Clustering IP addresses using longest prefix matching and nearest neighbor algorithms

This paper summarizes a new algorithm for clustering IP addresses. Unlike popular clustering algorithms such as k-means and DBSCAN, this algorithm is designed specifically for IP addresses. In particular, the algorithm employs the longest prefix match as a similarity metric and uses an adaptation of the nearest neighbor algorithm for search to yield meaningful clusters. The algorithm is automatic in that it does not require any input parameters. When applied to a large IP address dataset, the algorithm produced 90% correct clusters. Correct cluster analysis is essential for many network design and management tasks including design of web caches and server replications.