Abstract:The continuous growth of Internet and its applications caused more difficulties for analyzing Internet communications which are becoming more and more complex, this has caused new challenges for monitoring and managing the huge and vast network traffic. It is not efficient to monitor and analyze individual IP addresses, so it is more useful to monitor groups of IP addresses that have similar behavior, which represents a certain application activity. Nowadays, such a grouping is either based on network prefixes that does not meet the requirement mentioned above as difference of traffic behavior of individual IP address not being considered, or clustering IP hosts based on their traffic patterns, which requires information about TCP/UDP port numbers (which are occasionally obfuscated) or packet payloads (which are sometimes encrypted or unavailable from aggregated flow records). This paper proposes a new methodology of clustering IP addresses within a managed network domain such as campus network or ISP clients with similar social relationship based on inter-IP connectivity structure. The key idea of this methodology is to split the entire IP address space into Internal (inside the managed domain) and External (outside) ones. The clustering strategy is to group inside IP addresses that communicate with common outside IP addresses, the similarity measure of two inside IP addresses is the unique number of the common outside IP addresses. We propose a novel approach with an approximation algorithm to discover communities on a large scale in the managed domain based on the bipartite networks and one mode projection and the basis of graph partitioning of the similarity graph. Bipartite networks were built using NetFlow datasets collected from a boundary router in an actual environment, and then a one-mode projection has been applied to build a social relationship similarity graph of the inside IP addresses. We propose a community detection algorithm to extract communities. Experimental results demonstrate that our approach can discover communities from real large scale managed domain networks with a high quality. We experimentally validate our approach in terms of IP networking by applying deep flow inspection (DFI) and deep packet inspection (DPI) on related traffic to prove that hosts with the same cluster tend to have some dominant network behavior. We demonstrated the practical benefits of exploring social behavior similarity of IP hosts in understanding application usage, users' behavior, detecting malicious users, and users of prohibited applications.

Mining and Visualizing Clusters in Densely Connected P2P Networks

Modeling and Analysis of Resource'S Load-Scale in P2p Network

Using Visualization to Improve Clustering Analysis on Heterogeneous Information Network.

Internet Traffic Analysis in a Large University Town: A Graphical and Clustering Approach.

Network Statistical Analysis in Peer-to-peer Application

Popularity Based Network Statistical Analysis in Peer-to-peer Application

Re-exploring the Potential of Using Tree Structure in P2P Live Streaming Networks

Identifying Traffic Clusters in Urban Networks Based on Graph Theory Using License Plate Recognition Data

Social Relationship Discovery of IP Addresses in the Managed IP Networks by Observing Traffic at Network Boundary

Multi-dimensional Data Density Estimation in P2P Networks

Cufti: Methods for Core Users Finding and Traffic Identification in P2p Systems

Node Clustering in the P2P Environment

Queries mining for efficient routing in P2P communities

An Unstructured P2p Network Model For Efficient Resource Discovery

Flourishing in the internet: The huge success of live peer-to-peer media streaming

Real-Time P2P Traffic Identification

Power-Laws Model of Large-Scale Peer-to-Peer Networks Based on Broadcast Routing Mechanism

Towards a Better Understanding of Locality-Awareness in Peer-to-Peer Systems

An Efficient Architecture for Information Retrieval in P2P Context Using Hypergraph

A Peer-To-Peer Traffic Identification Method Using Machine Learning

Deploying P2P Networks for Large-Scale Live Video-Streaming Service [Peer-to-peer Multimedia Streaming].