Profiling-By-Association: a resilient traffic profiling solution for the internet backbone

Profiling Internet backbone traffic is becoming an increasingly hard problem since users and applications are avoiding detection using traffic obfuscation and encryption. The key question addressed here is: Is it possible to profile traffic at the backbone without relying on its packet and flow level information, which can be obfuscated? We propose a novel approach, called Profiling-By-Association (PBA), which uses only the IP-to-IP communication graph and information about some applications used by few IP-hosts (a.k.a. seeds). The key insight is that IP-hosts tend to communicate more frequently with hosts involved in the same application forming communities (or clusters). Profiling few members within a cluster can "give away" the whole community. Following our approach, we develop different algorithms to profile Internet traffic and evaluate them on real-traces from four large backbone networks. We show that PBA's accuracy is on average around 90% with knowledge of onl...

• Type: Journal
• Year: 2010
• Where: CONEXT
• Authors: Marios Iliofotou, Brian Gallagher, Tina Eliassi-Rad, Guowu Xie, Michalis Faloutsos
• Keywords: Application Forming Communities, Computer Networks, CONEXT 2010, Internet Backbone Traffic, Large Backbone Networks