An exploration of user recognition on domestic networks using NetFlow records

Abstract

In this paper, we describe HomeNetViewer, a system for collecting, visualising and annotating domestic network NetFlow records from a domestic network gateway. HomeNetViewer is designed to collect ground truth data which, enables the linking of users to low level network traffic. We present our first annotated dataset from a real household in the UK and the results of our preliminary work to build a user identification system. Our initial classifier achieves a true-positive rate of 64% with false-positive rate of 28% when compared to the ground truth annotations. This work attempts to address the lack of transparency and accountability within the domestic network infrastructure by identifying the user behind the device.