Modeling and forecasting overdispersed IoT data using an efficient and accurate computation of the Dirichlet Multinomial distribution

The Internet of Things (IoT) has rapidly become a ubiquitous aspect of modern society, intertwining with our daily lives in many ways; while these advancements provide several beneficial effects, they also bring forth significant security concerns that must be addressed to safeguard sensitive data, ensure privacy, and prevent potential cyber threats. While security by design will undoubtedly help in hardening systems, security is and will remain an arm-race between attackers and defenders, hence, a most important feat in the field of security for networked systems is the capability to model traffic and provide predictions capable of identifying suspicious behavior. This task becomes more challenging when handling overdispersed data where the dataset variance is significantly greater than what is expected by the adopted model. In this paper we model the overdispersed traffic of data collected from a device belonging to an IoT system using the Dirichlet Multinomial distribution and use that model to forecast the device traffic for the next 24 hours. Also, we compare the efficiency and accuracy of some state of the art techniques in generating traffic predictions. In terms of building the forecast model, our experiments utilized the LM technique and showed its superiority against the widely-used YS technique, in terms of speed and model accuracy. Our experiments also showed that the forecast model we built was capable of accurately predicting the traffic forecast for the next three days.