The Multifractal IP Address Structure: Physical Explanation and Implications

TL;DR

The study addresses why observed IP addresses in Internet traffic exhibit multifractal structure by linking it to a physical process—conservative cascades operating over the hierarchical IANA→RIR→organization allocation pipeline. It introduces a finite-discrete cascade toolbox, fits a symmetric Logit-normal generator $W$ to real data with $\sigma = 1.61$, and develops an improved estimator $\tilde{\tau}(q)$ to robustly quantify multifractality in discrete IP spaces. The authors demonstrate multifractal scaling across diverse real-world traces (IPv4 and IPv6) and show that the multifractal structure provides a practical invariant for anomaly detection and traffic characterization. The work highlights implications for in-network telemetry, dynamic resource allocation, and security, while outlining open statistical and methodological questions for adapting multifractal analysis to discrete, finite domains.

Abstract

The structure of IP addresses observed in Internet traffic plays a critical role for a wide range of networking problems of current interest. For example, modern network telemetry systems that take advantage of existing data plane technologies for line rate traffic monitoring and processing cannot afford to waste precious data plane resources on traffic that comes from "uninteresting" regions of the IP address space. However, there is currently no well-established structural model or analysis toolbox that enables a first-principles approach to the specific problem of identifying "uninteresting" regions of the address space or the myriad of other networking problems that prominently feature IP addresses. To address this key missing piece, we present in this paper a first-of-its-kind empirically validated physical explanation for why the observed IP address structure in measured Internet traffic is multifractal in nature. Our root cause analysis overcomes key limitations of mostly forgotten findings from ~20 years ago and demonstrates that the Internet processes and mechanisms responsible for how IP addresses are allocated, assigned, and used in today's Internet are consistent with and well modeled by a class of evocative mathematical models called conservative cascades. We complement this root cause analysis with the development of an improved toolbox that is tailor-made for analyzing finite and discrete sets of IP addresses and includes statistical estimators that engender high confidence in the inferences they produce. We illustrate the use of this toolbox in the context of a novel address structure anomaly detection method we designed and conclude with a discussion of a range of challenging open networking problems that are motivated or inspired by our findings.

Figures (27)

• Figure 1: 1D Pictorial evidence of multifractal vs not-multifracatal IP address structure, using the dataset CAIDA500k (left) and Uniform500k (right), respectively.
• Figure 2: High-level "cascade" process of Internet address allocations.
• Figure 2: Number of approximate max aggregates added (and percentage increase w.r.t. total number of records in each RIR) for each RIR at threshold of 51% coverage.
• Figure 3: Global view of IANA IPv4 Address Space Registry showing which regions of the space are allocated to several primary RIRs and the maximum possible aggregation of each contiguous per-RIR block.
• Figure 4: Timeline of IANA allocations for the non-reserved regions of the global unicast IPv6 space 2000::/3 showing how particular RIRs receive allocations in well-defined clusters.