Gonca Gürsun, Mark Crovella
Proceedings of the 2012 ACM conference on Internet measurement conference (IMC)
Publication year: 2012

Abstract: The ability of an ISP to infer traffic volumes that are not directly measurable can be useful for research, engineering, and business intelligence. Previous work has shown that traffic matrix completion is possible, but there is as yet no clear understanding of which ASes are likely to be able to perform TM completion, and which traffic flows can be inferred. In this paper we investigate the relationship between the AS-level topology of the Internet and the ability of an individual AS to perform traffic matrix completion. We first frame the questions through abstract analysis of idealized topologies, and then use actual routing measurements and topologies to study the ability of real ASes to infer traffic flows. Our first set of results identifies which ASes are best positioned to perform TM completion. We show, surprisingly, that TM completion ability is not particularly characteristic of ASes in the ‘core,’ nor does it help for an AS to have many peering links. Rather, the most important factor enabling an AS to perform TM completion is the number of direct customers it has. Our second set of results focuses on which flows can be inferred. We show that topologically close flows are easier to infer, and that flows passing through customers are particularly well suited for inference.