Learn from ordered network traffic

Course · Notebook · Part 4 · Part 4 exercises

Teach a small model from 12 consecutive one-minute traffic volumes. Compare two schedules with equal totals, then change labels or reschedule the same upload volume.

Self-study after Part 4 (notebook lesson 4). Core route: clean training, nine accepted-label edits, one-minute rescheduling, then an explanation. Start with Reset and zero label edits. Recovery training is further practice. No account, installation or API key.

Teaching steps: predict, do, observe, explain

1. Reset. The input is 12 successive one-minute volumes. Compare the review case and approved backup: both transfer 360 MB. Their timing differs.

2. Return to the review case, keep label edits at 0 and train both 500 updates. One learned weight belongs to each minute position.

3. Open Weights & loss. Explain why equal totals can get different scores. This positional classifier is not a forecaster or recurrent network.

4. Change 9 of 12 review labels to no review and retrain. Compare clean and poisoned catches on the same untouched evaluation labels.

5. Keep the review case. Reschedule by 1 minute and compare scores. Total volume and the case label stay fixed; no weight changes.

6. Restore input and explain the two changed surfaces. Optionally, set label edits to 0 and retrain for recovery. Name one unseen schedule to evaluate.

Next/Back changes the instruction only. The training button performs actual gradient updates in a local worker. Labels and learned weights are visible; no answer is hard-coded into the result.

Record your evidence

Keep threshold 0.50. For evasion, write the before/after scores, the unchanged model updates and unchanged total MB plus the changed minute schedule. Explain whether you changed the learning data or only the input presented after training.

What the data means

Each input contains 12 ordered values: one-minute outbound volume in MB/min, scaled by 100. The canonical approved bulk backup and authored review case each transfer 360 MB. Training and evaluation add separately seeded measurement variation to these same two schedule families. Labels describe the supplied case context; timing alone does not establish authorisation. Rescheduling rotates the 12 minute bins, preserving their values and total volume. The positional classifier has no recurrence, temporal invariance or forecasting objective; no real traffic is generated.

Both runs start with zero weights and use the same 500-update budget. Poisoning changes only the accepted labels of selected review examples to no review. Evaluation labels remain unchanged. Training loss measures agreement with accepted labels; a low poisoned-training loss can accompany poor clean evaluation. These evaluation examples support classroom comparisons; they are too narrow to justify deployment or tuning a production detector.

If the worker is unavailable

Draw two 12-minute charts: backup 70,70,70,70,10,10,10,10,10,10,10,10; review 10,10,70,10,10,70,10,10,70,10,10,70. Both sum to 360 MB. Give different minute positions different weights. A sigmoid maps the sum to a 0–1 score. Changing a label changes the next training target; changing only the input uses the existing function. Predict why moving an unchanged schedule to different minute positions can alter its score.

Explain it to your partner

Question: Equal totals produce different scores. After shifting minutes, what did the model rely on?

Take 30 seconds each: point to the input, name the one change, then cite an observation from your run. A useful explanation: The model receives rates at particular positions. Equal total volume does not make two input vectors equal.

Read next: Concept and research connection. The reading is optional; you do not need its mathematics for this exercise.