## 3 Application Community
### Application Community Detection Method
#### 3.2.1 Network Topological Partitioning Based on Communication Relationship  
A network application community is usually composed of a service node and multiple client nodes. If you can find the server in the network first, then the server and its neighboring hosts will naturally form a partition, which is helpful for identifying the community. Diagrams are used here to represent network communication relationships overtime. A large number of previous studies [8; 9; 11; 18; 19; 20; 21] use IP as a node in the communication. If data are transmitted between two IPs, the nodes represented by the two IPs are connected by one side. There are two limitations to this representation. First, it is impossible to determine from the topology whether an IP is a server or a client. For example, in Figure 2, node 1 may indicate that (1) one server receives many client visits or that (2) one client uses multiple applications to communicate with multiple servers at the same time. Second, it is impossible to identify the situation (through topology) when a service node provides multiple services. Since there is the possibility that an IP provides multiple services, even if node 1 in Figure 2 is known as a server node, it is not known exactly which services are provided and which clients correspond to each service. For most network application services, they open a fixed port to respond to requests from the client. The use of the port is very helpful for accurately determining the type and quantity of services provided by a server. Therefore, in this paper, the <IP, Port> two-tuple is used as a node in the network  
Figure 1: Diagram of application community. Figure 2: Communication relationships. topology diagram. The communication relationship between the nodes is represented by a connection. There are two advantages of doing this:  
1. The server node and client node can be accurately distinguished. When a client communicates with a server, it usually uses multiple ports and the server usually only uses a fixed port. This difference in ports allows the server nodes to have a large degree of power, so that the identity of a node can be clearly identified. Even if an IP accesses multiple servers at the same time, the phenomenon that the server nodes have a large degree of power will not change. 2. It can be identified that the same IP bears multiple services. The same IP will open different ports for different services, so the <IP, Port> two-tuple as a node can split a server IP into multiple topology nodes according to different ports. Each node corresponds to a service provided by the server IP. A client node's access to various services can also be easily identified. Server nodes and client nodes are form a common structure--the C/S structure. There is usually one service node and multiple client nodes. In this structure client node only communicates with the service node and does not communicate directly with other client nodes. Therefore, there is a significant difference between the server node and client node in the number of adjacent nodes. Which means, for a certain network service or application, a server node has many adjacent nodes and a client node has few adjacent nodes. We define the adjacency matrix \(A\) as follows. \[A_{ij}=\left\{ \begin{array}{ll}1&\text{$i$ and $j$ has a connection},\ i\
eq j\\ 0&\text{Other}\end{array} \right. \tag{1}\]  
For node \(i\), the definition of a set is  
\[P_{i}=\left\{p\big{|}A_{ip}=1\right\} \tag{2}\]  
\[Q_{i}=\left\{q\big{|}A_{pq}=1,p\in P_{i},q\
otin P_{i},q\
eq i\right\} \tag{3}\]  
where \(|P_{i}|\) and \(|Q_{i}|\) represent the number of elements in sets \(P_{i}\) and \(Q_{i}\), respectively. In Figure 1, for all nodes \(i=1,2,3,4,5,6,7,8\), their \(P_{i}\) and \(Q_{i}\) values are shown in Table 1.  
It can be seen from Table 1 that the core node in the C/S structure, \(|P_{i}|>|Q_{i}|\), and the edge nodes, \(|P_{i}|<|Q_{i}|\). Therefore, for any node, its \(|P_{i}|\) and \(|Q_{i}|\) values can reflect its type or identity in the network.