CN109802862B - Combined network flow prediction method based on ensemble empirical mode decomposition - Google Patents

Abstract

The invention belongs to the technical field of network traffic prediction, and in particular relates to a combined network traffic prediction method based on ensemble empirical modal decomposition, comprising: acquiring original traffic data and preprocessing; decomposing network traffic into different IMF components with a single frequency on the time scale; determine the stationarity of the IMF components through autocorrelation and partial autocorrelation analysis; use the linear ARMA model to predict the stationary IMF components; use the nonlinear Elman neural network for the non-stationary IMF components Network prediction; the predicted value of each IMF component is summed to obtain the predicted value of network traffic; the present invention describes and predicts actual network traffic more accurately and comprehensively, thereby improving prediction accuracy and increasing prediction reliability.

Description

A Combined Network Traffic Prediction Method Based on Ensemble Empirical Mode Decomposition

technical field

The invention belongs to the technical field of network traffic prediction, in particular to a combined network traffic prediction method based on ensemble empirical mode decomposition (Empirical Mode Decomposition, EMD).

Background technique

In recent years, with the rapid development of the Internet industry, the scale of the network has become increasingly large, the network structure has become increasingly complex, and network management is facing enormous challenges. It is an important subject for network management workers to improve network operation efficiency through efficient network management mechanism.

In the face of increasingly complex network interconnection environment and increasing network traffic, researchers and scholars need to use more resources and time to monitor and analyze the situation of these network traffic to deal with the sudden situation of network congestion and congestion, to ensure good network quality. Traditional network management adopts a reactive approach, that is, to solve the problem after an alarm occurs. At this time, the network service has been affected. When an alarm is received, there is often no time to take corresponding corrective measures. Network traffic prediction is to establish a network traffic prediction model based on the collected actual network traffic observation value sequence, to predict the future traffic data, and to judge the possibility and occurrence time of exceeding the threshold in the future. Managers can pay special attention during key periods and take preventive measures before the network is overloaded, so as to effectively ensure the stability of network performance and achieve the purpose of continuously serving network users.

In view of the short correlation characteristics of traditional network traffic, some linear prediction models are proposed, such as autoregressive model (AR), moving average model (MA), autoregressive moving average model (ARMA), etc., and the earlier Poisson ( Poisson model and Markov model are similar and can only predict stationary processes. With the development of the Internet, network traffic is increasingly showing nonlinear and non-stationary characteristics. Linear prediction models have many limitations, so many nonlinear prediction models have been proposed. Neural networks, support vector machines, etc., their models are complex The degree and computational complexity are relatively large.

After in-depth research on the characteristics of network traffic, it is found that the actual network traffic has obvious nonlinearity, self-similarity, long correlation, multi-fractality, burstiness and other characteristics in a long time. In the past, a single prediction model could not fully take into account these characteristics of network traffic, so as to accurately and comprehensively describe the real characteristics of network traffic, so the model will inevitably generate large errors in prediction. At present, most of the research on combined prediction model is based on wavelet decomposition, and then different prediction models are used to predict the decomposed branch sequence. However, the wavelet transform has the problem that it is difficult to determine the number of decomposition layers and the wavelet base, and it depends on the specific signal characteristics and application fields, and has no self-adaptability.

SUMMARY OF THE INVENTION

In order to describe and predict actual network traffic more accurately and comprehensively, the present invention proposes a combined network traffic prediction method based on ensemble empirical mode decomposition, including:

S1: Obtain raw traffic data and preprocess;

S2: Decompose network traffic into a finite number of intrinsic mode function (IMF) components with a single frequency on different time scales through ensemble empirical mode decomposition;

S3: Perform autocorrelation and partial autocorrelation analysis on the IMF components to determine the stationarity of the IMF components;

S4: Use the linear ARMA model to predict the stationary IMF component;

S5: Use nonlinear Elman neural network to predict non-stationary IMF components;

S6: The predicted value of each IMF component is summed to obtain the predicted value of the network traffic.

Further, the decomposing the network traffic into a finite number of eigenmode function IMF components with a single frequency on different time scales by the collective empirical mode decomposition includes:

S21: set i=1, and select N kinds of white noise signals;

S22: adding the i-th white noise signal to the original signal to form a signal-noise mixture;

S23: Perform empirical mode decomposition on the signal-noise mixture, and decompose it into a combination of IMFs;

S24: Determine whether i is greater than N, and if it is greater, average all the obtained IMFs, otherwise set i=i+1 and return to step S22.

Further, the empirical mode decomposition of the signal-to-noise mixture includes:

S221: Find all local maxima and local minima of the signal x(t);

S222: Obtain the upper envelope emax(t) and lower envelope emin(t) of the signal x(t) through extreme value fitting;

S223: Calculate the local mean value m(t), expressed as: m(t)=(emin(t)+emax(t))/2;

S224: subtract the local mean from the original input signal to obtain the oscillation signal h(t), which is expressed as: h(t)=x(t)−m(t);

S225: When h(t) satisfies the conditions of IMF, let c ₁ =h(t), then c ₁ is the first IMF, and the corresponding margin r ₁ =x(t)-c ₁ ; otherwise, use h (t) replace x(t) and go to step S221;

S226: when r ₁ still contains the frequency information in the original data, replace r ₁ with x(t) and go to step S221 to obtain the second IMF component, and so on, to obtain r ₁ -c ₂ =r ₂ , ..., rn _{-1 -cn} = rn ; when cn or _{rn is less} than the set value, or when rn _becomes a monotone function, the sieving process _is stopped.

Further, the establishment process of the ARMA model includes:

S41: Determine the autoregressive order p and moving average order q of the ARMA model by using the tailing of the autocorrelation function and the partial autocorrelation function;

S42: Use the least squares estimation method to estimate the unknown parameters of the ARMA model, and the unknown parameters include autoregressive coefficients, moving average coefficients and white noise variance;

S43: Use the Akaike information criterion (AIC) to perform model testing on different p, q parameter combinations, and obtain the optimal p, q parameter combination;

S44: Establish an ARMA model according to the autoregressive coefficient, the moving average coefficient and the white noise variance.

Further, the training process of the Elman neural network model includes:

S51: Select the appropriate number of neurons in each layer, initialize the parameters of the network structure, initialize the connection weight and error index ε, and the maximum number of learning times D, let d=1;

S52: Calculate the output of each neuron in the hidden layer, the successor layer, and the output layer;

S53: Correct the connection weights between the layers according to the error between the predicted value of the component sequence and the real value;

S54: Calculate the error square sum function E, and judge whether E<ε, if so, output and store the connection weights between the layers, otherwise go to S55;

S55: Determine whether d>D, if yes, output and store the connection weights between the layers, otherwise set d=d+1 and return to step S52.

The invention first aims at the problem that the number of decomposition layers and wavelet bases are difficult to select in wavelet transform, and introduces collective empirical mode decomposition to adaptively decompose the network traffic into a sequence with a single frequency, and at the same time solve the possible modal aliasing in the empirical mode decomposition. Secondly, the different characteristics of each IMF component after decomposition are deeply analyzed, and the stationarity of each IMF component is judged; then, the linear ARMA model is used to predict the stationary IMF component, and the nonlinear Elman neural network is used for the non-stationary IMF component. network prediction; finally, the prediction values of each component sequence are added up to obtain the final prediction value; all in all, the present invention fully utilizes the advantages of two different models, ARMA model and Elman neural network, to describe and predict actual network traffic more accurately and comprehensively. , thereby improving forecast accuracy and increasing forecast reliability.

Description of drawings

Fig. 1 is the overall flow chart of the present invention;

Fig. 2 is the ARMA model flow chart of the present invention;

Fig. 3 is the Elman neural network model diagram of the present invention;

FIG. 4 is a flow chart of the training process of the Elman neural network model of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The present invention provides a combined network traffic prediction method based on ensemble empirical modal decomposition, as shown in Figure 1, including:

S1: Obtain raw traffic data and preprocess;

S2: Decompose network traffic into IMF components with a single frequency on different time scales through ensemble empirical mode decomposition;

S3: Determine the stationarity of the IMF component through autocorrelation and partial autocorrelation analysis;

S4: Use the linear ARMA model to predict the stationary IMF component;

S5: Use nonlinear Elman neural network to predict non-stationary IMF components;

S6: The predicted value of each IMF component is summed to obtain the predicted value of the network traffic.

In this embodiment, the preprocessing includes normalizing the traffic data time series x(t), so that the data range is between 0 and 1. The normalization is specifically:

Among them, x' is the normalized network traffic value, x is the actual predicted value of the network traffic; x _max represents the maximum value of the network traffic, and x _min represents the minimum value of the network traffic.

S21: adding a white noise signal to the original signal to form a signal-noise mixture;

S22: Perform empirical mode decomposition on the signal-to-noise mixture, and decompose it into a combination of IMFs;

S23: Repeat step S21 and step S22, add different white noise each time, and decompose into IMF;

S24: Repeat N times, and average each IMF.

The network traffic is decomposed into IMF components with a single frequency on different time scales through ensemble empirical mode decomposition. The specific process includes:

S221: Find all local maxima and local minima of the signal x(t);

S222: Obtain the upper envelope emax(t) and lower envelope emin(t) of the corresponding signal through extreme value fitting;

S223: Calculate the local mean value m(t), expressed as: m(t)=(emin(t)+emax(t))/2;

S224: subtract the local mean from the original input signal to obtain the oscillation signal h(t), which is expressed as: h(t)=x(t)−m(t);

S225: When h(t) satisfies the conditions of IMF, let c ₁ =h(t), then c ₁ is the first IMF, and the corresponding margin r ₁ =x(t)-c ₁ ; otherwise, use h (t) replace x(t) and go to step S221;

S226: When r ₁ still contains the frequency information in the original data, replace r ₁ with x(t) and go to step S221 to obtain the second IMF component, and so on, to obtain r ₁ -c ₂ =r ₂ , ..., rn _{-1 -cn} = rn ; when cn or _{rn is less} than the set value, or rn _becomes a monotonic function, the sieving process _is stopped; the range of the set value is 0.2 ~0.3.

IMF conditions include:

1) In the entire data set, the number of extreme points and the number of zero points must be equal or at most one difference;

2) At any point in time, the mean value of the envelope defined by the local maxima and local minima is zero.

Autocorrelation and partial autocorrelation analyses include:

When analyzing the autocorrelation and partial autocorrelation of IMF components, it is necessary to calculate the autocorrelation function (ACF) and partial autocorrelation function (PACF) of each component sequence. The formulas are as follows:

in:

Among them, ρ _k is the autocorrelation function at time k; α _k,j is the partial autocorrelation function at time k; γ _k is the autocovariance at time k; y _k represents the network traffic at time k, and y _t+k represents t Network traffic at time +k, N is the length of the sequence.

The linear ARMA model is used to predict the stationary IMF components. The establishment process of the ARMA model, as shown in Figure 2, includes:

S41: Preliminarily determine the autoregressive order p and moving average order q of the ARMA model by using the tailing of the autocorrelation function and the partial autocorrelation function;

S42: Use the least squares estimation method to estimate the unknown parameters of the ARMA model, and the unknown parameters include autoregressive coefficients, moving average coefficients and white noise variance;

S43: Use the Akaike Information Criterion AIC to perform model testing on different combinations of p and q parameters; the function of the AIC criterion is expressed as: AIC=-2InL+2g, when the function obtains the minimum value, the optimal p and q parameters are obtained combination;

Among them, ln is the natural logarithm value, L is the maximum likelihood parameter of the model, g is the independent parameter of the model, and AIC represents the criterion function value.

S44: Establish an ARMA model according to the obtained parameters, and the mathematical model of ARMA is expressed as:

为自回归系数，θ₁、θ₂、...、θ_q为滑动平均系数，x_t-p表示时间序列X在t-p时刻的值，ε_t表示独立同分布的随机变量序列。in,

are autoregressive coefficients, θ ₁ , θ ₂ , ..., θ _q are moving average coefficients, x _tp represents the value of the time series X at time tp, and ε _t represents an independent and identically distributed random variable sequence.

Non-stationary IMF components are predicted by nonlinear Elman neural network. The Elman neural network model, as shown in Figure 3, includes input layer, hidden layer, successor layer and output layer, where the output of the neurons in the input layer at time k represents the is u(k), the output of the neuron in the successor layer at time k is expressed as x _c (k), the output of the neuron in the hidden layer at time k is expressed as x(k), and the output of the neuron in the output layer at time k is expressed as is y(k), the connection weight between the input layer and the hidden layer at time k is expressed as w ₁ , the connection weight between the hidden layer and the successor layer at time k is expressed as w ₂ , the connection between the hidden layer and the output layer at time k is expressed as w 2 The weight is represented as w ₃ ; the number of output layer nodes in this embodiment is 1; the training process of the Elman neural network prediction model, as shown in Figure 4, includes:

S51: Select the appropriate number of neurons in each layer, initialize the parameters of the network structure, initialize the connection weight and error index ε, and the maximum number of learning times D, let d=1;

S52: Calculate the output of each neuron in the hidden layer, the successor layer, and the output layer;

S53: Correct the connection weights between the layers according to the error between the predicted value of the component sequence and the real value;

S54: Calculate the error square sum function E, and judge whether E<ε, if so, output and store the connection weights between the layers, otherwise go to S55;

S55: Determine whether d>D, if yes, output and store the connection weights between the layers, otherwise return to step S52.

确定，n为输入节点数，m为输出节点，δ是取值在1到10之间的常数。Selecting the appropriate number of neurons in each layer includes: the number of nodes in the input layer is the number of non-stationary components, the number of nodes in the output layer is 1, and the number of nodes in the hidden layer is determined by the empirical formula.

Determine, n is the number of input nodes, m is the output node, and δ is a constant value between 1 and 10.

Preferably, computing the outputs of the neurons in the hidden layer, the successor layer and the output layer includes:

The output of each neuron in the hidden layer:

x(k)=f(w ₁ ·u(k-1)+w ₂ ·x _c (k));

The output of each neuron in the succession layer:

x _c (k)=x(k-1);

The output of each neuron in the output layer:

y(k)=g(w ³ ·x(k));

g(x)=x;

Among them, f(x) represents the transfer function of the hidden layer, and g(x) is the transfer function of the output layer, both of which take the Sigmoid function. The formula of the Sigmoid function is as follows:

Preferably, correcting the connection weights between the layers includes:

Correct the connection weights from the input layer to the hidden layer:

Modify the connection weights from the successor layer to the hidden layer:

Correct the connection weights from the hidden layer to the output layer:

为输入层到隐含层更新后的连接权值，

为更新之前的权值，λ表示网络的学习速率，E为误差平方和函数，d^jk表示为输出层各节点的期望值，y^ik表示为输出层各节点的预测值，k＝1,2,…,p，p表示训练样本的长度；

为承接层到隐含层更新后的连接权值，

为更新之前的权值；

为隐含层到输出层更新后的连接权值，

为更新之前的权值，符号

表示求偏导数，符号Δ表示增量。in,

is the updated connection weight from the input layer to the hidden layer,

In order to update the weights before, λ represents the learning rate of the network, E is the error square sum function, d ^jk represents the expected value of each node in the output layer, y ^ik represents the predicted value of each node in the output layer, k=1,2, ..., p, p represents the length of the training samples;

is the updated connection weight from the successor layer to the hidden layer,

is the weight before the update;

is the updated connection weight from the hidden layer to the output layer,

is the weight before the update, the symbol

Represents the partial derivative, and the symbol Δ represents the increment.

Preferably, the addition of the real predicted values of each IMF component includes: de-normalizing the predicted values of each IMF component, and the formula is as follows:

x=x'(x _max -x _min );

Where x' is the normalized network traffic value, x is the actual predicted value of the network traffic; x _max and x _min represent the maximum and minimum values of the network traffic, respectively.

Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: ROM, RAM, magnetic disk or optical disk, etc.

The above-mentioned embodiments further describe the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above-mentioned embodiments are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made to the present invention within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (8)

1. a combined network traffic prediction method based on set empirical mode decomposition, is characterized in that, comprises: S1: Obtain raw traffic data and preprocess; S2: Decompose network traffic into finite eigenmode function IMF components with a single frequency on different time scales through ensemble empirical mode decomposition; S3: Perform autocorrelation and partial autocorrelation analysis on the IMF components to determine the stationarity of the IMF components; S4: Use the linear ARMA model to predict the stationary IMF component; S5: Use nonlinear Elman neural network to predict non-stationary IMF components; S6: The predicted value of each IMF component is summed to obtain the predicted value of the network traffic. 2. A combined network traffic prediction method based on set empirical mode decomposition according to claim 1, wherein the preprocessing in step S1 comprises: normalizing the traffic data time series, so that the data The range is between 0 and 1, and the normalization is as follows:

Among them, x' is the normalized network traffic value; x is the actual predicted value of the network traffic; x _max represents the maximum value of the network traffic; x _min represents the minimum value of the network traffic. 3. a kind of combined network traffic prediction method based on ensemble empirical mode decomposition according to claim 1, is characterized in that, described by collective empirical modal decomposition, network traffic is decomposed into the limited frequency of single frequency on different time scales. The IMF components of the eigenmode function include: S21: set i=1, and select N kinds of white noise signals; S22: adding the i-th white noise signal to the original signal to form a signal-noise mixture; S23: Perform empirical mode decomposition on the signal-to-noise mixture, and decompose it into a combination of IMF components; S24: Determine whether i is greater than N, and if it is greater, average all the obtained IMF components, otherwise set i=i+1 and return to step S22. 4. a kind of combined network traffic prediction method based on set empirical mode decomposition according to claim 3, is characterized in that, carrying out empirical mode decomposition to signal-noise mixture comprises: S221: Find all local maxima and local minima of the signal x(t); S222: Obtain the upper envelope emax(t) and lower envelope emin(t) of the signal x(t) through extreme value fitting; S223: Calculate the local mean value m(t), expressed as: m(t)=(emin(t)+emax(t))/2; S224: subtract the local mean from the original input signal to obtain the oscillation signal h(t), which is expressed as: h(t)=x(t)−m(t); S225: When h(t) satisfies the condition of the IMF component, let c ₁ =h(t), then c ₁ is the first IMF component, and the corresponding margin r ₁ =x(t)-c ₁ ; otherwise, Replace x(t) with h(t) and go to step S221; S226: when r ₁ still contains the frequency information in the original data, replace r ₁ with x(t) and go to step S221 to obtain the second IMF component, and so on, to obtain r ₁ -c ₂ =r ₂ , ..., rn _{-1 -cn} = rn ; when cn or _{rn is less} than the set value, or when rn _becomes a monotone function, the sieving process _is stopped. 5. a kind of combined network traffic prediction method based on set empirical mode decomposition according to claim 1, is characterized in that, to the autocorrelation and partial autocorrelation analysis of IMF component comprises: The autocorrelation function of the IMF component is expressed as:

The partial autocorrelation function of the IMF component is expressed as:

Among them, γ _k is the auto-covariance at time k, which is expressed as

y _k represents the network traffic at time k, y _t+k represents the network traffic at time t+k, N is the length of the sequence; ρ _k is the autocorrelation function at time k; α _k,j is the partial autocorrelation function at time k ; γ ₀ is the autocovariance at time 0. 6. a kind of combined network traffic prediction method based on set empirical mode decomposition according to claim 1, is characterized in that, the establishment process of ARMA model comprises: S41: Determine the autoregressive order p and moving average order q of the ARMA model by using the tailing of the autocorrelation function and the partial autocorrelation function; S42: Use the least squares estimation method to estimate the unknown parameters of the ARMA model, and the unknown parameters include autoregressive coefficients, moving average coefficients and white noise variance; S43: Use the Akaike Information Criterion AIC to perform model testing on different p, q parameter combinations, and obtain the optimal p, q parameter combination; S44: Establish an ARMA model according to the autoregressive coefficient, the moving average coefficient and the white noise variance. 7. a kind of combined network traffic prediction method based on set empirical mode decomposition according to claim 1, is characterized in that, the training process of Elman neural network comprises: S51: Select the appropriate number of neurons in each layer, initialize the parameters of the network structure, initialize the connection weight and error index ε, and the maximum number of learning times D, let d=1; S52: Calculate the output of each neuron in the hidden layer, the successor layer, and the output layer; S53: Correct the connection weights between the layers according to the error between the predicted value and the real value of the IMF component; S54: Calculate the error square sum function E, and judge whether E<ε, if so, output and store the connection weights between the layers, otherwise go to S55; S55: Determine whether d>D, if yes, output and store the connection weights between the layers, otherwise set d=d+1 and return to step S52. 8. A combined network traffic prediction method based on ensemble empirical mode decomposition according to claim 1, is characterized in that, when adding the real predicted values of each IMF component, the predicted value of each IMF component needs to be carried out. Inverse normalization processing, expressed as: x=x'(x _max -x _min ); Among them, x' is the normalized network traffic value, x is the actual predicted value of the network traffic; x _max represents the maximum value of the network traffic; x _min represents the minimum value of the network traffic.

Images