Connection Pattern Based Android Network Traffic Clustering

摘要: Network traffic clustering plays a fundamental role in network flow analysis. Existing Android methods have three shortages. First, these always focus on partial features, such as port numbers, with the absence of holistic features. Second, existing sometimes fail to work if payload one package is encrypted. Third, some are valid only for several specific application-layer protocols. To handle inefficiencies, we adopted network-connection-pattern based features facilitate clustering. record platform was constructed. This executed 575 applications and recorded traffic. obtained input datasets through extracted connection pattern. Then, clustered datasets. Finally, employed Information Gain algorithm Fast Correlation-Based Filter separately rank contributions according results. Experiments show that network-connection-pattern-based lead more efficient result than port-number-based