Internet Traffic Classification Based on Hosts Behavior Analysis

Two novel methods based on hosts behavior analysis are proposed for encrypted packet-based Internet traffic classification. Combined with traffic matrix and network structure entropy, some new exponents for in-degree and out-degree are introduced to illustrate the characterization of connection and message transmission among the network nodes. These exponents can be used to describe traffic feature in different periods and time scale. Visibility graph is also used to convert traffic sequence to network. And the features for network structure are utilized to analyze the host behavior in the traffic sequence. The experimental results demonstrate that the variable trend of entropy exponents and network structure for different traffic have great difference. And two proposed methods can achieve effective traffic classification.