Newly created nodes cannot be merged for acertain number of minutes, called the maturation period, to prevent transientbehavior from affecting tree structure. Through these two operators, ADHIC generates a decision tree thatspecifies the contents of clusters. The path from the root of the tree to aleaf or other internal cluster specifies the boolean equation of (p,n)-gramswhich determine if a packet belongs to that cluster. Consider, for example, the tree in Figure 1. The root node hasa (p,n)-gram of (1, 0x0393) and its child(p,n)-grams (9 0x70ad) and (0, 0x0100). All the offsetspoint to locations within the MAC addresses of the Ethernet frame.The offsets 0 and 1 segregate portions of the destination MAC addressand 9 distinguishes between source MAC addresses. The left edgesignifies that the packet has matched the (p,n)-gramin the parent node. The right edge is followed for packets that donot contain that (p,n)-gram. Please note the labelingof the nodes and the pie charts is not a part of the ADHIC algorithm;it is a visualization produced by NetADHICT and is explained in the"NetADHICT" section.Figure 1: An ADHIC cluster decision tree after 3 node splits.The labelling of the internal nodes and the pie charts of the terminal nodesare explained in the "NetADHICT" section. The decision trees produced by the ADHIC algorithm have a number ofstrengths as representations of network structure. They are simple instructure and semantics, facilitating user understanding and analysis. Treescan be frozen, or subtrees removed from the learning algorithm, allowing usersto directly modify the tree. Subtrees can be incrementally modified andaugmented by users in a straightforward way. Additional information andstatistics may be easily added to decision trees. Finally, the ADHICrepresentation also easily lends itself to implementations like the decisiontree packet classification algorithms often used as alternatives to TCAM [23]. NetADHICT NetADHICT's user interface is an interactive AJAX-based web page (Figure2). The primary element of this interface is the tree view, which allows thenetwork administrator to quickly see how traffic is being distributed betweenclusters and what traffic each cluster represents. The tree view can updateitself with newly available data as it becomes available, allowing networkadministrators to watch changes in the traffic's structure as they occur.Figure 2: NetADHICT's primary tree view, showing traffic over afour hour period. Traffic is shown in the tree view for a selected time period, as shown inFigure 3. The time period is normally selected relative to the present time;it can be set to always show the latest data available or just data that wasavailable in the past. Alternatively, a time period can be specified directlyfor any time at which there is traffic data available.Figure 3: Selecting a time range for which NetADHICT willdisplay a tree and traffic statistics. In the tree view, internal nodes represent a (p,n)- gram operation whichis displayed within each node, such as (6, 0x0001). By tracing a node'sancestors up the tree, you can see which (p,n)-grams are or are not presentin the node's traffic. Terminal clusters show traffic volumes for the selected time period, aswell as much more information through their size and coloring. The size ofeach terminal cluster represents the volume of traffic relative