Research on Wide Area Network Performance Anomaly Detection Technology Based on Machine Learning

Institute of High Energy Physics, Beijing 100049, China

^* e-mail: chengli@ihep.ac.cn
^** e-mail: zengshan@ihep.ac.cn

Published online: 7 October 2025

Abstract

The upgrade of the IHEP WLCG Tier-1 site’s network bandwidth from 40 Gbps to 100 Gbps demands robust performance monitoring to ensure reliability. Traditional methods face inefficiencies in pinpointing anomalies within large-scale networks, particularly for long-lived connections. This study proposes a machine learning framework for wide area network (WAN) anomaly detection, targeting long-lived connections to address challenges in traffic analysis. Our pipeline integrates data acquisition (capturing packet metadata), PostgreSQL-based storage, and analysis. A multidimensional time-series training set was built using five-tuple metadata, including latency, retransmission, and packet disorder metrics. An unsupervised model, trained solely on normal long-term connection data without labeled anomalies, identifies multivariate traffic deviations. Initial tests on custom-built test datasets demonstrate stable convergence and reasonable prediction accuracy, with the model effectively flagging abnormal patterns. However, validation on real-world network data remains pending. Future work will rigorously evaluate the framework using authentic normal and anomalous datasets to assess its practical applicability. This approach provides a scalable foundation for automated diagnostics, reducing manual effort and enhancing operational efficiency in high-bandwidth environments.