# Analysis and Prediction of the IPv6 Traffic over Campus Networks in Shanghai
## 4 IPv6 Traffic Prediction Model
### The LS6 Model
#### 4.2.2 Traffic Encoding  
The traffic encoding component is responsible for extracting traffic features with deep learning and statistical methods. RNNs such as LSTM can extract features automatically, while SARIMA provides a better theoretical interpretation for time series prediction problems [15]. Thus, we consider both LSTM and SARIMA as extractors of network traffic features in the traffic encoding module.  
As traffic prediction is a time series prediction problem, an RNN, which can extract the sequential feature, is often used to solve such problems. We pick LSTM, a representative RNN, as the deep learning method to predict traffic volume and regard the prediction as a feature. LSTM is a variant of RNN for vanishing gradient problems, which has been widely used in time series prediction [23; 25; 51]. Figure 5(a) shows that each LSTM cell consists of three gates--the forget gate, the input gate, and the output gate. The cell state \(C_{t}\) and hidden state \(h_{t}\) for the current cell are generated by \(C_{t-1}\) and \(h_{t-1}\) from the last cell and input \(x_{t}\) passing through the three gates. The forget gate selectively bars the state value  
Figure 5: System design of LS6.  
from the previous time step \(C_{t-1}\). The input gate decides which information is added to \(C_{t}\). The output gate integrates the information from the forget gate and the input gate to get the output \(h_{t}\). As shown in Figure 6b, one layer of the LSTM network is formed by chained LSTM cells. Each cell receives the previous cell state and hidden state and then generates a new cell state and hidden state for the next cell. The number of data observations used for prediction is disclosed by the number of cells in an LSTM network. The mathematical expressions of LSTM are shown as follows:  
\[f_{t}=\sigma(W_{f}x_{t}+U_{f}h_{t-1}+b_{f}) \tag{5}\]  
\[i_{t}=\sigma(W_{i}x_{t}+U_{i}h_{t-1}+b_{i}) \tag{6}\]  
\[o_{t}=\sigma(W_{o}x_{t}+U_{o}h_{t-1}+b_{o}) \tag{7}\]  
where \(x_{t}\) is the current input and \(h_{t-1}\) is the previous hidden state. \(f_{t}\), \(i_{t}\), and \(o_{t}\) are the output of the forget, input, and output gates, respectively. \(\{W_{f},U_{f},b_{f}\}\), \(\{W_{i},U_{i},b_{i}\}\), and \(\{W_{o},U_{o},b_{o}\}\) are the parameters of the forget, input and output gates, respectively.  
\[\widetilde{C}_{t}=tanh(W_{c}x_{t}+U_{c}h_{t-1}+b_{c}) \tag{8}\]  
\[C_{t}=f_{t}*C_{t-1}+i_{t}*\widetilde{C} \tag{9}\]  
\[h_{t}=o_{t}*tanh(C_{t}) \tag{10}\]  
where \(\widetilde{C}_{t}\) is the candidate memory, \(C_{t}\) and \(h_{t}\) are the current cell memory and hidden state, and \(\{W_{c},U_{c},b_{c}\}\) are the parameters of the candidate memory network.  
Figure 6: (**a**) The structure of a long short-term memory cell. (**b**) The structure of a long short-term memory neural network.  
In our case, input \(x_{i}\) is the network traffic volume while the number of observations is the number of selected time steps, \(n\). The output of LSTM is the hidden state of the final cell (\(h_{n}\)) and is fed to a fully connected layer to get the prediction.  
We then leverage SARIMA [13] for traffic prediction. SARIMA (or seasonal ARIMA) is an extension of ARIMA, which can better forecast time series with periodicity. The SARIMA model can be defined by \(SARIMA(p,d,q)(P,D,Q)_{s}\), where \(p\) is the order of the non-seasonal autoregressive model, \(q\) is the order of non-seasonal moving average model, \(P\) is the order of seasonal autoregressive model, \(Q\) is the order of seasonal moving average model, \(d\) is the number of non-seasonal differences, \(D\) is the number of seasonal differences, and \(s\) is the periodic term. We feed both past IPv4 and IPv6 traffic data into SARIMA and LSTM, respectively, to acquire prediction results of the future traffic volume, which are regarded as traffic features of the next time slot.