Communities of Interest for Internet Traffic Prioritization

Communities of interest (COI) have been studied in the past to classify traffic within an enterprise network, and to mitigate denial-of-service (DoS) attacks. We investigate the use of Communities of Interest (COIs) to prioritize known good traffic on the Internet. Under our system, an ISP may construct a COI for each of its enterprise customers. The COI would contain entities which have previously had good communications with the customer. These COIs could then be used in combination with traffic differentiating mechanisms during periods of heavy traffic in order to prioritize traffic from communicating entities known to be good. We show that it is possible to construct an effective COI from information which would be available to an ISP about its customers, specifically sampled Netflow data. We investigate various heuristics to determine which flows actually represent good traffic whose endpoint should be inserted into the COI, and show that our heuristics are effective in differentiating wanted and unwanted traffic.