Scaling and memory in recurrence intervals of Internet traffic

By studying the statistics of recurrence intervals, $\tau$, between volatilities of Internet traffic rate changes exceeding a certain threshold $q$, we find that the probability distribution functions, $P_{q}(\tau)$, for both byte and packet flows, show scaling property as $P_{q}(\tau)=\frac{1}{\overline{\tau}}f(\frac{\tau}{\overline{\tau}})$. The scaling functions for both byte and packet flows obeys the same stretching exponential form, $f(x)=A\texttt{exp}(-Bx^{\beta})$, with $\beta \approx 0.45$. In addition, we detect a strong memory effect that a short (or long) recurrence interval tends to be followed by another short (or long) one. The detrended fluctuation analysis further demonstrates the presence of long-term correlation in recurrence intervals.

💡 Research Summary

The paper investigates the statistical properties of recurrence intervals (τ) between large fluctuations in Internet traffic, focusing on both byte‑level and packet‑level flow time series. After computing the absolute change (volatility) of the traffic rate, events are defined as moments when the volatility exceeds a chosen threshold q (expressed in units of the standard deviation of the volatility series). The time gaps between successive events constitute the recurrence intervals, and the authors analyze the probability distribution functions Pq(τ) for a range of q values.

A central finding is that all distributions collapse onto a single scaling form when the interval τ is normalized by its mean value τ̄:

 Pq(τ) = (1/τ̄) f(τ/τ̄).

The scaling function f(x) is well described by a stretched exponential,

 f(x) = A exp(−B x^β),

with an exponent β ≈ 0.45 for both byte and packet flows. This exponent is markedly different from the β = 1 expected for a simple Poisson (exponential) process, indicating that short intervals occur far more frequently than would be predicted by a memory‑less model, while long intervals also have a heavier tail.

Beyond the distribution shape, the authors examine temporal correlations. By calculating the conditional probability P(τ | τ0) they demonstrate a strong “memory” effect: a short (long) interval is statistically more likely to be followed by another short (long) interval. This clustering of similar intervals mirrors phenomena observed in financial markets (volatility clustering) and seismology (aftershock sequences).

To probe whether this memory extends over many events, the paper applies detrended fluctuation analysis (DFA) to the τ series. The DFA fluctuation function F(l) scales with window size l as F(l) ∝ l^α, with α ≈ 0.75 (>0.5), confirming the presence of long‑range correlations in the recurrence intervals themselves.

Importantly, the identical scaling exponent β and DFA exponent α for byte and packet streams suggest that the underlying dynamics are not specific to a particular measurement unit but reflect a universal mechanism governing Internet traffic fluctuations. The authors argue that such universality is consistent with self‑organized criticality or bursty human activity patterns, both of which generate power‑law‑like scaling and long memory.

The study’s limitations include a relatively short observation window, a lack of systematic sensitivity analysis for the threshold q, and the absence of a mechanistic decomposition of network‑layer contributions (e.g., routing policies, congestion control, retransmissions) to the observed scaling. Future work could extend the analysis to a broader set of traffic types (real‑time streaming, peer‑to‑peer, cloud workloads), explore multiple time scales (seconds to days), and develop generative traffic models that embed the empirically observed stretched‑exponential distribution and long‑range dependence.

In summary, the paper provides compelling evidence that Internet traffic exhibits non‑Poissonian, scale‑invariant statistics and pronounced memory effects in the timing of large volatility events. These findings have practical implications for traffic engineering, anomaly detection, and the design of predictive models that must account for both heavy‑tailed interval distributions and persistent correlations across time.