Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
403
B. Relations between application behaviour and observations
on the network layer
Typically, when a server application receives a request from a system running
a client application, it processes the request, generates the answer and then transmits
it to the client. Generating and transmitting an answer can be interleaved or
executed in parallel. Thus, when an application generates data at the same speed or
a higher speed than the capacity of the link that must be traversed when sending
the data through the network, the respective packets will be as large as possible and
emitted at a constant rate, i.e. the maximum rate permitted b y that link.
On the other extreme end, an application may need considerably more time
to generate a particular chunk of data than for transmitting it through the network.
Therefore, a delay occurs between a request and the transmission of the answer.
Finally, an application generating a fixed amount of data in each timestep, such
as a voice over IP application, can be considered a special case of the latter type
of application. We suggest however to consider this a class of behaviour on its own,
leaving us with a total of three classes of observable behaviour:
• Data transfer
• Computationally expensive/varying data rate
• Constant bitrate
Figure 1 visualises the network layer observation of these features. Each box
refers to a packet sent by an application, where the size of a box corresponds to
the size of the respective packet and white spaces between boxes indicate that no data
was sent by the application in the respective time frame. In this example, the first five
packets fall into the data transfer class, saturating each except the very last packet.
Following that, five packets are generated by a mechanism which generates data at
a varying rate, observable through the variation of packet sizes and inter-arrivaltimes.
Finally, the last five packets in figure 1 are generated at a constant rate and
carry the same amount of payload.
Time →
Application behaviour
Data transfer Computationally expensive answer Constant rate
Figure 1. Packets observed for different kinds of application behaviour. Wider boxes indicate
larger packet size, requiring more time for transmission
While the varying data rate mode can easily be identified since it will result
in a large variance of either packet sizes, inter-arrival-times or both, the other two
classes will both result in a small variance for each of these properties. Thus, to
be able to distinguish between them, we have to introduce a third metric. Such
a metric should relate to properties of the link traversed in order to reveal whether