Profiling-By-Association: a resilient traffic profiling solution for the internet backbone

摘要: Profiling Internet backbone traffic is becoming an increasingly hard problem since users and applications are avoiding detection using obfuscation encryption. The key question addressed here is: Is it possible to profile at the without relying on its packet flow level information, which can be obfuscated? We propose a novel approach, called Profiling-By-Association (PBA), that uses only IP-to-IP communication graph information about some used by few IP-hosts (a.k.a. seeds). insight tend communicate more frequently with hosts involved in same application forming communities (or clusters). members within cluster "give away" whole community. Following our we develop different algorithms evaluate them real-traces from four large networks. show PBA's accuracy average around 90% knowledge of 1% all given data set runtime order minutes (a 5).