title: Estimation and application of social network behaviour from network traffic
Creators: name: Albdair, Mostfa Mohsin
Publisher: name: University of Southern Queensland
Year: 2018
Subjects: subject: 080503 Networking and Communications

description: Because traffic is predominantly formed by communication between users or between users and servers which communicate with users, network traffic inherently exhibits social networking behaviour. In this thesis the extent of interaction between entities - as identified by their IP addresses - is extracted from massive anonymized Internet trace datasets obtained from the Center for Applied Internet Data Analysis (CAIDA) and analysed in a multiplicity of ways. A key discovery is that the Pareto principle applies to all the key features which have been identified: sources of traffic, destinations of traffic, traffic flows themselves, and also to the abstract sources, destinations, and flows which are identified by spectral analysis of traffic matrices. Chapter 2 reviews the literature on traffic analysis emphasising social network behaviour, and also the literature on methods for managing Quality of Service in the Internet. In Chapter 3, we infer the behaviour of social networks from O-D pair traffic by using two groups of analysis methods. The first group of methods is based on frequency analysis. The frequency analysis of origin, destination and O-D Pair statistics are found to exhibit heavy tailed behaviour. The second method is a slightly different characterization of social behaviour. In Chapter 4, traffic matrices are first decomposed into mean and variation about the mean. The mean traffic matrix is then analysed by singular value decomposition. The variation about the mean is analysed separately in two different ways. First, assuming that traffic associated with one O-D pair is uncorrelated with traffic of any other O-D pair, the variation is analysed by singular value decomposition. Secondly, dispensing with the O-D-traffic independence assumption, the covariance matrix of O-D traffic is analysed by singular value decomposition. It is discovered that in all three cases, the Pareto principal, that a small proportion of eigenvalues explains a high proportion of the matrices, is found to be true. The significance of the covariance eigenflows was tested by simulating a network with independently distributed O-D traffics of on-off type, with Pareto distributed on and off periods. The simulation confirmed the significance of the covariance eigenflows. A new software system comprising more than 7,000 lines of C++ code for analysis of very large pcap trace files, called Antraff, has been developed to carry out all the analysis procedures in Chapters 3 and 4. In Chapter 5, the understanding of the social-network behaviour exhibited by traffic is applied to design traffic control procedures which have highly significant advantages for maintaining QoS in the Internet. An architecture for protecting QoS is introduced, based on the understanding of social behaviour exhibited by traffic. Whereas DiffServ enables different treatment to be given to different traffic types, in this architecture, known as DefServ, different treatment is given on the basis of the traffic situation.