Bayesian Nonparametric Clustering of Network Traffic Data

We introduce a Bayesian nonparametric method for the clustering of network flows, sequences of packets observed during the communication between pairs of hosts. Our goal is to infer the application types without inspecting in detail the content of each packet, avoiding the so called DPI (Deep Packet Inspection). Instead, we only use simple to derive features such as packet size or direction (up-load/download) and represent each flow by a sequence of symbols from a finite alphabet. The flows are naturally modeled as a mixture of Markov models, gen-erated by a Dirichlet process. We have implemented a blocked Gibbs sampler for inferring cluster assignments by integrating out the model parameters. The clus-tering results obtained on data captured from a real network seems to be coherent.