Network Traffic Analysis with Process Mining: The UPSIDE Case Study

TL;DR

This work tackles explainable analysis of gaming network traffic by learning unsupervised traffic states from multi-device UPSIDE data and encoding them as Petri nets via process mining. The method proceeds through four phases—network monitoring, feature extraction, state characterization, and process discovery with Inductive Miner—to produce interpretable state machines that can classify which game is being played. The UPSIDE evaluation shows strong inter-device coherence ($94.02\%$) and inter-state separation ($174.99\%$) across devices, with competitive game discrimination performance ($AUC = 73.84\%$) and interpretable Petri nets illustrating representative traffic bursts. While promising for explainable traffic modeling and capacity planning at esports-scale events, the approach also reveals sensitivity to state-space design and window-length, motivating future refinements and simulation-based evaluations.

Abstract

Online gaming is a popular activity involving the adoption of complex systems and network infrastructures. The relevance of gaming, which generates large amounts of market revenue, drove research in modeling network devices' behavior to evaluate bandwidth consumption, predict and sustain high loads, and detect malicious activity. In this context, process mining appears promising due to its ability to combine data-driven analyses with model-based insights. In this paper, we propose a process mining-based method that analyzes gaming network traffic, allowing: unsupervised characterization of different states from gaming network data; encoding such states through process mining into interpretable Petri nets; and classification of gaming network traffic data to identify different video games being played. We apply the method to the UPSIDE case study, involving gaming network data of several devices interacting with two video games: Clash Royale and Rocket League. Results demonstrate that the gaming network behavior can be effectively and interpretably modeled through states represented as Petri nets with sufficient coherence (94.02% inter-device similarity) and specificity (174.99% inter-state separation) while maintaining a good classification accuracy of the two different video games (73.84% AUC).

Figures (6)

• Figure 1: The proposed method for encoding gaming traffic of network devices into behavioral models.
• Figure 2: Gaming event network of the UPSIDE case study.
• Figure 3: Similarity ($sim$), separation ($sep$) and complexity ($comp$) percentages of each set of Petri nets obtained with different window lengths and numbers of states.
• Figure 4: The probability mass functions of CR ($P_{CR}$) and RL ($P_{RL}$) for each number of states with a window length equal to 3. The configuration with four states achieves the least intersection ($I$) and cosine similarity ($CosSim$).
• Figure 5: Receiving operating curves associated with states 2 to 5 for a window length equal to 3.