Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining

Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining Mohammad Arafath Uddin Shariff and Byrav Ramamurthy

arXiv:2608.05605v1 [cs.CR] 6 Aug 2026

School of Computing University of Nebraska-Lincoln Lincoln, NE, USA mshariff2@nebraska.edu, ramamurthy@unl.edu

Abstract—Research and Education Networks (RENs) serve as critical infrastructure for scientific discovery, yet they face a unique security paradox: their normal traffic patterns which are characterized by massive, bursty “elephant flows” are statistically indistinguishable from volumetric attacks such as DDoS to conventional monitoring systems. This similarity leads to high false-positive rates in anomaly detection, blinding security operators to genuine threats. In this paper, we propose and evaluate a high-fidelity traffic forecasting framework designed to establish dynamic security baselines for RENs. Leveraging an exclusive 57-day Internet2 dataset spanning ten backbone routers (13.7 billion packets), we perform the first large-scale benchmark of anomaly-aware forecasting models in this domain. We systematically evaluate six model families, from SARIMA to state-of-the-art long-sequence architectures (TiDE, PatchTST), across 960 experimental configurations. Our results demonstrate that these advanced architectures, particularly TiDE, reduce baseline prediction error by 30-42% compared to traditional methods (p < 0.001), significantly improving the distinction between legitimate scientific bursts and potential anomalies. Furthermore, we introduce a novel anomaly-integration strategy that improves model robustness by 3.3% in the presence of noise. This work provides the first statistically validated framework for distinguishing scientific workflows from network attacks, enabling more autonomous and resilient network security operations. Index Terms—Network Security, Anomaly Detection, Traffic Forecasting, Research and Education Networks, Deep Learning, Internet2, DDoS Mitigation

I. I NTRODUCTION Research and Education Networks (RENs), such as Internet2 and ESnet, form the nervous system of modern science, facilitating petabyte-scale data transfers for highenergy physics, genomics, and climate research [1]. As critical infrastructure, these networks are high-value targets for cyber threats, necessitating robust, AI-driven cybersecurity frameworks for their protection [2] However, securing RENs presents a unique challenge: the “normal” behavior of a REN often mimics the signatures of volumetric attacks. A single scientific workflow can saturate a 100 Gbps link for hours, generating extreme burstiness and traffic spikes that traditional Intrusion Detection Systems (IDS) might flag as a Distributed Denial of Service (DDoS) attack [3].

This ambiguity creates a severe operational security risk. If security operators tune detection thresholds too loosely, they miss genuine attacks (false negatives). If they tune them too tightly, legitimate scientific transfers trigger alarms (false positives), leading to “alert fatigue” and potentially the automated blocking of critical research data. To resolve this, REN security requires a dynamic baseline—a highly accurate, predictive model of what “normal” scientific traffic looks like at any given moment, enabling the isolation of true anomalies (attacks, failures) from predicted elephant flows. Despite this need, current security baselining techniques in RENs remain rudimentary. Three fundamental barriers have hindered progress: (1) Data Scarcity: Real-world REN datasets are rarely accessible for security research due to privacy concerns [4]; (2) Lack of Benchmarking: There is no systematic comparison of modern deep learning architectures for creating robust security baselines in these environments; and (3) Anomaly Blindness: Existing forecasting models often fail to account for the presence of anomalies in training data, leading to poisoned baselines that normalize attack patterns. In this work, we address these challenges by developing a robust, anomaly-aware forecasting framework for dynamic security baselining. We leverage an exclusive 57-day dataset from the Internet2 backbone to benchmark six model families, ranging from classical statistical methods to modern Transformers. By integrating unsupervised anomaly detection (Isolation Forest, Local Outlier Factor) directly into the forecasting pipeline, we demonstrate how to build models that are resilient to noise and capable of predicting legitimate bursts with high fidelity. Our contributions to network security and measurement are: (1) We analyze 13.7 billion packets from ten Internet2 routers, providing rare insight into the baseline traffic patterns of critical scientific infrastructure; (2) We conduct the first systematic evaluation of advanced long-sequence architectures (including MLP-based TiDE and Transformer-based PatchTST) against traditional baselines for REN traffic, demonstrating that Transformers offer superior fidelity for security baselining; (3) We introduce and evaluate four strategies for integrating

© 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

anomaly detection into the forecasting loop, showing that masking anomalies during training significantly improves the robustness of RNN-based security models; (4) We analyze the trade-offs between baseline accuracy and computational cost, providing actionable recommendations for deploying real-time anomaly detection support systems. The remainder of this paper is organized as follows. Section II reviews related work in network security and traffic analysis. Section III details our dataset and the anomaly-aware methodology. Section IV describes the experimental design. Section V presents the benchmarking results. Finally, Section VI discusses the security implications and concludes the paper.

TABLE I P OSITIONING AGAINST P RIOR REN F ORECASTING AND S ECURITY S TUDIES Study

Routers

Duration

Models

Mohammed et al. [18] Liu et al. [19] Andreoletti et al. [21] Shariff et al. [20]

1 1 23 2

30 days 365 days ∼30 days 30 days

SARIMA Statistical DCRNN (GNN) GRU-LSTM

This Work

10

57 days

6 families

A. Traffic Characteristics and Security Risks in RENs Research and Education Networks (RENs) exhibit traffic patterns that are fundamentally distinct from commercial WANs, creating unique challenges for security monitoring. Rogers and Christensen first demonstrated that Internet2 traffic lacks the self-similar, human-driven patterns of commercial networks, instead following heavy-tailed distributions where under 1% of flows account for over 80% of volume [5]. This operational reality is shaped by architectural patterns like the Science DMZ, which prioritizes throughput by bypassing traditional firewalls [3]. From a security perspective, this creates a significant “masking” effect. As noted by Kiran and Chhabra, REN workloads are non-stationary and unpredictable [6]. This nonstationarity makes it difficult for threshold-based Intrusion Detection Systems (IDS) to distinguish between a legitimate 100 Gbps scientific transfer and a volumetric DDoS attack. Barford et al. analyzed such anomalies using signal processing, highlighting the difficulty of separating “flash crowd” events from malicious attacks [7]. Recent work by Giannakou et al. at NERSC further underscores the complexity of data movement patterns in modern HPC environments, necessitating more adaptive baselining techniques [8]. B. Anomaly Detection Challenges in High-Speed Networks Anomaly detection in high-speed networks is a well-studied field, yet significant challenges persist. Chandola et al. provide a comprehensive survey of techniques [9], but applying them to network intrusion detection is fraught with difficulty due to the “semantic gap” and high cost of false positives [10]. Gates and Taylor challenged the traditional anomaly detection paradigm, noting that “normal” traffic is rarely static [11], a view supported by Mahoney and Chan who proposed learning non-stationary models for detecting novel attacks [12]. Unsupervised methods are often required due to the scarcity of labeled attack data. Eskin et al. proposed a geometric framework for unsupervised detection [13], a concept we operationalize using Isolation Forests [14] and Local Outlier Factor (LOF) [15]. While Lakhina et al. demonstrated the utility of subspace methods (PCA) for diagnosing backbone anomalies [16], our work advances this by integrating these

None None None None 4 strategies

TABLE II I NTERNET 2 T RAFFIC C ORPUS S UMMARY BY ROUTER Router

II. R ELATED W ORK AND P OSITIONING

Anomaly

Raw GB

Flows (M)

Packets (B)

Hours

Atlanta Dallas Baton Rouge Boston El Paso Jackson Jacksonville Louisville Phoenix Reno

8.49 47.76 28.43 0.14 3.33 4.79 6.95 1.12 3.12 12.66

28.03 149.78 80.06 0.39 9.36 13.40 19.43 3.15 8.77 35.50

0.61 2.42 1.29 0.02 0.32 0.23 0.70 0.28 0.27 0.47

1369 1322 1343 789 1378 1369 1338 1466 1369 861

Total

147.7

314.0

13.7

12,604

unsupervised detectors directly into the forecasting pipeline to create a robust, dynamic baseline. C. Forecasting Models for Security Baselining Forecasting models serve as the foundation for dynamic anomaly detection. Foundational work by Papagiannaki et al. explored long-term forecasting on earlier backbones [17], but these models predate current petabyte-scale flows. Recent studies using SARIMA reported high error rates during scientific-scale bursts [18], while Liu et al. highlighted the inadequacy of classical baselines for capacity planning [19]. The advent of deep learning has led to more advanced architectures. A prior study by Shariff et al. demonstrated hybrid GRU-LSTM effectiveness on two routers [20]. More recently, Graph Neural Networks (GNNs) like DCRNN have shown promise for spatio-temporal modeling [21], and systems like APRIL have begun to use forecasts for intelligent load balancing [22]. However, a critical gap remains: these advanced long-sequence architectures, including modern MLP-based encoders like TiDE [23] and Transformers like PatchTST [24], have never been systematically benchmarked for their ability to serve as security baselines on a large-scale REN backbone. Table I summarizes this gap. III. M ETHODOLOGY AND DATASET A NALYSIS We leverage an exclusive 57-day Internet2 dataset containing 314 million flows and 13.7 billion packets from ten geographically distributed backbone routers, providing the largest, most diverse REN corpus for security baselining to date. Table II summarizes router-level scale and coverage. The dataset exhibits significant router heterogeneity: Dallas processes the highest volume (149.78M flows, 2.42B packets)

Raw NetFlow Data

ETL Pipeline

(147.7 GB Gzipped)

Data Ingestion & Parsing

Dask Out-of-Core Processing

Custom JSONL Conversion

Lazy Loading & Parquet Conversion

Clean, Hourly Aggregated Time Series

Feature Engineering

(10 Routers)

Creating 4 Data Variants (Raw, Mask, Score, Both)

Fig. 1. Geographic distribution of the ten Internet2 routers. The diversity of this backbone dataset allows us to test security baseline generalizability across both high-volume hubs and smaller regional nodes.

while Boston handles the smallest load (0.39M flows, 20M packets). This 380× variation in flow volume and geographic distribution across major research institutions enables comprehensive model evaluation under diverse traffic conditions. Coverage ranges from 789 to 1,466 hours per router due to data availability windows, with all routers providing sufficient temporal scope for robust train/validation/test splits. While network-wide spatial dependencies exist, we focus on univariate, per-router modeling as it represents the standard deployment model for edge-based Intrusion Detection Systems (IDS). By establishing independent baselines for each core router, we ensure that security alerts are localized and actionable. Our exploratory analysis reveals three key characteristics differentiating REN traffic from commercial networks: 1) Muted Diurnal Cycles, where traffic drops only ∼15% overnight (Fig. 3), reflecting machine-driven workflows; 2) Extreme Heavy-Tailed Distributions, with the top 1% of flows accounting for > 80% of volume; and 3) Striking Router Heterogeneity (Table II). This justifies our multi-site, perrouter benchmarking approach. A. Scalable ETL Pipeline Traditional in-memory data processing fails at this volume, a common challenge when extracting actionable insights from large-scale data systems [25]. To overcome this, we engineered a distributed, Dask-based ETL pipeline, shown in Fig. 2. The pipeline first performs Data Ingestion & Parsing to handle the raw, non-standard JSON fragments. The data then flows to the Dask Out-of-Core Processing stage, which uses lazy loading and Parquet conversion to manage the massive scale. This produces a Clean, Hourly Aggregated univariate Time Series by summing the in_packets field for each of the 10 routers. This clean data serves two purposes: it is the input for the Anomaly Detection Module and is combined with the anomaly scores in the Feature Engineering stage to create the final four data variants used in our benchmark. After parsing and hourly aggregation, we split the time series chronologically (70/15/15%) for realistic forecasting.

Anomaly Scores & Flags Per-Router IF & LOF Models

Anomaly Detection Module

Performance Analysis (MAE, RMSE, sMAPE, MSLE, P99)

Benchmarking Models: SARIMA • PatchTST XGBoost • N-BEATS GRU-LSTM • TiDE

Traffic Forecasts (960 Experiments)

Fig. 2. The end-to-end architecture of our anomaly-aware forecasting framework. Raw Internet2 NetFlow data is processed by a multi-stage, Dask-based ETL pipeline to produce a clean, hourly aggregated time series. This clean data is then fed into an Anomaly Detection Module to generate scores and flags, which are combined in the Feature Engineering stage to create four distinct data variants. Finally, these variants are used in a comprehensive benchmark of six model families to generate 960 sets of experimental forecasts for performance analysis.

Figure 3 illustrates muted diurnal patterns across all routers, with overnight traffic dropping only 15% compared to peak hours, far less than the 50-70% reductions typical in commercial WANs. This reflects the continuous, machine-driven nature of scientific workflows that operate independently of human activity cycles. To distinguish legitimate scientific bursts from operational anomalies and potential attacks, we deploy both Isolation Forest (IF) and Local Outlier Factor (LOF), trained per-router. In the context of REN security, we define an ‘anomaly’ as any traffic pattern that significantly deviates from the learned baseline. Unlike commercial networks where anomalies are often malicious such as DDoS, REN anomalies are bimodal: they can be legitimate scientific ‘elephant flows’ or actual security events. Our framework uses Isolation Forest not just to flag outliers, but to clean the training data, allowing the forecasting model to learn the true underlying baseline of legitimate traffic. This separation is critical for reducing false positives in downstream IDS.

we benchmark six representative model families, each selected to evaluate a specific property of baseline resilience: statistical rigidity, computational efficiency, or long-term temporal awareness. A. Model Portfolio and Security Rationale The design and selection of hybrid deep learning architectures is a critical factor in system performance across various domains [26], [27]. For this study, We selected six model families covering the spectrum of baseline generation techniques: SARIMA (Statistical Baseline): Provides a rigid, seasonality-based baseline. Useful for testing whether simple statistical bounds are sufficient for REN security. • XGBoost (Tree Ensemble): Excels at non-linear prediction with low inference latency, making it a candidate for high-speed edge security devices. • GRU-LSTM Hybrid (Recurrent DL): Combines GRUs and LSTMs to capture stateful temporal dependencies, testing the value of “memory” in distinguishing attacks from normal bursts. • N-BEATS (Interpretable DL): Uses a stacked architecture for trend modeling. This model does not support exogenous features, allowing us to test its inherent architectural robustness without explicit anomaly scores. • TiDE (Time-series Dense Encoder): An advanced MLPbased architecture that leverages dense encoder-decoder blocks with residual connections to learn long-range correlations efficiently without the overhead of self-attention mechanisms. • PatchTST (Patch-based Transformer): Divides sequences into patches for computational efficiency. Our implementation does not support exogenous anomaly scores, serving as a control for ‘pure’ Transformer performance. •

Fig. 3. Mean hourly traffic across ten routers. The muted diurnal cycles (only 15% variation) and extreme burstiness make REN traffic distinguishable from commercial traffic, complicating traditional DDoS detection thresholds.

Anomalous likelihood for IF is scored as: E(h(x))

s(x, n) = 2− c(n)

(1)

and for LOF as: P LOFk (x) =

y∈Nk (x) lrdk (y)/lrdk (x)

|Nk (x)|

(2)

where E(h(x)) is mean path length and lrdk is local reachability density. Features included hourly counts, 24h rolling zscores, and time-of-day; the contamination rate (0.01) matches observed anomaly frequencies. We specifically incorporated 24-hour rolling z-scores to capture local statistical deviations independent of absolute traffic volume. This feature allows the model to distinguish between a sudden, high-velocity ‘attack-like’ burst and a gradual, legitimate increase in scientific workload. By coupling this with time-of-day encoding, the detector learns to suppress false positives during known peak operational hours, adapting the security baseline to the network’s circadian rhythm. We systematically test four ways to inject anomaly information: (1) raw (no anomaly), (2) mask-out, (3) score-as-feature, and (4) both combined. The general forecasting formulation shown in Eq. (3): ŷt+1:t+h = f (Xt−w:t , At−w:t , θ)

(3)

where X is historical traffic, A is anomaly context, and f is the forecasting model establishing the dynamic baseline. Model benchmarking spanned 960 experiments (10 routers × 6 models × 4 horizons × 4 anomaly modes). All used chronological splits, early stopping, and cross-model normalization. Paired t-tests with Bonferroni correction, reported confidence intervals, and hardware control (NVIDIA A40 GPUs) ensure statistical rigor. IV. E XPERIMENTAL D ESIGN FOR S ECURITY BASELINES Building on our anomaly-aware pipeline, we now detail the experimental setup designed to stress-test these models as dynamic security baselines. To address the challenge of distinguishing legitimate scientific flows from volumetric attacks,

This variability in feature support allows us to benchmark “architecture-inherent robustness” versus “explicit anomaly awareness,” a critical distinction for security system design. For our attention-based model (PatchTST), the core selfattention mechanism, which captures the long-range context critical for filtering out legitimate elephant flows, is formulated as shown in Eq. (4):   QK T V (4) Attention(Q, K, V ) = softmax √ dk B. Experimental Protocol This factorial design explores how geographic diversity, model class, prediction horizon, and anomaly handling interact to affect the robustness of the security baseline. We employ a fully factorial design yielding 960 distinct experiments: Routers: 10 geographically diverse Internet2 nodes. Models: The 6 families described above. • Horizons: 1, 6, 12, and 24-hour prediction lead times, to evaluate baseline stability over operational shifts. • •

1e7

TABLE III K EY H YPERPARAMETER C ONFIG DETERMINED VIA G RID S EARCH

6

Model

Key Settings

SARIMA XGBoost GRU–LSTM N-BEATS TiDE PatchTST

(1, 1, 1) × (1, 1, 1)24 (AIC-optimized) n estimators=500, max depth=6, lr=0.05, early stop=50 128 units/layer, window=48h, 410 epochs, pat=20 30 stacks, 256 units/layer, 250 epochs 1.6M params, window=48h, 130 epochs, lr=1e-3 534K params, window=336h, patch len=16, stride=8

4 2

C. Evaluation Metrics for Baseline Fidelity

sMAPE MSLE P99 Error

Penalizes large deviations (potential attacks) Relative error for operator reporting Robustness to legitimate volume spikes Critical for minimizing false positives during bursts

A. Baseline Fidelity and Computational Cost Our benchmarking reveals a clear hierarchy in the ability of models to establish a high-fidelity security baseline. As shown in Fig. 4, Advanced long-sequence architectures significantly outperform traditional methods, providing the tightest fit to normal traffic patterns and thus the lowest potential for false positives. Tier 1 – Dense Encoder Dominance: TiDE variants achieve a median MAE of 5.66 × 107 packets, representing a 30–42% error reduction over traditional baselines (Table V, p < 0.001). For security operations, this superior fidelity is critical: it means legitimate bursts are correctly predicted as “normal,” preventing them from triggering false alarms in downstream IDS. Tier 2 - Modern Deep Learning: N-BEATS and PatchTST form a strong middle tier. While they lack the exogenous anomaly integration of TiDE, their inherent architectural depth allows them to outperform RNNs by 25-30%.

ST GR M (G ST G U-LS RU_ M RU TM ma (G -L ( sk RU ST GR _o _sc M U_ ut) NB ore_ (GRUboth EA as _r ) NB XGB TS ( _fea aw) E o M t SA ATS ost ask ure) R Pa IM (Ra (XG -Out tch A w B_r ) TS (Ra Ba aw Pa T (R w B selin ) tc a as e TiDhTST w Ba elin ) E ( (M sel e) R a in T aw sk- e) TiD iDE ( Bas Out) M el E( Sc T ask- ine) ore iDE Ou -as (B t) -Fe oth atu ) re)

GR U-L

Median MAE ST M

(G RU GR GR _sco U-L U-L re_ ST STM as_ f M GR (G (GR eatu U-L RU U_ re) ST _ma bot X G M NB B s h EA oo (GR k_ou ) TS st U_ t) ( r SA NBE (Raw XGB_ aw) A R Pa IM TS Ba raw tch A (M sel ) TS (Ra a in Pa T (R w B sk-O e) tch aw as ut) e T TiD ST ( Bas line) Ma elin E( s e S TiD core TiDE k-Ou ) E ( -as (Bo t) R -F t TiD aw B eatu h) E ( ase re) Ma lin sk e) -O ut)

Median MAE

U-L ST M Pa GRU (GRU tch -LS _m T GR TST M (Gask_ U-L (Ra RU out GR ST w _r ) U-L ST XGB M (GBase aw) M N oo R lin (G BE st U_ e) R A ( b NB U_sc TS ( XGB_ oth) EA ore Ma raw T P S _as sk- ) SA atch (Raw _fea Out) RIM TS B tur T as e TiDA (Ra (Mas elin ) E ( w k-O e) Ra Bas ut T w e ) TiD iDE ( Bas line) M el E( Sc T ask- ine) ore iDE Ou -as (B t) -Fe oth atu ) re)

U-L

GR

Security Purpose Avg. baseline deviation

V. R ESULTS : BASELINING AND R ESILIENCE A NALYSIS

24h Horizon

Model

MAE

RMSE

sMAPE

P99

Train (s)

TiDE (scF) N-BEATS PatchTST GRU-LSTM SARIMA XGBoost

5.66e7 6.4e7 6.4e7 8.8e7 8.1e7 9.5e7

7.5e7 9.5e7 9.2e7 1.3e8 1.2e8 1.1e8

60.4 65.7 88.1 87.1 122.5 86.4

1.9e8 2.9e8 2.1e8 3.9e8 2.9e8 3.4e8

1.6 2.6 0.4 1.8 1.9 6.7

Tier 3 - Lightweight Baselines: XGBoost (9.5×107 MAE) lags in accuracy but excels in computational efficiency. As shown in Table V, XGBoost training time (6.7s) and inference latency are negligible. This makes it a viable candidate for resource-constrained edge security appliances where ultra-low latency is prioritized over maximum baseline precision. Next, we analyze how robust these models are when trained on “poisoned” data containing unflagged anomalies (Fig. 5).

1.75 1.50 1.25 1.00 0.75 0.50 0.25 0.00

1e9

Original Data Detected Anomaly

in_packets

RMSE

Formula 1 P |yi − ŷi | 1 P (yi − ŷi )2 N |yi −ŷi | 100% P NP (|yi |+|ŷi |)/2 1 (log(1 + yi ) − log(1 + ŷi ))2 N 99th percentile of |yi − ŷi |

N q

1e8

1.2 1.0 0.8 0.6 0.4 0.2 0.0

TABLE V S ECURITY BASELINE P ERFORMANCE & C OST (M EDIAN VALUES )

TABLE IV E VALUATION M ETRICS FOR BASELINE F IDELITY

MAE

12h Horizon

Fig. 4. Baseline Fidelity (Median MAE) for all the Horizons. Transformerbased models (TiDE) provide the tightest security baseline, minimizing the residual noise that leads to false positives.

We assess the fidelity of the security baseline using five complementary metrics, summarized in Table IV. Statistical significance is validated using paired t-tests (α = 0.05) with Bonferroni correction.

Metric

1e8

GR

Anomaly Modes: The four strategies (raw, mask-out, score-as-feature, and combined) to test resilience against data poisoning. Data is split chronologically (70% train, 15% validation, 15% test) to mirror a realistic security deployment where future attacks are unknown. All deep learning models were trained on NVIDIA A40 GPUs using early stopping (patience=20) to prevent overfitting to noise, with hyperparameters tuned via grid search (Table III). •

6h Horizon

GR U-L

GR U-L

Pa tch SA TST R ( ST G IMA Raw M RU (R B (G -LS aw ase RU T B li n M GR _sco (G asel e) U-L XG re_ RU ine ST Boo as_ _bo ) f t M GR (G st (X eatu h) U R G r Pa -LST U_ma B_ra e) tch M sk w) TS (GR _ou T T (M U_ t) TiD TiDE iDE ( ask raw) E ( (R Ma -Ou Sc aw sk- t) ore B Ou -as ase t) l NB NBE T -Fea ine) EA ATS iDE tur TS ( (B e) (Ra Ma ot w sk-O h) Ba u se t) lin e)

0

1.2 1.0 0.8 0.6 0.4 0.2 0.0

1.2 1e8 1.0 0.8 0.6 0.4 0.2 0.0

Median MAE

1h Horizon

Median MAE

8

2021-10-08 2021-10-15 2021-10-22

2021-11-01 2021-11-08 2021-11-15 2021-11-22

Time

2021-12-01

Fig. 5. Visualizing the “Noise”: Legitimate traffic bursts (red dots) on the El Paso Router. A robust security model must predict these peaks to avoid flagging valid science flows as volumetric attacks.

Mask

Score

Both

B. Resilience to Data Poisoning Security baselines must often be trained on historical data that contains unverified anomalies. Our ablation study (Table VI) measures each model’s resilience to this “training noise.” RNN Vulnerability: The GRU-LSTM model is highly sensitive to training noise. Masking anomalies (the “Mask-out” strategy) yields a 3.3% MAE reduction (p < 0.01), confirming that RNNs require clean training data to establish a stable security baseline. Dense Encoder Robustness: TiDE benefits most from the “Score-as-feature” strategy (1.11% improvement, p < 0.05). This suggests that deep dense encoders can effectively use anomaly scores as a context signal to distinguish between normal high-volume transfers and statistical outliers. Inherent Stability: Tree-based models (XGBoost) showed minimal sensitivity to anomaly integration strategies, indicating they are inherently robust to outliers which is a valuable trait for “set-and-forget” security deployments. C. Operational Security Window The “Operational Security Window” refers to how far in advance a security team can reliably predict traffic patterns to configure proactive defenses.

6

12

(5)

with R2 = 0.89, providing a predictable error bound for security thresholds. D. Geographic Consistency of Baselines A global security policy requires baselines that work across diverse network segments. Our analysis reveals significant heterogeneity: atlanta 14.0 12.0 10.0 13.0 9.0 6.0 1.0 2.0 3.0 5.0 4.0 7.0 8.0 11.0 batonrouge 3.0 5.0 4.0 2.0 14.0 12.0 1.0 13.0 6.0 7.0 10.0 9.0 8.0 11.0 boston 5.0 8.0 14.0 13.0 9.0 11.0 6.0 7.0 10.0 3.0 1.0 2.0 4.0 12.0 dallas 10.0 9.0 11.0 13.0 3.0 8.0 2.0 1.0 12.0 7.0 4.0 5.0 6.0 14.0 elpaso 13.0 11.0 5.0 10.0 7.0 6.0 9.0 8.0 12.0 1.0 3.0 4.0 2.0 14.0 jackson 13.0 12.0 14.0 11.0 8.0 10.0 1.0 6.0 7.0 5.0 2.0 3.0 4.0 9.0 jacksonville 12.0 13.0 10.0 14.0 7.0 5.0 8.0 11.0 6.0 3.0 2.0 4.0 1.0 9.0 louisville 11.0 8.0 13.0 14.0 1.0 4.0 9.0 7.0 12.0 3.0 6.0 2.0 5.0 10.0 phoenix 11.0 10.0 9.0 14.0 7.0 6.0 5.0 8.0 13.0 2.0 1.0 3.0 4.0 12.0 reno 5.0 8.0 6.0 7.0 2.0 1.0 4.0 10.0 14.0 13.0 11.0 9.0 12.0 3.0

14 12 10 8 6 4 2

Fig. 7. Baseline Consistency Heatmap by Router (24-hour MAE). Lower ranks (brighter colors) indicate better performance. The consistent high ranks for TiDE variants (top rows) across most routers demonstrate its robustness and suitability for network-wide security deployment.

(Raw Baseline)

Median RMSE

2.00 1e8 1.75 1.50 1.25 1.00 0.75 0.50 0.25 0.00 1

MAE(h) = 5.2 × 107 · h0.23 + 4.8 × 107

Model Rank (Lower is Better)

Raw

GRU-LSTM 0.0 -3.3*** -0.7* +3.4 TiDE 0.0 +0.06 -1.11** +0.86 N-BEATS 0.0 -1.14** N/Aa N/Aa PatchTST 0.0 +5.89 N/Ab N/Ab XGBoost 0.0 -0.2 -0.1 +0.1 Significance: * p < 0.05, ** p < 0.01, *** p < 0.001 a N-BEATS does not support exogenous features. b PatchTST implementation (used) did not support exogenous features.

GR GRU U_ _b ma oth U_ sco G sk_o u NB re_a RU_ t EA s_f raw TS ea _ t Pa N mask ure tch BE _o TS ATS ut T_ _ Pa mas raw tch k_o SA TST_ ut RIM raw A T TiD iDE _raw E_m _bo TiD as th E_s co Ti k_ou re_ DE t as _ra _fe w a XG ture B_ raw

Model

of predicting the precise onset of scientific workflows. Security systems operating in this window must remain highly adaptive. 6-24 Hour Stability: Error growth flattens significantly after 6 hours. This identifies a 6-hour “Sweet Spot” for security planning. Operators can reliably use 6-hour forecasts to differentiate expected elephant flows from sustained volumetric attacks, setting thresholds that are loose enough to accommodate science but tight enough to catch threats. The baseline error growth follows a power law:

GR

TABLE VI R ESILIENCE TO T RAINING DATA N OISE (∆MAE% BY S TRATEGY )

GRU-LSTM NBEATS PatchTST SARIMA TiDE XGBoost

Prediction Horizon (hrs)

24

Fig. 6. Operational Security Window. The sharp error increase up to 6 hours defines the optimal look-ahead window for proactive security planning and rule configuration.

1-6 Hour Window: RMSE increases dramatically (≈ 38% median increase) in the short term. This reflects the difficulty

High Predictability Nodes: Regional nodes like Boston and Reno have stable traffic patterns, allowing for very tight security thresholds (low P99 error). High Variance Hubs: Core hubs like Dallas and Jacksonville exhibit massive variance. Security baselines here must be looser to avoid false positives. Deployment Implication: A “one-size-fits-all” anomaly threshold will fail. Security teams must deploy per-router baselines, tuning the sensitivity based on the specific predictability profile of that node (as modeled by TiDE’s consistent toptier performance). While our current evaluation is limited to the Internet2 backbone, the ability of our framework to successfully model the extreme variance between regional nodes (e.g., Boston) and international exchange hubs (e.g., Dallas) provides strong evidence that the methodology will generalize to other REN environments with diverse topologies.

TABLE VII O PERATIONAL S ECURITY D EPLOYMENT R ECOMMENDATIONS Security Aspect

Recommendation

Primary Baseline Model Look-ahead Window Training Data Hygiene

TiDE with anomaly score integration 6 hours (optimal fidelity-utility balance) Mask-out anomalies for RNNs Score-integration for deep architectures (TiDE) Edge vs. Core XGBoost for Edge; TiDE for Core Retraining Frequency Weekly (to mitigate concept drift) **This framework synthesizes our key findings into a set of actionable guidelines for deploying a robust security baseline in a production REN.

VI. D ISCUSSION , C ONCLUSION , AND F UTURE W ORK Our results provide a clear verdict on baseline fidelity and deep insights into the architectural properties required for securing REN environments. Advanced long-sequence models demonstrate clear superiority. For PatchTST, this is attributable to self-attention (Eqn. 4) processing sequences in parallel. For TiDE, superiority stems from its deep, multi-layer perceptron (MLP) encoder-decoder structure, which efficiently captures long-range dependencies and demonstrates inherent robustness to anomalies by mapping them into a dense latent space. A. Operational Security Recommendations Based on our comprehensive evaluation, we provide the first evidence-based deployment framework for REN security baselining, summarized in Table VII. Security Strategy: Our analysis confirms that a 6-hour prediction horizon offers the optimal balance between baseline accuracy and actionable lead time. This allows security teams to pre-configure firewalls and QoS policies for expected elephant flows. The need for per-router optimization is critical to avoid false positives in diverse network segments. Resilience & Cost: For resource-constrained edge devices, XGBoost serves as an excellent “failover” option, providing competitive baselines with minimal latency. For core routers, TiDE offers the highest fidelity. A weekly retraining cadence is recommended to adapt the security baseline to the evolving scientific workload. The broader impact is significant: by enabling autonomous, predictive baselining, this work allows security systems to filter out legitimate bursts, focusing analyst attention on true threats. B. Conclusion and Future Directions This work presents the first large-scale, anomaly-aware benchmark for traffic forecasting on the Internet2 backbone. By analyzing 13.7 billion packets across 10 routers, we have demonstrated that modern long-sequence architectures (like TiDE) can reduce baseline prediction error by over 30%, significantly improving the ability of security systems to distinguish legitimate scientific bursts from volumetric attacks. While our study establishes a strong foundation, we acknowledge several limitations that define clear avenues for future research. First, our 57-day temporal scope cannot capture long-term seasonal effects tied to annual academic

cycles; extended longitudinal studies are needed. Second, our univariate, per-router approach serves as a necessary first line of defense, but ignores broader network-wide spatial dependencies. Finally, validation on other RENs (such as ESnet, GÉANT) is required to confirm generalizability. Due to data privacy restrictions, the raw NetFlow datasets cannot be publicly released. To mitigate this and ensure reproducibility, we commit to releasing all processing scripts, model training code, and the whole comprehensive evaluation report for all variations. Future work will focus on addressing these limitations across three critical security frontiers: • Adversarial Robustness & Spatio-Temporal Modeling: Evaluating how these baselines perform against sophisticated “model poisoning” attacks, and extending the framework to incorporate Graph Neural Networks (GNNs) to model inter-router spatial dependencies. • Privacy-Preserving Federated Learning: Developing protocols to allow multiple RENs to collaboratively train security models without sharing sensitive traffic data. • Explainable AI (XAI): Integrating interpretability tools to help security analysts understand why a baseline deviation occurred, fostering trust in autonomous response systems. Ultimately, this work enables a shift from reactive intrusion detection to proactive, predictive resilience, ensuring the security and availability of the digital infrastructure that powers modern science. VII. ACKNOWLEDGMENTS We would like to thank the Internet2 consortium for their support without which this work would not have been possible. This work is sponsored in part by National Science Foundation (NSF) grant (Award Number: OAC-2322369) and U.S. Department of Energy (DOE) grant (Award Number: DESC0024648). R EFERENCES [1] I. Monga, C. Guok, J. MacAuley, A. Sim, H. Newman, J. Balcas, P. DeMar, L. Winkler, T. Lehman, and X. Yang, “SDN for End-to-End Networked Science at the Exascale (SENSE),” in IEEE/ACM Innovating the Network for Data-Intensive Science (INDIS), 2018, pp. 33–44. [2] M. S. Ahamed, K. M. N. Hossain, M. A. U. Shariff, I. U. Haque, S. M. Hridita, and M. A. Talha, “Ai-driven multilayered cybersecurity intelligence framework for critical infrastructure protection,” in International Conference on Data Science, AI and Applications. Springer, 2025, pp. 31–45. [3] E. Dart, L. Rotman, B. Tierney, M. Hester, and J. Zurawski, “The Science DMZ: A network design pattern for data-intensive science,” in Proceedings of the International Conference on High Performance Computing, Networking, Storage and Analysis, 2013, pp. 1–10. [4] A. Nottingham, J. W. Collyer, B. E. Root, M. Buchanan, Y. Zhang, K. Sadeghi, Y. Sun, D. E. Brown, J. W. Davidson, and M. Veeraraghavan, “Challenges with Collecting, Anonymizing, Sharing and Using HighSpeed Network-Traffic Data (White Paper),” 2020. [5] J. Rogers and K. J. Christensen, “A fluid-flow characterization of Internet1 and Internet2 traffic,” in Proceedings LCN 2001. 26th Annual IEEE Conference on Local Computer Networks. IEEE, 2001, pp. 509– 513. [6] M. Kiran and A. Chhabra, “Understanding flows in high-speed scientific networks: A Netflow data study,” Future Generation Computer Systems, vol. 94, pp. 72–79, 2019.

[7] P. Barford, J. Kline, D. Plonka, and A. Ron, “A signal analysis of network traffic anomalies,” in Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, 2002, pp. 71–82. [8] A. Giannakou, D. Hazen, B. Enders, L. Ramakrishnan, and N. J. Wright, “Understanding Data Movement Patterns in HPC: A NERSC Case Study,” in SC24: International Conference for High Performance Computing, Networking, Storage and Analysis. IEEE, 2024, pp. 1–17. [9] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: A survey,” ACM computing surveys (CSUR), vol. 41, no. 3, pp. 1–58, 2009. [10] R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in 2010 IEEE symposium on security and privacy. IEEE, 2010, pp. 305–316. [11] C. Gates and C. Taylor, “Challenging the anomaly detection paradigm: A provocative discussion,” in Proceedings of the 2006 workshop on New security paradigms, 2006, pp. 21–29. [12] M. V. Mahoney and P. K. Chan, “Learning nonstationary models of normal network traffic for detecting novel attacks,” in Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining, 2002, pp. 376–385. [13] E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo, “A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data,” in Applications of data mining in computer security. Springer, 2002, pp. 77–101. [14] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation Forest,” in 2008 Eighth IEEE International Conference on Data Mining, 2008, pp. 413–422. [15] M. M. Breunig, H.-P. Kriegel, R. T. Ng, and J. Sander, “LOF: identifying density-based local outliers,” in Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data. Association for Computing Machinery, 2000, p. 93–104. [16] A. Lakhina, M. Crovella, and C. Diot, “Diagnosing network-wide traffic anomalies,” ACM SIGCOMM computer communication review, vol. 34, no. 4, pp. 219–230, 2004. [17] K. Papagiannaki, N. Taft, Z.-L. Zhang, and C. Diot, “Long-term forecasting of Internet backbone traffic,” IEEE transactions on Neural Networks, vol. 16, no. 5, pp. 1110–1124, 2005. [18] B. Mohammed, N. Krishnaswamy, M. Kiran, and K. Wu, “Predicting

WAN traffic volumes using Fourier and multivariate SARIMA approach,” International Journal of Big Data Intelligence, vol. 8, no. 1, pp. 1–12, 2021. [19] Z. Liu, R. Kettimuthu, I. T. Foster, and Y. Liu, “A Comprehensive Study of Wide Area Data Movement at a Scientific Computing Facility.” in ICDCS, 2018, pp. 1604–1611. [20] M. A. U. Shariff, V. S. S. L. Karanam, and B. Ramamurthy, “Traffic Prediction for Research and Education Networks using an Ensemble GRU-LSTM with Varying Lead Times,” in 2025 IEEE International Conference on Communications Workshops (ICC Workshops). IEEE, 2025, pp. 1676–1681. [21] D. Andreoletti, S. Troia, F. Musumeci, S. Giordano, G. Maier, and M. Tornatore, “Network Traffic Prediction based on Diffusion Convolutional Recurrent Neural Networks,” in IEEE INFOCOM 2019IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 2019, pp. 246–251. [22] D. Nadig, B. Ramamurthy, B. Bockelman, and D. Swanson, “APRIL: An Application-Aware, Predictive and Intelligent Load Balancing Solution for Data-Intensive Science,” in IEEE INFOCOM 2019 - IEEE Conference on Computer Communications, 2019, pp. 1909–1917. [23] A. Das, W. Kong, A. Leach, S. Mathur, R. Sen, and R. Yu, “Long-term Forecasting with TiDE: Time-series Dense Encoder,” 2024. [Online]. Available: https://arxiv.org/abs/2304.08424 [24] Y. Nie, N. H. Nguyen, P. Sinthong, and J. Kalagnanam, “A Time Series is Worth 64 Words: Long-term Forecasting with Transformers,” 2023. [Online]. Available: https://arxiv.org/abs/2211.14730 [25] K. Begum, M. M. Rashid, and M. A. U. Shariff, “Comparative Study of Big Data Visualization Tools and Techniques,” in Applied Informatics for Industry 4.0. Chapman and Hall/CRC, 2023, pp. 188–199. [26] M. A. U. Shariff, “A novel hybrid gldnn architecture for bangla dialect identification,” in International Conference on Data Science, AI and Applications. Springer, 2025, pp. 75–91. [27] E. Hossain, M. A. U. Shariff, M. S. Hossain, and K. Andersson, “A novel deep learning approach to predict air quality index,” in Proceedings of International Conference on Trends in Computational and Cognitive Engineering: Proceedings of TCCE 2020. Springer, 2020, pp. 367–381.

Related documents

• Robustness across the Structure of Sub-Networks: The Contrast between Infection and Information Dynamics#737850
• Random-Priority Frontier Routing: Tight $Θ(n^c)$ Bounds Against $c$-Node Cartels#820895
• Predictive Analytics and Cybersecurity#1178781
• Discovering Collaboration from Novelty: Random Network Distillation for Clustered Federated Learning#321835
• Breaking Ambient Trust: In-Network Per-Process Access Control Against Lateral Movement#799226