Network Bandwidth Utilization Prediction Based on Observed SNMP Data

Bandwidth requirement prediction is an important part of network design and service planning. The natural way of predicting bandwidth requirement for existing network is to analyze the past trends and apply appropriate mathematical model to predict for the future. For this research, the historical usage data of FWDR network nodes of Nepal Telecom is subject to univariate linear time series ARIMA model after logit transformation to predict future bandwidth requirement. The predicted data is compared to the real data obtained from the same network and the predicted data has been found to be within 10% MAPE. This model reduces the MAPE by 11.71% and 15.42% respectively as compared to the non-logit transformed ARIMA model at 99% CI. The results imply that the logit transformed ARIMA model has better performance compared to non-logittransformed ARIMA model. For more accurate and longer term predictions, larger dataset can be taken along with season adjustments and consideration of long term variations.


Introduction
The rapid growth in the use of the Internet has led to huge and increasing demand for bandwidth, both international and domestic. Ensuring sufficient bandwidth in their network from core to the customer premises has been the constant challenge for network operators and service providers. In this context, timely and accurate prediction of bandwidth is very helpful to plan the network resources, expansion and upgrades on time so that bottlenecks and QoS degradations are avoided. This, in turn, is crucial for operators to attract, retain and regain customers. Hence, proper network traffic prediction is very useful for operators in initial planning as well as later on for upgrades and optimizations. To efficiently handle increasing subscriber base, service diversity and ensuing increase in bandwidth needs, service providers need to continuously monitor and predict traffic. For this research the reference data is taken from the utilization statistics of links in the Internet network of Nepal Telecom in the Far Western Region of Nepal. The data thus taken has been used to predict traffic using the method proposed here.

Literature Review
In a packet based network such as Internet, traffic flows through different links and nodes to reach from source to destination. The capability to predict future traffic demands can help improve the performance of network with timely planning for upgrades and updates. The self-similarity of network traffic has been studied in Local Area Network (LAN) [2]. To fit the bursty nature of the traffic ARIMA/GARCH model, which is a combination of a linear ARIMA (Auto-Regressive Integrated Moving Average) and non-linear Generalized Autoregressive Conditional Heteroskedasticity (GARCH) time series models, was proposed in [8]. According to [4], methodology for network resource management and network traffic congestion control using properly trained Artificial Neural Network (ANN) can better handle non-linear data relationship between the input and output patterns. The prediction model of network traffic based on Milti-Kernel Support Vector Regression (MKSVR) method showed that the proposed model can accurately describe the change trend of network traffic and hence improve the prediction accuracy of network traffic [6].
Several models have been proposed to predict network traffic. The short-term (a few minutes) forecast model using Auto-Regressive Moving Average (ARMA) with 1 sec time-scale data is proposed in [5]. The long-term (1 year) forecast model of Internet backbone traffic using ARIMA with 1 week time-scale data is proposed in [3]. The mid-term (1 day) forecast model using Autoregressive Conditional Heteroskedasticity (ARCH) model with 15 minute timescale data is proposed in [1]. This research focuses on three months prediction of the bandwidth utilization using 30 second time-scale data.

Methodology
The schematic model used in this research is as shown in Fig. 1.

Fig. 1: Research Schematic Model
For this research, real traffic data of 5 months for the Far Western Region network of Nepal Telecom was taken. The data is based on the SNMP capture for NMS visualization of the designated network nodes. This data is used as the training data for creation of the time series dataset that is used for the application of logit transformation and time series functions. The network links associated with the collected reference data is shown in Table 1. Daily aggregated traffic data has been taken of the Dhangadhi node for 6 months. This data is based on the NMS records which are aggregated every 30 seconds. The data collected was the inbound and outbound traffic at Dhangadhi node from the links given in Table 1. The inbound and outbound reference data thus collected are shown diagrammatically in Fig. 2   The framework for prediction based on collected data is shown in Fig. 4.

Fig. 4: Framework for Prediction
A univariate linear time series logit transformed ARIMA model is used for bandwidth utilization prediction of network traffic using the observed SNMP data.

Logit Transformation
Logit transformation is applied to the SNMP data 'x' to set the lower and upper bounds based on these limits. Time series data 'x' containing 'n' observations is transformed to time series data 'y' with lower bound 'a' and upper bound 'b' (10 10 bit/second) using the expression shown in Equation (1).

Network Bandwidth Utilization Prediction Based on Observed SNMP Data
The logit transformed SNMP data obtained after applying the transformation logic of Equation 1 are tested for seasonal adjustment using Seasonal Decomposition of Time Series by Loess (STL) in R programming.

Model Identification
The entire data set is split into training data (June to October) and testing data (November) for model validation. The purpose of model validation step is to determine accuracy of the model. For identification of the model, the selection the orders of p, d and q is performed using the "auto. arima" function in R programming which satisfied the Akaike's Information Criterion (AIC). The model with the minimum AIC is chosen as the best candidate model. The reason for the choice of AIC is because of the fact that AIC not only evaluates the fit between values predicted by the model and actual measurements, but also penalizes models with larger number of parameters.

Diagnostic Checking
The ARIMA diagnostic tests are run on the most promising of the model orders. Before fitting the accurate ARIMA model, the diagnostic checks of stationarity and normality are carried out.

Traffic Predictions
The network traffic is predicted after the order selection using "auto.arima" function. Then these predicted values are converted to the original scale using reverse logit transformation using Equation (2).
A one-step ahead prediction method is used recursively to obtain the subsequent values. The data of six months from June to November of a year of FWDR have been utilized to predict the network traffic.

Prediction Accuracy Check
A prediction error is the difference between the actual or real and the predicted value of a time series. For prediction accuracy check MAPE is used which is given in Equation (3).
where y t is actual traffic and f t is predicted traffic.
The normality test is carried out to test whether the data is normally distributed or not. When the data is normally distributed, then both mean or the median can be used as measures of prediction errors. In fact, in any symmetrical distribution the mean, median and mode are equal. However, in this situation, the mean is widely preferred as the best measure of prediction errors because it is the measure that includes all the values in the data set for its calculation and any change in any of the data will affect the value of the mean. This is not the case with the median or mode.

Results and Discussion
The entire data set is split into training data (June to October) and testing data (November) for model validation. The purpose of model validation step is to determine accuracy of the model . For identification of the model which satisfies the minimum Akaike's Information Criterion (AIC), the "auto.arima" of R programming is used. The function has the form where p is the number of autoregressive terms, d is the number of nonseasonal differences needed for stationarity and q is the number of lagged forecast errors in prediction equation.
The simulations have been carried out to identify the best ARIMA model and compare the errors of the other time series prediction models using R Studio package of R programming. For model validation, the entire data set is split into training dataset (June to October) and testing data set (November). The training for inbound and outbound are shown in Fig. 2 and Fig. 3 respectively. Similarly, the testing data (actual data of November) for inbound and outbound are shown in Fig.  5 and Fig. 6 respectively.

Fig. 5: Inbound Testing Data
An ARIMA model in training data set is implemented and found is a best model as per minimum Akaike information criterion using "auto.arima" function of R programming in forecast package. Seasonal components are also tested using "decompose" function in R and no seasonal components were found.   prediction method is chosen because of its minimum MAPE at 99% CI. The prediction of the traffic for the next time instant is performed recursively for the next day taking six months traffic data. This process is recursively performed for the next 90 days. The predicted inbound and outbound traffic time series plots for 90 days at 99% CI are shown in Fig. 11 and Fig. 12 respectively. A comparative study of the existing ARIMA model with logit transformed and non-logit transformed time series data is carried out to evaluate the prediction accuracy. It is found that the forecast error of logit transformed ARIMA model is significantly smaller than the non-logit transformed ARIMA model which clearly states the prediction efficiency of ARIMA model with logit transformed time series data. The logit transformed ARIMA model fitted the traffic data very well and this is confirmed by the goodness of fit test which are given by stationarity and normality. Such well-fitted statistical evidence is a solid empirical foundation for the prediction. The logit transformed ARIMA model reduces the MAPE by 11.71% and 15.42% respectively as compared to the non-logit transformed ARIMA model at 99% CI of inbound and outbound traffic.

Conclusion
A network bandwidth utilization prediction scheme is presented and analyzed using univariate linear time series model with ARIMA model after logit transformation. The logit transformed ARIMA model reduces the MAPE by 11.71% and 15.42% for inbound and outbound traffic respectively as compared to the non-logit transformed ARIMA model at 99 % CI. The reference data was available only for 6 months. It can be argued that if longer period of data is available, more accurate prediction for even longer duration can be achieved. For further research, larger dataset can be taken and season adjustments and long term variations can be taken into account to carry out predictions with longer periods with better confidence levels.