Statistical analysis of local features in network traffic processes

This work presents an approach to the detection of local features in network traffic, based on the analysis of short-time maximal rate envelopes, also called statistical arrival curves. In the proposed method, the time series representing a traffic trace is divided into non-overlapping segments, which are further divided into smaller blocks. The maximal rate envelope is estimated for each block and histograms of rate parameters are built over each segment. When significant local features are present in a trace segment, values of the maximal rates may change, resulting in the appearance of peaks or long tails in the corresponding histograms. These effects can be detected with remarkable sensitivity, since they are often evidenced by positive or negative peaks in skewness values of rate parameters histograms. The algorithm can be employed to detect such features on a reasonably fine-grained scale.