Unveiling core network-wide communication patterns through application traffic activity graph decomposition

Yu Jin, Esam Sharafuddin, Zhi-Li Zhang

Research output: Chapter in Book/Report/Conference proceedingConference contribution

70 Scopus citations

Abstract

As Internet communications and applications become more complex, operating, managing and securing networks have become increasingly challenging tasks. There are urgent demands for more sophisticated techniques for understanding and analyzing the behavioral characteristics of network traffic. In this paper, we study the network traffic behaviors using traffic activity graphs (TAGs), which capture the interactions among hosts engaging in certain types of communications and their collective behavior. TAGs derived from real network traffic are large, sparse, yet seemingly complex and richly connected, therefore difficult to visualize and comprehend. In order to analyze and characterize these TAGs, we propose a novel statistical traffic graph decomposition technique based on orthogonal nonnegative matrix tri-factorization (tNMF) to decompose and extract the core host interaction patterns and other structural properties. Using the real network traffic traces, we demonstrate that our tNMF-based graph decomposition technique produces meaningful and interpretable results. It enables us to characterize and quantify the key structural properties of large and sparse TAGs associated with various applications, and study their formation and evolution.

Original languageEnglish (US)
Title of host publicationSIGMETRICS/Performance'09 - Proceedings of the 11th International Joint Conference on Measurement and Modeling of Computer Systems
Pages49-60
Number of pages12
Edition1
DOIs
StatePublished - Nov 23 2009
Event11th International Joint Conference on Measurement and Modeling of Computer Systems, SIGMETRICS/Performance'09 - Seattle, WA, United States
Duration: Jun 15 2009Jun 19 2009

Publication series

NameSIGMETRICS/Performance'09 - Proceedings of the 11th International Joint Conference on Measurement and Modeling of Computer Systems
Number1
Volume37

Conference

Conference11th International Joint Conference on Measurement and Modeling of Computer Systems, SIGMETRICS/Performance'09
CountryUnited States
CitySeattle, WA
Period6/15/096/19/09

Keywords

  • C.2.3 [computer-communication networks]: Network operations
  • Measurement
  • Security

Fingerprint Dive into the research topics of 'Unveiling core network-wide communication patterns through application traffic activity graph decomposition'. Together they form a unique fingerprint.

Cite this