Discovering Packet Structure through Lightweight Hierarchical Clustering

— The complexity of current Internet applications makes the understanding of network traffic a challenging task. By providing larger-scale aggregates for analysis, unsupervised clustering approaches can greatly aid in the identification of new applications, attacks, and other changes in network usage patterns. In this paper we introduce ADHIC, a new algorithm that clusters similar network traffic together without prior knowledge of protocol structures. Packet similarity is determined through comparisons of substrings within packets at distinguishing offsets. ADHIC is notable in that 1) it produces a hierarchical decomposition of network traffic in the form of a cluster-identifying decision tree, 2) it needs only a small fraction of packets (about 3% in our traces) to generate the tree, and 3) it clusters packets at wire speeds. We find that ADHIC appropriately segregates well-known protocols, clusters together traffic of the same protocol running on multiple ports, and segregat...

• Type: Conference
• Year: 2008
• Where: ICC
• Authors: Abdulrahman Hijazi, Hajime Inoue, Ashraf Matrawy, Paul C. van Oorschot, Anil Somayaji
• Keywords: Communications, ICC 2008, Network Traffic, Network Usage Patterns, Unsupervised Clustering Approaches