This document summarizes a student's research on using pattern matching to classify internet traffic. The student developed online and offline tools to collect data sets from different networks. A k-means clustering approach is used to model traffic types, where models are trained and new traffic is identified by calculating distances to the models. The performance of the approach is evaluated based on training data size, number of models, test data size, and features used. The research concludes the approach can easily identify traffic models and provide high bandwidth internet access for users.

1. A PATTERN MATCHING APPROACH
TO CLASSIFICATION OF INTERNET TRAFFIC
Submitted By
P.SAKTHIVEL(Reg.No. 2010PR197)
Under the Guidance of
C.SENTHILKUMAR M.Sc.,M.Phil.,
Associate Professor, Dept. of Computer Science,
Erode Arts & Science College,Erode-638009.

2. Objective of Study
Different types Online and Offline Tools were developed to
understanding the character of internet traffic types.
New approaches are to identify proposed traffic modeling.
Data sets were collected from different organizations and
different types of networks.

3. Abstract
The past network traffic used self-similarity particularly
linear predication based traffic model.
Auto regressive / ARMA models have been used monitor
the Network traffic.
The traffic type can be characterized by Packet length,
Packet inter arrival time, Connection direction, Connection
Packet count and byte count.

4. The Proposed model used mixture distribution under
simple K-means clustering based approach
To facilitate the traffic analysis, developed several tools.

5. Literature Review on traffic modeling
Existing Model:
Linear Predication based traffic model
LP based network traffic uses the past history of network
traffic to predict the future.
This model have a minimal number of parameters and
overhead for modeling.
It identify the optimal value of LP parameters for network
traffic

6. The LP model can predict the occurrence of network
congestion.
LP model by itself does not lead to the source of
congestion.

7. Need for a New model
LP based traffic model can predict a network fault but
cannot find the source of the network fault.
A new model is required to overcome the limitation of
recent LP-based network traffic model.

8. Tools Developed and Data Sets Collected
 Offline Tool
 Online Tool
 WANMon Tool
 Control Tool
Data Sets
 TeNeT-WAN-2005
 TeNeT-LAN-2005
 BHEL-WAN-2005

9. UNIVARIATE DISTRIBUTION MODELING
Fitting Univariate Distributions to Internet Tra_c
Types:
Analysis can be divided into the following steps:
 Identifying the shape of the density
 Estimating the unknown parameters
 Performing a test of fit

10.  Identifying the Shape of the Density
For every member of this system, the probability density
fx(x) satises the differential equation.
 Estimating the Unknown Parameters
The general form of density function for the Type I family
of distributions is given below:

11.  Performing a Test of Fit
Under the condition that there are k intervals of values of x
giving nonzero expected frequencies. The parameters in
equation (4.17) are as follows:
• nfe(x) the expected frequencies,
• foi the observed frequencies,
• n the total number of samples.

12. MIXTURE DISTRIBUTION MODELING
K-Means Clustering Based Approach
 Training:
A series of K-means clustering models are trained to
model the traffic types from the available training data.
 Testing:
Minimum Distance Computation (MDC) identifies the
traffic type by calculating the distance of an unknown
traffic type to these models

13. FLOW CHART OF K-MEANS CLUSTERING APPROACH

18. PERFORMANCE EVALUATION
 List of Experiments

19.  Effect of training data on model performance

20.  Effect of number of models

21.  Effect of amount of test data

22.  Use of Different Features

23. CONCLUSION
 Easily access the internet to the user.
 High bandwidth.
 Variety of off and on line tools are used.
 Easily identify the traffic model.

24. Thank You