A Review of Network Traffic Analysis and Prediction Techniques
---
paper_title: A time-series decomposed model of network traffic

paper_content:

Traffic behavior in a large-scale network can be viewed as a complicated non-linear system, so it is very difficult to describe the long-term network traffic behavior in a large-scale network. In this paper, according to the non-linear character of network traffic, the time series of network traffic is decomposed into trend component, period component, mutation component and random component by different mathematical tools. So the complicated traffic can be modeled with these four simpler sub-series tools. In order to check the decomposed model, the long-term traffic behavior of the CERNET backbone network is analyzed by means of the decomposed network traffic. The results are compared with ARIMA model. According to autocorrelation function and predicting error function, compounded model can get higher error precision to describe the long-term traffic behavior.
---
paper_title: Research of Applying Information Entropy and Clustering Technique on Network Traffic Analysis

paper_content:

At the present time, most existing network traffic analysis techniques just focus on the traffic volume. But the fact is that most typical network behavior like DoS, port scan and network scan, etc, also induce some feather parameter distribution of network traffic changed usually. In view of this characteristic, this paper proposes a non-supervised analysis technique for network traffic by introducing information entropy and clustering. This analysis technique partitions the unlabeled traffic data into different clusters based on the comparability by analyzing the distribution of some traffic feather parameters. Then it can make sure the network behavior and the host machine that the corresponding behavior happened on by analysis the mode of cluster further.The experimental result indicates that it can help user know the state of network traffic from the parameter distribution and get good effect in distinguishing anomaly by using this technique to analyze network traffic. So it shows that introducing the entropy and clustering can help managers comprehend the changes of traffic state more comprehensive and find out some baleful network behavior.
---
paper_title: Traffic classification using clustering algorithms

paper_content:

Classification of network traffic using port-based or payload-based analysis is becoming increasingly difficult with many peer-to-peer (P2P) applications using dynamic port numbers, masquerading techniques, and encryption to avoid detection. An alternative approach is to classify traffic by exploiting the distinctive characteristics of applications when they communicate on a network. We pursue this latter approach and demonstrate how cluster analysis can be used to effectively identify groups of traffic that are similar using only transport layer statistics. Our work considers two unsupervised clustering algorithms, namely K-Means and DBSCAN, that have previously not been used for network traffic classification. We evaluate these two algorithms and compare them to the previously used AutoClass algorithm, using empirical Internet traces. The experimental results show that both K-Means and DBSCAN work very well and much more quickly then AutoClass. Our results indicate that although DBSCAN has lower accuracy compared to K-Means and AutoClass, DBSCAN produces better clusters.
---
paper_title: Anomalous Network Packet Detection Using Data Stream Mining

paper_content:

In recent years, significant research has been devoted to the development of Intrusion Detection Systems (IDS) able to detect anomalous computer network traffic indicative of malicious activity. While signature-based IDS have proven effective in discovering known attacks, anomaly-based IDS hold the even greater promise of being able to automatically detect previously undocumented threats. Traditional IDS are generally trained in batch mode, and therefore cannot adapt to evolving network data streams in real time. To resolve this limitation, data stream mining techniques can be utilized to create a new type of IDS able to dynamically model a stream of network traffic. In this paper, we present two methods for anomalous network packet detection based on the data stream mining paradigm. The first of these is an adapted version of the DenStream algorithm for stream clustering specifically tailored to evaluate network traffic. In this algorithm, individual packets are treated as points and are flagged as normal or abnormal based on their belonging to either normal or outlier clusters. The second algorithm utilizes a histogram to create a model of the evolving network traffic to which incoming traffic can be compared using Pearson correlation. Both of these algorithms were tested using the first week of data from the DARPA ’99 dataset with Generic HTTP, Shell-code and Polymorphic attacks inserted. We were able to achieve reasonably high detection rates with moderately low false positive percentages for different types of attacks, though detection rates varied between the two algorithms. Overall, the histogram-based detection algorithm achieved slightly superior results, but required more parameters than the clustering-based algorithm. As a result of its fewer parameter requirements, the clustering approach can be more easily generalized to different types of network traffic streams.
---
paper_title: Performance Impact of Wireless Mesh Networks with Mining Traffic Patterns

paper_content:

With mining traffic patterns, we evaluate the performance impact on wireless mesh networks. Genuine traffic traces are collected from the wireless mesh networks testbed, which tends to exhibit long-range dependent behavior under several Hurst index estimators. We analyze traffic traces and use clustering techniques to characterize patterns of individual users' behavior. After extracting traffic data from the raw data logs, we identify session clusters by employing the AutoClass tool and the K-means algorithm. Modeling and simulation were performed using the NS-2 tool. Based on the identified session clusters, we introduce source model based on wavelet. Simulation results indicate that traffic traces, compared to traditional traffic models, predict longer queues and, thus, require larger buffers in the network dimensioning.
---
paper_title: Intrusion Detection Using PCA Based Modular Neural Network

paper_content:

Most of current intrusion detection systems are based on machine learning methods but very few till now use clustering algorithms as a preprocessing layer to reduce the high dimensionality of data, which is difficult to analyze. In this paper we introduce Modular Neural Network for intrusion detection, which apply Principal Component Analysis (PCA) as preprocessing layer for reducing huge information quantity presented in knowledge discovery and data mining (KDD99) data set. PCA significantly reduce the high dimensionality of data set without loss of information. Then this preprocess data in the form of principal component is presented to Batch Backpropagation Neural Network for efficient intrusion detection. We rely on some experiments to calculate Root Mean Square Error (RMSE) using Modular Neural Network on KDD 99 data set. Our experimental results show improvement in the learning time due to the reduction of high dimensions of data. Also we have obtained low RMSE during training, which is below the acceptance range of 0.1. Proposed Modular Neural Network has capability to efficiently and accurately classify data into attack and normal.
---
paper_title: Dynamic Online Traffic Classification Using Data Stream Mining

paper_content:

Recently, traffic classification becomes more and more important for network management and measurement tasks. In this paper, we make a first step towards dynamic online traffic classification using data stream mining method. Two main contributions are as follows. Firstly, we propose a novel integrated dynamic online traffic classification framework, called DSTC (data stream based traffic classification). Secondly, a data stream mining algorithm, called VFDT (very fast decision tree) is implemented in DSTC, which can identify all kinds of traffic, e.g. encrypted traffic and peer-to-peer traffic, with several remarkable advantages: 1) It was designed to handle multiple, continuous, rapid, time-vary, and potential unbounded network traffic; 2) It provides real-time high accuracy traffic classification by using memory efficient method; 3) The underlying training model can adjust incrementally for newly emerging applications; 4) The training phase can go simultaneously with classification phase. The experiment results show that DSTC achieves extremely fast update speed and small memory cost with high accuracy of above 98%.
---
paper_title: A Novel Approach to Intrusion Detection System using Rough Set Theory and Incremental SVM

paper_content:

Intrusion Detection System (IDS) is software and/or hardware designed to detect unwanted attempts at accessing, manipulating, and/or disabling of computer systems, mainly through a network, such as the Internet. These attempts may take the form of attacks, as examples, by crackers, malware and/or disgruntled employees. An IDS cannot directly detect attacks within properly encrypted trafficOn detection of such sign triggers of IDS to report them generate the alerts. These alerts are presented to a human analyst who evaluates them and initiates an adequate response. In Practice, IDSs have been observed to trigger thousands of alerts per day, most of which are mistakenly triggered by begin events such as false positive. This makes it extremely difficult for the analyst to correctly identify alerts related to attack such as a true positive. Recently data mining methods have gained importance in addressing network security issues, including network intrusion detection. Intrusion detection systems aim to identify attacks with a high detection rate and a low false positive. We use RST (Rough Set Theory) and Incremental SVM (Support Vector Machine) to detect intrusions. First, RST is used to preprocess the data and reduce the dimensions. Next, the features were selected by RST will be sent to SVM model to learn and test respectively. The
---
paper_title: Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection

paper_content:

Anomaly detection is a critical issue in Network Intrusion Detection Systems (NIDSs). Most anomaly based NIDSs employ supervised algorithms, whose performances highly depend on attack-free training data. However, this kind of training data is difficult to obtain in real world network environment. Moreover, with changing network environment or services, patterns of normal traffic will be changed. This leads to high false positive rate of supervised NIDSs. Unsupervised outlier detection can overcome the drawbacks of supervised anomaly detection. Therefore, we apply one of the efficient data mining algorithms called random forests algorithm in anomaly based NIDSs. Without attack-free training data, random forests algorithm can detect outliers in datasets of network traffic. In this paper, we discuss our framework of anomaly based network intrusion detection. In the framework, patterns of network services are built by random forests algorithm over traffic data. Intrusions are detected by determining outliers related to the built patterns. We present the modification on the outlier detection algorithm of random forests. We also report our experimental results over the KDD'99 dataset. The results show that the proposed approach is comparable to previously reported unsupervised anomaly detection approaches evaluated over the KDD' 99 dataset.
---
paper_title: Classification of Intrusion Detection Dataset using machine learning Approaches

paper_content:

The paper portrays about a technique for interruption identification that utilizes. IDS is basically perform the approaches for detection of various cyber-attacks and privilege to maintain various decision algorithm and understand knowledge flow model for representation.It is used for finding various attacks to solve the method of various attacks and faults detection on given network. In this paper we will conclude the method of IDS system for classification based method to rectify the dos, probe types attack. The various attacks contribute for making consider through various data set of using knowledge discovery set. So we will conclude in this paper for attacks and prevent them for using machine learning approaches.
---
paper_title: Effective Anomaly based Intrusion Detection using Rough Set Theory and Support Vector Machine

paper_content:

detection system is used to discover illegitimate and unnecessary behavior at accessing or manipulating computer systems. Subsequently, these behaviors are checked as an attack or normal behavior. Intrusion detection systems aim to identify attacks with a high detection rate and a low false positive. Most of the earlier IDs make use of all the features in the packet to analyze and look for well-known intrusive models. Some of these features are unrelated and superfluous. The disadvantage of these methods is degrading the performance of IDs. The proposed Rough Set Support Vector Machine (RSSVM) approach is extensively decreases the computer resources like memory and CPU utilization which are required to identify an attack. The approach uses rough set to find out feature reducts sets. Then reduct sets are sent to SVM to train and test data. The results showed that the proposed approach gives better and robust representation of data.
---
paper_title: Intrusion Detection using Supervised Learning with Feature Set Reduction

paper_content:

Intrusion detection systems intend to recognize attacks with a low false positive rate and high detection rate. Many feature selection methods introduced to eliminate redundant and irrelevant features, because raw features may abbreviate accuracy or robustness of classification. In this paper we are proposing the information gain technique for the selection of the features. A feature with the highest information gain is the criteria for the selection of the features. We reduced the features of the data set than run the algorithm. Result show that drastically decreased in learning time of the algorithm without compromising the accuracy which is desirable for good IDS.We analyse two learning algorithms (NB and BayesNet) for the task of detecting intrusions and compare their relative performances. We comment on the suitability of the BayesNet algorithm for the intrusion detection task based on its high accuracy and high true positive rate. We finally state the usefulness of machine learning to the field of intrusion detection.
---
paper_title: Network Intrusion Detection system based on Feature Selection and Triangle area Support Vector Machine

paper_content:

As the cost of the data processing and Internet accessibility increases, more and more organizations are be- coming vulnerable to a wide range of cyber threats. Most current offline intrusion detection systems are focused on unsupervised and supervised machine learning approaches. Existing model has high error rate during the attack classification using support vector machine learning algorithm. Besides, with the study of existing work, feature selection techniques are also essential to improve high efficiency and effectiveness. Performance of different types of attacks detection should also be improved and evaluated using the proposed approach. In this proposed system, Information Gain (IG) and Triangle Area based KNN are used for selecting more discriminative features by combining Greedy k-means clustering algorithm and SVM classifier to detect Network attacks. This system achieves high accuracy detection rate and less error rate of KDD CUP 1999 training data set.
---
paper_title: Effective Anomaly Intrusion Detection System based on Neural Network with Indicator Variable and Rough set Reduction

paper_content:

Intrusion detection system (IDS) is an important tool for the defense of a network against attacks. It monitors the activities occurring in a computer system or network and analyzes them for recognizing intrusions to protect the computer network. Most of the existing IDSs use all of the 41 features available in the network packet to analyze and look for intrusive pattern, while some of these features are redundant and irrelevant. The weakness of this approach is the time-consuming during detection process and degrading the performance of IDSs. A well-defined feature selection algorithm makes the classification process more effective and efficient. In this paper a new hybrid algorithm NNIV-RS (Neural Network with Indicator Variable using Rough Set for attribute reduction) algorithm is used to reduce the amount of computer resources like memory and CPU time required to detect attack. Rough Set Theory is used to select out feature reducts. Indicator Variable is used to represent dataset in more efficient way. Neural network is used for network traffic packet classification. Tests and comparison were done on NSL-KDD dataset which is the improved version of KDD99 data set. The experiments results showed that the proposed algorithm gives better and robust representation of data as it was able to select features resulting in 80.4% data reduction, select significant attributes from the selected features and achieve detection accuracy about 96.7% with a false alarm rate of 3%.
---
paper_title: Cascading of C4.5 Decision Tree and Support Vector Machine for Rule Based Intrusion Detection System

paper_content:

Main reason for the attack being introduced to the system is because of popularity of the internet. Information security has now become a vital subject. Hence, there is an immediate need to recognize and detect the attacks. Intrusion Detection is defined as a method of diagnosing the attack and the sign of malicious activity in a computer network by evaluating the system continuously. The software that performs such task can be defined as Intrusion Detection Systems (IDS). System developed with the individual algorithms like classification, neural networks, clustering etc. gives good detection rate and less false alarm rate. Recent studies show that the cascading of multiple algorithm yields much better performance than the system developed with the single algorithm. Intrusion detection systems that uses single algorithm, the accuracy and detection rate were not up to mark. Rise in the false alarm rate was also encountered. Cascading of algorithm is performed to solve this problem. This paper represents two hybrid algorithms for developing the intrusion detection system. C4.5 decision tree and Support Vector Machine (SVM) are combined to maximize the accuracy, which is the advantage of C4.5 and diminish the wrong alarm rate which is the advantage of SVM. Results show the increase in the accuracy and detection rate and less false alarm rate.
---
paper_title: Analyze large-scale communication network behavior through mining TCP control segment information

paper_content:

One difficult task when managing large-scale network traffic flows is that the network operators must deal with a very large number of flow records. In this paper, we introduce a new defined TCP flags information analysis method, proportion-based analysis, which is a better way to narrow the analyzable flow records. We compute the percentage of different type of TCP flags among total traffic flows and consider these as multivariate time series over a duration of time. Furthermore, we may obtain frequent pattern of different type of TCP flags using multivariate time series association rule mining method. Experimental results with backbone network (Internet2) data confirmed our method.
---
paper_title: Determining feature set of DOS attacks

paper_content:

Denial of service attacks are large scale co operative attacks on the networking structure. It disables servers/ victims from providing services to its clients. These attacks adversely affect the network badly. Therefore they must be detected on time. IDS using classification plays a significant role in detecting such intrusions but it takes significant classification time due to large number of features. It reduces its efficiency. So in order to improve efficiency or to reduce classification time, researcher provides relevant set of features for detection of DOS attacks. For this purpose, researcher is using NSL KDD dataset and analysis is performed on orange canvas V2.6.1 data mining tool.
---
paper_title: Efficient Classifier for R2L and U2R Attacks

paper_content:

Detection System (IDS) is an effective security tool that helps to prevent unauthorized access to network resources by analysing the network traffic and classifying the records as either normal or anomalous. In this paper, a new classification method using Fisher Linear Discriminant Analysis (FLDA) is proposed. The features of KDD Cup '99 attack dataset are reduced for each class of attacks using correlation based feature selection method. Then with the reduced feature set, discriminant analysis is done for the classification of records. Comparison with other approaches reveals that our approach achieves good classification rate for R2L (Remote-to-Local) and U2R (User-to-Root) attacks.
---
paper_title: A graph-based clustering algorithm for anomaly intrusion detection

paper_content:

Many researchers have argued that data mining can improve the performance of intrusion detection system. So as one of important techniques of data mining, clustering is an important means for intrusion detection. Due to the disadvantages of traditional clustering methods for intrusion detection, this paper presents a graph-based intrusion detection algorithm by using outlier detection method that based on local deviation coefficient (LDCGB). Compared to other intrusion detection algorithm of clustering, this algorithm is unnecessary to initial cluster number. Meanwhile, it is robust in the outlier's affection and able to detect any shape of cluster rather that the circle one only. Moreover, it still has stable rate of detection on unknown or muted attacks. LDCGB uses graph-based cluster algorithm (GB) to get an initial partition of data set which is depended on parameter of cluster precision rather than initial cluster number. On the other hand, because of this intrusion detection model is based on mixed training dataset, so it must have high label accuracy to guarantee its performance. Therefore, in labeling phrase, the algorithm imposes outlier detection algorithm of local deviation coefficient to label the result of GB algorithm again. This measure is able to improve the labeling accuracy. The detection rate and false positive rate are obtained after the algorithm is tested by the KDDCup99 data set. The experimental result shows that the proposed algorithm could get a satisfactory performance.
---
paper_title: Network traffic analysis and prediction based on APM

paper_content:

Traffic prediction is of significant importance for telecommunication network planning and network optimization. Since modeling and forecasting using traditional Box-Jenkins' ARIMA is rather a complex process and time consuming, a novel approach called APM is studied and applied in this paper. APM is especially appropriate for time series exhibiting stable seasonal pattern and can be employed much simpler than ARIMA. Traffic series from a certain mobile network of Heilongjiang province in China is studied. Average daily traffic per month for the province as well as its every sub-region from July to December in 2009 is forecasted by using APM. The mean absolute percentage error (MAPE) for one-step ahead prediction is 2.11%, and MAPE for the 6 steps is smaller than 7%. The prediction result is of high precision and can be comparable with ARIMA.
---
paper_title: Impact of utilizing forecasted network traffic for data transfers

paper_content:

Sharing of information leads to the need to transfer data between geographically distant locations. Identifying the most appropriate time period to execute the data transfer is essential to achieve the best data transfer throughput; e.g. one can forecast network traffic, identify future low network traffic activities between two entities, and plan the data transfer accordingly. This forecasting can be done using Autoregressive Moving Average (ARMA) time series model. In this paper, we conduct an empirical study in a controlled laboratory environment to realise the impact of performing data transfer during the forecasted low network traffic activities. The network information is captured using a network analyzer and post-processed to create stationary data. This data is then passed to ARMA and the forecasting results produced by ARMA is post-processed to derive the forecasted network traffic activities. Comparison is made between the throughputs of the data transfers initiated when the forecasted network traffic is low and when the forecasted network traffic is high.
---
paper_title: Network Traffic Prediction and Result Analysis Based on Seasonal ARIMA and Correlation Coefficient

paper_content:

Traffic prediction is of significant importance for telecommunication network planning and network optimization. In this paper, the traffic series from a certain mobile network in Heilongjiang province in China is studied. The characteristics in respect of both trend and periodicity are explored with autocorrelation function. Based on the characteristics exhibited in the traffic series, multiplicative seasonal autoregressive integrated moving average model (ARIMA) is employed to make traffic series prediction. Average daily traffic per month for the province as well as its every sub-region from July to December in 2009 is forecasted and compared with the actual operation data. The mean absolute percentage error (MAPE) for one-step ahead prediction is 1.382%, and MAPE for the 6 steps is within 6%. The prediction result is of high precision. Furthermore, the cause for the big prediction error in 2 regions is analyzed, and the appropriateness of the model is testified on the opposite aspect. This paper also provides an effective method by using correlation coefficients to analyze the cause for significant prediction errors which do not happen in time series prediction applications rarely.
---
paper_title: Wireless traffic modeling and prediction using seasonal ARIMA models

paper_content:

Seasonal ARIMA model is a good traffic model capable of capturing the behavior of a network traffic stream. In this paper, we give a general expression of seasonal ARIMA models with two periodicities and provide procedures to model and to predict traffic using seasonal ARIMA models. Our feasibility study experiments showed that seasonal ARIMA models could be used to model and predict actual wireless traffic such as GSM traffic in China.
---
paper_title: Internet Traffic Forecasting using Neural Networks

paper_content:

The forecast of Internet traffic is an important issue that has received few attention from the computer networks field. By improving this task, efficient traffic engineering and anomaly detection tools can be created, resulting in economic gains from better resource management. This paper presents a neural network ensemble (NNE) for the prediction of TCP/IP traffic using a time series forecasting (TSF) point of view. Several experiments were devised by considering real-world data from two large Internet Service Providers. In addition, different time scales (e.g. every five minutes and hourly) and forecasting horizons were analyzed. Overall, the NNE approach is competitive when compared with other TSF methods (e.g. Holt-Winters and ARIMA).
---
paper_title: Multiscale analysis and prediction of network traffic

paper_content:

Traffic prediction plays an important role in network management especially for the current networks that do not comply to the Poisson model. Wavelet transform is an emerging technique that has a significant advantage in analyzing time domain signals. When combined with LMS (Least Mean Square), wavelet based predictor can achieve better performance than time domain predictor for self similar traffic which are revealed as the current network traffic. However, the computational complexity in predicting each wavelet coefficient is high. In this paper, first, the Least Mean Kurtosis (LMK) which uses the negated kurtosis of the error signal as the cost function, is proposed to estimate wavelet coefficients; then by analyzing the wavelet coefficients of two consecutive data sets, a fast WLMK is proposed to reduce the computational complexity. Simulation results show that the fast WLMK not only incurs smaller prediction error but also reduces the computational complexity greatly.
---
paper_title: A Time Series Modeling and prediction of wireless Network Traffic

paper_content:

The number of users and their network utilization will enumerate the traffic of the network. The accurate and timely estimation of network traffic is increasingly becoming important in achieving guaranteed Quality of Service (QoS) in a wireless network. The better QoS can be maintained in the network by admission control, inter or intra network handovers by knowing the network traffic in advance. Here wireless network traffic is modeled as a nonlinear and nonstationary time series. In this framework, network traffic is predicted using neural network and statistical methods. The results of both the methods are compared on different time scales or time granularity. The Neural Network(NN) architectures used in this study are Recurrent Radial Basis Function Network (RRBFN) and Echo state network (ESN).The statistical model used here in this work is Fractional Auto Regressive Integrated Moving Average (FARIMA) model. The traffic prediction accuracy of neural network and statistical models are in the range of 96.4% to 98.3% and 78.5% to 80.2% respectively.
---
paper_title: Network Traffic Prediction Using ARIMA and Neural Networks Models

paper_content:

Network traffic exhibits degree of selfsimilarity at large time scale and high degree of multifractal at small time scale. Network performance is a vital to business for bringing a product to the consumers. With the growing number of network users, more acute is maintenance and reliability of these networks. The predictability of network traffic is of significant interest in many domains, including adaptive applications [1], congestion control [2], admission control [3], wireless and network management [4]. An accurate traffic prediction model should have the ability to capture the prominent traffic characteristics, e.g. short and long dependence, self similarity in largetime scale and multifractal in smalltime scale. For these reasons time series models are introduced in network traffic simulation and prediction. The today’s network has a great number of applications (not just voice conversation), each with its own traffic characteristics, and new applications can arise at any time. There are many more varieties of network connectivity, architecture, and equipment, and, accordingly, a different type of traffic flows. There are no standard network topologies around which all design efforts can be based, and the topologies that exist are subject to constant change [5]. These all factors complicate the accuracy of traffic modelling and prediction. There has been a large work focused on developing prediction models for computer data networks. The most popular model for prediction is used autoregressive integrated moving average – ARIMA (also fractional ARIMA), but this model often fails to perform correct prediction [6], [7]. The Auto Regressive Integrated Moving Average (ARIMA) with Generalized Auto Regressive Conditional Heteroscedasticity (GARCH) model is a nonlinear time series model which combined the linear ARIMA with conditional variance GARCH. ARIMA/GARCH model provides flexibility when it is applied to model the network traffic [8], [9]. Neural networks also provide reliable prediction, but it depends on traffic characteristics [10], [11], [12]. The major open question is to understand the accuracy of made prediction using Internet traffic in different time scales and what are the benefits of imposed prediction models.
---
paper_title: Prediction of Network Flow Based on Wavelet Analysis and ARIMA Model

paper_content:

Internet traffic analysis, models simulation and prediction play a very important part in the network management and design.Combining wavelet techniques and time-series ARIMA model, the establishment of a network traffic prediction model in this paper. First, time series of wavelet decomposition of flow to gets detail coefficients and approximation coefficients, On the details coefficients, applying the stationary series model, on the approximation coefficients ,applying difference method, then using the stationary series ARIMA model to predict. At last,applying the actual network traffic to verify the model, The results show that the model has higher prediction accuracy.
---
paper_title: Power and performance analysis of network traffic prediction techniques

paper_content:

We study power and performance characteristics of different traffic predictors for online one-step-ahead predictions. The goal is to identify a predictor with reasonable accuracy and low power consumption. Our experiments on a large number of real network traces indicate that Double Exponential Smoothing and Auto-Regressive Moving Average are low cost predictors with reasonable accuracy.
---
paper_title: Some Aspects of Traffic Analysis used for Internet Traffic Prediction

paper_content:

It is very important for the resource distribution and control to predict the network traffic’s future varying trend. Via the effectively observed value of some time series in time t, we can predict its future value in time t+τ , and thus build the optimized foundation for the resource distribution and control. Traditionally, autoregressive moving average (ARMA) model has been used for network traffic prediction, which has difficulties in setting up its parameter values and dealing with non-linear time series. Another complexity is related with self-similar nature of network traffic makes high accurate prediction difficult. The parameter fitting procedure is time consuming. The goal is to forecast future traffic variations as precisely as possible, based on the measured traffic history.
---
paper_title: Short Term Traffic Flow Prediction Using Hybrid ARIMA and ANN Models

paper_content:

According to the complexity of the traffic historical data and the randomness of a lot of uncertain factors influence, a hybrid predicting model that combines both autoregressive integrated moving average (ARIMA) and multilayer artificial neural network (MLANN) is proposed in this paper. ARIMA is suitable for linear prediction and MLFNN is suitable for nonlinear prediction. This paper also investigates the issue on how to effectively model short term traffic flow time series with a new algorithm, which estimates the weights of the MLFNN and the parameters of ARMA model. Experimental results with real data sets indicate that the combined model can be an effective way to improve forecasting accuracy achieved by either of the models used separately.
---

Title: A Review of Network Traffic Analysis and Prediction Techniques
Section 1: Introduction
Description 1: Provide an overview including the importance of network traffic analysis and prediction, categories of predictions, and their benefits.

Section 2: Data sets
Description 2: Discuss the standard datasets used for network traffic analysis and prediction, highlighting several important ones like DARPA, NSL-KDD, and ISCX data sets.

Section 3: Preprocessing techniques
Description 3: Detail the preprocessing techniques necessary to handle real-world data for network traffic analysis, including discretization and feature selection methods.

Section 4: Data mining
Description 4: Present various data mining techniques used for network traffic analysis, categorized into clustering, classification, hybrid models, and association rules techniques.

Section 5: Evaluation metrics
Description 5: Explain the different metrics used to evaluate the performance of data mining techniques and traffic prediction models.

Section 6: Linear time Series technique
Description 6: Introduce linear time series models such as AutoRegressive Moving Average (ARMA) and AutoRegressive Integrated Moving Average (ARIMA) used for predicting network traffic.

Section 7: Nonlinear time series techniques
Description 7: Describe the nonlinear time series models including GARCH, neural network techniques, and other approaches used for network traffic prediction.

Section 8: Hybrid model techniques
Description 8: Discuss hybrid models that combine linear and nonlinear approaches for more accurate network traffic prediction.

Section 9: Decomposed model
Description 9: Explain the decomposed model approach for network traffic prediction, including its components and comparative effectiveness with other models.