A measurement-based study on the correlations of inter-domain Internet application flows

Internet traffic characterization has a profound impact on network engineering and traffic identification. Existing studies are often carried out on a per-flow basis, focusing on the properties of individual flows. In this paper, we study the interaction of Internet traffic flows and network features from a complex network perspective, focusing on six types of applications: P2P file sharing, P2P stream, HTTP, instant messaging, online games and abnormal traffic. With large-volume traffic flow records collected through proprietary line-speed hardware-based monitors, we construct flow graphs of these different application types. Based on the flow graphs, we calculate the correlation coefficients on various properties for individual or multiple applications. Our studies on associativity among degree and strength of individual hosts and connected nodes reveal distinct correlative behavior of different types of applications. Especially, the correlations of P2P applications are observed to be much stronger than those of the other applications. We also investigate the correlations between different types of applications, and observe that HTTP has remarkably different correlations from those of the two P2P applications due to the fact that multiple application types rely on HTTP. Finally, we study the dynamics of correlations for a period of 24 h and reveal a few interesting trends. We believe that our work which focuses on the assortativities of Internet applications provides insightful understanding on Internet traffic classification of up-to-date applications and will be helpful for Internet traffic classification and engineering.