This page contains the submitted abstracts and slidesets of speakers at the ISMA 2004 Workshop on Internet Signal Processing at CAIDA, SDSC on November 11-12, 2004. Entries are listed by alphabetical order of the last name of the presenter. Some slides are not available for web publishing.

###
November 11-12 (Thu-Fri), 2004

*Location:*
Auditorium, San Diego Supercomputer Center, UCSD, La Jolla, CA

### Abstracts of Talks for ISMA 2004 WISP

**Performance Debugging for Distributed Systems of Black Boxes**

[PPT slides]

*Speaker:*Marcos Aguilera

Many interesting large-scale systems are distributed systems ofmultiple communicating components. Such systems can be very hard todebug, especially when they exhibit poor performance. The problembecomes much harder when systems are composed of"black-box" components: software from many different(perhaps competing) vendors, usually without source code available.

Typical solutions-provider employees are not always skilled orexperienced enough to debug these systems efficiently. Our goal is todesign tools that enable modestly-skilled programmers (and experts,too) to isolate performance bottlenecks in distributed systemscomposed of black-box nodes. In this talk, I will focus on one of our basic technique, which uses signal processing techniques to find causal paths and delays through the distributed system.

*About the speaker:* Marcos K. Aguilera received his doctorate degree from CornellUniversity in 2000, when he joined Compaq's SystemsResearch Center. He now works in the Storage Systems Department at HP Laboratories. His research interests includedistributed systems, fault tolerance, and distributed algorithms.

**Trends In Network Measurement**

[PPT slides]

*Speaker:*Paul Barford

*Abstract not available*

*About the speaker:* Paul Barford received his BS in electrical engineering from the University of Illinois at Champaign-Urbana in 1985, and his Ph.D. in Computer Science from Boston University in December, 2000. He is an assistant professor of computer science at the University of Wisconsin at Madison. He is the founder and director of the Wisconsin Advanced Internet Laboratory and his research interests are in the design, measurement, and modeling of wide area networked systems and network protocols.

**Spectroscopy methods**

[PDF slides]

*Speaker:*Andre Broido

We will give an overview of the work that uses discrete, quantized and periodic delays for inference of network and device properties, and of techniques that proved useful in that respect. We will also discuss recent finding that packet delay may be a non-linear function of packet size.

*About the speaker:* Andre graduated from the Mechanics and Mathematics department of
Moscow State Lomonosov university
and worked in algebra, theoretical computer science, and geophysics.
He co-authored a book on the use of Radon transforms and dynamic programming
in seismic data analysis. His current interests include inverse networking
problems, in particular spectroscopy, i.e. inferences based on inherent
discreteness of parameters of signals like packet delay.

**Hierarchical Clustering and Network Topology Identification**

[PPT slides]

*Speaker:*Rui Castro

One of the predominant schools of thought in networking today is that monitoring and control of large scale networks is only practical at the edge of the network. Edge-based control can be significantly enhanced by accurate information about the internal network state, therefore methods for inferring state information from edge-based traffic measurements are of great interest. A fundamental component of the network state is the routing topology. We will address the problem of network topology identification in this talk. This problem can be casted as a hierarchical clustering process. We present a new method for hierarchical clustering, based on a maximum likelihood formulation. Unlike other existing clustering schemes, our method is based on a generative, tree-structured model that represents relationships between the objects to be clustered, rather than directly modeling properties of objects themselves, and therefore particularly well suited for the network problem in question. More broadly, the generative model may not reflect actual physical mechanisms relating the objects to be clustered, but nonetheless provides means for dealing with errors in the similarity matrix measurements, simultaneously promoting two desirable features in clustering: intra-class similarity and inter-class dissimilarity.

*About the speaker:* Rui M. Castro was born in Lisbon, Portugal. He received a Licenciatura degree in Aerospace Engineering (1998) from Instituto Superior Tecnico, Technical University of Lisbon, Portugal. He is currently pursuing a Ph.D. degree in Electrical and Computer Engineering.

**Measurements fueling Internet SP**

[PDF slides]

*Speaker:*kc claffy

We give an overview of current state of Internet measurement and data collection, and urge caution about potential pitfalls In signal processing of Internet data. We also briefly describe a new caida project, the IMDC catalogue, that is aimed at mitigating the acute problem of manageable community access to high integrity Internet data sets.

Project URL: http://www.caida.org/projects/trends/

*About the speaker:* kc claffy is principal investigator for the distributed Cooperative Association for Internet Data Analysis (CAIDA), and resident research scientist based at the University of California's San Diego Supercomputer Center. kc's research interests include Internet workload/performance data collection, analysis and visualization, particularly with respect to commercial ISP collaboration/cooperation and sharing of analysis resources. kc received her PhD in Computer Science from UCSD in 1994.

**Applying the Subspace Method to Network Traffic Analysis**

[PDF slides]

*Speaker:*Mark Crovella

Effective monitoring of IP networks requires analysis of traffic at multiple points throughout a network simultaneously. This problem can be attacked via methods of multivariate statistics. In this talk I will focus on one example: analyzing network traffic via principal component analysis (PCA). I will show that although network traffic takes the form of a high dimensional timeseries, that typical network behavior can be captured well by a low dimensional approximation obtained via PCA. This suggests the use of the subspace method for identifying unusual network conditions, which I will describe. I will then present results of using the subspace method for detecting and diagnosing a wide range of network anomalies, including volume anomalies (unusual surges in traffic), network abuse, and changes in customer behavior.

*About the speaker:* Mark Crovella is Associate Professor of Computer Science at Boston University; from 1994 to 2000 he was an Assistant Professor. During 2003-2004 he was a Visiting Associate Professor at the Laboratoire d'Infomatique de Paris VI (LIP6). He received a B.S. from Cornell University in 1982, and an M.S. from the State University of New York at Buffalo. He received his Ph.D. in Computer Science from the University of Rochester in 1994. From 1984 to 1994 he also worked at Calspan Corporation in Buffalo NY, eventually as a Senior Computer Scientist.

His research interests are in performance evaluation, focusing on parallel and networked computer systems. In the networking arena, he has worked on characterizing the Internet and the World Wide Web. He has been a leader in exploring the presence and implications of self-similarity and heavy-tailed distributions in network traffic and Web workloads. He has explored the implications of Web workloads for the design of scalable and cost-effective Web servers. He has also made contributions to Internet discovery, characterization, and modeling; and he has examined the impact of network properties on the design of protocols and the construction of statistical models.

Professor Crovella is the author of over fifty papers on performance evaluation of computer systems and holds three patents deriving from his research. He is an editor for IEEE/ACM Transactions on Networking and IEEE Transactions on Computers, and was the Program Chair for the 2003 ACM SIGCOMM Internet Measurement Conference. His paper "Self-Similarity in World Wide Web Traffic: Evidence and Possible Causes" is listed by Citeseer as one of the 50 most cited papers in Computer Science, and his paper "Critical Path Analysis of TCP Transactions" was nominated for the 2002 William Bennett Prize, given annually to the best paper published in IEEE/ACM Transactions on Networking. He has given numerous invited talks and tutorials, and is a founder of and consultant to companies involved in Internet technologies.

**Why is the Internet traffic bursty in short (sub-RTT) time scales?**

[PPT slides]

*Speaker:*Constantinos Dovrolis

Internet traffic exhibits multifaceted burstiness and correlation structure over a wide span of time scales. Previous work analyzed this structure in terms of heavy-tailed session characteristics, as well as TCP timeouts and congestion avoidance, in relatively long time scales.

We focus on shorter scales, typically less than 100-1000 milliseconds. Our objective is to identify the actual mechanisms that are responsible for creating bursty traffic in those scales. We show that TCP self-clocking, joint with queueing in the network, can shape the packet interarrivals of a TCP connection in a two-level ON-OFF pattern.

This structure creates strong correlations and burstiness in time scales that extend up to the Round-Trip Time (RTT) of the connection, especially for bulk transfers that have a large bandwidth-delay product relative to their window size. The burstiness in short scales can be significantly reduced by TCP pacing.

In particular, we focus on the importance of the minimum pacing timer, and show that a 10-millisecond timer would be too coarse for removing short-scale traffic burstiness, while a 1-millisecond timer would be sufficient to make the traffic almost as smooth as a Poisson stream. Finally, we show that sub-RTT burstiness is important in queueing performance not only in moderate load conditions, as previously shown, but also in high loads when the bottleneck buffer size is relatively small.

*About the speaker:* Constantinos Dovrolis is an Assistant Professor at theCollege of Computing of the Georgia Institute of Technology.He received the Computer Engineering degree from theTechnical University of Crete (Greece) in 1995, the M.S. degreefrom the University of Rochester in 1996, and the Ph.D. degree fromthe University of Wisconsin-Madison in 2000.His research interests include methodologies and applicationsof network measurements, bandwidth estimation,service differentiation, and routing security.

**On BGP instabilities and end-to-end path failures**

[PDF slides]

*Speaker:*Nick Feamster

*Abstract not available*

*About the speaker:* Nick Feamster is a student at the Massachusetts Institute of Technology with research interests in Interdomain Routing and Traffic Engineering, Routing Dynamics, Security and Anti-Censorship, and Streaming Video.

**Open problems in anomaly detection in BGP data**

(Slides not available)

*Speaker:*Nick Feamster

*Abstract not available*

*About the speaker:* Nick Feamster is a student at the Massachusetts Institute of Technology with research interests in Interdomain Routing and Traffic Engineering, Routing Dynamics, Security and Anti-Censorship, and Streaming Video.

**From Traffic Measurement to Realistic Workload Generation**

[PDF slides]

*Speaker:*Felix Hernandez-Campos

Internet traffic is a remarkable complex phenomenon that has received substantial attention over the last 15 years. Researchers have studied the rich traffic dynamics of many network links, developed numerous models of traffic, and proposed a range of explanations for the observed phenomena. However, there is not a comprehensive theory of traffic that can combine these advances and offer a more complete understanding of the interaction between the different forces behind traffic dynamics. In this talk, we argue that the development of such a theory shares many goals with the challenge of generating realistic traffic for networking experiments, and discuss our efforts in this direction.

*About the speaker:* Felix Hernandez-Campos received the B.Eng./M.Eng. degree in computer
science from the Universidad Complutense of Madrid, Spain, in 1999, and is
currently working toward the Ph.D. degree in computer science at the University
of North Carolina at Chapel Hill. He is expected to graduate in December 2004.
His current research interests include Internet measurement and modeling,
traffic generation, and wireless networking.

**Network Inference and Signal Processing**

[PDF slides][PPT slides]

*Speaker:*Alfred Hero

In this talk I will outline some principal areas in which statistical signal and image processing have played a role in network inference. Network inference from traffic measurements can be placed in the context of general spatio-temporal analysis, dimension reduction, and classification. What makes the probelm especially challenging is data non-stationarity and the need for distributed multiple sensor information aggregation and processing. Some strategies for approaching this problem will be discussed.

*About the speaker:* Alfred O. Hero III received the B.S. in Electrical Engineering
(summa cum laude) from Boston University (1980) and the Ph.D from Princeton
University (1984), both in Electrical Engineering. Since 1984 he has been a
Professor with the University of Michigan, Ann Arbor, where he is a Professor
in the Department of Electrical Engineering and Computer Science and, by
courtesy, in the Department of Biomedical Engineering and the Department of
Statistics. He is a Fellow of the Institute of Electrical and Electronics
Engineers (IEEE) and has received the 1998 IEEE Signal Processing Society
Meritorious Service Award, the 1998 IEEE Signal Processing Society Best Paper
Award, and the IEEE Third Millenium Medal. Alfred Hero is currently
President-Elect of the IEEE Signal Processing Society (2004-2005) and Associate
Editor of the IEEE Transactions on Computational Biology and Bioinformatics
(2004-2006).

**Identification of Repeated Denial of Service Attacks**

[PPT slides]

*Speaker:*Alefiya Hussain

*Abstract not available*

*About the speaker:* Alefiya Hussain is a PhD candidate at the Computer Science Department at the University of Southern California. She received a Bachelor of Engineering degree from Pune Institute of Computer Technology and a Master of Computer Science from University of Southern California in 1997 and 2001 respectively. Her current research interests include passive network measurements and security. She is a member of ACM, IEEE, and Upsilon Pi Epsilon.

**A Nonstationary Poisson View of Internet Traffic**

[PPT slides]

*Speaker:*Thomas Karagiannis

Recent measurements at the Internet core suggest that packet interarrival times follow the exponential distribution. Yet, Internet traffic is characterized by self-similar and LRD poperties. In this talk, we will discuss these contradicting observations.

*About the speaker:* Thomas Karagiannis is a PhD candidate in the Department of
Computer Science and Engineering at the University of California,
Riverside. His technical interests include Internet
traffic measurements, analysis of Internet traffic dynamics,
Internet protocols, and peer-to-peer networks. He received a BSc in the
Department of Applied Informatics at University of Macedonia, Thessaloniki,
Greece.

**Passive Monitoring of RTT spikes**: Applying some of the ideas of network spectroscopy

[PDF slides]

*Speaker:*Jorma Kilpi

We apply some of the ideas of the network spectroscopy to the analysis of thepacket radio interfaces

*About the speaker:* M.Sc -93 and Lic.Ph -97 from the University of Helsinki, majoring in mathematics. Former research area was dynamical systems and iteration theory.

Since 1998 worked at the VTT in the field of traffic theory, current research field being the statistical analysis of traffic measurements.

**Nonlinear Dynamics in TCP/IP networks**

[PPT slides]

*Speaker:*Ljupco Kocarev

In this talk I will first demonstrate that the TCP protocol, while competing for networking resources, generates complex non-linear dynamics. An important message of this work is that random traffic behavior is not exclusively due to 'random' effects, but also due to complex behavior of the TCP protocol. The TCP protocol, although driven by deterministic rules, may produce time-series seemingly indistinguishable from stochastic processes. Then I will discuss various techniques for nonlinear data analysis and present some measures from real Internet traffic.

*About the speaker:* Ljupco Kocarev is a Research Scientist at the Institute for
Nonlinear Science, University of California San Diego and Professor at the
Graduate School of Electrical Engineering, University 'Kiril i Metodij',
Skopje, Macedonia. He has coauthored more than 80 journal papers in 18
different international pier-review journals, ranging from mathematics to
physics, and from electrical engineering to computer sciences. According to
Science Citation Index his work has been cited more than 2000 times. His
scientific interests include nonlinear systems and circuits; coding and
information theory; networks and networks on chip; and cryptography.

**Traffic and Topological Analysis of Wireless Networks**

*Speaker:*Rajesh Krishnan

Suppose you have a simple device that can listen to a wireless network and record when it hears each transmission and the identification of the node (or direction) from which the transmission came. Further suppose that's all the information you have, either because all the transmissions are encrypted, or because of limitations in the sensor. How much about the network can you learn? In this talk, I'll show that you can learn a lot. The FASTJAM project team at BBN has developed a set of algorithms which can: (1) map the wireless network, including identifying links that connect the region the device can hear to the outside world; (2) determine which nodes are communicating with each other (including, with high probability, who received which transmission); and (3) identify all the hops in a path between any two nodes. Many of these algorithms are based on passive signal processing techniques and work in real-time.

*About the speaker:* Dr. Rajesh Krishnan is a Senior Scientist at BBN Technologies. Currently, he is developing technologies for policy-adaptive opportunistic spectrum access for the DARPA/ATO neXt Generation (XG) Communications program. Information on his research interests and publications can be found at: http://www.ir.bbn.com/~krash/

**Data-Streaming Algorithms for Monitoring High speed Traffic**

(Slides not available)

Speaker: Abhishek Kumar

The high line-rates in today's Internet preclude the possibility of per-flow monitoring at routers. The approach of packet sampling used by NetFlow is too coarse grained to provide meaningful monitoring of most flows. In this talk we present our work on applying techniques from data-streaming to design efficient monitoring applications. The crux of the idea is to use a fast but "lossy" or erroneous data-collection module, in conjunction with an estimation module that uses Bayesian estimation techniques to "recover" the lost data, providing accurate statistical estimates in the end.

*About the speaker:* Abhishek is a PhD student in the College of Computing at Georgia Tech. His current research interests include algorithms and mechanisms for traffic monitoring in high speed networks, Internet scale analysis of worm propagation and algorithms for routing and information propagation in peer-to-peer and sensor networks.

**Outwitting the Witty Worm -- Reconstruction and Analysis of an Internet-Scale Event by Exploiting Pseudo-Random Number Generation**

(Slides not available)

Speaker: Abhishek Kumar

Network telescopes trace packets destined to unused segments of the Internet address space, hence capturing the backscatter from DoS attacks, or copies of Internet worms that randomly scan the 32-bit IP address space. By scaling up the telescope observations, or analyzing their content and source addresses, researchers learn a lot about individual worms. (CAIDA publishes such analyses after most worm outbreaks. e.g. http://www.caida.org/research/security/witty/ .)

In this talk, I will present our work on exploiting the information revealed by the random-numbers that are used by Internet worms (e.g., to construct destination IP addresses). We use telescope traces of the Witty worm to reconstruct the series of actions performed by the worm at each infectee. Our analysis allowed us to identify the IP address of the original machine used to spread the worm. Other examples of the interesting information recovered by this analysis include: 1) the access bandwidth of the infectees, 2) the system time since last reboot of the infectees, 3) the number of physical drives on the infectees, 4) the number of infected machines behind a NAT box, 5) the exact list of packets sent by each infectee (before this work, only the list of packets actually received at the monitoring point was available), and 6) the infection graph (tree) of infector-infectee relationships.

*About the speaker:* Abhishek is a PhD student in the College of Computing at Georgia Tech. His current research interests include algorithms and mechanisms for traffic monitoring in high speed networks, Internet scale analysis of worm propagation and algorithms for routing and information propagation in peer-to-peer and sensor networks.

**Wasted Measurements in the Internet**

(Slides not available)

*Speaker:*Harsha Madhyastha

While many organizations have been carrying out measurements, there is an increasing need for communication between the measurement entities to react quickly to network-wide events. A triggered measurement architecture allows for arbitrary sites to selectively co-ordinate measurements carried out at other sites. In examining such an architecture, we find that there is a significant potential to avoid wasted measurements. Accordingly, we examine the concept of reusing Internet measurements along three axes: spatial, temporal, and application-level. Our proposed model is flexible enough to handle different ways of combining measurements, full and partial reuse, and anomalous measurements. We demonstrate this potential for reuse by way of an experimental study of a popular measurement application carried out via dozens of client sites.

**Statistical and Visualization Techniques for Streaming Data**

[PDF slides]

*Speaker:*David Marchette

Streaming data, such as Internet packet streams, call for new methods of statistical analysis and visualization. Traditional statistical methods cannot cope with the high volume, high data-rate streams that are typical of network data. I will discuss various techniques for computing statistics and estimates on streaming data. Estimation of model parameters in real time will be discussed, as well as nonparametric and semiparametric probability density estimation. These ideas will be illustrated on network data.

*About the speaker:* David Marchette received his B.A. and M.A. degrees from UCSD in Mathematics in 1980 and 1982 respectively. He received his PhD in Computational Sciences and Informatics from George Mason University in 1996. He has been working in Navy labs (NOSC to NRaD, NSWC) since 1985, in the areas of pattern recognition and computational statistics. He is the author of two books, one on computer intrusion detection and one on random graph methods for pattern recognition.

**Quantum computing and internet signal processing**

[PDF slides]

*Speaker:*David Meyer

I will introduce the basic ideas of quantum computing and survey existing quantum algorithms that are potentially applicable to signal processing. Although the talk will be too short for details, I will try to provide some idea of the potential advantages of quantum information processing, as well as a discussion of some of the relevant open questions.

*About the speaker:* David Meyer is a professor in the Mathematics Department at UCSD and a senior scientist at the Institute for Physical Sciences. Starting from a background in quantum gravity, he has worked on problems in combinatorics and topology. In the past 8 years he has concentrated on quantum information processing, working on a variety of topics: quantum lattice gas automata, entanglement, quantum games, search algorithms, quantum learning, error correcting codes, quantum image processing and simulation of physical systems.

**Distributed Sensing and Inference**

[PDF slides]

*Speaker:*Randy Moses

We will discuss inference problems (detection, estimation, and tracking) using distributed sensors and signal processing. We consider a problem in which distributed sensors take statistically-dependent measurements of one or more events in the scene of interest, process these measurement signals locally, and share local information with neighbors over an imperfect communication channel. From this shared information we wish to make inferences about the scene and present these inferences to people in a meanngful and useful way. We will discuss our thoughts on how to analyze performance and how to design algorithms that achieve a desired level of performance. We will discuss how the constraints and interactions of local signal processing, information communication, and human decision-making play a role in this design process.

*About the speaker:* Randolph L. Moses received the B.S., M.S., and Ph.D. degrees in electrical engineering from
Virginia Polytechnic Institute and State University in 1979, 1980, and 1984, respectively. During the
summer of 1983 he was a SCEEE Summer Faculty Research Fellow at Rome Air Development Center, Rome, NY.
From 1984 to
1985 he was with the Eindhoven University of Technology, Eindhoven, The Netherlands, as a NATO
Postdoctoral Fellow. Since 1985 he has been with the Department of Electrical Engineering, The Ohio
State University, and is currently a Professor there. During 1994-95 he was on sabbatical leave as a
visiting researcher at the System and Control Group at Uppsala University
in Sweden.

His research interests are in statistical signal processing, and include parametric time series analysis, array signal processing, sensor networks, and communications systems.

**On the estimation of the long-memory parameter: Fourier or Wavelet?**

[PDF slides]

*Speaker:*Eric Moulines

Semi-parametric estimation of the memory parameter has been a very active area of research in the last decade. The two most promising techniques are the Fourier and the wavelet methods. The Fourier method is very popular in the econometric literature: the theory behind this estimator is now well-understood. The wavelet methods is very popular in the networking community. Despite recent advances, a complete theory of such estimators (in the semu-parametric context) is still lacking. In this paper (co-authored with F. Roueff and M. Taqqu), we show how to fill the required steps to get results allowing comparison with the Fourier method on a fair basis. We will then discuss the relative merits of these estimators on real data and suggest some possible improvements.

*About the speaker:* From 1986 until 1990, he was a member of the technical staff at
Centre National de Recherche des Télécommunications (CNET),
working on signal processing applied to low-bit rate speech coding
and text-to-speech synthesis.
Since 1990, he was with École Nationale Supérieure des Télécommunications (ENST) where he is presently a Professor
(1996-present). His teaching and research interests include
applied probability, statistics and signal processing. His
current research projects are: Time series analysis with an emphasis on long memory processes (limit
theorem, long-memory renewal and aggregation of
renewal processes, inference in frequency domain), Hidden
Markov Models, Markov regime non linear autoregressive processes
(inference, computational methods, Sequential Monte carlo methods,
etc.), Markov Chain Monte Carlo methods (computable bounds,
adaptive simulation techniques, reinforcement learning)

The main applications of his work are in statistical signal processing (system identification, tracking in complex environment), digital communication and network traffic modelling and inference.

Dr. Moulines served on the editorial board of Speech Communication, and IEEE Transactions on Signal Processing. He is presently and editor of ESAIM: Probability and Statistics. He was a member of the IEEE committee "Signal processing: Theory and Methods".

**ANT: Analysis of Network Traffic**

[PDF slides]

*Speaker:*Christos Papadopoulos

I will give an overview of our efforts at USC/ISI to apply spectral analysis techniques to network traffic analysis.

*About the speaker:* Christos Papadopoulos received his PhD in 1999 from the Department of Computer Science at Washington University in St. Louis, Missouri. He is currently an assistant professor at the Computer Science department of the University of Southern California. His research interests include Computer Networks, Network Security, Multimedia Communication, Distributed Systems

**Long-Term Forecasting of Internet Backbone Traffic**

[PPT slides]

*Speaker:*Konstantina Papagiannaki

We introduce a methodology to predict when andwhere link additions/upgrades have to take place in an IPbackbone network. Using SNMP statistics, collected continuouslysince 1999, we compute aggregate demand between any twoadjacent PoPs and look at its evolution at time scales largerthan one hour. We show that IP backbone traffic exhibits visiblelong term trends, strong periodicities, and variability at multipletime scales.

Our methodology relies on the wavelet multiresolution analysisand linear time series models. Using wavelet multiresolutionanalysis, we smooth the collected measurements until we identifythe overall long-term trend. The fluctuations around the obtainedtrend are further analyzed at multiple time scales. We show thatthe largest amount of variability in the original signal is due toits fluctuations at the 12 hour time scale.

We model inter-PoP aggregate demand as a multiple linearregression model, consisting of the two identified components.We show that this model accounts for 98% of the total energy inthe original signal, while explaining 90% of its variance. Weeklyapproximations of those components can be accurately modeledwith low-order AutoRegressive Integrated Moving Average(ARIMA) models. We show that forecasting the long term trendand the fluctuations of the traffic at the 12 hour time scale yieldsaccurate estimates for at least six months in the future.

*About the speaker:* Konstantina Papagiannaki received her first degreein electrical and computer engineering from theNational Technical University of Athens, Greece,in 1998, and her PhD degree from the UniversityCollege London, U.K., in 2003. Her PhD thesis received the CPHC/BCS Distinguished Dissertations Award 2003. From 2000 to 2004,she was a member of the IP research group at theSprint Advanced Technology Laboratories. She iscurrently with Intel Research in Cambridge, UK.Her research interests are in Internet measurements,modeling of Internet traffic, and backbone networktraffic engineering.

**Whither Signal Processing and the Internet?**

[PPT slides]

*Speaker:*Craig Partridge

*Abstract not available*

*About the speaker:* Dr. Craig Partridge is a Chief Scientist at BBN Technologies and works in the Internetwork Research Department. Craig has worked on internetworking problems at BBN for twenty years. Notable bits of work include designing how Internet email is routed, working with Phil Karn on TCP round-trip time estimation, and designing and building the world's fastest router in the mid-1990s. Craig has been an active member of ACM SIGCOMM and the IEEE Communications Society and chaired the National Research Council committee on how the Internet functioned on September 11, 2001. He has written over 25 journal and conference papers, and wrote the book Gigabit Networking (Addison-Wesley, 1994). A Fellow of the ACM and the IEEE, and a graduate of Woodrow Wilson High School in DC, Craig received his A.B., M.Sc. and Ph.D. degrees from Harvard University.

**Watching Traffic for an Anomaly: Data Visualization using Dimensionality Reduction**

[PDF slides]

[AVI video - map]

[AVI video - data]

*Speaker:*Neal Patwari

Traffic anomalies dramatically change the quality and quantity of trafficobserved at routers across the Internet. During anomalies, we may observetemporal changes, spatial changes, change in the distribution of port/protocoland change in the distribution

*About the speaker:* Neal Patwari received the BSEE and MSEE degrees from Virginia Tech in Blacksburg, VA, in 1997 and 1999, respectively. He was a research engineer at Motorola Labs in Plantation, FL from 1999-2001, conducting research in localization and wireless sensor networks. Currently, he is pursuing a Ph.D. in the EECS department of the University of Michigan, specializing in the intersection between statistical signal processing and networking.

**Reflections on Modeling, Analysis and Insights in Networking Research**

[PPT slides]

*Speaker:*Ramesh Rao

*Abstract not available*

*About the speaker:* Ramesh Rao was born in Sindri, India. He did his undergraduate work at the Regional Engineering College of the University of Madras in Tiruchirapalli,
obtaining a BE (Honors) degree in Electronics and Communications in 1980. He did his graduate work at the University of Maryland, College Park, Maryland where he
received his M.S. and Ph.D. Professor Rao is currently a professor at the University of California, San Diego (UCSD) for the department of Electrical and Computer
Engineering in the Irwin and Joan Jacobs School of Engineering, where he has been a member of the faculty since 1984. Professor Rao is the former director of
UCSD's Center for Wireless Communications (CWC), and currently the Director of the San Diego Division of the California Institute of Telecommunications and
Information Technology [Cal-(IT)^{2}]. As Director of the San Diego Division of Cal-(IT)^{2}, he leads several interdisciplinary and collaborative projects. His
research interests include architectures, protocols and performance analysis of computer and communication networks, and he has published extensively on these
topics. Since 1984, Professor Rao has authored numerous technical papers, contributed book chapters, conducted a number of short courses and delivered invited
talks and plenary lectures. He is currently supervising both masters and doctoral students. Most recently, Dr. Rao was honored by being appointed the first holder
of the Qualcomm Endowed Chair in Telecommunications and Information Technologies.

**Optimal probing schemes for estimation of multiscale traffic**

[PPT slides]

*Speaker:*Vinay Ribeiro

In this talk we design optimal probing schemes to estimate networktraffic. Associated with probing is a Heisenberg-type uncertaintyprinciple. For a simplified path consisting of a single queue,flooding the queue with back-to-back probes gives an exact estimate ofthe cross-traffic but has the drawback of disrupting the very samecross-traffic. Clearly it is desirable to use few probe packets tomeasure cross-traffic while minimizing estimation error. We consider aqueue fed with cross-traffic from multiscale traffic models and studyhow to space a fixed number of probe packet-pairs over time in order tooptimally estimate cross-traffic. Our results have applications toother fields such as sensor networks.

*About the speaker:* Vinay Ribeiro is a Ph.D. student in the department of ElectricalEngineering at Rice University. He is currently attending a semester-long research seminar at the Institut Mittag-Leffler in Stockholm, Sweden. His researchinterests are computer networking, signal processing, traffic modeling, wavelets, network measurements,and queuing theory.

**MRA representation of signals - CAP representations**

[PDF slides]

*Speaker:*Amos Ron

The first part of the talk will be a friendly introduction to multiresolution representations, with emphasis on the notions of local "predictability" of the data, and the prediction performance of the representation.

The second part will review on-going progress in the area, and the importance the redundancy notion plays within it.

*About the speaker:* Amos Ron is a professor of Math and CS at UW Madison.
Specialty areas: approximation theory, representation
of curves and surfaces, multiscale data representation.
EiC of journal of approximation theory, member of EB of
constructive approximation, applied and computational
harmonic analysis, and SIAM j. of math. analysis.

**Phase plot analysis of Internet packet traffic**

(Slides not available)

*Speaker:*Joel Sommers

*Abstract not available*

**A Tricky Problem**

[PDF slides]

[gzipped postscript slides]

*Speaker:*Darryl Veitch

I will discuss an example of a `structure identifiability problem' where without prior knowledge, the `right model' may be impossible to obtain.

The idea for this talk came when I was reflecting on a point process model for packet arrivals which my colleagues and I developed recently. In that model the idea of flows of packets holds a central place. It struck me that without inside knowledge of the existence of flows, it may not have been possible to even detect their existence, even though their impact is very profound.

*About the speaker:* Darryl Veitch was born in Melbourne, Australia.
He completed a Bachelor of Science Honours degree at
Monash University, Melbourne in 1985, and a mathematics doctorate in
Dynamical Systems at the University of Cambridge, England, in 1990.
He is a senior member of the IEEE.

In 1991 he joined the research laboratories of Telecom Australia (Telstra) in Melbourne where he became interested in long-range dependence as a property of tele-traffic in packet networks. In 1994 he left Telstra to pursue the study of this phenomenon at the CNET in Paris (France Telecom). He then held visiting positions at the KTH in Stockholm, INRIA in the south of France, and Bellcore in New Jersey, before taking up a three year position as Senior Research Fellow at RMIT, Melbourne. He then joined the Electrical and Electronic Engineering department at the University of Melbourne as a Senior Research Fellow where for two years he directed the EMULab, an Ericsson funded networking research group.

He is now a member of the ARC Special Research Centre for Ultra-Broadband Information Networks (CUBIN) in the department, and a project leader in NICTA (National ICT Australia).. His research interests include scaling models of packet traffic, parameter estimation problems and queueing theory for scaling processes, the statistical and dynamic nature of Internet traffic, and the theory and practice of active measurement of packet networks.

**Internet Tomograpy**

[PPT slides]

*Speaker:*Bin Yu

Internet tomography represents a class of illposed linear inverse problems using indirect measurements to infer useful characteristics of networks. Origin-destination traffic estimation is one very important problem in this class. In this talk, for the OD problem we compare our approach (Gaussian model + Iterative Proportional Fitting) with that of the ATT group (gravity model + Mutual information regularization) using the information theoretic geometry and a real Sprint network data set with validation. Then we will present a partial measurment framework to significantly reduce the relative error rate and computation.

*About the speaker:* Bin Yu is a Professor of Statistics at UC Berkeley. Her current research interests
include statistical inference, machine learning, information theory, and
modeling and data analysis of information technology problems (including
internet tomography, remote sensing, bioinformatics, and neuroscience).
She is a Fellow of IEEE and IMS (Inst. of Math. Statistics).