Traffic volume anomalies refer to apparently abrupt changes in the time series of traffic volume, which can propagate through the network. Detecting and tracing these anomalies is a critical and difficult task for network operators. In this paper, we first propose a traffic decomposition method, which decomposes the traffic into three components: the trend component, the autoregressive (AR) component, and the noise component. A traffic volume anomaly is detected when the AR component is outside the prediction band for multiple links simultaneously. Then, the anomaly is traced using the projection of the detection result matrices for the observed links which are selected by a shortest-path-first algorithm. Finally, we validate our detection and tracing method by using the real traffic data from the third-generation Science Information Network (SINET3) and show the detected and traced results.

This paper proposes an advanced hybrid network architecture and a comprehensive network design of the next-generation science information network, called SINET3. Effectively combining layer-1 switches and IP/MPLS routers, the network provides layer-1 end-to-end circuit services as well as IP and Ethernet services and enables flexible resource allocation in response to service demands. The detailed network design focuses on the tangible achievement of providing a wide range of network services, such as multiple layer services, multiple virtual private network services, advanced qualities of service, and layer-1 bandwidth on demand services. It also covers high-availability capabilities and effective resource assignment in the hybrid network. The cost reduction effect of our network architecture is also shown in this paper.

This paper describes an architectural design and related services of a new Japanese academic backbone network, called SINET5, which will be launched in April 2016. The network will cover all 47 prefectures with 100-Gigabit Ethernet technology and connect each pair of prefectures with a minimized latency. This will enable users to leverage evolving cloud-computing powers as well as draw on a high-performance platform for data-intensive applications. The transmission layer will form a fully meshed, SDN-friendly, and reliable network. The services will evolve to be more dynamic and cloud-oriented in response to user demands. Cyber-security measures for the backbone network and tools for performance acceleration and visualization are also discussed.

This paper addresses the optimum routing problem of multipoint connection in large-scale networks. A number of algorithms for routing of multipoint connection have been studied so far, most of them, however, assume the availability of complete network information. Herein, we study the problem under the condition that only partial information is available to routing nodes and that routing decision is carried out in a distributed cooperative manner. We consider the network being partitioned into clusters and propose a cluster-based routing approach for multipoint connection. Some basic principles for network clustering are discussed first. Next, the original multipoint routing problem is defined and is divided into two types of subproblems. The global optimum multicast tree then can be obtained asymptotically by solving the subproblems one after another iteratively. We propose an algorithm and evaluate it with computer simulations. By measuring the running time of the algorithm and the optimality of resultant multicast tree, we show analysis on the convergent property with varying network cluster sizes, multicast group sizes and network sizes. The presented approach has two main characteristics, 1) it can yield asymptotical optimum solutions for the routing of multipoint connection, and 2) the routing decisions can be made in the environment where only partial information is available to routing nodes.

Burst assembly at edge nodes is an important issue for the Optical Burst Switching (OBS) networks because it has a great impact on the traffic characteristics. We analyze the assembled traffic of the Science Information Network (SINET) by using the Fractional Brownian Motion (FBM) model. The analytical and simulation results show that existing assembly schemes cannot avoid increasing the burstiness, which will deteriorate the network performance. Here, burstiness is defined as the variance of the bitrate in small timescales. Therefore, we address the issue of how to reduce the burstiness of the assembled network traffic. Firstly, a sliding window-based assembly algorithm is introduced to reduce the burstiness of assembled traffic by transmitting bursts at an average rate in a small timescale. Next, an advanced timer-based assembly algorithm is introduced, by which the traffic rate is smoothed out by restricting the burst length to a threshold. The simulation results show that both the sliding window-based and advanced timer-based assembly algorithms perform better than existing assembly algorithms do in terms of the burst loss ratio. The simulation also indicates that the advanced timer-based assembly algorithm performs better in terms of the edge buffering delay than the sliding window-based assembly algorithm does.

Denial of service (DoS) attacks have become one of the most serious threats to the Internet. Enabling detection of attacks in network traffic is an important and challenging task. However, most existing volume-based schemes can not detect short-term attacks that have a minor effect on traffic volume. On the other hand, feature-based schemes are not suitable for real-time detection because of their complicated calculations. In this paper, we develop an IP packet size entropy (IPSE)-based DoS/DDoS detection scheme in which the entropy is markedly changed when traffic is affected by an attack. Through our analysis, we find that the IPSE-based scheme is capable of detecting not only long-term attacks but also short-term attacks that are beyond the volume-based schemes' ability to detect. Moreover, we test our proposal using two typical Internet traffic data sets from DARPA and SINET, and the test results show that the IPSE-based detection scheme can provide detection of DoS/DDoS attacks not only in a local area network (DARPA) and but also in academic backbone network (SINET).

The optimum design of alternative routing network systems applying the equivalent random theory, which minimizes the system cost under given service criteria, has been proposed for the basic triangular model. Practical networks, however, are more complex than this model; for example, the networks overflowing from an alternative route to a higher level one will be introduced. As a study of such networks, an approximate solution of the two-stage overflow model has been proposed, but its accuracy has not yet been made clear. This paper first investigates a general n-stage overflow model, and provides the optimum condition minimizing the system cost applying the implicit function theorem. Next, using the above result, the accuracy for the approximate solution of the two-stage model is evaluated numerically. Furthermore, a practical design for the two-stage system is proposed, which is based on the optimum design charts for the basic triangular model.

ATM's bandwidth flexibility and high switching speed advantages have made it the preeminent solution to the B-ISDN. However, networks based on ATM suffer from phenomena not encountered in the STM network, e.g., cell loss, and cell jitter. For ATM to support varied media, problems arising from these phenomena must be resolved. This paper discusses techniques which enable ATM to support CBR, VBR voice, VBR video, and connectionless services. We determine the problems to be resolved for each service and discuss solutions. We focus on dejittering and clock recovery for CBR service, on talk-spurt synchronization for VBR voice, and on video frame synchronization and lost-cell compensation for VBR video service. We show experimental results for a prototype HDTV codec and terminal adapter. For connectionless service, we show that connectionless service should be supplied by the B-ISDN itself using message handlers which support message routing and addressing, i.e., connectionless service functions (CLSF), as described by the CCITT. We propose a network topology of message handlers, which reduces the routing database and avoids transit message handler overload. We show an example of system configuration for connectionless service.