💻 computer science

A Two-Level LSTM Framework for Traffic Forecasting and Early Congestion Prediction in SD-WAN Networks

This paper proposes a two-level LSTM framework for SD-WAN networks that integrates channel load prediction and critical congestion classification to enable proactive route management, demonstrating superior forecasting accuracy and decision reliability compared to traditional methods.

Original authors: Vitalii Savchenko, Yurii Kravchenko, Serhii Stavytskyi, Olga Leshchenko, Olena Starkova

Published 2026-08-12

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Vitalii Savchenko, Yurii Kravchenko, Serhii Stavytskyi, Olga Leshchenko, Olena Starkova

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a massive, bustling highway system where data packets are cars zooming from one city to another. In the past, traffic managers (the network controllers) would only react when they saw a jam forming or a crash happening; they'd wave their hands and say, "Oh no, move over!" after the damage was already done. This is called "reactive" management. But what if these managers had a crystal ball? What if they could see a traffic jam forming ten minutes before the first car even slowed down? That is the dream of "proactive" management in a type of super-smart network called SD-WAN (Software-Defined Wide Area Network). To do this, scientists use something called "machine learning," which is basically teaching a computer to look at past traffic patterns and guess what will happen next. One of the most popular tools for this is called an LSTM (Long Short-Term Memory) network, which is like a robot brain that has an excellent memory for remembering sequences of events, like the rhythm of rush hour. The big question researchers are trying to answer is: Can we build a system that doesn't just guess the exact number of cars on the road, but also sounds a loud alarm if a massive traffic jam is about to happen, giving the network enough time to reroute traffic before anyone gets stuck?

This paper, written by a team from Taras Shevchenko National University of Kyiv, proposes a clever two-step solution to this problem. Instead of relying on just one method to predict the future, they built a "two-level" framework that acts like a team of two different experts working together.

The first expert is a Traffic Forecaster. Its job is to guess the exact percentage of the road that will be used in the future. The researchers tested this expert against some older, simpler methods (like just guessing the traffic will be the same as it was a minute ago, or taking an average of the last few minutes). They found that their new "LSTM" expert was much better at guessing the numbers. For example, when looking 120 minutes into the future, their model was the most accurate, with an average error of about 18.392%. This means it could tell the network, "In two hours, we'll be at about 85% capacity," which is helpful, but maybe not enough to stop a sudden, scary traffic spike.

The second expert is a Congestion Alarmist. This one doesn't care about the exact number of cars; it only cares about one thing: "Is a disaster coming?" It looks at the same traffic data but asks a simple yes-or-no question: "Will the road get so full (over 90% full) that it breaks?" The researchers trained this alarmist to be very sensitive. They set a rule that it must catch at least 80% of all future traffic jams (a metric called "Recall"). Even if it sometimes cries "Wolf!" when there isn't one (a false alarm), it is better than missing a real jam. The results showed that this alarmist was very good at its job, successfully predicting critical jams 5 to 120 minutes in advance with a high level of accuracy.

The real magic happens when these two experts work together. The authors suggest that using just the number-guesser or just the alarmist isn't enough. Instead, they combined them into a single "Decision Confidence Index." Think of it like a weather app that gives you a percentage chance of rain. If the number-guesser says "It might rain" and the alarmist says "It's definitely going to pour," the system becomes super confident that you need an umbrella. The paper shows that by combining these two independent sources of information, the network controller can make decisions with much higher confidence (up to 99.5% confidence for short-term predictions) than if it relied on just one method.

The researchers tested all of this using simulated data that mimics real internet traffic, including the daily ups and downs of user activity. They found that while predicting the exact future is hard (especially far into the future), predicting that a problem is coming is very doable. They argue that this two-level approach allows SD-WAN networks to switch routes proactively, like a GPS rerouting you before you even hit the traffic, rather than waiting until you are already stuck. While the paper doesn't claim this solves every problem in the world, it suggests that this specific two-level framework is a very promising way to make networks faster and more reliable by getting ahead of the congestion before it happens.

Technical Summary: A Two-Level LSTM Framework for Traffic Forecasting and Early Congestion Prediction in SD-WAN Networks

Problem Statement
Current Software-Defined Wide Area Network (SD-WAN) control algorithms predominantly operate on a reactive basis, reconfiguring routes only after congestion or service degradation has already occurred. This latency leads to significant traffic delays and potential network failures. While existing research addresses either network traffic forecasting (predicting numerical values) or congestion detection as separate tasks, there is a lack of integrated frameworks that combine quantitative traffic prediction with the probabilistic assessment of critical network states. The authors argue that numerical predictions alone are often insufficient for proactive decision-making, as they may fail to capture the probability of sharp, short-term impulse overloads that degrade Quality of Service (QoS).

Methodology
The paper proposes a two-level Long Short-Term Memory (LSTM) framework designed for active route management. The system utilizes the CESNET-TimeSeries24 dataset, focusing on relative bandwidth utilization as the primary metric. The framework operates on two parallel levels:

Level 1: Numerical Traffic Forecasting (Regression)
- Architecture: A multilayer recurrent neural network consisting of two serially connected LSTM layers (64 and 32 cells), a Dropout layer (0.2), two fully connected linear layers, and a Ramp activation function.
- Function: Predicts the specific numerical value of future channel load (Bandwidth Utilization) for horizons of 5, 15, 30, 60, and 120 minutes.
- Training: Optimized using the ADAM algorithm with a batch size of 64 over 100 epochs.
- Comparison: The model is benchmarked against Simple Forecast, Moving Average, and SARIMA methods.
Level 2: Early Congestion Prediction (Classification)
- Architecture: A similar LSTM structure (64 and 32 cells, Dropout 0.2) but configured for binary classification. It outputs probabilities for two classes: "Normal" and "Critical" (defined as load > 90%).
- Function: Estimates the probability that at least one critical overload will occur within the specified forecasting horizon.
- Thresholding: The classification threshold is optimized to ensure a Recall of at least 0.8, prioritizing the detection of critical events over minimizing false positives, as missing a congestion event is deemed more costly than a false alarm.

Key Contributions

Integrated Decision Support System: The paper introduces a unified framework that simultaneously performs numerical traffic forecasting and critical congestion classification, feeding both results into an SD-WAN controller for proactive route selection.
Decision Confidence Index (DCI): The authors propose a novel metric to evaluate the reliability of the framework's decisions. They define two forms of this index:
- A linear weighted average of forecast confidence (derived from MAPE) and classification confidence (derived from Precision).
- A nonlinear integration model ( $R_{SD-WAN}^{(2)}$ ) that treats the two levels as independent information sources, calculating the probability that at least one module provides a correct result.
Threshold Optimization Strategy: A specific methodology for selecting classification thresholds is detailed, balancing high Recall (≥0.8) with maximum Precision to suit the operational needs of SD-WAN.

Experimental Results

Forecasting Accuracy: The LSTM model outperformed Simple Forecast, Moving Average, and SARIMA across all tested horizons (5–120 minutes) in terms of Root Mean Squared Error (RMSE), Mean Absolute Error (MAE), and Mean Absolute Percentage Error (MAPE). For the longest horizon (120 minutes), the LSTM achieved a MAPE of 18.392%, compared to 19.140% for SARIMA and significantly higher errors for the other methods.
Classification Performance: The LSTM classifier maintained a Recall of approximately 0.80–0.81 across all horizons when the threshold was set to meet the ≥0.8 constraint. Precision decreased as the horizon increased (from 0.925 at 5 minutes to 0.613 at 120 minutes), reflecting the inherent uncertainty in long-term prediction. The F1-scores ranged from 0.696 to 0.860.
Decision Confidence: The integration of the two levels significantly improved the overall reliability of the decision support. Using the nonlinear integration model ( $R_{SD-WAN}^{(2)}$ ), the confidence index remained high (0.929 at 120 minutes) compared to the linear average (0.715), demonstrating that the combination of independent models compensates for individual weaknesses.

Significance and Claims
The authors claim that the proposed two-level architecture offers a feasible and effective solution for implementing proactive route management in SD-WAN networks. By moving beyond simple numerical regression to include a dedicated congestion probability classifier, the system provides the SD-WAN controller with more reliable, actionable intelligence. The study concludes that integrating independent forecasting and classification models yields a higher level of confidence in decision-making than relying on either approach in isolation. The framework is presented as a step toward more intelligent network management that can prevent service degradation before it occurs, though the authors note that future work should involve validation on real-world SD-WAN traffic and the integration of multidimensional features like delay and jitter.

Technical Summary: A Two-Level LSTM Framework for Traffic Forecasting and Early Congestion Prediction in SD-WAN Networks

More like this