Measuring and modeling network traffic is of key importance for the traffic engineering of IP networks, due to the growing diversity of multimedia applications and the need to efficiently support QoS differentiation in the network. Several recent measurements have shown that Internet traffic may incorporate long-range dependence and self-similar characteristics, which can have significant impact on network performance. Self-similar traffic shows variability over many time scales, and this behavior must be taken into account for accurate prediction of network performance. In this paper, we propose a new parameter fitting procedure for a superposition of Markov Modulated Poisson Processes (MMPPs), which is able to capture self-similarity over a range of time scales. The fitting procedure matches the complete distribution of the arrival process at each time scale of interest. We evaluate the procedure by comparing the Hurst parameter, the probability mass function at each time scale, and the queuing behavior (as assessed by the loss probability and average waiting time), corresponding to measured traffic traces and to traces synthesized according to the proposed model. We consider three measured traffic traces, all exhibiting self-similar behavior: the well-known pOct Bellcore trace, a trace of aggregated IP WAN traffic, and a trace corresponding to the popular file sharing application Kazaa. Our results show that the proposed fitting procedure is able to match closely the distribution over the time scales present in data, leading to an accurate prediction of the queuing behavior.

Internet access traffic follows hourly patterns that depend on various factors, such as the periods users stay on-line at the access point (e.g. at home or in the office) or their preferences for applications. The clustering of Internet users may provide important information for traffic engineering and billing. For example, it can be used to set up service differentiation according to hourly behavior, resource optimization based on multi-hour routing and definition of tariffs that promote Internet access in low busy hours. In this work, we propose a methodology for clustering Internet users with similar patterns of Internet utilization, according to their hourly traffic utilization. The methodology resorts to three statistical multivariate analysis techniques: cluster analysis, principal component analysis and discriminant analysis. The methodology is illustrated through measured data from two distinct ISPs, one using a CATV access network and the other an ADSL one, offering distinct traffic contracts. Principal component analysis is used as an exploratory tool. Cluster analysis is used to identify the relevant Internet usage profiles, with the partitioning around medoids and Ward's method being the preferred clustering methods. For the two data sets, these methods lead to the choice of 3 clusters with different hourly traffic utilization profiles. The cluster structure is validated through discriminant analysis. It is also evaluated in terms of several characteristics of the user traffic not used in the cluster analysis, such as the type of applications, the amount of downloaded traffic, the activity duration and the transfer rate, resulting in coherent outcomes.