Behavioral Clustering of Non-Stationary IP Flow Record Data

Conference paper (2016)

Authors

C.A. Hammerschmidt University of Luxembourg

Samuel Marchal Aalto University

Radu State University of Luxembourg

S.E. Verwer Cyber Security -

Research Group

Cyber Security () (TU Delft)

Feature extraction Merging Automata Data models Learning automata IP networks Malware

More Info

expand_more

To reference this document use:

http://resolver.tudelft.nl/uuid:17e50be2-3a89-4165-ac17-dd9485ad6e37

Published Date

2016-11

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Electrical Engineering, Mathematics and Computer Science

Department

Intelligent Systems

Research Group

Cyber Security

Abstract

Automated network traffic analysis using machine learning techniques plays an important role in managing networks and IT infrastructure. A key challenge to the correct and effective application of machine learning is dealing with non-stationary learning data sources and concept drift. Traffic evolves overtime due to new technology, software, services being used, changes in user behavior but also due to changes in network graphs like dynamic IP address assignment. In this paper, we present an automatic online method to detect changepointsin network traffic based on IP flow record analysis. This technique is used to segment an observed behavior into smaller consecutive behaviors differing one from another. The segmented traffic is used to learn small communication profile characterizing accurately the activities present between two observed changepoints. We validate our method using synthetic data and outlinea real-world application to botnet hosts behavior modeling.