Background:  Forecasting network traffic with precision and detecting anomalies in real-time are essential for the efficient operation of intelligent network management systems. Traditional statistical models, including ARIMA, provide advantages such as interpretability and reduced computational demands; however, they exhibit limitations when handling non-linear dynamics. In contrast, deep learning models, exemplified by LSTM, demonstrate robust performance capabilities but face challenges related to transparency and higher computational costs. To mitigate these issues, recent studies have investigated hybrid methodologies that combine the strengths of both approaches.

Objectives: This thesis proposes a hybrid Autoregressive Integrated Moving Average (ARIMA) and Long Short-Term Memory (LSTM) forecasting framework designed to enhance the accuracy and robustness of network traffic prediction. The framework also facilitates real-time anomaly detection. The performance of the proposed model is systematically evaluated under varying conditions, including datasets with complete data and those that exhibit issues such as missing values, irregular time intervals, and traffic fluctuations. The evaluation utilizes a real-world dataset to validate the model's efficacy in various operational scenarios.

Methods:  The proposed method integrates ARIMA to model linear patterns and LSTM to learn the residual non-linear components. The Residuals from ARIMA are transformed into an LSTM model trained to forecast error corrections. Anomaly detection is implemented using a statistical Z-score thresholding mechanism on hybrid residuals. Extensive experiments were conducted using real network traffic datasets, with evaluations across various corruption scenarios.

Results:  The hybrid model demonstrated superior performance compared to the standalone ARIMA and LSTM models across all evaluated scenarios. It achieved a Mean Absolute Error (MAE) of 3.44 million bits and a mean absolute percentage error (MAPE) of 20. 78%  when tested on clean data. Moreover, the model exhibited robustness in the presence of missing data, 20% and maintained effectiveness despite irregular data intervals. The anomaly detection module achieved a sensitivity rate of 93.7% with a corresponding false positive rate of 4.1%.

Conclusions: The ARIMA-LSTM hybrid framework offers a solution characterized by interpretability, scalability, and accuracy for network traffic forecasting and anomaly detection. This framework exhibits robust performance even under suboptimal conditions, indicating strong potential for implementation in real-time network monitoring systems.