Sciweavers

INFOCOM
2011
IEEE

Network-aware behavior clustering of Internet end hosts

13 years 2 months ago
Network-aware behavior clustering of Internet end hosts
Abstract—This paper explores the behavior similarity of Internet end hosts in the same network prefixes. We use bipartite graphs to model network traffic, and then construct one-mode projection graphs for capturing social-behavior similarity of end hosts. By applying a simple and efficient spectral clustering algorithm, we perform network-aware clustering of end hosts in the same prefixes into different behavior clusters. Based on information-theoretical measures, we find that the clusters exhibit distinct traffic characteristics which provides improved interpretations of the separated traffic compared with the aggregated traffic of the prefixes. Finally, we demonstrate the applications of exploring behavior similarity in profiling network behaviors and detecting anomalous behaviors through synthetic traffic that combines Internet backbone traffic and packet traces from real scenarios of worm propagations and denial of service attacks.
Kuai Xu, Feng Wang 0002, Lin Gu
Added 21 Aug 2011
Updated 21 Aug 2011
Type Journal
Year 2011
Where INFOCOM
Authors Kuai Xu, Feng Wang 0002, Lin Gu
Comments (0)