• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37B no.9
• /
• pp.849-858
• /
• 2012

We proposed a scheme to accurately detect elephant flows. Along the ever increasing traffic trend, certain flows occupy the network heavily in terms of time and network bandwidth. These flows are called elephant flows. Elephant flows raises complicated issues to manage for Internet traffics and services. One of the methods to identify elephant flows is the Landmark LRU cache scheme, which improved the previous method of Least Recently Used scheme. We proposed a cache update algorithm, to further improve the existing Landmark LRU. The proposed scheme improves the accuracy to detect elephant flow while maintaining efficiency of Landmark LRU. We verified our algorithm by simulating on Sangmyung University's wireless real network traces and evaluated the improvement.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.3 no.2
• /
• pp.134-146
• /
• 2009

Traffic classification seeks to assign packet flows to an appropriate quality of service(QoS) class based on flow statistics without the need to examine packet payloads. Classification proceeds in two steps. Classification rules are first built by analyzing traffic traces, and then the classification rules are evaluated using test data. In this paper, we use self-organizing map and K-means clustering as unsupervised machine learning methods to identify the inherent classes in traffic traces. Three clusters were discovered, corresponding to transactional, bulk data transfer, and interactive applications. The K-nearest neighbor classifier was found to be highly accurate for the traffic data and significantly better compared to a minimum mean distance classifier.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.8 no.4
• /
• pp.1307-1323
• /
• 2014

With the exhaustion of global IPv4 addresses, IPv6 technologies have attracted increasing attentions, and have been deployed widely. Meanwhile, new applications running over IPv6 networks will change the traditional traffic characteristics obtained from IPv4 networks. Traditional models obtained from IPv4 cannot be used for IPv6 network monitoring directly and there is a need to investigate those changes. In this paper, we explore the flow features of IPv6 traffic and compare its difference with that of IPv4 traffic from flow level. Firstly, we analyze the differences of the general flow statistical characteristics and users' behavior between IPv4 and IPv6 networks. We find that there are more elephant flows in IPv6, which is critical for traffic engineering. Secondly, we find that there exist many one-way flows both in the IPv4 and IPv6 traffic, which are important information sources for abnormal behavior detection. Finally, in light of the challenges of analyzing massive data of large-scale network monitoring, we propose a group flow model which can greatly reduce the number of flows while capturing the primary traffic features, and perform a comparative measurement analysis of group users' behavior dynamic characteristics. We find there are less sharp changes caused by abnormity compared with IPv4, which shows there are less large-scale malicious activities in IPv6 currently. All the evaluation experiments are carried out based on the traffic traces collected from the Northwest Regional Center of CERNET (China Education and Research Network), and the results reveal the detailed flow characteristics of IPv6, which are useful for traffic management and anomaly detection in IPv6.

• Journal of Korea Multimedia Society
• /
• v.11 no.2
• /
• pp.197-205
• /
• 2008

TCP packets occupy over 90% of current Internet traffic thus understanding of TCP throughput is crucial to understand Internet. Under the TCP congestion regime, heterogeneous flows, i.e., flows with different round-trip times (RTTs), that share the same bottleneck link will not attain equal portions of the available bandwidth. In fact, according to the TCP friendly formula, the throughput ratio of two flows is inversely proportional to the ratio of their RTTs. It has also been shown that TCP's unfairness to flows with longer RTTs is accentuated under loss synchronization. In this paper, we show that, injecting bursty background traffic may actually lead to new type of synchronization and result in unfairness to foreground TCP flows with longer RTTs. We propose three different metrics to characterize traffic burstiness and show that these metrics are reliable predictors of TCP unfairness.

• Journal of Communications and Networks
• /
• v.11 no.3
• /
• pp.297-305
• /
• 2009

Multiprotocol label switching (MPLS) networks require dynamic flow admission control to guarantee end-to-end quality of service (QoS) for each Internet protocol (IP) traffic flow. In this paper, we propose to tackle the joint routing and admission control problem for the IP traffic flows in MPLS networks without rerouting already admitted flows. We propose two mathematical programming models for this problem. The first model includes end-to-end delay constraints and the second one, end-to-end packet loss constraints. These end-to-end QoS constraints are imposed not only for the new traffic flow, but also for all already admitted flows in the network. The objective function of both models is to minimize the end-to-end delay for the new flow. Numerical results show that considering end-to-end delay (or packet loss) constraints for all flows has a small impact on the flow blocking rate. Moreover, we reduces significantly the mean end-to-end delay (or the mean packet loss rate) and the proposed approach is able to make its decision within 250 msec.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.4 no.3
• /
• pp.428-451
• /
• 2010

Traffic matrix-based anomaly detection and DDoS attacks detection in networks are research focus in the network security and traffic measurement community. In this paper, firstly, a new type of unidirectional flow called IF flow is proposed. Merits and features of IF flows are analyzed in detail and then two efficient methods are introduced in our DDoS attacks detection and evaluation scheme. The first method uses residual variance ratio to detect DDoS attacks after Recursive Least Square (RLS) filter is applied to predict IF flows. The second method uses generalized likelihood ratio (GLR) statistical test to detect DDoS attacks after a Kalman filter is applied to estimate IF flows. Based on the two complementary methods, an evaluation formula is proposed to assess the seriousness of current DDoS attacks on router ports. Furthermore, the sensitivity of three types of traffic (IF flow, input link and output link) to DDoS attacks is analyzed and compared. Experiments show that IF flow has more power to expose anomaly than the other two types of traffic. Finally, two proposed methods are compared in terms of detection rate, processing speed, etc., and also compared in detail with Principal Component Analysis (PCA) and Cumulative Sum (CUSUM) methods. The results demonstrate that adaptive filter methods have higher detection rate, lower false alarm rate and smaller detection lag time.

• Journal of computational fluids engineering
• /
• v.11 no.4 s.35
• /
• pp.20-25
• /
• 2006

In the present study, flow characteristics inside a road tunnel are simulated for the ventilation flows due to jet fan system and flows induces by the traffic. Traffic ventilation is numerically simulated by multiple reference frame. From the results of steady state simulation of tunnel ventilation, it is found that the proper ventilation is achieved by the designed jet fan system along with ventilating flow induced by the traffic. A transient simulation is also performed for the case of vehicle fire in the tunnel reversing the direction of rotation of some fans. The results suggest that the heat and smoke can be controlled by the proper changing of fan operation mode. The present results can be used to design proper ventilation system and effective smoke control system as well.

• Journal of Korean Institute of Industrial Engineers
• /
• v.8 no.1
• /
• pp.29-39
• /
• 1982

This paper presents a practical guidence for determining an optimal traffic control system at intersections in the urban areas in Korea. Two alternative systems, unsignalized and signalized, are considered. For analyzing the unsignalized system, two kinds of simulation model are developed ; gap acceptance model and first -in -first - out model. For the signalized system the total delay function for general arrival distribution is developed under the assumption that departure time is constant and it is used to find an optimal cycle time. Finally, the results in these two alternative systems are compared under the minimum average delay criterion and an optimal traffic control system is determined. This approach supports the decision making whether to install a traffic signal system in an intersection with given traffic flows and, if installed, determines what is the optimal cycle time and how the traffic signal phases are divided. And it also gives upper bounds of traffic flows to be passed in the unsignalized and the signalized system, which can be effectively used whenever an intersection is designed.

• International Journal of Highway Engineering
• /
• v.15 no.4
• /
• pp.135-146
• /
• 2013

PURPOSES : This study aimed to analyze the impact the operation of pre-signals at 4-leg signalized intersections and present primary environmental factors of roads that need to be considered in the installation of pre-signals. METHODS : Shift of proportions safety effectiveness evaluation method which assesses shifts in proportions of target collision types to determine safety effectiveness was applied to analyze traffic crash by types. Also, Empirical Bayes before/after safety effectiveness evaluation method was adapted to analyze the impact pre-signal installation. Negative binomial regression was conducted to determine SPF(safety performance function). RESULTS : Pre-signals are effective in reducing the number of head on, right angle and sideswipe collisions and both the total number of personal injury crashes and severe crashes. Also, it is deemed that each factor used as an independent variable for the SPF model has strong correlation with the total number of personal injury crashes and severe crashes, and impacts general traffic crashes as a whole. CONCLUSIONS: This study suggests the following should be considered in pre-signal installation on intersections. 1) U-turns allowed in the front and rear 2) A high number of roads that connect to the intersection 3) Many right-turn traffic flows 4) Crosswalks installed in the front and rear 5) Insufficient left-turn lanes compared to left-turn traffic flows or no left-turn-only lane.

• The Transactions of the Korea Information Processing Society
• /
• v.6 no.4
• /
• pp.977-987
• /
• 1999

The current traffic signal control systems are operated depending on the pre-planned control scheme or the selected control scheme according to a period of time. The problem with these types of traffic control systems is that they can not cope with variant traffic flows appropriately. Such a problem can be difficult to solve by using binary logic. Therefore, in this 0paper, we propose a traffic signal control system which can deal wit various traffic flows quickly and effectively. The proposed controller is operated under uncertainty and in a fuzzy environment. It show the congestion of road traffic by using fuzzy logic, and it determines the length of green signal by means of a fuzzy inference engine. It modeled using petri-net to verify its validation.