Can’t See Forest through the Trees? Understanding Mixed Network Traffic Graphs from Application Class Distribution

In this paper we study the interaction patterns among traffic from different application classes, namely, how they collaboratively form a mixed traffic activity graph (mixed TAG). Utilizing real traffic traces from a major ISP and a large university network, we show that densely connected subgraphs or clusters are the building blocks for a mixed TAG. These subgraphs can be either dependent or independent for different application classes. In addition, clusters from different application classes exhibit repulsive/attractive relationships while they interconnect to form a mixed TAG. We then propose a variant of the Markov clustering algorithm to extract these clusters. Analysis of the clusters show that though mixed TAGs display similar structures, many core components are time/location specific. The clustering results also motivate us to develop an accurate, semi-supervised learning based traffic classification algorithm.