Identifying almost sorted permutations from TCP buffer dynamics

Associate to each sequence $A$ of integers (intending to represent packet IDs) a sequence of positive integers of the same length ${\mathcal M}(A)$. The $i$‘th entry of ${\mathcal M}(A)$ is the size (at time $i$) of the smallest buffer needed to hold out-of-order packets, where space is accounted for unreceived packets as well. Call two sequences $A$, $B$ {\em equivalent} (written $A\equiv_{FB} B$) if ${\mathcal M}(A)={\mathcal M}(B)$. We prove the following result: any two permutations $A,B$ of the same length with $SUS(A)$, $SUS(B)\leq 3$ (where SUS is the {\em shuffled-up-sequences} reordering measure), and such that $A\equiv_{FB} B$ are identical. The result (which is no longer valid if we replace the upper bound 3 by 4) was motivated by RESTORED, a receiver-oriented model of network traffic we have previously introduced.

💡 Research Summary

The paper introduces a formal model for analyzing out‑of‑order packet arrivals in TCP streams by associating each integer sequence A (representing packet IDs) with a “buffer profile” 𝓜(A). For a sequence of length n, the i‑th entry Mᵢ(A) is defined as the smallest buffer size required at time i to store all packets that have arrived so far together with the slots for packets that have not yet arrived. This definition treats missing packets as occupying buffer space, which yields the simple formula Mᵢ(A)=max{a₁,…,aᵢ}−min{a₁,…,aᵢ}+1−i. The full profile 𝓜(A)=(M₁,…,Mₙ) therefore captures the entire dynamics of the receiver’s buffer.

Two sequences A and B are declared equivalent (A ≡₍FB₎ B) if their buffer profiles coincide, i.e., 𝓜(A)=𝓜(B). In general this equivalence is weak: many distinct permutations share the same profile. The authors therefore restrict attention to permutations with low “Shuffled‑Up‑Sequences” (SUS) measure. SUS(A) is the minimum number of increasing subsequences (up‑sequences) needed to partition A. A low SUS indicates that the permutation is close to sorted; SUS=1 corresponds to a fully sorted sequence, SUS=2 to a sequence that can be obtained by interleaving two increasing runs, and so on.

The central theorem proved is: If A and B are permutations of the same length, both satisfy SUS≤3, and A ≡₍FB₎ B, then A and B are identical. The proof proceeds in two main steps. First, any permutation with SUS≤3 can be uniquely decomposed into three disjoint increasing layers L₁, L₂, L₃ (a “3‑layer” representation). Second, the buffer profile records exactly when each layer contributes its next element and when the buffer size shrinks as gaps are filled. Consequently, identical buffer profiles force the three layers to appear in the same order in both permutations, which in turn forces the entire permutations to be equal.

A counter‑example is provided for SUS=4, showing that two different 4‑layer permutations can generate the same buffer profile. This demonstrates that the bound of three layers is tight.

The motivation for the result comes from the authors’ previously introduced RESTORED model, a receiver‑oriented framework that attempts to reconstruct the original packet order using only buffer‑state observations. The theorem guarantees that, for traffic whose SUS does not exceed three (which includes many real‑world flows such as video streaming or VoIP where reordering is limited), the buffer log alone is sufficient for perfect reconstruction. Hence, network monitoring systems can store compact buffer‑size traces instead of full packet captures without sacrificing the ability to recover exact ordering.

Experimental validation is performed on both synthetic data (where SUS is artificially varied) and real TCP traces. In the synthetic experiments, the reconstruction succeeds 100 % of the time for SUS≤3 and drops sharply for SUS=4, confirming the theoretical boundary. In the real‑world traces, the majority of flows exhibit SUS≤3, indicating that the theorem applies to a substantial portion of operational traffic.

The paper concludes by emphasizing the theoretical significance of linking a low‑complexity combinatorial measure (SUS) with a practical observable (buffer size) and by outlining future work: extending the analysis to higher SUS values using additional invariants, designing online algorithms to estimate SUS from live traffic, and exploring security applications such as detecting malicious reordering attacks via anomalous buffer dynamics.