A Machine Learning-based Method for Clustering the Traffic of Linux NATed Network Entities with TCP/IP Feature

It is crucial to distinguish the network entities (NEs) behind NAT devices for tasks such as information gathering, asset management, and legal interception. The current mainstream approach has the problem of erroneously clustering traffic from a sparsely communicating NE as traffic from multiple NE. This leads to current algorithms not being able to be applied effectively in real environment. To address this issue, we propose a Linux NEs traffic clustering method based on TCP/IP features in this paper. We integrate multiple hidden level features such as operating system and timestamp and freely cluster the data set based on the density of spatial distribution. We use the datasets from the real campus network and public dataset to evaluate the performance of our method, and the results show that our method overcomes the problem erroneously clustering traffic from a sparsely communicating NE as traffic from multiple NEs. For the current mainstream Linux types, the purity of each version exceeds 0.91, RI exceeds 0.98, ARI exceeds 0.88, and FMI exceeds 0.89. Our method can accurately calculate the number of hosts behind NAT and cluster traffic accordingly.