URL: http://www.pamconf.org/2005/PDF/34310042.pdf Entry Date: 2009-02-06 Abstract: Packet header traces are widely used in network analysis. Header traces are the aggregate of traffic from many concurrent applications. We present a methodology, based on machine learning, that can break the trace down into clusters of traffic where each cluster has different traffic characteristics. Typical clusters include bulk transfer, single and multiple transactions and interactive traffic, amongst others. The paper includes a description of the methodology, a visualisation of the attribute statistics that aids in recognising cluster types and a discussion of the stability and effiectiveness of the methodology. Results:

• datasets: auckland-vi
• EM clustering algorithm
• classify traffic into similar application types(single transaction, bulk transfer etc);
• based on flows, a range of attributes are extracted from each flow(packet sze statistics, interarrival statistics, byte counts, connection duration, the number of transitions between transaction mode and bulk transfer mode, the time spent)