NetBurst: Event-Centric Forecasting of Bursty, Intermittent Time Series

TL;DR

This paper tackles forecasting of bursty, intermittent network telemetry, where traditional smooth-benchmark models underperform due to heavy-tailed bursts and long idle periods. It introduces NetBurst, an event-centric approach that reformulates forecasting as predicting burst timings and magnitudes via two streams, $\mathrm{IBG}$ and $\mathrm{BI}$, with quantile-based tokenization and dual autoregressors, followed by reconstruction. Empirically, NetBurst delivers dramatic $MASE$ improvements (up to $13$–$605\times$) over strong baselines on PINOT and MAWI across service, IP, and subnet granularities, while preserving burstiness as evidenced by $\mathrm{WD}$ improvements and richer embeddings (silhouette improvements $>5\times$). The work demonstrates a path toward foundation-model-like forecasting for telemetry, with practical benefits in anomaly detection, capacity planning, and cross-granularity transfer, and suggests broader applicability to other self-similar, heavy-tailed time series domains.

Abstract

Forecasting on widely used benchmark time series data (e.g., ETT, Electricity, Taxi, and Exchange Rate, etc.) has favored smooth, seasonal series, but network telemetry time series -- traffic measurements at service, IP, or subnet granularity -- are instead highly bursty and intermittent, with heavy-tailed bursts and highly variable inactive periods. These properties place the latter in the statistical regimes made famous and popularized more than 20 years ago by B.~Mandelbrot. Yet forecasting such time series with modern-day AI architectures remains underexplored. We introduce NetBurst, an event-centric framework that reformulates forecasting as predicting when bursts occur and how large they are, using quantile-based codebooks and dual autoregressors. Across large-scale sets of production network telemetry time series and compared to strong baselines, such as Chronos, NetBurst reduces Mean Average Scaled Error (MASE) by 13--605x on service-level time series while preserving burstiness and producing embeddings that cluster 5x more cleanly than Chronos. In effect, our work highlights the benefits that modern AI can reap from leveraging Mandelbrot's pioneering studies for forecasting in bursty, intermittent, and heavy-tailed regimes, where its operational value for high-stakes decision making is of paramount interest.

Figures (8)

• Figure 1: Current forecasting benchmarks (ETT and Taxi) vs. network telemetry data (more bursty service time series): (a) shows benchmarks are confined to narrow ranges, while network telemetry exhibits extreme variability. (b) reveals strong periodicity in benchmarks but flat autocorrelation structure in telemetry. (c) shows telemtry has only localized, phase-misaligned micro-patterns that cancel when aggregated.
• Figure 2: NetBurst pipeline. Raw telemetry series are eventized into inter-burst gaps (IBG) and burst intensities (BI), discretized with quantile-based tokenizers, and modeled with separate autoregressive forecasters. The two streams are then recombined during reconstruction to produce byte-count forecasts that preserve sparsity and burst fidelity.
• Figure 3: Fano Factor of the 95th-percentile service, IP, and subnet series under varying thresholds and window sizes. Smaller windows increase variance and sparsity, while larger windows reduce burst detail. This motivates the choice of 100 ms and 1 s windows for service- and IP/subnet-level evaluation, respectively.
• Figure 4: NetBurst vs. Baselines
• Figure 5: CDF of MASE losses shows NetBurst has fewer examples where losses were large, demonstrating effectiveness in predicting rare events.