Generalized Pareto Mixture Distribution Approach to Network Modeling and Performance Evaluation 1

Published

October 12, 2021

Author(s)

Z Q. Lu, N Sedransk

Abstract

A recurring theme in Internet network traffic analysis is that most observed data show characteristics of a long (heavy) right-tail distribution taking on nonnegative values. Thus, extreme value distribution such as generalized Pareto distribution (GPD) provides a natural setup for modeling the tail behavior of network data. On the other hand, due to the enormous diversity in network traffic at different time scales, at different nodes, different sources or protocols, it is necessary to introduce a more flexible framework using finite mixtures. We believe that the generalized Pareto mixture distribution (GPMD) is such a general model and it should form a theoretical basis for any anomaly detection algorithms for extreme events detection. We will demonstrate these points through applying to the popular RTT pingER data. For example, in terms of pingER RTT performance, users might have felt more frequent network slowdowns even if the median performance improved after a NIST network upgrade. Potential extensions to include temporal dependence and continuous time process are also discussed. Our GPMD methodology as a powerful tool for detecting perturbations at extreme events may prove useful in other areas of network security.

Citation

IEEE Transactions on Signal Processing

Pub Type

Journals

Keywords

Anomaly detection in extreme events, extreme value theory, finite mixtures, generalized Pareto distribution, network latency, quantile estimation, tail metrics

Citation

Lu, Z. and Sedransk, N. (2021), Generalized Pareto Mixture Distribution Approach to Network Modeling and Performance Evaluation 1, IEEE Transactions on Signal Processing (Accessed April 24, 2024)