Traffic Profiling: Evaluating Stability in Multi-device User Environments

An ever-growing number of network connected devices per user and changing usage preferences in current networks require novel monitoring techniques be put in place by operators to identify and, if possible, predict user requirements and behaviour. This study utilises NetFlow and cluster analysis to derive six unique traffic profiles namely, 'communicators', 'concealers', 'downloaders', 'all-rounders' and 'high' and 'low intensity web surfers', of around two hundred users (each having multiple devices) based on their application usage trends. During 4 weeks of observation, the analysis indicates that profiles are rather static, with the average probability for a specific device to change its profile ranging between 3-19% over any consecutive 24 hours. Additionally, user devices exhibited a greater probability (up to 8%) of switching to profiles that were similar in terms of application usage ratios due to proportional variations in the same user activity rather than any major usage changes. User devices in some profiles such as 'concealers' and 'downloaders', showed minimal change in application proportion attributed to dedicated P2P and FTP usage. The reported high level of consistency in all profile memberships led to recommending the use of resulting profile baselines for effective monitoring, policy enforcement and anomaly detection in modern networks.