Identification of user behavior from flow statistics

Recently, network traffic is becoming strongly biased by user's action taken in an application. In this paper, we propose a method to infer such action (we define as “user behavior”) from the monitored traffic. The proposed method firstly composes a set of traffic features (statistical features of measured traffic flows) and then applies a Supervised Machine Learning (ML) algorithm to identify the user behavior from the statistical features. Through experimental results by using actual traffic, we show that the proposed method achieves around 91% accuracy of identification for 9 major applications, and around 81% accuracy of identification for 43 user behaviors.