SPSD: An alternative attribute for a flow using packet sampling

Packet size distribution (PSD), known as the probability distribution of packet size in a flow, is an important attribute for traffic analysis. However, to get a flow's precise PSD is computationally intensive due to the massive flows in networks and massive packets in some flows. In this paper, we propose an alternative attribute, sampled packet size distribution (SPSD), which can give a proper estimation of PSD. We introduce a bi-directional flow model and the probability representation of SPSD. Generating method of SPSD is also given, where SPSD is collected from a sampled trace, which makes it easier to get and have a great reduction in the number of packets being processed. Based on a real trace collected from the campus network, we confirm that SPSD varies slightly from PSD on low sampling granularity. The cosine and KL distances between SPSD and PSD of a flow are less than 10−2 and 10−1 respectively. Also, the orderliness of PSD distance sequence is well preserved when SPSD used.