Computer Science Department Technical Report NWU - CS - 02 - 11 January 12 , 2003 Network Traffic Analysis , Classification , and Prediction

This paper describes a detailed study of aggregated network traffic using time series analysis techniques. The study is based on three sets of packet traces: 175 short-period WAN traces from the NLANR PMA archive (NLANR), 34 long-period WAN traces from NLANR archive (AUCKLAND), and the four Bellcore LAN and WAN traces (BC). We binned the packets with different bin sizes to produce a set of time series estimating the consumed bandwidth. We studied these series using the following time series techniques: summary statistics, time series structure, the autocorrelation function, the histogram, and the power spectral density. Using a qualitative approach, we developed a classification scheme for the traces using the results of our analyses. We believe that this classification scheme will be helpful for others studying these freely available traces. We studied the predictability of the traces by choosing representatives of the different classes and then applying a wide variety of linear time series models to them. We found considerable variation in predictability. Some network traffic is essentially white noise while other traffic can be predicted with considerable accuracy. The choice of predictive model is also relatively context-dependent, although autoregressive models tend to do well. Predictability is also affected by the bin size used. As might be expected, it is often the case that predictability increases as bin size grows. However, we also found that in many cases there is a “sweet spot”, a degree of aggregation at which predictability is maximized.