## 2 Network Tomography Model and Classification Overview
### Network Tomography Classification Overview  
Network tomography can be classified into various categories depending on the type of the observed data (measurements) and the performance parameters of interest [1; 2]. More precisely, we can distinguish the following three wide classes of tomographic approaches (Figure 1):  
* _Link-level parameter estimation_: vector \(\mathbf{Y_{t}}\) consists of end-to-end traffic measurements such as accounts of delivered/lost packets and time delays (differences) between packet transmissions and receptions. The unknown variables (i.e., vector \(\mathbf{X_{t}}\)) are the link metrics, which are typically additive, meaning that the path metric obtained by combining multiple serial links is the sum of the individual link metrics. Time delays are a good example of an additive metric, whereas a multiplicative metric, such as loss rates, can be expressed in an additive form by using the logarithmic function. Since these end-to-end path measurements are carried out between pairs of nodes with monitoring capabilities, the decision of which nodes will be chosen as monitors becomes a key problem. This category can be further divided based on the different application contexts and the specific link metric used (e.g., loss tomography [8; 9; 10], delay tomography [11; 12; 13], bandwidth tomography [14], etc.) * _Path-level traffic intensity estimation_[15; 16; 17]: the goal is to estimate the traffic volume (or to infer the distribution of the flowing traffic) of end-to-end routes between all pairs of nodes in the network based on the observed traffic volumes on individual links. At a practical level, the involved link aggregate data are acquired by monitoring the total number of packets traversing the respective nodes. The combination of the traffic intensities of all these origin-destination pairs forms the _origin-destination (OD) traffic matrix_. Hence, this category aims at the inference of OD traffic matrices (\(\mathbf{X_{t}}\)) based on (aggregated) link traffic counts (\(\mathbf{Y_{t}}\)). This is the original NT problem studied in [18]. * _Topology inference_[19; 20; 21; 22; 23]: the network topology, which is expressed by the routing matrix \(\mathbf{A}\), is unknown. Hence, in this category, the goal is the inference of the topology based on end-to-end measurements conducted at the network edge and obtained without the cooperation and the participation of the internal nodes. These measurements evaluate the degree of correlation between receivers. Network topology is usually examined in terms of the logical topology, which is defined by the branching points between paths to different destination nodes. Internal nodes where no branching of traffic occurs do not appear in the logical topology. The central idea of the methods in this category is to obtain a measure of similarity between pairs of terminal nodes (i.e., source and destination) by means of end-to-end measurements that behave as a monotonically increasing function of the number of shared links or common queues between the two receiving nodes. Knowledge of the pairwise similarity metric values under an additive metric is sufficient to completely identify the logical topology by employing various statistical techniques such as hierarchical clustering, maximum likelihood, and Bayesian inference. Similarly, network tomography can be further categorized based on the measurement methodology, i.e., the way in which the end-to-end or link-level measurements are acquired. In particular, the distinction is made between active network probing and passive traffic monitoring. Active techniques collect measurements by explicitly sending out probe packets between the participating nodes in order to measure a specific end-to-end characteristic. Passive techniques observe already existing network traffic and occurring packet sequences. Since they analyze the regular data flow, no extra network resources are consumed. However, because of exclusively observing existing communications, there is a negative impact in terms of flexibility.