Packet Loss Measurement Based on Sampled Flow

: This paper is devoted to further strengthening, in the current asymmetric information environment, the informed level of operators about network performance. Speciﬁcally, in view of the burst and perishability of a packet loss event, to better meet the real-time requirements of current high-speed backbone performance monitoring, a model for P acket L oss M easurement at the access network boundary B ased on S ampled F low ( PLMBSF ) is presented in this paper under the premise of both cost and real-time. The model overcomes problems such as the inability of previous estimation to distinguish between packet losses before and after the monitoring point, deployment difﬁculties and cooperative operation consistency. Drawing support from the Mathis equation and regression analysis, the measurement for packet losses before and after the monitoring point can be realized when using only the sampled ﬂows generated by the access network boundary equipment. The comparison results with the trace-based passive packet loss measurement show that although the proposed model is easily affected by factors such as ﬂow length, loss rate, sampling rate, the overall accuracy is still within the acceptable range. In addition, the proposed model PLMBSF , compared with the trace-based loss measurement is only different in the input data granularity. Therefore, PLMBSF and its advantages are also applicable to aggregated trafﬁc. steady assumption met, underestimation to average the effect of overestimated bandwidth caused by a slow start. through limited rounds, short connections cannot exclude the effect of few rounds with fewer packet losses.

From the discussion above, it can be seen that the current research does not fully fit the actual scenario of an access network boundary, so it is not applicable, or fully meet the actual demand for access network boundary packet loss measurement. To this end, this paper adds to the body of measurement techniques by constructing model PLMBSF. Drawing support from the Mathis equation [21] and regression analysis [22], the model is able to estimate packet losses before and after the monitoring point when only the sampled flows generated by the access network boundary equipment are available. Compared with other research in this area, this work has the following contributions:

•
The access network boundary performance measurement can be achieved with only a single point of data, and there are no problems of deployment difficulties and cooperative operation consistency. • Without making pre-assumptions on the performance of the intra-domain network, the performance status of intra-domain and inter-domain can be given at the same time, which is more in line with the actual demand of the current refined network performance management.
The rest of the paper is organized as follows: Section 2 outlines the construction of PLMBSF. Section 3 details the solving for model PLMBSF. Section 4 discusses the processing strategy for flow sampling. Section 5 validates and analyzes PLMBSF based on the practical measurement data. Finally, Section 6 concludes the paper and suggests future work.

PLMBSF
PLMBSF stems from the famous Mathis equation that is able to infer the bandwith of a TCP connection under steady state and with random loss rate. Through regression analysis to mine the hidden information in the data stream and ACK stream, PLMBSF realizes the estimation for packet losses before and after the monitoring point.

Model Description
Mathis is one of the simplest renewal-theory-based TCP models, which describes the macroscopic behavior of the congestion avoidance algorithm. In addition to Mathis, there exist more complex and advanced models. For instance, PFTK [23] modeled timeout and window limits, and C-PFTK [24] extended PFTK to simulate the impact of a TCP delay and slow start strategy, while GRZ [25] further modeled the congestion avoidance scenarios after the retransmission timer fires. However, the reason why Mathis is still chosen in our research is that its parameters are relatively easy to obtain at the access network boundary.
Mathis's simplicity is built on a number of assumptions, and here list only the ones that are relevant to PLMBSF: • When Sack is enabled, multiple packet losses in one RTT represent a single congestion event, and only one packet loss is recorded; • The receiver window is large enough, and the sender always has data to send; • The connection is long enough to reach a steady state; • The RTT is constant over the path.
Based on the assumptions above, Mathis is expressed as: where: • goodput represents the effective throughput, indicating the useful traffic [26] transferred from the source to the sink in a unit time; • MSS represents maxim segment size, typically 1460 bytes; • C is the smoothing parameter, with a value of 0.93; • RTT is the round-trip time; • PLR is the application-level packet loss rate.

Problem Setting and Challenges
The effective acquisition of several unknown parameters involved in PLMBSF is critical. Suppose that for a TCP connection, the packet loss rates before and after the monitoring point are LB and LA, respectively. Meanwhile, Equation (2) only gives the end-to-end application-level packet loss rate. To further distinguish the packet loss rate before and after the monitoring point indicated by LB and LA, the following problems need to be solved:

•
Mathis is suitable for the sink application layer, how to realize the utilization for Mathis at the monitoring point, viz., how to determine goodput; • After obtaining PLR, how to determine LB and LA; • Based on the sampled flow at the monitoring point, how to determine the RTT corresponding to a TCP connection; • In practical application, how to deal with flow sampling to ensure the model accuracy.
In view of the problems above, this paper next establishes statistical models with regression analysis to dynamically determine the target parameters. On this basis, with the aid of heavy-tailed distribution [27] and Pareto distribution [28], the influence of sampling is further considered by increasing the number of flows and performing a weighted average for the estimation results.

Methodology
The proposed method leverages regression analysis and the ratio of the number of data packets to the number of ACK packets to determine the unknown parameters of PLMBSF and finally obtains the target parameters LA and LB. Specifically, the steps to determine LA and LB are as follows: Step 1: Establish a regression model to mine the relationship hidden between AD and goodput to determine goodput; Step 2: Determine RTT by estimating the number of packets transmitted in each transmission round; Step 3: Determine PLR by Equation (1); Step 4: Establish a regression model between AD and LA to determine LA; Step 5: Determine LB by PLR and LA.
Since the method of determining the target parameters that is described later is based on regression analysis, the regression analysis is first presented in this section. In addition, to determine the target parameters of PLMBSF, it needs the TCP transfers used for regression analysis to cover various characteristics related to packet losses. To this end, after presenting regression analysis, the platform generating the wanted TCP transfers are further described in this section. Finally, on this basis, the method for determining the target parameters is detailed in this section.

Regression Analysis
In statistics, regression analysis refers to a set of statistical processes used to estimate the relationship between variables. Regression analysis contains numerous techniques for modeling when inferring the relationship between dependent variables and indepent variables. Correspondingly, the goal of regression analysis is to construct an optimum fitting model of the statistical data, i.e., to solve the weight θ of each characteristic independent variable. Assume that there are eigenvalues x 1 , x 2 , . . . . . . , x n (n variables), and then the prediction model can be expressed as: Convert to matrix form: The error between the predicted value and the true value is represented by ε, then: Assume that residual error ε (i) is independent and identically distributed, and it is generally believed that ε (i) obeys a normal distribution with a mean value of 0 and a variance of σ 2 . Thus: Substitute ε (i) into: Since ε is independent identically distributed, the output y of each sample is also independent and identically distributed. Accordingly, the maximum likelihood estimation is used to approximate θ so that the value of Equation (7) is most likely to be y (i) under the condition x (i) .
The log-likelihood function is: Accordingly, the cost function is: Next, the goal is to solve θ to minimize J(θ).

(a) When the matrix is full rank
In this case, the least squares method (LSM) is used. J(θ) is expressed as: Take the derivative of θ: Let X T Xθ − X T y = 0, then: (b) When the matrix is not full rank In this case, LSM may not be able to directly find the extreme value. Accordingly, the batch gradient descent is used to solve the local optimum, and the specific steps are as follows: (1) Assign a random value to θ, which can be a vector of all zeros; (2) Change θ to make J(θ) decrease in the direction of gradient descent, i.e., for each component of θ, update as the following manner until convergence: where: Since: Then: Finally, take the appropriate α as the step size to obtain:

Platform
In order to obtain the data required for regression analysis and PLMBSF evaluation, it is necessary to generate the target TCP flow and make it flow through the preset capture point so as to create a data capture scenario shown in Figure 1. In detail, the platform consists of four servers and ten clients located inside and outside JSERNET [26], respectively. Among them, the server configuration information is shown in Table 1, and number 1 to number 3 are communication servers, and number 4 is the storage server. The reason for setting 3 communication servers is to simplify the client operation to easily form TCP transfers with different acknowledgment mechanisms in the network [29]. Specifically, No. 1 server implements SCA by turning off SACK and DSACK, No. 2 server implements SACK by turning off DSACK and No. 3 server implements DSACK by default configuration. Moreover, to effectively carry out regression analysis and fully evaluate PLMBSF, in addition to the pre-placed files of different sizes on the communication server, we also irregularly arrange file uploads and downloads to obtain TCP transmissions with different sizes and loss rates.
Symmetry 2021, 13, x FOR PEER REVIEW 7 we also irregularly arrange file uploads and downloads to obtain TCP transmissions different sizes and loss rates.    Thus far, we have arranged more than 10,000 TCP transmissions. Particularly, we selected the semantically complete TCP transmissions to generate the dataset RED_SET, focusing on the effectiveness evaluation of PLMBSF itself. Here, the semantically complete TCP transmission refers to the TCP transmission containing connection establishment (three-way handshake) and connection release (four-way wavehand).

Target Parameter Determination
Regression analysis is mainly used to reveal the quantitative relationship between related variables. Therefore, before constructing the regression model, appropriate dependent variables should be set, and the related independent variables need to be selected in conjunction with the dependent variables. Combined with the research objective, in order to obtain goodput, the independent variables are set as SPR and LA. Then, goodput can be expressed as: where SPR represents the proportion of the number of spurious retransmissions at the monitoring point to the total number of data packets, TN represents the total number of data packets at the monitoring point, T indicates the flow duration, AVG represents the average number of bytes of the data packets, IH and TH represent the overhead of IP header and TCP header of the data packet respectively, and the default values are both 20 bytes. For SPR and LA, the corresponding independent variable selected is AD, i.e., the ratio of the number of data packets to the number of ACK packets. For SPR, the reason why AD is selected as an independent variable is that the spurious retransmission will trigger redundant ACK and change the status of AD. Specifically, the number of spurious retransmissions will affect AD, and in turn, AD can reflect SPR to a certain extent. Furthermore, due to the existing relationship between TCP packet losses and AD [13], AD is also selected as the independent variable of LA. Accordingly, the specific steps to determine target parameters are: establish the regression model between AD and SPR to determine SPR → establish the regression model between AD and LA to determine LA → determine goodput, LB and RTT.
According to empirical analysis, whether SPR and AD, or LA and AD, there exists a multivariate nonlinear relationship between them. Therefore, we intend to linearize the multivariate nonlinear model first and then solve the target parameters with linear regression. Moreover, the polynomial model plays a very important role in nonlinear regression analysis. According to the theory of the series expansion method, any problem of the curve, surface and hypersurface can be approximated arbitrarily with the polynomials in a certain range. Therefore, when the correlation between the regression variables is unknown, it can be approximated with the polynomials of appropriate power. Since only one independent variable is involved here, namely AD, the corresponding polynomial function is the univariate polynomial, and its general form is: Linearization, let: Obtain the multiple linear regression equation: In order to establish the regression model between SPR and AD, we randomly selected twenty TCP flows from RED_SET to make statistics of SPR and AD, and the statistical result is shown in Table 2. As can be seen, there is a positive correlation between AD and SPR as a whole. Moreover, Table 2 also gives the corresponding values after linearizing AD. According to Table 2, X and y are:   According to LSM, θ is: Finally, the regression model between SPR and AD is: After obtaining the regression model indicated by Equation (24), a statistical test is needed to further confirm the correlation between SPR and AD. Therefore, we next carry out a goodness-of-fit test and significance test.
The indicators used for goodness-of-fit are R-squared R 2 and adjusted R-squared R 2 .
Before the goodness-of-fit test, introduce the following indicators: Total Sum of Squares (TSS): Explained Sum of Squares (ESS): Residual Sum of Squares (RSS): Then, R 2 is calculated as: Divide RSS and TSS by their respective degrees of freedom to eliminate the effect of the number of variables on the goodness-of-fit: (29) where n − k and n − 1 are the degrees of freedom of RSS and TSS, respectively.
As can be seen from the above goodness-of-fit, R 2 and R 2 are both close to 1 and greater than 0.96. Therefore, the constructed regression model has a good fitting effect and meets the actual application requirements.
Next, to evaluate the joint significance, it is necessary to perform an F-test on the basis of variance analysis. To this end, introduce a null hypothesis and alternative hypothesis: Null hypothesis: H 0 : β 1 = β 2 = · · · = β k = 0. Alternative hypothesis: H 1 : β j (j = 1, 2, . . . , k) is not all 0. Construct statistics F: Given the significance level α = 0.05, check the critical value with degrees of freedom of 3 and 16 in the F distribution table [30]: According to Equation (31), H 0 is rejected, i.e., the regression relationship between the explanatory variable and the explained variable is significant.
In unary regression, the F-test and t-test are equivalent. However, in multiple regression, the F-test is significant, which does not mean that every explanatory variable has a significant influence on the explained variable. Therefore, for the constructed regression model, the t-test is also needed. To this end, introduce the null hypothesis and alternative hypothesis: Null hypothesis: H 0 : β j = 0, j = 1, 2, . . . , k.
Construct statistics t*: where σ is the standard deviation of the random disturbance term, and its estimated value is: According to |t * (9.502045874)|, |t * (AD)|, |t * (AD 2 )| and |t * (AD 3 )|, H 0 is rejected, i.e., each explanatory variable in the constructed regression has a significant impact on the explained variable.
Based on the discussion above, the regression model indicated by Equation (24) is optimum.
Likewise, referring to the statistical results in Table 3, the optimum regression between AD and LA can be built: Combined with the application scenarios of Mathis, LA is calculated as: Correspondingly, LB is calculated as: Then, LB is calculated as: Finally, for RTT, we can estimate it with the existing models [32,33].

Sampling Analysis and Processing
Considering the system burden, the flow generated by the router is generally packetsampled. Accordingly, the sampling needs to be processed to reduce the estimation error. The unknown variables involved in PLMBSF include: TDN, TAN, T, AVG and T. For this reason, how to determine these variables through sampled flow becomes the key to sampling analysis and processing.
In a sampling environment, if the number of sampled packets is known to be N S , then TDN can be estimated as follows [32,34].
Let A denote the number of packets and B denote the number of sampled packets, then: Since the network flow obeys a heavy-tailed distribution, TDN can be estimated by the Pareto distribution with a parameter of 1 [35], i.e., β = 1 and A min = N S , then: Correspondingly, TDN is calculated as: Although the numerator and denominator of Equation (40) contain infinite items, since the value of the expansion term is degressive, only the first few terms need to be calculated according to the actual accuracy requirements. Similarly, TAN can be obtained. As for T and AVG, the general processing method is: where T S is the sampling flow duration.
where TB S and TN S represent the total number of bytes and packets in the sampled flow, respectively.

Experimental Verification
In this section, PLMBSF is compared with the classical trace-based algorithm of Benko-Veres [36] from four aspects: flow length, packet loss rate, acknowledgment mechanism and sampling rate. Since Benko-Veres does not support sampling, the corresponding unsampled packet trace is taken as the input. In addition, the flow length interval division standard takes the original flow length instead of the sampled one.

Effect of Flow Length
In order to cover as many flow lengths as possible, the distribution of the file size (original flow length) on the server side during data capture is shown in Figure 2. Among them, each flow length interval corresponds to 10 files with different sizes. Correspondingly, for each flow length interval, 10 TCP flows were selected for experiment. Since the presentation of the estimation results is grouped in flow length intervals, and each group of results is the packet loss estimation between different hosts, the traditional statistical-based error analysis is not applicable here. To this end, cosine similarity (CS) is used to measure the difference in estimation results between PLMBSF and Benko-Veres.
where A = {a i } n and B = {b i } n represent two sets of estimated results, respectively. CS ranges from 0 to 1. The closer CS is to 1, the more similar A and B are, and the better the estimation result. In order to focus on the effect of flow length on PLMBSF, the selected public parameters are shown in Table 4. Figure 3 shows the CS of PLMBSF and Benko-Veres under different flow length intervals. It can be seen that the flow length has no significant effect on PLMBSF after the monitoring point. Instead, with the increase in flow length, there is a significant difference in the estimation before the monitoring point, i.e., the estimation of long flow is better than that of short flow. Through analysis, the difference before the monitoring point mainly stems from the limitations of Mathis itself. Specifically, the premise of Mathis's reliability is that the flow should be long enough to have enough interaction time to reach steady state. When this assumption is not met, underestimation may occur. Actually, it is not the flow duration time that matters, but, rather, the transmission round (a transmission round equals the RTT in slow-start stage, or equals, in congestion avoidance, the time needed to increase the window by one segment). For the case of small loss rates, a short connection will not be able to interact enough times to average the effect of overestimated bandwidth caused by a slow start. Again, through limited rounds, short connections cannot exclude the effect of few rounds with fewer packet losses.
ingly, for each flow length interval, 10 TCP flows were selected for experiment. S presentation of the estimation results is grouped in flow length intervals, and eac of results is the packet loss estimation between different hosts, the traditional st based error analysis is not applicable here. To this end, cosine similarity (CS) is measure the difference in estimation results between PLMBSF and Benko-Veres.
where A = {ai}n and B = {bi}n represent two sets of estimated results, respectively. C from 0 to 1. The closer CS is to 1, the more similar A and B are, and the better the es result. In order to focus on the effect of flow length on PLMBSF, the selected publi eters are shown in Table 4. Figure 3 shows the CS of PLMBSF and Benko-Ver different flow length intervals. It can be seen that the flow length has no significa on PLMBSF after the monitoring point. Instead, with the increase in flow length a significant difference in the estimation before the monitoring point, i.e., the es of long flow is better than that of short flow. Through analysis, the difference b monitoring point mainly stems from the limitations of Mathis itself. Specifically, th ise of Mathis's reliability is that the flow should be long enough to have enough tion time to reach steady state. When this assumption is not met, underestimat occur. Actually, it is not the flow duration time that matters, but, rather, the tran round (a transmission round equals the RTT in slow-start stage, or equals, in co avoidance, the time needed to increase the window by one segment). For the case loss rates, a short connection will not be able to interact enough times to average t of overestimated bandwidth caused by a slow start. Again, through limited roun connections cannot exclude the effect of few rounds with fewer packet losses.

Effect of Loss Rate
The public parameters selected for investigating the effect of loss rate o shown in Table 5. The selected 100 flows are divided into 10 groups on ave to loss rates, and the ranges of loss rate before and after the monitoring poi ing to group i are (0.001·(i − 1), 0.001i] and (0.005·(i − 1), 0.005i], respecti results in Figure 4, it can be seen that the estimation after the monitoring po

Effect of Loss Rate
The public parameters selected for investigating the effect of loss rate on PLMBSF are shown in Table 5. The selected 100 flows are divided into 10 groups on average according to loss rates, and the ranges of loss rate before and after the monitoring point corresponding to group i are (0.001·(i − 1), 0.001i] and (0.005·(i − 1), 0.005i], respectively. From the results in Figure 4, it can be seen that the estimation after the monitoring point tends to be stable on the entire parameter space. In contrast, as the loss rate increases, the estimate accuracy before the monitoring point rises first and then falls. Specifically, when the loss rate is less than or equal to 1.5%, CS fluctuates between 0.7 and 0.8, when the packet loss rate rises to between 1.5% and 3%, CS remains above 0.8, and when the packet loss rate is greater than or equal to 3%, CS falls back to around 0.7.  Actually, the estimation error mainly stems from Mathis itself. First, M that the receiver window is large enough and does not limit the data tra However, when the loss rate is too low to meet this assumption, what PLM is not the real loss rate but the "virtual" one imposed by the receiver bu Mathis assumes that the loss event is random and is repaired by fast retrans ever, the type of packet loss in a real network usually depends on the actua ditions. In particular, when the tail drop strategy is implemented at the bott of packets may be lost. In this case, the sender will wait until the timeout is triggered. Correspondingly, such situation will increase with the incre and eventually result in the inaccuracy of PLMBSF.

Effect of Acknowledgment Mechanism
The public parameters selected for investigating the effect of acknowle anism on PLMBSF are shown in Table 6. The selected 300 flows are div groups on average according to the acknowledgment mechanism. For th each acknowledgment mechanism: First, calculate their CS separately; seco their maximum CS, minimum CS, and average CS before and after the mo The experiment results in Figure 5 show that the acknowledgment mechan nificant effect on PLMBSF estimation after the monitoring point. Specifica Actually, the estimation error mainly stems from Mathis itself. First, Mathis assumes that the receiver window is large enough and does not limit the data transmission rate. However, when the loss rate is too low to meet this assumption, what PLMBSF estimates is not the real loss rate but the "virtual" one imposed by the receiver buffer. Secondly, Mathis assumes that the loss event is random and is repaired by fast retransmission. However, the type of packet loss in a real network usually depends on the actual network conditions. In particular, when the tail drop strategy is implemented at the bottleneck, a series of packets may be lost. In this case, the sender will wait until the timeout retransmission is triggered. Correspondingly, such situation will increase with the increase in loss rate and eventually result in the inaccuracy of PLMBSF.

Effect of Acknowledgment Mechanism
The public parameters selected for investigating the effect of acknowledgment mechanism on PLMBSF are shown in Table 6. The selected 300 flows are divided into three groups on average according to the acknowledgment mechanism. For the TCP flows of each acknowledgment mechanism: First, calculate their CS separately; secondly, calculate their maximum CS, minimum CS, and average CS before and after the monitoring point. The experiment results in Figure 5 show that the acknowledgment mechanism has no significant effect on PLMBSF estimation after the monitoring point. Specifically, the overall CS is maintained between 0.7 and 0.8, while the average CS fluctuates around 0.74. Actually, for any acknowledgment mechanism, the spurious retransmissions will not update the receiver buffer while increasing the number of data packets, thereby causing their differences in AD. Unlike the situation after the monitoring point, before the monitoring point, the performance of PLMBSF on SCA is significantly better than that on SACK and DSACK. Regardless of SACK or DSACK, when SACK is enabled, Mathis will treat multiple packet losses within one RTT as a single congestion, which will cause PLMBSF's underestimation before the monitoring point.  Figure 5. Effect of acknowledgment mechanism on PLMBSF.

Effect of Flow Sampling
The selected 100 flows are divided into 10 groups on average acc length, and the range of flow length corresponding to group i is (5·i MB, 5( reference to the effect of loss rate and flow length on PLMBSF, the selection of flows according to the parameters in Table 7 will have a relatively small the investigation of the effect of the sampling rate. Correspondingly, the are set to 1/4 and 1/16. From the results in Figure 6, it can be seen that the sa in certain fluctuations, and the estimation becomes more and more inaccur pling rate increases. In fact, this is mainly related to inaccurate statistical parameters (e.g., flow length, flow duration time and so on) caused by sam of this, we try to reduce the adverse effect by increasing the number of flow set the sampling rate to 1/32 and select 10, 50 and 100 flows within the sa interval for experiments, respectively. The experiment results in Figure 7 accuracy and stability of PLMBSF, after increasing the number of sampled proved. This indicates that although sampling will bias the statistics of t rameters, the effect on the expectation value of estimations is relatively sm when evaluating overall performance, the weighted average of the estim

Effect of Flow Sampling
The selected 100 flows are divided into 10 groups on average according to flow length, and the range of flow length corresponding to group i is (5·i MB, 5·(i+1) MB). With reference to the effect of loss rate and flow length on PLMBSF, the selection and grouping of flows according to the parameters in Table 7 will have a relatively small interference on the investigation of the effect of the sampling rate. Correspondingly, the sampling rates are set to 1/4 and 1/16. From the results in Figure 6, it can be seen that the sampling results in certain fluctuations, and the estimation becomes more and more inaccurate as the sampling rate increases. In fact, this is mainly related to inaccurate statistical values of some parameters (e.g., flow length, flow duration time and so on) caused by sampling. In view of this, we try to reduce the adverse effect by increasing the number of flows. To this end, set the sampling rate to 1/32 and select 10, 50 and 100 flows within the same flow length interval for experiments, respectively. The experiment results in Figure 7 show that the accuracy and stability of PLMBSF, after increasing the number of sampled flows, are improved. This indicates that although sampling will bias the statistics of the relevant parameters, the effect on the expectation value of estimations is relatively small. Therefore, when evaluating overall performance, the weighted average of the estimates of enough sampled flows within a specific time granularity will reduce the effect of sampling. Loss rate before the monitoring point (0.7%, 1.0%) 3 Loss rate after the monitoring point (1.0%, 3.0%) 4 Sampling rate 1/4, 1/6, 1/32 5 Acknowledgment mechanism SACK the investigation of the effect of the sampling rate. Correspondingly, the sampling rates are set to 1/4 and 1/16. From the results in Figure 6, it can be seen that the sampling results in certain fluctuations, and the estimation becomes more and more inaccurate as the sampling rate increases. In fact, this is mainly related to inaccurate statistical values of some parameters (e.g., flow length, flow duration time and so on) caused by sampling. In view of this, we try to reduce the adverse effect by increasing the number of flows. To this end set the sampling rate to 1/32 and select 10, 50 and 100 flows within the same flow length interval for experiments, respectively. The experiment results in Figure 7 show that the accuracy and stability of PLMBSF, after increasing the number of sampled flows, are improved. This indicates that although sampling will bias the statistics of the relevant parameters, the effect on the expectation value of estimations is relatively small. Therefore when evaluating overall performance, the weighted average of the estimates of enough sampled flows within a specific time granularity will reduce the effect of sampling.

Application Analysis
For PLMBSF, in order to focus on its estimation technique itself, we assume data source is a semantically complete TCP bidirectional flow. However, referri generation process of the sampled flow (e.g., NetFlow), the sampled flow, when the data source of PLMBSF, must be preprocessed.
When the IP flow stored in the flow buffer meets one of the four conditions Table 8, it is considered to be terminated. Subsequently, the corresponding one-w Flow is output. Combined with the generation process of NetFlow, the followin sues should be considered when taking NetFlow as input: (a) Merging of truncated flows As can be seen from Table 8, a NetFlow may correspond to a truncated IP addition to a normally ended IP flow. If it is the latter, you need to merge the t NetFlow into a complete one.

(b) Bidirectional flow matching
The generated NetFlow is unidirectional. Therefore, when PLMBSF is app real network, it is necessary to perform bidirectional flow matching based on 5-tu sisting of protocol number, source IP address, destination IP address, source

Application Analysis
For PLMBSF, in order to focus on its estimation technique itself, we assume that the data source is a semantically complete TCP bidirectional flow. However, referring to the generation process of the sampled flow (e.g., NetFlow), the sampled flow, when taken as the data source of PLMBSF, must be preprocessed.
When the IP flow stored in the flow buffer meets one of the four conditions listed in Table 8, it is considered to be terminated. Subsequently, the corresponding one-way NetFlow is output. Combined with the generation process of NetFlow, the following two issues should be considered when taking NetFlow as input: (a) Merging of truncated flows As can be seen from Table 8, a NetFlow may correspond to a truncated IP flow in addition to a normally ended IP flow. If it is the latter, you need to merge the truncated NetFlow into a complete one.

(b) Bidirectional flow matching
The generated NetFlow is unidirectional. Therefore, when PLMBSF is applied in a real network, it is necessary to perform bidirectional flow matching based on 5-tuple consisting of protocol number, source IP address, destination IP address, source port and destination port so as to produce the required bidirectional flow. Flag indicating the end of the flow appears, such as FIN, RST, etc. 4 Flow buffer area is full.

Conclusions
The model PLMBSF constructed and evaluated in this paper is able to realize the estimation for packet losses before and after the monitoring point when only sampled flow is available. Compared with traditional algorithms and models in this field, the advantages of our method are mainly reflected in two points: (1) Under the premise of considering cost, real-time and realistic-usability, the access network boundary performance measurement can be achieved with only a single point of data, and there are no problems of deployment difficulties and cooperative operation consistency. (2) Without making pre-assumptions on the performance of the intra-domain network, the performance status of intra-domain and inter-domain can be given at the same time, which is more in line with the actual demand of currently refined network performance management. Moreover, PLMBSF is suitable for continuous observation, at the large-scale network boundary, for packet loss behavior so as to realize fine-grained network performance monitoring. Moreover, PLMBSF is a good supplement to trace-based performance measurement, i.e., network operators and managers can make more targeted trace-based measurements on the basis of this macro measurement to fully understand and grasp network performance.
For PLMBSF, the estimation before the monitoring point tends to be stable, but the estimation after the monitoring point is easily affected by the flow length, loss rate and acknowledgment mechanism. To this end, in future work, it is considered to complete the model construction based on more complex and advanced PFTK, C-PFTK, GRZ, etc. Meanwhile, regardless of whether before or after the monitoring point, the expected value of the estimation is relatively less affected by sampling. Therefore, PLMBSF is suitable for overall performance measurement on the high-speed backbone network.
Furthermore, the impact of IP fragmentation [37] will spread to the flow record level. Accordingly, processing IP fragmentation is beneficial to improve the robustness of PLMBSF in practical applications. If one-way traffic [38] is supported, the number of available flows will be increased to further improve the availability of PLMBSF. Moreover, since wireless access networks [39] are now very popular and have noticeable effects on network performance [40], it will be very interesting to carry out relevant research in wireless networks.