Pith. sign in

REVIEW 4 major objections 5 minor 28 references

Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining

T0 review · 4 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read TiDE forecasting models cut median baseline error by 30–42% on ten-router Internet2 traffic, enabling dynamic security baselines that tell scientific bursts from attacks.

desk verdict A solid forecasting benchmark on real Internet2 data that is oversold as a security result; the anomaly labels are generated by the same unsupervised detectors used to build the variants, so the 'distinguishing attacks' claim is untested. read the letter →

arxiv 2608.05605 v1 pith:VQHGC2IJ submitted 2026-08-06 cs.CR cs.LGcs.NI

Mohammad Arafath Uddin Shariff , Byrav Ramamurthy This is my paper · ORCID
classification cs.CRcs.LGcs.NI
keywords anomalydetectiontrafficforecastingresearchandeducationnetworksdynamicsecuritybaseliningtimeseriesbenchmarkTiDEInternet2backbonedeeplearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that modern long-sequence forecasting models, especially the MLP-based TiDE architecture, can build far tighter dynamic security baselines for research and education networks (RENs) than the statistical and tree-based methods currently used. Using 57 days of Internet2 backbone traffic spanning ten routers and 13.7 billion packets, the authors benchmark six model families across 960 configurations and report that TiDE cuts median absolute error by 30 to 42 percent relative to SARIMA, XGBoost, GRU-LSTM, N-BEATS, and PatchTST, with p<0.001. They further claim that injecting unsupervised anomaly signals—either by masking anomalous training windows or adding anomaly scores as features—improves robustness to poisoned training data. If these results hold, security operators could predict the 'elephant flows' that legitimately saturate research links and reserve alarms for genuine attacks, converting a chronic false-positive problem into a manageable thresholding task.

What carries the argument

The load-bearing mechanism is the forecasting benchmark itself: a Dask-based ETL pipeline aggregates raw NetFlow into hourly per-router time series; Isolation Forest and Local Outlier Factor (features: hourly counts, 24-hour rolling z-scores, time-of-day) assign anomaly scores and flags with contamination 0.01; those signals are combined into four data variants (raw, mask-out, score-as-feature, both); and six model families are trained per router per horizon. The claimed advantage of TiDE comes from its dense encoder-decoder with residual connections, which maps noisy historical windows into a dense latent space and thereby dampens single-point anomalies, while the power-law error growth provides a predictable threshold bound for security operations.

What would settle it

Take a different REN backbone (for example ESnet or GÉANT) with a labeled set of confirmed security incidents, train the same six model families with the same protocol, and check whether TiDE's 30–42% median MAE advantage over SARIMA reproduces and whether the anomaly-aware variants actually lower the false-positive rate on genuine attacks. If the error gap shrinks below statistical significance or the baselines fail to flag the labeled attacks, the paper's central claim is refuted.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is an empirical ranking: TiDE variants achieve a median MAE of 5.66e7 packets, a 30–42% error reduction over traditional baselines, and this advantage persists across 1-, 6-, 12-, and 24-hour horizons on most of the ten routers. The paper also finds that anomaly masking improves GRU-LSTM robustness by 3.3% (p<0.01), that score-as-feature helps TiDE by 1.11% (p<0.05), and that baseline error grows as a power law MAE(h)=5.2e7*$h^{0}$.23+4.8e7 ($R^{2}$=0.89), defining a 6-hour operational security window. The authors present this as the first statistically validated framework for distinguishing scientific workflows from network attacks on a large-scale REN backbone.

Load-bearing premise

The anomaly labels used to build the anomaly-aware variants come from unsupervised Isolation Forest and Local Outlier Factor detectors fitted to the same unlabeled Internet2 traffic, with a contamination rate of 0.01 assumed to match observed anomaly frequency; if these machine-made labels do not line up with real attacks or with the events operators care about, the robustness improvements and the claimed science-versus-attack distinction lack external validation.

Editorial extensions

If this is right

  • Tier-1 dense encoders (TiDE) can serve as the primary dynamic security baseline for core REN routers, with a 6-hour look-ahead window for proactive firewall and QoS configuration.
  • RNN-based detectors should be trained with anomaly masking to avoid poisoned baselines, while dense encoders benefit from feeding anomaly scores as exogenous features.
  • Per-router baselines are required because predictability varies dramatically across nodes, and a single network-wide threshold will produce false positives.
  • XGBoost remains a viable low-latency failover for edge security appliances where maximal accuracy is less critical than minimal inference time.
  • A weekly retraining cadence is recommended to keep baselines aligned with evolving scientific workloads.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the 30–42% error reduction generalizes, the same dense-encoder approach could be applied to other bursty, machine-driven network environments—HPC data transfers, cloud interconnects, science DMZ edge—where legitimate elephant flows mask volumetric attacks.
  • The paper's internal contamination assumption (0.01) could be tested directly by comparing generated anomaly flags against real-world incident logs, and the framework's practical value might be better measured by downstream IDS false-positive reduction than by raw MAE.
  • The power-law error growth suggests a concrete operational rule the authors do not state: security thresholds for a given horizon could be set adaptively as a function of h^0.23, tightening the window during planned quiet periods and loosening it during expected science bursts.
  • The univariate per-router design ignores spatial correlation between routers; a spatio-temporal baseline would likely tighten the 6-hour window further, which the authors list as future work.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a traffic-forecasting framework for dynamic security baselining in Research and Education Networks (RENs). Using an Internet2 dataset of 13.7 billion packets across ten backbone routers, the authors benchmark six model families (SARIMA, XGBoost, GRU-LSTM, N-BEATS, TiDE, PatchTST) over four prediction horizons and four anomaly-integration strategies, totaling 960 experiments. They report that TiDE variants achieve a median MAE of 5.66×10^7 packets, a 30–42% error reduction over traditional baselines (p<0.001), and that anomaly masking improves GRU-LSTM robustness by 3.3%. The paper claims this constitutes "the first statistically validated framework for distinguishing scientific workflows from network attacks."

Significance. The forecasting benchmark itself has notable strengths: a large and diverse real-world dataset (13.7 billion packets, ten routers), chronologically split train/validation/test sets, five evaluation metrics, paired t-tests with Bonferroni correction, hyperparameter grid search, and a per-router analysis that acknowledges heterogeneity. If the forecasting results hold, the paper provides useful evidence that dense-encoder architectures such as TiDE can produce tighter traffic baselines for RENs than classical methods or recurrent networks. However, the security-oriented claims go beyond the evidence. The anomaly labels are produced by unsupervised Isolation Forest and LOF detectors fitted to the same unlabeled series, with no ground-truth attack events, no injection experiments, and no detection metrics. Consequently, the central claim of "distinguishing scientific workflows from network attacks" is unsupported as stated, and the anomaly-robustness results are at risk of circularity. The paper would be a credible forecasting benchmark if the security claims were reframed or externally validated.

major comments (4)
  1. [Abstract and Section VI-B] The claim of a "statistically validated framework for distinguishing scientific workflows from network attacks" is not supported by any experiment with ground-truth attack labels. The only anomaly labels come from unsupervised Isolation Forest and LOF detectors fitted to the same unlabeled Internet2 series (Section III-A, Eqs. 1–2), with contamination rate 0.01 assumed to match observed anomaly frequency. No precision, recall, false-positive rate, or time-to-detection is reported. Moreover, the paper's own premise (Section I) states that elephant flows and DDoS are "statistically indistinguishable" to conventional monitoring; a more accurate forecaster could therefore predict an attack-like burst as "normal" and mask it from downstream detectors. The 30–42% MAE reduction in Table V is a forecasting result and does not logically establish improved attack distinction. The authors should either provide labeled or injected attack evaluation or explicitly reframe the contribution as a forecasting benchmark without the security-distinction claim.
  2. [Section III-A and Table VI] The anomaly-robustness results (Table VI) are circular with respect to the anomaly labels and are ambiguous about the evaluation set. The mask-out, score-as-feature, and combined variants are all constructed from IF/LOF flags on the same training series (Fig. 2). If the test set still contains the flagged points, the GRU-LSTM mask-out gain (−3.3%) may partly reflect the removal of hard-to-predict high-error points from training rather than improved resilience to attacks. If the test set excludes those points, the reported ΔMAE does not measure behavior on the anomalies that a security system would need to detect. The paper should specify whether anomalies were removed from the test set, report detection performance (precision/recall on the flagged points or on injected anomalies) in addition to forecasting error, and discuss the extent to which the mask-out improvement is mechanical.
  3. [Eq. (5) and Section V-C] The power-law model MAE(h) = 5.2×10^7 · h^0.23 + 4.8×10^7 with R²=0.89 is fit to only four prediction horizons (1, 6, 12, 24 hours), and the manuscript does not state which error quantity (e.g., median MAE or RMSE) was used, the per-horizon values, or confidence bounds. This is too thin a basis for the operational recommendation of a 6-hour "sweet spot" and for the power-law error bound in Eq. (5). The authors should report the fit residuals and a robustness check (e.g., leave-one-horizon-out) before using this relation to set security thresholds.
  4. [Section VI-B, Data Availability] The paper describes itself as a benchmark but does not provide the processed data or code. Section VI-B states that the raw NetFlow datasets cannot be released and that the authors "commit to releasing all processing scripts, model training code, and the whole comprehensive evaluation report" without providing a repository link or a timeline. For a benchmarking contribution, the aggregated hourly per-router time series and the training/evaluation code are necessary for independent verification and extension. Without these artifacts, the benchmark is not reproducible as presented.
minor comments (5)
  1. [Fig. 4 caption] The caption refers to "Transformer-based models (TiDE)", but TiDE is a time-series dense encoder based on MLPs, not a Transformer. This mislabeling also appears in the Introduction's contribution list and could mislead readers about the architectural comparison.
  2. [Section V-B and Table VI] The significance notation is inconsistent: the text states the TiDE Score-as-feature improvement is p<0.05, while Table VI marks the same entry with ** (p<0.01). Please align the text with the table or explain the discrepancy.
  3. [Eq. (5)] The variable h is used in Eq. (3) as the forecast horizon, but in Eq. (5) the power-law fit uses h as the input while MAE(h) is the output; using the same symbol for both the horizon index and the independent variable is confusing. Rename the independent variable in Eq. (5) (e.g., H).
  4. [Section V-A] The sentence "N-BEATS and PatchTST ... outperform RNNs by 25–30%" is not clearly derived from Table V: the reader must compute (8.8e7−6.4e7)/8.8e7 ≈ 27% for N-BEATS, and the same for PatchTST is also about 27%, so stating the exact comparison base would improve clarity.
  5. [Section VI-B] The sentence "To mitigate this and ensure reproducibility, we commit to releasing all processing scripts, model training code, and the whole comprehensive evaluation report for all variations" is vague; please provide a concrete artifact availability statement (e.g., a repository URL and license) rather than a commitment.

Circularity Check

1 steps flagged · score 4.0 of 10

Anomaly-resilience results are validated against the same unsupervised detectors that generate the anomaly labels, but the core forecast benchmark is independent.

  1. fitted input called prediction [Section III-A (Anomaly Detection Module) and Section V-B (Table VI)]
    "To distinguish legitimate scientific bursts from operational anomalies and potential attacks, we deploy both Isolation Forest (IF) and Local Outlier Factor (LOF), trained per-router. ... the contamination rate (0.01) matches observed anomaly frequencies. ... We systematically test four ways to inject anomaly information: (1) raw (no anomaly), (2) mask-out, (3) score-as-feature, and (4) both combined. ... Masking anomalies (the "Mask-out" strategy) yields a 3.3% MAE reduction (p < 0.01), confirming that RNNs require clean training data to establish a stable security baseline."

    The mask-out and score-as-feature variants are constructed from IF/LOF flags fitted to the same unlabeled Internet2 series. Table VI then reports that masking these self-generated flags improves MAE (e.g., GRU-LSTM -3.3%). The 'noise' being removed is defined by the very detectors that produce the masks; no external ground-truth attack labels, injection experiments, or detection metrics (precision/recall/FPR) are provided. The claimed robustness improvement therefore reduces to 'the model predicts better on points that the same unsupervised detectors do not flag,' and the security conclusion that the framework distinguishes scientific workflows from network attacks is not independently validated. The core forecasting benchmark itself is evaluated on held-out test data and is not circular.

full rationale

The central forecasting benchmark is self-contained: six model families are trained on chronological train/validation splits and evaluated on a held-out test split, with paired t-tests and Bonferroni correction, so the TiDE 30-42% MAE reduction does not reduce to any fitted parameter or self-citation. The self-citations (e.g., [20]) are used only for positioning and are not load-bearing. The circularity is confined to the anomaly-resilience and 'distinguishing attacks' claims: IF/LOF are fitted to the same unlabeled series, their flags define the mask/score variants, and the resilience improvement is measured against those same internal labels. Consequently, the robustness result is partly self-referential, though it does not undermine the independent forecast-accuracy benchmark. The external-validation gap (no ground-truth attacks) is a serious validity concern but is separate from the benchmark's internal correctness.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The benchmark rests on a private dataset, hand-set contamination, grid-searched hyperparameters, and an internal anomaly definition. The TiDE forecasting advantage is largely independent of these choices, but the anomaly-resilience and security-distinction claims depend on the internal anomaly labels.

free parameters (5)
  • Isolation Forest / LOF contamination rate = 0.01
    Chosen by hand to match observed anomaly frequencies (Section III-A); this threshold defines which points are masked or scored, so it directly shapes the anomaly-aware robustness results.
  • SARIMA order = (1,1,1)x(1,1,1)_24
    Selected via AIC on the training data (Table III); it is a fitted model order, not a fixed constant.
  • Deep learning hyperparameters (TiDE, PatchTST, N-BEATS, GRU-LSTM) = window, units, layers, patch length, learning rate
    Grid-searched on validation data (Table III); results depend on these choices.
  • XGBoost hyperparameters = n_estimators=500, max_depth=6, lr=0.05
    Grid-searched; affects the lightweight baseline comparison.
  • Power-law baseline error constants = 5.2e7, 0.23, 4.8e7
    Eq. (5) is fitted to the four median horizon errors with R^2=0.89; it is a descriptive fit, not a validated predictive law.
assumptions (4)
  • domain assumption An anomaly is any traffic pattern that significantly deviates from the learned baseline (Section III-A).
    This equates statistical deviation with security-relevant anomaly, unproven and load-bearing for the robustness claims.
  • domain assumption Univariate, per-router modeling is the standard deployment model for edge IDS and is sufficient for establishing security baselines (Section III).
    The paper explicitly excludes spatial dependencies and does not compare against multivariate models.
  • ad hoc to paper The 0.01 contamination rate matches observed anomaly frequencies in the unlabeled data.
    No measurement or external evidence is given for this rate; it is set to match the detector's own output.
  • domain assumption REN anomalies are bimodal, either legitimate elephant flows or security events, and unsupervised outlier detectors can separate them without labeled attacks.
    This underwrites the claim that forecasting deviations distinguish attacks from science; no labeled validation is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining." pith.science (2026). https://pith.science/paper/VQHGC2IJ

@misc{pith2026260805605,
  author       = {Pith},
  title        = {Pith review of: Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VQHGC2IJ}},
  note         = {Machine review of arXiv:2608.05605}
}
abstract

Research and Education Networks (RENs) serve as critical infrastructure for scientific discovery, yet they face a unique security paradox: their normal traffic patterns which are characterized by massive, bursty "elephant flows" are statistically indistinguishable from volumetric attacks such as DDoS to conventional monitoring systems. This similarity leads to high false-positive rates in anomaly detection, blinding security operators to genuine threats. In this paper, we propose and evaluate a high-fidelity traffic forecasting framework designed to establish dynamic security baselines for RENs. Leveraging an exclusive 57-day Internet2 dataset spanning ten backbone routers (13.7 billion packets), we perform the first large-scale benchmark of anomaly-aware forecasting models in this domain. We systematically evaluate six model families, from SARIMA to state-of-the-art long-sequence architectures (TiDE, PatchTST), across 960 experimental configurations. Our results demonstrate that these advanced architectures, particularly TiDE, reduce baseline prediction error by 30-42% compared to traditional methods ($p < 0.001$), significantly improving the distinction between legitimate scientific bursts and potential anomalies. Furthermore, we introduce a novel anomaly-integration strategy that improves model robustness by 3.3% in the presence of noise. This work provides the first statistically validated framework for distinguishing scientific workflows from network attacks, enabling more autonomous and resilient network security operations.

Figures

Figures reproduced from arXiv: 2608.05605 by the authors.

Figure 1
Figure 1. Geographic distribution of the ten Internet2 routers. The diversity of [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The end-to-end architecture of our anomaly-aware forecasting frame [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Mean hourly traffic across ten routers. The muted diurnal cycles (only [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Baseline Fidelity (Median MAE) for all the Horizons. Transformer [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Visualizing the “Noise”: Legitimate traffic bursts (red dots) on the [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 7
Figure 7. Figure 7: Baseline Consistency Heatmap by Router (24-hour MAE). Lower [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 6
Figure 6. Figure 6: Operational Security Window. The sharp error increase up to 6 hours [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 26 canonical work pages

  1. [1]

    SDN for End-to-End Networked Science at the Exascale (SENSE),

    I. Monga, C. Guok, J. MacAuley, A. Sim, H. Newman, J. Balcas, P. DeMar, L. Winkler, T. Lehman, and X. Yang, “SDN for End-to-End Networked Science at the Exascale (SENSE),” inIEEE/ACM Innovating the Network for Data-Intensive Science (INDIS), 2018, pp. 33–44

    work page 2018

  2. [2]

    Ai-driven multilayered cybersecurity intelli- gence framework for critical infrastructure protection,

    M. S. Ahamed, K. M. N. Hossain, M. A. U. Shariff, I. U. Haque, S. M. Hridita, and M. A. Talha, “Ai-driven multilayered cybersecurity intelli- gence framework for critical infrastructure protection,” inInternational Conference on Data Science, AI and Applications. Springer, 2025, pp. 31–45

    work page 2025

  3. [3]

    The Science DMZ: A network design pattern for data-intensive science,

    E. Dart, L. Rotman, B. Tierney, M. Hester, and J. Zurawski, “The Science DMZ: A network design pattern for data-intensive science,” inProceedings of the International Conference on High Performance Computing, Networking, Storage and Analysis, 2013, pp. 1–10

    work page 2013

  4. [4]

    Challenges with Collecting, Anonymizing, Sharing and Using High- Speed Network-Traffic Data (White Paper),

    A. Nottingham, J. W. Collyer, B. E. Root, M. Buchanan, Y . Zhang, K. Sadeghi, Y . Sun, D. E. Brown, J. W. Davidson, and M. Veeraraghavan, “Challenges with Collecting, Anonymizing, Sharing and Using High- Speed Network-Traffic Data (White Paper),” 2020

    work page 2020

  5. [5]

    A fluid-flow characterization of Internet1 and Internet2 traffic,

    J. Rogers and K. J. Christensen, “A fluid-flow characterization of Internet1 and Internet2 traffic,” inProceedings LCN 2001. 26th Annual IEEE Conference on Local Computer Networks. IEEE, 2001, pp. 509– 513

    work page 2001

  6. [6]

    Understanding flows in high-speed scientific networks: A Netflow data study,

    M. Kiran and A. Chhabra, “Understanding flows in high-speed scientific networks: A Netflow data study,”Future Generation Computer Systems, vol. 94, pp. 72–79, 2019

    work page 2019

  7. [7]

    A signal analysis of network traffic anomalies,

    P. Barford, J. Kline, D. Plonka, and A. Ron, “A signal analysis of network traffic anomalies,” inProceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, 2002, pp. 71–82

    work page 2002

  8. [8]

    Understanding Data Movement Patterns in HPC: A NERSC Case Study,

    A. Giannakou, D. Hazen, B. Enders, L. Ramakrishnan, and N. J. Wright, “Understanding Data Movement Patterns in HPC: A NERSC Case Study,” inSC24: International Conference for High Performance Computing, Networking, Storage and Analysis. IEEE, 2024, pp. 1–17

    work page 2024

Show all 28 references
  1. [9]

    Anomaly detection: A survey,

    V . Chandola, A. Banerjee, and V . Kumar, “Anomaly detection: A survey,”ACM computing surveys (CSUR), vol. 41, no. 3, pp. 1–58, 2009

    2009

  2. [10]

    Outside the closed world: On using machine learning for network intrusion detection,

    R. Sommer and V . Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in2010 IEEE symposium on security and privacy. IEEE, 2010, pp. 305–316

    2010

  3. [11]

    Challenging the anomaly detection paradigm: A provocative discussion,

    C. Gates and C. Taylor, “Challenging the anomaly detection paradigm: A provocative discussion,” inProceedings of the 2006 workshop on New security paradigms, 2006, pp. 21–29

    2006

  4. [12]

    Learning nonstationary models of normal network traffic for detecting novel attacks,

    M. V . Mahoney and P. K. Chan, “Learning nonstationary models of normal network traffic for detecting novel attacks,” inProceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining, 2002, pp. 376–385

    2002

  5. [13]

    A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data,

    E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo, “A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data,” inApplications of data mining in computer security. Springer, 2002, pp. 77–101

    2002

  6. [14]

    Isolation Forest,

    F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation Forest,” in2008 Eighth IEEE International Conference on Data Mining, 2008, pp. 413–422

    2008

  7. [15]

    LOF: identifying density-based local outliers,

    M. M. Breunig, H.-P. Kriegel, R. T. Ng, and J. Sander, “LOF: identifying density-based local outliers,” inProceedings of the 2000 ACM SIGMOD International Conference on Management of Data. Association for Computing Machinery, 2000, p. 93–104

    2000

  8. [16]

    Diagnosing network-wide traffic anomalies,

    A. Lakhina, M. Crovella, and C. Diot, “Diagnosing network-wide traffic anomalies,”ACM SIGCOMM computer communication review, vol. 34, no. 4, pp. 219–230, 2004

    2004

  9. [17]

    Long-term forecast- ing of Internet backbone traffic,

    K. Papagiannaki, N. Taft, Z.-L. Zhang, and C. Diot, “Long-term forecast- ing of Internet backbone traffic,”IEEE transactions on Neural Networks, vol. 16, no. 5, pp. 1110–1124, 2005

    2005

  10. [18]

    Predicting W AN traffic volumes using Fourier and multivariate SARIMA ap- proach,

    B. Mohammed, N. Krishnaswamy, M. Kiran, and K. Wu, “Predicting W AN traffic volumes using Fourier and multivariate SARIMA ap- proach,”International Journal of Big Data Intelligence, vol. 8, no. 1, pp. 1–12, 2021

    2021

  11. [19]

    A Comprehensive Study of Wide Area Data Movement at a Scientific Computing Facility

    Z. Liu, R. Kettimuthu, I. T. Foster, and Y . Liu, “A Comprehensive Study of Wide Area Data Movement at a Scientific Computing Facility.” in ICDCS, 2018, pp. 1604–1611

    2018

  12. [20]

    Traffic Prediction for Research and Education Networks using an Ensemble GRU-LSTM with Varying Lead Times,

    M. A. U. Shariff, V . S. S. L. Karanam, and B. Ramamurthy, “Traffic Prediction for Research and Education Networks using an Ensemble GRU-LSTM with Varying Lead Times,” in2025 IEEE International Conference on Communications Workshops (ICC Workshops). IEEE, 2025, pp. 1676–1681

    2025

  13. [21]

    Network Traffic Prediction based on Diffusion Con- volutional Recurrent Neural Networks,

    D. Andreoletti, S. Troia, F. Musumeci, S. Giordano, G. Maier, and M. Tornatore, “Network Traffic Prediction based on Diffusion Con- volutional Recurrent Neural Networks,” inIEEE INFOCOM 2019- IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 2019, pp...

    2019

  14. [22]

    APRIL: An Application-Aware, Predictive and Intelligent Load Balancing So- lution for Data-Intensive Science,

    D. Nadig, B. Ramamurthy, B. Bockelman, and D. Swanson, “APRIL: An Application-Aware, Predictive and Intelligent Load Balancing So- lution for Data-Intensive Science,” inIEEE INFOCOM 2019 - IEEE Conference on Computer Communications, 2019, pp. 1909–1917

    2019

  15. [23]

    Long-term Forecasting with TiDE: Time-series Dense Encoder,

    A. Das, W. Kong, A. Leach, S. Mathur, R. Sen, and R. Yu, “Long-term Forecasting with TiDE: Time-series Dense Encoder,” 2024. [Online]. Available: https://arxiv.org/abs/2304.08424

    2024 arXiv

  16. [24]

    A Time Series is Worth 64 Words: Long-term Forecasting with Transformers,

    Y . Nie, N. H. Nguyen, P. Sinthong, and J. Kalagnanam, “A Time Series is Worth 64 Words: Long-term Forecasting with Transformers,”

  17. [25]

    Comparative Study of Big Data Visualization Tools and Techniques,

    K. Begum, M. M. Rashid, and M. A. U. Shariff, “Comparative Study of Big Data Visualization Tools and Techniques,” inApplied Informatics for Industry 4.0. Chapman and Hall/CRC, 2023, pp. 188–199

    2023

  18. [26]

    A novel hybrid gldnn architecture for bangla dialect identification,

    M. A. U. Shariff, “A novel hybrid gldnn architecture for bangla dialect identification,” inInternational Conference on Data Science, AI and Applications. Springer, 2025, pp. 75–91

    2025

  19. [27]

    A novel deep learning approach to predict air quality index,

    E. Hossain, M. A. U. Shariff, M. S. Hossain, and K. Andersson, “A novel deep learning approach to predict air quality index,” inProceedings of International Conference on Trends in Computational and Cognitive Engineering: Proceedings of TCCE 2020. Springer, 2020, pp. 367–381

    2020

  20. [2023]

    Available: https://arxiv.org/abs/2211.14730

    [Online]. Available: https://arxiv.org/abs/2211.14730

    arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.