Why Network input bytes had increased steeply on EC2 instance?

I want to know that reason about steeply increased Network input bytes on my instance.

I'm using EC2 for development server. (nginx and php-fpm based on docker)

My instance allows only specific ip address and port via SecurityGroup's inbound rule.(port: 22, 80, 443)

But CloudWatch shows weird information.

CloudWatch tells Network input bytes(almost 7MB) reached my instance when I never using instance.

So I'd found weird point in ssh(22) log and nginx(80) log, but it was not exist.

Can I know that reason about this problem without Amazon Technical Support?