Domain Name System (DNS) is one of the pillars of today's Internet. Due to its appealing properties such as low data volume, wide-ranging applications and encryption free, DNS traffic has been extensively utilized for network monitoring. Most existing studies of DNS traffic, however, focus on domain name reputation. Little attention has been paid to understanding and profiling what people are doing from DNS traffic, a fundamental problem in the areas including Internet demographics and network behavior analysis. Consequently, simple questions like “How to determine whether a DNS query for www.google.com means searching or any other behaviors?” cannot be answered by existing studies. In this paper, we take the first step to identify user activities from raw DNS queries. We advance a multiscale hierarchical framework to tackle two practical challenges, i.e., behavior ambiguity and behavior polymorphism. Under this framework, a series of novel methods, such as pattern upward mapping and multi-scale random forest classifier, are proposed to characterize and identify user activities of interest. Evaluation using both synthetic and real-world DNS traces demonstrates the effectiveness of our method.

With the number of Internet users and applications continues to grow, it becomes increasingly important to understand the users' behavior character for efficient network management and security monitoring. Web is one of the most popular applications, which can help users to obtain anything they want. In this paper, we propose a new framework to measure and monitor users' web access behavior character. Firstly, web services are divided into 12 types according to the content they provide. As user like to access different web services at different time instants, we proposed the behavior spectrum to describe the users' access character in an easily understandable way. Secondly, we employ three traffic features (number of connections, number of packets and number of bytes) to measure the intensity of users' access behavior. Based on the spectrums and features obtained, two kinds of user's access characters are analyzed: the characters at a particular time instant and the dynamic changing characters at continuous time points. Finally, we employ the Renyi entropy to cluster the users into different groups based on the spectrum and find the results are useful for network management. To verify the method, several actual traffic traces are collected from the Northwest Regional Center of CERNET (China Education and Research Network) and the experimental results prove the efficiency of the proposed methods.

The emergence of online social network has changed the Internet users' online behaviors dramatically. Microblog, as an emerging online social network service, has attracted hundreds of millions of users to produce and share all kinds of content since its foundation. How to improve the Quality of Experience of the service and keep the users' passions for participant has become one of the most important problems confronted by the quick development of microblogging services. On the other hand, the QoE of a service influences and is influenced by its users' activities. In this paper, we analyzed the users' activities in Sina Weibo, a popular Chinese microblog website which has a profound influence on Chinese netizens. With the aim to find possible ways to improve users' Quality of Experience, we conduct a research to gain an in-depth understanding of what kinds of users are more active and what kinds of content are favored most. When we compare the distributions of the degrees of followers, we find Sina Weibo is still younger than Twitter, a famous worldwide microblogging service. Based on the following analysis, we find that users with around 300 friends in SinaWeibo are the most active users, which we believe is consistent with the Dunbar number. Furthermore, we find users in Sina Weibo are very keen on the content embedded with images and videos, which make up the majority of retweeted tweets. Through the analysis results, we confirm that inspiring users to follow others and improving the renderings of images and videos are the basic ways to improve the Quality of Experience.

To distributed sources, the usage of conventional point-source model will cause inaccuracy in the direction-of-arrival (DOA) estimation. Conventional methods for distributed sources usually estimate the DOAs and the distribution parameters with multi-dimensional peak search operations, which will lead to much higher computational complexity than that in the point source model. In this paper, a blind parameter estimation method is proposed for distributed sources, where the DOAs are estimated in a closed form. As a result, the computational burden is decreased a lot. Furthermore, the proposed method can work in the scenario with mixture sources of many kinds of distributions. The selection method and its spatial-time domain version are also discussed in this paper. Simulation results show the effectiveness of our method.

Abstract Modern Internet routers have to handle a large number of packet classification rules, which requires classification schemes to be scalable both in time and space. In this paper, we present a scalable packet classification algorithm that is developed by combining two new concepts to the well‐known bit vector (BV) scheme. We propose a range search method based on a cache‐aware tree (CATree) which makes full use of processor's cache line to reduce the number of dynamic random access memory (DRAM) accesses. Theoretically, the number of DRAM accesses of CATree is about log(m+1) times lower than that of the widely used binary search algorithm, where m is the number of keys in a single cache line. Based on our computational results on a set of 1024 keys, the CATree algorithm is 36% faster than binary search algorithm and the performance is better when applied to a larger set of keys. In addition, we develop a rule re‐arrangement algorithm to reduce the bitmap space of BV. With this re‐arrangement, the rules for the same action may be assigned an identical priority. This reduces the number of priorities as well as the memory space of the bitmap. Furthermore, this also reduces the number of memory accesses and hence, increases the CPU cache utilization. With CATree and rule re‐arrangement, the cache‐aware bit vector with rule re‐arrangement algorithm achieves better performance in comparison with the regular BV scheme, both in space and time. In our experiments, the proposed algorithm reduces the bitmap memory space of a practical set of firewall rules by two orders of magnitude and is 91% faster than the regular BV.

Nowadays, millions of Internet users watch and upload a large number of videos on User Generated Content (UGC) sites (e.g., Youtube) everyday. Moreover, online videos about hot events, such as breaking news and Olympic games, attract lots of users. In this paper, we study the characteristics of hot-event videos by collecting video traces of the largest UGC site in China for 28 days. We first empirically study statistical properties of such videos and find that hot-event videos contribute a large number of views, even though the total number of hot-event videos is relatively small. In addition, there exist extremely active uploaders and top 10% active uploaders upload over 60% videos. The video popularity demonstrates high skewness, where top 5% the most popular videos contribute over 80% views. Finally, we analyze the popularity evolution of hot-event videos using the consecutive 28-day video traces. The popularity of the studied videos decays very fast and most of these videos remain popular for only a week. Our findings reflect the most recent developments of UGC sites, which provide technical and commercial insights for engineers and UGC site owners.

Measuring and monitoring the changes of network traffic patterns in large-scale networks are crucial for effective network management. In this paper, we present a framework and method for detecting and measuring the dynamic changes of the pivotal traffic patterns. A bidirectional regional flow model is established to aggregate traffic packets and extract the traffic metrics and profiles. The characteristics of the regional flows are analyzed and interesting findings are obtained. A directed graph model is applied to describe the flow metrics and six flow features are extracted to capture the dynamic changes of the flow patterns. The measurements based on Renyi entropy are developed to quantitatively monitor these changes. The experimental results based on the actual network traffic data traces show that the method presented in this paper can capture the dynamic changes of pivotal traffic patterns effectively.

The randomness of the network behaviors poses serious challenges for discovering the abnormal patterns in network traffic flows. This paper presents a method based on blind source separation approach for detecting abnormal traffic flows. It decomposes the network traffic into two components: the routine pattern and the abnormal pattern. The scale-space filter with adaptive scale is applied to filter the noise without affecting the main behavior patterns which can be used to form the abnormal traffic metrics and profiles. The zero-crossing method is applied to extract the stochastic behavior pulse widths and the largest width is selected as the scale space factor. In this way, the influence of the inherent randomness could be removed or greatly reduced. The extracted patterns of the routine behaviors imply the user's habit and the abnormal patterns are useful for discovering anomalous behaviors such as scanning, flooding and content distribution attacks. A salient feature of the method is that no supervised learning process is needed. This is a very important advantage since obtaining labeled samples in traffic monitoring is extremely difficult. Experimental results based on the datasets of an actual network show that this method is effective for monitoring anomaly traffic flows in the gigabytes traffic environment and the identification accuracy is above 95%.