Cesnet dataset enables long term network traffic forecasting and anomaly detection
CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection
Artificial IntelligenceMachine LearningNetworking and Internet Architecture
Summary
Many network tools try to predict future traffic to spot problems early. But earlier data collections are too short to see yearly patterns or big changes over years. The authors provide a new dataset from the Cesnet network covering almost 4.5 years, capturing many institutions and IP addresses. They show that annual cycles are important and that models need at least a full year’s data to learn them well. This dataset helps test traffic forecasting over long times and detect unusual events more reliably.
What this means in practice
- •For network operators: Evaluate network traffic forecasting models for detecting annual patterns and long-term anomalies using multi-year data.
- •For security monitoring teams: Test and improve anomaly detection methods that require long-term data to identify evolving threats and unusual behavior over years.
Authors
Josef Koumar, Karel Hynek, Kamil Jerabek, Pavel Siska
Abstract
Forecast-based models are fundamental to network traffic management and anomaly detection. However, it is essential to evaluate these forecasting models over extended periods of time in order to assess their adaptability to unexpected phenomena and shifts in underlying patterns. This kind of long-term evaluation requires multi-year data to account for yearly seasonality and behavioral drift. Existing public datasets are too short to support such long-horizon forecasting tasks. We introduce CESNET-TimeSeries26, comprising 995 days of continuous traffic time series from the CESNET3 network, together with a single subnet spanning approximately 4.5 years. The dataset captures 278,466 IP addresses, 285 institutions, and 566 institutional subnets at three aggregation intervals. The dataset provides a definitive longitudinal benchmark for evaluating forecasting models in both operational management and security monitoring. We demonstrate that annual seasonality is the dominant periodic component. Moreover, we show that a forecasting model can exploit the annual component only when its training window covers at least one complete annual cycle, which no sub-year dataset provides.