Exploiting clustering techniques

Exploiting Clustering Techniques for Web Session Inference A.Bianco, G. Mardente, M. Mellia, M.Munafò, L. Muscariello (Politecnico di Torino)

Outline ,[object Object],[object Object],[object Object],[object Object],[object Object]

Web session definition ,[object Object],think time T off think time T off ,[object Object],[object Object]

Algorithms ,[object Object],[object Object],[object Object],[object Object]

Proposed algorithm ,[object Object],[object Object],[object Object],[object Object],[object Object]

First Step: K-means ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],g - th percentile (100- g )- th percentile

Second step: a hierarchical method ,[object Object],[object Object]

Gamma function typical behaviour -10 0 10 20 30 40 50 60 70 0 200 400 600 800 1000 1200 1400 gamma Step

Third Step: K-means ,[object Object],[object Object],[object Object]

Performance evaluation ,[object Object],[object Object],[object Object],[object Object],[object Object]

First step sensitivity (1/2) ,[object Object],[object Object],0.01 0.1 1 10 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Percentage of errors T_{off} K=1000 K=1500 K=2000 K=2500

First step sensitivity (2/2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],0.01 0.1 1 10 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Percentage of errors T_{off} Single linkage Centroid Method g=1 g=5 0.01 0.1 1 10 0 200 400 600 800 1000 1200 1400 1600 1800 2000 T_{off} g=15 g=25 g=35 g=45

Comparison with threshold based algorithms – exponential case ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],0.1 1 10 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Percentage of errors T_{off} clustering etha=T_{off}/2 etha=T_{off}/4 etha=T_{off}/8 0.1 1 10 0 200 400 600 800 1000 1200 1400 1600 1800 2000 T_{off} etha=T_{off}/16 etha=T_{off}/32 etha=T_{off}/64 etha=T_{off}/128

Comparison with threshold based algorithms – Pareto case ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],0.1 1 10 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Percentage of errors T_{off} clustering etha=T_{off}/2 etha=T_{off}/4 etha=T_{off}/8 0.1 1 10 0 200 400 600 800 1000 1200 1400 1600 1800 2000 T_{off} etha=T_{off}/16 etha=T_{off}/32 etha=T_{off}/64 etha=T_{off}/128

Some statistics on aggregated sessions ,[object Object],[object Object],[object Object],0 0.05 0.1 0.15 0.2 0.25 0.3 1 10 100 1000 10000 PDF Number of TCP connections per session 1e-005 0.0001 0.001 0.01 0.1 1 100 1000 10000 Number of TCP connections per session Compl. CDF 0 0.01 0.02 0.03 0.04 0.05 0.06 1 10 100 PDF Session Length [s] First SYN -> Last TCP Tear-Down First SYN -> Last Data Segment 0.0001 0.001 0.01 0.1 1 100 1000 10000 Session Length [s] Compl. CDF

Some statistics on aggregated sessions ,[object Object],[object Object],0 0.005 0.01 0.015 0.02 0.025 0.03 100 1000 10000 100000 1e+006 PDF Session data [bytes] Server -> Client Client -> Server 1e-005 0.0001 0.001 0.01 0.1 1 10000 100000 1e+006 1e+007 Session data [bytes] Compl. CDF

Flow’s and session’s inter-arrivals ,[object Object],[object Object],0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0.1 1 10 100 1000 10000 CDF Time [s] Apr.04 T_{off} Oct.02 T_{off} Apr.04 T_{arr} Oct.02 T_{arr}

Conclusions ,[object Object],[object Object],[object Object],[object Object]

Exploiting clustering techniques

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Exploiting clustering techniques

Similar to Exploiting clustering techniques (20)

Exploiting clustering techniques