Flow classification is of great significance for network management. Machine-learning-based flow classification is widely used nowadays, but features which depict the non-Gaussian characteristics of network flows are still absent. In this paper, we propose the Windowed Higher-order Statistical Analysis (WHOSA) for machine-learning-based flow classification. In our methodology, a network flow is modeled as three different time series: the flow rate sequence, the packet length sequence and the inter-arrival time sequence. For each sequence, both the higher-order moments and the largest singular values of the Bispectrum are computed as features. Some lower-order statistics are also computed from the distribution to build up the feature set for contrast, and C4.5 decision tree is chosen as the classifier. The results of the experiment reveals the capability of WHOSA in flow classification. Besides, when the classifier gets fully learned, the WHOSA feature set exhibit stronger discriminative power than the lower-order statistical feature set does.

Identifying IDC (Internet Data Center) IP addresses and analyzing the connection relationship of IDC could reflect the IDC network resource allocation and network layout which is helpful for IDC resource allocation optimization. Recent research mainly focuses on minimizing electricity consumption and optimizing network resource allocation based on IDC traffic behavior analysis. However, the lack of network-wide IP information from network operators has led to problems like management difficulties and unbalanced resource allocation of IDC, which are still unsolved today. In this paper, we propose a method for the IP identification and connection relationship analysis of IDC based on the flow connection behavior analysis. In our method, the frequent IP are extracted and aggregated in backbone communication network based on the traffic characteristics of IDC. After that, the connection graph of frequent IP (CGFIP) are built by analyzing the behavior of the users who visit the IDC servers, and IDC IP blocks are thus identified using CGFIP. Furthermore, the connection behavior characteristics of IDC are analyzed based on the connection graphs of IDC (CGIDC). Our findings show that the method can accurately identify the IDC IP addresses and is also capable of reflecting the relationships among IDCs effectively.