Proling-by-Association: A Resilient Trafc Proling Solution for the Internet Backbone

Proling Internet backbone trafc is becoming an increasingly hard problem since users and applications are avoiding detection using trafc obfuscation and encryption. The key question addressed here is: Is it possible to profile traffic at the backbone without relying on its packet and flow level information, which can be obfuscated? We propose a novel approach, called Proling-By-Association (PBA), that uses only the IP-to-IP communication graph and information about some applications used by few IP-hosts (a.k.a. seeds). The key insight is that IP-hosts tend to communicate more frequently with hosts involved in the same application forming communities (or clusters). Proling few members within a cluster can “give away” the whole community. Following our approach, we develop different algorithms to prole Internet trafc and evaluate them on real-traces from four large backbone networks. We show that PBA’s accuracy is on average around 90% with knowledge of only 1% of all the hosts in a given data set and its runtime is on the order of minutes (≈ 5).