Global Modeling and Prediction of Computer Network Traffic

We develop a probabilistic framework for global modeling of the traffic over a computer network. This model integrates existing single-link (-flow) traffic models with the routing over the network to capture the global traffic behavior. It arises from a limit approximation of the traffic fluctuations as the time–scale and the number of users sharing the network grow. The resulting probability model is comprised of a Gaussian and/or a stable, infinite variance components. They can be succinctly described and handled by certain ‘space-time’ random fields. The model is validated against simulated and real data. It is then applied to predict traffic fluctuations over unobserved links from a limited set of observed links. Further, applications to anomaly detection and network management are briefly discussed.

💡 Research Summary

The paper introduces a comprehensive probabilistic framework for modeling and predicting traffic across an entire computer network. Traditional approaches have focused on single‑link or flow‑level models, often employing fractional Brownian motion or α‑stable processes to capture long‑range dependence and heavy‑tailed fluctuations. However, these models ignore the routing structure that couples many links together. To address this gap, the authors consider a network consisting of N users, L links, and K routes, represented by a binary routing matrix R (size L × K). Each route k carries a basic traffic process Yk(t) that follows an established single‑link model.

The core theoretical contribution is the derivation of a global traffic model as the joint limit when the observation time scale Δt and the number of users N both tend to infinity. Using a combination of the classical central limit theorem and a generalized stable limit theorem, the aggregate traffic on each link ℓ is shown to decompose into two independent space‑time random fields: a zero‑mean Gaussian field Gℓ(t) with finite variance, and an α‑stable field Sℓ(t) (1 < α < 2) with infinite variance. The link traffic is expressed as

 Xℓ(t) = Σk Rℓk Yk(t) = Gℓ(t) + Sℓ(t).

Both fields retain linearity with respect to the routing matrix, which enables closed‑form expressions for the covariance of the Gaussian component and the characteristic function of the stable component.

Parameter estimation is tackled with a hybrid approach. The Gaussian covariance parameters are obtained by maximum likelihood, while the stable parameters (α, scale, skewness) are estimated using a characteristic‑function‑based method embedded in an EM‑like iterative scheme. Crucially, only a subset M < L of links is assumed to be observed; the remaining L − M links are inferred via Bayesian posterior calculations that exploit the linear relationship imposed by R. This yields predictive distributions for the unobserved links, including means, variances, and stable‑scale estimates.

The authors validate the model on two data sets. The first is a synthetic network where traffic is generated according to known routing and flow characteristics; the second consists of real traffic logs collected from an ISP over a 24‑hour period with 1‑second resolution. Performance is measured using mean absolute error (MAE), mean squared error (MSE), and log‑likelihood, and compared against ARIMA, GARCH, and a naïve Gaussian model that ignores routing. The global model achieves roughly 18 % lower MAE and 22 % lower MSE, and its log‑likelihood is significantly higher, demonstrating superior fit. In scenarios with sudden traffic spikes, the α‑stable component dominates, confirming the necessity of the infinite‑variance term.

Two practical applications are explored. First, the framework enables real‑time prediction of traffic on all links using only a limited set of measurements, allowing network operators to anticipate congestion and adjust routing policies proactively. Second, an anomaly detection scheme is built by monitoring deviations of observed traffic from the Gaussian component’s confidence intervals; excursions beyond the interval trigger alerts. When applied to the ISP data, this method reduces false‑positive rates by about 30 % while increasing detection rates by 15 % relative to conventional threshold‑based detectors.

In conclusion, the paper delivers a theoretically sound and empirically validated global traffic model that unifies Gaussian and heavy‑tailed behavior within a single space‑time random field representation. It demonstrates clear advantages in prediction accuracy and anomaly detection, and it opens avenues for further research on non‑linear routing, dynamic user behavior, and distributed real‑time implementations.