Inference of social network behavior from Internet traffic traces

Abstract

All network traffic is a byproduct of social networking. In this paper, Anonymized Internet (IP) Trace Datasets obtained from the Center for Applied Internet Data Analysis (CAIDA) has been used to identify and estimate characteristics of the underlying social network from the overall traffic. The analysis methods used here fall into two groups, the first being based on frequency analysis and second method being based on the use of traffic matrices, with the later analysis method being further sub-divided into groups based on the traffic mean, variance and covariance. The frequency analysis of origin (O), destination (D) and O-D Pair statistics exhibit heavy tailed behavior. Because the large number of IP addresses contained in the CAIDA Datasets, only the most predominate IP Addresses are used when estimating all three sub-divided groups of traffic matrices. Principal Component Analysis (PCA) and related methods are applied to identify key features of each type of traffic matrix. A new system called Antraff has been developed to carry out all the analysis procedures.