Utility of User Roles in Comparing Network Flow Behaviors

We compared the practice of grouping users based on roles to define normal network behaviors with grouping users based on behavioral similarities. For this comparison we utilized Netflow-derived features to characterize the network traffic of users on a small campus, and labeled the feature vectors based on user roles. Using the same flow-feature sets we also grouped users based on shared network behaviors, using K-means++ to cluster user data sets. Intra-group similarities under the grouping strategies were tested in two ways. First, by using a linear (Nearest Centroid) classifier to measure how separable group data sets were. Second, by averaging each user's feature vector values by week of activity, and measuring pairwise distances between the centroid vectors to determine intra-group and intergroup distance distributions. Our tests showed that creating user groups via clustering user data sets created tighter ranges of user behavior as compared to grouping based on user roles.