МОДЕЛИРОВАНИЕ СЕТЕВОГО ТРАФИКА НА БАЗЕ МАРКОВСКОЙ МОДЕЛИ И РЕКУРРЕНТНОЙ НЕЙРОННОЙ СЕТИ
Authors: Бикмухамедов Р.Ф. , Надеев А.Ф. 
Published: February 2025

Статистическое моделирование сетевых потоков и устройств находит своё применение при тестировании систем и сетей, а также при необходимости воспроизвести трафик устройств, которые недоступны. В данной работе был проведён сравнительный анализ моделей трафика на базе скрытой марковской модели и рекуррентной нейронной сети в задаче имитации трафика на примерах с голосовым сеансом и трафика от IoT (Internet of Things) устройства Amazon Echo. По результатам оценки сгенерированных пакетов было показано преимущество марковской модели по метрикам скользящей энтропии и дивергенции КульбакЛейблера по распределениям сгенерированных параметров.
Introduction. Currently, there are three main approaches to generation of discrete sequences with the use of Markov and neural networks models also referred to as autoregressive models. The first two network traffic models have been thoroughly studied. The lack of studies into the traffic modeling with the use of neural networks has fostered us to carry out this research. In our research, we performed traffic modeling for individual devices or network flows with the use of the following features packet size and time interval between two packets sent in the same direction. The aim of the research was to analyze the possibility of generating traffic using a recurrent neural network and compare the obtained result with the original traffic and the one generated by a Hidden Markov Model. Research method. The neural network architecture was based on a generative classification model of discrete sequences. It required the quantization of the original twodimensional attribute space with the use of a Gaussian mixture. The traffic model based on the recurrent neural network was compared to the hidden Markov model of the first order with the Gaussian distribution of the hidden components. The recurrent neural network traffic model was compared with the first order Hidden Markov model with Gaussian components. For the sake of performance comparison, we selected KulbakLeibler divergence from the original densities of the parameters and a rolling entropy that captures feature randomness within a limited timewindow. Findings. We tested the models according to two scenarios with a Skype voice flow and traffic of an Amazon Echo device. Both models demonstrated the divergence below 0.03 in the first scenario, although the rolling entropies were roughly 5 higher than the original traffic. In the second case, the Markov model was superior in terms of the divergence (0.02), as compared to 0.09 in the worst case for the neural model. Moreover, the former approach outperformed the latter model by the rolling entropy metric as well, showing similar periodicity and amplitude to the original traffic, whereas the neural model had lower values without explicit periodicity. Conclusions. Overall, the model based on a recurrent neural network can be adapted for network traffic modeling under condition of proper parameter selection and training procedure. However, in the framework of the performed simulation, the hidden Markov model exhibited better performance.