Parameter Estimation and Application of Time-Varying FARIMA Model

Parameter Estimation and Application of Time-varying FARIMA Model
Xun-yi Ren, Yang-Yu, Jun-feng Zhang, Li-Ma, Xiao-dong Ma

International Journal of Advancements in Computing Technology, Volume 3, Number 3, April 2011


1
Xun-yi Ren,
1
Yang-Yu,
1
Jun-feng Zhang,
2
Li-Ma,
2
Xiao-dong Ma
1*College of Computer Nanjing University of Posts and Telecommunications
2Jiangsu YiTong HIGH-Tech Co., LTD
renxy@njupt.edu.cn
doi:10.4156/ijact.vol3. issue3.8

Abstract
The prediction model of network traffic has been a hot research spot. In this paper, a time-varying
FARIMA model is proposed based on the traditional FARIMA model, in which the parameter d is
changed into time-varying parameter d(t) and the time-varying parameters are estimated combined
with time-varying ARMA model. The new model overcomes the fractal information loss caused by the
global average and improves the accuracy of parameter estimation. Finally, the model's application in
the anomaly detection of network traffic is analyzed.

Keywords: Network Traffic Model, FARIMA, Time-varying Parameters, Anomaly Detection,
Parameter Estimation

1. Introduction

Network traffic model is the foundation of network behavior's understanding and prediction,
network performance's analysis and evaluation and network structure's design. The research about
modeling and prediction of network traffic has been of concern during the several decades of
communication network technology development. Network traffic models can be divided into
stationary ones and non-stationary ones, and the stationary models also include two types of short
correlation and long correlation. Common short correlated models include the Markov process,
Autoregressive Model(AR), Autoregressive Moving Average model(ARMA) and the sum of
autoregressive moving average model (ARIMA), etc. Long correlated models include the sum of
fractional autoregressive moving average model (FARIMA), fractional Brownian motion (FBM) and
other self-similar models. Non-stationary models include neural network model and chaos model, etc.
The high-speed network service now has not only short relevance but also long relevance[1],
namely self-similarity. Common Short-related network traffic model can not describe the long-range
dependence and some long-range dependence models such as FGN and FARIMA (0, d, 0) can not
describe the short-correlation. Therefore, the establishment of network traffic model which can
describe both short correlation and long correlation is necessary, and FARIMA (p, d, q)[2] meets the
need.
Many algorithms to calculate the parameters used by traditional FARIMA (p, d, q) model, with
varying degrees of global average sum, smooth the sequence's high variable information. But
time-varying FARIMA model, using parameter d(t) instead of d and combining itself with time-varying
ARMA model, achieves the full-domain dynamic estimation of the traffic series' self-similarity and
greatly promotes the accuracy of parameters estimation. Finally, we use time-varying FARIMA model
together with wavelet forecast to overcome the false positives caused by wavelet alone and improve the
detection efficiency.

2. FARIMA Model

Definition a stochastic process {
t
X } is called a FARIMA (p, d, q) model if {
t
X } is
stationary(mean value is zero) and the following differential equation is satisfied:

( ) ( )
d
t t
B X B a u A = O (1)
- 89 -

where d is the differential order, p is the autoregressive order and q is the moving average order(p and q
are both non-negative integers). } -1,0,1,... ..., = : { t a
t
is a white noise sequence, namely a Wiener
process WN (0,
2
) that the average value is 0 and the variance is
2
. What's more,

2
1 2
( ) 1- - -...- (AR)
p
p
B B B B u = (2)

2 q
1 2 q
(B) 1- B- B -...- B (MA) u u u O = (3)

Where ) ( B and ) ( B are both complex variable polynomials without public solutions, and
) ( B has no solutions in the unit disk. B is the backward moving operator and
... = , =
, 2 -
2
1 - t t t t
X X B X BX . B) - 1 ( = is defined as the difference operator and
d
is the
fractional difference operator whose binomial expansion is

( )
d
0
(1-B)
d
k
d
k k
B
=
A = = (4)

( 1) / [ ( -k 1)]
d
d d
k
= I + I + (5)

, defined as
1
0
( ) , 0
t x
x e t dt x

I = >
}
, represents the gamma function.
Obviously, {
t
X } is a FARIMA (p, a, q) process in which -0.5,0.5) ( d only if
t
d
X is an
ARMA (p, q) process. The only difference between FARIMA(p,d,q) and ARIMA(p,d,q) lies in the
value of d, and the former only take an integer among 0,1 and 2, but the latter is a fraction among
-0.5,0.5) ( . They share the same process except for the different value of d, converted to ARMA (p, q)
model after taking d-order difference on the time series. The accurate formula to compute the d-order
fractional difference of {
t
X } can be obtained from the above formulas, that is

0 0
( )
d
d k
j t t t t j
k
k j
W X B X X

= =
= A = = [
(6)

and
j) - + 1 ( ) + 1 (
) + 1 ( (-1)
=
j
d j
d
j
.
t
W so obtained can be judged as a ARMA sequence and then
prediction can be made according to ARMA model. A set of mature theory and methods about
FARIMA model based on ARMA model have been established.
Theorem
[3]
If 0<d<0.5, then the process FARIMA (p, d, q) is an asymptotic second-order
self-similar process and H=d+1/2, where H is the value of its Hurst parameter.
It is obviously that FARIMA (0, d, 0) (0<d<0.5) and FARIMA (p, d, q) process can both describe the
long correlation of the self-similar traffic. Easily seen from the definition of FARIMA, FARIMA (p, d,
q) is normal ARMA (p, q) process and short-related when d=0, and long-related when ) 5 . 0 , 0 ( d . In
addition, FARIMA (0, d, 0), the simplest form of FARIMA (p, d, q) when p=q=0, is defined as d-order
fractional difference of Gaussian white noise shortly named fractional differential noise. And the
operation is called fractal filtering. FARIMA (0, d, 0) is equivalent with FGN that the differential
coefficient d indicates the intensity of long-range dependence and the Hurst parameter, similar to FGN
process, can be calculated by H=d+0.5. Compared with the ARMA process and the FGN process,
- 90 -

FARIMA (p, d, q) process can build model based on long-range and short-range dependence at the
same time, which reflects its flexibility.

3. Parameter Estimation of Traditional FARIMA Model

Known from the analysis in section II, the mentality of FARIMA(p,d,q) model modeling is that
t
X
is a FARIMA(p,d,q) model if
t t
d
a B X B ) ( = ) ( and
t
W (
t
d
t
X W = ) is a ARMA(p,q) model.
After fractional difference,
t
X is equivalent with
t
W . So FARIMA model can be built through two
steps, firstly calculating the value of d to achieve fractional difference, and then to obtain the
corresponding ARMA (p, q) model.

3.1. Estimation of the Parameter d

It's known from d=H-1/2 that the estimation of d can be converted to the calculation of the value of
H. A number of methods to calculate the value of H have been proposed, such as R/S method, variance
aggregation method, periodogram method
[4]
. Now the variance of wavelet coefficients based method is
mostly used and its idea is as follows:
If {x(t)} is a statistical self-similar process and the self-similarity coefficient is H, then the wavelet
coefficient
k j
d
,
can be obtained after wavelet transformation to x(t).

-j/2
, ,
-j/2
/ 2
( 1/ 2)
0,
( ), ( ) 2 ( ) (2 )dt
2 (2 ) ( - )2 ( 2 )
2 ( ) ( - ) ( (2 ) 2 ( ))
2
j
j k j k
j j j
jH j j jH
j H
k
d x t t x t t k
x u u k du t u
x u u k du x u x u
d

+
+
= =
}
=
}
=
}
=
(7)

In the formula (1), ) (
,
t
k j
is got by the expansion and translation to ) (t .
) (
,
t
k j
( k)dt - 2 ( 2 = ) (
-j -j/2
,
t t
k j
) is a binary orthogonal wavelet, R being its regularity index.
Then ] [
,k j
d Var is the variance of
k j
d
,
and

( 1/ 2) (2 1) (2 1) j
, 0, 0,
[ ] [2 ] =2 [ ] C2 =C2
j H j H j H
j k k k
Var d Var d Var d
+ + +
= = (8)

Taking the logarithmic data from both sides of the formula (2) and then making a linear fitting under
the minimum mean square error, a straight line can be obtained, whose slope is and function is
log
2
Var[d
j,k
]. Then the value of H can be got by 2H+1.

3.2. Parameter Estimation of Corresponding ARMA Process

The commonly used estimation method of ARMA (p, q) parameter can be taken and achieved
through the following two steps:
.Decide the order of p and q. Choose a small value for (p, q) such as 0, 1 and 2(p and q can't be
both 0) according to the experience of fitting FARIMA (p, d, q) model. Then do modeling examination
based on commonly used model selection standards such as AIC, BIC and decide the best value of
(p,q). Repeat the above steps by increasing the value of p and q(generally not more than 5) if no
suitable one found.
- 91 -

.Estimate the parameters
i
and
j
. After the first step, all the parameters
(
2
2 1 2 1
, ,..., , , ,..., ,
q p
) can be got through the parameter estimation, like the approximate
maximum likelihood method.

4. Parameter Estimation of Time-Varying FARIMA model

4.1. Estimation of d (t)

Similar to traditional FARIMA model, time-varying d-order fractional difference of {
t
X } can be
obtained from the time-varying model with d(t) in place of d in the formula (6). Therefore, the
estimation of the value of d(t) is the key point.
This article uses improved time-varying H(t)
[5]
algorithm to estimate d(t). As to the network traffic
sequence } ,..., 2 , 1 = ), ( { N k k X , define
1 -
0 =
j) + X(k
1
= ) (
m
j
m
m
k X as its local time-lapse mean
sequence, where ) (k X
m
is a m-size time window added to the sequence.
Define
2
0
1
[ ( )-X ( )]
k
m
k
i
X i i
k
o
=
= as the sample variance of {X (k)} relative to the time-lapse
average value.
( 1) k i
-
i k i o o
o o o
A + + +
= is the difference of the variance. Window width m of
i
o
A
got
by different ( ) m X i meets the Hurst-exponent exponential law
[6]
, namely,
H
i
cm o
A
and the
linear relationship in the logarithmic diagram. Based on the above definition, the m-size time window
slides in the entire sampling region at
speed and local Hurst index is calculated by the statistics of

each local region. Each local Hurst index constitutes the whole-region time-varying Hurst index
function of the entire network traffic sequence. A concrete description of this algorithm is as follows:
(1) Pretreatment. Estimate different values of m ando with
H
i
cm o
A
in the short data field.
Calculate the mean value in the densest region of the obtained values of H. The value of m and o
corresponding to the H closest to the mean value is the best choice of the traffic sequence.
(2) Divides the whole time domain region into several local regions and calculate ) (k X
m
of each
local region, then
k
,
i
and finally Hurst index by

H
i
cm
and the slope of the straight line

in the logarithmic diagram.
(3) Make polynomial interpolation on the Hurst index of each local region to form a smooth curve,
which is a approach to Hurst index's shape of the traffic sequence.

4.2. Parameter Estimation of Time-varying ARMA Process

Suppose the signal model of time-varying ARMA is:

1 1 1 -q
( -1) ... ( -p) ( -1) ... ( -q)
n t n p np n n q n
x a n x a n x e b n e b n x + + + = + + + (9)

In the formula,
n
e is a stationary white noise process whose average value is 0 and variance is
2
. p
and q is respectively the order of AR and MA. For convenience, here a signal model where the right
side time-varying parameters are constants is used. Namely,
1 -1 -p 1 -1 -q
( -1) ... ( -p) ...
n n p n n n q n
x a n x a n x e b e b x + + + = + + + . Suppose the time-varying
parameter p} 1,..., = i 1), - ( { n a
i
is a linear combination of a set of ground time functions.
- 92 -

,
0
( ) ( )
m
i i j j
j
a n a g n
=
= (10)

} ,..., 0 = ), ( { m j n g
j
is the set of ground time functions. Order that
] ... [ = E ]; ... [ =
) ( )... ( )... ( )... ( [ =
] ... ... ... [ =
q - 1 -
'
1
'
1 - 0 1 - 1 - 0 1 -
1 -
'
0 1 10
'
n n q
m n n m n n
n
pm p m
e e b b B
n f x n f x n g x n g x X
a a a a A
.
Then the formula (10) can be written as
' ' ' '
-1 -1 n n n n
x X A e E B + = + .
Make the feedback linear estimate method used to estimate the parameters of stationary constant
parameter model extended to time-varying parameter model
[7-10]
. The method consists of two linear
least squares estimate and a linear filter and finally
' '
B A can be calculated.

5. The Application of Time-varying FARIMA Model

Time-varying FARIMA model can be used in many aspects in reality. In this paper, we will combine
it with wavelet detection to detect the anomalous network traffic so that the false positive problem
caused by wavelet detection alone can be solved.
The appearance of wavelet has brought new contents and methods to many problems. Good results
have been achieved with wavelet used in anomaly detection of network traffic, but present wavelet
detection methods only rely on the value of Hurst to determine whether there is anomaly of network
traffic. However some special reasons, such as holidays, can also cause sudden increase in network
traffic that day. Then that the traffic is anomalous will be determined after the calculation of the value
of Hurst, resulting in false positives. Therefore, it's particularly important to distinguish normal sudden
increase from real anomalous traffic, which can be well resolved by time-varying FARIMA model.
The basic thought is that time-varying FARIMA prediction model is triggered when the anomaly of
network traffic is detected by wavelet. Then the model gets the data with the same features of the
anomalous points from the historical database. For instance, if wavelet has determined that the traffic at
10:00 on Monday morning is anomalous, the model would get the formal data at the same clock to do
prediction. We believe it's a wavelet false positive when the predicted result is normal. Thus the
problem of wavelet false alarm can be solved.

6. Conclusion

This paper presents a time-varying FARIMA prediction model, converting the fixed parameters of
traditional model to time-varying parameters, and proposes its application in anomaly detection of
network traffic. The model shows the time domain dynamic self-similarity of network traffic and
achieves the self-similarity's full domain dynamic estimates of the traffic sequence, thus overcoming
the fractal information loss caused by global average in traditional models and greatly improving the
accuracy of parameter estimation. Certainly further study and optimization of the algorithms to
estimate time-varying parameters can be done on the basis of this paper. The aspects where this model
can make up for others and new impacts on the constitution and the behavioral traits of network traffic
that the emergence of new applications and continuous development of network traffic business make
can also be studied. What's more, will self-similarity of network traffic disappear or be damaged with
the development of network technology and the continual emergence of new business? Are there any
other features of network traffic having not yet been discovered? These questions will be the focus of
future research.

- 93 -

7. Acknowledgement

Supported by National Natural Science Foundation of China (61073188), China Postdoctoral
Science Foundation (20100471355), the Talent Project of Nanjing University of Posts and
Telecommunications (NY208006).

8. References

[1] Tsybakov B,Georganas N D.On self-similar traffic in ATM queues:definitions,overflow
probability bound,and cell delay distribution.IEEE/ACM Trans.on Networking,vol.5, no.3,
pp.397-409,1997.
[2] Yantai Shu,Wang Lei,Zhang Lianfang.FARIMA-based internet network business
forecasts.Computers,vol.24,no.1,pp.46-53,2001.
[3] Zhigang Jin,Yantai Shu,Jiakun Liu,et al.Prediction-based Bandwidth Allocation for VBR
Traffic.Trans.of Tianjin University,vol.7,no.4,pp.221-225,2001.
[4] Chen Jian,Tan Xianhai,Jia Zhen. Performance analysis of 7 kinds of Hurst coefficient estimation
algorithm[J].Computer Applications,vol.26,no.4,pp.945-950,2006.
[5] Weijin Wu,Zhang Jin,Wu Jiangxing.Sliding window time-variable estimate algorithm of network
traffic long-range dependence[J].Computer Research and
Development,vol.45,no.3,pp.436-442,2008.
[6] Alessio E,Carbone A,Castelli G,et al.Second-order Moving Average and Scaling of Stochastic
Time Series[J].The European Physical Journal B, vol.27,no.2,pp.197-200,2002.
[7] Wang Wenhua,Wang Hongyu.A ARMA model parameter estimation method of non-stationary
signal[J]. Signal Processing, vol.14,no.1, pp.33-38,1998.
[8] Michael Zimba, Sun Xingming, "DWT-PCA (EVD) Based Copy-move Image Forgery
Detection", JDCTA, Vol. 5, No. 1, pp. 251-258, 2011.
[9] Zhang Ye, Cai Guoqiang, Jianwei YANG, Jiao Zhang, Qilong Shi, Heng Zeng, "Fault Diagnosis
of Railway Rolling Bearing Based on Wavelet Analysis and FCM ", JDCTA, Vol. 5, No. 3, pp.
47-58, 2011.
[10] Yang Tie-jun, Huang Lin, "Level Set Segmentation Method Using Wavelet Based Effective
Energy", JDCTA, Vol. 5, No. 3, pp. 119-125, 2011.

- 94 -

Parameter Estimation and Application of Time-Varying FARIMA Model

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Parameter Estimation and Application of Time-Varying FARIMA Model

Uploaded by

Copyright:

Available Formats

Parameter Estimation and Application of Time-varying FARIMA Model

Xun-yi Ren, Yang-Yu, Jun-feng Zhang, Li-Ma, Xiao-dong Ma

speed and local Hurst index is calculated by the statistics of

and finally Hurst index by

and the slope of the straight line

You might also like