# Characteristic Analysis and Modeling of Network Traffic for the Electromagnetic Launch System

Authors: Yao Lu; Hanhong Jiang; Tao Liao; Chengcheng Xu; Chen Deng
Journal: Mathematical Problems in Engineering
 (2019)

---

## Abstract

The electromagnetic launch system (EMLS) is a kind of large-scale complex system with strong mechanical, electrical, and hydraulic coupling. The effective operation of the system requires the support of advanced and reliable health management system, and the function of the health management system relies on the network traffic to complete data transmission and interaction. Through protocol filtering and time-frequency characteristic analysis of network traffic, it is found that the system mainly includes CIP and TCP; traffic of CIP shows continuity and stability, while traffic of TCP shows sparsity and impact. Based on the analysis of traffic characteristics, an SVR-ARMA network traffic model is established, which improves the prediction accuracy and performance of network traffic and provides a reliable technical guarantee for the fault diagnosis and health management of the EMLS.


---

## Body

## 1. Introduction

The electromagnetic launching system is a kind of launching technology that converts electromagnetic energy into the kinetic energy of the payload by using electromagnetic energy to do work. The system represented by the EMLS has the characteristics of large scale, high complexity, and strong mechanical, electrical, and hydraulic coupling [1, 2], and its development, production, and maintenance costs are increasingly high. The increase of system complexity will inevitably lead to the increase of failure rate. Without the support of advanced and reliable health management system, the reduction of effective running time ratio of the EMLS is unacceptable. The existing health management functions include data acquisition, data monitoring, data presentation, fault alarm, and recording. The realization of these functions relies on network traffic to complete data transmission and interaction. To improve network performance, it is necessary to analyze and study network traffic characteristics, which can effectively reflect network performance and system operation [3]. The establishment of relevant traffic model on this basis is conducive to improving the stability, reliability, and operation efficiency of the network system in long-term operation [4]. It plays a fundamental supporting role in improving network performance and making full use of network resources and provides reliable technical guarantee for the fault diagnosis and health management of the EMLS.Previous studies on network traffic model can be divided into linear model and nonlinear model. Linear models include Poisson model and Markov process model, and traffic characteristics have short correlation [5, 6]. Nonlinear models include ON/OFF model with heavy tail distribution and fractal Brownian motion model, and traffic characteristics have long correlation and self-similarity [7–10]. The current research focus on traffic modeling has shifted to the problem of traffic modeling for all kinds of new networks. James et al. [11] studied the modeling problem under the traffic of denial of service attack. Ghandali et al. [12] studied traffic modeling in the network of multimedia data transmission. Cho et al. [13] proposed the traffic model of the sink node of the enterprise network to solve the problem of traffic anomaly detection. Addie et al. [14] studied the traffic modeling problem of transparently transmitted optical Internet. It can be seen that the model study of network traffic will continue to evolve with the changes in the types and characteristics of network services. Each model has only the most suitable network type to describe, and there is no universal network traffic model.The transmission of network traffic is affected by network topology, communication protocol, service type, and other factors, and the traffic characteristics are different. It is necessary to learn from the previous research results and establish the corresponding traffic model according to the traffic characteristics of the EMLS.


## 2. Analysis of Traffic Characteristics of the EMLS Network

### 2.1. Network Traffic Collection and Processing

The characteristic of the EMLS is the combination of periodic steady state and aperiodic transient state. Network traffic data are mainly state data and recorded data. The state data is a kind of data with sampling frequency of 1Hz and recorded in time, corresponding to the periodic steady state process. The recorded data is a kind of data with sampling frequency of 2kHz and only recorded before and after the occurrence of events (includes launch, maintenance testing, and failure events) and the process of a few seconds, corresponding to the aperiodic transient process. As far as the test environment permits, packet capturing software is run on the device side of the EMLS to analyze the packets captured. Each operating mode (OM) takes three minutes as the acquisition time. The statistical results of packet capturing under multiple different operating modes are shown in Table1.Table 1
Packets captured under different operating mode.
OM Network protocol type NTP NBNS UDP SMB CIP TCP 1 6 15 7 4974 36673 33612 2 6 42 5 5713 37187 33917 3 6 35 0 5783 37673 41300 4 6 13 0 5403 35929 40971 5 8 34 9 7000 35053 51029 6 9 13 7 8280 37369 63518 7 6 13 2 6980 36932 60498 8 6 43 7 8930 38250 82283 9 8 78 36 15820 34799 127507As can be seen from Table1, the data packets captured under different operating modes are quite different, but SMB, CIP, and TCP are the three protocol types that account for the vast majority, more than 99%. In Table 1, operating mode 2 is a typical working condition, and the data analysis below is based on the data of this operating mode.SupposeL(t) is the packet size captured at timet,fs is the sampling frequency, and Δt is the sampling interval; then the network trafficx(t) at timet is approximately(1)xt≈1Δt∑τ=tt+ΔtLτConsidering the requirements of the actual frequency resolution of the EMLS and the limitation of the calculation amount, the sampling frequency is taken as 50Hz (i.e., the sampling interval is 0.02s). The traffic obtained by processing according to the above algorithm is shown in Figure1. It can be seen from the figure that the network traffic starts from about 68s and reaches a peak from 73s to 78s, and then the sudden traffic ends and the system returns to a steady state.Figure 1
Logarithmic diagram of traffic waveform.The network traffic is filtered by protocol, and the traffic waveforms of CIP and TCP are extracted, respectively, as shown in Figures2 and 3. It can be seen that the two types of protocol traffic have obviously different characteristics; CIP traffic has obvious continuity and stationarity, while TCP traffic has sparsity and impact.Figure 2
Traffic waveform of CIP.Figure 3
Traffic waveform of TCP.


### 2.2. Time-Frequency Analysis of Network Traffic

Time-frequency representation is a method of representing signals by introducing a joint function of time and frequency. Time-frequency analysis can not only analyze the local spectrum characteristics of the signal, but also analyze the frequency time-varying characteristics of the traffic. It is very suitable for analyzing the network characteristics of the EMLS.In this paper, the short-time Fourier transform (STFT) is employed to analyze the traffic characteristics of EMLS. STFT is a localized time-frequency analysis method, which firstly divides the signal into several fixed size time windows, and then Fourier transform is used to analyze the frequency existing in each time window.Define the window functionγ(t)∈L2(R),  γ^(ω)∈L2(R),  tγ(t)∈L2(R),  ωγ^(ω)∈L2(R); then for the time signalx(t)(2)STFTxt,ω=∫-∞∞xτγ∗τ-te-iωτdτ(3)STFTxt,f=∫-∞∞xτγ∗τ-te-i2πfτdτwhereSTFTx(t,f) is the spectrum of local signalx(t) in a time window near timet. The size of the window function determines the degree of proximity to timet, and its energy density spectrum is(4)SPxt,f=STFTxt,f2=∫-∞∞xτγ∗τ-te-i2πfτdτ2The network traffic of CIP and TCP obtained in Section2.1 is transformed by STFT, and their time-frequency characteristics are analyzed. Gaussian window function is selected as the window function, and the window radius is set as 0.05 of the total data length. The results are shown in Figures 4–6.Figure 4
STFT spectrum of CIP in 30 seconds in 1% threshold.Figure 5
STFT spectrum of TCP in 30 seconds without impact traffic in 10% threshold.Figure 6
STFT spectrum of TCP in 30 seconds with impact traffic in 0.1% threshold.Figure4 shows the STFT spectrum of CIP. The left figure shows the frequency domain waveform, the top-right figure shows the time domain waveform, and the bottom-right figure shows the contour diagram of the time-frequency characteristics. As seen in Figure 4, the network traffic of CIP shows strong randomness in time domain. In the frequency domain, it shows a stable periodicity, and the main energy is concentrated in the low frequency band. Other high energy frequency points are concentrated at 2Hz, 4Hz, 8Hz, 10Hz, and 12Hz, where the amplitude at 10Hz is the largest, which is consistent with the software setting of CIP communication cycle in the EMLS.Due to the obvious shock traffic of TCP in the aperiodic transient process, the extremely high peak traffic will annihilate other protocol traffic and TCP needs to be divided into two periods for analysis. Figure5 shows the STFT spectrum of TCP in a nonimpact period of 30s. In the time domain, there is a good periodicity. However, according to the results of frequency domain analysis, the spectral lines are messy, the harmonic components are high, the frequency band distribution is wide, and the effective frequency exceeds Nyquist frequency (half of sampling frequency, which is 25Hz). When the sampling frequency is increased to 100Hz, the spectrum line distribution obtained also occupies the entire frequency band. Therefore, it can be inferred that there is no significant attenuation of the high frequency band in the nonimpact period. Due to uneven distribution of the segment traffic spectrum with time, obvious discontinuities, and frequency drift, and the drifting time corresponds to the sudden change of network traffic; it can be inferred that the phenomenon is caused by special traffic control mechanism of TCP, which may be one of the reasons that TCP traffic has self-similarity and long correlation.Figure6 shows the STFT spectrum of TCP in the impact period of 30s. It can be seen that the spectrum of impact traffic is mainly distributed in the low frequency band less than 5Hz. Since the energy at impact is too large, the spectral lines at other times are annihilated; the spectral lines at nonimpact time can not be seen in the figure. It is found that the waveform of TCP traffic during the impact period has a certain randomness, but the peak value of spectrum is basically kept at the same level, which indicates that the total traffic generated in each operating mode is basically consistent.It can be seen from the above analysis that the Ethernet of the EMLS presents a relatively stable characteristic in the periodic steady state; the main transmission in the link is CIP and a small number of TCP packets. In the aperiodic transient state, the characteristics of shock are presented. TCP packets are mainly transmitted in the link, while the CIP packets remains basically unchanged. Overall, the EMLS has a more complex traffic periodic and traffic impact. The periodicity is caused by the periodicity of the state data uploaded from the bottom equipment such as network controller and reinforcement machine to the top machine. The impact is caused by the fact that when the EMLS is in operation, the bottom equipment will upload a large number of recorded data within seconds, which will result in multiple growth of network traffic, causing the impact of traffic on the aggregation link. The analysis of the network traffic characteristics provides basis for the selection of Ethernet link bandwidth and switching equipment and has reference significance for network design.


## 2.1. Network Traffic Collection and Processing

The characteristic of the EMLS is the combination of periodic steady state and aperiodic transient state. Network traffic data are mainly state data and recorded data. The state data is a kind of data with sampling frequency of 1Hz and recorded in time, corresponding to the periodic steady state process. The recorded data is a kind of data with sampling frequency of 2kHz and only recorded before and after the occurrence of events (includes launch, maintenance testing, and failure events) and the process of a few seconds, corresponding to the aperiodic transient process. As far as the test environment permits, packet capturing software is run on the device side of the EMLS to analyze the packets captured. Each operating mode (OM) takes three minutes as the acquisition time. The statistical results of packet capturing under multiple different operating modes are shown in Table1.Table 1
Packets captured under different operating mode.
OM Network protocol type NTP NBNS UDP SMB CIP TCP 1 6 15 7 4974 36673 33612 2 6 42 5 5713 37187 33917 3 6 35 0 5783 37673 41300 4 6 13 0 5403 35929 40971 5 8 34 9 7000 35053 51029 6 9 13 7 8280 37369 63518 7 6 13 2 6980 36932 60498 8 6 43 7 8930 38250 82283 9 8 78 36 15820 34799 127507As can be seen from Table1, the data packets captured under different operating modes are quite different, but SMB, CIP, and TCP are the three protocol types that account for the vast majority, more than 99%. In Table 1, operating mode 2 is a typical working condition, and the data analysis below is based on the data of this operating mode.SupposeL(t) is the packet size captured at timet,fs is the sampling frequency, and Δt is the sampling interval; then the network trafficx(t) at timet is approximately(1)xt≈1Δt∑τ=tt+ΔtLτConsidering the requirements of the actual frequency resolution of the EMLS and the limitation of the calculation amount, the sampling frequency is taken as 50Hz (i.e., the sampling interval is 0.02s). The traffic obtained by processing according to the above algorithm is shown in Figure1. It can be seen from the figure that the network traffic starts from about 68s and reaches a peak from 73s to 78s, and then the sudden traffic ends and the system returns to a steady state.Figure 1
Logarithmic diagram of traffic waveform.The network traffic is filtered by protocol, and the traffic waveforms of CIP and TCP are extracted, respectively, as shown in Figures2 and 3. It can be seen that the two types of protocol traffic have obviously different characteristics; CIP traffic has obvious continuity and stationarity, while TCP traffic has sparsity and impact.Figure 2
Traffic waveform of CIP.Figure 3
Traffic waveform of TCP.


## 2.2. Time-Frequency Analysis of Network Traffic

Time-frequency representation is a method of representing signals by introducing a joint function of time and frequency. Time-frequency analysis can not only analyze the local spectrum characteristics of the signal, but also analyze the frequency time-varying characteristics of the traffic. It is very suitable for analyzing the network characteristics of the EMLS.In this paper, the short-time Fourier transform (STFT) is employed to analyze the traffic characteristics of EMLS. STFT is a localized time-frequency analysis method, which firstly divides the signal into several fixed size time windows, and then Fourier transform is used to analyze the frequency existing in each time window.Define the window functionγ(t)∈L2(R),  γ^(ω)∈L2(R),  tγ(t)∈L2(R),  ωγ^(ω)∈L2(R); then for the time signalx(t)(2)STFTxt,ω=∫-∞∞xτγ∗τ-te-iωτdτ(3)STFTxt,f=∫-∞∞xτγ∗τ-te-i2πfτdτwhereSTFTx(t,f) is the spectrum of local signalx(t) in a time window near timet. The size of the window function determines the degree of proximity to timet, and its energy density spectrum is(4)SPxt,f=STFTxt,f2=∫-∞∞xτγ∗τ-te-i2πfτdτ2The network traffic of CIP and TCP obtained in Section2.1 is transformed by STFT, and their time-frequency characteristics are analyzed. Gaussian window function is selected as the window function, and the window radius is set as 0.05 of the total data length. The results are shown in Figures 4–6.Figure 4
STFT spectrum of CIP in 30 seconds in 1% threshold.Figure 5
STFT spectrum of TCP in 30 seconds without impact traffic in 10% threshold.Figure 6
STFT spectrum of TCP in 30 seconds with impact traffic in 0.1% threshold.Figure4 shows the STFT spectrum of CIP. The left figure shows the frequency domain waveform, the top-right figure shows the time domain waveform, and the bottom-right figure shows the contour diagram of the time-frequency characteristics. As seen in Figure 4, the network traffic of CIP shows strong randomness in time domain. In the frequency domain, it shows a stable periodicity, and the main energy is concentrated in the low frequency band. Other high energy frequency points are concentrated at 2Hz, 4Hz, 8Hz, 10Hz, and 12Hz, where the amplitude at 10Hz is the largest, which is consistent with the software setting of CIP communication cycle in the EMLS.Due to the obvious shock traffic of TCP in the aperiodic transient process, the extremely high peak traffic will annihilate other protocol traffic and TCP needs to be divided into two periods for analysis. Figure5 shows the STFT spectrum of TCP in a nonimpact period of 30s. In the time domain, there is a good periodicity. However, according to the results of frequency domain analysis, the spectral lines are messy, the harmonic components are high, the frequency band distribution is wide, and the effective frequency exceeds Nyquist frequency (half of sampling frequency, which is 25Hz). When the sampling frequency is increased to 100Hz, the spectrum line distribution obtained also occupies the entire frequency band. Therefore, it can be inferred that there is no significant attenuation of the high frequency band in the nonimpact period. Due to uneven distribution of the segment traffic spectrum with time, obvious discontinuities, and frequency drift, and the drifting time corresponds to the sudden change of network traffic; it can be inferred that the phenomenon is caused by special traffic control mechanism of TCP, which may be one of the reasons that TCP traffic has self-similarity and long correlation.Figure6 shows the STFT spectrum of TCP in the impact period of 30s. It can be seen that the spectrum of impact traffic is mainly distributed in the low frequency band less than 5Hz. Since the energy at impact is too large, the spectral lines at other times are annihilated; the spectral lines at nonimpact time can not be seen in the figure. It is found that the waveform of TCP traffic during the impact period has a certain randomness, but the peak value of spectrum is basically kept at the same level, which indicates that the total traffic generated in each operating mode is basically consistent.It can be seen from the above analysis that the Ethernet of the EMLS presents a relatively stable characteristic in the periodic steady state; the main transmission in the link is CIP and a small number of TCP packets. In the aperiodic transient state, the characteristics of shock are presented. TCP packets are mainly transmitted in the link, while the CIP packets remains basically unchanged. Overall, the EMLS has a more complex traffic periodic and traffic impact. The periodicity is caused by the periodicity of the state data uploaded from the bottom equipment such as network controller and reinforcement machine to the top machine. The impact is caused by the fact that when the EMLS is in operation, the bottom equipment will upload a large number of recorded data within seconds, which will result in multiple growth of network traffic, causing the impact of traffic on the aggregation link. The analysis of the network traffic characteristics provides basis for the selection of Ethernet link bandwidth and switching equipment and has reference significance for network design.


## 3. Network Traffic Model of the EMLS Based on SVR-ARMA

Based on the analysis of the network traffic characteristics of the EMLS, the wavelet decomposition method is adopted to decompose the network traffic into a trend traffic and the sum of each detail traffic. In order to improve the prediction accuracy and calculation speed of the network traffic, SVR model and ARMA model are used to predict the trend traffic and detail traffic, respectively, according to the different characteristics of the trend traffic and detail traffic. The advantages of the two models are used to ensure better function approximation and avoid overfitting of detailed signals. The SVR-ARMA model is shown in Figure7.Figure 7
The block diagram of SVR-ARMA model.The specific algorithm steps of SVR-ARMA model are as follows:① The network traffic is taken as the original sample, which is divided into training sample and test sample.② According to the actual situation, the appropriate mother wavelet coefficients and the decomposition layers are selected, and then the training samples are decomposed by wavelet to obtain the high frequency coefficient sequences and low frequency coefficient sequences.③ The coefficients obtained in step ② are reconstructed using the wavelet inverse transform pair to obtain the detailed traffic rate and trend traffic rate.④ SVR algorithm is used to model the trend traffic, and ARMA algorithm is used to model the detailed traffic. Then, linear combination of the predicted results of each component is conducted to obtain the final predicted results of network traffic:(5)x^=a^n+∑i=1nd^nwherea^n is the prediction result of the trend traffic signal and d^1~d^n are the prediction results of the detail traffic signal of each layer.⑤ Compared the predicted results with the actual network traffic, and the prediction error is analyzed and studied.


## 4. Test Verification and Comparative Analysis

### 4.1. Source of the Test Data

The test data come from the traffic collected in Ethernet of the EMLS, and the sampling frequency is 50Hz. 2000 data points with typical representativeness are selected randomly and continuously from the original data as the test samples, and the waveform is shown in Figure8. The first 1900 points from the original data are selected as training samples for modeling, and the last 100 data are used as test samples to verify the effectiveness of the model.Figure 8
Traffic waveform of a test sample.


### 4.2. Model Prediction of SVR-ARMA

Aiming at the data points of the first 1900 training samples, fast Mallat algorithm is adopted to carry out wavelet decomposition, and the number of decomposition layers is selected as 5,db4 is selected as the decomposition and reconstruction of the parent wavelet function, and the trend traffic signal parta5 and the detail traffic signal partd1 ~d5 of each layer could be obtained.SVR model is adopted to predict the trend traffic signal parta5. After the normalization ofa5, the radial basis function of g = 0.5 is selected as the kernel function. After several tests on the parameters of SVR model, it is finally determined that the other parameters of SVR model are taken as ε=0.2 and C = 10. The prediction results ofa5 can be obtained by establishing the simulation training of SVR.ARMA model is adopted to predict thed1~d5 of the detail traffic signal of each layer. The good linearity of ARMA model is very suitable for the prediction and analysis of stationary time series. Let the traffic signal d=∑i=15di be the sum of the parts of the detailed traffic signal. By calculating the autocorrelation function and partial autocorrelation function ofd, it can be identified thatd conforms to the AR(3) model (namely, ARMA(3,0) model) according to the trailing and truncating characteristics of the autocorrelation function and partial autocorrelation function. Then the prediction results ofd can be obtained by modeling and predicting the detailed traffic signal part.The predicted results obtained by SVR model and ARMA model are combined linearly according to (5), and the final predicted traffic is compared with the actual traffic. The comparison results are shown in Figure 9.Figure 9
Contrast of predicted traffic and actual traffic.From the comparison results in Figure9, it can be seen that the SVR-ARMA combined prediction model fits well for the main trend of sample traffic, but the details have certain fluctuation due to the large suddenness. This is because the wavelet decomposition decomposes the network traffic signals with high randomness and nonlinearity into multiple traffic signals with single frequency components, which reduces the interference between partial signals of different frequencies and thus effectively improves the prediction accuracy.


### 4.3. Cross Validation

In order to cross-verify the prediction effect of the combined model, the single SVR prediction model, the single ARMA prediction model, and the Backpropagation Neural Network (BPNN) model are used for comparison, and the prediction results are evaluated by the Mean Relative Error (MRE):(6)MRE=1n∑i=1nxi-x^ixiThe predicted results of each model are shown in Table2. The differences between training MRE and test MRE of different models are determined by the characteristics. ARMA model has a good effect on the traffic prediction of linear characteristics, especially for the short-time prediction with high accuracy and speed, while it has a poor effect on the nonlinear or impact traffic prediction. The advantages of SVR model are high prediction accuracy and good generalization ability. Thus for impact traffic like EMLS, the training MRE and test MRE of SVR are better than ARMA. For BPNN, because of the contradiction between prediction ability and training ability, the fitting error is small, but the test sample error goes up, which is not suitable for EMLS. The SVR-ARMA model has the lowest training MRE and test MRE and the best prediction effect.Table 2
Comparison of prediction errors of each model.
Model Training MRE Test MRE SVR 0.136 0.164 ARMA 0.192 0.252 BPNN 0.127 0.186 SVR-ARMA 0.102 0.137


## 4.1. Source of the Test Data

The test data come from the traffic collected in Ethernet of the EMLS, and the sampling frequency is 50Hz. 2000 data points with typical representativeness are selected randomly and continuously from the original data as the test samples, and the waveform is shown in Figure8. The first 1900 points from the original data are selected as training samples for modeling, and the last 100 data are used as test samples to verify the effectiveness of the model.Figure 8
Traffic waveform of a test sample.


## 4.2. Model Prediction of SVR-ARMA

Aiming at the data points of the first 1900 training samples, fast Mallat algorithm is adopted to carry out wavelet decomposition, and the number of decomposition layers is selected as 5,db4 is selected as the decomposition and reconstruction of the parent wavelet function, and the trend traffic signal parta5 and the detail traffic signal partd1 ~d5 of each layer could be obtained.SVR model is adopted to predict the trend traffic signal parta5. After the normalization ofa5, the radial basis function of g = 0.5 is selected as the kernel function. After several tests on the parameters of SVR model, it is finally determined that the other parameters of SVR model are taken as ε=0.2 and C = 10. The prediction results ofa5 can be obtained by establishing the simulation training of SVR.ARMA model is adopted to predict thed1~d5 of the detail traffic signal of each layer. The good linearity of ARMA model is very suitable for the prediction and analysis of stationary time series. Let the traffic signal d=∑i=15di be the sum of the parts of the detailed traffic signal. By calculating the autocorrelation function and partial autocorrelation function ofd, it can be identified thatd conforms to the AR(3) model (namely, ARMA(3,0) model) according to the trailing and truncating characteristics of the autocorrelation function and partial autocorrelation function. Then the prediction results ofd can be obtained by modeling and predicting the detailed traffic signal part.The predicted results obtained by SVR model and ARMA model are combined linearly according to (5), and the final predicted traffic is compared with the actual traffic. The comparison results are shown in Figure 9.Figure 9
Contrast of predicted traffic and actual traffic.From the comparison results in Figure9, it can be seen that the SVR-ARMA combined prediction model fits well for the main trend of sample traffic, but the details have certain fluctuation due to the large suddenness. This is because the wavelet decomposition decomposes the network traffic signals with high randomness and nonlinearity into multiple traffic signals with single frequency components, which reduces the interference between partial signals of different frequencies and thus effectively improves the prediction accuracy.


## 4.3. Cross Validation

In order to cross-verify the prediction effect of the combined model, the single SVR prediction model, the single ARMA prediction model, and the Backpropagation Neural Network (BPNN) model are used for comparison, and the prediction results are evaluated by the Mean Relative Error (MRE):(6)MRE=1n∑i=1nxi-x^ixiThe predicted results of each model are shown in Table2. The differences between training MRE and test MRE of different models are determined by the characteristics. ARMA model has a good effect on the traffic prediction of linear characteristics, especially for the short-time prediction with high accuracy and speed, while it has a poor effect on the nonlinear or impact traffic prediction. The advantages of SVR model are high prediction accuracy and good generalization ability. Thus for impact traffic like EMLS, the training MRE and test MRE of SVR are better than ARMA. For BPNN, because of the contradiction between prediction ability and training ability, the fitting error is small, but the test sample error goes up, which is not suitable for EMLS. The SVR-ARMA model has the lowest training MRE and test MRE and the best prediction effect.Table 2
Comparison of prediction errors of each model.
Model Training MRE Test MRE SVR 0.136 0.164 ARMA 0.192 0.252 BPNN 0.127 0.186 SVR-ARMA 0.102 0.137


## 5. Conclusion

This paper firstly analyzes the traffic characteristics of different protocols in the EMLS network and analyzes the causes of the traffic characteristics. Based on the study of traffic characteristics, a network traffic model based on SVR-ARMA is proposed, which improves the prediction accuracy and the prediction performance of network traffic and provides reliable technical support for the fault diagnosis and health management of the EMLS.



---

*Source: 2929457-2019-06-23.xml*