Advertisement

Discovering Patterns of Interest in IP Traffic Using Cliques in Bipartite Link Streams

  • Tiphaine Viard
  • Raphaël Fournier-S’niehotta
  • Clémence Magnien
  • Matthieu Latapy
Conference paper
Part of the Springer Proceedings in Complexity book series (SPCOM)

Abstract

Studying IP traffic is crucial for many applications. We focus here on the detection of (structurally and temporally) dense sequences of interactions that may indicate botnets or coordinated network scans. More precisely, we model a MAWI capture of IP traffic as a link streams, i.e., a sequence of interactions \((t_1,t_2,u,v)\) meaning that devices u and v exchanged packets from time \(t_1\) to time \(t_2\). This traffic is captured on a single router and so has a bipartite structure: Links occur only between nodes in two disjoint sets. We design a method for finding interesting bipartite cliques in such link streams, i.e., two sets of nodes and a time interval such that all nodes in the first set are linked to all nodes in the second set throughout the time interval. We then explore the bipartite cliques present in the considered trace. Comparison with the MAWILab classification of anomalous IP addresses shows that the found cliques succeed in detecting anomalous network activity.

Notes

Acknowledgements

This work is funded in part by the European Commission H2020 FETPROACT 2016-2017 program under grant 732942 (ODYCCEUS), by the ANR (French National Agency of Research) under grants ANR-15-CE38-0001 (AlgoDiv) and ANR-13-CORD-0017-01 (CODDDE), and by the Ile-de-France program FUI21 under grant 16010629 (iTRAC).

References

  1. 1.
    Latapy, M., Magnien, C., Vecchio, N.: Basic notions for the analysis of large two-mode networks. Soc. Netw. 30(1), 31–48 (2008)CrossRefGoogle Scholar
  2. 2.
    Latapy, M., Viard, T., Magnien, C.: Stream graphs and link streams for the modeling of interactions over time (2017). https://arxiv.org/abs/arXiv:1710.04073
  3. 3.
    Viard, T., Latapy, M., Magnien, C.: Computing maximal cliques in link streams. Theor. Comput. Sci. 609, 245–252 (2016)MathSciNetCrossRefMATHGoogle Scholar
  4. 4.
    Himmel, A., Molter, H., Niedermeier, R., Sorge, M.: Enumerating maximal cliques in tem- poral graphs. In: IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining. ASONAM (2016)Google Scholar
  5. 5.
    Fontugne, R., Borgnat, P., Abry, P., Fukuda, K.: Mawilab: Combining diverse anomaly de- tectors for automated anomaly labeling and performance benchmarking. In: ACM CoNext ’10. (2010)Google Scholar
  6. 6.
    Himura, Y., Fukuda, K., Cho, K., Borgnat, P., Abry, P., Esaki, H.: Synoptic graphlet: bridg- ing the gap between supervised and unsupervised profiling of host-level network traffic. IEEE/ACM Trans. Netw. 21(4), 1284–1297 (2013)CrossRefGoogle Scholar
  7. 7.
    Asai, H., Fukuda, K., Abry, P., Borgnat, P., Esaki, H.: Network application profiling with traffic causality graphs. Int. J. Netw. Manag. 24(4), 289–303 (2014)CrossRefGoogle Scholar
  8. 8.
    Xu, K., Wang, F., Gu, L.: Behavior analysis of internet traffic via bipartite graphs and one- mode projections. IEEE/ACM Trans. Netw. 22(3), 931–942 (2014)CrossRefGoogle Scholar
  9. 9.
    Jakalan, A., Jian, G., Zhang, W., Qi, S.: Clustering and profiling ip hosts based on traffic behavior. J. Netw. 10(2), 99–107 (2015)Google Scholar
  10. 10.
    Latapy, M., Hamzaoui, A., Magnien, C.: Detecting events in the dynamics of ego-centred measurements of the internet topology. J. Complex Netw. 2(1), 38–59 (2014)CrossRefGoogle Scholar
  11. 11.
    Leo, Y., Crespelle, C., Fleury, E.: Non-altering time scales for aggregation of dynamic net- works into series of graphs. In: Proceedings of the ACM Conference on Emerging Networking Experiments and Technologies CoNEXT. (2015)Google Scholar
  12. 12.
    Wehmuth, K., Ziviani, A., Fleury, E.: A unifying model for representing time-varying graphs. In: 2015 IEEE International Conference on Data Science and Advanced Analytics, DSAA 2015, Campus des Cordeliers, pp. 1–10. Paris, France, 19–21 Oct 2015Google Scholar
  13. 13.
    Holme, P.: Modern temporal network theory: a colloquium. Eur. Phys. J. B 88(9), 1–30 (2015)CrossRefGoogle Scholar

Copyright information

© Springer International Publishing AG 2018

Authors and Affiliations

  • Tiphaine Viard
    • 1
  • Raphaël Fournier-S’niehotta
    • 1
  • Clémence Magnien
    • 2
  • Matthieu Latapy
    • 2
  1. 1.CEDRIC CNAMParisFrance
  2. 2.CNRS, UMR 7606, LIP6Sorbonne Universités, UPMC Univ Paris 06ParisFrance

Personalised recommendations