Discovering Patterns of Interest in IP Traffic Using Cliques in Bipartite Link Streams
Studying IP traffic is crucial for many applications. We focus here on the detection of (structurally and temporally) dense sequences of interactions that may indicate botnets or coordinated network scans. More precisely, we model a MAWI capture of IP traffic as a link streams, i.e., a sequence of interactions \((t_1,t_2,u,v)\) meaning that devices u and v exchanged packets from time \(t_1\) to time \(t_2\). This traffic is captured on a single router and so has a bipartite structure: Links occur only between nodes in two disjoint sets. We design a method for finding interesting bipartite cliques in such link streams, i.e., two sets of nodes and a time interval such that all nodes in the first set are linked to all nodes in the second set throughout the time interval. We then explore the bipartite cliques present in the considered trace. Comparison with the MAWILab classification of anomalous IP addresses shows that the found cliques succeed in detecting anomalous network activity.
This work is funded in part by the European Commission H2020 FETPROACT 2016-2017 program under grant 732942 (ODYCCEUS), by the ANR (French National Agency of Research) under grants ANR-15-CE38-0001 (AlgoDiv) and ANR-13-CORD-0017-01 (CODDDE), and by the Ile-de-France program FUI21 under grant 16010629 (iTRAC).
- 2.Latapy, M., Viard, T., Magnien, C.: Stream graphs and link streams for the modeling of interactions over time (2017). https://arxiv.org/abs/arXiv:1710.04073
- 4.Himmel, A., Molter, H., Niedermeier, R., Sorge, M.: Enumerating maximal cliques in tem- poral graphs. In: IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining. ASONAM (2016)Google Scholar
- 5.Fontugne, R., Borgnat, P., Abry, P., Fukuda, K.: Mawilab: Combining diverse anomaly de- tectors for automated anomaly labeling and performance benchmarking. In: ACM CoNext ’10. (2010)Google Scholar
- 9.Jakalan, A., Jian, G., Zhang, W., Qi, S.: Clustering and profiling ip hosts based on traffic behavior. J. Netw. 10(2), 99–107 (2015)Google Scholar
- 11.Leo, Y., Crespelle, C., Fleury, E.: Non-altering time scales for aggregation of dynamic net- works into series of graphs. In: Proceedings of the ACM Conference on Emerging Networking Experiments and Technologies CoNEXT. (2015)Google Scholar
- 12.Wehmuth, K., Ziviani, A., Fleury, E.: A unifying model for representing time-varying graphs. In: 2015 IEEE International Conference on Data Science and Advanced Analytics, DSAA 2015, Campus des Cordeliers, pp. 1–10. Paris, France, 19–21 Oct 2015Google Scholar