Home // SECURWARE 2012 , The Sixth International Conference on Emerging Security Information, Systems and Technologies // View article

Characterizing and Predicting Internet Users Hidden Behaviors with Markovian Models

Authors:
Paulo Salvador
António Nogueira
Eduardo Rocha

Keywords: User profiling; wavelets; multiscaling behavior; multivariate Gaussian distributions; Markovian modeling; behavior prediction

Abstract:
The ability to characterize and predict Internet users behaviors in environments where only layer 2 statistics are available can be very important for a network operator. At network entry points, like Wi-Fi or WiMax access points or UMTS or LTE base stations, the operator can perform a low level monitoring of the communications independently of the data encryption level and even without being associated with the network itself. Based on this low level network data, it is possible to infer the user behavior, optimize the access service and offer new security threat detection services. The user behavior inference consists in identifying the underlying web application that is responsible by the layer 2 traffic at different time instants and characterize the usage dynamics of the different web applications. Many identification methodologies have been proposed over the last years to classify/identify IP applications, including port-based analysis, deep packet inspection, behavior-based approaches and learning theory, each one having its own advantages and drawbacks. However, all these methodologies fail when only low level statistics are available or under data encryption restrictions. We propose the use of multiscaling traffic characteristics to differentiate between different web applications and the use of a Markovian model to characterize the dynamics of the user actions over time. By applying this methodology to Wi-Fi layer 2 traffic generated by users accessing different common web services/contents through HTTP (namely social networking, web news and web-mail applications), it was possible to achieve a good matching and prediction of the users behaviors. The results show that the proposed multiscaling traffic Markovian model has the potential to identify, model and predict Internet users behaviors based only on layer 2 traffic statistics.

Pages: 98 to 103

Copyright: Copyright (c) IARIA, 2012

Publication date: August 19, 2012

Published in: conference

ISSN: 2162-2116

ISBN: 978-1-61208-209-7

Location: Rome, Italy

Dates: from August 19, 2012 to August 24, 2012