Exploiting dynamicity in graph-based traffic analysis

摘要: Network traffic can be represented by a Traffic Dispersion Graph (TDG) that contains an edge between two nodes send particular type of (e.g., DNS) to one another. TDGs have recently been proposed as alternative way interpret and visualize network traffic. Previous studies focused on static properties using graph snapshots in isolation. In this work, we represent with series related instances change over time. This representation facilitates the analysis dynamic nature traffic, providing additional descriptive power. For example, DNS P2P appear similar when compared isolation, but time differs significantly. To quantify changes time, introduce novel metrics capture both structure average degree) participants (i.e., IP addresses) TDG. We apply our new methodologies improve graph-based classification detect profile legacy applications e-mail).