As the Internet continues to grow in size and complexity, the challenge of effectively provisioning, managing and securing it has become inextricably linked to a deep understanding of Internet traffic. While there exists an extensive body of prior work on traffic characterization of Internet traffic, there has been very little attempt to build general models or profiles in terms of behaviors, i.e., communication patterns of end-hosts and services. This project is devoted to developing a general behavior-oriented methodology for modeling and profiling Internet traffic based on their communication patterns, underlying structures, temporal properties and other related features. The project consists of four major components which build upon each other to explore, analyze and profile traffic behaviors using different combinations of features and techniques.
Broader Impact: The ultimate goal of the project is to i) at a theoretical level, help establish a new behavior-based theoretical framework for modeling and studying the Internet traffic so as to gain a deep understanding of what constitutes ``normal'' or ``anomalous'' traffic in a network; and ii) at a practical level, help develop effective techniques and tools for improved network problem identification, security monitoring, attack detection and attribution. The research of this project is to be incorporated into classroom teaching, undergraduate directed research and senior projects as well as in an NSF funded summer school under the SFS program for teacher education in information assurance.
