[Paper Review] Analysis of Inter-Domain Traffic Correlations: Random Matrix Theory Approach

Viktoria Rojkova, Mehmed Kantardzic|ArXiv.org|Jun 18, 2007

Complex Network Analysis Techniques27 references3 citations

TL;DR

This paper proposes a Random Matrix Theory (RMT) approach to analyze inter-domain traffic correlations in a university backbone network, using cross-correlation matrices of SNMP-based traffic time series to distinguish random from system-specific interactions. The method identifies stable, non-random eigenvalues and eigenvectors that reveal large-scale network-wide traffic patterns, while deviations from RMT predictions detect anomalies, enabling real-time monitoring of network health and traffic dynamics without prior structural knowledge.

ABSTRACT

The traffic behavior of University of Louisville network with the interconnected backbone routers and the number of Virtual Local Area Network (VLAN) subnets is investigated using the Random Matrix Theory (RMT) approach. We employ the system of equal interval time series of traffic counts at all router to router and router to subnet connections as a representation of the inter-VLAN traffic. The cross-correlation matrix C of the traffic rate changes between different traffic time series is calculated and tested against null-hypothesis of random interactions. The majority of the eigenvalues λ_{i} of matrix C fall within the bounds predicted by the RMT for the eigenvalues of random correlation matrices. The distribution of eigenvalues and eigenvectors outside of the RMT bounds displays prominent and systematic deviations from the RMT predictions. Moreover, these deviations are stable in time. The method we use provides a unique possibility to accomplish three concurrent tasks of traffic analysis. The method verifies the uncongested state of the network, by establishing the profile of random interactions. It recognizes the system-specific large-scale interactions, by establishing the profile of stable in time non-random interactions. Finally, by looking into the eigenstatistics we are able to detect and allocate anomalies of network traffic interactions.

Motivation & Objective

• To develop a constraint-free methodology for analyzing network-wide traffic interactions using only time series data.
• To verify the uncongested state of the network by identifying time-stable, random-like interactions as a baseline.
• To detect and localize large-scale, system-specific traffic correlations through deviations from RMT predictions.
• To enable early detection of network anomalies by monitoring changes in eigenvalue and eigenvector statistics.
• To demonstrate the method’s robustness through controlled injection of random traffic and analysis of resulting spectral shifts.

Proposed method

• Construct a cross-correlation matrix $ C $ from equal-interval time series of traffic counts across all router-to-router and router-to-VLAN connections.
• Apply Random Matrix Theory (RMT) to test whether the eigenvalues of $ C $ fall within the bounds expected for random correlation matrices under the null hypothesis.
• Identify eigenvalues and eigenvectors deviating from the RMT bulk as indicators of non-random, system-specific interactions.
• Use the Inverse Participation Ratio (IPR) and eigenvector overlap matrices to assess localization and stability of deviating modes.
• Inject random traffic into significant time series to simulate anomalies and observe changes in eigenvalue distribution and eigenvector structure.
• Analyze temporal stability of both random and non-random components to detect shifts in network interaction patterns.

Experimental results

Research questions

• RQ1 Can Random Matrix Theory effectively distinguish random traffic interactions from system-specific large-scale correlations in inter-domain traffic?
• RQ2 Do the eigenvalues and eigenvectors of the traffic cross-correlation matrix exhibit stable, non-random deviations from RMT predictions?
• RQ3 Can changes in the eigenvalue spectrum and eigenvector statistics detect and localize network anomalies in real time?
• RQ4 How do controlled injections of random traffic affect the spectral and eigenvector properties of the correlation matrix?
• RQ5 Can the RMT-based approach serve as a universal, structure-agnostic method for monitoring network-wide traffic behavior?

Key findings

• The majority of eigenvalues of the traffic cross-correlation matrix $ C $ fall within the RMT-predicted bounds, confirming that most interactions are random and consistent with an uncongested network state.
• A small number of eigenvalues significantly exceed the RMT upper bound, indicating the presence of stable, non-random, system-specific large-scale correlations in the network.
• The deviating eigenvectors are spatially localized and stable over time, revealing identifiable traffic groups such as VLAN-router switch clusters and firewall-connected subnets.
• After injecting random traffic for three hours, the largest eigenvalue increased from 10 to 12, and the IPR tail extended, indicating increased localization and disruption of stable eigenvector patterns.
• The overlap matrix of deviating eigenvectors showed a dramatic break in stability, confirming detectable changes in network interaction structure due to anomaly injection.
• The method successfully detects temporal changes in both random and non-random interaction profiles, enabling real-time anomaly localization in time and space.