# Network Traffic Forecasting in Network Cybersecurity: Granular Computing Model

Authors: Ali Alzahrani; Theyazn H. H Aldhyani; Saleh Nagi Alsubari; Ans D. Alghamdi
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Industry 4.0, also known as the Internet of Things, is a concept that encompasses the joint applicability of operation, the Internet, and information technologies to expand the efficiency expectation of automation to include green and flexible processes and innovative products and services. Industrial network infrastructures must be modified to accommodate extra traffic from a variety of technologies in order to achieve this integration. In order to successfully implement cutting-edge wireless technologies, high-quality service (QoS) must be provided to end users. It is thus important to keep an eye on the functioning of the whole network without impacting base station throughput. Improved network performance is constantly needed, even for already-deployed cellular networks, such as the 4th generation (4G) and 3rd generation (3G). For the purpose of forecasting network traffic, an integrated model based on the long short-term memory (LSTM) model was used to combine clustering rough k-means (RKM) and fuzzy c-means (FCM). Clustering granules derived from FCM and RKM were also utilized to examine the network data for each calendar year. The novelty of our proposed model is the integration of the prediction and forecasting results obtained using existing prediction models with centroids of clusters. The WIDE backbone network’s live network traffic statistics were used to evaluate the proposed solution. The integrated model’s outcomes were assessed using a variety of statistical markers, including mean square error (MSE), root mean square error (RMSE), and standard error. The suggested technique was able to provide findings that were very accurate. The prediction error of LSTM with FCM was less on the basis of the MSE of 0.00783 and RMSE of 0.0885 at the training phase, where the prediction values of LSTM with the RKM had an MSE of 0.00564 and RMSE of 0.7511. Finally, the suggested model may substantially increase the prediction accuracy attained using FCM and RKM clustering.


---

## Body

## 1. Introduction

Hasty traffic development and the existence of services with highly varied demands are expected to contribute to continuously changing traffic conditions and high bandwidth demands in future 5G networks [1, 2]. Network redimensioning has become a vital activity in such networks as a consequence of this dynamic. As a consequence, Internet providers must review and upgrade their capacity strategies regularly to anticipate capacity restrictions and obviate complications before the user experience is degraded. Techniques for intelligent capacity management are designed on a self-organizing network architecture that makes it much simpler [3, 4]. Such techniques are frequently applied in the network systems utilized by telecom service providers to handle network connections that require precise estimation of forthcoming traffic load and network abilities to forecast traffic variants. Thus, the network configuration could be updated in time regularly to ensure sufficient user satisfaction during all environmental changes. Capacity restrictions are discovered within radio access networks by correlating traffic predictions with a predefined limit indicating cell capacity, which triggers an alerting to warn of potential resource shortages. Furthermore, several replanning policies can be made on the basis of how far ahead the problem is identified. Short-term predictions frequently drive momentary changes in system network configurations. For example, a more optimal audio coding method [5] assumes new buffer configurations for traffic exchange across nearby cells [6] or naive traffic dispatchers for a reduced computational workload [7].In handling abrupt changes in traffic requirements, such as rapid setting schemes being provisional, with characteristics returning to their initial values once the network has returned to its normal state or responds as a partial fix if the problems continue, much more steady solutions based on network throughput connections are expected. On the other hand, long-term estimations estimate a scarcity of resources in advance, for instance, a few months, allowing more prospective strategies such as bandwidth extension [8], license continuation for the largest number of channel components, synchronous users [9], and/or new co-sited cells to be incorporated as future confirmation resolutions. As real-time user movement worldwide brings forth a massive spatially and temporally dynamic nature, forecasting cellular data packets in advanced metropolitan areas has now become a valuable way of assessing the efficiency of cells in cities. Accurate traffic forecasting throughout mobile networks could help mobile operators improve the success of resource utilization [10] and evaluate the capacity and connectivity of mobile network operators (MNOs).For example, the accuracy of future cellular traffic flow prediction benefits the effectiveness of demand-aware resource allocation [11], and traffic forecasting ensures that the predicted mobile and user capabilities will be performed even without capacity deadlock or usability evaluation destruction for MNOs to take into account. Machine learning (ML) has recently risen to prominence as a popular innovation aimed at balancing challenge computation costs with accuracy concerns, causing considerable consternation throughout the mathematical optimization field [12]. Scholars have been encouraged to apply restricted solutions to handle the challenges of wireless network optimization methodologies based on ML techniques [13].However, despite two probable issues, a conventional time series prediction model (e.g., the autoregressive integrated moving average (ARIMA) model or supervised neural network prediction model (e.g., the long short-term memory [LSTM] approach) was utilized in the current prediction model. The prediction performance of the classic model is low compared with that of the deep learning model, but the latter is time consuming and its accuracy is diminished once the number of features is minimized, making it unsuitable for low and small dimensional datasets [14]. Finally, we acknowledge that an exact and time-saving forecast model can be used to accomplish a competent capability of measuring network traffic prediction. Consequently, the aims of the present study were to apply a cohesive model depending on unsupervised and supervised ML techniques and using datasets from a radio access network, and to evaluate the model in the downlink network throughout the entire period. The suggested model is the same as various other supervised learning (SL) models that analyze the effectiveness of the algorithm in predicting data flow. Furthermore, our suggested prediction model appears to have an improved prediction performance rate compared to the reference model. Rough k-means (RMK) and fuzzy c-means (FCM) were introduced to deal with ambiguous items in this work. The LSTM model for forecasting network traffic was improved by including the centroids of clustering. Listed below are some of the primary advantages of the suggested system. It applies soft granular computing such as RKM and FCM clustering to address the ambiguity and thereby enhance the LSTM time series models.(1)
It predicts network traffic using a deep learning model like the LSTM model.(2)
The centroids of the soft computing methods were used with the prediction output from the LSTM model to obtain new prediction values.


## 2. Background of the Study

Cellular network traffic prediction can be considered a time series analysis task. Circuit-switched traffic modeling was first tackled by developing mathematical models depending on the historical data in previous research studies. ARIMA and other linear time series algorithms can be used to incorporate trends and quick dependencies in traffic requirements [15]. Another study presented an intelligent hypermodel for performing a time series analysis for wireless network traffic prediction, which was broadly investigated in reference [16]. Classic statistical learning approaches, machine-learning techniques, and evolutionary algorithms, which combine the preceding methods into one method, are the most commonly utilized techniques for network traffic prediction. The research articles are presented by references [17–19]. For example, supporting data-driven intelligence for performance analysis in a cellular network is considered. To anticipate call detailed information, the authors in reference [14] applied a causal investigation and LSTM paradigm. The authors of reference [20] focused on capturing and demonstrating the characteristics of network traffic prediction. A time-series analysis using cellular traffic and randomized rules divided into components was performed to examine the traffic flows in the network. Adopting a classic time series model called ARIMA [21], the authors identified the abnormality and estimated network performance by evaluating the prominent key performance indicators, but they did not provide an effective predictive rate or planning measurement. Instead, an empirical approach was introduced to predict downlink user capacity using driving test data obtained with a radiofrequency analyzer [22]. On the other hand, road tests should be conducted frequently to meet the regional influence of radiofrequency assessments (for illustration, a new building) or probably a network (e.g., a new cellular) in case of an emergency; as such, the road test is more time consuming and results in increased operational costs [23].A comparable study was reported [12], wherein four supervised ML (SML) techniques were contrasted against deep neural networks and line regression leveraging the download performance of LTE and 3G networks. The study discovered an excellent observation: the performance measure of the cell capacity of the deep neural network has been the worst, whereas the traditional SML techniques (i.e., random forest, KNN, and SVM) have been demonstrated to be efficient techniques. However, in their study, the authors only compared sophisticated SML algorithms without presenting their algorithm-based model for cell capacity assessment. The authors in reference [24] presented the k-means clustering and ARMA models. The k-means model was applied to classify wind directions and cluster weather circumstances. Furthermore, the real operating conditions of the wind turbine have not been taken into account. The authors [25] proposed deep belief networks and Gaussian models to represent network traffic temporal relationships over a mesh wireless communication network. Various methods have been used to address spatial relationships in network traffic. The setting is partitioned into a grid pattern [26], and traffic spatiotemporal relationships between the grid points are modeled using a convolutional neural network. In another study [27], a similar approach was used with additional nodes to the network to fuse extrinsic features such as population mobility patterns or temporal function areas. The spatiotemporal interdependence of traffic conveyed in grid cells is encoded using convolutional LSTM components and three-dimensional convolutional layers [28]. Other authors have analyzed the spatial interdependence of the traffic transmitted to various cells. The authors [29] used correlation selection with a general feature extractor mechanism to model spatial relationships between cells and an embedding approach to incorporate external information from various sources. To cope with inconsistent cell coverage, the authors in reference [30] modeled spatial coherence between cells using a graphical neural network dependent on cell tower range. Another study [31] proposed a graph-based method, in which traffic is segregated across inter- and in-tower segments. Deep learning-based models such as LSTM [32], convolutional neural networks [33], and recurrent neural networks [34] were used with coarser temporal intervals (i.e., an hour) to expand the prediction horizon to many days.


## 3. Materials and Methods

In this section, the methodology of the integrated model, which is used for network traffic prediction, is demonstrated. The LSTM model’s ability to anticipate network traffic has been boosted by the development of RKM and FCM, two integrated models that use soft clustering to increase prediction accuracy. The LSTM model’s trials are speculatively described in the integrated model. Figure1 depicts the proposed system’s overall structure (Algorithm 1).Figure 1
The proposed system’s architecture.Algorithm 1: Algorithm steps.
Let,Si be the sample of the network traffic on ith day.K is the number of clusterings in the FCM and RKM methods.Ci is the centroid of clustering with the FCM and RKM approaches.EPi is enhanced prediction.(1) Use soft computing with RKM and FCM.(2) Obtain the prediction values from the LSTM modelPi.(3) Determine the cluster membership of theith sample Si; let Si be the member of clusters j (Si ∈ kj). For the FCM and RKM granules, membership was determined appropriately.(4) Modify Pi usingCj, which is the centroid of the jth cluster EPi  = f(Pi, Cj).


### 3.1. Dataset

The data set used in this study was derived from real-world network traffic flowing across the WIDE backbone network. The MAWI working group is responsible for maintaining the WIDE backbone network repository. Specifically, we used data from the years 2012 to 2014, which were aggregated every hour and used for the present analysis. The Wireshark software was used to retrieve the numbers of packets sent and received. Table1 lists the dataset volumes. The dataset is available at this link: https://mawi.wide.ad.jp/mawi/.Table 1
Dataset volume.
YearVolume201236420133652014365


### 3.2. Normalization Method

The complexity and variation of the network traffic have created the same challenges in determining the regularity of the explanatory principle of the network traffic flow. Nevertheless, the transformation behavior observed in the networks has raised the prospect of improving network traffic prediction models in the near future. Several data transformations have been examined, and we demonstrate that the natural logarithm (log) of the data sets has the best performance across all models and samples. Most data sets are scaled as a result of the data preprocessing phase. By scaling, instances of larger numerical ranges can be prevented from dominating instances in smaller numerical ranges, and numerical issues can be avoided throughout the development process of the prediction model. Scaling the data in MATLAB was accomplished using the natural logarithm. Figure2 shows the original data from 2012 to 2014 after normalization was applied.Figure 2
Network traffic after normalization in (a) 2021, (b) 2023, and (c) 2014.
(a)(b)(c)


### 3.3. Clustering Approaches

The most significant recent advances in time series clustering can be grouped into three categories: entire, subsequence, and time point clustering. Whole-time series clustering is used to arrange object time series into distinct groups based on their commonalities. Items in a time-series data collection that reflect subsequences are grouped together in a subsequence time series clustering. A sliding window, a collection of segments from the lengthy time series, is used to extract the subsequences of items for the subsequence time series. It is possible to group objects at precise points in time using the time point clustering approach, which relies on both their temporal closeness and the similarity of their corresponding values. Because it makes use of time-series data, this time series clustering is comparable to time series segmentation. Part of the data is treated as noise in time point clustering, in contrast to segmentation, which requires all objects to be assigned to a cluster. How to categorize a vast quantity of time-series data and make the findings understandable are among the most important issues in subsequence clustering of time series. Subsequence time series clustering has been the focus of most recent research efforts. Sequence time series clustering may be used to find patterns in time-series data. This strategy is used owing to its effectiveness and efficiency in managing time-series data to achieve positive outcomes.In this study, soft clustering approaches were applied to handle ambiguous objects from the network dataset to improve the LSTM model. To improve the performance of standard time series models, we propose a strategy that focuses on clustering centroids. In refining time series models, our strategy is more practicable than the others. Figure3 shows ambiguous objects of three classes and those not belonging to any class.Figure 3
Sample of ambiguous objects.


#### 3.3.1. RKM Clustering

In the suggested RKM clustering method, a simplek-means clustering algorithm is used [35]. With the addition of rough centroid calculations based on distance ratios as new recommendations to distinguish between closely spaced points [36] improved on the algorithm originally proposed. RKM and ECM clustering techniques were used by Theyazn et al. [37] to deal with large dimensional data. These techniques were utilized by Theyazn et al. [37] to deal with intrusion detection items that are confusing by nature. RKM is a technique used to sort out the cluster’s top border’s muddled items. Data clustering is done using lower and higher approximations. It is an RKM for everyone.(P1) An objectx⟶ that belongs to a lower approximation is called lower bound.(P2)x⇀ ∈ A¯ (c⟶i) = ⇒ c⟶ ∈ A¯ (c⟶i)(P3) An objectx⟶ does not belong to any lower bound.⇕x⟶ The term “upper bound” refers to anything that belongs to multiple upper approximations.The RKM approach was appropriate for improving the time series model for predicting network traffic. The RKM algorithm processes data intowlower and wupper, where the object vector v⟶ let (v⟶, c⟶j) and the centroid of clustering is c⟶j. Let d (v⟶, c⟶i) = min 1≤j≤ k d (v⟶, c⟶j). The ratios d (v⟶, c⟶j)/d (v⟶, c⟶j), 1 ≤ I, j ≤ k, are used to determine the membership of v⟶. Let T = {j:d (v⟶, c⟶j)/d (v⟶) ≥ threshold and i≠j. The correct clustering object is clustered into the lower bound, and the ambiguous object is clustered into the upper bound. A snapshot of the results of the RKM is shown in Figure 4.Figure 4
Snapshot of the results of the RKM model.


#### 3.3.2. Fuzzy c-Means

In the fuzzy clustering approach, a candidate data item value can be a member of more than one cluster at the same time, with membership degrees ranging from 0 to 1. Different degrees of membership values can be provided for an item in several clusters using the FCM technique, which results in an overall coefficient value of 1 [38]. The following objective function is minimized in the fuzzy c-means approach:(1)Jm=∑i=1N∑j=1CUijxi−cj2,1≤m<∞,Uij=1∑k=1cxi−cj/xi−cj2/m−1,cj=∑i=1NUijm−xi∑i=1NUijm,where m is the real number greater than 1, Uij is the membership function, xixi is the sample of data, and cj is the centroid of clustering number.


### 3.4. Long Short-Term Memory

The LSTM layer has a large number of series LSTM units, collectively referred to as the LSTM model [39–41]. Three multiplicative units are contained within the LSTM models: first, the input gate, which is used to store information from the current time; second, the output gate, which is responsible for displaying the results; third, the forget gate, which is used to select some already forgotten information from the past. The sigmoid function and dot product operation are the building blocks of multiplication. Sigmoid functions have a range of values from 0 to 1, whereas the dot product operation determines how much information must be sent over the wire. 0 indicates that no information is communicated, whereas 1 indicates that the information is conveyed. Dot product operations are defined as follows: 0 indicates no transmission of information and 1 indicates information transfer:(2)ft=σwfht−1,xt+bf,it=σwiht−1,xt+bi,Ct˜=tanhwCht−1,xt+bC,Ct=ft∗Ct−1+it∗Ct˜,ot=σwoht−1,xt+bo,ht=ot∗tanhCt,where it, ft, and ot respectively represent the input, forget, and output gates, and ht represents the number of hidden layers included inside the cells. wf, wowc, and Ct are the representations of the weighted neural network, while the internal memory cell for the hidden layer is denoted by the letter Ct. The values bf and bo represent the bias of the neural network, while xt is the data representing the traffic on the network. Figure 5 provides a representation of the LSTM architecture. The essential LSTM model parameters are listed in Table 2.Figure 5
LSTM architecture.Table 2
Parameters of the LSTM algorithm.
ParameterValueHidden layers150Delays[1–9]Shallow hidden layers[3000]Number of epochs250Batch size120Environment of the proposed modelCPUNumber of iterations350Dropout number0.5Optimization function of the proposed systemAdam


### 3.5. Model Evaluation

The metrics of mean error (ME), mean square error (MSE), root mean square error (RMSE), and standard error (std. error) served as the criterion for assessment. These performance measurements were used to compare the prediction and observation values:(3)MSE=1n∑i=1nyi,observ−yi,pred2,RMSE=∑i=1nyi,observ−yi,pred2n,ME=yi,observ−yi,pred,where yi,observyi,observ is the observation value, yi,predyi,pred is the predicted value, and NN is the number of samples.


## 3.1. Dataset

The data set used in this study was derived from real-world network traffic flowing across the WIDE backbone network. The MAWI working group is responsible for maintaining the WIDE backbone network repository. Specifically, we used data from the years 2012 to 2014, which were aggregated every hour and used for the present analysis. The Wireshark software was used to retrieve the numbers of packets sent and received. Table1 lists the dataset volumes. The dataset is available at this link: https://mawi.wide.ad.jp/mawi/.Table 1
Dataset volume.
YearVolume201236420133652014365


## 3.2. Normalization Method

The complexity and variation of the network traffic have created the same challenges in determining the regularity of the explanatory principle of the network traffic flow. Nevertheless, the transformation behavior observed in the networks has raised the prospect of improving network traffic prediction models in the near future. Several data transformations have been examined, and we demonstrate that the natural logarithm (log) of the data sets has the best performance across all models and samples. Most data sets are scaled as a result of the data preprocessing phase. By scaling, instances of larger numerical ranges can be prevented from dominating instances in smaller numerical ranges, and numerical issues can be avoided throughout the development process of the prediction model. Scaling the data in MATLAB was accomplished using the natural logarithm. Figure2 shows the original data from 2012 to 2014 after normalization was applied.Figure 2
Network traffic after normalization in (a) 2021, (b) 2023, and (c) 2014.
(a)(b)(c)


## 3.3. Clustering Approaches

The most significant recent advances in time series clustering can be grouped into three categories: entire, subsequence, and time point clustering. Whole-time series clustering is used to arrange object time series into distinct groups based on their commonalities. Items in a time-series data collection that reflect subsequences are grouped together in a subsequence time series clustering. A sliding window, a collection of segments from the lengthy time series, is used to extract the subsequences of items for the subsequence time series. It is possible to group objects at precise points in time using the time point clustering approach, which relies on both their temporal closeness and the similarity of their corresponding values. Because it makes use of time-series data, this time series clustering is comparable to time series segmentation. Part of the data is treated as noise in time point clustering, in contrast to segmentation, which requires all objects to be assigned to a cluster. How to categorize a vast quantity of time-series data and make the findings understandable are among the most important issues in subsequence clustering of time series. Subsequence time series clustering has been the focus of most recent research efforts. Sequence time series clustering may be used to find patterns in time-series data. This strategy is used owing to its effectiveness and efficiency in managing time-series data to achieve positive outcomes.In this study, soft clustering approaches were applied to handle ambiguous objects from the network dataset to improve the LSTM model. To improve the performance of standard time series models, we propose a strategy that focuses on clustering centroids. In refining time series models, our strategy is more practicable than the others. Figure3 shows ambiguous objects of three classes and those not belonging to any class.Figure 3
Sample of ambiguous objects.


### 3.3.1. RKM Clustering

In the suggested RKM clustering method, a simplek-means clustering algorithm is used [35]. With the addition of rough centroid calculations based on distance ratios as new recommendations to distinguish between closely spaced points [36] improved on the algorithm originally proposed. RKM and ECM clustering techniques were used by Theyazn et al. [37] to deal with large dimensional data. These techniques were utilized by Theyazn et al. [37] to deal with intrusion detection items that are confusing by nature. RKM is a technique used to sort out the cluster’s top border’s muddled items. Data clustering is done using lower and higher approximations. It is an RKM for everyone.(P1) An objectx⟶ that belongs to a lower approximation is called lower bound.(P2)x⇀ ∈ A¯ (c⟶i) = ⇒ c⟶ ∈ A¯ (c⟶i)(P3) An objectx⟶ does not belong to any lower bound.⇕x⟶ The term “upper bound” refers to anything that belongs to multiple upper approximations.The RKM approach was appropriate for improving the time series model for predicting network traffic. The RKM algorithm processes data intowlower and wupper, where the object vector v⟶ let (v⟶, c⟶j) and the centroid of clustering is c⟶j. Let d (v⟶, c⟶i) = min 1≤j≤ k d (v⟶, c⟶j). The ratios d (v⟶, c⟶j)/d (v⟶, c⟶j), 1 ≤ I, j ≤ k, are used to determine the membership of v⟶. Let T = {j:d (v⟶, c⟶j)/d (v⟶) ≥ threshold and i≠j. The correct clustering object is clustered into the lower bound, and the ambiguous object is clustered into the upper bound. A snapshot of the results of the RKM is shown in Figure 4.Figure 4
Snapshot of the results of the RKM model.


### 3.3.2. Fuzzy c-Means

In the fuzzy clustering approach, a candidate data item value can be a member of more than one cluster at the same time, with membership degrees ranging from 0 to 1. Different degrees of membership values can be provided for an item in several clusters using the FCM technique, which results in an overall coefficient value of 1 [38]. The following objective function is minimized in the fuzzy c-means approach:(1)Jm=∑i=1N∑j=1CUijxi−cj2,1≤m<∞,Uij=1∑k=1cxi−cj/xi−cj2/m−1,cj=∑i=1NUijm−xi∑i=1NUijm,where m is the real number greater than 1, Uij is the membership function, xixi is the sample of data, and cj is the centroid of clustering number.


## 3.3.1. RKM Clustering

In the suggested RKM clustering method, a simplek-means clustering algorithm is used [35]. With the addition of rough centroid calculations based on distance ratios as new recommendations to distinguish between closely spaced points [36] improved on the algorithm originally proposed. RKM and ECM clustering techniques were used by Theyazn et al. [37] to deal with large dimensional data. These techniques were utilized by Theyazn et al. [37] to deal with intrusion detection items that are confusing by nature. RKM is a technique used to sort out the cluster’s top border’s muddled items. Data clustering is done using lower and higher approximations. It is an RKM for everyone.(P1) An objectx⟶ that belongs to a lower approximation is called lower bound.(P2)x⇀ ∈ A¯ (c⟶i) = ⇒ c⟶ ∈ A¯ (c⟶i)(P3) An objectx⟶ does not belong to any lower bound.⇕x⟶ The term “upper bound” refers to anything that belongs to multiple upper approximations.The RKM approach was appropriate for improving the time series model for predicting network traffic. The RKM algorithm processes data intowlower and wupper, where the object vector v⟶ let (v⟶, c⟶j) and the centroid of clustering is c⟶j. Let d (v⟶, c⟶i) = min 1≤j≤ k d (v⟶, c⟶j). The ratios d (v⟶, c⟶j)/d (v⟶, c⟶j), 1 ≤ I, j ≤ k, are used to determine the membership of v⟶. Let T = {j:d (v⟶, c⟶j)/d (v⟶) ≥ threshold and i≠j. The correct clustering object is clustered into the lower bound, and the ambiguous object is clustered into the upper bound. A snapshot of the results of the RKM is shown in Figure 4.Figure 4
Snapshot of the results of the RKM model.


## 3.3.2. Fuzzy c-Means

In the fuzzy clustering approach, a candidate data item value can be a member of more than one cluster at the same time, with membership degrees ranging from 0 to 1. Different degrees of membership values can be provided for an item in several clusters using the FCM technique, which results in an overall coefficient value of 1 [38]. The following objective function is minimized in the fuzzy c-means approach:(1)Jm=∑i=1N∑j=1CUijxi−cj2,1≤m<∞,Uij=1∑k=1cxi−cj/xi−cj2/m−1,cj=∑i=1NUijm−xi∑i=1NUijm,where m is the real number greater than 1, Uij is the membership function, xixi is the sample of data, and cj is the centroid of clustering number.


## 3.4. Long Short-Term Memory

The LSTM layer has a large number of series LSTM units, collectively referred to as the LSTM model [39–41]. Three multiplicative units are contained within the LSTM models: first, the input gate, which is used to store information from the current time; second, the output gate, which is responsible for displaying the results; third, the forget gate, which is used to select some already forgotten information from the past. The sigmoid function and dot product operation are the building blocks of multiplication. Sigmoid functions have a range of values from 0 to 1, whereas the dot product operation determines how much information must be sent over the wire. 0 indicates that no information is communicated, whereas 1 indicates that the information is conveyed. Dot product operations are defined as follows: 0 indicates no transmission of information and 1 indicates information transfer:(2)ft=σwfht−1,xt+bf,it=σwiht−1,xt+bi,Ct˜=tanhwCht−1,xt+bC,Ct=ft∗Ct−1+it∗Ct˜,ot=σwoht−1,xt+bo,ht=ot∗tanhCt,where it, ft, and ot respectively represent the input, forget, and output gates, and ht represents the number of hidden layers included inside the cells. wf, wowc, and Ct are the representations of the weighted neural network, while the internal memory cell for the hidden layer is denoted by the letter Ct. The values bf and bo represent the bias of the neural network, while xt is the data representing the traffic on the network. Figure 5 provides a representation of the LSTM architecture. The essential LSTM model parameters are listed in Table 2.Figure 5
LSTM architecture.Table 2
Parameters of the LSTM algorithm.
ParameterValueHidden layers150Delays[1–9]Shallow hidden layers[3000]Number of epochs250Batch size120Environment of the proposed modelCPUNumber of iterations350Dropout number0.5Optimization function of the proposed systemAdam


## 3.5. Model Evaluation

The metrics of mean error (ME), mean square error (MSE), root mean square error (RMSE), and standard error (std. error) served as the criterion for assessment. These performance measurements were used to compare the prediction and observation values:(3)MSE=1n∑i=1nyi,observ−yi,pred2,RMSE=∑i=1nyi,observ−yi,pred2n,ME=yi,observ−yi,pred,where yi,observyi,observ is the observation value, yi,predyi,pred is the predicted value, and NN is the number of samples.


## 4. Experiment

WIDE real-time network data were taken into account during the experiments. Data were collected during a 3-year period (2012–2014). Predicting the loading packets of the network traffic was a priority. With the Wireshark software, packet numbers may be extracted from real-world network data. MATLAB was used to write all accompanying programs. The MSE, RMSE, MA, and SE measurements were taken into account when judging the performance of various methodologies in terms of prediction and forecasting. Soft clustering with RKM and FCM was applied to control ambiguous objects to achieve the desired prediction accuracy of LSTM. We used only the centroids of five clusters for integration with the output of the prediction model. The LSTM time series model achieved high performance.


### 4.1. Environmental Setup

Developing a prediction system requires software and hardware. Table3 lists the hardware and software requirements.Table 3
Hardware and software requirements.
HardwareSoftware16 GB RAMMATLAB 2020CPU I7Operating system: Windows


### 4.2. Training Phase

To build a highly efficient model using network traffic data, the training procedure is crucial. In this stage, 70% of the datasets were used for training. Table4 lists the results of integrating the performance of the LSTM model using the clustering FCM method. The FCM algorithm improved the LSTM model, enabling it to achieve high performance.Table 4
Results of the LSTM model with FCM clustering.
YearMSERMSEMESE20120.00480.06988.0368e-090.069920130.000960.03108.6061e-090.0310620140.007830.08850.73136e-090.08868The time series plot of the combined LSTM model and FCM clustering strategy is shown in Figure6. The y axis indicates the scaling data, and the x axis represents the number of data samples that were collected from the network. As a result, the generated LSTM with the RKM model had very low MSE and RMSE values, which indicate that it is ready to be evaluated for the desired purposes. The MSE error results were 0.0048, 0.00096, and 0.00783 for the 3 years, respectively.Figure 6
Time series plot of the LSTM and FCM methods: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)Figure7 shows the mean error from the time series mplt, the histogram of the error values, and the mean error of the time series. The mean error and histogram metrics represent the error from the time series plot between the target and prediction values. We have observed that the proposed model has achieved very less prediction error (8.0368e-09 and 0.0699) with respect to mean error and the std error metric, respectively.Figure 7
SE and mean error plots for the LSTM and FCM methods: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)Table5 lists the results of the training that the LSTM did using RKM clustering in order to make predictions about the network traffic during the course of the three years from 2012 to 2014. The proposed LSTM + FCM achieved high accuracy and fewer prediction errors. The LSTM model with RKM clustering achieved fewer errors in 2013, with an MSE of 0.01225 and RMSE of 0.1107.Table 5
Results of the LSTM method with RKM clustering in the training phase.
YearMSERMSEMEStd. error20120.053100.23048.5046e-050.231520130.012250.11070.031270.106620140.005640.75110.037260.0655The graphical performance of the proposed LSTM model with RKM is shown in Figure8. The results generated using the LSTM method with the RKM model showed very low MSE and RMSE values, which indicate that the method is ready to be evaluated for its desired purposes.Figure 8
Time series plot for the LSTM and RKM methods: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)The training state used to process the network dataset, std. error, and mean performance of the LSTM method with the RKM clustering algorithm is shown in Figure9. The performance of the LSTM model was enhanced, thanks to RKM clustering since the model’s prediction errors were lower. The proposed system achieved std. error values of 0.2315, 0.1066, and 0.0655 for 2012, 2013, and 2014, respectively.Figure 9
SE and mean error plots for the LSTM and RKM methods: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)


### 4.3. Testing Phase

To validate the proposed system deep learning LSTM model with RKM and FCM clustering approaches for predicting network traffic, 8% of the network data set was used in the testing phase. FCM, which is noncrisp, was used to improve the accuracy of more traditional models for forecasting network traffic. This type of clustering uses a coefficient for each individual cluster to specify the variable degrees of membership in a given cluster of objects. The data were clustered into five clusters that were taken into account after the cluster number was determined. Members of these cluster numbers had the highest membership values. Cluster number centroids were chosen. The results of the LSTM method with FCM clustering in the testing phase are listed in Table6. The proposed system achieved very low prediction error values.Table 6
Results of the LSTM method with FCM clustering in the testing phase.
YearMSERMSEMEStd. error20120.053100.230448.5046e-050.231520130.01220.11070.03120.106620140.00560.07510.030260.0655Figure10 shows the times series plot for the LSTM method with the FCM model for predicting network traffics. The prediction values are close to the observation values. The LSTM method with the FCM model achieved less error, with an MSE of 0.0056 at the testing phase.Figure 10
Time series plot for the LSTM and FCM methods in the testing phase: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)A graphical representation of the mean error and std. error of the LSTM with the FCM for predicting network traffic is presented in Figure11. The proposed system LSTM with FCM clustering achieved less error, with a ME of 0.03026 and std. error of 0.0655, using 2014 data. Overall, the hybrid LSTM model with the FCM clustering approach attained good accuracy in predicting network traffic.Figure 11
Std. error and mean error plots for the LSTM and FCM methods in the testing phase: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)Another noncrisp clustering technique was used to strengthen and optimize the model. The LSTM time series model can benefit from the noncrisp RKM approach, which uses this technique to improve performance. Five clusters were formed using the RKM technique. The upper approximation included some objects, whereas the lower approximation included other objects. A subset of centroids was chosen for further study. As a result, objects that fell into the higher approximation category were considered ambiguous. Centroids of the clusters to which these unclear objects belonged were averaged to address these issues. From thek-means clustering and conventional prediction findings, centroids were generated by combining the two sets of data. The results of the LSTM model with RKM clustering in the testing phase are summarized in Table 7. The LSTM method with RKM clustering achieved good accuracy.Table 7
Results of the LSTM method with RKM clustering in the testing phase.
YearMSERMSEMEStd. error20120.152130.390040.0134150.3916620130.08780.29630.085410.285120140.01070.10380.0500820.09143The time series plot for the LSTM model with RKM clustering is shown in Figure12. The performance of the LSTM method with the RKM model is also depicted in the figure. The line of the prediction values is close to the observation values. The prediction value of the LSTM method with RKM clustering was 0.0107 using 2014 data in the testing phase.Figure 12
Time series plot of the LSTM and RKM methods in the testing phase: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)Figure13 shows the prediction values of the LSTM model with the RKM clustering approach with respect to the ME and std. error metrics for predicting network traffic. The LSTM method with RKM clustering had a ME of 0.050082 and an SE of 0.09143.Figure 13
Std. error and ME plots of the LSTM and RKM methods at the testing phase: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)


## 4.1. Environmental Setup

Developing a prediction system requires software and hardware. Table3 lists the hardware and software requirements.Table 3
Hardware and software requirements.
HardwareSoftware16 GB RAMMATLAB 2020CPU I7Operating system: Windows


## 4.2. Training Phase

To build a highly efficient model using network traffic data, the training procedure is crucial. In this stage, 70% of the datasets were used for training. Table4 lists the results of integrating the performance of the LSTM model using the clustering FCM method. The FCM algorithm improved the LSTM model, enabling it to achieve high performance.Table 4
Results of the LSTM model with FCM clustering.
YearMSERMSEMESE20120.00480.06988.0368e-090.069920130.000960.03108.6061e-090.0310620140.007830.08850.73136e-090.08868The time series plot of the combined LSTM model and FCM clustering strategy is shown in Figure6. The y axis indicates the scaling data, and the x axis represents the number of data samples that were collected from the network. As a result, the generated LSTM with the RKM model had very low MSE and RMSE values, which indicate that it is ready to be evaluated for the desired purposes. The MSE error results were 0.0048, 0.00096, and 0.00783 for the 3 years, respectively.Figure 6
Time series plot of the LSTM and FCM methods: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)Figure7 shows the mean error from the time series mplt, the histogram of the error values, and the mean error of the time series. The mean error and histogram metrics represent the error from the time series plot between the target and prediction values. We have observed that the proposed model has achieved very less prediction error (8.0368e-09 and 0.0699) with respect to mean error and the std error metric, respectively.Figure 7
SE and mean error plots for the LSTM and FCM methods: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)Table5 lists the results of the training that the LSTM did using RKM clustering in order to make predictions about the network traffic during the course of the three years from 2012 to 2014. The proposed LSTM + FCM achieved high accuracy and fewer prediction errors. The LSTM model with RKM clustering achieved fewer errors in 2013, with an MSE of 0.01225 and RMSE of 0.1107.Table 5
Results of the LSTM method with RKM clustering in the training phase.
YearMSERMSEMEStd. error20120.053100.23048.5046e-050.231520130.012250.11070.031270.106620140.005640.75110.037260.0655The graphical performance of the proposed LSTM model with RKM is shown in Figure8. The results generated using the LSTM method with the RKM model showed very low MSE and RMSE values, which indicate that the method is ready to be evaluated for its desired purposes.Figure 8
Time series plot for the LSTM and RKM methods: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)The training state used to process the network dataset, std. error, and mean performance of the LSTM method with the RKM clustering algorithm is shown in Figure9. The performance of the LSTM model was enhanced, thanks to RKM clustering since the model’s prediction errors were lower. The proposed system achieved std. error values of 0.2315, 0.1066, and 0.0655 for 2012, 2013, and 2014, respectively.Figure 9
SE and mean error plots for the LSTM and RKM methods: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)


## 4.3. Testing Phase

To validate the proposed system deep learning LSTM model with RKM and FCM clustering approaches for predicting network traffic, 8% of the network data set was used in the testing phase. FCM, which is noncrisp, was used to improve the accuracy of more traditional models for forecasting network traffic. This type of clustering uses a coefficient for each individual cluster to specify the variable degrees of membership in a given cluster of objects. The data were clustered into five clusters that were taken into account after the cluster number was determined. Members of these cluster numbers had the highest membership values. Cluster number centroids were chosen. The results of the LSTM method with FCM clustering in the testing phase are listed in Table6. The proposed system achieved very low prediction error values.Table 6
Results of the LSTM method with FCM clustering in the testing phase.
YearMSERMSEMEStd. error20120.053100.230448.5046e-050.231520130.01220.11070.03120.106620140.00560.07510.030260.0655Figure10 shows the times series plot for the LSTM method with the FCM model for predicting network traffics. The prediction values are close to the observation values. The LSTM method with the FCM model achieved less error, with an MSE of 0.0056 at the testing phase.Figure 10
Time series plot for the LSTM and FCM methods in the testing phase: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)A graphical representation of the mean error and std. error of the LSTM with the FCM for predicting network traffic is presented in Figure11. The proposed system LSTM with FCM clustering achieved less error, with a ME of 0.03026 and std. error of 0.0655, using 2014 data. Overall, the hybrid LSTM model with the FCM clustering approach attained good accuracy in predicting network traffic.Figure 11
Std. error and mean error plots for the LSTM and FCM methods in the testing phase: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)Another noncrisp clustering technique was used to strengthen and optimize the model. The LSTM time series model can benefit from the noncrisp RKM approach, which uses this technique to improve performance. Five clusters were formed using the RKM technique. The upper approximation included some objects, whereas the lower approximation included other objects. A subset of centroids was chosen for further study. As a result, objects that fell into the higher approximation category were considered ambiguous. Centroids of the clusters to which these unclear objects belonged were averaged to address these issues. From thek-means clustering and conventional prediction findings, centroids were generated by combining the two sets of data. The results of the LSTM model with RKM clustering in the testing phase are summarized in Table 7. The LSTM method with RKM clustering achieved good accuracy.Table 7
Results of the LSTM method with RKM clustering in the testing phase.
YearMSERMSEMEStd. error20120.152130.390040.0134150.3916620130.08780.29630.085410.285120140.01070.10380.0500820.09143The time series plot for the LSTM model with RKM clustering is shown in Figure12. The performance of the LSTM method with the RKM model is also depicted in the figure. The line of the prediction values is close to the observation values. The prediction value of the LSTM method with RKM clustering was 0.0107 using 2014 data in the testing phase.Figure 12
Time series plot of the LSTM and RKM methods in the testing phase: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)Figure13 shows the prediction values of the LSTM model with the RKM clustering approach with respect to the ME and std. error metrics for predicting network traffic. The LSTM method with RKM clustering had a ME of 0.050082 and an SE of 0.09143.Figure 13
Std. error and ME plots of the LSTM and RKM methods at the testing phase: (a) 2012, (b) 2013, and (c) 2014 data.
(a)(b)(c)


## 5. Conclusion

Modeling telecommunication network traffic is critical to its design and administration. Network traffic forecasting is useful for network capacity planning and quality-of-service enhancement. Hence, network traffic forecasting has become a major focus of study in recent years to improve service quality. Modeling and forecasting algorithms that accurately depict network traffic statistics are among the primary goals of this study. The WIDE trace online network data aggregated 1 hour daily were used to test these models. They were used to retrieve loading packets from the trace using the Wireshark tool. In addition, MATLAB uses a natural logarithm to scale the data. This technique rescaled the data in the scale range. Each year’s network traffic is predicted using typical forecast techniques. It is common practice to compare traditional prediction models using MSE, RMSE, and ME.A key part of our innovation is the use of machine intelligence to improve already existing network traffic models. To improve the prediction of packet loading in network traffic, machine intelligence techniques such ask-means, FCM, and RKM clustering are utilized. To improve the LSTM prediction model, the new approach focuses on the centroids of clustering. A direct correlation exists between the improved models and the ability of traditional models to predict accurately. The LSTM model and centroids from the clustering algorithms were combined to create an improved model.



---

*Source: 3553622-2022-06-20.xml*