Internet Traffic Volumes Are Not Gaussian -- They Are Log-Normal: An 18-Year Longitudinal Study With Implications for Modelling and Prediction (Complete Version)

TL;DR

This study analyzes 18 years of network traffic data, demonstrating that traffic volumes follow a log-normal distribution rather than the traditionally assumed Gaussian, with implications for modeling and prediction.

Contribution

It provides extensive empirical evidence that network traffic volumes are better modeled by a log-normal distribution than Gaussian or Weibull, across diverse networks and over long periods.

Findings

Traffic follows a log-normal distribution more closely than Gaussian.

The log-normal model improves prediction accuracy for traffic exceedance and 95th percentile pricing.

Traffic is stationary over 15-minute and 1-hour samples, supporting modeling assumptions.

Abstract

Getting good statistical models of traffic on network links is a well-known, often-studied problem. A lot of attention has been given to correlation patterns and flow duration. The distribution of the amount of traffic per unit time is an equally important but less studied problem. We study a large number of traffic traces from many different networks including academic, commercial and residential networks using state-of-the-art statistical techniques. We show that traffic obeys the log-normal distribution which is a better fit than the Gaussian distribution commonly claimed in the literature. We also investigate an alternative heavy-tailed distribution (the Weibull) and show that its performance is better than Gaussian but worse than log-normal. We examine anomalous traces which exhibit a poor fit for all distributions tried and show that this is often due to traffic outages or links that hit maximum capacity. We demonstrate that the data we look at is stationary if we consider samples of 15- minute long or even 1-hour long. This gives confidence that we can use the distributions for estimation and modelling purposes. We demonstrate the utility of our findings in two contexts: predicting that the proportion of time traffic will exceed a given level (for service level agreement or link capacity estimation) and predicting 95th percentile pricing. We also show that the log-normal distribution is a better predictor than Gaussian or Weibull distributions in both contexts.