Research on Wide Area Network Performance Anomaly Detection Technology Based on Machine Learning

The upgrade of the IHEP WLCG Tier-1 site’s network bandwidth from 40 Gbps to 100 Gbps demands robust performance monitoring to ensure reliability. Traditional methods face inefficiencies in pinpointing anomalies within large-scale networks, particularly for long-lived connections. This study proposes a machine learning framework for wide area network (WAN) anomaly detection, targeting long-lived connections to address challenges in traffic analysis. Our pipeline integrates data acquisition (capturing packet metadata), PostgreSQL-based storage, and analysis. A multidimensional time-series training set was built using five-tuple metadata, including latency, retransmission, and packet disorder metrics. An unsupervised model, trained solely on normal long-term connection data without labeled anomalies, identifies multivariate traffic deviations. Initial tests on custom-built test datasets demonstrate stable convergence and reasonable prediction accuracy, with the model effectively flagging abnormal patterns. However, validation on real-world network data remains pending. Future work will rigorously evaluate the framework using authentic normal and anomalous datasets to assess its practical applicability. This approach provides a scalable foundation for automated diagnostics, reducing manual effort and enhancing operational efficiency in high-bandwidth environments.