Network Traffic Analysis Using Principal Component Graphs
Harsha Sai Thota, V. Vijaya Saradhi, Venkatesh Tamarapalli · 2013
Graph-based techniques for monitoring network trac and trac classication have gained widespread attention due to their power of visualization and ability to detect anomalous behavior. In this work, we construct generic trac activity graphs (TAGs) to represent packet-level traces and propose a method based on principal component analysis (PCA) of TAGs for trac classication. The technique proposed in this work overcomes the issues with TAG construction related to ambiguity in edge denition, interval of trace collected for graph construction, and the time and location of trace collection. We construct a set of TAGs corresponding to traces from dierent time intervals and locations, and analyze the collection of TAGs by using PCA on the set of TAGs to identify the applications associated with trac ows. Results on trac classication show that the accuracy is very high and the technique is portable across dierent traces and therefore is useful to develop better graph-based trac analysis tools.