WO2021047270A1

WO2021047270A1 - Network traffic prediction method, communication device and storage medium

Info

Publication number: WO2021047270A1
Application number: PCT/CN2020/101057
Authority: WO
Inventors: 巫忠正; 郭洋
Original assignee: 中兴通讯股份有限公司
Priority date: 2019-09-09
Filing date: 2020-07-09
Publication date: 2021-03-18
Also published as: CN112468312A

Abstract

Disclosed is a network traffic prediction method. The method comprises: acquiring historical network traffic data; inputting the historical network traffic data into a timing sequence prediction model to obtain a first predicted network traffic value; and inputting the first predicted network traffic value and at least one value correlating with the first predicted network traffic value into an artificial neural network to obtain a second predicted network traffic value.

Description

Method for predicting network traffic, communication equipment and storage medium

This article claims the priority of the Chinese patent application CN201910856965.3 entitled "A network traffic prediction method and communication equipment and storage medium" filed on September 9, 2019, the entire content of which is incorporated herein by reference.

Technical field

The embodiments herein relate to the field of network traffic analysis, and in particular to a network traffic prediction method.

Background technique

As Transmission Control Protocol/Internet Protocol (TCP/IP) networks occupy an increasingly important position in modern society, how to better understand and correctly predict network behavior has become the most important part of the development of information technology. An important part. For medium and large network providers, TCP/IP network forecasting has become an important task and is gaining more and more attention. By improving the accuracy of this task, network providers can better optimize resources and provide better service quality. Not only that, network traffic prediction can help detect malicious attacks on the network. For example, denial of service or spam attacks can be detected by comparing real traffic with predicted traffic. The sooner these problems are detected, the more reliable network services can be obtained.

The large-scale network system itself is a complex non-linear system, and at the same time it is affected by a variety of external factors. Its macro-flow behavior is often complex and changeable. The data contains a variety of periodic fluctuations, as well as non-linear upward and downward trends. , It is also interfered by uncertain random factors, which makes the flow model expressed by linear characteristics have large errors. Therefore, how to select and optimize nonlinear models has become the focus of research in predicting network traffic in recent years. Among them, Support Vector Machine (SVM), Least Squares Support Vector Machines (LS-SVM), Artificial Neural Network (ANN), Echo State Network, etc. are all accurate for prediction. However, the existing linear model is still unable to accurately predict network traffic with obvious nonlinear characteristics.

Summary of the invention

The main purpose of the embodiments of this document is to provide a network traffic prediction method, communication device and storage medium, so as to improve the accuracy of network traffic prediction.

In order to achieve the purpose of the embodiments of this document, the embodiments of this document provide a network traffic prediction method, including obtaining historical network traffic data; inputting the historical network traffic data into a time series prediction model to obtain the first network traffic prediction value; The first network traffic prediction value and at least one value that is correlated with the first network traffic prediction value are input into an artificial neural network to obtain a second network traffic prediction value.

In order to solve the above technical problems, the embodiments of this document also provide a communication device, including a processor, a memory, and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute the memory One or more computer programs stored in the computer program to implement the steps of the network traffic prediction method as described above; in order to solve the above technical problems, the embodiments herein also provide a computer-readable storage medium, the computer-readable storage medium One or more computer programs are stored, and the one or more computer programs can be executed by a processor to implement the steps of the method for predicting network traffic as described above.

Description of the drawings

Fig. 1 is a flowchart of a network traffic prediction method according to an embodiment of this document;

FIG. 2 is a schematic diagram of an analysis result of an autocorrelation coefficient of network traffic data collected in an embodiment of this document;

Figure 3 is a schematic diagram of a network traffic prediction model in an embodiment of this document;

Figure 4 is a schematic diagram of network traffic data collected in an embodiment of this document;

FIG. 5 is a schematic diagram of network traffic data of area one collected in an embodiment of this document;

FIG. 6 is a schematic diagram of network traffic data of area 2 collected in an embodiment of this document.

The implementation, functional characteristics, and advantages of the embodiments herein will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

detailed description

Hereinafter, this article will be described in detail with reference to the drawings and in conjunction with the embodiments. It should be noted that the embodiments herein and the features in the embodiments can be combined with each other if there is no conflict.

It should be noted that the terms "first", "second", etc. in the specification and claims herein and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence.

Example 1

In this embodiment, a method for predicting network traffic is provided. FIG. 1 is a flowchart of a method for predicting network traffic according to an embodiment of this document. As shown in FIG. 1, the process includes the following steps: Step S101, obtain network Historical traffic data; step S102, input the historical network traffic data into a time series prediction model to obtain a first network traffic prediction value; step S103, combine the first network traffic prediction value and at least one with the first network traffic The correlated value of the traffic prediction value is input into the artificial neural network to obtain the second network traffic prediction value.

In Embodiment 1, the time series prediction model is a long-short-term memory model. After the preliminary network traffic prediction value is obtained through the long-short-term memory model, the preliminary network traffic prediction value and at least one of the preliminary network traffic prediction values The predicted value is related to the value input into the artificial neural network. For example, the preliminary network traffic prediction value predicts the network traffic at 5 o'clock tomorrow afternoon, then the value related to the preliminary network traffic prediction value includes the same time yesterday , The traffic at the same time the day before, etc.

Through the above steps, the prediction effect of network traffic is improved.

Example 2

Fig. 3 is a schematic diagram of a network traffic prediction model according to an embodiment of this paper. As shown in Fig. 3, the embodiment of this paper combines a long- and short-term memory model and an artificial neural network model as a network traffic prediction model, wherein the input of the long- and short-term memory model is a sequence of numbers , The input of the artificial neural network model is a value that is highly correlated with the predicted value of network traffic and the output of the long- and short-term memory model. The network traffic data prediction method based on artificial neural network includes the following steps:

Use network traffic collection device or software to collect historical network traffic data. Referring to Figure 4, Figure 4 is a schematic diagram of the collected network traffic data. With a time scale of every five minutes, it can be seen from the figure that the network traffic data has an obvious periodicity with a 24-hour period. And each cycle has similar data characteristics. Therefore, the following autocorrelation coefficient formula is used to analyze the network traffic data.

By examining the autocorrelation coefficient of the flow data, the correlation degree of the time series data compared with the data of k lagging periods is obtained:

As shown in Figure 2, Figure 2 is the result of the autocorrelation coefficient analysis of the collected network traffic data. It can be seen from the figure that in the network traffic data, the autocorrelation coefficient is performed in units of twenty-four hours, that is, "days". Circulation, and shows a trend of decreasing day by day. Therefore, the network traffic data one day ago is largely correlated with the current network traffic data.

Construct a neural network structure combining a long and short-term memory model and an artificial neural network, and use the historical data of the network traffic combined with a value that is highly correlated with the network traffic prediction value for training modeling to generate a deep neural network traffic prediction model. Among them, the long and short-term memory model is a variant of the recursive neural network (RNN), and the principles of the related network structure will be described in detail below.

RNN is a popular learning method in the field of machine learning and deep learning in recent years. It is different from the traditional feedforward neural network (FNN). The neurons of FNN carry out information through the connection of the input layer, hidden layer, and output layer. transfer. Each input item is independent of each other, and there is no connection between neurons in the same layer. RNN introduces a cyclic structure into the network and establishes a connection between the neuron itself and itself. Through this ring structure, the neuron can "memorize" the input information at the last moment in the neural network and affect the output at the current moment. Therefore, RNN can better reflect the time sequence of data, and often has better performance than FNN in the prediction of time series data.

There are some differences between the training process of RNN and FNN. FNN is implemented by Back Propagation (BP) algorithm. RNN has to be in the time dimension because the state of the hidden layer at several previous moments will also affect the error of the output layer. The result of backward propagation is superimposed, that is, the Back Propagation Through Time (BPTT). The time backward propagation algorithm of RNN first defines the partial derivative of the loss function to the input value of neuron j at time t, and then calculates the partial derivative of the loss function to the network weight through the chain derivation rule.

The partial derivative between the loss function and the neuron is affected by the hiding of the output layer at the current time t and the next time t+1. Using the chain derivation rule for each time step, all the results are added in the time dimension to obtain the partial derivative of the loss function with respect to the neural network weight w. Then through the gradient descent method, the weights in the recurrent neural network are updated until the conditions are met.

In the last step of the RNN training process, you can see that the gradient must be multiplied by _{W hh} ^{T at each step in the back propagation process.} If the eigenvalue W _hh <1, this will lead to a gradient explode; if the eigenvalue W _hh <1, this will lead to a gradient vanish. In response to this problem, the Long short term memory (LSTM) neural network was born.

LSTM neural network is a variant of RNN. The key is to replace neurons in the hidden layer of RNN with cell state. Cell state is transmitted in the time chain. There are only a few linear interactions, and the information is very large on the cell unit. Easy to keep. Each memory contains one or more memory cells and three non-linear summation units. The non-linear summation unit is also called "Gate", which is divided into 3 types: "Input gate", "Output gate" (Output gate) and "Forget gate", respectively through the matrix Multiplication controls the input and output of memory cells.

The time backward propagation algorithm of LSTM is similar to that in RNN. Starting from the end of the time series (time T), the gradient of each parameter is calculated in the reverse loop step by step, and finally the network parameters are updated with the gradient of each time step. First calculate the partial derivative corresponding to the output value of the memory cell, then calculate the partial derivative of the output gate, and then calculate the partial derivative of the memory cell state, forget gate, and input gate respectively, and finally use the gradient descent method to update the model connection weight.

The deep neural network generated by training is used to predict the network traffic in the future and provide a basis for network service providers to make decisions.

Compared with the prior art, the embodiments of this paper have at least the following technical advantages: the implementation results show that LSTM can be used as a time series sequence prediction model and can provide accuracy better than other traditional models. And after considering the autocorrelation characteristics, the neural network combined with LSTM and ANN has certain advantages in the accuracy of coarse time-granularity data sets. High-precision network traffic prediction provides certain support for handling possible network congestion, abnormal attacks and other situations.

Example 3

Figure 3 is a schematic diagram of a network traffic prediction model according to an embodiment of this paper. As shown in Figure 3, the input of the long and short-term memory model is a time series sequence, and the input of the artificial neural network model is a value with high correlation with the network traffic prediction value. The output of the long and short-term memory model. The network traffic data prediction method based on neural network includes the following steps:

Use network traffic collection device or software to collect historical network traffic data.

Figure 5 is a schematic diagram of the collected network traffic data of area 1. As shown in Figure 5, the blue line is the real data, and the red line is the predicted result; with every fifteen seconds as a time scale, you can see from the figure The traffic data to the network has obvious periodicity with a 24-hour cycle. And each cycle has similar data characteristics. So use the following autocorrelation coefficient formula to analyze the network traffic data.

By examining the autocorrelation coefficient of the flow data, draw the correlation degree of itself in the time series data compared with the data lagging k periods:

According to the flow data of area 1, the autocorrelation index is calculated to be 0.7479596037 (between 0.5-1.5, and the autocorrelation is suitable for flow forecasting). Therefore, the network traffic data one day ago is largely correlated with the current network traffic data.

Figure 6 is a schematic diagram of the collected network traffic data of area 2. As shown in Figure 6, with every fifteen seconds as a time scale, it can be seen from the figure that the network traffic data has obvious periodicity with a 24-hour period. . And each cycle has similar data characteristics. So use the following autocorrelation coefficient formula to analyze the network traffic data.

Calculated according to the formula, the autocorrelation coefficient of the flow in area 2 is 0.693812642395 (between 0.5-1.5, and the autocorrelation is suitable for flow prediction). Therefore, the network traffic data one day ago is largely correlated with the current network traffic data.

By constructing a neural network structure combining a long and short-term memory model and an artificial neural network, the historical data of the network traffic is combined with a value that has a high correlation with the network traffic prediction value for training modeling to generate a deep neural network traffic prediction model .

Example 4

The embodiments herein also provide a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any of the foregoing method embodiments when running.

In Embodiment 4, in this embodiment, the above-mentioned storage medium may be configured to store a computer program for performing the following steps: S1, obtain historical network traffic data; S2, input the historical network traffic data into a time series forecast In the model, the first network traffic prediction value is obtained; S3, the first network traffic prediction value and at least one value that is correlated with the first network traffic prediction value are input into the artificial neural network to obtain the second network traffic Predictive value.

In Embodiment 4, in this embodiment, the above-mentioned storage medium may include, but is not limited to: U disk, Read-Only Memory (Read-Only Memory, ROM for short), Random Access Memory (Random Access Memory, RAM for short) ), mobile hard disks, magnetic disks or optical disks and other media that can store computer programs.

The embodiments herein also provide a communication device, including a processor, a memory, and a communication bus; the communication bus is used to connect the processor and the memory; the processor is configured to run a computer program to execute any of the above The steps in the method embodiment.

In Embodiment 4, in this embodiment, the above-mentioned processor may be configured to execute the following steps through a computer program: S1, acquiring historical network traffic data; S2, inputting the historical network traffic data into a time series prediction model, Obtain a first network traffic prediction value; S3, input the first network traffic prediction value and at least one value that is correlated with the first network traffic prediction value into an artificial neural network to obtain a second network traffic prediction value.

In an implementation manner, for specific examples in this embodiment, reference may be made to the examples described in the above-mentioned embodiments and alternative implementation manners, and details are not described herein again in this embodiment.

Based on the autocorrelation characteristics of the network traffic, the embodiment of the present invention combines the time series sequence prediction model and the artificial neural network to obtain the traffic prediction model, so as to improve the prediction effect of the network traffic.

Obviously, those skilled in the art should understand that the above-mentioned modules or steps in this document can be implemented by a general computing device, and they can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. In one embodiment, they can be implemented with program codes executable by a computing device, so that they can be stored in a storage device for execution by the computing device, and in some cases, they can be different from here. The steps shown or described are performed in the order of, or they are respectively fabricated into individual integrated circuit modules, or multiple modules or steps of them are fabricated into a single integrated circuit module to achieve. In this way, this article is not limited to any specific combination of hardware and software.

The above descriptions are only the preferred embodiments of this article and are not intended to limit this article. For those skilled in the art, this article can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the principles of this article shall be included in the scope of protection of this article.

Claims

A network traffic prediction method, including:

Obtain historical data of network traffic;

Inputting the historical network traffic data into the time series prediction model to obtain the first network traffic prediction value;

The first network traffic prediction value and at least one value that is correlated with the first network traffic prediction value are input into an artificial neural network to obtain a second network traffic prediction value.
The method according to claim 1, wherein the inputting the historical network traffic data into a time series prediction model comprises: inputting the historical network traffic data into a long and short-term memory model.
The method according to claim 2, wherein the long and short-term memory model is an LSTM neural network model.
A communication device, including a processor, a memory, and a communication bus;

The communication bus is used to connect the processor and the memory;

The processor is configured to execute one or more computer programs stored in the memory to implement the steps of the network traffic prediction method according to any one of claims 1-3.
A computer-readable storage medium, wherein the computer-readable storage medium stores one or more computer programs, and the one or more computer programs can be executed by one or more processors to realize -Steps of any one of the network traffic prediction methods.