Folds here Folds here

Prediction of Mobile-App Network-Traffic Aggregates using Multi-task Deep Learning

L. Pappone∗, V. Persico^, D. Ciuonzo^, A. Pescapé^, F. Esposito*

∗Saint Louis University, USA ^University of Naples Federico II, Italy

Input-Output Construction

After collecting traffic generated by mobile

applications, it is submitted to an aggregation module

in order to subdivide it in memory windows, extract

the features of interest and build the input structure

to feed the models.

Consecutive windows always include non-overlapping

sets of packets. Therefore, ∆𝑀 is defined as the

aggregation granularity: each packet of each biflow

that occurs within this time is properly aggregated

according to the specific feature of interest.

As a result of the process, for each ∆𝑀 a single

aggregate value is generated for each feature, so the

resulting time-series will be generated for the single

biflow.

Our single-step prediction approach is based on an

incremental windowing procedure for input-output

construction: when approaching to the windowing,

incrementally-sized sets of samples are grouped

together until reaching the prescribed maximum size

W of the prediction window (i.e., predictions can be

made as soon as the first sample is available). That

leads to model the border effects, (i.e., the early

behaviors), which are achieved through a left zero-

padding up to W samples.

Experimental Analysis

Modeling and predicting network traffic have

become essential to many diverse practical

contexts, ranging from security and network

planning to QoS optimization. Nonetheless,

modeling such processes is challenging due to the

complexity and variability of the network traffic.

Several modeling approaches have been

proposed to improve classification and forecasting

performances, spanning different objectives,

excluding the prediction of aggregated network

traffic generated by mobile applications.

In this poster, we aim at filling this gap by

exploring the suitability of several Deep learning

(DL) and Machine Learning (ML) models to such

aim. In particular, we used multi-task deep

learning to predict several aggregate traffic

features, including downstream and upstream

traffic volumes, on different window sizes, showing

promising performances.

Abstract

[1] G. Aceto et al. MIRAGE: Mobile-app Traffic Capture and

Ground-truth Creation. In 2019 IEEE ICCCS.

[2] W. Wang el al., “End-to-end encrypted traffic

classification with one-dimensional convolution neural

networks,” in IEEE International Conference on Intelligence

and Security Informatics (ISI), 2017.

[3] J. Chung et al., “Empirical evaluation of gated recurrent

neural networks on sequence modeling,”arXiv

preprintarXiv:1412.3555, 2014.

[4] M. Barabas et al., “Evaluation of network traffic

prediction based on neural networks with multi-task learning

and multiresolution decomposition,” in IEEE 7° International

Conference on Intelligent Computer Communication and

Processing (ICCP), 2011, pp. 95–102.

We analyze the suitability of state-of-art DL/ML models:

• Convolutional Neural Network (CNN) [2],

• Gated Recurrent Unit (GRU) [3]

• Random Forest Regressor (RFR)

to predict mobile-network traffic aggregates.

We predict four aggregated traffic features, namely

upstream traffic volume, downstream traffic volume,

upstream No. of packets, downstream No. of packets.

We evaluate DL models compared with a ML baseline -

extracted from video applications [1] bi-directional flows

traffic traces – relying on short-term aggregation windows

(in the order of milliseconds).

Single-Step Prediction

References

Acknowledgement*The work of Lorenzo Pappone and Flavio Esposito has been partially supported by NSF # 1836906 and # 1908574.

Deep Learning Architectures

We leverage Multi-Task learning in order to tackle the

multivariate nature of the prediction task.

Multi-task learning consists in solving multiple prediction

problems, each associated to an aggregated traffic

feature [4]. It is implemented sharing a single DL

architecture (CNN or GRU) among different problems,

thus constituting a significant difference in terms of

computational complexity with respect to a multiple

single-task learning approach.

Multi-Task Learning

Trend Performance Analysis

GRU

CNN

Experimental Results

In this work, our contribution can be summarized as follows:

• We formally define the traffic aggregates prediction problem and related parameters;

• We report experimental results concerning the comparison between state-of-art DL architectures in terms of

prediction performances along with a ML baseline;

• We design systematic pre-processing framework to combine different aggregation windows (revealing potential

traffic patterns over shorter time period), employing an input-output construction process to feed the models.

• We provide a trend performance analysis regarding the application of smaller aggregation windows to predict

larger time periods.

Our Contribution

Features of interest

Input-Output

construction