Internet Signal Processing: Next Steps

photohomoeopathAI and Robotics

Nov 24, 2013 (3 years and 6 months ago)

96 views

Internet Signal Processing:

Next Steps

Dr. Craig Partridge

BBN Technologies

Defining Signal Processing

Processing

such as shaping, converting,
enhancing, and time positioning

of
signals

(such as packet traces), to
transform

the
signals into other forms


such as shapes,
power levels, or images


and thereby
extract

features from the original signal.

Internet Signal Processing


While there have been brief uses in the past


E.g. Jacobson on timing


We’re only now seeing an emerging community
of people doing signal processing on Internet
traffic


And most of that community is in this room


Where should we, as a community, be headed?


This is not a question we’ve had a chance to consider as
a group (thus this workshop)

Whither? In Three Questions


Is there more to signal processing than
pretty pictures?


What can signal processing illuminate?


What are the limits of different algorithms?


What should our input signals be?


Pretty Pictures


Why do we create pretty pictures?


Initial experiments with an algorithm


Try it on things and see what pops out


The danger comes when we publish those pictures
without understanding them


“This traffic pattern causes this picture” is something
we should aim not to do


Unless you’re asking for help


Seek rather “This traffic pattern causes this picture
because….”

Some Not
-
Yet
-
Ready Pictures


Delta
-
time analysis


Inter
-
transmission time vs.
transmission time


Bands represent observed
acceptable transmission
times


Low part of chart may
reveal MAC layer in
use…

What Can We Illuminate?


What can signal processing tell us about the
network?


We need to find out.


Can:


Seek out algorithms and try them


Seek out problems and find algorithms that might
answer them


Seek out inputs to feed to algorithms we understand


At this point, we probably need to try all three
approaches


Some Thought Questions


How much does cross traffic “imprint”?


What are wavelets good for?


When are wavelets the wrong approach?


What role for match
-
and
-
latch?


Imprinting



Propagation of self
-
similarity work…



An intriguing result from signal processing…



Characteristics from all three flows observed


But only two visible to sensor!

Pros and Cons of Wavelets


Pro:


we’ve used them a lot and we understand a few things


how to compute Hurst parameter


how their details tend to vary


Con:


they’re bad at identifying particular frequencies


often hard to say exactly why details vary


BTW: these are questions we should ask ourselves
about any technique going forward

Match
-
and
-
Latch


A technique for extracting signals from noisy
input


Requires:



signals to have a structure that enables the extraction


that we be sure the signals are present


One useful structure: signals expressable in max
-
plus algebra


TCP is max
-
plus (SIGCOMM 2000)

What Should Input Signals Be?


Typical practice:


take a packet trace


post process it into a signal


sample it in some fashion (method usually not
described in paper…)


usually only use arrival time and length


usually resulting in either bins of event counts or a
(
-
1,0,1) uniformly sampled signal


Why Can’t an Input ….


Be something other than a packet trace


up
-
down times for BGP peers?


byte counts per unit time?


Use more information from the trace


encoding source and destination prefixes?


power levels on wireless?


multi
-
dimensional signals?


Be properly documented in the paper…

Final Thoughts


Having put a lot of challenges on the table, let me
say we’ve also come a long way in a short time


Lots of interesting work, which you’ll hear over the
next few days


I encourage you to view it all (no matter how
impressive) as a starting point….


A final challenge:


Why are we using signal processing only for analysis?


Are there applications we could transform with signal
processing? (Beyond covert channels)