Auto-identification of background traffic based on autonomous periodic interaction
Chang Liu, Lingwu Zeng, Junzheng Shi, Fei Xu, Gang Xiong, Siu‐Ming Yiu · 2017
Background traffic of web applications refers to the traffic not generated directly due to user activities (e.g. user behavior profiling) that is usually useful to the application providers, but not the users. A recent study indicated that background traffic, contributing 51.8% bandwidth, has exceeded user-generated traffic. Accurate identification of background traffic can help network managers to optimize network resource allocation and avoid network congestion. However, identification of background traffic is not easy and the solution must be robust enough for all applications. In this paper, we propose the first method that can self-learn background traffic rules from unlabeled data and automatically identify online background traffic. The accuracy of the extracted rules is 90.51%. When applying our method in a real enterprise network, the false positive rate (FPR) is only 3% showing that our method is accurate and effective. Our method is derived from a critical observation that the background traffic exhibits a periodic behavior (referred as autonomous periodic interaction (AuPI)). Technically, we propose two indexes, Time Regularity Factor (TRF) and Time Interval Factor (TIF), to capture this AuPI pattern from unlabeled communication traffic. As a side contribution, we created a public benchmark dataset of 45 hot applications with 97,000+ background traffic flows that can be used by researchers to further investigate background traffic.