Ongoing work on MRA of traffic matrices

Internet Traffic Matrices (TMs), giving traffic volumes from ingress to egress nodes in a network, are a basic input to many network engineering tasks, but are non-trivial to measure, and so much work has gone into measurement or their indirect inference [1] from readily available link load measurements. In the latter case, however, the measurements do not provide enough information to form a well-posed inference problem, and therefore some type of side information (usually in the form of a traffic matrix model) is needed to perform the inference. Network engineering with TMs also needs models. For instance, we may need to predict a traffic matrix at some time in the future. In addition, we may wish to detect anomalous traffic behaviour, and a simple approach is to look for large deviations from predicted behaviour. The problem of finding a “good” model for TMs is problem dependent. The criterion we focus on here is that the traffic matrix model should be sparse. A traffic matrix for a network with N nodes has N terms, and since N can be in the thousands, the number of terms in the traffic matrix can become very large. A sparse model has a number of parameters M ? N. There are good reasons for a sparse model: • There is a tradeoff between model fidelity and the model’s predictive power. A model with a large number of parameters may work well for one dataset, but provide bad predictions because it is too specific. • If the model has few parameters then we have more hope of attaching physical meaning to them. • The inference problem is ill-posed when we have K = O(N) link-load measurements, but N parameters that we need to estimate. If the TM model had M ≤ K parameters, then the problem might become well posed. Often, approaches to TM inference have sought some kind of sparse model for the matrices, with a view that this will bring the problem back towards being well-posed. The gravity model [1] is a good example, with only 2N parameters. However, in this case the model itself is not a particularly accurate representation of a TM, it simply forms a prior used in a regularization approach for inference. Our approach for finding such a sparse model is to use Multi-Resolution Analysis (MRA). The sparseness of the coefficients is the leading reason why modern audio and video compression techniques often use MRA techniques such as wavelets. Unfortunately, standard wavelet-based MRA analysis is not appropriate for traffic matrices. In a TM the spatial relationships between elements are more complicated than in an image, which is a rectangular grid sampling of a two-dimensional field. We exploit the new Diffusion Wavelets (DW) approach [2] and perform multi-resolution analysis of functions defined on graphs. The graph may represent the underlying network (over which our traffic matrix is routed), and thus reflect the natural spatial relationships in the TM (i.e., two traffic matrix elements originating from locations close together in the network may share characteristics such as their diurnal traffic pattern). One of our contributions is to generalize Diffusion Wavelets to 2D and apply them to modelling traffic matrices, which we see as two-dimensional functions of the nodes. In our first experiments with real data from operational networks we found that in the DW domain traffic matrices are sparse.