Early Detection of Increasing Traffic with Distributed Traffic Measurement

With the spread of broadband access lines, many bandwidth-consuming services such as video streaming have appeared. The popularity of these services can cause problems such as the shortage of the Internet backbone capacity, so it is important to detect increasing traffic caused by these services early. Conventional detection method called aggregation method tries to detect increasing traffic by predicting its future traffic volume with linear approximation. However, the aggregation method may not cope with increasing traffic whose growth is more rapid than linear growth. In this paper, we propose an early detection method (partial aggregation method) of increasing traffic under per-subnet based distributed traffic measurement. The method predicts 1) future traffic volume for each address in each subnet and 2) the number of subnets having increasing traffic in the future with a linear approximation. Then, the method estimates future traffic volume for each address as a product of the predicted future traffic volume in each subnet and the predicted subnet number. As a result, the method is expected to cope with rapid growth in traffic volume. Simulation results show that the partial aggregation method can detect increasing traffic earlier than the aggregation method by a maximum of 90 days.