TY - GEN
T1 - Unveiling core network-wide communication patterns through application traffic activity graph decomposition
AU - Jin, Yu
AU - Sharafuddin, Esam
AU - Zhang, Zhi-Li
PY - 2009
Y1 - 2009
N2 - As Internet communications and applications become more complex, operating, managing and securing networks have become increasingly challenging tasks. There are urgent demands for more sophisticated techniques for understanding and analyzing the behavioral characteristics of network traffic. In this paper, we study the network traffic behaviors using traffic activity graphs (TAGs), which capture the interactions among hosts engaging in certain types of communications and their collective behavior. TAGs derived from real network traffic are large, sparse, yet seemingly complex and richly connected, therefore difficult to visualize and comprehend. In order to analyze and characterize these TAGs, we propose a novel statistical traffic graph decomposition technique based on orthogonal nonnegative matrix tri-factorization (tNMF) to decompose and extract the core host interaction patterns and other structural properties. Using the real network traffic traces, we demonstrate that our tNMF-based graph decomposition technique produces meaningful and interpretable results. It enables us to characterize and quantify the key structural properties of large and sparse TAGs associated with various applications, and study their formation and evolution.
AB - As Internet communications and applications become more complex, operating, managing and securing networks have become increasingly challenging tasks. There are urgent demands for more sophisticated techniques for understanding and analyzing the behavioral characteristics of network traffic. In this paper, we study the network traffic behaviors using traffic activity graphs (TAGs), which capture the interactions among hosts engaging in certain types of communications and their collective behavior. TAGs derived from real network traffic are large, sparse, yet seemingly complex and richly connected, therefore difficult to visualize and comprehend. In order to analyze and characterize these TAGs, we propose a novel statistical traffic graph decomposition technique based on orthogonal nonnegative matrix tri-factorization (tNMF) to decompose and extract the core host interaction patterns and other structural properties. Using the real network traffic traces, we demonstrate that our tNMF-based graph decomposition technique produces meaningful and interpretable results. It enables us to characterize and quantify the key structural properties of large and sparse TAGs associated with various applications, and study their formation and evolution.
KW - C.2.3 [computer-communication networks]: Network operations
KW - Measurement
KW - Security
UR - http://www.scopus.com/inward/record.url?scp=70449686700&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=70449686700&partnerID=8YFLogxK
U2 - 10.1145/1555349.1555356
DO - 10.1145/1555349.1555356
M3 - Conference contribution
AN - SCOPUS:70449686700
SN - 9781605585116
T3 - SIGMETRICS/Performance'09 - Proceedings of the 11th International Joint Conference on Measurement and Modeling of Computer Systems
SP - 49
EP - 60
BT - SIGMETRICS/Performance'09 - Proceedings of the 11th International Joint Conference on Measurement and Modeling of Computer Systems
T2 - 11th International Joint Conference on Measurement and Modeling of Computer Systems, SIGMETRICS/Performance'09
Y2 - 15 June 2009 through 19 June 2009
ER -