CN103546335A - Method and device for predicting network traffic - Google Patents

Abstract

The invention relates to a method and a device for predicting network traffic, and belongs to the technical field of network communication. The method includes reading original network traffic data; computing moving average values of the network traffic by the aid of the network traffic data according to a given number of computing cycles; computing first-order difference values of the network traffic by the aid of the moving average values of the original network traffic data; computing second-order difference values of the moving average values according to the first-order difference values of the moving average values; predicting peak values of the network traffic in advance according to peak value occurrence conditions of first-order difference value curves and second-order difference value curves. The method and the device have the advantages that the problem of lagging of the traditional moving average method for predicting network traffic can be solved, the peak values of the network traffic can be predicted in advance, accordingly, a reliable basis for scientific decision making and scientific planning can be provided for optimally configuring network bandwidths and balancing the traffic in advance, and future uncertainty of the network traffic can be effectively controlled in advance.

Description

A kind of Forecasting Methodology of network traffics and device thereof

Technical field

The Forecasting Methodology and the device thereof that the present invention relates to a kind of network traffics, belong to network communications technology field.

Background technology

Along with the fast development of the business such as cloud computing, Internet of Things, Internet video, network size constantly expands, and network traffics rapid growth usually causes network to occur choking phenomenon, affects carrying out of network regular traffic.In order to improve network service quality, need to the flow of network be monitored in real time and be predicted, in time the network bandwidth is optimized to configuration, and balancing flow reasonably, effectively improve the speed of service and the utilance of network.The variation of network traffics is subject to the combined influence of many factors, the features such as its variation has periodically, non-linear and randomness, efficiency and performance that the accuracy of network traffics peak value prediction and real-time are directly connected to NTM network traffic management.

Traditional predicting network flow adopts method of moving average method, by means of statistical analysis technique, flow measuring data in regular period is in addition average, and mean value in the same time is not coupled together, form Moving Average, according to the direction of motion of Moving Average, carry out the direction of motion of predict future flow.Because the low-frequency filter characteristics of the method for moving average can be eliminated short-term fluctuation and the random disturbances impact in network traffics measurement data, what make that Moving Average becomes compared with primitive network flow curve is level and smooth, so Moving Average can show and movement tendency and the direction of tracking network flow.When Moving Average moves up, represent the ascendant trend that is changed to of future network flow; When Moving Average moves down, represent the downward trend that is changed to of future network flow.

According to the difference to original data processing method, the method for moving average can be divided into the rolling average that counts, weighted moving average and three kinds of methods of exponential smoothing rolling average.Often use in actual applications the method for moving average that counts, its computing formula is:

$\mathrm{MA}\left(t\right)=\frac{1}{N}\underset{i=1}{\overset{N}{\mathrm{\Σ}}}P(t-i+1)---\left(1\right)$

In formula (1): the moving average that MA (t) is the t phase, the network traffics measurement data that P (t-i+1) is the t-i+1 phase, ordinal number when t is, the computing cycle number that N is moving average.

The sensitivity that the method for moving average changes network traffics depends on that computing cycle counts the size of N.When N hour, the sensitive of moving average MA (t) to network traffics P (t), the ability of tracking network flow is stronger, but is easily subject to the impact of short-term fluctuation and random disturbances, antijamming capability declines, and has reduced the accuracy of prediction.When if N is larger, although can effectively remove the impact of short-term fluctuation and random disturbances, there is stronger antijamming capability, but moving average MA (t) the relatively variation of network traffics P (t) seriously lags behind, its time hysteresis is (N-1)/2, cannot make a response in time to the variation of network traffics.

The method of moving average when the predicting network flow, when computing cycle is counted N when larger, the fluctuation that moving average MA (t) can not reaction network flow P (t), although antijamming capability is stronger, sensitivity is very low; When N hour, although sensitivity is higher, antijamming capability is very low, is easily subject to having a strong impact on of short-term fluctuation and random disturbances.

Summary of the invention

The object of the invention is to propose a kind of Forecasting Methodology and device thereof of network traffics, to overcome the deficiency of existing network volume forecasting technology, adopt the network flow prediction method of moving average, use larger computing cycle number, not only remove the impact of network traffics short-term fluctuation and random disturbances, and can also solve the serious hysteresis problem that traditional method of moving average produces, when increasing substantially antijamming capability, also increase substantially prediction sensitivity.

The network flow prediction method that the present invention proposes, comprises the following steps:

(1) from the network flow data of storage, read the network traffics P (t) before current time, t is sampling instant;

(2) set the computing cycle N of a moving average, the span of N is 5～250, the moving average MA (t) of computing network flow P (t):

$\mathrm{MA}\left(t\right)=\frac{1}{N}\underset{i=1}{\overset{N}{\mathrm{\Σ}}}P(t-i+1)$

Wherein, i is a sampling number in computing cycle N, and P (t-i+1) is t-i+1 network traffics constantly;

(3) according to the moving average MA of above-mentioned network traffics (t), the first difference score value V (t) of moving average calculation MA (t):

V(t)=MA(t)-MA(t-1)

Wherein MA (t-1) is (t-1) network traffics moving average constantly;

(4) according to above-mentioned first difference score value V (t), the second difference score value A (t) of moving average calculation:

A(t)=V(t)-V(t-1)

Wherein V (t-1) is (t-1) first difference score value constantly;

(5) according to the curve of the curve of above-mentioned first difference score value V (t) and second difference score value A (t), carry out predicting network flow, if there is peak value in second difference score value A (t) curve, predict that network traffics occur that at second difference score value A (t) curve peak value appears in 1/2 week later after date of the peak value moment again, if peak value appears in the curve of first difference score value V (t), predict that network traffics occur that at the curve of first difference score value V (t) peak value appears in 1/4 week later after date of the peak value moment again.

The predicting network flow device that the present invention proposes, comprising: water flow collection device and monitoring server; Wherein:

Described water flow collection device is placed in network tandem node place, for the data on flows of collecting the local router, switch and the server that are connected with water flow collection device, the data on flows of collecting is processed, and result is sent to monitoring server by the Internet;

Described monitoring server is placed in network management center, for receive the data on flows of water flow collection device by the Internet, the data on flows receiving is processed, and according to result, network traffics is predicted;

Described water flow collection device is connected with the Internet respectively with monitoring server.

Network flow prediction method and device thereof that the present invention proposes, its feature and advantage are, network flow prediction method of the present invention, utilized the low-frequency filter characteristics of the method for moving average, effectively remove random disturbances in original time series and the impact of short-term fluctuation, extracted the low-frequency fluctuation component (moving average) in network traffics, next is movement velocity (first difference score value) and the acceleration (second difference score value) of having obtained low-frequency fluctuation component, owing to having utilized speed and the acceleration of simple harmonic motion, in phase place, distinguish the characteristic of leading displacement pi/2 (1/4th cycles) and π (1/2nd cycles), not only solved the hysteresis problem of the method for moving average in predicting network flow, and can carry out advanced prediction to network traffics peak value, for the network bandwidth, distribute rationally with science decision and the science plan of flow equalization reliable basis is provided, and be conducive in advance the uncertainty in network traffics futures to control effectively.

Accompanying drawing explanation

Fig. 1 is the FB(flow block) of the network flow prediction method that proposes of the present invention.

Fig. 2 is the structural representation of the predicting network flow device that proposes of the present invention.

Fig. 3 is the computer simulation experiment result curve of one embodiment of the invention.

In Fig. 3, the 1st, be that the network traffics of 24 hours are measured curve period of waves, the 3rd, computing cycle is the network traffics moving average curve of 6 hours, the 2nd, the first difference score value curve of moving average curve 3, the 4th, the second difference score value curve of moving average curve 3.

Embodiment

The network flow prediction method that the present invention proposes, its FB(flow block) as shown in Figure 1, comprises the following steps:

(1) from the network flow data of storage, read the network traffics P (t) before current time, t is sampling instant;

(2) set the computing cycle N of a moving average, the span of N is 5～250, the moving average MA (t) of computing network flow P (t):

$\mathrm{MA}\left(t\right)=\frac{1}{N}\underset{i=1}{\overset{N}{\mathrm{\Σ}}}P(t-i+1)$

Wherein, i is a sampling number in computing cycle N, and P (t-i+1) is t-i+1 network traffics constantly;

(3) according to the moving average MA of above-mentioned network traffics (t), the first difference score value V (t) of moving average calculation MA (t):

V(t)=MA(t)-MA(t-1)

Wherein MA (t-1) is (t-1) network traffics moving average constantly;

(4) according to above-mentioned first difference score value V (t), the second difference score value A (t) of moving average calculation:

A(t)=V(t)-V(t-1)

Wherein V (t-1) is (t-1) first difference score value constantly;

(5) according to the curve of the curve of above-mentioned first difference score value V (t) and second difference score value A (t), carry out predicting network flow, if there is peak value in second difference score value A (t) curve, predict that network traffics occur that at second difference score value A (t) curve peak value appears in 1/2 week later after date of the peak value moment again, if peak value appears in the curve of first difference score value V (t), predict that network traffics occur that at the curve of first difference score value V (t) peak value appears in 1/4 week later after date of the peak value moment again.

The prediction principle of network traffics of the present invention is:

Theoretical according to the Fourier in signal analysis technology, any time dependent sophisticated signal, all can be decomposed into several simple harmonic motions.And simple harmonic motion has following kinematics character: the speed of (1) simple harmonic motion, acceleration are also simple harmonic motions, and there is identical frequency with simple harmonic motion displacement; (2) speed of simple harmonic motion is compared with the leading pi/2 of the phase place of displacement (1/4th cycles), and acceleration is compared with the leading π of displacement phase (1/2nd cycles).Therefore in engineering practice, can utilize the speed of simple harmonic motion and the displacement that acceleration measurement is come advanced prediction or control simple harmonic motion.

The predicting network flow device that the present invention proposes, its structural representation as shown in Figure 2, comprising: water flow collection device and monitoring server; Wherein:

Described water flow collection device is placed in network tandem node place, for the data on flows of collecting the local router, switch and the server that are connected with water flow collection device, the data on flows of collecting is processed, and result is sent to monitoring server by the Internet;

Described monitoring server is placed in network management center, for receive the data on flows of water flow collection device by the Internet, the data on flows receiving is processed, according to result, network traffics are predicted, according to predicting the outcome, the network bandwidth is optimized to configuration, reasonably balancing flow;

Described water flow collection device is connected with the Internet respectively with monitoring server.

The predicting network flow device that the present invention proposes, adopts the deployment way of managing distribution collection concentratedly, and water flow collection device is wherein connected with the Internet respectively with monitoring server.Water flow collection device adopts IBM System x3650M4 rack-mount server (CPU:Xeon E5-2650, internal memory 8GB), and monitoring server adopts IBM System x3850X5 rack-mount server (CPU:Xeon E5-7520, internal memory 16GB).Water flow collection device is placed on network tandem node place, by SNMP(Simple Network Management Protocol) Simple Network Management Protocol collects the data on flows of local router, switch and server, and to the data on flows of the collecting analyzing and processing that gives a forecast, then analysis result is sent to monitoring server by the Internet.Monitoring server is placed on network management center, by SNMP(Simple Network Management Protocol) Simple Network Management Protocol collects the data on flows of backbone network router, switch and server, and to the data on flows of the collecting analyzing and processing that gives a forecast, finally, the data of all water flow collection devices are unified gather, processing and association analysis, keeper can understand all data results by a unified WEB interface, the network bandwidth is optimized to configuration, and balancing flow reasonably.

Below in conjunction with accompanying drawing, introduce in detail content of the present invention:

As shown in Figure 1, first read primitive network data on flows storage.The method of storage can be same as the prior art, stores in function P (t).Also can adopt alternate manner storage, as long as can be by each network flow data value and time corresponding stored constantly.Read all data of primitive network flow, calculate the moving average at each data place, can calculate the N phase moving average MA (t) that counts by formula (1).The value principle of N is: if heavy recent data should be got less; If heavy data at a specified future date, should get greatly, its scope is generally 5～250.Moving average also can adopt index moving average.With the moving average MA (t) that counts, calculate its backward difference, obtain the first difference V (t) of MA (t), computing formula is:

V(t)=MA(t)-MA(t-1)

First difference V (t) with MA (t), calculates its backward difference, obtains the second order difference A (t) of MA (t), and computing formula is:

A(t)=V(t)-V(t-1) （2）

Primitive network flow P (t) curve, the moving average that counts MA (t) curve, first difference V (t) curve and time difference A (t) curve are simultaneously displayed on computer screen, according to the appearance situation of first difference V (t) curve and second order difference A (t) peak of curve, the appearance of look-ahead network traffics peak value.

In this step, when V (t) is greater than zero, if when first difference V (t) curve moves upward, indication network traffics P (t) curve will speed up up; When if first difference V (t) curve turns around to move downward, indication network traffics P (t) curve will slow down up; When V (t) goes to zero, indication network traffics P (t) curve will reach maximum.

In this step, when A (t) is greater than zero, if when second order difference A (t) curve moves upward, indication first difference V (t) curve will speed up up; When if secondary time difference A (t) curve turns around to move downward, indication first difference V (t) curve will slow down up; When A (t) goes to zero, indication first difference V (t) curve will reach maximum.

Below introduce an embodiment of network flow prediction method of the present invention:

First utilize the low-frequency filter characteristics of the method for moving average, effectively remove the random disturbances impact in network traffics, obtain the low frequency component data of network traffics, next is to utilize the speed of simple harmonic motion and acceleration in phase place, to distinguish the principle of leading displacement pi/2 (1/4th cycles) and π (1/2nd cycles), successively calculate first difference (speed) value and second order difference (acceleration) value of low frequency component data, then utilize the variation of first difference (speed) curve and second order difference (acceleration) curve, just can carry out advanced prediction to the future trends of network traffics.

Fig. 3 is the computer simulation experiment result curve of one embodiment of the invention.1 is analog network data on flows curve (24 hours cycles), and it is that the rolling average that counts of 6 hours is processed that analog network data on flows is carried out to computing cycle, to its normalized, obtains Moving Average 3; The first difference of calculating Moving Average 3, is normalized it, obtains first difference curve 2; The second order difference of calculating Moving Average 3, is normalized it, obtains second order difference curve 4; As can be seen from Figure 3, Moving Average 3 was compared with network traffics curve 1 time delay 3 hours, one difference curves 2 are compared with leading 6 hours (1/4th cycles of primitive network flow) of Moving Average 3, second order difference curve 4 is compared with leading 12 hours (1/2nd cycles of original time series) of Moving Average 3, therefore, first difference curve 2 and two difference curves 4 are leading 3 hours and 9 hours compared with network traffics curve 1 respectively.Computer simulation experiment result shows, can utilize 4 pairs of network traffics curves of first difference curve 2 and second order difference curve 1 to carry out advanced prediction.

From the above embodiments, this network flow prediction method of the present invention, owing to first having utilized the low-frequency filter characteristics of the method for moving average, effectively removed the random disturbances impact in network traffics, extracted the low frequency component (moving average) of reflection network traffics movement tendencies, then calculate movement velocity (first difference of moving average) and the acceleration (second order difference of moving average) of network traffics low frequency component, utilize speed and the acceleration of simple harmonic motion in phase place, to distinguish the principle of leading displacement pi/2 (1/4th cycles) and π (1/2nd cycles), be movement velocity and the acceleration displacement of lead network flow in time of network traffics, therefore, solved the hysteresis problem of the method for moving average in predicting network flow, can utilize again the leading characteristic of network traffics movement velocity and acceleration, network traffics peak value is carried out to look-ahead.

Claims (2)

1. a network flow prediction method, is characterized in that, the method comprises the following steps:

(1) from the network flow data of storage, read the network traffics P (t) before current time, t is sampling instant;

(2) set the computing cycle N of a moving average, the span of N is 5～250, the moving average MA (t) of computing network flow P (t):

$\mathrm{MA}\left(t\right)=\frac{1}{N}\underset{i=1}{\overset{N}{\mathrm{\Σ}}}P(t-i+1)$

Wherein, i is a sampling number in computing cycle N, and P (t-i+1) is t-i+1 network traffics constantly;

(3) according to the moving average MA of above-mentioned network traffics (t), the first difference score value V (t) of moving average calculation MA (t):

V(t)=MA(t)-MA(t-1)

Wherein MA (t-1) is (t-1) network traffics moving average constantly;

(4) according to above-mentioned first difference score value V (t), the second difference score value A (t) of moving average calculation:

A(t)=V(t)-V(t-1)

Wherein V (t-1) is (t-1) first difference score value constantly;

(5) according to the curve of the curve of above-mentioned first difference score value V (t) and second difference score value A (t), carry out predicting network flow, if peak value appears in second difference score value A (t) curve, predict that network traffics occur that at second difference score value A (t) curve peak value appears in 1/2 week later after date of the peak value moment again; If peak value appears in the curve of first difference score value V (t), predict that network traffics occur that at the curve of first difference score value V (t) peak value appears in 1/4 week later after date of the peak value moment again; When if the curve of first difference score value V (t) goes to zero from peak value, represent that network traffics have reached peak value.

2. a predicting network flow device, is characterized in that, this prediction unit comprises: water flow collection device and monitoring server; Wherein:

Described water flow collection device is placed in network tandem node place, for the data on flows of collecting the local router, switch and the server that are connected with water flow collection device, the data on flows of collecting is processed, and result is sent to monitoring server by the Internet;

Described monitoring server is placed in network management center, for receive the data on flows of water flow collection device by the Internet, the data on flows receiving is processed, and according to result, network traffics is predicted;

Described water flow collection device is connected with the Internet respectively with monitoring server.

Images