Computer Network Model And Its Classification Based On Lstm For Identifying Fake Bandwidth

Abstrak

The phenomenon of fake bandwidth arises when the actual internet throughput delivered by an Internet service provider consistently falls below the speed guaranteed in a service level agreement. This study presents a long short-term memory classification framework to identify genuine and fake bandwidth based on real-world network log data collected at the University of Technology Sarawak, Malaysia. The network model was developed following the infrastructure pattern of the campus dedicated bandwidth environment connected to the cybersecurity laboratory. A dataset comprising 1,857,285 log records was acquired over 60 days of continuous monitoring via an RB1100AHx backbone router integrated with a Telegram bot-based real-time notification system. Four bandwidth categories were defined in accordance with ETSI quality standards: Genuine Bandwidth ≥21 Mbps, Fake Bandwidth <15 Mbps, No Heavy Activity <100 kbps, and Unclassified. The LSTM model was optimized through a 100-dimensional embedding layer, a bidirectional LSTM layer with 128 units and progressive dropout regularization (0.4–0.6), and the Adam optimizer at a learning rate of 0.0005. Experiments were conducted under three data split configurations (30:70, 50:50, and 70:30). The model achieved a consistent classification accuracy of 96.93% across all configurations, with an empirical error rate of 3.06%–3.07% and a theoretical generalization bound of 2.87% derived from Vapnik–Chervonenkis theory. K-fold cross-validation yielded a mean accuracy of 0.940, confirming model stability. Empirical analysis reveals that approximately 52% of monitored dedicated bandwidth constitutes genuine throughput, while approximately 23% exhibits fake bandwidth behavior, providing quantitative evidence of systematic SLA non-compliance.