IM session identification by outlier detection in cross-correlation functions

摘要: The identification of encrypted Instant Messaging (IM) channels between users is made difficult by the presence variable and high levels uncorrelated background traffic. In this paper, we propose a novel Cross-correlation Outlier Detector (CCOD) to identify communicating end-users in large group users. Our technique uses traffic flow traces individual IM service provider's data center. We evaluate CCOD on set Yahoo! with an average SNR −6.11dB (data includes ground truth). Results show that our provides 88% true positives (TP) rate, 3% false (FP) rate 96% ROC area. Performance previous correlation-based schemes same was limited 63% TP 4% FP 85%