【作者】 高波；

【导师】 张乃通； 张钦宇；

【作者基本信息】 哈尔滨工业大学 ， 信息与通信工程， 2013， 博士

【摘要】 网络测量是对网络进行有效管理、维护和安全保障的重要手段，通过对测量数据的分析，可以了解网络的运行环境以及网络服务状态等方面的情况，为网络的升级或改建提供必要的参考。在网络测量范畴内，由于网络流量融合了网络运营时所有的信息，是最基础也是最关键的测量数据，因此对网络流量数据的分析与研究格外重要。而随着物联网、泛在网络等概念的提出，下一代互联网骨干网各节点之间、局域网各节点之间的网络流量数据将呈现大幅度增长，互联网流量即将迈入大数据时代。在大数据流量背景下，网络业务类别的急剧增加导致网络流量性质发生改变，传统的流量模型已不适用于当今乃至下一代互联网流量的分析与预测，因此对网络流量建模的研究势在必行。网络流量模型可以生成不同特征的流量数据，用于检验新型网络设备的功能与质量，有助于衡量网络设备与业务流量之间的匹配问题，对研发下一代互联网技术和基础设施具有重要意义。网络流量模型还可用于流量的预测：做为一种重要的预警手段，网络流量的预测结果指明了网络流量未来的趋势，可根据这种趋势调整相应网络资源，保证网络业务的服务质量；通过对流量预测值的分析，依据相应判别准则，能够提前发现网络异常，及时采取有效措施，将损失减小到最低。本文旨在建立能够刻画网络流量特性和预测网络流量趋势的两类模型，主要研究内容可归纳为以下几个方面：第一，网络流量特性的分析与研究。网络流量的特性是网络流量建模的基础。首先，从数学角度分析了泊松过程的二阶矩函数无穷级数与自相似过程的二阶矩函数无穷级数之间的差异；然后，给出了泊松过程和自相似过程在不同尺度下的聚合流量变化趋势，分析表明自相似网络流量的尺度特征是由其长相关性质所引起，说明长相关性质是刻画网络流量建模的关键；最后对几种典型的网络流量模型进行了比较，重点讨论了ON/OFF模型和ARMA类模型的特点和建模过程，为后文C-ON/OFF模型和EMD-ARMA模型的建立提供了必要的理论基础。第二，C-ON/OFF模型的建立。针对以往的长相关流量模型计算复杂度较高且大多数模型物理意义不明确的问题，在研究了ON、OFF周期持续时间呈重尾分布的多个ON/OFF源合成流量性质的基础上，结合互联网中广泛存在的网络用户行为趋同性对现有ON/OFF模型进行了改进。通过对Hurst参数和自协方差函数衰减速度两项指标的分析，确立了各ON/OFF源之间相关性与合成流量长相关性的关系。基于以上结果，建立了一个结构简单、计算复杂度低、物理意义明确的网络流量模型——C-ON/OFF模型，并通过对C-ON/OFF模型参数的定量分析，得到了模型参数与生成流量长相关性的内在联系，进一步揭示了网络流量长相关性质与网络趋同性之间的关系，对未来网络流量建模研究提供了技术参考。第三，EMD-ARMA模型的建立。通过分析经验模式分解过程，从理论推导和仿真实验两个方面证明并验证了长相关流量数据经过经验模式分解之后得到的固有模式函数是短相关流量数据。短相关模型具有比长相关模型复杂度低的优势，因此，采用短相关模型对经验模式分解后的流量数据进行建模。基于经验模式分解的去长相关作用，以及ARMA模型的低复杂度优点，提出了EMD-ARMA模型，详细讨论了EMD-ARMA模型的建立过程，分析比较了EMD-ARMA的参数估计方法。针对两类实测互联网流量数据，在归一化自协方差指标下，检验了EMD-ARMA生成流量的性质，结果显示EMD-ARMA模型不但能够有效去除网络流量的长相关性，而且可明显降低流量模型的计算复杂度，为后文的网络流量预测提供了坚实的基础。第四，基于EMD-ARMA模型的网络流量预测。证明了在均方误差最小条件下的网络流量时间序列广义最优预测值的存在性和唯一性，并研究了线性条件下的最优均方预测值的性质。给出了EMD-ARMA模型的单步和多步预测系统结构：针对单步预测系统中存在的误差问题，提出了一种提升精度的方法，并依此对系统结构进行了改进，简化了模型，降低了模型的计算复杂度；推导了多步预测系统中预测误差与预测步长的数学关系，通过仿真实验对上述关系进行了验证，并根据多步预测系统中更新数据的信息量，给出了多步预测条件下的预测值修正方法。仿真结果表明，EMD-ARMA模型更适合于网络流量的短期预测，对网络的资源调配、异常监测等方面具有重要的应用价值。更多还原

【Abstract】 As an effective approach to managing, maintaining and securing networks, themeasured data obtained from network measurement can provide the necessaryreference to the upgrade and alteration of the network in terms of monitoring thenetwork environment and network service status. In network measurement, since thenetwork traffic incorporates all information about network operating, networktraffic is the most fundamental and critical data. Therefore, it is very important toanalysis and research network traffic data. With the development of Internet ofThings (IoT) and ubiquitous networks, the network traffic in backbone nodes andlocal area network (LAN) nodes of the next generation Internet is explosivelygrowing and these phenomenons indicate that we are towards a Big Data era. In thiscontext, characteristics of network data are dramatically changed by diversities ofnetwork services, and traditional traffic model does not work for the analysis andpredication of the next generation Internet. Therefore, it is imperative to investigatethe establish-ment of network traffic.Network models can be used to generate network data with differentcharacteristics, and used to test the functionalities and qualities of network devices.These can address the matching problem between network devices and servicetraffic, which has a prominent effect on developing network devices for nextgeneration networks. Network traffic model can also be used to predict future traffic.As an effective indicator, traffic predication can indicate the trend of future networktraffic, and people can adjust the associated network resources to guarantee thequality of service (QoS) according to this trend. By predicting the traffic, someabnormal behaviors can be detected in advance, and some strategies can be taken toreduce the cost as low as possible. This dissertation is devoted to identifying thecharacteristics of network traffic and to predict the traffic trend. The main contentsare as follows.(1) Analysis on characteristics of network traffic. For traffic modelling, trafficcharacteristics are fundamentals. The difference between infinite series of second-order moment function of Possion process and that of self-similar process is firstlyinvestigated. Then the change trend of aggregate traffic of Possion process and self-similar process is provided in different scales. It is shown that the scale feature inself-similar process is determined by its long range dependence, indicating that theanalysis on long range dependence is the key to network traffic modelling.Advantages and disadvantages of several traffic models are compared, in which ON/OFF model and ARMA based models are highlighted. These can providetheoretic fundamentals to C-ON/OFF and EMD-ARMA models discussed in laterparts.(2) Establishment of C-ON/OFF model. By observing the complexity andphysical interpretation issues in long range dependence of traditional models, amodified ON/OFF model is established after research of ON/OFF model’scharacteristics with heavy-tailed distribution and Internet users’ behaviorhomogeneity. By analyzing Hurst parameters and attenuations of autocovariancefunctions, the correlation between ON/OFF sources and long range dependencenetwork traffic is identified. Based on these results, a simple and low-complexitywhile full of physical meaning model, namely C-ON/OFF model, is proposed. Byquantifying the modeling parameters in C-ON/OFF models, some naturerelationship between model parameters and traffic long range dependence is found,further revealing the relationship between long range dependence nature of networktraffic and network convergence, and providing technical reference for futurenetwork traffic modeling.(3) Establishment of EMD-ARMA model. Through the analysis of empiricalmode decomposition (EMD), both theoretical analysis and simulation experimentsprove that the intrinsic mode function of the long range dependence data obtainedafter EMD is short range dependence flow data. The short range dependence modelhas the advantage of lower complexity than long range dependence. Based onEMD’s operation of the removing long range dependence, as well as the advantagesof low complexity of the ARMA model, EMD-ARMA model is proposed.Parameters estimation methods of EMD-ARMA model are compared and discussedin detail. Based on two types of empirical data from the Internet, characteristics ofEMD-ARMA are verified in terms of normalized autovariance, showing that theproposed EMD-ARMA model not only reduces the long range dependence, but alsoreduces the computational complexity. This will provide a solid fundamental fornetwork traffic predication.(4) Traffic predication of EMD-ARMA model. It is proved that, a generalizedoptimal predictive value of the time series of network traffic in the minimum meansquare error exists and is unique. The nature of the optimal linear conditions meansquare prediction value is also studied. The structure of the EMD-ARMA model ofone step and multisteps ahead prediction system is given. Facing system errors inone step ahead prediction, after in-depth research, a scheme to enhance the accuracyof the method is obtained. This further simplifies model, reduces the computationalcomplexity of the model. Relationship between prediction errors and prediction steps in multisteps ahead prediction system is mathematically found, and is verifiedthrough simulation experiment, and according to the updated data. Based on theamount of information in a multisteps ahead prediction system, the correctionmethod for multisteps ahead prediction is given. It is shown that EMD-ARMAmodel is more suitable for short-term prediction of network traffic, networkresource allocation, exception monitoring and has important applications.更多还原