We propose to use multiscale entropy analysis in characterisation of network traffic and spectrum usage. We show that with such analysis one can quantify complexity and predictability of measured traces in widely varying timescales. We also explicitly compare the results from entropy analysis to classical characterisations of scaling and self-similarity in time series by means of fractal dimension and the Hurst parameter. Our results show that the used entropy analysis indeed complements these measures, being able to uncover new information from traffic traces and time series models. We illustrate the application of these techniques both on time series models and on measured traffic traces of different types. As potential applications of entropy analysis in the networking area, we highlight and discuss anomaly detection and validation of traffic models. In particular, we show that anomalous network traffic can have significantly lower complexity than ordinary traffic, and that commonly used traffic and time series models have different entropy structures compared to the studied traffic traces. We also show that the entropy metrics can be applied to the analysis of wireless communication and networks. We point out that entropy metrics can improve the understanding of how spectrum usage changes over time and can be used to enhance the efficiency of dynamic spectrum access networks. but necessarily ignores large amount of information possibly present in the empirical time series (for a related discussion in an information-theoretic context, see (8)). We show through numerous examples that the introduced metrics can indeed uncover several types of structure from observed traffic, and offer complementary information to the classical metrics of time series analysis. In order to demonstrate that these complexity metrics pro- vide new information about time series, we explicitly com- pare the behaviour of multiscale entropies to usual metrics quantifying scaling and self-similarity. We carry out this comparison using both synthetic data traces generated from a number of well-known discrete time series models as well as measured traffic traces. The latter part is an extension of our earlier work (9). We also discuss the applications of these complexity metrics, focusing in particular on validation of synthetic traffic models and anomaly detection. Based on experimental data we show that there is a significant difference in the complexity of anomalous network traffic compared to regular aggregate traffic observed at a router of an Internet service provider. In addition to the classical applications in traffic analysis, we also study measured traces of wireless spectrum usage for self-similarity and compare our findings to results from multiscale entropy analysis. We specifically show that the methods applied here provide insight in the difference between noise and interference and are capable of discovering reoccurring structures in the data.
['Janne Riihijarvi', 'Matthias Wellens', 'Petri Mahonen']
Measuring Complexity and Predictability in Networks with Multiscale Entropy Analysis