Chinese Journal of Electronics
Vol.24, No.1, Jan. 2015
An Analysis and Proof on Self-Similarity
Property of Flash P2P Internet Video Traffic∗
JI Yimu1,2 , YUAN Yongge1 , HAN Zhijie1 , WANG Hao3 , HAN Lei3 , SUN Yanfei1 and WANG Ruchuan1
(1. Computer of Science, Nanjing University of Posts and Telecommunications, Nanjing 210023, China)
(2. Institute of Advanced Technology, Nanjing University of Posts and Telecommunications, Nanjing 210023, China)
(3. Nanjing Institute Huawei Technologies Corporation, Nanjing 210012, China)
Abstract — In order to study the amount of bandwidth
resource loss caused by flash P2P technique, its influence
on network load and its maintenance cost, the characteristic of Internet traffic of flash P2P is studied. On the basis
of analysis of features of Real time media flow protocol
(RTMFP), the traffic of flash P2P can be identified from
the Internet traffic. By extraction and analysis of the traffic of the three largest online video content providers in
China (Youku, Iqyi and Sohu Video) and the calculation
of probability distribution of the traffic, it is found that the
transmission time of flash P2P traffic and the transmission
time interval obeys the heavy-tailed distribution. This accounts for the self-similarity of the flash P2P traffic. To
better explain the phenomenon, the long-range dependent
model is established based on the current traffic. By the
established mathematical model, it is strictly proved that
flash P2P traffic has self-similar characteristic.
Key words — Video traffic, Flash P2P, Self-similarity,
Empirical mode decomposition (EMD), Autoregressive integrated moving average (ARAMA) model.
I. Introduction
P2P live media streaming system has developed rapidly
during the past decade, such as Coolstreaming[1] and PPLive.
In these P2P application programs, when a number of users
are watching the live videos, the users can share the video
stream mutually, so that the burden on the server can be relieved. However, the service of VOD (Video-on-demand) has
been increasingly popular in recent years. To improve QoS
(Quality of service), the P2P technique can be employed to
relieve the burden on servers[2] , and the on-demand P2P distributed extensible architecture can be adopted for improving
system efficiency[3] . These techniques are widely used by the
video-on-demand service providers in China and abroad, such
as Youtube in the U.S, and Youku, Sohu and Iqyi in China.
The traditional video-on-demand services adopt CDN (Content delivery network) technique to distribute video contents
to audiences, i.e., building a CDN server at the operator near
the users. However, the cost of CDN devices increases linearly
with the increasing of users. Although the current architecture
for video-on-demand services adopts the P2P technique to improve QoS, there are still challenges for the providers with
respect to the P2P architecture for video-on-demand. One is
the high cost of server bandwidth, which accounts for nearly
half of the total cost[4] , the other one is the low use ratio of
bandwidth and the increasing requirement on user experience.
In recent years, Adobe has developed an online broadcasting
protocol based on flash P2P technique. It is a new P2P technique based on flash platform, taking advantages of the traditional P2P technique, and adopts the RTMFP[5] . The RTMFP
is built upon UDP, and can minimize the delay and realize
the real-time communication. There are three advantages of
RTMFP: (1) It supports end-to-end media data transmission,
that is, the media data is directly transmitted between two
flash player instances without being routed by relay servers.
In this way, RTMFP not only decreases end-to-end delay, but
also eliminates the cost of relay server, and the protocol is
easy to be extended. (2) In RTMFP, the priority of audio is
higher than other data, which increases user experience where
the bandwidth of communication channel is limited. (3) The
video playing of flash P2P is based on web browser, which is
different with traditional P2P video playing, where a client side
is needed. Therefore, the user convenience is improved. Compared with the architecture and protocol of traditional P2P
video delivery network, that of Flash P2P network can reduce
the cost of CDN devices, and increase the use ratio of bandwidth resource. It has the advantages of extensibility, robustness and accessibility. It is found by packet capture analysis on
video websites in China and abroad that the video-on-demand
technique using flash P2P will cause more consumption of
bandwidth resources to the network and telecom carriers. This
will lead to overlarge load on network devices, and increase the
cost of operation and maintenance[6] . Based on the analysis on
∗ Manuscript Received June 2014; Accepted July 2014. This work is supported by Huawei Foundation (No.2013W04), National Natrual
Foundation (No.61170065, No.61373017), Jiangsu Natural Science of Young Foundation (No.BK20130876), Jiangsu future network project
(No.BY2013095-4-03), and National Post-doctorial Foundation (No.2013M541702).
An Analysis and Proof on Self-Similarity Property of Flash P2P Internet Video Traffic
video packet of video websites in China and abroad, a model is
established for the Internet video traffic of flash P2P, so that
the technical and theoretical basis is provided to the control
and optimization of traffic. This can also improve the network
performance and QoS. The main contributions of this study
are as follows: (1) Introducing how to analyze the self-similar
model of network traffic. (2) RTMFP, introducing the features
of the protocol and the collected traffic data that possesses
the properties of RTMFP. (3) Statistical analysis on Internet
traffic of flash P2P. (4) Long-range dependent model based on
EMD and ARIMA, and a brief introduction of the reason why
the flash P2P traffic has self-similar characteristic.
II. Related Works
In early 1990s, Leland et al. conducted a traffic analysis
on LAN (Local area network), and proposed that there is a
self-similar phenomenon in Internet traffic for the first time[7] .
After many studies since then, it is found that the network
traffic of Ethernet, WAN and WWW, and the cloud service
also has self-similar characteristic[8-10] . As to the reason why
the Internet traffic is self-similar, Leland et al. believed that
this property is due to the aggregation of the traffic of massive
independent ON/OFF data sources[7] . Based on this, Crovella
et al. proposed that the distribution of file size is also one of
the reasons leading to self-similarity[11] . Yoshiaki Sumida et
al. tried to explain the phenomenon from the perspective of
network protocol[12] . The network transport layer consists of
a series of protocols, such as the protocols of traffic control
and congestion control. Realizing the services on the upper
layers of network communication (such as network retransmission and congestion control mechanism) will cause the arrival time intervals obey the heavy-tailed distribution, which is
another reason for self-similarity[13] . A. Holt. considered that
cache is another reason leading to the self-similarity of Internet
traffic[14] . The self-similarity feature of Internet traffic[15] has
attracted much attention, and a number of self-similar models
have been established to describe and simulate the characteristics of traffic. These previous researches lay a solid foundation
for the modeling of Internet traffic. To analyze the video traffic model of flash P2P, it is necessary to capture the traffic
of network video packet using the architecture of flash P2P
technique. Then, the features are extracted, filtered and modeled. With the constant development of network technique, the
self-similarity property is a common phenomenon in Internet
traffic. The main contribution of this study is to conclude that
the video traffic of flash P2P also possesses the self-similarity
property. The reasons leading to the self-similarity property
are also analyzed.
III. Features of RTMFP and Collection of
Video Traffic Data
In this section, the composition structure of RTMFP package is given first to analyze the features. Furthermore, the captured Internet data package is filtered with these features, so
that the traffic of video packet corresponding to the features
27
of RTMFP is extracted for the self-similarity property of flash
P2P traffic.
1. RTMFP feature analysis and extraction
RTMFP is an exclusive protocol developed by Adobe. The
RTMFP can achieve interactions between the terminal users of
Adobe flash player, such as peer-to-peer, multicast and anycast. The discovery and connection between nodes and the
discovery and search of streaming video resources are achieved
by DHT (Dynamic hash table) protocol. RTMFP is based on
UDP, and the DH (Diffie-Hellman) algorithm is used for the
key agreement during the connection building. The method
adopts AES128 bits to conduct encryption in UDP layer[16] .
The main protocol interaction of RTMFP can be divided
into three processes: the mutual connection building between
nodes, sending resource request, and the maintenance of Pingpang heartbeat. It is found from the introduction of RTMFP
document[5] and packet capture analysis that in the four hand
shaking processes in RTMFP, the main feature is presented as
the initiator initial keying packet in the second hand shaking
phase. There are mainly two aspects of features of RTMFP
analyzed from the packet capture. The first is that the original sessionID is a 32 bit unsigned integer. By performing exclusive or on the original sessionID and two encrypted-part
of the same type, the scrambledSessionID can be obtained.
It can be known from packet capture analysis that the sessionID during the first three hand shakings is zero. Actually,
the sessionID in the data package obtained from the capturing
is the scrambledSessionID after being scrambled. Therefore,
each data package in RTMFP is made up of two parts: (1) The
first four bytes form the session-id after scrambling (scrambled
sessionID), and the last four bytes form the package after encryption using AES-128; (2) RTMFP is based on the User
datagram protocol (UDP). The length of its payload segment
minus the length of sessionId is the integer multiple of 16 bytes.
According to the features of RTMFP, it is judged whether each
received data package is flash P2P traffic package, and the data
packages conforming to protocols are recorded. The recorded
contents include the time when the data package is acquired,
address information of source ip, address information of target ip, length of data package, and the value of sessionID. The
recorded information is saved in log documents on the server
regularly. The traffic data of flash P2P can be obtained by the
log documents. The video interaction processes of flash P2P of
Youku, Iqiyi and Sohu TV are illustrated as an example. An
analysis is performed using Wireshark packet capture.
2. Experimental traffic data
The traffic of flash P2P is mainly from the video-ondemand and playing on the web page by users. In order to
study the self-similarity property of the Internet traffic of flash
P2P, the campus network center of Nanjing University of Posts
and Telecommunications (telecom) is used as the main collecting source of video traffic data. The experimental data covers
a time span of 1 month, and the traffic is 20 TB. With the
experimental data (which represents the traffic condition of
Nanjing), several other large cities in China are also selected
as sampling sites to analyze the self-similarity property of flash
P2P. The data collection was performed in Beijing, Shanghai,
Hefei and Guangzhou for a week, and the traffic of each city
28
Chinese Journal of Electronics
is 5TB.
IV. Statistical Analysis on the Flash P2P
Video Traffic
To prove that the FlashP2P video traffic possesses the selfsimilarity property, self-similarity property and statistical test
methods are first defined. The relevant statistical method is
used to inspect the self-similarity property of the Flash P2P
video traffic.
1. Self-similarity property and statistical test
methods
Studies about the self-similarity in time sequences can be
found in Refs.[17,18]. Here only the definition of self-similar
process (shown as Definition 1) and the determination criteria
of self-similarity property (see Property 1) are given[17,20] .
Definition 1 For a stochastic process X = {Xt , t =
1, 2, 3, . . . , K} that is stable, suppose its autocorrelation function is ρk ∼ kβ L1 (k), k → ∞ (0 < β < 1, L1 is slow change
function). By performing superposition on the stochastic process, a superimposed sequence X (m) can be generated. If the
(m)
autocorrelation function of the superimposed sequence, ρk ,
(m)
and that of the original process ρk satisfy ρk = ρk , m =
1, 2, . . . , K, then the process is called a self-similar process.
Property 1 For a sequence of random variable of wide
sense stationary process Xm = (X1m , X2m , . . .), suppose that
r m (k) is the autocorrelation function of process Xm . If the
increasing speed of V AR(X1 + X2 , . . . + Xn ) is n2H , then parameter H is the Hurst parameter of the sequence of random
variable X. When 0.5 < H < 1, the stochastic process Xm has
the self-similarity property.
Generally, another parameter β (which is the slope of the
curve in time sequence analysis) is used to denote the degree of
self-similarity, where H = 1 − β/2. The variance-time method
(R-S method) can be used to calculate the Hurst value of selfsimilarity property: (1) Variance-time method[19] . The original
time sequence is divided into data blocks with the size of m.
For each given m, the mean value and variance of each data
block is calculated. Finally, the logarithm is taken of m and the
sample variance as the X and Y -axis to plot the curve. These
points should be distributed around a straight line, and the
slop of the line is β = 2H − 2. Therefore, the Hurst value can
be calculated. (2) Wavelet Transform[20] . For a stochastic process X(t) after wavelet transform, since the wavelet transform
1
coefficients dx (j, k) and 2j(H+ 2 ) dx (0, k) have the same probability density distribution function, the wavelet coefficients
1
dx (j, k) and 2j(H+ 2 ) dx (0, k) can be estimated, and the value
of H is calculated from the relation between the two values.
2. Self-similarity judgment of the flash P2P traffic
According to the traffic data of flash P2P in Table 2, the
variance-time method and wavelet analysis are adopted to calculate the Hurst value of each group of data in order to guarantee the statistical accuracy. Take the video traffic volume of
flash P2P in Nanjing as an example. Both the two methods
are used to test whether it satisfies the self-similarity property.
Fig.1.(a) shows the curve fitted with variance-time method.
The least square method is adopted for the curve fitting. The
slope of the fitted straight line is α = −0.7528. Then, Hurst
value is calculated as 0.6236 according to β = 2H − 2. Wavelet
2015
analysis is also adopted for the calculation. First, the traffic sequence is subjected to discrete wavelet transform with
jsi , i = {1, 2, . . . , 5} series to obtain the detailed wavelet coefficient.Next, the logarithm is taken of the spectra of all series
intervals and is plotted on the coordinate axes, as shown in
Fig.1.(b). The least square method is used to fit the curve,
and a curve with the slope β of 0.1311 is obtained. According
to H = 1 − β/2, Hurst value is calculated to be 0.5655.
Fig. 1. Calculating the Hurst value with variance-time
method and wavelet analysis method
For the data collected in other cities shown in Section
III.2, the R-S method and the wavelet analysis method are
employed, and the calculated Hurst values are shown in Table
1. The results show that the video traffic of flash P2P possesses
self-similarity property.
Table 1. Two fitting methods to calculate hurst
values for five cities
Beijing Shanghai Guangzhou Hefei Nanjing
V-T Method 0.6050
0.5454
0.7630
0.7405 0.6236
AV Method 0.5652
0.5664
0.5043
0.5181 0.5655
3. Analysis on the self-similarity property of the
Flash P2P Traffic
For the video traffic of flash P2P, the superposition model
of ON/OFF correlated traffic source (also known as “switch
model”) (reference) is adopted to the analysis. The switch
model is the result that the self-similar process is regarded
as the overlapping of innumerable user data source.
Definition 2 The superposition model of ON/OFF correlated traffic source is the result of regarding the self-similar
process as the superposition of innumerable user data sources.
The model defines a large number of data sources, and each
source has ON and OFF states. Each data source is independent of other one, and the state duration obeys the heavytailed distribution. When the data source is ON, the data
is produced at a constant speed, while it is OFF, no data
will be produced. The self-similar process can be obtained by
performing superposition on massive ON/OFF data sources
following heavy-tailed distribution. When the amount of the
data sources approaches infinity, the total Internet traffic approaches asymptotic self-similarity.
An Analysis and Proof on Self-Similarity Property of Flash P2P Internet Video Traffic
Definition 3 Distribution function of the random variable X is supposed to be F (x). If it follows the heavy-tailed
distribution, it satisfies the following:
F (x) = 1 − F (x) ∼ cx−β , 0 < β < 2
where c is a positive constant, and X is a random variable
with the heavy-tailed distribution. The variance of X is infinite, especially when β ≤ 1, E[x] → ∞.
Property 2 If a time sequence follows heavy-tailed distribution for a long time at ON and OFF states, then it is selfsimilar. Generally, the “logarithm-logarithm” can be used to
complement the LLCD diagram to prove and analyze whether
the data follows heavy-tailed distribution[21] and to estimate
the shape parameter α. To explain the self-similarity property
of flash P2P traffic with the model, it is necessary to prove
that the ON and OFF time obeys the heavy-tailed distribution. The ON tine corresponds to the independent transmission time of flash P2P stream, while the OFF time corresponds
to the interval between transmissions. For the collected flash
P2P video stream, the Transmission times (TT) and quiet
times are counted. For these two times, the LLCD fitting is
performed. It can be seen that the shape parameter of traffic transmission time is 1.5, and that of the Time interval
(TI) between traffic transmissions is also 1.5. Both TT and
TI are found to obey toe heavy-tailed distribution shown as
Fig.2. This explains that the transmission time (Fig.2(a)) and
the time interval between transmissions (Fig.2(b)) obey heavytailed distribution. Furthermore, the self-similarity property
of flash P2P traffic can be attributed to the superposition of
ON/OFF which obeys heavy-tailed distribution.
Fig. 2. Distribution map of transmission times and quiet
times of flash P2P
V. Self-Similar Mathematical Model of
the Flash P2P Traffic
In this section, by explaining the self-similarity property of
video traffic data of flash P2P theoretically, it is proved that
network video traffic of flash P2P conforms to the long-range
dependent model based on EMD and ARIMA using the experimental data[22-31] . Besides, the reason for the self-similarity
29
property of video traffic of flash P2P is explained. First, the
relation between self-similarity and long range dependence is
given. Then, a long-range dependent model based on EMD
and ARIMA is established. At last, the established model is
used to fit the Internet traffic data of flash P2P.
1. Relationship between self-similarity and long
range dependence
Definition 4 For a stationary discrete time sequence
X, if its autocorrelation function ρ(k) decreases very slowly,
ρ(k) ∼ |k|−a , k → ∞, 0 < a < 1 has long range dependence.
Self-similarity of the Internet traffic means that the local
structure of the traffic is roughly similar to the overall structure. The long range dependence property of Internet traffic
is relative to the short range dependence of models such as
the Possion model. The long range dependence property reflects the persistence of self-similar process. That is to say, the
suddenness exists on all time scales. Hence, it is also called
multi-scale property[22] . The self-similarity property of network traffic is closely related with the long range dependence
property. Normally, a stable self-similar stochastic process has
long range dependence, while a long-range dependent process
does not have to be self-similar. X = {Xt , t = 0, 1, 2, . . .} is
supposed to be a wide sense stationary stochastic process.
μ = E[Xt ], σ 2 = E[(Xt − μ)2 ], ρk =
E[(Xt − μ)(Xt+k − μ)]
σ2
If ρk attenuates in the form of hyperbolic curve that is
slower than in the exponential form with the increasing of
P
time delay, namely, ρk has nonadditivity as k ρk = ∞, then
the stochastic process X is long-range dependent[23] . Random
sequence X (m) (k) = (Xkm−m−1 + . . . + Xkm )/m is generated
by stacking X. If the stacking process X (m) and X have the
same correlated structure, and for the autocorrelation func(m)
= ρk , then the stochastic process X is
tion, there is ρk
self-similar. Hence, the long range dependence model can be
regarded as an asymptotically self-similar process.
2. Proof of long range dependence property based
on EMD and ARIMA
First, the brief introduction of EMD[24] is given. In HilbertHuang transform[25] , EMD is mainly used to decompose the
original signal into several Intrinsic mode function (IMF). Essentially, it is to determine the basic oscillation pattern of effective signal in data based on experience. IMF satisfies the
following conditions[26] : First, the amount of extreme points
of signals and zero crossing points must be equal or differ for 1
at most. Second, at any moment, the mean values of envelope
defined by the local maximum and minimum in the signals
are zero. In practice, the mean values of upper and lower envelopes will not be zero. Therefore, if the following conditions
are satisfied, it is generally believed that the mean values of
envelope satisfy the condition that the mean value of IMF is
zero.
P
[hk (t) − hk−1 (t)]2
P
≤
(1)
[hk−1 (t)]2
where is the threshold, and it is usually set to be between
0.2 and 0.3.
When the traffic data is subjected to EMD, it is decomposed into several IMF. It is proved by Gaobo et al. that the
IMF is short-range dependent[27] . Accordingly, the long-range
Chinese Journal of Electronics
30
dependent model can be transformed to a short-range dependent model. However, the process of proving IMF is shortrange dependent is complex, and the proof about the integrability of the autocorrelation function of IMF is not very
rigorous.
Proof: According to the adaptive filter property of EMD,
the IMF components obtained by EMD have different frequency components and bandwidths. Moreover, the IMF components containing high frequency components will be decomposed first during the process. Therefore, the EMD method
can be viewed as a bandpass filter which is adaptive. The
cutoff frequency and bandwidth vary with the decomposed
signals[28] . Hence, it can be assumed that the power spectral
density of each IMF component Ci (t) is Sx (ω), and there
(
Sx (ω) =
αi ,
0,
textrm|ω| ≤ Ω i
textrm|ω| > Ωi
)
Ωi τ
Then, there is Rx (τ ) = αi sinπτ
. Apparently, R(τ ) is integrable. Consequently, it is proved that each IMF component after EMD is short-range dependent. ARIMA model[29]
is much improved in terms of the fitting accuracy on nonstationary series than other regression models. Therefore, the
ARIMA model is used to fit IMF. In fact, ARIMA model is the
combination of differential operation and ARMA model, which
means that the series after differentiation can be fitted with
ARMA model as long as the traffic series achieves stationary
after differentiation of an appropriate order[30] .
Definition 5 ARIMA model is defined as follows. Suppose the stochastic process {Xt } obeys ARIM A(p, d, q) model,
then the expanded table is φ(B)∇d Xt = θ(B)αt , where
φ(B) = 1 − φ1 B − . . . − φp B p , |B| ≤ 1; θ(B) = 1 − θ1 B −
. . . − θp B B , |B| ≤ 1; B denotes the backward shift operator,
i.e. BXt = Xt−1 . ∇ = (1 − B) denotes the differential operator, and ∇d = (1 − B)d denotes the fractional differential
operator[31] .
3. Model fitting
The data used in model fitting is from the traffic package of
flash P2P collected at NUPT campus. In order to avoid the influence of Internet traffic burst, the traffic data 1s in time are
selected, and 99,000 RTMFP data packages are intercepted.
Finally, 132 data points are obtained, and the data are shown
in Fig.3.
2015
number of the components of IMF increase, the residual decreases. Therefore, decomposition into six IMF components
can satisfy the prediction accuracy of system, and decrease
the computational complexity of EMD. Six IMF components
obtained after decomposing the original data are IMF1 IMF6
(see Fig.4).
Then ARIMA model is used to fit IMF1-IMF6 (Seeing
Fig.4(a) and (f )). After the fitting, the prediction accuracy
of other components is high except IMF1 and IMF2. The sum
of IMF2∼IMF5 is fitted as a whole. Not only the number of the
models decreases, but also the efficiency is promoted. Fig.5(a)
and Fig.5(b) are the ARIMA fitting diagrams of IMF1 and
the sum of IMF2∼IMF5, respectively. IMF1 and the sum of
IMF2 IMF5 are fitted by ARIMA (0,1,2) and ARIMA (4,1,0)
models, respectively. This indicates that ARIMA (0,1,2) and
ARIMA (4,1,0) model succeed in sequence fitting with IMF1
and the sum of IMF2 IMF5, respectively.Fitting diagram of
the overall traffic is shown in Fig.5(c). It can be seen that the
model fits the traffic data accurately. The Flash P2P Internet traffic accords with the long-range dependent model based
on EMD and ARIMA, that is, it can be seen as a progressive self-similar process. Therefore, the Flash P2P possesses
the self-similarity property. Possible explanations for this selfsimilarity property is given on the model level.
Fig. 4. Components of the flash P2P traffic data sequence after EMD
VI. Conclusion and Future Work
Fig. 3. Original sequence data of the flash P2P traffic
EMD is performed on the 132 data points. Original data
is decomposed by EMD and the condition of Eq.(1). Through
the Matlab simulation and calculation, it is found that after
decomposing the original data into 6 IMF, the amplitude of
the residual is very low and can be ignored. Moreover, as the
Based on the research on the Flash P2P traffic, selfsimilarity property of the Flash P2P video traffic is derived.
The fact that the Flash P2P Internet traffic has self-similarity
property has been proved for the first time. Moreover, the reason why Flash P2P Internet traffic possesses the self-similarity
property is also given. Finally, a long-range dependent mathematical model based on EMD and ARIMA is built, which provides a reasonable explanation for the self-similarity property
An Analysis and Proof on Self-Similarity Property of Flash P2P Internet Video Traffic
from the model level. Though the self-similarity property is
proved through experiments and simulations, the fundamental
reasons for this have to be further explored by constructing the
self-similar model based on the Markov chain[32] . This will be
very significant for the research on the whole Internet traffic.
In addition, the Internet traffic will become more complicated
and changeable in the age of network. Therefore, research on
the traffic self-similarity becomes increasingly important, and
will benefit the development of the future network.
[8]
[9]
[10]
[11]
[12]
[13]
[14]
[15]
[16]
[17]
[18]
[19]
Fig. 5. Overall fitting result of the flash P2P traffic. (a) IMF1
fitting diagram; (b) Fitting diagram of the sum of
IMF2∼IMF5; (c) Fitting diagram of the overall traffic
[20]
References
[21]
[1] X. Zhang, J. Liu, B. Li and T.S.P. Yum, “CoolStreaming/DONet: A data-driven overlay network for efficient live
media streaming”, INFOCOM 2005, 24th Annual Joint Conference of the IEEE Computer and Communications Societies,
Proceedings IEEE, No.3, pp.2102–2111, 2005.
[2] Ming Rong, Feng Xu, Jin Zhao and Xin Wang, “GMaker: A
video recommendation module for peer-assisted VoD”, Peer-toPeer Networking and Applications, Vol.7, No.1, pp.41–52, 2014.
[3] Konstantinos Deltouzos, Ilias Gkortsilas Nikolaos Efthymiopoulos and Spyros Denazis, “Liquidstream IIScalable P2P overlay
optimization with adaptive minimal server assistance for stable
and efficient video on demand”, Peer-to-Peer Networking and
Applications, Vol.8, No.7, 2013.
[4] Xin Cong, Kai Shuang, Sen Su and Fangchun Yang, “An efficient server bandwidth costs decreased mechanism towards mobile devices in cloud-assisted P2P-VoD system”, Peer-to-Peer
Networking and Applications, Vol.7, No.2, pp.175–187, 2014.
[5] http://tools.ietf.org/html/draft-thornburgh-adobe-rtmfp-05,
2013.
[6] http://www.adobe.com/devnet/flashplayer/articles/rtmfp cirrus app.html, 2011.
[7] W.E. Leland and M.S. Taqqu, “On the self-similar nature of
[22]
[23]
[24]
[25]
[26]
[27]
31
ethernet traffic (extended version)”, IEEE/ACM Transactions
on Networking, Vol.2, pp.1–15, 1994.
V. Paxon and S. Floyd, “Wide area traffic: The failure of Poisson modeling”, IEEE/ACM Transactions on Networking, Vol.3,
pp.226–244, 1995.
M. Crovella and A. Bestavros, “Self-similarity in world wide
web traffic: Evidence and possible causes”, IEEE/ACM Transactions on Networking, Vol.5, pp.835–846, 1997.
Zia ur Rehman, Farookh Khadeer Hussain, Omar Khadeer Hussain and Jaipal Singh, “Is there self-similarity in cloud QoS
data?”, e-Business Engineering (ICEBE), 2013 IEEE 10th International Conference, Coventry, pp.76–81, 2013.
Mark E. Crovella and Azer Bestavros, “Self-Similarity in world
wide web traffic: Evidence and possible causes”, IEEE/ACM
Transactions on Networking, Vol.5, No.6, pp.835–846, 1997.
Yoshiaki Sumida, Hiroyuki Ohsaki, Masayuki Murata and Hideo
Miyahara, “Effects of upper-layer protocols on self-similarity of
network traffic”, Internet Workshop, 1999. IWS 99, pp.272–
279, 1999.
Liang Guo, Markc Rovella, Ibrahimm Atta, “How does TCP
generate Pseudo-self-similarity?”, Modeling, Analysis and Simulation of Computer and Telecommunication Systems, Proceedings Ninth International Symposium, Cincinnati, OH, pp.215–
223, 2001.
A. Holt, “Long-range dependence and self-similarity in world
wide web proxy cache references”, Communications, IEE Proceedings, Vol.147, No.6, pp.317–321, 2000.
F. Amin and K. Mizanian, “Buffer management for self-similar
network traffic”, Telecommunications (IST), 2012 Sixth International Symposium, Tehran, pp.737–742, 2012.
http://labs.adobe.com/technologies/cirrus/, 2013.
W. Willinger, M.S. Taqqu, W.E. Lelandm and D.V. Wilson,
“Self similarity in high-speed packet traffic: Analysis and modeling of ethernet traffic measurements”, Statistical Science,
Vol.10, pp.67–85, 1995.
Zhang Xiaoyong, Luo Laiyuan, “Self-similarity analysis of time
series”, Signal Processing (ICSP), 2012 IEEE 11th International Conference, pp.2063–2066, 2012.
M.S. Taqqu, V. Teverovsky and W. Willinger, “Estimators for
long range dependence: An empirical study”, Fractals, Vol.3,
No.4, pp.785–798, 1995.
Stilian A. Stoev, George Michailidis and Murad S. Taqqu, “Estimating heavy-tail exponents through max self-similarity”, IEEE
Transactions on Information Theory, Vol.57, No.3, pp.1615–
1636, 2011.
G.W. Wornell and A.V. Oppenheim, “Estimation of fractal signals from noisy measurements using wavelets”, IEEE Trans. on
Signal Processing, Vol.40, No.3, pp.611–623, 1992.
G. Mansfield, T.K. Roy and N. Shiratori, “Self-similar and fractal nature of Intemet traffic data”, Proceedings of the 15th International Conference on Information Networking, Beppu city,
Oita, pp.227–231, 2001.
J. Jusak and R.J. Harris, “Study of UDP-based Internet traffic:
Long-range dependence characteristics”, Australasian Telecommunication Networks and Applications Conference (ATNAC),
Melbourne, VIC, pp.1–7, 2001.
Jieying Han and James Z. Zhang, “Network traffic anomaly
detection using weighted self-similarity based on EMD”, 2013
Proceedings of IEEE, Southeastcon, pp.1–5, 2013.
N.E. Huang, Z. Shen and S.R. Long, “The empirical mode decomposition and the hilbert spectrum for nonlinear and nonstationary time series analysis”, Proc. Royal Soc London A,
pp.903–995, 1998.
D. Yu, J. Cheng and Y. Yang, “Application of EMD method
and Hilbert spectrum to the fault diagnosis of roller bearings”,
Mechanical Systems and Signal Processing, Vol.19, pp.259–270,
2005.
Gao Bo, Zhang Qinyu, Liang Yongsheng and Zhang Naitong,
“One method from LRD to SRD wireless communications”,
32
Chinese Journal of Electronics
Networking and Mobile Computing, WiCom ’09. 5th International Conference, Beijing, pp.1–4, 2009.
[28] Z.H. Wu and N.E. Huang, “Ensemble empirical mode decomposition: A noise assisted data analysis method”, Calverton Center for Ocean-Land-Atmosphere Studies, Vol.1, No.1, pp.370–
377, 2013.
[29] Yi Han, J. Chan and C. Leckie, “Analysing virtual machine
usage in cloud computing”, Services, 2013 IEEE Ninth World
Congress, Santa Clara, CA, pp.226–244, 1995.
[30] Bo Gao, Qinyu Zhang, Yongsheng Liang and Naitong Zhang,
“LRD network traffic predicting based on SRD model ”,
(WCSP), 2012 International Conference, huangshan, pp.1–6,
2012.
[31] H. Nakayama, S. Ata and I. Oka, “Predicting time series of
individual trends with resolution adaptive ARIMA”, Measurements and Networking Proceedings, 2013 IEEE International
Workshop, Naples, pp.143–148, 2013.
[32] Yi Xie, Jiankun Hu, Yang Xiang and Shui Yu, “Modeling oscillation behavior of network traffic by nested hidden Markov model
with variable state-duration”, Parallel and Distributed Systems,
IEEE Transactions, Vol.24, No.9, pp.1807–1817, 2013.
JI Yimu was born in Anhui. He
received the Ph.D. degree in computer
science from Nanjing University of Posts
and Telecommunications. He is now an
association professor of Nanjing University of Posts and Telecommunications. His research interests include p2p,
cloud computing and bigdata. (Email:
[email protected])
YUAN Yongge was born in Anhui. He received the B.S. degree in computer science from AnHui Normal University. He is now a Ph.D. candidate of Nanjing University of Posts and Telecommunications. His research interests include p2p,
cloud computing and big data. (Email:
[email protected])
2015
HAN Zhijie was born in Henan. He
received the Ph.D. degree in computer science from Nanjing University of Posts and
Telecommunications. He is now a post doctor of Nanjing University of Posts and
Telecommunications. His research interests
include p2p, cloud computing and big data.
(Email: [email protected])
WANG Hao was born in Hunan.
He received the M.S. degree in computer science from Central South University. He is now a senior research engineer
of Huawei. His research interests include
IP network and IP value-added services.
(Email:jason w [email protected])
HAN Lei was born in Jiangsu. He
received the M.S. degree in computer science from Nanjing University of Science
and Technology. He is now a research director of Huawei.His research interests include
data center, NFV and security. (Email:
[email protected])
SUN Yanfei (corresponding author)
was born in Shandong. He received the
Ph.D. degree in computer science from
Nanjing University of Posts and Telecommunications. He is now a professor of Nanjing University of Posts and Telecommunications. His research interests include p2p,
network QoS and big data. (Email: [email protected])
WANG Ruchuan was born in Anhui, and now he is a professor in Nanjing University of Posts and Telecommunication, and
is interested in the security of network and mobile agent technology, computer network and sensor network, etc. (Email: [email protected])