data clustering based on correlation analysis applied to ... · clustering of traffic data based...
TRANSCRIPT
Computer Networks 57 (2013) 3025–3038
Contents lists available at SciVerse ScienceDirect
Computer Networks
journal homepage: www.elsevier .com/ locate/comnet
Data clustering based on correlation analysis applied to highlyvariable domains
1389-1286/$ - see front matter � 2013 Elsevier B.V. All rights reserved.http://dx.doi.org/10.1016/j.comnet.2013.07.004
⇑ Corresponding author. Address: Via Vignolese 905/B, 41125 Modena,Italy, Tel.: +39 0592056273; fax: +39 0592056129.
E-mail addresses: [email protected] (S. Tosi), [email protected] (S. Casolari), [email protected] (M. Colajanni).
Stefania Tosi ⇑, Sara Casolari, Michele ColajanniDepartment of Information Engineering, University of Modena and Reggio Emilia, Italy
a r t i c l e i n f o
Article history:Available online 14 July 2013
Keywords:Traffic clusteringHigh variabilityCorrelation indexNetwork management
a b s t r a c t
Clustering of traffic data based on correlation analysis is an important element of severalnetwork management objectives including traffic shaping and quality of service control.Existing correlation-based clustering algorithms are affected by poor results when appliedto highly variable time series characterizing most network traffic data. This paper proposesa new similarity measure for computing clusters of highly variable data on the basis oftheir correlation. Experimental evaluations on several synthetic and real datasets showthe accuracy and robustness of the proposed solution that improves existing clusteringmethods based on statistical correlations.
� 2013 Elsevier B.V. All rights reserved.
1. Introduction
Clustering is a widely adopted approach for augmentingthe level of knowledge on rough data. The goals ofclustering applied to computer and network datasets canbe different, going from Web sites characterization [1],classification of users navigation patterns [4], network traf-fic classification and management [2]. For example, manynetwork management goals such as flow prioritization,traffic shaping and policing, and diagnostic monitoring aswell as many network engineering problems, such asworkload characterization and modeling, capacity plan-ning, and route provisioning may benefit from traffic clus-tering [2].
In this paper, we are interested in correlation-basedclustering algorithms applied to highly variable time ser-ies. This set of algorithms (e.g., Pearson product moment[7], Spearman and Kendall ranks [8,9]) consider that timeseries are similar if they exhibit some degree of statisticalinter-dependency, and differ from other popular ap-proaches using some geometrical distance (e.g., Euclidean
distance [6], cosine distance [5]) as their similarity measure.The reason of focusing on correlation similarity measuresis distance functions are not always adequate in capturingdependencies among the data. In fact, strong dependenciesmay exist between time series even if their data samplesare far apart from each other as measured by distancefunctions [3]. In the next section, we will support thisstatement through a network related example.
The choice and the performance of the similarity mea-sure impact the quality of any clustering algorithm. Thebetter the accuracy and robustness of the measure in find-ing similarity, the better the quality of the clustering mod-el. Existing correlation indexes are accurate and robust indisclosing similarity except when time series exhibit highvariability. This is the case of most traffic data that arehighly variable in terms of number of connections, requestinter-arrivals, flow sizes (e.g., [13,16,14]). In these scenar-ios, popular correlation indexes, such as the Pearson coef-ficient [7], the Spearman rank [8], the Kendall rank [9],and the Local Correlation index [10], show poor resultsbecause they are unable to capture correlations even whenthey exist.
We propose a new similarity measure that is able todisclose correlation even when time series are character-ized by high variability. The accuracy and robustness ofthe proposed correlation index is achieved through an
3026 S. Tosi et al. / Computer Networks 57 (2013) 3025–3038
original approach that separates trend from perturbationpatterns, and evaluates correlation by computing the sim-ilarity of trend patterns. On this basis, clustering modelscan group time series presenting similarity also whencharacterized by high variability, such as network traffic[16], workloads [15], and data center resource metrics[11]. Such data may have strong correlations that aremasked by perturbations. When some correlations exist,the similarity measure we propose is able to identify themand clustering algorithms can group time series accord-ingly. The improvements with respect to the state of theart are shown on synthetic and real datasets characterizedby high variability.
The remainder of this paper is organized as follows.Section 2 defines the problem of correlation clusteringfor highly variable datasets. Section 3 presents the pro-posed algorithm. Section 4 compares the performance ofdifferent correlation indexes applied to synthetic time ser-ies that represent a fully controlled scenario for evaluation.Section 5 evaluates the proposed algorithm on real scenar-ios. Section 6 concludes the paper with some final remarks.
2. Problem definition
We define the clustering process based on similarity byconsidering a dataset X = {x1, . . . ,xN}. For example, it con-tains all time series of a monitored network, where eachtime series xj = [xj1, . . . ,xjn] is a vector containing atime-ordered discrete sequence of traffic data sampledonce. We are interested in partitioning the N time seriesinto K clusters C � fC1; . . . ; CKg (K 6 N), such that:
1. Ci – £; i ¼ 1; . . . ;K;2.SK
i¼1Ci ¼ X;3. Ci \ Cj ¼£; i; j ¼ 1; . . . ;K and i – j.
The clustering algorithm requires the choice of a simi-larity measure determining groups of time series so thatthe similarity between time series within a cluster is largerthan the similarity between time series belonging to differ-ent clusters. As a similarity measure, we adopt the correla-tion index q between two time series xi and xj 2 X, wherethe absolute value of q ranges between 0 and 1. Whenq = 0, there is no correlation between the two time series,while q = 1 indicates a complete correlation between xi
and xj. The literature offers several guidelines for the bestinterpretation of the value of the correlation measure[17,7], but all criteria depend on the context and purposesof the analysis. In this paper, we do not refer to a specifictraffic scenario, hence we can adopt the most general inter-pretation indicating a strong correlation when q > 0.5, and aweak correlation for q 6 0.5 (e.g., [17]). Different choices forthe threshold do not impact the main conclusions of thispaper.
This paper proposes a new similarity measure that isable to determine correlation clustering even in datasetsexhibiting a high degree of variability, where existing cor-relation indexes (e.g., [7,10,8,9]) are not accurate. High var-iability is a typical phenomenon in network-related timeseries [16] in which most observations take values around
the time series trend (trend pattern) and some observationsdepart from it with appreciable frequency, even by assum-ing extremely large values with non-negligible probability(perturbation pattern). Trend patterns represent the ten-dency of a time series that may be related to the other timeseries, while perturbation patterns consist of randomobservations hiding trends. In this paper, we use the stan-dard deviation as the measure of time series variability be-cause a high standard deviation is the most typicaltrademark of highly variable network measurements[16]. For our purposes, this feature causes trend patternsthat are hard to identify because masked by perturbations.
Fig. 1 illustrates some examples of highly variable timeseries derived from network monitors measuring the num-ber of active connections, active clients and transferred by-tes during a day period. In each time series, we can see thepresence of different trend patterns during working hoursand during the night. These patterns are masked by pertur-bation patterns. However, there is an evident dependencybetween the number of active connections and the amountof transferred bytes. In fact, when the number of activeconnections increases (decreases), the amount of trans-ferred bytes increases (decreases) as well. Despite the var-iability, we want that a good similarity measure can detectthis dependency so to group the two time series in thesame cluster. This goal cannot be achieved through dis-tance-based similarity measures because the distance be-tween the sample values of the two time series is notalways close, hence the two time series cannot be clus-tered together through a traditional distance-based clus-tering model. For this reason, we prefer to considercorrelation as the similarity measure, and we propose acorrelation-based clustering model that is able to disclosedependency even in highly variable scenarios where dis-tance-based clustering models do not work.
The ability of a correlation index in detecting similarityamong correlated time series is measured in terms of accu-racy. The ability in guaranteeing a stable correlation indexwhen conditions do not change is measured in terms ofrobustness. In the case of highly variable time series, themost popular correlation indexes are affected by two mainproblems:
1. low accuracy, since they are unable to detect similari-ties even among correlated time series;
2. low robustness, since they do not guarantee a stableevaluation of the correlation index, even when the rela-tionships between the time series do not change.
Let us give an example of the above problems by refer-ring to the time series shown in Fig. 1 that reports thenumber of active connections and transferred bytes moni-tored during a 12-h period in Fig. 2(a). We evaluate thecorrelation index between the two time series throughthe Pearson correlation index [7], and we report the resultsin Fig. 2(b). (The Pearson index is used as an example, butother existing models do not change the conclusions.) De-spite the relationship between the two time series, thePearson model is affected by both issues reported earlier:its results are characterized by low accuracy because thePearson correlation index remains lower than 0.5 during
00:00 06:00 12:00 18:000
100
200
300
#act
ive
conn
ectio
ns
00:00 06:00 12:00 18:0005
101520
#act
ive
clie
nts
00:00 06:00 12:00 18:00
24:00
24:00
24:00
0
1
2
3x 105
inpu
t byt
es
Fig. 1. Examples of network-related time series.
00:00 6:00 12:000
100
200
300
#act
ive
conn
s
00:00 6:00 12:000
1
2
3 x 105
inpu
t byt
es
00:00 06:00 12:000
0.5
1
Cor
rela
tion
inde
x
Fig. 2. Correlation index results on highly variable data.
S. Tosi et al. / Computer Networks 57 (2013) 3025–3038 3027
the entire interval of observation; its results are character-ized by low robustness because the correlation index pre-sents oscillations even when the correlation between thetimes series does not change.
A typical approach addressing issues related to highvariable time series is to refer to some filtering algorithms(e.g., [18]). In fact, filtering data and then applying somecorrelation model does not address the above issues, butadds further hard-to-solve problems that are related tothe choice of the ‘‘right’’ filter and to the setting of itsparameters. Discussing the largely investigated problemsrelated to filters is out of the scope of this paper. We ob-serve the two main conclusions: it is impossible to choosethe best filter and its parameters without a preliminaryextensive study about data statistical properties[18,11,12]. A similar study is even more complex whendata are characterized by high variability. Moreover, theconcept of best filter requires an anticipated definition ofthe context and goals of filtering, that in general is toughor impossible. Basically, we have two alternatives thatare equally useless for clustering purposes: to apply a weakor a strong filter. A weak filter removes small variability,
hence underlying relationships among time series remainundetectable by existing correlation models; a strong filtermay remove important information about trend patternsand thus it prevents the possibility of finding existingcorrelations.
As an example, let us reconsider the time series repre-sented in Fig. 2(a). We choose a popular filter such as theExponential Weighted Moving Average (EWMA) [18] as abasis, and we apply different parameters in order to obtaina weak and a strong filter. The resultant time series areshown in Figs. 3(a) and 4(a), respectively. In Fig. 3(b), wereport the results of the Pearson index computed on theweakly filtered data. As expected, the results are improvedwith respect to the not filtered case, but the conclusionremains unchanged: the correlation index has low accu-racy since it remains lower than 0.5 for most of the obser-vation interval; it has low robustness since its markedoscillations cause a continuous shift from considering thetime series correlated to uncorrelated, then correlatedagain, and so on.
By increasing the filter strength, most perturbations arediscarded. The problem is that a strong filter cancels also
00:00 6:00 12:000
100
200
300
#act
ive
conn
s
00:00 6:00 12:000
1
2
3 x 105in
put b
ytes
00:00 06:00 12:000
0.5
1
Cor
rela
tion
inde
x
Fig. 3. Weak filtering applied before correlation analysis.
00:00 6:00 12:000
100
200
300
#act
ive
conn
s
00:00 6:00 12:000
1
2
3 x 105
inpu
t byt
es
00:00 06:00 12:000
0.5
1
Cor
rela
tion
inde
x
Fig. 4. Strong filtering applied before correlation analysis.
3028 S. Tosi et al. / Computer Networks 57 (2013) 3025–3038
information about trend patterns characterizing the timeseries. The result is that the Pearson correlation index be-comes even less accurate and less robust, as we see inFig. 4(b).
All these results evidence that high variability repre-sents a limit of existing correlation indexes even whenthey are integrated with filtering techniques. These limitsof existing correlation indexes affect the quality of the re-sults of clustering models based on similarity when ap-plied to highly variable datasets. In these contexts, therisk is that time series characterized by strong correlationmay be clustered in different groups, and uncorrelatedtime series may be assigned to the same cluster. These rea-sons motivate the need of a new similarity measure that isable to disclose correlations in an accurate and robust wayin highly variable contexts. The model proposed in the fol-lowing section has several benefits: it does not require anyassumption about statistical properties, any pre-analysis oftime series characteristics, and any integration with pre-filtering techniques. Moreover, it is able to adapt itsparameters to data characteristics, to capture linear andnon-linear dependences, and to cluster time series basingon their statistical correlation in an accurate and robustway.
3. Clustering of highly variable datasets
In this section, we present a novel correlation index,named CoHiVa (Correlation for Highly Variable data), that
may be used as the similarity measure of different cluster-ing algorithm(s) applied to highly variable time series.CoHiVa may be viewed as an improvement of the LoCoscore [10] that evaluates correlation through the analysisof pattern similarity. CoHiVa extends this idea to the corre-lation analysis in highly variable domains. Unlike the Pear-son model [7] that works well only if time series are linkedby a linear relationship, CoHiVa does not assume any datadependency and it is able to capture linear and non-lineardependencies. Moreover, CoHiVa does not assume any datadistribution, as required by the Spearman and Kendallranks [8,9].
The described clustering algorithm adopts CoHiVa tomodify the complete-linkage clustering model [19], butother clustering algorithms using similarity measures canbe considered as well. The proposed algorithm denotes Nsingleton clusters fC1; . . . ; CNg, each corresponding to amonitored time series (Ci � xi; i ¼ 1; . . . ;N). It then com-putes the N � N similarity matrix D containing the CoHiVacorrelation indexes q(xp, xq) between all pairs of time ser-ies xp, xq in X through the following procedure.
Let us consider one time series xp = [xp1, . . . ,xpn] of thepair. The first goal is to identify the main patterns in xp,where the patterns correspond to trends (i.e., periodicand seasonal components) and perturbations. To this end,we apply the Singular Value Decomposition (SVD) [10] tothe auto-covariance matrix of the time series. Among thespectral decomposition techniques, SVD is considered asthe baseline technique for separating existing patterns
S. Tosi et al. / Computer Networks 57 (2013) 3025–3038 3029
without any assumption about the statistical characteris-tics of data [20,21].
In practice, we estimate the full auto-covariance matrixof the time series xp, that is defined as:
UðxpÞ ¼ xp � xp; ð1Þ
where U(xp) is the auto-covariance matrix of xp.Then, we compute the SVD of the auto-covariance ma-
trix U(xp) as follows:
UðxpÞ ¼ UðxpÞRðxpÞVðxpÞT ; ð2Þ
where U(xp),R(xp) and VðxpÞ 2 Rn�n.The columns vi of V(xp) � [v1, . . . ,vn] are the right singu-
lar vectors of U(xp). Similarly, the columns ui of U(xp) -� [u1, . . . ,un] are the left singular vectors of U(xp). Finally,R(xp) � diag[s1, . . . ,sn] is a diagonal matrix with positivevalues si, called the singular values of U(xp).
The singular vectors corresponding to small singularvalues are composed by errors that usually contaminatethe measured variables [24]. The contribution of these er-rors must be discarded by eliminating the singular vectorscorresponding to the smallest singular values [25]. Byretaining just the principal vectors corresponding to thehighest k singular values (k < n) we can reconstruct a k-dimensional approximation of the correlation matrix:
UðxpÞ � UðxpÞRðxpÞVðxpÞT ; ð3Þ
where UðxpÞ � ½�u1; . . . ; �uk�; VðxpÞ � ½�v1; . . . ; �vk� andRðxpÞ � diag½�s1; . . . ;�sk�.
Literature on SVD gives little importance to the problemof dynamically selecting the appropriate number of princi-pal vectors that capture the patterns (e.g., [10,20]). A com-mon approach is to choose a fixed number of principalvectors independently of data characteristics, but thischoice is unsuitable to time varying contexts where thestatistical properties of data may change frequently. Onthe other hand, our algorithm chooses a variable numberof principal vectors that takes into account the statisticalcharacteristics of the considered data. To this purpose,we select the principal vectors accounting for 90% of thevariation in the analyzed time series as in [23]. In thisway, the number of selected principal vectors varies fromtime series to time series according to data characteristics.The variable number of principal vectors used to capturethe main patterns of the time series is denoted by k.
In order to find correlations also in the case of high var-iability, we analyze the main patterns of xp and retain justtrend patterns because they represent the tendency of atime series that may be related to the other time series.The problem is that in contexts characterized by high var-iability it is expected that the extraction of main patternsincludes also some perturbation patterns among the kprincipal vectors [26]. As these last patterns prevent theidentification of trends and their possible correlations,our algorithm discards them. The idea is to build a newmatrix based on a subspace of k 6 k principal vectors thatcapture just trend patterns. To remove perturbation pat-terns from UðxpÞ in (3), our algorithm computes the Hurstexponent H of the k principal vectors by means of the re-scaled range analysis of Hurst [27]. The Hurst exponent
measures whether the data have pure random variabilityor some underlying trends [28]. For each principal vector�ui 2 UðxpÞ of length n, we first define its cumulative deviateseries:
Zt ¼Xt
j¼1
ð�uj �mÞ; ð4Þ
where t = 1,2, . . . ,n, �uj is the jth element of the ith principalvector, and m is the mean of �ui.
To compute the rescaled range RðnÞSðnÞ, we calculate the
range:
RðnÞ ¼maxðZ1; Z2; . . . ; ZnÞ �minðZ1; Z2; . . . ; ZnÞ; ð5Þ
and the standard deviation:
SðnÞ ¼ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi1n
Xn
j¼1ð�uj �mÞ2
r: ð6Þ
The Hurst exponent H is defined in terms of the asymp-totic behavior of the rescaled range as a function of thetime span of a time series as follows [27]:
ERðnÞSðnÞ
� �¼ CnH as n!1; ð7Þ
where E RðnÞSðnÞ
h iis the expected value of the rescaled range, n
is the number of observations in a time series, and C is aconstant.
If the estimated Hurst exponent Hi of a principal vector�ui 2 UðxpÞ is close to 0.5, then we can conclude that �ui con-tains perturbations. On the other hand, if the Hurst expo-nent remains far from 0.5, then we can assume that �ui isa trend principal vector.
Our model builds up a new bUðxpÞ matrix containingonly the k trend principal vectors ul; l ¼ 1; . . . ; k as follows:8�ui 2 UðxpÞ; i ¼ 1; . . . ; k:
ul � �ui if Hi < 0:5� d2
or Hi > 0:5þ d2; ð8Þ
where d is a two-sided 95% confidence interval computedon the number of samples [28].
This separation between perturbation and trend pat-terns allows us to remove perturbation patterns in thetime series and to focus only on trends. By focusing onthe k trend principal vectors, we are able to construct anew approximation of the U(xp) matrix that we nametrend approximation. Given bUðxpÞ � ½u1; . . . ; uk�, thecorresponding singular values and the right singularvectors form the matrices bRðxpÞ � diag½s1; . . . ; sk� andbVðxpÞ � ½v1; . . . ; vk�, respectively. Through these matrices,the trend approximation of the correlation matrix usingonly trend patterns is given by:
bUðxpÞ � bUðxpÞbRðxpÞbVðxpÞT : ð9Þ
The matrix bUðxpÞ approximates the trend behavior ofU(xp) by removing error information and perturbation pat-terns that affect the identification of the trends of the timeseries.
After the extraction of the main trends from the timeseries xp, we evaluate whether it is correlated or not withthe other time series xq of the pair by computing how closetheir trends are. When the trend approximation matrices
3030 S. Tosi et al. / Computer Networks 57 (2013) 3025–3038
bUðxpÞ and bUðxqÞ are similar, the time series xp and xq followsimilar (linear or non-linear) trends, and we can guess thatthe two time series are correlated. In geometric terms, iftwo time series are correlated, then the trend principalvectors of one time series should lie within the subspacespanned by the trend principal vectors of the other timeseries. For this reason, we compute the CoHiVa correlationindex between xp and xq by projecting the trend principalvectors of the time series xp into the trend principal vectorsof xq, as following:
qðxp;xqÞ ¼1
kðxpÞ þ kðxqÞðkbUðxpÞT bUðxqÞk
þ kbUðxqÞT bUðxpÞkÞ; ð10Þ
where kðxpÞ and kðxqÞ are the amounts of trend principalvectors of U(xp) and U(xq), respectively, while bUðxpÞ andbUðxqÞ are the trend principal vectors matrices collectingthem.
Through this procedure, our algorithm finds out theCoHiVa correlation indexes q(xp, xq) between all pairs oftime series in X and uses them to fill the N � N similaritymatrix D. These correlation values represent the measuresof similarity between all the clusters.
We then proceed through the following steps:
1. Find the most correlated pair of clusters in the similar-ity matrix:
qðxr ;xsÞ ¼ max16p;q6N;p–q
qðxp;xqÞ: ð11Þ
2. Combine cluster Cr and cluster Cs to form a new cluster,denoted as Cðr;sÞ.
3. Update the similarity matrixD by deleting the rows andcolumns corresponding to clusters Cr and Cs and by add-ing a row and a column corresponding to the early cre-ated cluster. The similarity between the new clusterCðr;sÞ and a generic old cluster Ci is defined as:
qðxi;xðr;sÞÞ ¼maxðqðxi; xrÞ;qðxi; xsÞÞ: ð12Þ
4. Repeat steps (1)–(3) until all objects are in a cluster.
This procedure results as an organized tree built upaccording to the similarity matrix computed through CoH-iVa. Cutting the tree at a given height gives a partition clus-tering at a selected precision /. For example, if wediscriminate between weak and strong correlation throughthe value of / = 0.5, we cut the tree when the highest cor-relation value found in the similarity matrix goes below /= 0.5. The time series forming a sub-tree after this cut areconsidered part of the same cluster [22].
4. Performance evaluation
The quality of the proposed clustering algorithmstrongly depends on the performance of the similaritymeasure. Hence, in this section we evaluate the perfor-mance of the CoHiVa index in finding correlation, and wecompare it against the results of the following state-of-the-art alternatives: the Pearson product moment (Pear-son) [7], the Spearman rank (Spearman) [8], the Kendall
rank (Kendall) [9], and the Local Correlation (LoCo) index[10]. In order to stress the importance of managing thetime series variability for disclosing correlation, we also re-port the results that we would obtain by avoiding the trendpatterns selection step based on the Hurst rescaled rangeanalysis in our model (CoHiVa without Hurst analysis).Moreover, we make our evaluation even more exhaustiveby comparing the performance of CoHiVa to that of astate-of-the-art model that is integrated with apre-filtering technique (Pearson with filtering).
To evaluate the accuracy and robustness of the consid-ered indexes we initially refer to synthetic time series thatallow us to have full control on their actual degree of cor-relation. The considered data refer to three types of timeseries: (1) correlated with linear dependence, (2) corre-lated with non-linear dependence, and (3) not correlated.
The time series of each scenario take values in the range[0,1]. In order to evaluate the ability of the correlation in-dexes in capturing different types of dependency for differ-ent levels of variability, we introduce perturbations fromN(0, r), where r 2 {0.01,0.05,0.1, . . . ,0.5} is the standarddeviation that quantifies the intensity of perturbationsadded to data [29,30]. We remind that we consider astrong correlation when q > 0.5, and a weak correlationfor q 6 0.5 [17] although this choice does not affect themain conclusions of this paper. The performance of thecorrelation index is evaluated in terms of accuracy androbustness over 1000 independent generations of time ser-ies for each scenario.
4.1. Accuracy
We define the accuracy of a correlation index as its abil-ity in capturing correlation when data present some linearor non-linear relationships, and in categorizing as not cor-related time series having no dependence. For example, anaccurate index should obtain a correlation value close to 1in the two correlated scenarios, and a value close to 0 inthe not correlated scenario. The first set of experimentsevaluates the accuracy of the correlation indexes whenthe time series are characterized by different intensitiesof perturbations in the three scenarios.
The performance of the considered correlation indexesin the linear scenario is reported in Fig. 5(a). As expected,we observe a decrease of the accuracy of each index forincreasing values of r, but the impact of perturbations dif-fers substantially for different indexes. When the disper-sion is very low (r 6 0.1), all indexes are able to capturethe strong correlation between data. When the dispersionincreases (r > 0.1), the Kendall rank is the first losing itsability of detecting time series correlation. In higher vari-able contexts (r > 0.15), only the CoHiVa index capturesthe strong data correlation, thanks to a value always higherthan 0.6. We can also appreciate the benefits achievable byperforming the Hurst rescaled range analysis for retainingonly trend patterns in the time series. If we skip this step,CoHiVa without Hurst analysis still improves state-of-the-art models performance but it cannot capture the strongcorrelation between time series when the data variabilityreaches critical levels (r > 0.45).
Fig. 5. Accuracy of the correlation indexes.
S. Tosi et al. / Computer Networks 57 (2013) 3025–3038 3031
The accuracy of the indexes deteriorates when we passto a scenario where the correlation between time series isnon-linear. A comparison between Fig. 5(a) and (b) gives afirst idea about the overall results. Only the CoHiVa indexis able to detect a strong correlation for any r when therelationship between data is non-linear, also thanks tothe Hurst-based trend pattern selection that guaranteeshigh correlation results for each perturbation level. Onthe other hand, all existing indexes are affected by a lowaccuracy for increasing values of r. (They estimate a weakcorrelation even when time series are perturbed by verylow levels of dispersion, such as r = 0.15.) It is also inter-esting to observe that the Spearman rank, which is specif-ically oriented to capture non-linear dependencies [8],exhibits the best accuracy when the dispersion is verylow (that is, r < 0.05), but it loses its capacity as soon asthe time series are characterized by higher perturbations.
To address issues related to high variability, the state-of-the-art models may increase their accuracy by workingon a filtered representation of the original time series. Weanticipated in Section 2 that this approach does not workwell, but for the sake of an exhaustive comparison we com-
pare the performance of CoHiVa against a Pearson modelcombined with a pre-filtering technique. We have to spec-ify that the choice of the best filtering model and of itsparameters is a serious issue by itself, and is out of thescope of this paper.
We integrate the Pearson correlation model with anEWMA filter that we have experimentally evaluated as giv-ing good results. We do not claim that we are applying anoptimal filter with optimal parameter setting, even be-cause the definition of optimum is improper in thiscontext.
Fig. 6 shows the results obtained by applying the Pear-son model to data filtered through a weak and a strong fil-ter. If we compare the results of Pearson without filteringto the results of Pearson with filtering, we can appreciatethat the filter in fact improves accuracy: the correlation va-lue is higher for every r and for linear and non-linear sce-narios. In the linear scenario shown in Fig. 6(a), the Pearsonmodel with filtering is able to detect a correlation indexhigher than 0.5 for any r. On the other hand, if we considerthe non-linear scenario shown in Fig. 6(b), there is a drasticdecrease of the correlation index. Both weak and strong fil-
0.01 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.50
0.10.20.30.40.50.60.70.80.9
1
Standard Deviation
Cor
rela
tion
CoHiVaPearsonPearson with weak filteringPearson with strong filtering
0.01 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.50
0.10.20.30.40.50.60.70.80.9
1
Standard Deviation
Cor
rela
tion
CoHiVaPearsonPearson with weak filteringPearson with strong filtering
Fig. 6. Accuracy of the correlation indexes using data filtering.
3032 S. Tosi et al. / Computer Networks 57 (2013) 3025–3038
tering are useless because they estimate a q 6 0.5 whenr > 0.2 and r > 0.3, respectively.
These results demonstrate that filters do not guaranteeaccurate results, besides the further problems related tothe choice of the best filter and of its parameters in highlyvariable contexts.
We finally report some results of the considered corre-lation indexes applied to a scenario characterized by syn-thetic time series characterized by no dependence. Theseresults complete the accuracy evaluation of the indexes,because we expect that an accurate index can also detectthe absence of correlation. Despite the level of variability,we see in Fig. 7 that all the indexes are accurate and detecta weak correlation between time series having no depen-dence. These results confirm that, even though CoHiVa as-sumes high values when applied to correlated time series,its values does not remain high when applied to time serieshaving no dependence. As well as existing correlation in-dexes, our index is able to avoid to detect correlation whenapplied to uncorrelated datasets.
4.2. Robustness
The accuracy of a correlation index must be combinedwith information about its robustness, that assesses thereliability of correlation results across different evalua-
Fig. 7. Analysis of accuracy in a
tions. We quantify the robustness in terms of coefficientof variation (CoV) for different evaluations. The coefficientof variation is defined as the ratio of the standard deviationto the mean of the correlation values over all the experi-ments. A lower CoV denotes a better robustness of the cor-relation index.
We evaluate the robustness of the results obtained inSection 4.1. Table 1 reports the CoV of each considered cor-relation index applied to time series in a linear scenario.The columns refer to the increasing values of perturbationsintensity r, while the rows report the correlation indexes.The CoV of all correlation indexes increases when r in-creases. Compared to existing solutions, the CoHiVa indexis able to keep the lowest CoV for any r value. Thanks to aCoV always lower than 0.15, the proposed correlation in-dex guarantees high robustness in capturing linear correla-tions also among highly variable data. Moreover, we seethat the robustness of our model benefits from performingthe rescaled range analysis of Hurst.
As expected, a non-linear context worsens the robust-ness of all the indexes. This main conclusion is confirmedby the CoV values reported in Table 2. These results dem-onstrate that only the CoHiVa model is able to guaranteea CoV lower than 0.2 for any perturbation intensity. Onthe other hand, state-of-the-art models show poor resultseven for medium–low values of r (r 6 0.2). With the
not correlated scenario.
Table 1Coefficient of variation in the linear scenario.
r
0.01 0.1 0.2 0.3 0.4 0.5
Pearson 0.0232 0.0299 0.0914 0.1992 0.3437 0.4817Spearman 0.0227 0.0304 0.0905 0.2036 0.3496 0.4874Kendall 0.0371 0.0486 0.1098 0.2170 0.3606 0.4936LoCo 0.0220 0.0284 0.0835 0.1653 0.2452 0.2735Pearson with weak filtering 0.0001 0.0069 0.0324 0.0785 0.1206 0.1787Pearson with strong filtering 0.0001 0.0123 0.0497 0.0917 0.1318 0.1736CoHiVa without Hurst analysis 0.0127 0.0190 0.0342 0.0688 0.1301 0.2405CoHiVa 0.0073 0.0086 0.0217 0.0498 0.0888 0.1343
Table 2Coefficient of variation in the non-linear scenario.
r
0.01 0.1 0.2 0.3 0.4 0.5
Pearson 0.0274 0.1296 0.3704 0.5843 0.6838 0.7052Spearman 0.0266 0.1457 0.3894 0.5919 0.6892 0.7104Kendall 0.0391 0.1632 0.4014 0.5997 0.6960 0.7194LoCo 0.0258 0.1136 0.2550 0.2923 0.3073 0.2924Pearson with weak filtering 0.0070 0.0835 0.2026 0.2215 0.2224 0.2236Pearson with strong filtering 0.0083 0.0944 0.2120 0.2468 0.2434 0.2473CoHiVa without Hurst analysis 0.0407 0.0392 0.1748 0.2083 0.2205 0.2881CoHiVa 0.0380 0.0172 0.1467 0.1614 0.1711 0.1926
S. Tosi et al. / Computer Networks 57 (2013) 3025–3038 3033
exception of LoCo and Pearson model integrated with fil-tering, all the other correlation indexes are quite unreliablein highly variable contexts because they reach CoV valuesaround 0.7. These results confirm that they cannot be usedto capture non-linear relationships among highly variabletime series for clustering purposes.
Our analyses confirm that the most popular correlationindexes are affected by scarce accuracy and robustnesswhen data exhibit high variabilities and/or non-lineardependency. The main result is that the proposed CoHiVaindex is able to guarantee good performance for any con-sidered scenario and represents a good choice as the simi-larity measure to be used in clustering algorithms workingon highly variable datasets.
5. Experimental results
We evaluate the quality of the proposed clustering algo-rithm by referring to two network-related datasets charac-terized by high variability: Abilene network traffic, andmeasurements collected at the border router of ouruniversity.
� Abilene network.The publicly available Abilene dataset contains aggre-gate data based on measurements of origin–destination(OD) flows on the Abilene network [31]. We considersampled data from every router over a 7-day period,starting December 12, 2003.1 At sampling period of5 min, each link produces 2016 samples a week.
1 Data available at: http://math.bu.edu/people/kolaczyk/datasets.html.
� University network.The dataset is obtained from a monitor attached to aborder router of the university and contains flows char-acterized by different metrics, such as total number ofpackets (excluding ack packets), packet size statistics(mean, minimum, maximum, quartiles), number ofbytes transferred in each direction, number of activeconnections and number of active clients. These net-work metrics are aggregated every 10 s. The presentedresults refer to 1 day characterized by 8640 samplesfor each network metric.
The clustering algorithms applied to these two datasetsare used for two different purposes: for traffic clustering ofAbilene network data (Section 5.1), and for server cluster-ing of university network data (Section 5.2).
5.1. Traffic clustering
The identification of the main statistical properties oftraffic flows and the clustering of flows based on suchproperties are crucial to many network management tasksand network engineering problems [2]. Due to the highvariability of OD traffic flows [16], clustering solutionsmust be able to group data even in highly variable con-texts. Our algorithm represents a good solution for trafficclustering because it is able to identify correlation betweenOD flow traffic patterns and to cluster together flows pre-senting similar statistical properties.
We carried out a preliminary analysis of the Abilenedataset with the goal of extracting the main statisticalproperties shared by the OD traffic flows that we expect
3034 S. Tosi et al. / Computer Networks 57 (2013) 3025–3038
to be shared by the time series clustered together. Thisanalysis evidences the presence of the following six mainstatistical properties:
1. Periodic pattern of 6 h: some OD flows have fluctuationsof request volume over a time period of 6 h, typically
Mon Tue Wen Thu Fri Sat Sun0
2
4
6x 106
OD
flow
Mon Tue Wen Thu Fri Sat Sun0
1
2
3 x 107
OD
flow
Mon Tue Wen Thu Fri Sat Sun0
5
10
15 x 106
OD
flow
OD 109 STTL−STTL
OD 33 DNVR−WASH
OD 61 KSCY−KSCY
Mon Tue Wen Thu Fri Sat Sun0
5
10 x 106
OD
flow
OD
flow
Mon Tue Wen Thu Fri Sat Sun0
2
4 x 107
OD
flow
OD
flow
OD 104 STTL−IPLS
OD 88 NYCM−WASH
Mon Tue0
1
2 x 107
OD
flow
Mon Tue0
1
2 x 107
OD
flow OD 75 LOSA−SNVA
OD 42 HSTN−SNVA
OD
flow
OD
flow
Mon Tue Wen Thu Fri Sat Sun0
2
4 x 107
OD
flow
Mon Tue Wed Thu Fri Sat0
5 x 107
OD
flow OD 44 HSTN − WASH
OD 77 LOSA − WASH
OD
flow
OD
flow
Fig. 8. Characteristics of A
related to hourly human behaviors. Some intra-dailyperiodic patterns are shown in Fig. 8(a).
2. Periodic pattern of 24 h: some OD flows present the typ-ical increase of user requests during working hours anda decrease during the night. Some examples of dailypatterns are reported in Fig. 8(b).
Mon Tue Wed Thu Fri Sat Sun0
1
2
3 x 107
OD
flow
Mon Tue Wen Thu Fri Sat Sun0
5
10
15 x 107
OD
flow
Mon Tue Wen Thu Fri Sat Sun0
5
10 x 106
OD
flow
OD 25 DNVR−DNVR
OD 31 DNVR−SNVA
OD 121 WASH−WASH
Mon Tue Wed Thu Fri Sat Sun0
1
2
3 x 107
Mon Tue Wen Thu Fri Sat Sun0
1
2 x 107
OD 55 IPLS−WASH
OD 82 NYCM−IPLS
Mon Tue0
1
2 x 107
Mon Tue0
1
2 x 107
OD 34 HSTN−ATLA
OD 67 LOSA−ATLA
Mon Tue Wen Thu Fri Sat Sun0
2
4 x 106
Mon Tue Wed Thu Fri Sat Sun0
1
2 x 106
OD 5 WASH−NYCM
OD 6 WASH−ATLA
bilene traffic flows.
S. Tosi et al. / Computer Networks 57 (2013) 3025–3038 3035
3. Repeated spikes every 45 min: some OD flows manifestbursts of requests repeated every 45 min. Fig. 8(c)shows this behavior during a time interval of 2 days.
4. Repeated spikes every 90 min: some OD flows exhibitregular spikes every hour and a half as in Fig. 8(d).
5. Aperiodic trend: some OD flows are characterized byincreasing or decreasing trends even thought they donot manifest any periodicity. Some flows with thesecharacteristics are presented in Fig. 8(e).
6. Stochastic pattern: some OD flows are characterized byminor bursts and irregular behavior as those in Fig. 8(f).
This preliminary analysis gives us the ground truth. Inother words, we can expect that the most effective cluster-ing algorithm is able to find out 6 clusters, each one includ-ing all and only the OD flows sharing just one of theidentified statistical properties. Thanks to this term ofcomparison, we can compute the recall and the precision[32] of the other clustering algorithms.
The recall measures the ability of an algorithm to clustera flow presenting a statistical property together with otherflows having that statistical property (e.g., a flow with a24-h periodic pattern is clustered together with the flowshaving a daily period). To achieve a recall of 100%, the clus-
Table 3Recall and precision.
Cluster
Periodic pattern of 6 h RecallPrecision
Periodic pattern of 24 h RecallPrecision
Repeated spikes every 45 min RecallPrecision
Repeated spikes every 90 min RecallPrecision
Aperiodic trend RecallPrecision
Stochastic pattern RecallPrecision
0
0.2
0.4
0.6
0.8
1
period 6hr period 24hr spike 45min
F-m
easu
re
Clus
CoHiVa P
Fig. 9. F-me
tering algorithm must insert each flow in the cluster repre-senting the corresponding statistical property.
The precision gives information about the ability of theclustering algorithm to limit the number of flows thatpresent a statistical property but are clustered togetherwith flows characterized by a different statistical property(e.g., a flow with a 24-h periodic pattern is clustered to-gether with 6-h periodic flows). A precision of 100% meansthat the algorithm inserts into a cluster only the flows withthe corresponding statistical property.
We compare the results of the complete-linkage clus-tering algorithm using CoHiVa against those obtainedthrough the Pearson product moment and the LoCo score,that achieved the best trade-off between accuracy androbustness on synthetic settings. Table 3 reports the recalland precision values for the three considered algorithms.This table evidences three main results.
� The ability of CoHiVa in disclosing the presence of all 6clusters, since it obtains high recall and precision valuesover all the clusters. The null values obtained by Pear-son in both precision and recall over the cluster withdaily periodic flows mean that this index does notreveal the presence of correlated flows having daily pat-
CoHiVa (%) Pearson (%) LoCo (%)
100 100 10089 56 8991 0 8183 0 7875 100 060 40 0
100 100 0100 100 0100 100 0100 67 0
81 49 6791 100 83
spike 90min aperiodic stochastic
ter
earson LoCo
asure.
0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 10.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
CoHiVa InBytes/InPackets
CoH
iVa
Out
Byte
s/O
utPa
cket
s
Web Ftp Dns Smb Sql Oracle MySql
0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 10.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Pearson InBytes/InPackets
Pear
son
Out
Byte
s/O
utPa
cket
s
Web Ftp Dns Smb Sql Oracle MySql
0.7
0.8
0.9
1
/Out
Pack
ets
Table 4Server classes.
Web DNS FTP Samba Oracle MySql Microsoft Sql
# Servers 7 2 2 5 1 2 2
3036 S. Tosi et al. / Computer Networks 57 (2013) 3025–3038
terns. LoCo is unable to identify spiky and aperiodicflows because it is characterized by null recall and pre-cision values over these three clusters. These results arein accord to those achieved on synthetic settings in theprevious section: Pearson is unable to identify correla-tion among highly variable data (e.g., flows with a 24-h period), while LoCo fails in finding spiky and aperiodicflows because it considers just the first principal com-ponent not including information of those irregularpatterns.� The ability of CoHiVa in discriminating between corre-
lated and not correlated flows. This algorithm guaran-tees high recall and precision values in theidentification of correlated flows belonging to the first5 clusters and the best performance for the identifica-tion of uncorrelated stochastic flows. On the other hand,Pearson and LoCo insert in the same cluster many flowsthat are correlated with other flows, as their lowerrecall values over the stochastic cluster demonstrate.� The ability of CoHiVa in guaranteeing the best compro-
mise between the capacity of clustering together flowshaving similar statistical properties and the capacityof limiting the number of flows that are wronglyclassified.
This last result can be appreciated by introducing a fur-ther performance measure. Since a trade-off between recalland precision values exists, these two metrics can be com-bined into one measure, namely the F-measure [32], thatgives a global estimation of the quality of the clusteringalgorithm through the weighted harmonic mean of preci-sion and recall, that is:
F-measure ¼ 2precision � recallprecisionþ recall
ð13Þ
The closest the F-measure to 1, the highest the qualityof the clustering algorithm.
The combined effect of recall and precision can beappreciated in Fig. 9 showing that CoHiVa achieves thebest F-measure in all cluster identification. This is animportant result about the robustness of CoHiVa: indepen-dently of the flow statistical properties, CoHiVa guaranteesthe best compromise between the number of correctly andwrongly clustered flows. Pearson and LoCo achieve somegood results but they show also unacceptable performancein other cases. In particular, the null F-measure values ofPearson and LoCo indexes in the identification of flowswith highly variable, spiky and aperiodic flows limit theirapplicability as similarity measures for correlation-basedclustering algorithms.
0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 10.2
0.3
0.4
0.5
0.6
LoCo InBytes/InPackets
LoC
o O
utBy
tes
Web Ftp Dns Smb Sql Oracle MySql
Fig. 10. Server clustering results.
5.2. Server clustering
As a further test case, we apply the clustering algo-rithms to the identification of network-based servers hav-ing similar statistical behavior. The idea is to group serversperforming similar tasks through the analysis of the net-work traffic flows they generate. Even these scenarios arecharacterized by highly variable measures gathered by anetwork monitor connected to the border router of our
university. We select 21 destination servers by consideringthe destination address and the port number of the trafficflows. Table 4 reports the different classes of servers andthe number of monitored servers for each class. We expectthat a good clustering algorithm is able to group togetherhosts supporting same server processes. In other words,we expect that Web servers are grouped in the same clus-
S. Tosi et al. / Computer Networks 57 (2013) 3025–3038 3037
ter, and that this cluster is separated from the cluster con-taining FTP servers, as well as from that containing DNSservers, and so on.
We apply a K-means clustering model [6] to the 21datasets referring to the monitored network metrics ofeach considered server. We set K = 7 because we have se-ven classes of servers. We consider clustering in a 2-dimensional space based on the correlation among input/output bytes and input/output packets of the monitoredtraffic flows, supported by previous studies on correlationof flow characteristics (e.g., [33]). By considering thesetwo pairs of metrics, for each dataset related to one ofthe 21 servers we compute three similarity matrices con-taining the pair-wise similarity measures computedthrough CoHiVa, Pearson, and Loco. These measures allowus to place each server in the spaces generated through theindexes. In each space, the K-means model groups serversso as to minimize the within-cluster distance [6].
Fig. 10 shows the results related to the CoHiVa index(Fig. 10(a)), the Pearson product moment (Fig. 10(b)), andthe LoCo score (Fig. 10(c)).
For this dataset, CoHiVa is able to group all the Webservers in a cluster, that is separated from the cluster con-taining the two DNS servers, from that referring to the twoFTP servers, from the one for all the Samba servers, and soon. We should note that the chosen metrics and similaritymeasure do not allow us to discriminate between the Ora-cle and MySql database servers, that consequently aregrouped together.
The results related to Pearson and LoCo are muchpoorer: they cluster different types of servers in the samecluster, and some servers are in singleton clusters despitetheir expected correlation. These results are caused bythe high variability of some monitored metrics and to thelow mean value of others. As a consequence, Pearson andLoCo correlation indexes see as uncorrelated time seriesthat actually present some dependency, while they seehigh correlations between time series that are actuallyindependent.
The reported results show that CoHiVa represents aneffective solution for clustering data in highly variable con-texts where state-of-the-art similarity measures areaffected by poor results.
6. Conclusion
We propose a novel similarity measure that can beapplied to correlation-based clustering algorithms specifi-cally tailored to the analysis of time series characterizedby high variability. This paper is motivated by the observa-tion that existing clustering algorithms are affected bypoor results when data are highly variable as in most data-sets obtained by network and system measurements.Experimental evaluations carried on synthetic and realdatasets demonstrate that our solution improves the stateof the art in clustering traffic flows and server behaviors.These promising results open the possibility of using theproposed model as a support for several applicationsincluding traffic and network management, and capacityplanning of networks and systems.
References
[1] Z. Liu, M. Squillante, C. Xia, S. Yu, L. Zhang, Profile-based trafficcharacterization of commercial web sites, in: Proc. of the 18thInternational Teletraffic Congress, Berlin, Germany, 2003.
[2] J. Erman, M. Arlitt, A. Mahanti, Traffic classification using clusteringalgorithms, in: Proc. of the 2006 SIGCOMM Workshop on Miningnetwork data, New York, USA, 2006.
[3] H. Wang, W. Wang, J. Yang, P.S. Yu, Clustering by patternsimilarity in large data sets, in: Proc. of the 2002 ACM SIGMODInternational Conference on Management of Data, Madison,Wisconsin, 2002.
[4] B. Hay, G. Wets, K. Vanhoof, Clustering navigation patterns on awebsite using a sequence alignment method, in: Proc. of 17thInternational Joint Conference on Artificial Intelligence, Washington,USA, 2001.
[5] M. Steinbach, G. Karypis, V. Kumar, A comparison of documentclustering techniques, in: KDD Workshop on Text Mining, 2000.
[6] J.B. MacQueen, Some methods for classification and analysis ofmultivariate observations, in: Proc. of the 5th Berkeley Symposiumon Mathematical Statistics and Probability, vol. 1, 1967, pp. 281–297.
[7] J. Cohen, P. Cohen, S.G. West, L.S. Aiken, Applied Multiple Regression/Correlation Analysis for the Behavioral Sciences, L. ErlbaumAssociates, 2003.
[8] C. Spearman, The proof and measurement of association betweentwo things, The American Journal of Psychology 100 (3–4) (1904)441–471.
[9] M.G. Kendall, Rank Correlation Methods, Charles Griffin & CompanyLtd., 1962.
[10] S. Papadimitriou, J. Sun, P.S. Yu, Local correlation tracking in timeseries, in: IEEE International Conference on Data Mining, LosAlamitos, USA, 2006.
[11] M. Andreolini, S. Casolari, M. Colajanni, Models and framework forsupporting run-time decisions in web-based systems, ACMTransaction on the Web 2 (3) (2008) 17:1–17:43.
[12] S.G. Mallat, A theory of multiresolution signal decomposition: thewavelet decomposition, IEEE Transaction on Pattern Analysis andMachine Intelligence 11 (7) (1989) 674–693.
[13] P. Barford, M. Crovella, Generating representative Web workloadsfor network and server performance evaluation, SIGMETRICSPerformance Evaluation Review 26 (1) (1998) 151–160.
[14] M. Crovella, A. Bestavros, Self-similarity in World Wide Web traffic:evidence and possible causes, IEEE/ACM Transactions onNetworking 5 (6) (1997) 835–846.
[15] M.N. Bennani, D.A. Menasce, Assessing the robustness of self-managing computer systems under highly variable workloads, in:Proc. of the First International Conference on Autonomic Computing,Washington, USA, 2004.
[16] W. Willinger, D. Alderson, L. Li, A pragmatic approach to dealingwith high-variability in network measurements, in: Proc. of the 4thACM SIGCOMM Conference on Internet Measurement, Taormina,Italy, 2004.
[17] A. Buda, A. Jarynowski, Life-time of correlations and its applications,Wydawnictwo Niezalezne (2010).
[18] D.C. Montgomery, Introduction to Statistical Quality Control, JohnWiley and Sons, 2008.
[19] T. Sørensen, A Method of Establishing Groups of Equal Amplitude inPlant Sociology Based on Similarity of Species Content, BiologiskeSkrifter, E. Munksgaard, 1948.
[20] S. Papadimitriou, P.S. Yu, Optimal multi-scale patterns in time seriesstreams, in: Proc. of the 2006 ACM SIGMOD International Conferenceon Management of Data, Chicago, USA, 2006.
[21] S. Papadimitriou, S. Jimeng, C. Faloutsos, Streaming patterndiscovery in multiple time-series, in: Proc. of the 31stInternational Conference on Very Large Data Bases, Trondheim,Norway, 2005.
[22] A.K. Jain, R.C. Dubes, Algorithms for Clustering Data, Prentice-Hall,Inc., 1988.
[23] R. Khattree, D.N. Naik, Multivariate Data Reduction andDiscrimination with SAS Software, SAS Institute Inc., 2000.
[24] B.R. Bakshi, Multiscale PCA with application to multivariatestatistical process monitoring, AIChE Journal 44 (7) (1998) 1596–1610.
[25] B. Abrahao, A. Zhang, Characterizing Application Workloads on CPUUtilization in Utility Computing, Technical Report HPL-2004-157,Hewlett-Packard Labs, 2004.
[26] A. Lakhina, K. Papagiannaki, M. Crovella, C. Diot, E.D. Kolaczyk, N.Taft, Structural analysis of network traffic flows, in: Proc. of the Joint
3038 S. Tosi et al. / Computer Networks 57 (2013) 3025–3038
International Conference on Measurement and Modeling ofComputer Systems, New York, USA, 2004.
[27] H.E. Hurst, Long-term storage capacity of reservoirs, Transaction ofthe American Society of Civil Engineers 116 (1951) 770–799.
[28] R. Weron, Estimating long range dependence: finite sampleproperties and confidence intervals, Physica A 312 (1–2) (2002)285–299.
[29] M. Dobber, R. Van det Mei, G. Koole, A prediction method for jobruntimes in shared processors: survey, statistical analysis and newavenues, Performance Evaluation 64 (7–8) (2007) 755–781.
[30] B.L. Brockwell, R.A. Davis, Time Series: Theory and Methods,Springer-Verlag, 1987.
[31] Abilene network. <http://abilene.internet2.edu/>.[32] D.L. Olson, D. Delen, Advanced Data Mining Techniques, Springer,
2008.[33] K. Lan, J. Heidemann, On the Correlation of Internet Flow
Characteristics, Technical Report ISI-TR-574, USC/InformationSciences Institute, 2003.
Stefania Tosi is a Ph.D. student in Informationand Communication Technologies at the Uni-versity of Modena and Reggio Emilia, Italy.She received her master degree (summa cumlaude) in Computer Science from the Univer-sity of Modena and Reggio Emilia in July 2010.Her research interests include performanceevaluation of modern data centers and sta-tistical models for data management. She hasthree publications in international journalsand several proceedings of key internationalconferences. She received a best paper award
at WWW/Internet 2010. Home page: http://weblab.ing.unimo.it/people/stefy.
Sara Casolari is a researcher assistant at theDepartment of Information Engineering of theUniversity of Modena and Reggio Emilia, Italy.She received her master degree (summa cumlaude) and the Ph.D. in Computer Engineeringform the University of Modena and ReggioEmilia in information engineering in 2004 and2008, respectively.Her research interestsinclude stochastic models and performanceevaluation of distributed systems, and mod-elling algorithms for supporting large systemsand Internet-based application. She received a
best paper award at the International Conference on Autonomic andAutonomous Systems (ICAS 2007) and at WWW/Internet 2010. Homepage: http://weblab.ing.unimo.it/people/sara.
Michele Colajanni is full professor in com-puter engineering at the University of Modenaand Reggio Emilia since 2000. He received themaster degree in computer science from theUniversity of Pisa, and the Ph.D. degree incomputer engineering from the University ofRoma in 1992. He manages the Interdepart-ment Research Center on Security and Safety(CRIS), and he is the Director of the post-graduate master course in ‘‘InformationSecurity: Technology and Law’’. He is theauthor or co-authors of more than 150 papers
on performance and prediction models, information security, manage-ment of large scale systems. Home page: http://weblab.ing.unimo.it/people/colajanni.