TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 https://doi.
org/10.
51967/tepian.
3260 A 2025 Tepian Politeknik Pertanian Negeri Samarinda This work is licensed under a Creative Commons Attribution 4.
0 License CC-BY Optimisation of Network Logs for Fake Bandwidth Classification using CNN Azriel Christian Nurcahyo * Design and Technology Centre.
School of Computing and Creative Media.
University of Technology Sarawak, 96000.
Malaysia pic24030001@student.
*Corresponding author Huong Yong Ting Design and Technology Centre.
School of Computing and Creative Media.
University of Technology Sarawak, 96000.
Malaysia ting@uts.
Abdulwahab Funsho Atanda Design and Technology Centre.
School of Computing and Creative Media.
University of Technology Sarawak, 96000.
Malaysia abdulwahab@uts.
Submitted: 2025-03-26.
Accepted: 2025-04-21.
Published: 2025-06-01 AbstractAi The goal of this study is to enhance the classification accuracy of fake bandwidth using a CNN model, leveraging network logs collected in real-time.
For this research, the network logs from the Cyber Security Laboratory of the University of Technology Sarawak are used as a dataset for training the CNN model.
The dataset consists of 20 days of continuous network activity logging, which results in over 500,000 data entries.
According to the model evaluation results, the trained CNN model demonstrated high accuracy in classifying genuine bandwidth (Precision: 0.
Recall: 0.
Moreover, it achieved considerable success in detecting fake bandwidth (Precision: 0.
Recall: 0.
and the no heavy activity category (Precision: 0.
Recall: 0.
Analysis of Loss Over Epochs showed a dramatic decrease in loss during the training phase, with optimal convergence reached by Identifying these characteristics enables monitoring systems to classify network data with high certainty, detecting bandwidth manipulation in expansive Thus, this research aids the design of dynamic network monitoring systems that require minimal response time while maintaining high accuracy.
KeywordsAi Convolutional Neural Network (CNN).
Fake Bandwidth.
Network Logs.
Bandwidth Utilization INTRODUCTION The World is in an era where virtually all human interactions across different sectors require a stable Internet connection, which is used to facilitate countless activities (Dolgui.
A et al.
, 2.
In an AI-powered world, without the use of the Internet, all work models involving software and applications would become nearly impossible, especially those requiring high connectivity (Giordano et al.
, 2.
The Internet is critical for software and applications, especially those providing essential services, to function effectively in today's digital environment (Sari.
M et al.
, 2.
Many enterprise devices or network loads are always associated with high bandwidth usage (Shi.
et al.
, 2.
On a broader spectrum, high as well as low levels of an enterprise may not be accurately depicted as the real user of the bandwidth based on certain activities (Oji et al.
, 2.
Exceptional situations can be found where network bandwidth is referred to as fake bandwidth or manipulated bandwidth.
This is known as a means to artificially make network bandwidth appear high from a speed test, while no actual data traffic use exists that continuously works in conjunction with the results provided by the speed test.
Additionally, in certain instances, the Service Licence Agreement outlines a sizable bandwidth figure, but at certain times, its ability to deliver service in line with the parameters of the agreement is hindered, hence the service is burdened and the level of access which ought to be available to major users is not probable (Razian et al.
Such problems arise where users or businesses have contracts with ISPs for a certain Mbps figure, but instead of the contracted value, they are given lower values or, at times, only some fraction of the figure during some other periods (Hapsari, 2.
There are also other situations where bandwidth management is performed as per the agreement, but for some reason, only half of the anticipated bandwidth is received in the monitoring of upload and download activities (Jhaveri et al.
, 2.
Moreover, having Internet outages for more than the specified durations in the agreement will, without doubt, pose a problem for many, especially those whose business functionality is highly dependent on the Internet (Biswal et , 2.
Bandwidth inconsistency caused by the availability of bandwidth manipulation methods can be extremely harmful to consumers and service providers alike, as it results in Quality of Service (QoS) degradation.
High latency or delay in data communication occurs when realized bandwidth falls below the commitments of the Service Level Agreements (SLA.
, causing a notable effect on overall user experience for applications such as video conferencing.
With bandwidth classification, it is expected that the optimisation of ISP services can be improved since ISPs can ensure that the provided bandwidth meets the requirements of the users and prevents wastage of network resources.
Additionally, a better classification of bandwidth can enhance the Service Level Agreements (SLA.
between Internet Service Providers (ISP.
and their customers, while increasing the effectiveness of resource allocation at the same time.
This improvement allows ISPs to provide bandwidth with more Ae 85 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
precision according to the particular application demands, reduces unnecessary bandwidth usage, and ensures sufficient bandwidth for critical user requests (Collier.
Gomes et al.
, 2.
An examination of how service processes are run demonstrates that these trends can prove to be economically expensive as they lead to the decline of service quality, waste of service resources, or even incorrect decisions regarding service router infrastructure management (Ye et al.
, 2.
More technically, loss of bandwidth, false bandwidth, or manipulation of queue models, can in large unattended settings such as data centres, educational institutions, or corporations, damage the quality of service (QoS) and pose a risk to modern network management.
Bandwidth that is lost, for example, during prolonged inactivity, is often not tracked by monitoring systems, thus preventing them from detecting what truly should be flagged: when data traffic appears to be normal (Jhaveri et al.
, 2.
Network intrusion detection systems based on statistics or models include clustering methods, distribution-based methods, graphical methods, and density-based methods (Komadina et al.
Regardless of the existence of alternative solutions, approaches to network analysis will always have gaps due to the rapid development of internet technology, thus, improvement of the actual network log data is always going to be required (Alhammadi.
, & Abul.
, 2.
A broad range of research conducted by Zhao et al.
and Cermyk et al.
, corroborates that both manual and automated network surveillance techniques have a myriad of shortcomings when it comes to detecting anomalies such as loss of bandwidth, especially when there is no database to monitor it (Duan, et al.
, 2.
Zhao et al.
demonstrate that conventional bandwidth traffic monitoring systems fail to recognise abnormal activities because the daily network traffic that is captured, and often conducted manually.
AoappearsAo normal but is, in fact, twelve hours' worth of non-detection (Zhao et al.
, 2.
This was echoed by Cermyk et al.
, stating that analysis of system network logs not only takes significant amounts of time, but also heavily depends on the judgment of the analyst (Cermyk et al.
, 2.
, hence, introducing the issue of bias and misinterpretation.
AsSadhan et al.
suggest, automatic systems employing rudimentary upper and lower threshold boundaries are exceedingly problematic as they tend to have high rates of false positives and negatives because, unfortunately, the simplistic approach does not allow accommodating the ever-changing dynamics of network traffic (AsSadhan et , 2.
Onietan et al.
claimed that rule-driven systems still have some deficiencies in recognising new or undetected patterns, having to do with the condition of network traffic, because such systems base their action log substantiated behaviours on already documented It was also asserted that the commonly used SNMP and NetFlow commercial monitoring tools do not enable full visibility into traffic behaviour at the application level, where most bandwidths are contended (Zhang, et al.
, 2.
Moreover, it was also noted that marker-based intrusion detection systems are not fully reliable in anomaly detection.
they only sense threats defined in advance (Ring, et al.
, 2.
Saha et al.
pointed out that traditional methods of dealing with network traffic flows are not very effective when it comes to dynamic changes in internet network traffic because they rely on fixed parameters.
In the same vein.
Zhang et al.
argued that offline batch monitoring systems cannot retain important real-time information during periods of high activity and data Dong et al.
noted that a large number of automated network anomaly detection systems do not differentiate between genuine and non-genuine network traffic surges because there is no understanding of the information that is to be analysed before processing.
noteworthy insight here is that, although machine learning is starting to be used for network supervision, most of the systems tend to overfit and fail to generalise to new forms of anomalies, such as excessive use of bandwidth (Wang et al.
, 2.
In their research on the application of CNN for cyber-attack detection.
Najar et al.
mentioned that CNNAos prowess in this field is yet to be leveraged in the context of bandwidth DDoS cases.
This was also noted in the work of Fotiadou et al.
, asserting that while CNN is capable of identifying abnormal network traffic behaviour, applying it to network logs is challenging unless powerful servers for massive network log data are In Cyber Security.
CNN has proved to be able to identify DDoS attacks with up to 20% higher accuracy than traditional models.
Yet, one of the biggest challenges is presented by non-IID .
on-independent and identically distribute.
data, i.
, the dataset is compromised by drastically different data distributions per device.
solving the non-IID problem, more intricate and elaborate algorithms must be employed to resolve the inconsistency of data distribution so that data retrieval and identification become more accurate and efficient (Lv et al.
, 2.
CNN
in bandwidth utilization has been addressed in bandwidth forecasting with the aid of edge based on a CNN hybrid Yet, even though the results of testing reflect tremendous improvements in MAE and RMSE accuracy, the model could be less effective in very dynamic scenarios or where there are sudden spikes in bandwidth Consequently, the accuracy of the predictions made by the model improves only when incoming data exhibit stability, but in extreme situations such as DDoS attacks or abrupt network changes, the reliability of the prediction outcomes may be compromised, thereby rendering the detection of actual real time data challenging (Wen et al.
, 2.
Moreover.
Alrubayyi et al.
further emphasised that most existing AI systems lack necessary accuracy in the real world due to the limitations of the training datasets used, thus complicating bandwidth analysis in IoT devices even further.
In addition, abanovic et al.
reported that real-time AI-based monitoring systems still cannot fully sense micro anomalies such as network bandwidth spikes in 5G at a false negative rate of 2.
37% on a persistent basis because of a high amount of noise in log data, which requires structured data logs.
The same goes for the research by Magnani et al.
, which also Ae 86 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
pointed out that there remains a gap in the integration of real-time network monitoring systems with self-adapting features to cope with abnormal network traffic.
Collectively, these previous studies demonstrate that there is still a large gap in the market for effective network monitoring technologies set against the accurate detection and manipulation of bandwidth from real-time data Therefore, there must be a different solution that is not just overriding and flexible, but also capable of transforming logs to accurate data in real-time every second, wherein the network log data is categorised as such, as proposed by the deep learning model of this study.
In a prior analysis, the researcher (Zhuang, 2.
stated that the integration of artificial intelligence and deep learning technologies has become a valuable tool for identifying intricate phenomena in massive datasets.
this study.
CNN is more suitable for classification because it has greater advantages compared to other algorithms.
For example, it has a high accuracy rate of 99%, whereas SVM has 74%.
The CNN model employs a deep learning architecture, which enables the network to extract features capabilities for complicated tasks like multi-class Conversely.
SVM, although efficient for less complex tasks, is inefficient when dealing with highdimensional data and more than two classes, hence a greater classification error rate.
Thus.
CNN's capacity to learn from hierarchies in data and automatically extract features makes it outshine SVM in intricate classification tasks (Fadlil et al.
, 2.
Moreover.
Lyu and Liu .
confirmed that the Convolutional Neural Network (CNN) architecture, which is often considered one of the most famous, was first developed for image analysis, but is now being extended to other fields like text processing.
Similarly.
Pham et al.
demonstrated the use of CNN in detecting hidden patterns for cyber-attack classification from network logs.
Similarly, work by Antonius et al.
proved the successful application of CNN in modelling network traffic anomalies with high accuracy.
Nevertheless, some of the previous studies that specifically applied CNN have bypassed the applicability of real network logs with many lines of data, say above half a million or even 700 thousand lines.
This is mainly because there are very few means of obtaining network log data for analysis, most commonly having to depend on Wireshark, daily speed tests, or metered attacks from an observing IP This creates a gap in the literature that warrants further investigation, particularly in the area of identifying illegitimate bandwidth.
This study is developed and carried out to fill the gap in research concerning fake bandwidth as compared to genuine bandwidth, with the growing need for internet use The network model that is tested in this research is the backbone model of the internet at the University of Technology Sarawak from the public domain in the Cyber Security lab.
Then, real-time network log data is captured every second and subsequently categorised to estimate the levels of fake bandwidth, genuine bandwidth, and no heavy activity using the CNN algorithm.
The major novelty of this method lies in two features: how the network performance is improved for data traffic that is received every second, something that has not been done in earlier studies.
Then, the log labels are assigned every second for the fake activity model, the genuine activity model, and the no heavy activity model.
The log data is processed and stored in what is referred to as the first part of the training data.
Twenty days later, real data, log data collected over twenty-four hours each day, is uploaded as real data for feature extraction, which is the process of transforming raw log data into numerical forms that can be utilised by a CNN model.
As for the results of this particular study, the model aims to do more than just classify network attacks or types of traffic.
it also aims to classify the amounts of detected fake and real .
bandwidth, as well as periods of inactivity .
o heavy activit.
, all within the constraints of 2000 epochs, or as many iterations needed to optimally showcase the accuracy of the created CNN.
The accuracy of the CNNAos classification is attributed to its architecture, compared to conventional approaches like Random Forest or Naive Bayes, which can better manage noise in the data and capture spatial dependencies within the data, hence yielding more precise classification results (Abdfilminaam et al.
, 2.
This study aims to construct an automated log extraction system on the internet backbone network using network log optimisation, and subsequently conduct deep learning analysis that can store, retrieve, and process vast amounts of log data, identify phantom bandwidth, and classify it at the University of Technology Sarawak.
The system should work in actual network environments for further studies in network logs and deep learning towards assisting system administrators to monitor the system performance and minimise the effect of bandwidth abuse or fake bandwidth.
This study also contributes to the theoretical advancement of more flexible and applicable deep learning approaches outside their traditional boundaries by employing the capabilities of CNN in non-image domains like network logs, especially in the real-time management of data captured every second of the day, averaging 25,000 to 35,000 rows a day.
This study provided a classification of three criteria from the summation of the abnormal bandwidth which is genuine bandwidth, fake bandwidth, and no heavy activity bandwidth, and each epoch will show accuracy loss validation accuracy validation loss and learning rate values while this study aims to set 2000 epochs to get the best results of CNN.
II.
RESEARCH METHODS
The Design of The Network Model The methodology of this study is divided into three parts: the design of the network model, network data logs, and the CNN model.
The first diagram comprises the design of a distributed computer network starting from the ISP side to the public IP address 60.
x/26, which belongs to Telkom Malaysia Berhad and is one of the public routes utilised by this research as the Cyber Security Laboratory at the University of Technology Sarawak.
The purpose of the public IP connection is to facilitate stable Ae 87 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
bandwidth conditions for the purpose of analysing and optimising bandwidth management.
The first step is to set up the network infrastructure, which comprises the backbone router, core switch, and dynamic DHCP to the Access Point, including users in Lab 4.
In the backbone and core switch configuration part, it consists of DNS setup, firewall configuration, and bandwidth management turned off by the queue and switch to bypass a 100 -1000 Mbps connection.
It includes categorically active network configuration, automatic logging for 20 days.
The network configuration is followed by deep learning with the use of real-time log data, as illustrated in Figure 1.
Figure 1.
Network Model / Log Optimization Moving on, the log data collection section seeks to locate and fetch the largest training data for a single day.
The training data sample includes files larger than 4 MB in size, which were collected between 12:01 on 20th February and 12:00 on 21st February 2025.
Moreover, monitoring of network traffic is performed for 20 days in February 2025.
This information is captured at the router and transmitted to the mail server, while being monitored in real time through Telegram using the ID = @routeruts1100ahx_bot which is actively uploading files with the user ID and download speeds of 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85,90, 95, 100, 105, 110, 115, 120, 125 until 200 Mbps per second.
AuThe download speed on 2nd March 2025 11:48:26 was more than 21 Mbps (Genuine Bandwidt.
in UTSAy is one of the examples given from the obtained model.
Figure 2 is used to illustrate the Telegram model that was developed to showcase the automated active traffic data collection that comes from the API-key from Mikrotik 1100 AHx.
Figure 2.
Real-Time Monitoring Model on @routeruts1100ahx_bot The Usage Networking system logs are output into two the first being the auto-originating logs from the mail server through the RB1100 AHx connection, while the second is real-time monitoring output, which gets streamed straight to the Telegram bot.
The next stage is classifying the bandwidth, where the network utilisation is further divided into 1 Mbps ranges up to 100 Mbps.
This classification can be done by extracting the log data every second, which allows for a more precise and further optimised bandwidth meter pattern, as described in Figure Having three data points every second translates into a maximum of 55,000 lines worth of data in an astonishing These logs are very important because they tell a story of the trends in bandwidth utilisation and the anomalies that could be present in the network traffic in Lab 4.
University of Technology Sarawak.
Figure 3.
Ae 88 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
Figure 3.
Bandwidth log on RB 1100 AHx Lab 4.
University of Technology Sarawak patterns to classify the different percentages of genuine.
This stage uses created logs that contain bandwidth fake, and inactive users based on their daily activity activities, inclusive of the fake, genuine, and inactive In this phase, the deep learning model is trained values, alongside login information, script alterations, and after the log collection to aid in understanding the patterns captured activities saved on the disk.
The next step is of bandwidth consumption and in finding anomalies in implementation using deep learning techniques, bandwidth usage using CNN.
All network traffic in Lab 4 particularly neural network models.
Applying these is captured in ether 1 connection for Tx and Rx, as techniques allows for an analysis of the established illustrated in Figure 4.
Figure 4.
Interface ether 1 / main internet connection used for capturing the entire recorded log data.
Following the shift from data collection via Telegram and the mail server's .
txt format for 20 consecutive days, we will now implement data classification using Python in conjunction with the CNN algorithm.
The extracted and classified bandwidth data will further undergo evaluation to derive the metrics and performance indices for the CNN Implementation The CNN process is a continuation of the data that has been pre-processed in the backbone network in UTS Lab It entails data preprocessing, cleansing, feature engineering, labelling, data normalisation, noise filtering, as well as the training of a deep learning model on the first dayAos dataset, followed by CNN classification and results presentation in the form of graphs as illustrated in the flow diagram in Figure 5.
Ae 89 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
Figure 5.
CNN Bandwidth Classification Model The data flow through the CNN pipeline is conducted in a structured manner, commencing with model training utilizing complex network logs gathered over five days, and ending with the classification of real-time data accumulated over twenty days.
Firstly, network logs are collected second by second from Computer Lab 4 within the University of Technology Sarawak (UTS).
During the model's training period, logs are gathered for five days, which represents a broader and more sophisticated range of data.
The dataset includes all forms of network activities, including extraneous entries, thereby making it larger in size and challenging for the model to learn from.
The data flow for CNN processing from log acquisition to training and real-time data classification can be seen in Figure 6 as follows.
Figure 6.
Data Processing Flow of the CNN Algorithm The training logs are then subjected to a pre-processing step, in which the unwanted data is removed, missing values are addressed, and anomalies are corrected.
Feature extraction is subsequently performed, in which data such as bandwidth values and timestamps are converted into numerical representations understandable by the CNN The log entries are then tagged as Fake Bandwidth.
Genuine Bandwidth, or No Heavy Activity.
This is followed by data normalization so that all of the features are scaled to a common range, typically between 0 and 1.
The dataset is split into two datasets: training data and validation data.
This splitting allows us to evaluate the performance of the model on unseen data.
The CNN architecture is then trained using the given training dataset.
It learns to identify patterns within the data through convolutional layers, pool layers, and fully connected or dense layers.
The utilization of ReLU activation functions allows for the addition of non-linearity and thereby enhances the capabilities of the model to identify more intricate patterns.
During the training process, the model calculates the loss value, which is the difference between the predicted labels and the actual labels.
The loss is calculated using the Categorical Cross-Entropy Loss function, and the model's internal weights are adjusted using the backpropagation algorithm to improve accuracy.
At the end of the training process, the model is tested using the validation dataset.
Several performance measures, such as Precision.
Recall, and F1-Score, are used to assess the performance of the model in classifying entries into the three defined It is utilized to categorize real-time data only after the model achieves good accuracy.
Logs collected for twenty days from Computer Lab 4 at UTS are processed at this stage.
This real-time dataset is cleaner and more precise as it contains only logs related to actual network activity, those corresponding to Telegram and Mikrotik.
Then the model developed classifies every real-time log entry into one of the three different categories: Fake Bandwidth.
Genuine Bandwidth, or No Heavy Activity.
The results of the classification process are visualized using pie charts, trend graphs, and loss-over-epochs graphs generated during the training process, thus illustrating the learning progress of the model.
As the first step in the CNN section, information is collected from the RB 1100 server every second through the bot @routeruts1100data_bot on Telegram.
The information collected constitutes network logs detailing users' bandwidth consumption.
This data is processed as the main input in the analysis shown below.
def load_data.
with open.
name, "r", encoding="utf-8") as f:
lines = f.
data, labels, bandwidth = [[] for _ in range.
] for line in lines:
line = line.
strip().
if "fake bandwidth" in line:
append("Fake") append.
'(\d )', group())) elif "genuine bandwidth" in line:
append("Genuine") append.
'(\d )', group())) elif "no heavy activity" in line:
append("No Heavy") append.
return data, labels, bandwidth Mathematically, the preprocessing operation can be written as .
X_cleaned = clean_text(X_ra.
where X_raw is the provided data of the unprocessed log, and X_cleaned is the data after a text cleaning process that Ae 90 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
removes non-alphanumeric characters and applies text Data obtained from network logs undergo a preprocessing procedure to ensure that the format is appropriate for the output of three criteria, which are fake, genuine, and no heavy.
this process consists of text cleansing and normalisation, as well as formatting the data to make it ready to be processed as follows.
output = text.
output = re.
'[^a-zA-Z0-9\.
', '', outpu.
return output Following the preprocessing, data cleansing was performed by detecting and resolving missing or invalid Next, normalisation was done to ensure that all data had a common uniform scale.
Normalisation is the process of changing the scale of data so that features such as bandwidth speed can be equitably compared.
The values for this normalisation were set by transforming all values to a range between 0 and 1, represented as follows .
X_norm = (X - X_mi.
/ (X_max - X_mi.
from sklearn.
preprocessing import LabelEncoder label_encoder = LabelEncoder() labels_train = label_encoder.
fit_transform.
abels_trai.
The next step is advanced Feature Engineering, in this case.
Double Bandwidth Detection.
At this stage, the aim is to identify the implementation of dual bandwidth due to networking anomalies or fraudulent activities, for example, at over 100 Mbps, as the model only considers up to 100 Mbps.
X_double = { x | x > 100 Mbps } .
Wherein X_double is filtered bandwidth data containing values greater than 100 Mbps, indicating the possibility of an anomaly, using the following script.
bandwidth_values = .
'(\d )', group()) for line in data if search.
'(\d )', lin.
] double_bandwidth_detected = .
w for bw in bandwidth_values if bw > .
Data that has been processed will be labelled to distinguish genuine bandwidth, fake bandwidth, and no heavy activity.
When data demonstrates an upload speed 22 to 100 Mbps, the data will be labelled as genuine bandwidth for both upload and download.
Meanwhile, if the data shows an upload speed of less than 20 Mbps, the data will be labelled as fake bandwidth.
Data without heavy activity will be labelled as no heavy if "fake bandwidth" in line:
append("Fake") elif "genuine bandwidth" in line:
append("Genuine") elif "no heavy activity" in line:
append("No Heavy") Based on the above flowchart, the next stage involves noise filtering to select irrelevant data or errors present in the log file, such as uncontrolled logon changes or bandwidth information augmenting that are outside the scope of fake, genuine, or no heavy, or deleting the socalled short strings which are devoid of meaning.
filtered_data = len.
> .
ine The main part, that is training data, is done with some convolution and pooling layers to capture patterns in the log data of the network.
Parameter models such as the number of convolutional layers, filter size, and epoch were implemented on the output.
The model was then trained with processed data, while the results were evaluated to measure the accuracy of classification for fake heavy bandwidth, genuine heavy, and no heavy bandwidth, which was over five hundred thousand rows of data.
The batch size utilised in this experiment was 32, which indicates that, in every iteration of the training, 32 samples of data will be considered for gradient calculation and weight update.
The core of the CNN model includes several convolutional layers and pooling layers that operate on raw input data to learn spatial features.
Mathematically, the convolution operation can be expressed as follows:
= sum_m sum_n X.
m, j .
* W.
Where X indicates the input data .
og data or bandwidth valu.
W is the convolutional filter, and C is the resultant feature map.
Filter W learns the spatial patterns in the data using local analysis windows, which are then followed by pooling operations to decrease the dimensions of the feature map and capture the characteristics by the encoding model as follows:
model = Sequential([ Embedding.
um_words, embedding_dim, input_length=input_lengt.
Conv1D.
, 3, activation='relu').
MaxPooling1D.
Conv1D.
, 3, activation='relu').
MaxPooling1D.
Conv1D.
, 3, activation='relu').
MaxPooling1D.
GlobalMaxPooling1D().
Dense.
, activation='relu').
Dropout.
Dense.
um_classes, activation='softmax') compile.
oss='categorical_crossentropy', optimizer='adam', metrics=['accuracy']) return model Ae 91 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
After the CNN model has been trained with the initial data, model evaluation is carried out by testing the data to see the accuracy obtained from outside.
The classification results are then visualised in a pie chart depicting the distribution of categories.
category_distribution = "category_distribution.
, .
) labels = ['Fake Bandwidth', 'Genuine Bandwidth', 'No Heavy Activity'] sizes = .
ake_detected, genuine_detected, no_heavy_detecte.
def func.
ct, allvalue.
absolute = int.
ct / 100.
)) return f".
%\n(.
)" pie.
izes, labels=labels, autopct=lambda pct: func.
ct, size.
, startangle=.
The output of the main step that occurs in this application is the uploading of data or files.
The user can upload network log files in the form of Daily.
txt, which contains records of bandwidth speed activity over 24 hours at three-second intervals.
The data in the first capture was trained in the first 20 days.
later, this training was used as real-time data, processed daily, and updated automatically from the mail server and monitoring Telegram, as shown in Figure 6 model of the upload dataset.
Figure 7.
Python based CNN Log Classifier Model During training, the CNN model performed a deep analysis of the incoming log data.
Each epoch provided new learning for the model to be able to identify features from the three categories of bandwidths.
Genuine Bandwidth pertains to network activities that display legitimate and real bandwidth usage.
Fake Bandwidth, on the other hand, refers to the activity in which there is less than 15% of the allowed 100 Mbps bandwidth utilisation .
n which case 200 Mbps is used but there is a tolerance limit of 20 Mbp.
to show a high level of utilisation without any actual data traffic for 24 hours a day for every Moreover, the No Heavy Activity evidence shows having little or no significant bandwidth activity.
The model was first trained, and the next step was to evaluate the model using the test data that was set aside.
The model was tested for the degree of accuracy on how it classifies new data from the set of three predetermined categories, as shown in Figure 8.
Figure 8.
Python-based CNN Classification Results Model Figure 6.
Dataset Upload Model i.
RESULTS AND DISCUSSIONS
In the deep learning model training process, this application issues two parameters subject to manual configuration as outputs: epoch and batch size.
An epoch, also referred to as an iteration, is a complete forward and backward pass of all the training data through the model.
In this context, the maximum number of epochs is set to 2000, which is sufficient to enable the model to deeply learn the patterns within the bandwidth data.
Batch size is referred to as the number of records that are processed in a single cycle of weight update.
In this case, a batch size of 32 was used, meaning that 32 samples were processed every time the model performed an update, as illustrated in Figure 7.
CNN Model Evaluation Results In this study, the CNN architecture was used to classify network logs into Fake Bandwidth.
Genuine Bandwidth, and No Heavy Activity.
The results were obtained from the bandwidth logs that had been documented from the traffic graphs into data logs as in the Figures 9 and 10 which are the results of monitoring and have consumed the bandwidth resources until downloading 25 Terabytes and uploading 7 Terabytes for 20 days of bypass bandwidth monitoring which was later converted to monitoring data in seconds.
Ae 92 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
Based on the table above, we observe that Genuine Bandwidth possesses very high Precision and Recall .
, which suggests that this model is highly accurate in distinguishing valid network activities.
On the other hand, while Fake Bandwidth had a lower Precision .
, the higher Recall .
suggests that the model is very aggressive in detecting fake bandwidths.
No Heavy Activity has astonishingly high Precision .
with lower Recall .
, which implies that though this category is detected accurately, the model does not capture all pertinent entries.
This is corroborated by the pie chart results in Figure 11, as obtained from the application.
Figure 9.
Network Traffic Model The data depicted in Figures 8 and 9 was converted into txt format and sent from the mail server phdscm01@uts.
my over port 587, which is utilized for the transmission of emails encrypted using Secure SMTP (SMTPS).
The information is, on average, 3-6 MB per file per day.
It is to be uploaded as real-world data that has been classified using CNN and needs to be processed.
Figure 11.
Bandwidth Distribution Model from CNN Classification at Lab 4 UTS The evaluation was carried out using the metrics of Precision.
Recall.
F1-Score, and Support for each The importance of these metrics is vital when it comes to assessing the effectiveness of a model in recognizing patterns in the log data.
Loss Over Epochs Figure 10.
Monitoring Results for 20 Days from RB 1100 AHx in Lab 4 UTS CNN was used to classify internet logs of Fake Bandwidth.
Genuine Bandwidth, and No Heavy Activity.
For the evaluation.
Precision.
Recall.
F1-Score, and Support were calculated for each category.
The use of these metrics is crucial to assess the effectiveness of the model in log data pattern classification.
After training the model with 2000 epochs, the evaluation results are presented in Table 1.
Table 1.
Precision.
Recall, and F1-Score Test Results Type Fake Bandwidth Genuine Bandwidth No Heavy Activity Precision Recall F1-Score Support On the external analysis of this application, calculations were made for the Loss Over Epochs graph that illustrates the loss value during training over 2,000 epochs, which took 7 hours of processing.
This evidence illustrates the level of prediction error made by the model in relation to the actual prediction results versus the real Categorical cross-entropy was used to calculate loss, and its mathematical expression is .
Loss = - y_i log(_.
Where y_i is the target value for class i, and _i is the predicted probability of the model for that class.
From the training results displayed in Figure 12, it is evident that the loss value decreases sharply, which indicates that the model learns these things very quickly because the log data was already distributed properly according to the required criteria, although it necessitated the router and server to perform at a high resource cost.
Figure 12 illustrates that CNN classified bandwidths for the first time during training.
The loss was approximately equal to 1.
0 at epoch zero, then sharply decreased to 0.
5 by epoch 100, indicating that the model was beginning to assimilate data swiftly.
Subsequently.
Ae 93 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
from epochs 100 to 500, the loss reduction rate slowed down progressively, hitting approximately 0.
2, which indicates the model was nearing the convergence point.
Within the region of epochs 500 to 1000, the loss continued to decrease and reached around 0.
1, which indicated that the model was becoming more effective in reducing the prediction errors.
Figure 12.
Loss Over Epochs of the CNN Classification Results more dynamic and accurate approach in monitoring the utilization of large-scale computer networks using log monitoring and CNN-based classification.
The success in classifying hundreds of thousands of lines of logs demonstrates CNN's extraordinary advantages in operating on big data and ability to capture very subtle phenomena in complex data that as shown:
Detected Fake Bandwidth : 170544 .
Detected Genuine Bandwidth : 378289 .
Detected No Heavy Activity : 19382 .
The log analysis approach can overcome the difficulties posed by traditional techniques that rely on larger time frames or sparse data.
The results from this CNN model show a high classification accuracy, even when working with a large amount of data in real time.
This model validated the notion that CNNs can be modified and enhanced for the application of everyday real-time data, which requires instant classification along with a very high accuracy level, as evidenced in Figure 14.
At the 2000th epoch, which is the end of the training period, the loss value was around 0.
05, which is incredibly low and suggests that the model achieved optimal convergence, where the prediction error is nearly zero.
The use of epochs shows that the robustness of the model can be increased by using techniques where the learning rate can be dropped at certain points during training.
Figure 13 shows the CNNs processing in this study.
Figure 14.
CNN Application Model for Lab 4 UTS IV.
CONCLUSION
Figure 13.
Epoch Processing on CNN to Obtain Accuracy and Loss Over Epochs Results of the Novelty of The Research (Network Log Optimisatio.
The novelty of the results in this research refers to the consideration of using network logs captured in real-time over 20 continuous days, with data collection frequency every second, to uncover fake bandwidth or more than 500,000 lines of data used to train the CNN model.
With the presence of real-time network logs, there is room for a This study demonstrated that the CNN model can be used to classify network logs to detect fake bandwidth, genuine bandwidth, and no heavy activity with high accuracy using log data collected in real-time every second for 20 days.
This CNN model has proven capable of processing over 500,000 lines of log data at once, demonstrating the model's ability to recognise very complex and subtle patterns in large volumes of data that traditional methods struggle with.
CNN successfully classified genuine bandwidth with high accuracy, evidenced by model performance evaluation based on metrics of: Precision 0.
Recall 0.
95, fake bandwidth detected with Precision 0.
89 and Recall 0.
90, and no heavy activity detected with Precision 0.
98 and Recall 0.
The Loss Over Epochs results show that as the number of epochs increased, the CNN model experienced a decrease in loss from 1.
0 at epoch 0 to 0.
05 at epoch 2000.
This estimate revealed that the CNN model successfully Ae 94 Ae TEPIAN Vol.
6 No.
2 (June 2.
85-96 p-ISSN 2721-5350 e-ISSN 2721-5369 Nurcahyo.
Yong .
, & Atanda.
Optimisation of Network Logs for Fake Bandwidth Classification using CNN.
TEPIAN, 6.
https://doi.
org/10.
51967/tepian.
minimised prediction errors with a stable training process that approached an optimal convergence point indicated by the decrease in loss.
As part of the key innovation in this research, the optimisation of real-time network log collection and processing using CNN has proven effective on dynamically distributed data.
Because the data is gathered systematically every second, the CNN model can classify it with great accuracy, even at a very large scale.
This approach not only improves the accuracy of detecting imprecise manipulative fake bandwidth, but also greatly aids fake bandwidth detection and network monitoring optimisation in real-time responsive environments.
REFERENCES