Table Of ContentLecture Notes in Computer Science 6613
CommencedPublicationin1973
FoundingandFormerSeriesEditors:
GerhardGoos,JurisHartmanis,andJanvanLeeuwen
EditorialBoard
DavidHutchison
LancasterUniversity,UK
TakeoKanade
CarnegieMellonUniversity,Pittsburgh,PA,USA
JosefKittler
UniversityofSurrey,Guildford,UK
JonM.Kleinberg
CornellUniversity,Ithaca,NY,USA
AlfredKobsa
UniversityofCalifornia,Irvine,CA,USA
FriedemannMattern
ETHZurich,Switzerland
JohnC.Mitchell
StanfordUniversity,CA,USA
MoniNaor
WeizmannInstituteofScience,Rehovot,Israel
OscarNierstrasz
UniversityofBern,Switzerland
C.PanduRangan
IndianInstituteofTechnology,Madras,India
BernhardSteffen
TUDortmundUniversity,Germany
MadhuSudan
MicrosoftResearch,Cambridge,MA,USA
DemetriTerzopoulos
UniversityofCalifornia,LosAngeles,CA,USA
DougTygar
UniversityofCalifornia,Berkeley,CA,USA
GerhardWeikum
MaxPlanckInstituteforInformatics,Saarbruecken,Germany
Jordi Domingo-Pascual Yuval Shavitt
Steve Uhlig (Eds.)
Traffic Monitoring
and Analysis
Third International Workshop, TMA 2011
Vienna, Austria, April 27, 2011
Proceedings
1 3
VolumeEditors
JordiDomingo-Pascual
UniversitatPolitècnicadeCatalunya(UPC)-BarcelonaTECH
Departamentd’ArquitecturadeComputadors,CampusNord.MòdulD6
JordiGirona1-3,08034Barcelona,Spain
E-mail:[email protected]
YuvalShavitt
TelAvivUniversity,TheIbyandAladarFleischmanFacultyofEngineering
SchoolofElectricalEngineering,WolfsonBuildingforSoftwareEngineering
RamatAviv69978,Israel
E-mail:[email protected]
SteveUhlig
TechnischeUniversitätBerlin,An-InstitutDeutscheTelekomLaboratories
FGINET,ResearchGroupAnjaFeldmann,Sekr.TEL16
Ernst-Reuter-Platz7,10587Berlin,Germany
E-mail:[email protected]
ISSN0302-9743 e-ISSN1611-3349
ISBN978-3-642-20304-6 e-ISBN978-3-642-20305-3
DOI10.1007/978-3-642-20305-3
SpringerHeidelbergDordrechtLondonNewYork
LibraryofCongressControlNumber:2011924344
CRSubjectClassification(1998):C.2,D.4.4,H.3,H.4,D.2
LNCSSublibrary:SL5–ComputerCommunicationNetworksandTelecommuni-
cations
©Springer-VerlagBerlinHeidelberg2011
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965,
initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violationsareliable
toprosecutionundertheGermanCopyrightLaw.
Theuseofgeneraldescriptivenames,registerednames,trademarks,etc.inthispublicationdoesnotimply,
evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevantprotectivelaws
andregulationsandthereforefreeforgeneraluse.
Typesetting:Camera-readybyauthor,dataconversionbyScientificPublishingServices,Chennai,India
Printedonacid-freepaper
SpringerispartofSpringerScience+BusinessMedia(www.springer.com)
Preface
The Third International Workshop on Traffic Monitoring and Analysis (TMA
2011)wasaninitiativeoftheCOSTActionIC0703“DataTrafficMonitoringand
Analysis: Theory,Techniques, Tools and Applications for the Future Networks”
http://www.tma-portal.eu/cost-tma-action.
The COST program is an intergovernmental framework for European Co-
operation in Science and Technology, promoting the coordination of nationally
funded research on a European level. Each COST Action aims at reducing the
fragmentation in research and opening the European research area to coopera-
tion worldwide.
Traffic monitoring and analysis (TMA) is nowadays an important research
topic within the field of computer networks. It involves many research groups
worldwide that are collectively advancing our understanding of the Internet.
Modern packet networks are highly complex and ever-evolving objects. Under-
standing,developingandmanagingsuchinfrastructuresisdifficultandexpensive
in practice. Traffic monitoring is a key methodology for understanding telecom-
municationtechnologyandimprovingits operation,andTMA-basedtechniques
canplayakeyroleintheoperationofrealnetworks.Besidesitspracticalimpor-
tance,TMAisanattractiveresearchtopicforseveralreasons.First,theinherent
complexityoftheInternethasattractedmanyresearcherstofacetrafficmeasure-
ments since the pioneering times. Second, TMA offers a fertile ground for the-
oretical and cross-disciplinary research, such as the various analysis techniques
being imported into TMA from other fields, while at the same time providing
a clear perspective for the practical exploitation of the results. In other words,
TMAresearchhasthe potentialto reconciletheoreticalinvestigationswithreal-
worldapplications,andtorealigncuriosity-drivenwithproblem-drivenresearch.
In the spirit of the COST program, the COST-TMA Action was launched
in 2008 to promote building a researchcommunity in the specific field of TMA.
Today, it involves research groups from academic and industrial organizations
from 25 countries in Europe.
The goal of the TMA workshops is to open the COST Action research and
discussions to the worldwide community of researchers working in this field.
Followingthesuccessofthefirsttwoeditionsofthe TMAworkshopin2009and
2010,wedecidedtomaintainthesameformatforthis thirdedition:single-track
full-day program.TMA 2011 was organizedjointly with the European Wireless
conference and was held in Vienna on April 27, 2011.
TMA2011attracted29submissions.Eachpaperwascarefullyreviewedbyat
leastthreemembersoftheTechnicalProgramCommittee.Thereviewingprocess
ledtotheacceptanceoftenpapersasfullpapersandfourasshortpapers.Short
papers are works that provide promising results or justify discussion during the
workshop,butlacktechnicalmaturitytobeacceptedasfullpapers.Finally,this
VI Preface
year’s workshop included a poster session. This poster session welcomes work-
in-progress work from academia as well as industry. Early experimental results,
insights, and prototypes are also of interest. Six posters were accepted.
We would like to thank all members of the Technical Program Committee
fortheirtimelyandthoroughreviews.Wehopeyouwillenjoytheworkshopand
make this event a success!
April 2011 Jordi Domingo-Pascual
Yuval Shavitt
Steve Uhlig
Organization
Program Committee Chairs
Jordi Domingo-Pascual Technical University of Catalonia (UPC),
Spain
Yuval Shavitt Tel Aviv University, Israel
Steve Uhlig TU Berlin/T-labs, Germany
Program Committee
Pere Barlet-Ros Technical University of Catalonia (UPC),
Spain
Ernst Biersack Eur´ecom,France
Pierre Borgnat ENS Lyon, France
Albert Cabellos Technical University of Catalonia (UPC),
Spain
Kenjiro Cho IIJ, Japan
Ana Paula Couto da Silva Federal University of Juiz de Fora, Brazil
Xenofontas Dimitropoulos ETH Zu¨rich, Switzerland
Benoit Donnet Universit´e catholique de Louvain (UCL),
Belgium
Gianluca Iannaccone Intel Research Berkeley, USA
Ethan Katz-Bassett University of Washington, USA
Udo Krieger University of Bamberg, Germany
Youngseok Lee CNU, Korea
Olaf Maennel LoughboroughUniversity, UK
Gregor Maier ICSI, Berkeley, USA
Marco Mellia Politecnico di Torino, Italy
Michela Meo Politecnico di Torino, Italy
Philippe Owezarski CNRS, Toulouse, France
Dina Papagiannaki Intel Pittsburgh, USA
Antonio Pescape University of Naples, Italy
Aiko Pras University of Twente, The Netherlands
Fabio Ricciato University of Salento, Italy and FTW, Austria
Dario Rossi TELECOM ParisTech, France
Luca Salgarelli University of Brescia, Italy
Ruben Torres Purdue University, USA
Tanja Szeby Fraunhofer FOKUS Berlin, Germany
VIII Organization
Local Arrangements Chairs
Fabio Ricciato University of Salento, Italy and FTW, Austria
Alessandro D’Alconzo FTW, Austria
Poster Session Committee
Saverio Niccolini NEC Laboratories Europe, Germany
Giuseppe Bianchi Univerista` di Roma 2, Italy
Brian Trammell ETH Zu¨rich, Switzerland
Nuno M. Garcia Universidade Luso´fona de Humanidades e
Tecnologias, Portugal
Chadi Barakat INRIA, Sophia Antipolis, France
Table of Contents
Traffic Analysis (1)
On Profiling Residential Customers ................................ 1
Marcin Pietrzyk, Louis Plissonneau, Guillaume Urvoy-Keller, and
Taoufik En-Najjary
Sub-Space Clustering and Evidence Accumulation for Unsupervised
Network Anomaly Detection....................................... 15
Johan Mazel, Pedro Casas, and Philippe Owezarski
An Analysis of Longitudinal TCP Passive Measurements
(Short Paper) ................................................... 29
Kensuke Fukuda
Traffic Analysis (2)
Understanding the Impact of the Access Technology: The Case of Web
Search Services .................................................. 37
Aymen Hafsaoui, Guillaume Urvoy-Keller, Denis Collange,
Matti Siekkinen, and Taoufik En-Najjary
A Hadoop-Based PacketTrace Processing Tool ...................... 51
Yeonhee Lee, Wonchul Kang, and Youngseok Lee
Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and
IPFIX (Short Paper) ............................................. 64
Martin Elich, Matˇej Gr´egr, and Pavel Cˇeleda
Applications and Privacy
Identifying Skype Traffic in a Large-Scale Flow Data Repository ....... 72
Brian Trammell, Elisa Boschi, Gregorio Procissi,
Christian Callegari, Peter Dorfinger, and Dominik Schatzmann
On the Stability of Skype Super Nodes ............................. 86
Anat Bremler-Barr and Ran Goldschmidt
Reduce to the Max: A Simple Approach for Massive-Scale
Privacy-Preserving Collaborative Network Measurements
(Short Paper) ................................................... 100
Fabio Ricciato and Martin Burkhart
X Table of Contents
An Analysis of Anonymity Technology Usage........................ 108
Bingdong Li, Esra Erdin, Mehmet Hadi Gu¨ne¸s, George Bebis, and
Todd Shipley
Traffic Classification
Early Classification of Network Traffic through Multi-classification ..... 122
Alberto Dainotti, Antonio Pescap´e, and Carlo Sansone
Software Architecture for a Lightweight Payload Signature-Based
Traffic Classification System....................................... 136
Jun-Sang Park, Sung-Ho Yoon, and Myung-Sup Kim
Mining Unclassified Traffic Using Automatic Clustering Techniques..... 150
Alessandro Finamore, Marco Mellia, and Michela Meo
Entropy Estimation for Real-Time Encrypted Traffic Identification
(Short Paper) ................................................... 164
Peter Dorfinger, Georg Panholzer, and Wolfgang John
Poster Session
Limits in the Bandwidth Exploitationin PassiveOptical Networks Due
to the Operating Systems (Poster) ................................. 172
Paolo Bolletta, Valerio Petricca, Sergio Pompei, Luca Rea,
Alessandro Valenti, and Francesco Matera
Toward a Scalable and Collaborative Network Monitoring Overlay
(Poster) ........................................................ 176
Vasco Castro, Paulo Carvalho, and Solange Rito Lima
Hardware-Based “on-the-fly” Per-flow Scan Detector Pre-filter
(Poster) ........................................................ 181
Salvatore Pontarelli, Simone Teofili, and Giuseppe Bianchi
Anti-evasion Technique for Packet Based Pre-filtering for Network
Intrusion Detection Systems (Poster) ............................... 185
Salvatore Pontarelli and Simone Teofili
COMINDIS – COllaborative Monitoring with MINimum DISclosure
(Poster) ........................................................ 189
Jacopo Cesareo, Andreas Berger, and Alessandro D’Alconzo
Dynamic Monitoring of Dark IP Address Space (Poster) .............. 193
Iasonas Polakis, Georgios Kontaxis, Sotiris Ioannidis, and
Evangelos P. Markatos
Author Index.................................................. 197
On Profiling Residential Customers
MarcinPietrzyk1,LouisPlissonneau1,
GuillaumeUrvoy-Keller2,andTaoufikEn-Najjary1
1 OrangeLabs,France
{marcin.pietrzyk,louis.plissonneau,
taoufik.ennajjary}@orange-ftgroup.com
2 Universite´deNiceSophia-Antipolis,LaboratoireI3SCNRSUMR6070,France
[email protected]
Abstract. Some recent large scalestudies on residential networks (ADSLand
FTTH)haveprovidedimportantinsightsconcerningthesetofapplicationsused
insuchnetworks.Forinstance,itisnowapparentthatWebbasedtrafficisdom-
inating againat the expense of P2Ptrafficinlotsof countries due to thesurge
ofHTTPstreamingandpossiblysocialnetworks.Inthispaperweconfrontthe
analysisoftheoverall(highlevel)trafficcharacteristicsoftheresidentialnetwork
withthestudyoftheuserstrafficprofiles.Weproposeapproachestotacklethose
issuesandillustratethemwithtracesfromanADSLplatform.Ourmainfindings
arethatevenifP2Pstilldominatesthefirstheavyhitters,thedemocratizationof
WebandStreamingtrafficisthemaincauseofthecome-backofHTTP.More-
over, the mixture of applications study highlights that these two classes (P2P
vs. Web + Streaming) are almost never used simultaneously by our residential
customers.
1 Introduction
Theresearchcommunityhasdevotedsignificanteffortsto profileresidentialtrafficin
thelastcoupleofyears.AlargescalestudyofJapaneseresidentialtraffic[5,4],where
almost40%oftheInternettrafficoftheislandis continuouslyobserved,hasrevealed
specific characteristics of the Japanese traffic: a heavy use of dynamic ports, which
suggestsaheavyuseofP2PapplicationsandatrendofusersswitchingfromADSLto
FTTHtechnologytorunP2Palongwithgamingapplications.ArecentstudyintheUS
[6],wherethetrafficof100KDSLusershasbeenprofiledwithaDeepPacketInspec-
tiontool,hasrevealedthatHTTPtrafficisnowthedominantprotocolattheexpenseof
P2PfortheconsideredISP,andprobablyfortheUSingeneral.Thissignificantchange
inthetrafficbreakdownisnotduetoadecreaseofP2Ptrafficintensitybutasurgeof
HTTPtrafficdrivenbyHTTPstreamingserviceslikeYouTubeandDailymotion.Sim-
ilarresultshavebeenobtainedinEuropeancountries.InGermany,arecentstudy[11]
analyzedabout30KADSLusersandalsoobservedthatHTTPwasagaindominantat
the expenseof P2Ptraffic,forthe same reasonas in the US:a surgeof videocontent
distribution over HTTP. Early studies in France [15] for an ADSL platform of about
4000usershighlightedthe dominanceofP2Ptraffic in 2007buta subsequentstudies
J.Domingo-Pascual,Y.Shavitt,andS.Uhlig(Eds.):TMA2011,LNCS6613,pp.1–14,2011.
(cid:2)c Springer-VerlagBerlinHeidelberg2011
