Network-aware behavior clustering of Internet end hosts

Research output: Chapter in Book/Report/Conference proceedingConference contribution

35 Citations (Scopus)

Abstract

This paper explores the behavior similarity of Internet end hosts in the same network prefixes. We use bipartite graphs to model network traffic, and then construct one-mode projection graphs for capturing social-behavior similarity of end hosts. By applying a simple and efficient spectral clustering algorithm, we perform network-aware clustering of end hosts in the same prefixes into different behavior clusters. Based on information-theoretical measures, we find that the clusters exhibit distinct traffic characteristics which provides improved interpretations of the separated traffic compared with the aggregated traffic of the prefixes. Finally, we demonstrate the applications of exploring behavior similarity in profiling network behaviors and detecting anomalous behaviors through synthetic traffic that combines Internet backbone traffic and packet traces from real scenarios of worm propagations and denial of service attacks.

Original languageEnglish (US)
Title of host publicationProceedings - IEEE INFOCOM
Pages2078-2086
Number of pages9
DOIs
StatePublished - 2011
EventIEEE INFOCOM 2011 - Shanghai, China
Duration: Apr 10 2011Apr 15 2011

Other

OtherIEEE INFOCOM 2011
CountryChina
CityShanghai
Period4/10/114/15/11

Fingerprint

Internet
Clustering algorithms
Denial-of-service attack

ASJC Scopus subject areas

  • Computer Science(all)
  • Electrical and Electronic Engineering

Cite this

Xu, K., Wang, F., & Gu, L. (2011). Network-aware behavior clustering of Internet end hosts. In Proceedings - IEEE INFOCOM (pp. 2078-2086). [5935017] https://doi.org/10.1109/INFCOM.2011.5935017

Network-aware behavior clustering of Internet end hosts. / Xu, Kuai; Wang, Feng; Gu, Lin.

Proceedings - IEEE INFOCOM. 2011. p. 2078-2086 5935017.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Xu, K, Wang, F & Gu, L 2011, Network-aware behavior clustering of Internet end hosts. in Proceedings - IEEE INFOCOM., 5935017, pp. 2078-2086, IEEE INFOCOM 2011, Shanghai, China, 4/10/11. https://doi.org/10.1109/INFCOM.2011.5935017
Xu, Kuai ; Wang, Feng ; Gu, Lin. / Network-aware behavior clustering of Internet end hosts. Proceedings - IEEE INFOCOM. 2011. pp. 2078-2086
@inproceedings{ed9dc152e2cb4663b04d186476dc2b29,
title = "Network-aware behavior clustering of Internet end hosts",
abstract = "This paper explores the behavior similarity of Internet end hosts in the same network prefixes. We use bipartite graphs to model network traffic, and then construct one-mode projection graphs for capturing social-behavior similarity of end hosts. By applying a simple and efficient spectral clustering algorithm, we perform network-aware clustering of end hosts in the same prefixes into different behavior clusters. Based on information-theoretical measures, we find that the clusters exhibit distinct traffic characteristics which provides improved interpretations of the separated traffic compared with the aggregated traffic of the prefixes. Finally, we demonstrate the applications of exploring behavior similarity in profiling network behaviors and detecting anomalous behaviors through synthetic traffic that combines Internet backbone traffic and packet traces from real scenarios of worm propagations and denial of service attacks.",
author = "Kuai Xu and Feng Wang and Lin Gu",
year = "2011",
doi = "10.1109/INFCOM.2011.5935017",
language = "English (US)",
isbn = "9781424499212",
pages = "2078--2086",
booktitle = "Proceedings - IEEE INFOCOM",

}

TY - GEN

T1 - Network-aware behavior clustering of Internet end hosts

AU - Xu, Kuai

AU - Wang, Feng

AU - Gu, Lin

PY - 2011

Y1 - 2011

N2 - This paper explores the behavior similarity of Internet end hosts in the same network prefixes. We use bipartite graphs to model network traffic, and then construct one-mode projection graphs for capturing social-behavior similarity of end hosts. By applying a simple and efficient spectral clustering algorithm, we perform network-aware clustering of end hosts in the same prefixes into different behavior clusters. Based on information-theoretical measures, we find that the clusters exhibit distinct traffic characteristics which provides improved interpretations of the separated traffic compared with the aggregated traffic of the prefixes. Finally, we demonstrate the applications of exploring behavior similarity in profiling network behaviors and detecting anomalous behaviors through synthetic traffic that combines Internet backbone traffic and packet traces from real scenarios of worm propagations and denial of service attacks.

AB - This paper explores the behavior similarity of Internet end hosts in the same network prefixes. We use bipartite graphs to model network traffic, and then construct one-mode projection graphs for capturing social-behavior similarity of end hosts. By applying a simple and efficient spectral clustering algorithm, we perform network-aware clustering of end hosts in the same prefixes into different behavior clusters. Based on information-theoretical measures, we find that the clusters exhibit distinct traffic characteristics which provides improved interpretations of the separated traffic compared with the aggregated traffic of the prefixes. Finally, we demonstrate the applications of exploring behavior similarity in profiling network behaviors and detecting anomalous behaviors through synthetic traffic that combines Internet backbone traffic and packet traces from real scenarios of worm propagations and denial of service attacks.

UR - http://www.scopus.com/inward/record.url?scp=79960853919&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=79960853919&partnerID=8YFLogxK

U2 - 10.1109/INFCOM.2011.5935017

DO - 10.1109/INFCOM.2011.5935017

M3 - Conference contribution

AN - SCOPUS:79960853919

SN - 9781424499212

SP - 2078

EP - 2086

BT - Proceedings - IEEE INFOCOM

ER -