Scientific news from the Institut Mines-Télécom.

Published on 11 March 2025

Written by Ingrid Colleau

Patrice Abry, winner of the 2024 IMT-Académie des Sciences Grand Prize

Complex systems specialist Patrice Abry played a key role in identifying the fractal nature of Internet traffic as early as 1998. The success of his work, carried out in collaboration with Daryl Veitch, sparked the launch of a series of research projects integrating theoretical advances and applications, particularly in cybersecurity, that have continued over two decades. We review a career that saw techniques evolve with the times, but in which fundamental constants remain.

In brief:

In 1998, Patrice Abry showed that the dynamics of Internet traffic are scale-invariant.
20 years later, the researcher successfully demonstrated the stability of the model proposed in his early work.
His research, particularly in multifractal analysis, paved the way for anomaly detection techniques in cybersecurity.

Tags:

# cybersecurity

# fractal

# IMT-Académie des Sciences awards

# portrait

# signal processing

Patrice Abry receives the 2024 IMT-Académie des Sciences Grand Prize.

Patrice Abry applies his knowledge of fractals to natural systems, particularly physiological rhythms such as walking or heart rate, but also artificial ones such as Internet traffic. In 1998, he co-edited an article with Australian researcher Daryl Veitch based on the University of Auckland’s database, through which all Internet traffic entering and leaving New Zealand was routed. Together, they proposed analysis tools that confirmed for the first time that the dynamic structure of Internet traffic was fractal. The article was a major success.

Their publication marked the start of a long-term research project that was followed up in 2009 and again in 2017, and continues to this day. Below is a review of Patrice Abry’s unique career in which theoretical developments intersect with such topics as applications in Internet traffic and cybersecurity, but where time clearly has no hold.

Unusual subjects of study

In traditional geometry, an object such as a square or circle can be fully described by simple, smooth contours. Fractal objects, or “scale invariants”, on the other hand, are infinitely complex: no matter how great the zoom, they constantly reveal new details, without ever displaying simple contours. What is more, most of these objects are self-similar, i.e. their shapes or motifs are repeated on all scales, a bit like a Romanesco broccoli!

In physics, the analysis of a system’s processing method ordinarily assumes that it is characterized by time or space scales that structure its operation. This means that the key step in writing a model or analysis tool is to identify and measure these scales. The human heart rate, for example, is characterized by a time scale relative to a baseline rate of one beat per second.

“However, there is a group of systems, some natural and some artificial, for which this definition based on space and times scales can no longer be applied, and it is, conversely, this absence that characterizes them. It’s what we call scale invariance,” explains Patrice Abry. In such cases, there is no characteristic scale or, on the contrary, all scales are characteristic. A system is no longer described by what is observed at a particular scale, but by how information changes from one scale to another.

Internet traffic, between “technological” and “human” regimes

Patrice Abry observed this invariance of scale in Internet traffic, i.e. the flow of data on the Internet network. Internet traffic is made up of IP packets, small units containing part of the data sent via IP (Internet Protocol), and is measured by the volume of data (megabytes or gigabytes) in circulation. The rsearcher has spent many years working with the University of Tokyo and the Japanese National Institute of Informatics (NII) to demonstrate the fractal nature of these flows.

Using equipment at the NII capable of recording Internet traffic over several days, Patrice Abry identified two major scale-invariant ranges, separated by a characteristic time scale of around one second. This duration is a time constant observed in all Internet traffic worldwide and is linked to Round Trip Time (RTT), i.e. the time required for a computer to receive an acknowledgment of receipt from its recipient whenever it sends a data packet.

Below one second, there is a great dynamic (linked to the workings of Internet technology, packet transmission, etc.), which is not characterized by a time scale. The same is true of the range above one second, which is linked to human activity, data sharing and transmission, emails, videos, etc. This analysis, however contemporary it is with the diversity of Internet uses, is not recent and was first proposed by the researcher in his 1998 article, over 25 years ago!

A groundbreaking article

“At the time, the people who managed the Internet were trying to model traffic using the telephone network model,” says Patrice Abry. Telephone flows can be well described by time-scale models, making it possible to dimension infrastructures, define server sizes and bill services. “But when these models were applied to Internet traffic, things soon went wrong,” says the researcher.

Originally calibrated using a characteristic size, as for telephones, servers were often overwhelmed with Internet traffic that was of no characteristic size, causing interruptions in communication. In 1995, an American team introduced the concept of long-range dependence (LRD), which addressed the absence of characteristic scale. But it was really the work of Abry and Veitch that brought this property to light, thanks to a theoretical tool used by the French researcher during his thesis: wavelet, or multiscale, analysis.

“When Darryl Veitch suggested that I transfer the theoretical tools developed during my thesis, which was supervised by Patrick Flandrin, to Internet traffic, I immediately latched on to the idea, because Internet data poses a number of operational difficulties. We couldn’t apply these tools as they were, so we had to rethink and adapt them,” recalls Patrice Abry. This toing-and-froing between theory and application is a common thread in the researcher’s career: “Theoretical tools drive applications forward, while applications question the practicality of the tools.”

Patrice Abry has demonstrated the scale invariance of Internet traffic. At left, the same time series showing the number of active connections measured on a server over time. Regardless of the time magnitude selected on each line by the red rectangle, dilating this portion along the horizontal axis (graphs on the right) reveals a new time series, so similar to the original as to be statistically indistinguishable. By extension, the three “dilated” series on the right are also statistically indistinguishable from each other. So it’s impossible to say whether the selection in the red rectangle on the left is more or less “large” or “small”, because there is no relevant time scale in the original series to compare it to! Credits: P. Abry.

“Fundamentally, the dynamics governing the Internet haven’t changed ”

The article was very well received by the scientific community and paved the way for numerous complementary studies and international collaborations, including those with the University of Tokyo and the NII. In 2005, Patrice Abry launched a 14-year longitudinal study with the two institutions, which first served to test the results obtained in 1998. In 2009, and again in 2017, he and his Japanese colleagues came to the astonishing conclusion that the model he had proposed almost 20 years earlier had not aged a single day!

“Obviously, traffic has increased enormously since then, but apart from this increase, the time scale between the technological and human regimes has not changed. Moreover, the parameters of the model have also stayed extremely stable, which means that, fundamentally, despite remarkable changes in usage, the dynamics governing the Internet haven’t changed either!” explains the researcher.

Traffic anomaly detection

These observations served as the starting point for the development of an innovative cybersecurity strategy. Given the great variability of traffic, it is very difficult to define a frame of reference for differentiating between what is normal or legitimate and what is abnormal or threatening. “Just a few years ago, we were observing typical behaviors, collecting data on a fixed schedule every week, and distinguishing weekday and weekend behaviors, or day and night behaviors. But these temporalities have become inadequate in a world where information circulates around the clock between Japan, the United States, or France,” says Patrice Abry.

The researcher and his Japanese colleagues came up with the idea of supplementing their scale invariance tools with robust statistical tools, and applying a random sampling technique to a day’s traffic. The trace (recording) of a day is made up of a time series of packets, which are dispatched between several sub-traces according to a rule. Each sub-trace is then passed through a statistical analysis tool which, in the event of an attack, sounds the alarm if one of them has a different dynamic to the others. By repeating these operations enough times, it is possible to identify the source IP address of the attack with a very high probability of success. “The advantage of this random projection method is that it’s not based on referencing using the past, but rather on a form of self-referencing,” explains Patrice Abry.

Multifractal analysis: a precision tool

In parallel with this project, the researcher is collaborating with mathematician Stéphane Jaffard on multifractal modeling, a powerful tool for describing highly heterogeneous systems that are characterized by rich, complex dynamics. “In signal processing, autocorrelation is a classic tool for obtaining a global description of temporal dynamics, but it is inadequate for describing more subtle phenomena, such as the fact that there is sometimes a complex alternation between peaks of activity and very quiet periods,” he explains.

The two researchers developed a theoretical tool for multifractal analysis called wavelet leaders, or dominant wavelet coefficients, which goes beyond global dynamics and describes information linked to local dynamics. Patrice Abry demonstrated the effectiveness of this tool in a number of applications, including cardiac variability to establish whether hospitalized patients are in a life-threatening condition, and cybersecurity to improve anomaly detection.

The combination of random sampling techniques and these multifractal analysis tools was the subject of a 2017 article of particular importance to the researcher. “It was the culmination of our work. It answers some of the questions we were already asking ourselves in 1998, but for which we had neither the data nor the theoretical tools to fully address,” says Patrice Abry. “In research, there are projects that come to a swift conclusion, and others that stick in our heads and re-emerge years later. Research also has its own time constants!” he says with a smile.