A Contextual Approach for Improving Anomalous Network Traffic Flows Prediction

Network traffic prediction for small flow aggregations is crucial in automating future network management and optimization. However, fine-grained traffic prediction is challenging because some flows reveal anomalous behavior influenced by various factors. In this study, we present a contextual approach to improve the prediction of these flows. We leverage time and location context in IP flows to aggregate them into country traffic time series, then cluster the countries' traffic time series based on their spike patterns. For the cluster dominated by spikes, we investigate real events correlated to the spikes, model the impact of these events as weights, and use the weights to improve prediction performance on the traffic cluster. We evaluate our method on network traffic traces from a campus network and our dataset of university events. Our method improves the predictability of anomalous traffic flows by 6%. Our work showcases the potential of improving anomalous flow prediction by augmenting contextual data.