Recent spates of cyber-attacks and frequent emergence of applications affecting Internet traffic dynamics have made it imperative to develop effective techniques that can extract, and make sense of, significant communication patterns from Internet traffic data for use in network operations and security management. In this paper, we present a general methodology for building comprehensive behavior profiles of Internet backbone traffic in terms of communication patterns of end-hosts and services. Relying on data mining and entropy-based techniques, the methodology consists of significant cluster extraction, automatic behavior classification and structural modeling for in-depth interpretive analyses. We validate the methodology using data sets from the core of the Internet.
Bibliographical noteFunding Information:
Manuscript received March 25, 2006; revised March 31, 2007 and July 29, 2007. First published February 22, 2008; current version published December 17, 2008. Approved by IEEE/ACM TRANSACTIONS ON NETWORKING Editor D. Veitch. This work was supported in part by the National Science Foundation (NSF) under Grants CNS-0435444 and CNS-0626812, in part by a University of Minnesota Digital Technology Center DTI grant, and in part by a Sprint ATL gift grant.
- Anomaly behavior
- traffic profiling