Community Detection in large-scale IP networks by Observing Traffic at Network Boundary

Internet communications are becoming more and more complex due to the exponential growth in Internet applications which created a new challenging task to accurately and efficiently monitor and manage the huge and vast network traffic. Community detection in large-scale IP networks is an important and challenging research topic. This paper proposes a methodology of unsupervised clustering of IP addresses within a managed network domain (e.g., campus network) based on inter-IP communication structure. We propose a novel approach and an efficient algorithm to discover communities based on bipartite networks and one mode projection and the basis of graph partitioning of the similarity graph. Bipartite networks were built using a NetFlow dataset collected from a boundary router in an actual environment, and then a one-mode projection has been applied over the outside IP nodes to build a social similarity graph of the inside IP addresses. We extract communities based on graph partitioning into sub-graphs (communities). Experimental results demonstrate that our approach can discover communities from real managed domain networks and obtain high quality of partitioning communities.