Using Network Motifs to Identify Application Protocols

Abstract

Identifying application types in network traffic is a difficult problem for administrators who must secure and manage network resources, further complicated by the use of encrypted protocols and nonstandard port numbers. This paper takes a unique approach to this problem by modeling and analyzing application graphs, structures which describe the applicationlevel (e.g., HTTP, FTP) communications between hosts. These graphs are searched for motifs: recurring, significant patterns of interconnections that can be used to help determine the network application in use. Motif-based analysis has been applied predominantly to biological networks to hypothesize key functional regulatory units, but never to network traffic as it is here. For the proposed method, a description of each node is generated based on its participation in statistically significant motifs. These descriptions, or profiles, are data points in multidimensional space that are used as input to a k-nearest neighbor (k-NN) classifier to predict the application. This work also compares the performance of motif-based analysis to an alternative profile type based on "traditional" graph measures such as path lengths, clustering coefficients and centrality measures. The results show that motif profiles perform better than traditional profiles, and are able to correctly identify the actions of 85% of the hosts examined across seven protocols.

Classifying Wikipedia articles using network motif counts and ratios

“…This fundamental idea has been demonstrated in areas as diverse as spam filtering [5,4], telecommunications [3], bioinformatics [20] and social network analysis [13]. How best to represent the network around a node is still a significant research challenge.…”

“…How best to represent the network around a node is still a significant research challenge. Recently profiling using network motif counts has emerged as a promising solution for characterizing networks [20,25,3].…”

Ego-centric Graph Pattern Census

“…Motif discovery typically does not take node or edge attributes into account, but rather depends solely on the pattern structure. It is commonly performed on naturally occurring graphs like biological networks [28], or computational graphs such as software graphs [38] or computer network graphs [3]. In these works, motif profiles (i.e., counts of different motif structures in the graph) have proven to be a strong indicator of a network's function.…”

Integration of multiple network views in Wikipedia

“…This fundamental idea has been demonstrated not only in social network analysis [14,21] and in bioinformatics [23] but also in areas as diverse as spam filtering [6,5], telecommunications [3], fraud detection [24] and of course web search [16]. How best to represent the network around an object is still a significant research challenge.…”

“…How best to represent the network around an object is still a significant research challenge. Recently profiling using network motif counts has emerged as a promising solution for characterizing networks [23,26,27,3].…”