Multi-scale Internet traffic forecasting using neural networks and time series methods Paulo Cortez, 1 Miguel Rio, 2 Miguel Rocha 3 and Pedro Sousa 3 (1) Department of Information Systems=Algoritmi, University of Minho, 4800-058 Guimara ˜es, Portugal Email: [email protected](2) Department of Electronic and Electrical Engineering, University College London, Torrington Place, WC1E 7JE London, UK (3) Department of Informatics=CCTC, University of Minho, 4710-059 Braga, Portugal Abstract: This article presents three methods to forecast accurately the amount of traffic in TCP=IP based networks: a novel neural network ensemble approach and two important adapted time series methods (ARIMA and Holt-Winters). In order to assess their accuracy, several experiments were held using real-world data from two large Internet service providers. In addition, different time scales (5 min, 1 h and 1 day) and distinct forecasting lookaheads were analysed. The experiments with the neural ensemble achieved the best results for 5 min and hourly data, while the Holt-Winters is the best option for the daily forecasts. This research opens possibilities for the development of more efficient traffic engineering and anomaly detection tools, which will result in financial gains from better network resource management. Keywords: network monitoring, multi-layer perceptron, time series, traffic engineering 1. Introduction As more applications vital to today’s society migrate to TCP=IP networks, it is crucial to develop techniques to better understand and forecast the behaviour of these networks. In effect, TCP=IP traffic prediction is an important issue for any medium=large network provider and it is gaining more attention from the com- puter networks community (Papagiannaki et al., 2005; Babiarz & Bedo, 2006). By improving this task’s performance, network providers can opti- mize resources (e.g. adaptive congestion control and proactive network management), allowing a better quality of service (Alarcon-Aquino & Barria, 2006). Moreover, traffic forecasting can also help to detect anomalies in the data networks. Security attacks like denial-of-service or even an irregular amount of SPAM can in theory be detected by comparing the real traffic with the values predicted by forecasting algorithms (Krish- namurthy et al., 2003; Jiang & Papavassiliou, 2004). The earlier detection of these problems would conduct to a more reliable service. Nowadays, TCP=IP traffic prediction is often done intuitively by experienced network admin- istrators, with the help of marketing informa- tion on the future number of costumers and their behaviours (Papagiannaki et al., 2005). Yet, this produces only a rough idea of the real traffic. On the other hand, contributions from the areas of Operational Research and Compu- ter Science has lead to solid forecasting methods that replaced intuition based ones in other fields. DOI: 10.1111/j.1468-0394.2010.00568.x Article _____________________________ 143 c 2010 Blackwell Publishing Ltd Expert Systems, May 2012, Vol. 29, No. 2
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Multi-scale Internet traffic forecasting usingneural networks and time series methods
Paulo Cortez,1 Miguel Rio,2 Miguel Rocha3 andPedro Sousa3
(1) Department of Information Systems=Algoritmi, University of Minho, 4800-058Guimaraes, PortugalEmail: [email protected](2) Department of Electronic and Electrical Engineering, University College London,Torrington Place, WC1E 7JE London, UK(3) Department of Informatics=CCTC, University of Minho, 4710-059 Braga, Portugal
Abstract: This article presents three methods to forecast accurately the amount of traffic in TCP=IP based
networks: a novel neural network ensemble approach and two important adapted time series methods (ARIMAand Holt-Winters). In order to assess their accuracy, several experiments were held using real-world data fromtwo large Internet service providers. In addition, different time scales (5min, 1 h and 1 day) and distinctforecasting lookaheads were analysed. The experiments with the neural ensemble achieved the best results for
5min and hourly data, while the Holt-Winters is the best option for the daily forecasts. This research openspossibilities for the development of more efficient traffic engineering and anomaly detection tools, which willresult in financial gains from better network resource management.
Keywords: network monitoring, multi-layer perceptron, time series, traffic engineering
1. Introduction
As more applications vital to today’s society
migrate to TCP=IP networks, it is crucial to
develop techniques to better understand and
forecast the behaviour of these networks. In
effect, TCP=IP traffic prediction is an important
issue for any medium=large network provider
and it is gaining more attention from the com-
puter networks community (Papagiannaki et al.,
2005; Babiarz & Bedo, 2006). By improving this
task’s performance, network providers can opti-
mize resources (e.g. adaptive congestion control
and proactive network management), allowing a
better quality of service (Alarcon-Aquino &
Barria, 2006). Moreover, traffic forecasting
can also help to detect anomalies in the data
networks. Security attacks like denial-of-service or
even an irregular amount of SPAM can in theory
be detected by comparing the real traffic with the
values predicted by forecasting algorithms (Krish-
namurthy et al., 2003; Jiang & Papavassiliou,
2004). The earlier detection of these problems
would conduct to a more reliable service.
Nowadays, TCP=IP traffic prediction is often
done intuitively by experienced network admin-
istrators, with the help of marketing informa-
tion on the future number of costumers and
their behaviours (Papagiannaki et al., 2005).
Yet, this produces only a rough idea of the real
traffic. On the other hand, contributions from
the areas of Operational Research and Compu-
ter Science has lead to solid forecasting methods
that replaced intuition based ones in other fields.
*Statistically significant when compared with other methods.
10 Expert Systems c� 2010 Blackwell Publishing Ltd152 c� 2010 Blackwell Publishing LtdExpert Systems, May 2012, Vol. 29, No. 2
0
5
10
15
20
25
30
35
5 10 15 20
MA
PE
Lead Time (every 5 minutes)
A5M
Naive
ARIMA
HW
NNE
0
5
10
15
20
5 10 15 20
MA
PE
Lead Time (every five minutes)
B5M
Naive
HW
NNEARIMA
0
10
20
30
40
50
60
70
5 10 15 20
MA
PE
Lead Time (hours)
A1H
HW
ARIMA
NNE
Naive
0
5
10
15
20
25
30
35
5 10 15 20
MA
PE
Lead Time (hours)
B1H
HW
Naive
ARIMA
NNE
0
2
4
6
8
10
1 2 3 4 5 6 7
MA
PE
Lead Time (days)
NNEARIMA
5
10
15
20
25
30
35
1 2 3 4 5 6 7
MA
PE
Lead Time (days)
Naive
HW
ARIMA
NNE
Figure 4: The forecasting error results (MAPE) plotted against the lead time (h).
c� 2010 Blackwell Publishing Ltd Expert Systems 11153c� 2010 Blackwell Publishing Ltd Expert Systems, May 2012, Vol. 29, No. 2
predictions, the error goes from 3% to 5% (1 h in
advance) until 13–22% (24h lookahead). Finally,
the daily forecasts gave rise to error rates of 7%
(1 day horizon) and 6–13% (1 week lookahead).
Moreover, once this work was designed assuming
a passive monitoring system, no extra traffic is
required in the network. Hence, the recommended
approach opens room for the development of
better traffic engineering tools and methods to
detect anomalies in the traffic patterns.
In the future, similar methods will be applied
to forecast traffic demands associated with spe-
cific Internet applications, since this might ben-
efit management operations performed by ISPs,
such as traffic prioritization. Another interest-
ing possibility, would be the exploration of
similar forecasting approaches to other domains
(e.g. electricity demand or road traffic).
Acknowledgements
This work is supported by the FCT (Portuguese
science foundation) project PTDC=EIA=64541=2006. We would also like to thank Steve Williams
from UKERNA for providing us with part of the
data used in this work.
References
ALARCON-AQUINO, V. and J. BARRIA (2006) Multi-resolution FIR neural-network-based learning algo-rithm applied to network traffic prediction, IEEETransactions on Systems, Man and Cybernetics –Part C, 36, 208–220.
BABIARZ, R. and J. BEDO (2006) Internet traffic mid-term forecasting: a pragmatic approach using statis-tical analysis tools, Lecture Notes on ComputerScience, 3976, 111–121.
BOX, G. and G. JENKINS (1976) Time Series Analysis:Forecasting and Control, San Francisco, CA, USA:Holden Day.
CORTEZ, P., M. ROCHA, J. MACHADO and J. NEVES
(1995) A neural network based forecasting system.In Proceedings of IEEE ICNN’95. Vol. 5, Perth,Australia, pp. 2689–2693
CORTEZ, P., M. ROCHA and J. NEVES (2005) Time seriesforecasting by evolutionary neural networks, ChapterIII: Artificial Neural Networks in Real-Life Applica-tions, Hershey, PA, USA: Idea Group Publishing,pp 47–70.
DIETTERICH, T. (2000) Ensemble methods in machinelearning, in J. Kittler and F. Roli (eds), MultipleClassifier Systems, Lecture Notes in ComputerScience 1857, Berlin: Springer, 1–15.
DING, X., S. CANU and T. DENOEUX (1995) Neuralnetwork based models for forecasting. In Proceed-ings of Applied Decision Technologies Conference(ADT’95). Uxbridge, UK, pp. 243–252
FLEXER, A. (1996) Statistical evaluation of neural net-works experiments: minimum requirements and cur-rent practice, In Proceedings of the 13th EuropeanMeeting on Cybernetics and Systems Research,Vol. 2, Vienna, Austria, pp. 1005–1008
HANSEGAWA, M., G. WU and M. MIZUNO (2001)Applications of nonlinear prediction methods to theinternet traffic, In Proceedings of IEEE InternationalSymposium on Circuits and Systems. Vol. 3, Sydney,Australia, pp. 169–172
HASTIE, T., R. TIBSHIRANI and J. FRIEDMAN (2001) TheElements of Statistical Learning: Data Mining, Infer-ence, and Prediction, NewYork,USA: Springer-Verlag.
JIANG, J. and S. PAPAVASSILIOU (2004) Detecting net-work attacks in the internet via statistical networktraffic normality prediction, Journal of Network andSystems Management, 12, 51–72.
KRISHNAMURTHY, B., S. SEN, Y. ZHANG and Y. CHEN
(2003) Sketch-based change detection: methods, eva-luation, and applications, In Proceedings of InternetMeasurment Conference (IMC’03), Miami, USA
LAPEDES, A. and R. FARBER (1987). Non-Linear SignalProcessing Using Neural Networks: Prediction andSystem Modelling, Technical Report LA-UR-87-2662, Los Alamos National Laboratory, USA.
MAKRIDAKIS, S. (1982) The accuracy of extrapolation(times series) methods: results of a forecasting com-petition, Journal of Forecasting, 1, 111–153.
MAKRIDAKIS, S., S. WEELWRIGHT and R. HYNDMAN
(1998) Forecasting: Methods and Applications, NewYork, USA: John Wiley & Sons.
MALKI, H., N. KARAYIANNIS, B. NICOLAOS andM. BALASUBRAMANIAN (2004) Short-term electric
0
0.5
1
1.5
2
2.5
3
3.5
0 20 40 60 80 100
x 10
12, b
its
Time (hours)
A1HH=1
H=24
Figure 5: Example of the neural forecasts for
series A1H and lead times of h¼ 1 and h¼ 24.
12 Expert Systems c� 2010 Blackwell Publishing Ltd154 c� 2010 Blackwell Publishing LtdExpert Systems, May 2012, Vol. 29, No. 2
power load forecasting using feedforward neuralnetworks, Expert Systems, 21, 157–167.
PAPAGIANNAKI, K., N. TAFT, Z. ZHANG and C. DIOT
(2005) Long-term forecasting of internet backbonetraffic, IEEE Transactions on Neural Networks, 16,1110–1124.
RIEDMILLER, M. (1994) Advanced supervised learningin multilayer perceptrons – from backpropagation toadaptive learning techniques, International Journalof Computer Standards and Interfaces, 16, 265–278.
SANG, A. and S. LI (2002) A predictability analysis ofnetwork traffic, Computer Networks, 39, 329–345.
STALLINGS, W. (1999) SNMP, SNMPv2, SNMPv3 andRMON 1 and 2, Reading, MA: Addison-Wesley.
TAYLOR, J. (2003) Short-term electricity demand fore-casting using double seasonal exponential smooth-ing, Journal of Operational Research Society, 54,799–805.
TAYLOR, J., L. MENEZES and P. MCSHARRY (2006) Acomparison of univariate methods for forecastingelectricity demand up to a day ahead, InternationalJournal of Forecasting, 21, 1–16.
Time-Series-Staff (2002). X-12-ARIMA referencemanual. Available at http://www.census.gov/srd/www/x12a/ (accessed December 2008), U. S. CensusBureau, Washington, USA, July.
TONG, H., C. LI and J. HE (2004) Boosting feed-forward neural network for internet traffic predic-tion, In Proceedings of the IEEE 3rd InternationalConference on Machine Learning and Cybernetics.Shanghai, China, pp. 3129–3134
WANG, C., X. ZHANG, H. YAN and L. ZHENG (2008)An internet traffic forecasting model adopting radi-cal based on function neural network optimized bygenetic algorithm, In Proceedings of IEEEWorkshopon Knowledge Discovery and Data Mining(WKDD08). Adelaide, Australia, pp. 367–370
The authors
Paulo Cortez
Paulo Cortez received anMSc degree (1998) and
a PhD (2002), both in Computer Science, Uni-
versity of Minho, where he works since 2001 as
an Assistant Professor in the Department of
Information Systems. He is also researcher at
the Algoritmi centre, with interests in the fields
of: business intelligence, data mining, neural
networks, evolutionary computation and fore-
casting. Currently, he is associate editor of
the Neural Processing Letters journal and he
participated in seven R&D projects (principal
investigator in two). He is co-author of more
than sixty publications in international peer
reviewed journals and conferences. Web-page:
http://www3.dsi.uminho.pt/pcortez
Miguel Rio
Miguel Rio received the PhD from the Univer-
sity of Kent at Canterbury where he worked on
Multicast distribution with Quality of Service.
He has been the Principal Investigator of several
UK and EU funded research project in areas of
Telecommunications and Future Internet. Cur-
rently, he is Senior Lecturer in the Department
of Electrical and Electronic Engineering, Uni-
versity College London. His research interests
include peer-to-peer real-time delivery, routing,
congestion control, and network traffic analysis.
Web-page: http://www.ee.ucl.ac.uk/�mrio
Miguel Rocha
Miguel Rocha obtained anMSc degree (1998) and
a PhD (2004), both in Computer Science, Uni-
versity of Minho. Since 1998, he is an Assistant
Professor in the Artificial Intelligence group at the
Department of Informatics at the same institu-
tion. His research interests include bioinformatics
and systems biology, evolutionary computation
and neural networks, where he coordinates
funded projects and has a number of refereed
publications in journals and international confer-
ences (see http://www.di.uminho.pt/�mpr).
Pedro Sousa
Pedro Sousa received anMSc degree (1997) and a
PhD (2005), both in Computer Science, Univer-
sity of Minho. In 1996, he joined the Computer
Communications Group of the Department of
Informatics at University of Minho, where he is
an assistant professor and performs his research
activities within the CCTC R&D Center. His
main research interests include computer net-
works technologies and protocols, network simu-
lation, TCP=IP protocols, quality of service,
traffic scheduling and mobile networks. Web-
page: http://marco.uminho.pt/�pns
c� 2010 Blackwell Publishing Ltd Expert Systems 13155c� 2010 Blackwell Publishing Ltd Expert Systems, May 2012, Vol. 29, No. 2