CN118353797A - Network traffic prediction method, device, electronic device and storage medium - Google Patents

Abstract

The invention provides a network traffic prediction method, a device, electronic equipment and a storage medium, belonging to the technical field of machine learning, wherein the method comprises the following steps: inputting the time sequence network flow data into a first depth forest model to obtain a first prediction result output by the first depth forest model; inputting the time sequence network flow data into a time sequence feature extraction network of a time sequence prediction model to obtain a feature map output by the time sequence feature extraction network; inputting the feature map into a second depth forest model to obtain a second prediction result output by the second depth forest model; inputting the feature map to a prediction network of the time sequence prediction model to obtain a third prediction result output by the prediction network; and inputting the first prediction result, the second prediction result and the third prediction result into a weighted average module to obtain the network flow prediction result output by the weighted average module. The invention can extract valuable characteristics from a large amount of user data and accurately predict communication flow in a changeable network environment.

Description

Network traffic prediction method, device, electronic device and storage medium

Technical Field

The present invention relates to the field of machine learning technology, and in particular to a network traffic prediction method, device, electronic device and storage medium.

Background technique

In the context of digital transformation, communication operators have accumulated a large amount of user data through advanced technical means. This data not only reflects the user's communication behavior, but also contains a wealth of information about the user's living habits and preferences. Using this data to accurately predict traffic is of great significance for network planning, resource allocation and user experience optimization.

At present, statistical models such as autoregressive moving average models or machine learning models such as support vector machines are usually used for modeling and fitting, and the model obtained by modeling is used to predict network traffic. However, traditional models, whether statistical models or machine learning models, may not be able to fully utilize all relevant information in the data, especially in high-dimensional data scenarios such as network traffic prediction, and cannot effectively extract and select features that are helpful for prediction, which limits the performance of the model when dealing with complex patterns and hidden relationships.

Summary of the invention

The present invention provides a network traffic prediction method, device, electronic device and storage medium, which are used to solve the defect that traditional models in the prior art cannot effectively extract and select features that are helpful for prediction when facing high-dimensional data scenarios such as network traffic prediction.

In a first aspect, the present invention provides a network traffic prediction method, comprising:

Inputting the time series network traffic data into a first deep forest model to obtain a first prediction result output by the first deep forest model;

Inputting the time series network traffic data into a time series feature extraction network of a time series prediction model to obtain a feature graph output by the time series feature extraction network;

Inputting the feature map into a second deep forest model to obtain a second prediction result output by the second deep forest model;

Inputting the feature graph into a prediction network of the time series prediction model to obtain a third prediction result output by the prediction network;

The first prediction result, the second prediction result and the third prediction result are input into a weighted average module to obtain a network traffic prediction result output by the weighted average module.

According to a network traffic prediction method provided by the present invention, the time series network traffic data is input into a time series feature extraction network of a time series prediction model to obtain a feature graph output by the time series feature extraction network, including:

Inputting the time series network traffic data into a plurality of first convolutional networks of the time series feature extraction network respectively, and obtaining a plurality of feature vectors corresponding to the outputs of the plurality of first convolutional networks;

Inputting the time series network traffic data into the pooling network of the time series feature extraction network to obtain a first feature vector output by the pooling network;

Inputting the time series network traffic data into the second convolutional network of the time series feature extraction network to obtain a second feature vector output by the second convolutional network;

The multiple feature vectors, the first feature vector and the second feature vector are fused to obtain a feature map and output it.

According to a network traffic prediction method provided by the present invention, each of the multiple first convolutional networks includes a dilated causal convolutional layer, a weight normalization layer, an activation layer and a discard layer connected in sequence.

According to a network traffic prediction method provided by the present invention, the second convolutional network includes a 1*1 convolutional layer.

According to a network traffic prediction method provided by the present invention, the fusion of the multiple feature vectors, the first feature vector and the second feature vector to obtain a feature graph and output it includes:

The multiple feature vectors, the first feature vector, and the second feature vector are added to obtain a feature map and output it.

According to a network traffic prediction method provided by the present invention, the time series network traffic data is input into a first deep forest model to obtain a first prediction result output by the first deep forest model, including:

Input the time series network traffic data into the feature screening module of the first deep forest model to obtain the screening features output by the feature screening module, wherein the feature screening module uses the minimum absolute value selection and shrinkage operator LASSO;

The screening features are input into a multi-granularity scanning module of the first deep forest model to obtain a first prediction result output by the multi-granularity scanning module.

In a second aspect, the present invention further provides a network traffic prediction device, comprising:

A first prediction module, configured to input the time series network traffic data into a first deep forest model to obtain a first prediction result output by the first deep forest model;

A feature extraction module, used for inputting the time series network traffic data into a time series feature extraction network of a time series prediction model to obtain a feature graph output by the time series feature extraction network;

A second prediction module, used for inputting the feature map into a second deep forest model to obtain a second prediction result output by the second deep forest model;

A third prediction module, used for inputting the feature graph into the prediction network of the time series prediction model to obtain a third prediction result output by the prediction network;

The traffic prediction module is used to input the first prediction result, the second prediction result and the third prediction result into a weighted average module to obtain a network traffic prediction result output by the weighted average module.

In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the network traffic prediction methods described above are implemented.

In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the network traffic prediction methods described above.

In a fifth aspect, the present invention further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any of the network traffic prediction methods described above.

The network traffic prediction method, device, electronic device and storage medium provided by the present invention input the time series network traffic data into the first deep forest model to obtain the first prediction result output by the first deep forest model. The deep forest model can efficiently train and process large-scale data sets, and is suitable for network traffic prediction scenarios. The deep forest model performs feature transformation at each layer, which helps to capture complex patterns and relationships in the data. In addition, since the deep forest model integrates multiple random forests in depth, the classification ability of the model is improved, and its generalization ability is stronger than that of a single decision tree or a simple integration method. The time series network traffic data is input into the time series feature extraction network of the time series prediction model to obtain the feature map output by the time series feature extraction network. The time series feature extraction network can better retain historical information, thereby maintaining more extended memory when processing long sequences, and effectively capturing the cycles in the time series. The method can extract valuable features from a large amount of user data by extracting key information such as characteristics and trend changes; input the feature graph into the second deep forest model to obtain the second prediction result output by the second deep forest model, that is, establish a second deep forest model for the feature graph, and use the deep forest model again for prediction based on the feature graph extracted by the time series feature extraction network, which further increases the richness of the entire network traffic prediction process and improves the generalization of the network traffic prediction method; input the feature graph into the prediction network of the time series prediction model to obtain the third prediction result output by the prediction network, process the feature graph through the traditional prediction network, and make full use of the features in the feature graph for prediction; perform weighted average processing on the first prediction result, the second prediction result and the third prediction result to obtain the network traffic prediction result, and combine the prediction results of each model to further improve the generalization and accuracy of the entire network traffic prediction method. In summary, the present invention can effectively extract valuable features from a large amount of user data and realize more accurate communication traffic prediction in a changing network environment.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a schematic diagram of a flow chart of a network traffic prediction method provided by the present invention;

2 is a schematic diagram of data flow of the network traffic prediction method provided by the present invention;

FIG3 is a schematic diagram of TCN causal convolution in the prior art;

FIG4 is a schematic diagram of the structure of a TCN residual block in the prior art;

FIG5 is a schematic diagram of the residual block structure of the temporal feature extraction network provided by the present invention;

FIG6 is a schematic diagram of the structure of an improved deep forest model provided by the present invention;

7 is a schematic diagram of the structure of a network traffic prediction device provided by the present invention;

FIG8 is a schematic diagram of the structure of an electronic device provided by the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

It should be noted that in the description of the embodiments of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements. The orientation or position relationship indicated by the terms "upper", "lower" and the like is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. Unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected, or indirectly connected through an intermediate medium, or it can be a connection between two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

The terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and/or" means at least one of the connected objects, and the character "/" generally indicates that the objects associated with each other are in an "or" relationship.

The following describes the network traffic prediction method, device, electronic device and storage medium provided by the embodiments of the present invention in conjunction with Figures 1 to 8.

FIG1 is a flow chart of a network traffic prediction method provided by the present invention, as shown in FIG1 , including but not limited to the following steps:

S110, inputting the time series network traffic data into a first deep forest model to obtain a first prediction result output by the first deep forest model;

S120, inputting the time series network traffic data into a time series feature extraction network of a time series prediction model to obtain a feature graph output by the time series feature extraction network;

S130, inputting the feature map into a second deep forest model to obtain a second prediction result output by the second deep forest model;

S140, inputting the feature graph into the prediction network of the time series prediction model to obtain a third prediction result output by the prediction network;

S150, input the first prediction result, the second prediction result and the third prediction result into a weighted average module to obtain a network traffic prediction result output by the weighted average module.

Specifically, Figure 2 is a data flow diagram of the network traffic prediction method provided by the present invention. As shown in Figure 2, the time series network traffic data are respectively input into the time series prediction model and the first deep forest model, the first deep forest model outputs a first prediction result, the time series feature extraction network in the time series prediction model extracts features from the time series network traffic data to obtain a feature graph, the feature graph input is processed by the second deep forest model to obtain a second prediction result, the feature graph is processed by the prediction network in the time series prediction model to obtain a third prediction result, and the weighted average module performs weighted average calculation on the three prediction results to obtain a network traffic prediction result.

Optionally, the time series network traffic data is obtained by preprocessing the original time series network traffic data.

It should be noted that the execution subject of the network traffic prediction method provided in the embodiment of the present invention can be a server, a computer device, such as a laptop, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA).

In some embodiments, the first deep forest model can be obtained by directly training the deep forest model using the time series network traffic training data, or by training a pre-trained deep forest model using the time series network traffic training data, without limitation here; the time series feature extraction network is a neural network used to analyze and process time series data, which can extract useful features from the time series, and the type of time series feature extraction network used specifically here is not limited; the second deep forest model can be obtained by directly training the deep forest model using the feature graph data, or by training a pre-trained deep forest model using the feature graph, without limitation here, wherein the feature graph data is obtained by extracting features from the time series network traffic training data by the time series feature extraction network; the prediction network is trained based on the feature graph data, and the specific network type is not limited.

In some embodiments, the second deep forest model is jointly trained with the time series prediction model, that is, the second deep forest model is jointly trained with the time series feature extraction network and the prediction network, and the first deep forest model is trained alone.

In other embodiments, the first deep forest model, the second deep forest model, the time series prediction model, and the weighted average module are jointly trained.

Optionally, the temporal feature extraction network uses TCN (Temporal Convolutional Network), which can calculate data in all time steps in parallel, and has a powerful ability to model long-term dependencies and fewer parameters, compared to traditional sequence modeling methods such as RNN (Recurrent Neural Network) and LSTM (Long Short-Term Memory) that require serial calculations at each moment.

Optionally, the prediction network in the time series prediction model uses a fully connected network.

The network traffic prediction method provided by the embodiment of the present invention inputs the time series network traffic data into the first deep forest model to obtain the first prediction result output by the first deep forest model. The deep forest model can efficiently train and process large-scale data sets, and is suitable for network traffic prediction scenarios. The deep forest model performs feature transformation at each layer, which helps to capture complex patterns and relationships in the data. In addition, since the deep forest model integrates multiple random forests in depth, the classification ability of the model is improved, and its generalization ability is stronger than that of a single decision tree or a simple integration method. The time series network traffic data is input into the time series feature extraction network of the time series prediction model to obtain the feature map output by the time series feature extraction network. The time series feature extraction network can better retain historical information, thereby maintaining more extended memory when processing long sequences, and effectively capturing the periodicity and trend changes in the time series. ization and other key information to achieve the extraction of valuable features from a large amount of user data; the feature graph is input into the second deep forest model to obtain the second prediction result output by the second deep forest model, that is, a second deep forest model is established for the feature graph, and the feature graph extracted based on the time series feature extraction network is used again to predict using the deep forest model, which further increases the richness of the entire network traffic prediction process and improves the generalization of the network traffic prediction method; the feature graph is input into the prediction network of the time series prediction model to obtain the third prediction result output by the prediction network, and the feature graph is processed by the traditional prediction network to make full use of the features in the feature graph for prediction; the first prediction result, the second prediction result and the third prediction result are weighted averaged to obtain the network traffic prediction result, and the prediction results of each model are combined to further improve the generalization and accuracy of the entire network traffic prediction method. In summary, the present invention can effectively extract valuable features from a large amount of user data and achieve more accurate communication traffic prediction in a changing network environment.

In an optional embodiment, the step of inputting the time series network traffic data into a time series feature extraction network of a time series prediction model to obtain a feature graph output by the time series feature extraction network includes:

Inputting the time series network traffic data into a plurality of first convolutional networks of the time series feature extraction network respectively, and obtaining a plurality of feature vectors corresponding to the outputs of the plurality of first convolutional networks;

Inputting the time series network traffic data into the pooling network of the time series feature extraction network to obtain a first feature vector output by the pooling network;

Inputting the time series network traffic data into the second convolutional network of the time series feature extraction network to obtain a second feature vector output by the second convolutional network;

The multiple feature vectors, the first feature vector and the second feature vector are fused to obtain a feature map and output it.

In TCN, the core computing structure is called dilated causal convolution, which consists of two types of convolutions: dilated convolution and causal convolution.

Causal convolution ensures that at any time point t, the output depends only on the input at time point t and before, and does not depend on the input after time point t. Causal convolution can be achieved by properly "padding" the input data. Specifically, assuming there is a 1D (1-dimensional) input sequence and a convolution kernel of size k, in order to achieve causal convolution, k-1 zeros are padded at the beginning of the sequence, and then a standard convolution operation is performed, that is, the input sequence is point-multiplied using the convolution kernel. In this way, the output of the convolution at any time point t will only depend on the input at time point t and before. Figure 3 is a schematic diagram of TCN causal convolution in the prior art. As shown in Figure 3, 4 zeros are padded here. At time point t=1, the convolution kernel is point-multiplied with the input sequence to obtain C*1+11F.

Dilated convolution is a key component in TCN. It enlarges the receptive field of the convolution layer by filling the convolution kernel with "holes". Filling holes is a common method in convolution operations. This method can enlarge the receptive field without increasing model parameters or computational costs. In standard convolution, the elements of the convolution kernel are continuous and cover continuous parts of the input data at a time. In dilated convolution, there are gaps between the elements of the convolution kernel. These gaps allow the convolution kernel to cover a wider range.

Residual connection (or residual block, residual link) is a technique in deep learning to enhance the stability of network training. It was first proposed by He et al. in a 2015 article to solve the gradient vanishing and gradient exploding problems in deep networks. This design was later widely adopted in a variety of network architectures, including TCN.

In TCN, the main purpose of residual links is to help the model learn dependencies at different time scales and ensure training stability as the depth increases. In the design of residual connections, the output of the current layer is not only passed to the next layer, but also directly added to the input, forming a "short-circuit" connection. This design allows information to flow directly through multiple layers, providing a more direct path to update gradients. A residual block is essentially composed of dilated causal convolutions and 1x1 convolutions, and multiple residual blocks stacked in series form a TCN.

FIG4 is a schematic diagram of the structure of a TCN residual block in the prior art. As shown in FIG4 , in TCN, in the main path, the input undergoes a series of convolutions, normalization, activation, and dropout in series, and in the residual path, the input is directly output without any operation, and the output results of the two paths are added in the depth direction to form the final output. This structure ensures that if the model believes that the operation of the current layer will not add any useful information to the final output, then it can set the weights of these operations to be very small, so that the output of the main path is close to zero. In this way, the output of the model mainly depends on the residual connection. This gives the model a choice to either use the main path or rely on the residual path. In actual implementation, in order to ensure that the output of the main path and the output of the residual path have the same shape, some modification of the input or output may be required. For example, if the convolution operation in the main path changes the number of features, then a 1x1 convolution may need to be added to the residual path to match the number of features.

Considering the need for structural fusion with deep forest, and TCN can only obtain a wide receptive field after deep stacking, which undoubtedly increases the depth and complexity of the model, therefore, the residual block of TCN is improved.

FIG5 is a schematic diagram of the residual block structure of the temporal feature extraction network provided by the present invention. As shown in FIG5, based on the original residual block, the stacking mode is changed to a parallel form, and multiple first convolutional networks are connected in parallel to achieve rapid acquisition of local and wider information, and finally the results of the same level are fused for subsequent stacking. FIG5 exemplarily shows two first convolutional networks, and in the specific implementation process, the number of first convolutional networks can be adaptively set according to actual needs.

Optionally, the multiple feature vectors, the first feature vector and the second feature vector are weighted to obtain a feature map and output it.

Optionally, the pooling network includes a pooling layer, a normalization layer, an activation layer, and a dropout layer connected in sequence. The pooling layer may use average pooling, maximum pooling, etc., the normalization layer may use batch normalization, weight normalization, etc., and the activation layer may use a linear rectification function, a sigmoid function, etc., without limitation here.

Optionally, the pooling layer in the pooling network adopts average pooling to average the features in the neighborhood, smooth the feature map, and reduce the impact of local data noise.

Furthermore, each of the multiple first convolutional networks comprises a dilated causal convolutional layer, a weight normalization layer, an activation layer and a discard layer connected in sequence.

Optionally, the activation layer uses ReLU (Rectified Linear Unit).

By expanding the causal convolution, the receptive field of the convolution kernel is increased, long-distance dependencies are understood, and the causality of the time series is maintained; weight normalization is used to reduce time overhead, increase computing speed, and reduce the introduction of noise; the ReLU activation function is used to increase the network training speed, increase the nonlinearity of the network, improve the expressiveness of the model, and prevent the disappearance of the gradient; through the dropout layer, the neural network units are discarded with a certain probability to prevent overfitting and further improve the model operation speed.

In an optional embodiment, the second convolutional network includes a 1*1 convolutional layer to match the number of features.

Based on any of the foregoing embodiments, fusing the multiple feature vectors, the first feature vector, and the second feature vector to obtain and output a feature map includes:

The multiple feature vectors, the first feature vector, and the second feature vector are added to obtain a feature map and output it.

Adding multiple feature vectors, the first feature vector and the second feature vector, that is, directly adding the output of a series of operations on the main path to the input, forms a "short-circuit" connection, allowing information to flow directly through multiple layers, providing a more direct path to update the gradient.

In an optional embodiment, inputting the time series network traffic data into a first deep forest model to obtain a first prediction result output by the first deep forest model includes:

Input the time series network traffic data into the feature screening module of the first deep forest model to obtain the screening features output by the feature screening module, wherein the feature screening module uses the minimum absolute value selection and shrinkage operator LASSO;

The screening features are input into a multi-granularity scanning module of the first deep forest model to obtain a first prediction result output by the multi-granularity scanning module.

The original deep forest uses a multi-granularity scanning method to form feature subsets. This idea is derived from CNN convolution and has a strong feature relationship mining capability for feature sets with spatial and sequential relationships. However, if the feature vectors received by the deep forest are too large or too many sliding windows are selected, the feature subsets will be too dense, making the subsequent process complicated.

Figure 6 is a structural schematic diagram of the improved deep forest model provided by the present invention. As shown in Figure 6, the present invention adds a layer of LASSO (Least Absolute Shrinkage and Selection Operator) in the multi-granularity scanning stage to perform fast screening of vector features. Through the L1 normalization of LASSO, the purpose of fast dimensionality reduction and screening of important features is achieved to reduce the complexity of subsequent modeling.

The embodiment of the present invention overcomes the problem of feature vector redundancy to a certain extent. By pre-screening features through LASSO, the modeling process of subsequent meaningless feature subsets is reduced, and the processing efficiency of deep forest in high-dimensional features and large data volume scenarios such as network traffic prediction is accelerated.

The network traffic prediction method provided by the present invention is described below in conjunction with simulation experiments.

Time series network traffic data refers to indicators related to consumer and total communication traffic, such as basic identity indicators, basic communication indicators, app usage indicators, communication indicators in the past six months, etc. The time series indicators are used for modeling the time series prediction model, and the remaining indicators are used for modeling the deep forest model. Some indicators are shown in Table 1 below.

Table 1 Exemplary indicator data

Time Series Forecasting Model Improved Deep Forest Model Common app communication traffic gender Average daily call duration age ... Package Type ... App usage time/traffic

When training the multi-granularity scanning stage model of the improved deep forest model, the multi-granularity scanning stage parameter settings are shown in Table 2 below.

Table 2 Multi-granularity scanning stage parameters

parameter name Parameter Value Number of models 2. Random Forest, Extreme Random Forest Sliding Window The three lengths are 4, 8, and 16 respectively; the step length is 1 Number of decision trees 500 Decision Tree Splitting Rules The leaf node reaches full purity or the depth reaches 50 Evaluation Metrics Mse/Mae

When training the cascade stage model of the improved deep forest model, the cascade stage parameter settings are shown in Table 3 below.

Table 3 Cascade stage parameters

parameter name Parameter Value Number of models 4. 2 random forests, 2 extreme random forests Number of decision trees 500 Decision Tree Splitting Rules The leaf nodes are completely pure Cascade Depth Judging by classification longitude gain Evaluation Metrics Mse/Mae Submodel cross validation folds 5

The time series prediction model parameter settings are shown in Table 4 below.

Table 4 Time series prediction model parameters

parameter name Parameter Value Sliding Window twenty one Stacked structure 3 layers Layer-by-layer expansion rate (1, 2), (2, 3), (3, 4) Convolution Kernel 7 Evaluation Metrics Mse/Mae

Compared with other models, deep forest has a smaller number of related parameters due to its adaptive deep growth mode. Each predictor has a certain complementary effect with the adaptive parameters of deep forest. That is, if the accuracy of a single predictor parameter is not high, the corresponding depth of deep forest will automatically increase, otherwise the depth will decrease relatively. Therefore, better results can be obtained without using various parameter optimization algorithms.

The errors between the prediction results of the original TCN model, the original deep forest model, and this scheme and the actual network traffic are shown in Table 5.

Table 5 Model prediction results error

In summary, the fusion model structure proposed in this scheme has a certain improvement in prediction accuracy compared with the original TCN model and deep forest model.

In summary, the present invention simultaneously inputs data into two different model branches: an improved TCN branch and an improved deep forest branch. The improved TCN branch uses dilated causal convolution to capture the temporal characteristics of time series data, and quickly obtains local and wider information by connecting multiple convolutional networks in parallel. Multiple TCN layers are stacked as needed to obtain deeper abstract features. At the end of TCN, the prediction results are output using a fully connected layer or other forms; the improved deep forest branch reduces the feature dimension and screens important features through LASSO, uses multi-granularity scanning to extract features, and constructs a cascade forest structure, which includes multiple random forests, and the output of each forest becomes the input of the next forest; during the training process, the feature extraction vectors of each structural segment of TCN are input into the deep forest, and a forest model of the feature map is established to increase the richness and generalization of the model; finally, all results are output by weighted averaging according to the quality of the results.

Traditional models, whether statistical models or machine learning models, may not be able to fully utilize all relevant information in the data, especially when faced with high-dimensional data. They may not be able to effectively extract and select features that are helpful for prediction, which limits the performance of the model when processing complex patterns and hidden relationships. In addition, although some expert experience-type features can be manually constructed, the effectiveness of the features cannot be guaranteed, and the constructed features are limited, extremely dependent on domain knowledge, costly, and lack flexibility. The present invention combines the temporal convolution capability of TCN and the complex pattern processing capability of deep forests to more effectively extract valuable features from large amounts of user data.

Although traditional statistical models and machine learning models can provide reasonable predictions in some cases, they are usually difficult to capture long-term dependencies and complex nonlinear relationships in time series data, which affects the prediction accuracy of the model in dynamic and nonlinear environments; the present invention utilizes the long sequence modeling advantages of TCN and the nonlinear pattern recognition capabilities of deep forests to improve the prediction accuracy of communication traffic changes.

In addition, many existing models may not take into account a variety of different time series patterns, such as periodicity, trends, and seasonal changes when they are designed, and they may lack the ability to adapt to new data and rapidly changing network conditions; the hybrid model of the present invention can adapt to different network environments and data patterns to cope with the variability of network traffic.

The network traffic prediction device provided by an embodiment of the present invention is described below. The network traffic prediction device described below and the network traffic prediction method described above can be referenced to each other.

FIG. 7 is a schematic diagram of the structure of a network traffic prediction device provided by the present invention. As shown in FIG. 7 , the network traffic prediction device includes:

A first prediction module 710, configured to input the time series network traffic data into a first deep forest model to obtain a first prediction result output by the first deep forest model;

A feature extraction module 720 is used to input the time series network traffic data into a time series feature extraction network of a time series prediction model to obtain a feature graph output by the time series feature extraction network;

A second prediction module 730, configured to input the feature map into a second deep forest model to obtain a second prediction result output by the second deep forest model;

A third prediction module 740, configured to input the feature graph into a prediction network of the time series prediction model to obtain a third prediction result output by the prediction network;

The traffic prediction module 750 is used to input the first prediction result, the second prediction result and the third prediction result into a weighted average module to obtain a network traffic prediction result output by the weighted average module.

It should be noted that the network traffic prediction device provided in the embodiment of the present invention can execute the network traffic prediction method described in any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

FIG8 is a schematic diagram of the structure of an electronic device provided by the present invention. As shown in FIG8, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the network traffic prediction method, which includes: inputting the time series network traffic data into the first deep forest model to obtain the first prediction result output by the first deep forest model; inputting the time series network traffic data into the time series feature extraction network of the time series prediction model to obtain the feature map output by the time series feature extraction network; inputting the feature map into the second deep forest model to obtain the second prediction result output by the second deep forest model; inputting the feature map into the prediction network of the time series prediction model to obtain the third prediction result output by the prediction network; inputting the first prediction result, the second prediction result and the third prediction result into the weighted average module to obtain the network traffic prediction result output by the weighted average module.

In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the network traffic prediction method provided in the above-mentioned embodiments, and the method includes: inputting time series network traffic data into a first deep forest model to obtain a first prediction result output by the first deep forest model; inputting the time series network traffic data into a time series feature extraction network of a time series prediction model to obtain a feature graph output by the time series feature extraction network; inputting the feature graph into a second deep forest model to obtain a second prediction result output by the second deep forest model; inputting the feature graph into a prediction network of the time series prediction model to obtain a third prediction result output by the prediction network; inputting the first prediction result, the second prediction result and the third prediction result into a weighted average module to obtain a network traffic prediction result output by the weighted average module.

On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the network traffic prediction method provided in the above-mentioned embodiments, the method comprising: inputting time series network traffic data into a first deep forest model to obtain a first prediction result output by the first deep forest model; inputting the time series network traffic data into a time series feature extraction network of a time series prediction model to obtain a feature graph output by the time series feature extraction network; inputting the feature graph into a second deep forest model to obtain a second prediction result output by the second deep forest model; inputting the feature graph into a prediction network of the time series prediction model to obtain a third prediction result output by the prediction network; inputting the first prediction result, the second prediction result and the third prediction result into a weighted average module to obtain a network traffic prediction result output by the weighted average module.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. A method for predicting network traffic, comprising:

inputting the time sequence network flow data into a first depth forest model to obtain a first prediction result output by the first depth forest model;

inputting the time sequence network flow data to a time sequence feature extraction network of a time sequence prediction model to obtain a feature map output by the time sequence feature extraction network;

Inputting the feature map to a second depth forest model to obtain a second prediction result output by the second depth forest model;

Inputting the feature map to a prediction network of the time sequence prediction model to obtain a third prediction result output by the prediction network;

And inputting the first prediction result, the second prediction result and the third prediction result into a weighted average module to obtain a network flow prediction result output by the weighted average module.

2. The network traffic prediction method according to claim 1, wherein the inputting the time-series network traffic data to a time-series feature extraction network of a time-series prediction model, to obtain a feature map output by the time-series feature extraction network, includes:

Respectively inputting the time sequence network flow data into a plurality of first convolution networks of the time sequence feature extraction network to obtain a plurality of feature vectors correspondingly output by the plurality of first convolution networks;

Inputting the time sequence network flow data into a pooling network of the time sequence feature extraction network to obtain a first feature vector output by the pooling network;

inputting the time sequence network flow data into a second convolution network of the time sequence feature extraction network to obtain a second feature vector output by the second convolution network;

and fusing the plurality of feature vectors, the first feature vector and the second feature vector to obtain a feature map and outputting the feature map.

3. The network traffic prediction method according to claim 2, wherein each of the plurality of first convolutional networks comprises an expansion causal convolutional layer, a weight normalization layer, an activation layer, and a discard layer, which are sequentially connected.

4. The network traffic prediction method according to claim 2, wherein the second convolutional network comprises a 1*1 convolutional layer.

5. The network traffic prediction method according to any one of claims 2 to 4, wherein the merging the plurality of feature vectors, the first feature vector, and the second feature vector to obtain and output a feature map includes:

and adding the plurality of feature vectors, the first feature vector and the second feature vector to obtain a feature map and outputting the feature map.

6. The network traffic prediction method according to claim 1, wherein the inputting the time-series network traffic data into the first depth forest model to obtain the first prediction result output by the first depth forest model includes:

inputting the time sequence network flow data to a feature screening module of a first depth forest model to obtain screening features output by the feature screening module, wherein the feature screening module uses a minimum absolute value selection and contraction operator LASSO;

And inputting the screening characteristics to a multi-granularity scanning module of the first depth forest model to obtain a first prediction result output by the multi-granularity scanning module.

7. A network traffic prediction apparatus, comprising:

The first prediction module is used for inputting the time sequence network flow data into a first depth forest model to obtain a first prediction result output by the first depth forest model;

The feature extraction module is used for inputting the time sequence network flow data into a time sequence feature extraction network of a time sequence prediction model to obtain a feature map output by the time sequence feature extraction network;

The second prediction module is used for inputting the feature map into a second depth forest model to obtain a second prediction result output by the second depth forest model;

the third prediction module is used for inputting the feature map to a prediction network of the time sequence prediction model to obtain a third prediction result output by the prediction network;

and the flow prediction module is used for inputting the first prediction result, the second prediction result and the third prediction result into the weighted average module to obtain the network flow prediction result output by the weighted average module.

8. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the network traffic prediction method according to any of claims 1 to 6 when the computer program is executed.

9. A non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor, implements the steps of the network traffic prediction method according to any of claims 1 to 6.

10. A computer program product comprising a computer program which, when executed by a processor, implements the steps of the network traffic prediction method according to any one of claims 1 to 6.