Semi-automated discovery of application session structure

摘要: While the problem of analyzing network traffic at granularity individual connections has seen considerable previous work and tool development, understanding a higher level - structure user-initiated sessions comprised groups related remains much less explored. Some types session structure, such as coupling between an FTP control connection data it spawns, have prespecified forms, though specifications do not guarantee how forms appear in practice. Other sessions, user reading email with browser, only manifest empirically. Still other might exist without us even knowing their presence, botnet zombie receiving instructions from its master proceeding turn to carry them out. We present algorithms rooted statistics Poisson processes that can mine large corpus logs extract apparent application embedded connections. Our methods are semi-automated we aim analyst high-quality information (expressed regular expressions) reflecting different possible abstractions application's structure. develop test our using traces Internet site, finding diversity number applications manifest, structures, presence abnormal behavior. characterization monitoring, source models for synthesizing traffic, anomaly detection.