Educational Network Bandwidth Analysis and Prediction

1 Shwan Dyllon, 2 Ousmane Abdoulaye Oumar, 1 Perry Xiao

1 London South Bank University

2 School of Engineering - Electrical & Electronic Engineering, London South Bank University, London, UK

Email :{ dyllons, oumaro2, xiaop}@lsbu.ac.uk

Abstract. Network monitoring and analytic thinking are important to understand network performance, reliability and security, as easily as to identify potential problems. This research work focuses on looking into the educational network data traffic, to understand current trends in order to design for the time to come. The aim of the research is to monitor the London South Bank University’s (LSBU) network traffic, and to evolve a software analytic tool that can study the network traffics. The results of this study can assist organisations to enhance their network performance, and offer recommendations for scalability and future upgrades.

This paper presents, LSBU network traffic raw data were first captured using the Paessler Router Traffic Grapher (PRTG) network-monitoring tool, and then many numerical analysis algorithms was developed to analyse the captured raw data. A fast Fourier transform (FFT) algorithm developed to study the traffic’s frequency domain data, performing large-scale analytics for user conduct. Initial effects of the FFT show that it holds potential as a tool for evaluating and/or predicting LSBU behaviour. A wavelet-based algorithm also used in development in order to decompose, demos, and compress the data, as well as analyse the time frequency characteristics of the data. In addition, helps develop methods to control the technique for working network analysis; this technique can analyse and predict data usage in its current and future states, and used as a mechanism to support decision-making in terms of the organization’s future investments.

Keywords: Network, Prediction, Bandwidth, FFT.

I. INTRODUCTION

It is important that the network traffic analysis based on the different characters of protocols covering the enterprise networks at any single time. This is essential for efficient troubleshooting and resolving of issues when they occur, so that network services do not come to a standstill for extended stops. The network monitoring tool is used for protocols and techniques (such as SNMP, slow, and port utilization) in order to capture data and format them for analysis. According to different internet, applications can affect the behaviour of ISPs’ internet structural operations, which modelled as complex networks for each behaviour [1].

The major factors that determine network design by examining the characteristics of multicast traffic in the local area network (LAN), which rarely studied in terms of packet size and interval time distribution [2]. Their research exposed multicast traffic in an intra-domain network in terms of two parameters based on several networks. The results of their experiment are useful for multicast traffic simulation, which commonly found in corporate networks. One solution is to have regular and complex monitoring of the network through implementing traffic-engineering techniques. The main objective of these techniques is to avoid traffic congestion and the resulting deterioration in service.

On the other hand demonstrated how TCP congestion control could reveal the chaotic behaviour of TCP/IP networks. Their research shows that TCP is a process that creates chaos and generates self-similarity [3]. This characteristic is inherent in today’s TCP/IP networks, and is independent of higher layer applications or protocols: The two causes: heavy tailed ON/OFF and chaotic TCP; together they contribute to the phenomena called the fractal nature of internet traffic. Therefore, it is important that this investigated; the authors have proposed further analysis on minute influences for buffer management and TCP congestion control (in order to fairly improve throughput and arrive at more accurate network-level macroscopic TCP models).

Developed an application-level HTTP traffic classification system and verified it by applying the system to a small part of a campus network. The research helps network management performance by offering a method for classifying HTTP traffic based on client-side applications and then grouping those applications based on providing services [4].

In this project, we are going to use FFT and wavelet to develop an analytic tool to examine LSBU’s real-time raw data. This analysis will allow LSBU to predict future trends in data traffic, help the organization addition, further improvement of the current software analysis tool takes the diligence of other machine learning algorithms and techniques (such as back propagation in neural nets and fuzzy neurons) in order to focus the public presentations of each technique to derive more accurate predictions. To enhance their network operation in the future, and prepare recommendations for future climbs. The wavelet transform analysis was the most appropriate technique to analyse LSBU network behaviour.

Developed a simulation to analyse historical data based on FFT that indicates frequency domain analysis by providing an alternative method of understanding data characteristics (by applying a DFT in order to analyse anomalies and identify the periodic signature) [5]. By measuring the signature of the historical data, DFT proves to be a perfect tool for examining historical data. In addition, DFT can be very good in terms of accuracy when it comes to windowing and sample size processing. Compared their system with previous research, and it appeared to have more suitable and accurate traffic analysis [6]. In addition, it had a good reduction of press to the core network and low false rates. This achieved high accuracy by simulating results using an FFT-based IP traffic classification system called selected IP traffic offload (SIPTO) and a partial decision tree (PART) machine learning algorithm. In contrast a new method based on FFT signal processing techniques that exactly pinpoint traffic shaped by time and date in the frequency domain. This method used the technique to help see a wormhole attack very accurately and very quickly [7]. The research simulation stated that the method of detecting does not require any special hardware. Another benefit of FFT stated, the user of two fibre-optics based on interferometric sensor multiplexing schemes [8].

In this paper, the wavelet transform used for data decomposition, denoising, and compressing. With a wavelet transform, you do not lose time information (which is useful in many contexts) and clustering allows more accuracy in terms of data representation. A comparison of the two processes resulted in an accurate prediction by wavelet. This indicates that wavelet is able to predict a value for short-term traffic flow. Examined two kinds of mechanisms by tracing network traffic: postmortem and real-time detection modes [9]. Research has shown the feasibility of analysing packet header data through wavelet analysis in order to detect traffic anomalies by using the correlation coefficient of destination IP addresses in the outgoing traffic on an egress router. The result indicated that the statistical analysis of aggregate traffic header data might provide an effective mechanism for the detection of anomalies within a campus or edge network.

It is good for sine wave comparison to display the smoothness of infinite length. Wavelets are an ideal tool for analysing signals of a non-stationary nature because they are irregular in shape and are able efficiently analyse sharply changed signals with temporal localisation. Thus, wavelet offers other benefits from FFT: it shows a correlation between the time and frequency domains of a signal, while FFT provides information about the frequency domain. The wavelet coefficients calculated for each wavelet segment, giving a timescale function that relates the wavelet correlations to the signal. Developed a model (called Waveman) to analyse data traffic anomalies; it used for real-time wavelet-based analysis [10]. The model uses two matrices percentage deviation and entropy to evaluate the performance of various wavelet functions for security purposes, such as denial of service (DoS), traffic anomalies and port scans.

II. Analysis Results

The results and a discussion of the research work, which divided into three sections (i.e. the analysis of HTTP and HTTPS data, FFT data analysis, and wavelet data analysis). The study’s novelty is the use of this information to validate algorithms of estimation using experiments involving different techniques for analysing data. Hence, the novelty and original contribution of this study are limited by the usage of the PRTG network monitoring tool to capture real-time raw data, monitor network traffic, develop software solutions for network traffic analysis using wavelets, and analyze data traffic, predict future trends in data traffic to assist an organization enhance its web performance, and provide recommendations for scalability and future upgrades.

The analyse traffic (applying FFT) and how we can apply filters such as low-pass, high-pass, band-pass and notch filters to manipulate the frequency domain so as to remove any spikes and abnormal activity before bringing it back to a time domain in the plot. Figure 2 shows the corresponding FFT results expressed as raw data counts (Bin). The time interval of the data is Ts= 1 (1 hour); therefore, sampling frequency is Fs=1/Ts, and total data length is L=8784.

Figure 1: High-pass filter process in the frequency domain.

367 (daily traffic)

Figure 1 shows the high-pass filter process in the frequency domain, and Figure 2 shows the corresponding time domain data using inverse FFT.

Figure 2: High-pass filter data traffic pattern in the time domain.

Figure 3: Low-pass filter process in the frequency domain.

53 (weekly traffic)

Apparently, weekly and monthly data usages vary a lot throughout the yr. This is quite different from previous used on the other section of this research daily and hourly data usage. By appearing at the graph for an entire year, it can highlight bursts of usage that correspond to university events where activity is high e.g., backups, cloud synchronization, and data centre synchronisation.

Figure 4: Low-pass filter data traffic pattern in the time domain.

Band-Pass

Figure 5: Band-pass process in the frequency domain.

367	733

Figure 6: Band-pass filter data traffic pattern in the time domain.

Passing traffic Passing traffic

367 (daily traffic) Figure 7: Notch filter process in the frequency domain.

Figure 8: Notch filter data traffic pattern in the time domain.

Figure 9 shows the original one-year total traffic data (top), and corresponding CWT 2D results (bottom). The X-axis of CWT result is time, and the Y-axis is CWT scales, which are inversely proportional to frequency. It can convert this CWT scale into frequencies, and convert the CWT results into time-frequency results, as shown in Figure 10. Figure 11 & Table 1 shows the frequencies in Hz of hourly, daily, weekly and monthly events. Using these frequencies, it can then identify the corresponding hourly, daily weekly and monthly event in Figure 12.

Figure 9: Sliding Window Smoothing.

Figure 10: The original one-year total traffic data (top), and corresponding CWT 2D results (bottom).

Figure 11: Original data (weekly smoothing data) and linear least squares regression trend line.

Table 1: The frequencies (Hz) of hourly, daily, weekly and monthly event.

Time	Frequency (Hz)
Hourly:	2.78E-04
Half daily:	2.31E-05
Daily:	1.16E-05
Weekly:	1.65E-06
Two weekly:	8.27E-07
Monthly:	3.86E-07
Quarterly:	1.29E-07

Figure 12: The CWT time - frequency 2D results.

Analysing packet header data through wavelet analysis in order to detect traffic anomalies by using the correlation coefficient of destination IP addresses in the outgoing traffic on an egress router. The result indicated that the statistical analysis of aggregate traffic header data might provide an effective mechanism for the detection of anomalies within a campus or edge network.

It is good for sine wave comparison to display the smoothness of infinite duration. Wavelets are an ideal instrument for analysing signals of a non-stationary nature because they are irregular in form and are able efficiently analysing sharply changed signals with temporal localization. Thus, wavelet offers other benefits from FFT: it shows a correlation between the time and frequency domains of a sign, while FFT provides information about the frequency field.

The wavelet transform allows extraordinary localisation in both the time domain (via translations of the mother wavelet) and the frequency domain (via dilations). The translation and dilation operations applied to the mother wavelet performed to calculate wavelet coefficients, which represent the correlation between the wavelet and a localised section of the signal. The wavelet coefficients calculated for each wavelet segment, giving a timescale function that relates the wavelet correlations to the signal.

III. Conclusion

This study’s approach has allowed the researcher to read the raw data in the time domain into the frequency domain, and has enabled the isolation of patterns from the analysis of unidirectional IP traffic to utilize an educational data kit. It has as well helped reasonably predict what traffic could be similar, given anomalies and outcomes. It has also proven that applying filters (such as low-pass, high-pass, band-pass and notch filters where appropriate) can identify fundamental network usage without the noise caused by internal processes. For instance, at assignment time, there is a spike in network usage. However, part of this spike could have been the result of a backup, where a virtual server was migrated to the cloud DC. By using filters, we were able successfully remove these spikes to give a much smoother oscillation representing the actual user-driven network usage pattern. Furthermore, the notch function allowed us to focus on specific time increments in order to analyse the actual readings taken from the PRTG tool. This will allow us to predict user-driven network usage much more accurately in the future, as it eliminates the noise generated by internal network traffic.

The study only explores the application of the given techniques to a certain extent. It would have been best to run this tool for data over several years so that it could perform a deep dive of analysis behaviour. The program allows the user to apply various filters and functions to the raw data in the frequency domain before plotting the time domain. In another eight months’ time, with only a few modifications, it will be possible to input two years’ worth of data into this program.

References

[1]	Yu, K., Wu, X. and Cao, Y., 2010. Competitive Analysis of Behavioral

Structure from Internet Traffic. Deploying In Network Data Analysis

Techniques in Sensor Networks, Beijing, 26–28 October, Beijing: IEEE, pp.75–79.

[2]	Monsakul, A., Charnkeitkong, P. and Chimmanee, S., 2011. A study in multicast traffic characteristic analysis on the intra-domain network 2011 IEEE/SICE International Symposium on System Integration, SII 2011, pp.1155–1158. DOI: http://doi.org/10.1109/SII.2011.6147612.

[3]	Veres, A. and Boda, M., 2000. The chaotic nature of TCP congestion control. Proceedings of INFOCOM’00, vol. 3, Tel Aviv, 26–30 March. Israel: IEEE, pp.1715–1	723.

[4]	Choi, M.J, Jin, C.G. and Kim, M.S, 2011. Classification of Client-side Application-level HTTP Traffic. The Journal of Korea Information and Communication Society (J-KICS), 36(11), pp.1277–1284. Available at: http://www.koreascience.or.kr/article/ArticleFullRecord.jsp?cn=GCSHCI_2011_v36 11B_1277.

[5]	Drew, M., 2014. A Frequency Analysis Approach for Categorizing Air Traffic Behavior. 14th AIAA Aviation Technology, Integration, and Operations Conference, Atlanta, GA, 16–20 June. Available at:http://www.aviationsystemsdivision.arc. nasa.gov /publications/2014/AIAA-20142420.pdf.

[6]	Han, L. et al., 2012. Fast fourier transform based ip traffic classification system for SIPTO at H(e)NB. 7th International Conference on Communications and Networking in China, pp.430–435. Available at:

http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6417521.

[7]	Song, R., Mason, P.C. & Li, M., 2011. Enhancement of frequency-based wormhole attack detection. Proceedings of the IEEE Military Communications Conference (MILCOM), pp.1139–1145.

[8]	Wu, Z., Zhang, L. and Yue, M., 2015. Low-Rate DoS Attacks Detection Based on Network Multifractal. IEEE Transactions on Dependable and Secure Computing, 5971(c), pp.1–1. Available at: http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=7120917.

[9]	Kim, S.S., Reddy, A.L.N. and Vannucci, M., 2004. Detecting Traffic Anomalies Using Discrete Wavelet Transform. pp.951–961. Available at: http://link.springer.com/chapter/10.1007%2F978-3-540-25978-7_96.

[10]	Huang, C.T., Thareja, S. and Shin, Y.J., 2006. Wavelet-Based Real Time Detection of Network Traffic Anomalies. 2006 Securecomm and Workshops, pp.1–7.