JP2005086566A - Traffic volume estimation method and packet discard prevention method using the estimation method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable an average maximum traffic volume at shorter time intervals to be estimated without increasing a load of a network and a packet discard to be prevented. <P>SOLUTION: Average traffic at concerned each time interval is repeatedly obtained for time intervals based on measured data, and distributed values are obtained for each time interval. On the basis of the distributed values obtained, a distributed value σ at a time interval T shorter than the time interval is estimated by using a self-similarity of traffic, and an average maximum traffic volume at the time interval T is estimated on the basis of the average traffic volume and the distributed value σ based on the time interval of the measured data. Thus, the average maximum traffic volume of the time interval T is estimated, and a capacity of a buffer accumulating a transmission packet once is adjusted in accordance with the estimated maximum traffic volume, thereby preventing a buffer overflow of the transmission packet. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a method for estimating the traffic volume of a communication line such as the Internet and a packet discarding prevention method using the same.

  A system (line monitoring system) for monitoring the traffic volume of the Internet line is regularly supplied with measurement data from a traffic volume measuring device provided in the middle of the line. For example, every 30 minutes, the measuring device supplies an average traffic volume for 30 minutes as measurement data to the line monitoring system through the Internet line. As described above, since the measuring apparatus transmits data through the Internet line, a transmission interval (measurement interval) of the measured average traffic amount is set to some extent so as to suppress an increase in communication amount and suppress a load applied to the network as much as possible. The measurement interval of the measuring device is normally set to 30 minutes or more, for example, and is set to 5 minutes or more even if it is short.

  FIG. 4 shows the average traffic amount when the measurement interval is 5 minutes, that is, the average traffic amount every 5 minutes. In FIG. 4, the vertical axis represents the traffic volume (unit: Mbps), and the horizontal axis represents the elapsed time.

N.G.Duffield, P.Goyal, A.Greenberg, P.Mishra, K.K.Ramakrishnan, and J.E.V.der Merwe, "A flexible model for resource management in virtual private networks," in ACM Sigcomm, San Diego, California, USA, Augast 1999.

  By the way, in some applications used by the user using the Internet, it is sometimes necessary to guarantee the delay time in a short time of 5 minutes or less. For example, a streaming service application that is frequently used in the Internet in recent years is for streaming video from a server to a user client. However, in order to be safe to some extent even if communication is interrupted while video is being distributed, Play while storing data. However, when a transmission delay occurs in the Internet, a situation occurs in which data cannot reach the user and reproduction cannot be satisfied. In many cases, the size of the buffer is usually 10 seconds, and if a delay of 10 seconds or more occurs, there is a possibility that a reproduction failure may occur. Therefore, FIG. 5 shows the same traffic as in FIG. 4 recalculated on the average for 10 seconds, that is, the traffic recalculated to the average traffic amount every 10 seconds.

  For example, since the traffic amount does not exceed 8 Mbps in the monitoring information in which the traffic amount is measured with an average of 5 minutes as shown in FIG. 4, the operating line speed is 8 Mbps. However, as shown in FIG. 5 in which the traffic volume is averaged and recalculated for 10 seconds, which is the condition of the application, the traffic volume may exceed 8 Mbps. At this time, the amount exceeding the line capacity is stored in the Internet node. As a result, data transmission delay occurs on the Internet line, and there is a possibility that the reproduction of the application may be defective. In order to prevent such a data transmission delay, if the measurement interval of the average traffic amount by the measuring device is shortened from 5 minutes to 10 seconds, the increase in monitoring information will cause network pressure this time. Therefore, it is virtually impossible to shorten the measurement interval.

  In addition, there is a switch for exchanging a line in the network line of the Internet, and this switch is provided with a buffer for temporarily storing inflowing traffic. The capacity of this buffer needs to be suitable for the traffic volume. If the buffer capacity is too small for the inflow traffic, the buffer overflows and the packets are discarded. On the other hand, if the buffer capacity is too large with respect to the inflow traffic, the number of packets staying in the buffer increases, and as a result, packet transmission delay occurs more than necessary. That is, if the buffer capacity is not appropriate with respect to the inflow traffic volume, it causes a communication failure.

  Therefore, in order to guarantee that the user application operates more normally, the maximum traffic volume is set based on the shorter time average traffic volume that matches the operation conditions of the application from the monitoring information of the existing line monitoring system. It is necessary to estimate, and it is necessary to appropriately set the buffer capacity of the switch into which traffic flows according to the maximum traffic volume.

  An object of the present invention is to provide a traffic amount estimation method capable of estimating the maximum traffic amount with an average time interval shorter than the data measurement time interval without increasing the load on the network. It is another object of the present invention to provide a packet discard prevention method for preventing packet discard by determining the maximum traffic volume in this way.

In order to estimate the maximum amount of traffic at a time interval shorter than that time interval (a time interval that matches the operating conditions of the application) based on the average traffic amount measured at a time interval that does not load the network, It uses a property called self-similarity of traffic characteristics. This traffic self-similarity is the property that the amount of traffic on the Internet is similar to the variance value of the traffic amount even if the time interval to be measured is changed. That is, the traffic self-similarity is defined as follows. Now, let Xt be the number of packets generated in the t-th time interval. Let X = (Xt: t = 0, 1, 2, 3,...). X is divided into m blocks, and the average value of the elements of each block is represented by X _k ^(m) . That is, Formula 2.
Let X ^(m) = ( _Xk ^(m) : k = 1, 2, 3,...). If var (X ^(m) ) ^{m -β} holds for all m = 1, 2,..., The process X has a self-similarity in the second order. As an evaluation index for quantitatively evaluating this property, there is a Hurst parameter which is a parameter indicating how much the dispersion value changes when the time interval to be measured is changed.

  For example, the traffic amount of the line to be monitored is extracted from an existing line monitoring system. A variance value is calculated based on this data. At this time, a variance value is calculated for a plurality of time intervals. In other words, if the existing rotation monitoring system measures the average traffic amount at every time Ta, in addition to the data at every time Ta, the data at every time (2 × Ta), the data every time (3 × Ta) ,... Can be obtained, and the dispersion value is calculated for each of these time intervals Ta, 2Ta, 3Ta,.

  A Hurst parameter is calculated from the variance value for each time interval thus calculated, and the variance value σ at a desired time interval T (T <Ta) is estimated based on the Hurst parameter. Further, the maximum traffic amount is calculated by Equation 3 based on the estimated variance value σ.

[Equation 3]
Maximum traffic volume = Traffic volume of existing line monitoring system + a x σ ^1/2
Here, the parameter a is a correction value determined by performing a test before the estimation method of the present invention is performed so that the estimated maximum traffic amount matches the actually measured maximum traffic amount.

  That is, in the traffic amount estimation method according to claim 1, the average traffic amount is repeatedly obtained for each time interval for a plurality of time intervals based on the measurement data, and a dispersion value is obtained for each time interval. Based on the value, the self-similarity of traffic is used to estimate the variance value σ at the time interval T shorter than the time interval, and the time interval based on the average traffic amount based on the time interval of the measurement data and the variance value σ T-average maximum traffic amount is estimated.

  Therefore, based on the average traffic amount measured at a time interval that does not place a load on the network, it is possible to estimate the maximum traffic amount with a time interval T average shorter than that time interval.

  In this case, as in the traffic amount estimation method according to claim 2, a correction value a that compares the maximum traffic amount of the time interval T average experimentally measured with the estimated maximum traffic amount to reduce the difference therebetween. Is calculated in advance, and the maximum traffic amount of the time interval T average is estimated while considering the correction value a. In this way, the maximum traffic volume can be estimated more accurately.

  Further, it is preferable to calculate the maximum amount of traffic of the time interval T average based on Formula 4 as in the traffic amount estimation method according to claim 3.

[Equation 4]
Maximum traffic amount = average traffic amount of time interval of measurement data + a × σ ^1/2

  Furthermore, the packet discard prevention method according to claim 4 estimates the maximum traffic volume of the time interval T average by the method according to any one of claims 1 to 3, and estimates the capacity of a buffer for temporarily storing transmission packets. It adjusts according to the maximum traffic volume and prevents buffer overflow of transmission packets.

  Therefore, the buffer overflow of the transmission packet can be prevented, and the packet discard due to the buffer overflow can be prevented.

  Therefore, in the traffic amount estimation method according to claim 1, it is possible to estimate the maximum traffic amount with an average time interval shorter than the data measurement interval without imposing a load on the network. In addition, it is possible to estimate the maximum amount of traffic with a short time interval average using measurement data of an existing line monitoring system.

  In this case, the maximum traffic volume can be estimated more accurately by using the traffic volume estimation method according to claim 2.

  More specifically, it is preferable to use the traffic amount estimation method according to claim 3.

  Furthermore, in the packet discard prevention method according to the fourth aspect, for example, it is possible to prevent the packet from being discarded by preventing the buffer overflow of the switch of the Internet line.

  Hereinafter, the configuration of the present invention will be described in detail based on the best mode shown in the drawings.

  FIG. 1 shows an example of an embodiment of a traffic amount estimation method to which the present invention is applied. This traffic volume estimation method repeatedly calculates an average traffic volume for each time interval for a plurality of time intervals based on measurement data, obtains a variance value for each time interval, and based on each obtained variance value, determines traffic. The variance value σ in the time interval T shorter than the time interval is estimated using self-similarity, and the average traffic amount based on the time interval of the measurement data and the maximum traffic amount of the time interval T average based on the variance value σ Is estimated. Then, a correction value a for reducing the difference between the estimated maximum traffic volume and the estimated maximum traffic volume at the time interval T measured experimentally is obtained in advance, and the time is calculated while considering the correction value a. It is preferable to estimate the maximum traffic amount of the interval T average. Specifically, it is preferable to calculate the maximum traffic amount of the time interval T average based on Equation 5.

[Equation 5]
Maximum traffic amount = average traffic amount of time interval of measurement data + a × σ ^1/2

  For example, a procedure for estimating a maximum traffic amount at a required time interval T (for example, every 10 seconds) based on measurement data (traffic data) of an average traffic amount at a time interval Ta (for example, 5 minutes) will be described as an example. . Note that the measurement data of the average traffic volume at intervals of 5 minutes (Ta) can be obtained by the existing network line monitoring system 1.

  Step (1): As the traffic data (X (t)) of the monitoring target line 3 of the network 2, the average traffic amount for 5 minutes is acquired every 5 minutes. This traffic data (measurement data) is acquired from the existing line monitoring system 1 that monitors the traffic volume of the monitoring target line 3.

  Step (2): A variance value is calculated in real time based on traffic data for a certain fixed time immediately before.

  Step (3): The calculated dispersion value is approximated by a straight line, and its slope is obtained. An average variance value σ of 10 seconds is estimated from the obtained slope. Then, based on Equation 6, the next maximum 5-minute average traffic amount is calculated. Note that the parameter a is determined in advance according to traffic characteristics, errors allowed in operation, and the like.

[Equation 6]
Maximum traffic amount = X (t) + a × σ ^1/2

  A case will be described as an example where traffic data (measurement data) is obtained from the line monitoring system 1 at an average time interval of 300 seconds (5 minutes). This traffic data is time-series data with an average time interval of 300 seconds. Further, based on the 300-second average time-series data, time-series data having a time interval that is an integral multiple of 300 seconds, such as 600-second average, 900-second average,... And each dispersion value is calculated | required from the time series data of each time interval. In other words, the first aspect of “obtaining a dispersion value for each time interval by repeatedly obtaining an average traffic amount for each time interval based on measurement data” is performed. The graph of FIG. 1 plots the variance values for each time interval.

  Next, the decreasing tendency of the dispersion value at a time interval of 300 seconds or more is approximated by a straight line. It is known from the Internet traffic self-similarity that when the variance value of each time interval is plotted in the graph of FIG. 1, the plot position can be approximated by a straight line having a certain slope. Let the slope of this straight line be β. That is, β is a Hurst parameter. The obtained straight line is extended to a desired time interval T (a direction in which the time interval is short), and the magnitude of dispersion in the time interval T is estimated. That is, the value on the horizontal axis and the value on the vertical axis corresponding to the straight line in the graph of FIG. That is, “Estimating the dispersion value σ at a time interval T shorter than the time interval using the self-similarity of traffic based on each obtained dispersion value” is executed.

The variance value is an index indicating how far the average value deviates. Since the traffic data from the line monitoring system 1 is an average value every 300 seconds, in order to estimate the maximum traffic amount averaged for 10 seconds, a deviation (σ ^{1/2) obtained} by taking the square root of the variance value σ to this average value. ). How much time series data is included between the average value and the deviation depends on the data distribution. For this reason, the estimated magnitude of dispersion (dispersion value σ) is multiplied by a parameter (correction value) a, and the obtained value is added to the average value to obtain a maximum traffic amount of 10 seconds average. That is, “estimating the maximum traffic amount of the time interval T average based on the average traffic amount based on the time interval of the measurement data and the variance value σ” of claim 1 is performed. The maximum traffic volume of the time interval T average is estimated in consideration of the above. Specifically, the maximum traffic volume of the time interval T average is calculated based on Equation 7.

[Equation 7]
Maximum traffic volume = 300 seconds interval average traffic volume of measured data + a x σ ^1/2

  The above is a qualitative description of the traffic amount estimation method of the present invention. Next, the procedure of the traffic amount estimation method of the present invention will be described quantitatively.

  Let Xt be the traffic amount averaged for 300 seconds obtained from the line monitoring system 1 of the network 2. t is an index representing the time order of time series data. Let X = (Xt: t = 0, 1, 2, 3,...).

Based on the 300-second average time-series data Xt, the time-series data of the traffic amount that is an integral multiple of 300 seconds such as the 600-second average and the 900-second average is calculated. X is divided into m blocks, and the average value of the elements of each block is represented by X _k ^(m) . That is, Formula 8 is obtained.

A set of time series data X _k ^(m) created in this way is _represented by Equation 9.

[Equation 9]
X ^(m) = ( _Xk ^(m) : k = 1, 2, 3, ...)
Here, X ⁽¹⁾ corresponds to a set of 300-second average time-series data, X ⁽²⁾ corresponds to a 600-second average time-series data, and so on.

A variance value is obtained from X ^(m) at each time interval. First, an average value of a set X _k ⁽¹⁾ of basic 300-second average time-series data is calculated from Equation 10. Here, N is the number of data.

  Next, a dispersion value is calculated using this average value. The formula is shown in Formula 11.

Similarly, an average value and a variance value are calculated for a set of time series data X ⁽²⁾ , X ⁽³⁾ ,... At other time intervals. Assume that the set is var (X ^(m) ), m = 1, 2,.

Assuming that var (X ^(m) ) ∝m− ^β holds at m = 1, 2,..., ^β is obtained from var (X ^(m) ) calculated from the measurement data using the least square method.

Assuming that var (X ^(m) ) ∝m ^−β holds, when the estimated time interval T (10 seconds) is m ₁ and the measured time interval (300 seconds) is m ₂ , the proportional relationship of Equation 12 is Since this holds, var (X ^(m1) ) to be obtained is given by Equation 13.

  Formula 14 is considered in order to estimate the maximum value (maximum traffic amount).

This is to evaluate whether time series data falls below this value by adding X ^(m2) as an average value and adding the deviation of the distribution multiplied by the parameter (correction value) a. In general, the magnitude of the deviation is multiplied by the parameter a to control the frequency of occurrence of the distribution falling below this value. The frequency of occurrence is determined by the shape of the distribution. Data exceeding the estimated value is an estimation error, and how much error is allowed depends on the operation policy of the network 2. Here, the equation 14 is applied to the actually measured data X ^(m2) , and the parameter a is determined based on the occurrence frequency determined according to the operation policy.

  As an example, consider a case where a 10-second average is estimated from a 300-second average using the obtained β.

Since the estimated time interval of 10 seconds is considered as the basic time series data, m ₁ = 1. In addition, since the time-series data averaged for 300 seconds is 30 times the time interval of the basic time-series data (m ₁ = 1), Equation 15 is obtained with m ₂ = 30.

  First, the variance value is estimated according to Equation 15, and then the maximum traffic amount is estimated according to Equation 16.

  As described above, according to the estimation method of the present invention, the maximum traffic volume with a shorter average time interval can be estimated based on the measurement data with a relatively long time interval average. The maximum traffic volume with an average time interval can be accurately estimated, and the maximum traffic volume with a short time interval average can be accurately estimated using the measurement data of the existing line monitoring system 1.

  In actual operation, the correction value a is considered in calculating the maximum traffic volume, so that the maximum traffic volume can be estimated more accurately.

  Next, the packet discarding prevention method of the present invention will be described. FIG. 2 shows the concept of the packet discard prevention method. In this packet discard prevention method, the maximum traffic amount of the time interval T is estimated by the above estimation method, and the capacity of the buffer 5 for temporarily storing the transmission packet is adjusted according to the estimated maximum traffic amount, and the buffer of the transmission packet is adjusted. This is to prevent overflow.

  The buffer 5 for adjusting the capacity is, for example, a buffer in the switch 4 installed in the monitoring target line 3. Traffic flowing through the monitored line 3 flows into the switch 4. The switch 4 temporarily stores the packet in the buffer 5 and then controls the traffic. For this reason, the switch 4 needs to be provided with a buffer 5 having a capacity capable of sufficiently storing inflowing traffic. However, if the buffer capacity of the switch 4 is too large with respect to the traffic volume, the accumulated amount of packets increases, so that the residence time in the buffer increases, resulting in an increase in transmission delay. Therefore, if the buffer capacity is large The larger the size, the better. The buffer capacity needs to be appropriate.

  In the packet discarding prevention method of the present invention, the capacity of the buffer 5 of the switch 4 is adjusted according to the maximum traffic amount estimated by the above-described estimation method, so that the buffer overflow of the transmission packet due to the insufficient capacity of the buffer 5 is prevented. This can prevent the packet from being discarded. In other words, if the output line speed from the switch 4 is equal to or higher than the average traffic volume, packet discard due to buffer overflow can be reliably prevented. Further, since the capacity of the buffer 5 does not become larger than necessary, transmission delay does not occur due to the capacity of the buffer 5 being too large, and waste of hardware resources can be prevented. it can. That is, the capacity of the buffer 5 can be set appropriately.

  Note that the buffer capacity of the switch 4 may be automatically adjusted, or may be adjusted manually. The automatic adjustment of the buffer capacity is performed as follows, for example. That is, the maximum traffic amount estimated by the above estimation method minus the output speed of the switch 4 is notified to the switch 4 and set as the buffer amount. This is possible by connecting to the switch 4 using the SNMP protocol and changing the set value. It is possible to automatically adjust the buffer capacity by preparing a series of these commands, in which command commands called scripts are written and executing them.

  The above-described embodiment is an example of a preferred embodiment of the present invention, but is not limited thereto, and various modifications can be made without departing from the scope of the present invention. For example, in the above description, the time interval T shorter than the measurement time interval is 10 seconds as an example, but it is needless to say that the time interval T is not limited to 10 seconds.

  In the above description, the correction value a is obtained in advance, and the maximum traffic amount is estimated in consideration of the correction value a. However, for example, depending on the required accuracy, the correction value a may not be considered. good. Further, the correction value a need not be considered even when the maximum traffic amount can be accurately estimated without considering the correction value a.

(Evaluation of this estimation method based on actual measurement data)
In order to evaluate the traffic amount estimation method of the present invention, the traffic amount was measured by a wide area Ethernet network (Ethernet is a registered trademark), and the estimation method was evaluated.

The average throughput data of 5 minutes (300 seconds) is obtained from the line monitoring system 1 of the network 2, and this is defined as X ⁽³⁰⁾ . The maximum traffic volume to be estimated is the maximum value of the traffic volume calculated with an average of 10 seconds during the 300 seconds.

  By the way, the 5-minute average data obtained from the line monitoring system 1 is a result calculated after collecting data for a maximum of 5 minutes. Therefore, it is considered that this data appears with a delay of 5 minutes from the actual measurement. In this evaluation, taking this point into consideration, the estimated maximum traffic volume was calculated with a time difference of 5 minutes from the throughput data obtained from the line monitoring system 1.

X ⁽³⁰⁾ is an average value for 300 seconds, and it is considered to add a deviation (σ ^1/2 ) obtained by taking the square root of the dispersion value σ to the average value. Here, the maximum value (maximum traffic amount) estimated by changing the parameter a to be applied to the deviation value is changed, and the extent to which the actually measured data falls within the maximum value is analyzed.

  Formula 14 was used to estimate the maximum traffic volume. The parameter a is determined by the traffic characteristics, the size of the allowable error, etc. Here, for the first one hour, the traffic is measured by the traffic volume measuring device, and the estimated maximum traffic volume is changed to the actually measured maximum traffic volume. The parameter a was determined so as to match. Thereafter, the estimation method of the present invention was actually performed, and the maximum traffic amount was estimated for the measurement data obtained from the line monitoring system 1.

  Compared with measured data, we evaluated how often the estimated maximum traffic volume was exceeded. FIG. 3 shows the result applied to the measurement data. The horizontal axis indicates the size exceeding the estimated maximum value (estimated maximum traffic amount), and the vertical axis indicates the frequency number. In order to compare the performance, the maximum traffic amount was estimated without considering the self-similarity of traffic, that is, with β as a constant value. These results are shown in FIG.

  In the estimation method of the present invention, even if the actually measured value exceeds the estimated maximum value, most of the measured value only increased by about 30%. On the other hand, in the method that does not use the traffic self-similarity, the measured value is about 900% at the maximum, which is larger than the estimated maximum value. This means that the traffic self-similarity is not constant, but fluctuates dynamically, and unless this fluctuation is taken into account, the traffic characteristics at high time resolution cannot be accurately captured. It is done.

  Therefore, it can be said that the method of estimating the traffic characteristic (maximum traffic amount) using the self-similarity of the traffic is effective for capturing the traffic characteristic at a different time resolution. Especially useful for estimating traffic characteristics at desired time intervals to monitor application quality of service (QoS) conditions from data with low temporal resolution, such as information obtained from monitoring systems It can be said that.

  As described above, the estimation method of the present invention was applied and its performance was evaluated. For comparison, we also evaluated the case where traffic self-similarity was not used. As a result, it was confirmed that the maximum traffic amount can be effectively estimated by the estimation method of the present invention using the self-similarity of traffic.

It is a conceptual diagram which shows an example of embodiment of the estimation method of the traffic amount to which this invention is applied, and shows the procedure. It is a conceptual diagram which shows an example of embodiment of the packet discard prevention method to which this invention is applied, and shows the procedure. It is a figure which shows the evaluation result of the estimation method of the traffic amount to which this invention is applied. It is a figure which shows the average traffic amount for every 5 minutes. It is a figure which shows the average traffic amount for every 10 seconds.

Explanation of symbols

1 Line monitoring system 2 Network 4 Switch 5 Buffer a Parameter (correction value)
σ variance

Claims (4)

  Based on the measurement data, the average traffic amount is repeatedly obtained for each time interval for a plurality of time intervals, and a variance value is obtained for each time interval, and the traffic self-similarity is used based on each obtained variance value. Estimating a variance value σ in a time interval T shorter than the time interval, and estimating an average traffic amount based on the time interval of the measurement data and a maximum traffic amount of the time interval T average based on the variance value σ. A characteristic traffic amount estimation method.   A correction value a for reducing the difference between the maximum traffic volume of the average time interval T measured experimentally and the estimated maximum traffic volume is obtained in advance, and the time interval T is calculated while taking the correction value a into consideration. 2. The traffic amount estimation method according to claim 1, wherein an average maximum traffic amount is estimated. 3. The traffic volume estimation method according to claim 2, wherein the maximum traffic volume of the time interval T average is calculated based on the mathematical formula 1.
[Equation 1]
Maximum traffic amount = average traffic amount of time interval of measurement data + a × σ ^1/2 The maximum traffic volume of the time interval T average is estimated by the method according to any one of claims 1 to 3, the capacity of a buffer for temporarily storing transmission packets is adjusted according to the estimated maximum traffic volume, and the transmission packet A packet discarding prevention method characterized by preventing buffer overflow.