Identifying IDC (Internet Data Center) IP addresses and analyzing the connection relationship of IDC could reflect the IDC network resource allocation and network layout which is helpful for IDC resource allocation optimization. Recent research mainly focuses on minimizing electricity consumption and optimizing network resource allocation based on IDC traffic behavior analysis. However, the lack of network-wide IP information from network operators has led to problems like management difficulties and unbalanced resource allocation of IDC, which are still unsolved today. In this paper, we propose a method for the IP identification and connection relationship analysis of IDC based on the flow connection behavior analysis. In our method, the frequent IP are extracted and aggregated in backbone communication network based on the traffic characteristics of IDC. After that, the connection graph of frequent IP (CGFIP) are built by analyzing the behavior of the users who visit the IDC servers, and IDC IP blocks are thus identified using CGFIP. Furthermore, the connection behavior characteristics of IDC are analyzed based on the connection graphs of IDC (CGIDC). Our findings show that the method can accurately identify the IDC IP addresses and is also capable of reflecting the relationships among IDCs effectively.

Network tomography is an appealing technology to infer link delay distributions since it only relies on end-to-end measurements. However, most approaches in network delay tomography are usually computationally intractable. In this letter, we propose a Fast link Delay distribution Inference algorithm (FDI). It estimates the node cumulative delay distributions by explicit computations based on a subtree-partitioning technique, and then derives the individual link delay distributions from the estimated cumulative delay distributions. Furthermore, a novel discrete delay model where each link has a different bin size is proposed to efficiently capture the essential characteristics of the link delay. Combining with the variable bin size model, FDI can identify the characteristics of the network-internal link delay quickly and accurately. Simulation results validate the effectiveness of our method.

Detecting distributed anomalies rapidly and accurately is critical for efficient backbone network management. In this letter, we propose a novel anomaly detection method that uses router connection relationships to detect distributed anomalies in the backbone Internet. The proposed method unveils the underlying relationships among abnormal traffic behavior through closed frequent graph mining, which makes the detection effective and scalable.

This letter proposes a novel method of large-scale IP traffic matrix (TM) estimation, called algebraic reconstruction technique inference (ARTI), which is based on the partial flow measurement and Fratar model. In contrast to previous methods, ARTI can accurately capture the spatio-temporal correlations of TM. Moreover, ARTI is computationally simple since it uses the algebraic reconstruction technique. We use the real data from the Abilene network to validate ARTI. Simulation results show that ARTI can accurately estimate large-scale IP TM and track its dynamics.

In this letter, we address the issue of estimating the temporal dependence characteristic of link loss by using network tomography. We use a k-th order Markov chain (k > 1) to model the packet loss process, and estimate the state transition probabilities of the link loss model using a constrained optimization-based method. Analytical and simulation results indicate that our method yields more accurate packet loss probability estimates than existing loss inference methods.

In this letter, a new definition of two-stage spatiotemporal approach, called ICA-WFS (Independent-Component-Analysis-Weighted-Frequent-Substructure) is proposed. To facilitate capturing abnormal behavior across multiple networks and dimensionality reduction at a single Point of Presence (PoP), ICA is applied. With application of WFS, an complete graph is examined, unusual substructures of which are reported. Experiments are conducted and, together with application of backbone network (Internet2) Netflow data, show some positive results.

Flow classification is of great significance for network management. Machine-learning-based flow classification is widely used nowadays, but features which depict the non-Gaussian characteristics of network flows are still absent. In this paper, we propose the Windowed Higher-order Statistical Analysis (WHOSA) for machine-learning-based flow classification. In our methodology, a network flow is modeled as three different time series: the flow rate sequence, the packet length sequence and the inter-arrival time sequence. For each sequence, both the higher-order moments and the largest singular values of the Bispectrum are computed as features. Some lower-order statistics are also computed from the distribution to build up the feature set for contrast, and C4.5 decision tree is chosen as the classifier. The results of the experiment reveals the capability of WHOSA in flow classification. Besides, when the classifier gets fully learned, the WHOSA feature set exhibit stronger discriminative power than the lower-order statistical feature set does.