The demand for effective VoIP and online gaming traffic management methods continues to increase for purposes such as QoS provisioning, usage accounting, and blocking VoIP calls or game connections. However, identifying such flows has become a significant administrative burden because many of the applications use proprietary signaling and transport protocols. The question of how to identify proprietary VoIP traffic has yet to be solved. In this paper, we propose using a deviation-based classifier to identify VoIP and gaming traffic, given that such real-time interactive services normally send out constant-packet-rate (CPR) traffic with a fixed interval, in order to maintain real-timeliness and interactivity. Our contribution is two-fold: 1) We show that scale-free variability measures are more appropriate than scaledependent ones for quantifying the network variability injected into CPR traffic. 2) Our proposed classifier is particularly lightweight in that it only requires a few inter-packet times to make a decision. The evaluation results show that by only analyzing 10 successive inter-packet times, we can distinguishbetween CPR and non-CPR traffic with approximately 90% accuracy.

1. Rapid Detection of
Constant-Packet-Rate Flows
Jing-Kai Lou, Kuan-Ta Chen
Institute of Information Science, Academia Sinica
ARES 2008, 03/05 1

2. Talk Outline
Motivation
Investigation
Performance Evaluation
Summary
ARES 2008, 03/05 2

3. Motivation
Popular real-time and interactive applications:
VoIP, Real-time network games
Traffic management
Need of flow identification
A distinct characteristic of such traffic:
Constant Packet Rate
VoIP: Encoded continuous human voice
Real-time network game: game state updates
Key to identify VoIP and online gaming traffic:
CPR flow identification
ARES 2008, 03/05 3

4. Key Contribution
A CPR traffic classifier
Lightweight
10 successive inter-packet times
High Accuracy
90% identification rate
Client Client
Traffic stream
ARES 2008, 03/05 4

5. A Naive Method
Coefficient of Variation (CoV) of Inter-Packet Times
(IPT)
IPT CoV small CPR
IPT CoV large non-CPR
CPR Traffic IPT1= IPT1=…= IPTi
IPT1 IPT2 … IPTi
ARES 2008, 03/05 5

6. Ideal IPT Distribution
1
Density
0
0 200 400 600 800 1000
Inter-packet time (ms)
ARES 2008, 03/05 6

7. Collected Traces
Trace Flow IPT CoV Path Diversity
VoIP (Skype) 1739 0.37 1106 hosts / 1641 paths
Counter-Strike 1016 0.32 271 hosts / 270 paths
TELNET 276 1.53 140 hosts / 93 paths
HTTP 409 1.54 474 hosts / 325 paths
P2P 1303 1.63 645 hosts / 644 paths
World of Warcraft 1611 0.71 52 hosts / 39 paths
ARES 2008, 03/05 7

8. Real IPT Distributions
Why the IPT distributions of VoIP and
Counter-Strike are not as we expect?
ARES 2008, 03/05 8

9. Difficulties: Network Impairment
Host delay
Channel delay
Network queueing delay
Network packet loss
packet loss
delay traffic
CPR
after network impairment
Sender
ARES 2008, 03/05 9

10. More Difficulties
To do a decision with a few samples
short time
few storage space
In short scale, non-CPR traffic could look like CPR
Non-CPR Flow
ARES 2008, 03/05 10

11. Refreshment
Our goal
To search a good metric of IPT deviations for CPR detection
Challenges
Network impairment
Need of small sample size
ARES 2008, 03/05 11

12. Deviation Metric Design
Design factors for measuring variation
Function (FUN)
Sample Size (W)
Smoother Size (S)
ARES 2008, 03/05 12

13. Deviation Metric: Function (1/3)
Standard Deviation (SD)
∑iN 1 ( IPTi − IPT ) 2
SD = =
N
Coefficient of variation (CoV)
SD
CoV =
MEAN
ARES 2008, 03/05 13

14. Deviation Metric: Function (2/3)
Mean absolute deviation (MD)
∑iN 1 | ( IPTi − IPT ) |
MAD = =
N
Median absolute deviation (MAD)
∑iN 1 | ( IPTi − median( IPT )) |
MAD = =
N
ARES 2008, 03/05 14

15. Deviation Metric: Function (2/3)
Inter-quantile range (IQR)
IQR = Upper Quartile (75%) − Lower Quartile (25%)
Range
Range = max(IPT) − min(IPT)
ARES 2008, 03/05 15

16. Deviation Metric: Sample Size
Sample size (W): Number of IPT samples
W increases
Accuracy increases
Time/space complexity increases
Sample Time/Space
Accuracy
Size complexity
ARES 2008, 03/05 16

17. Deviation Metric: Smoother Size
Smoother size (S): Window size to smooth (mean)
W increases
Impairment effect decreases
False negative increases
Impairment
Window effect False
Size Negative
ARES 2008, 03/05 17

18. FUN=CoV, W=10, S=1
Does this estimator setting
achieve the best discriminative
power??
ARES 2008, 03/05 18

20. Performance Metric
ROC (Receiver Operating Characteristic):
TPR: ratio of true positive
FPR: ratio of false positive
AUC (Area Under Curve): Area under the ROC curve
AUC = 1, perfect classification
AUC > 0.8, generally good
AUC = 0.5 random guess
ARES 2008, 03/05 20

21. Effect of Deviation Metric
Dimensionless metric CoV performs the best!
ARES 2008, 03/05 21

22. Effect of Sample Size
Sample size increases
ROC Curve shifts left
AUC increases
ARES 2008, 03/05 22

23. Effect of Smoother Size
Improvement only for
large samples
ARES 2008, 03/05 23

24. Discrimination Performance
ARES 2008, 03/05 24

25. Summary
Proposed using IPT constancy to identify CPR flows
VoIP
Real-time gaming
Studied various design issues of IPT deviation estimators
Our classifier (CoV-based) yields an accuracy rate 90%
with only 10 IPT samples
ARES 2008, 03/05 25

26. ARES 2008, 03/05 26

28. packet loss
delay
after network impairment
Receiver
ARES 2008, 03/05 28