Characteristic Analysis and Modeling of Network Traffic for the Electromagnetic Launch System

Theelectromagnetic launch system(EMLS)isakind oflarge-scalecomplex systemwith strongmechanical, electrical, and hydraulic coupling. The effective operation of the system requires the support of advanced and reliable health management system, and the function of the health management system relies on the network traffic to complete data transmission and interaction. Through protocol filtering and time-frequency characteristic analysis of network traffic, it is found that the system mainly includes CIP and TCP; traffic of CIP shows continuity and stability, while traffic of TCP shows sparsity and impact. Based on the analysis of traffic characteristics, an SVR-ARMA network traffic model is established, which improves the prediction accuracy and performance of network traffic and provides a reliable technical guarantee for the fault diagnosis and health management of the EMLS.


Introduction
The electromagnetic launching system is a kind of launching technology that converts electromagnetic energy into the kinetic energy of the payload by using electromagnetic energy to do work. The system represented by the EMLS has the characteristics of large scale, high complexity, and strong mechanical, electrical, and hydraulic coupling [1,2], and its development, production, and maintenance costs are increasingly high. The increase of system complexity will inevitably lead to the increase of failure rate. Without the support of advanced and reliable health management system, the reduction of effective running time ratio of the EMLS is unacceptable. The existing health management functions include data acquisition, data monitoring, data presentation, fault alarm, and recording. The realization of these functions relies on network traffic to complete data transmission and interaction. To improve network performance, it is necessary to analyze and study network traffic characteristics, which can effectively reflect network performance and system operation [3]. The establishment of relevant traffic model on this basis is conducive to improving the stability, reliability, and operation efficiency of the network system in long-term operation [4]. It plays a fundamental supporting role in improving network performance and making full use of network resources and provides reliable technical guarantee for the fault diagnosis and health management of the EMLS.
Previous studies on network traffic model can be divided into linear model and nonlinear model. Linear models include Poisson model and Markov process model, and traffic characteristics have short correlation [5,6]. Nonlinear models include ON/OFF model with heavy tail distribution and fractal Brownian motion model, and traffic characteristics have long correlation and self-similarity [7][8][9][10]. The current research focus on traffic modeling has shifted to the problem of traffic modeling for all kinds of new networks. James et al. [11] studied the modeling problem under the traffic of denial of service attack. Ghandali et al. [12] studied traffic modeling in the network of multimedia data transmission. Cho et al. [13] proposed the traffic model of the sink node of the enterprise network to solve the problem of traffic anomaly detection. Addie et al. [14] studied the traffic modeling problem of transparently transmitted optical Internet. It can be seen that the model study of network traffic will continue to evolve with the changes in the types and characteristics of network services. Each model has only the most suitable network type to describe, and there is no universal network traffic model.

Analysis of Traffic Characteristics of the EMLS Network
. . Network Traffic Collection and Processing. The characteristic of the EMLS is the combination of periodic steady state and aperiodic transient state. Network traffic data are mainly state data and recorded data. The state data is a kind of data with sampling frequency of 1Hz and recorded in time, corresponding to the periodic steady state process. The recorded data is a kind of data with sampling frequency of 2kHz and only recorded before and after the occurrence of events (includes launch, maintenance testing, and failure events) and the process of a few seconds, corresponding to the aperiodic transient process. As far as the test environment permits, packet capturing software is run on the device side of the EMLS to analyze the packets captured. Each operating mode (OM) takes three minutes as the acquisition time. The statistical results of packet capturing under multiple different operating modes are shown in Table 1.
As can be seen from Table 1, the data packets captured under different operating modes are quite different, but SMB, CIP, and TCP are the three protocol types that account for the vast majority, more than 99%. In Table 1, operating mode 2 is a typical working condition, and the data analysis below is based on the data of this operating mode.
Suppose L(t) is the packet size captured at time t, fs is the sampling frequency, and Δt is the sampling interval; then the network traffic x(t) at time t is approximately Considering the requirements of the actual frequency resolution of the EMLS and the limitation of the calculation amount, the sampling frequency is taken as 50Hz (i.e., the sampling interval is 0.02s). The traffic obtained by processing according to the above algorithm is shown in Figure 1. It can be seen from the figure that the network traffic starts from about 68s and reaches a peak from 73s to 78s, and then the sudden traffic ends and the system returns to a steady state. The network traffic is filtered by protocol, and the traffic waveforms of CIP and TCP are extracted, respectively, as shown in Figures 2 and 3. It can be seen that the two types of protocol traffic have obviously different characteristics; CIP traffic has obvious continuity and stationarity, while TCP traffic has sparsity and impact.  characteristics of the signal, but also analyze the frequency time-varying characteristics of the traffic. It is very suitable for analyzing the network characteristics of the EMLS. In this paper, the short-time Fourier transform (STFT) is employed to analyze the traffic characteristics of EMLS. STFT is a localized time-frequency analysis method, which firstly divides the signal into several fixed size time windows, and then Fourier transform is used to analyze the frequency existing in each time window.
Define the window function ( ) ∈ 2 ( ),̂( ) ∈ 2 ( ), ( ) ∈ 2 ( ),̂( ) ∈ 2 ( ); then for the time signal where STFTx(t,f ) is the spectrum of local signal x(t) in a time window near time t. The size of the window function determines the degree of proximity to time t, and its energy density spectrum is The network traffic of CIP and TCP obtained in Section 2.1 is transformed by STFT, and their time-frequency characteristics are analyzed. Gaussian window function is selected as the window function, and the window radius is set as 0.05 of the total data length. The results are shown in   Figure 4, the network traffic of CIP shows strong randomness in time domain. In the frequency domain, it shows a stable periodicity, and the main energy is concentrated in the low frequency band. Other high energy frequency points are concentrated at 2Hz, 4Hz, 8Hz, 10Hz, and 12Hz, where the amplitude at 10Hz is the largest, which is consistent with the software setting of CIP communication cycle in the EMLS.
Due to the obvious shock traffic of TCP in the aperiodic transient process, the extremely high peak traffic will annihilate other protocol traffic and TCP needs to be divided into two periods for analysis. Figure 5 shows the STFT spectrum of TCP in a nonimpact period of 30s. In the time domain, there is a good periodicity. However, according to the results of frequency domain analysis, the spectral lines are messy, the harmonic components are high, the frequency band distribution is wide, and the effective frequency exceeds Nyquist frequency (half of sampling frequency, which is 25Hz). When the sampling frequency is increased to 100Hz, the spectrum line distribution obtained also occupies the entire frequency band. Therefore, it can be inferred that there is no significant attenuation of the high frequency band in the nonimpact period. Due to uneven distribution of the segment traffic spectrum with time, obvious discontinuities, and frequency drift, and the drifting time corresponds to the sudden change of network traffic; it can be inferred that the phenomenon is caused by special traffic control mechanism of TCP, which may be one of the reasons that TCP traffic has self-similarity and long correlation. Figure 6 shows the STFT spectrum of TCP in the impact period of 30s. It can be seen that the spectrum of impact traffic is mainly distributed in the low frequency band less than 5Hz. Since the energy at impact is too large, the spectral lines at other times are annihilated; the spectral lines at nonimpact time can not be seen in the figure. It is found that the waveform of TCP traffic during the impact period has a certain randomness, but the peak value of spectrum is basically kept at the same level, which indicates that the total traffic generated in each operating mode is basically consistent.
It can be seen from the above analysis that the Ethernet of the EMLS presents a relatively stable characteristic in the periodic steady state; the main transmission in the link is CIP and a small number of TCP packets. In the aperiodic transient state, the characteristics of shock are presented. TCP packets are mainly transmitted in the link, while the CIP packets remains basically unchanged. Overall, the EMLS has a more complex traffic periodic and traffic impact. The periodicity is caused by the periodicity of the state data uploaded from the bottom equipment such as network controller and reinforcement machine to the top machine. The impact is caused by the fact that when the EMLS is in operation, the bottom equipment will upload a large number of recorded data within seconds, which will result in multiple growth of network traffic, causing the impact of traffic on the aggregation link. The analysis of the network traffic characteristics provides basis for the selection of Ethernet link bandwidth and switching equipment and has reference significance for network design.

Network Traffic Model of the EMLS Based on SVR-ARMA
Based on the analysis of the network traffic characteristics of the EMLS, the wavelet decomposition method is adopted 4 Mathematical Problems in Engineering    to decompose the network traffic into a trend traffic and the sum of each detail traffic. In order to improve the prediction accuracy and calculation speed of the network traffic, SVR model and ARMA model are used to predict the trend traffic and detail traffic, respectively, according to the different characteristics of the trend traffic and detail traffic. The advantages of the two models are used to ensure better function approximation and avoid overfitting of detailed signals. The SVR-ARMA model is shown in Figure 7.
The specific algorithm steps of SVR-ARMA model are as follows: A The network traffic is taken as the original sample, which is divided into training sample and test sample.
B According to the actual situation, the appropriate mother wavelet coefficients and the decomposition layers are selected, and then the training samples are decomposed by wavelet to obtain the high frequency coefficient sequences and low frequency coefficient sequences.
C The coefficients obtained in step B are reconstructed using the wavelet inverse transform pair to obtain the detailed traffic rate and trend traffic rate.
D SVR algorithm is used to model the trend traffic, and ARMA algorithm is used to model the detailed traffic. Then, linear combination of the predicted results of each component is conducted to obtain the final predicted results of network traffic:

5)
wherêis the prediction result of the trend traffic signal and̂1 ∼̂are the prediction results of the detail traffic signal of each layer.
E Compared the predicted results with the actual network traffic, and the prediction error is analyzed and studied.

Test Verification and Comparative Analysis
. . Source of the Test Data. The test data come from the traffic collected in Ethernet of the EMLS, and the sampling frequency is 50Hz. 2000 data points with typical representativeness are selected randomly and continuously from the original data as the test samples, and the waveform is shown in Figure 8. The first 1900 points from the original data are selected as training samples for modeling, and the last 100 data are used as test samples to verify the effectiveness of the model.

. . Model Prediction of SVR-ARMA.
Aiming at the data points of the first 1900 training samples, fast Mallat algorithm is adopted to carry out wavelet decomposition, and the number of decomposition layers is selected as 5, db is selected as the decomposition and reconstruction of the parent wavelet function, and the trend traffic signal part a 5 and the detail traffic signal part d 1 ∼ d 5 of each layer could be obtained.
SVR model is adopted to predict the trend traffic signal part a 5 . After the normalization of a 5 , the radial basis function of = 0.5 is selected as the kernel function. After several tests on the parameters of SVR model, it is finally determined that the other parameters of SVR model are taken The predicted results obtained by SVR model and ARMA model are combined linearly according to (5), and the final predicted traffic is compared with the actual traffic. The comparison results are shown in Figure 9.
From the comparison results in Figure 9, it can be seen that the SVR-ARMA combined prediction model fits well for the main trend of sample traffic, but the details have certain fluctuation due to the large suddenness. This is because the wavelet decomposition decomposes the network traffic signals with high randomness and nonlinearity into multiple traffic signals with single frequency components, which reduces the interference between partial signals of different frequencies and thus effectively improves the prediction accuracy.
The predicted results of each model are shown in Table 2. The differences between training MRE and test MRE of different models are determined by the characteristics. ARMA model has a good effect on the traffic prediction of linear characteristics, especially for the short-time prediction with high accuracy and speed, while it has a poor effect on the nonlinear or impact traffic prediction. The advantages of SVR model are high prediction accuracy and good generalization ability. Thus for impact traffic like EMLS, the training MRE and test MRE of SVR are better than ARMA. For BPNN, because of the contradiction between prediction ability and  training ability, the fitting error is small, but the test sample error goes up, which is not suitable for EMLS. The SVR-ARMA model has the lowest training MRE and test MRE and the best prediction effect.

Conclusion
This paper firstly analyzes the traffic characteristics of different protocols in the EMLS network and analyzes the causes of the traffic characteristics. Based on the study of traffic characteristics, a network traffic model based on SVR-ARMA is proposed, which improves the prediction accuracy and the prediction performance of network traffic and provides reliable technical support for the fault diagnosis and health management of the EMLS.

Data Availability
The network data used to support the findings of this study are included within the article.

Conflicts of Interest
The authors declare that they have no conflicts of interest.