User characterization through network flow analysis

One of the objectives of network security is to control the use of shared resources among users. In this regard, knowing the actual identity of network users is quite valuable to the intermediate nodes. The dynamic allocation of IP addresses and Network Address Translation(NAT) make it practically difficult, without any significant modifications to end user protocols and applications, to identify users by looking at network traffic. This work tries to establish network flow analysis as a viable method of user identification in such cases. We propose a supervised learning model that uses flow features to identify users within a given set. Based on our analysis of flow features, we introduce the concept of flow-bundle-level features which can be derived from the packet-level and flow-level features which are generally recorded by flow probes. We have identified a set of flow-bundle-level features which is able to identify users with a high degree of accuracy. This set comprises two types of features, user-features which are characteristic of the behaviour of an individual user and host-features which are the properties of the user's host platform. We also present an argument that, with the increasing penetration of personal mobile devices, a one-host one-user is going to be the norm and hence inclusion of host features will strengthen the user identification model. The model was validated, with four different supervised learning algorithms, using a data-set of flow records of 65 users. It was able to give a highest accuracy of 83%.