Sciweavers

Share
ICC
2008
IEEE

Discovering Packet Structure through Lightweight Hierarchical Clustering

8 years 8 months ago
Discovering Packet Structure through Lightweight Hierarchical Clustering
— The complexity of current Internet applications makes the understanding of network traffic a challenging task. By providing larger-scale aggregates for analysis, unsupervised clustering approaches can greatly aid in the identification of new applications, attacks, and other changes in network usage patterns. In this paper we introduce ADHIC, a new algorithm that clusters similar network traffic together without prior knowledge of protocol structures. Packet similarity is determined through comparisons of substrings within packets at distinguishing offsets. ADHIC is notable in that 1) it produces a hierarchical decomposition of network traffic in the form of a cluster-identifying decision tree, 2) it needs only a small fraction of packets (about 3% in our traces) to generate the tree, and 3) it clusters packets at wire speeds. We find that ADHIC appropriately segregates well-known protocols, clusters together traffic of the same protocol running on multiple ports, and segregat...
Abdulrahman Hijazi, Hajime Inoue, Ashraf Matrawy,
Added 30 May 2010
Updated 30 May 2010
Type Conference
Year 2008
Where ICC
Authors Abdulrahman Hijazi, Hajime Inoue, Ashraf Matrawy, Paul C. van Oorschot, Anil Somayaji
Comments (0)
books