## 3 Application Community
### Application Community Detection Method
#### 3.2.2 Node Clustering Based on Traffic Behavior  
In most cases, the result of node partitioning obtained in Section 3.2.1 can identify an application community in the network. However, there may be malicious entities sending malicious messages, such as distributed denial-of-service (DDos) attacks, worms, and Trojans, based on the inherent communication relationship. Therefore, in this paper we further differentiate the communication traffic flow according to the statistical characteristics of the transmission data before obtaining the final community identification result. The members of a community obtained through the above two step have a very high similarity in both communication relationship and communication mode. After the division process in Section 3.1, entities with close communication relationships are divided into the same partition. In most cases, a pair of IPs will only communicate with one type of service in a short period of time. Therefore, traffic flows between entities in the same partition can be aggregated according to IP pairs to extract data transmission behavior characteristics. There are two advantages to doing this:  
1. Increasing the number of sample scan avoid the influence of outlier traffic flows on the results of community partitioning, which can reflect the data transmission behavior between a pair of IPs in more detail. 2. After clustering, the number of instances used for clustering is greatly reduced, reducing the time for clustering calculations. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & 1P1\textgreater{}1 & 1P1\textgreater{}1 & 1P1\textgreater{}1 & **Total Number of Nodes** \\ \hline Server nodes & 5006 & 318 & 5324 \\ \hline Client nodes & 2122 & 154,789 & 156,911 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: \(|P|\) and \(|Q|\) values for different types of nodes. The clustering features selected in this paper are identified by the five-tuple (<source IP, source port, destination IP, destination port, proto>), and the statistical information of each traffic flow is recorded, such as the number of packets and the number of bytes in each direction. During the clustering process, all traffic flows between each pair of IPs are combined and a feature vector is extracted to describe the data transmission behavior between the pair of IPs. Each vector includes these several elements:  
1. Number of nonrepeating ports used by the source IP. 2. Number of nonrepeating ports used by the destination IP. 3. Average value of the protocol number. 4. Minimum number of up flow packets. 5. Median number of up flow packets. 6. Maximum number of up flow packets. 7. Minimum number of down flow packets. 8. Median number of down flow packets. 9. Maximum number of down flow packets. 10. Minimum average packet length for up flow. 11. Average median packet length for up flow. 12. Maximum of average up flow packet length. 13. Minimum of average down flow packet length. 14. Median of average down flow packet length. 15. Maximum of average down flow packet length. Features 1 and 2 reflect the usage of a pair of communication IP ports. Feature 3 is used to reflect the usage of a pair of communication IP transmission layer protocols. In this paper, we only study traffic flows with protocol numbers 6 (TCP) and 17 (UDP). Features 4-9 reflect the distribution of the number of IP transmission packets, while Features 10-15 reflect the distribution of the length of a pair of IP transmission packets. By extracting the above features, the data transmission behavior between pairs of nodes with in a partition can be quantitatively described. In order to unify the weights of each dimension, we normalize the actual (IP pair) feature values in the same partition before clustering. In this paper, we use maximum and minimum scaling to scale the feature to [0, 1].