Web user-session inference by means of clustering techniques

ABSTRACT

This paper focuses on the definition and identification of "Web user-sessions", aggregations of several TCP connections generated by the same source host. The identification of a user-session is non trivial. Traditional approaches rely on threshold based mechanisms. However, these techniques are very sensitive to the value chosen for the threshold, which may be difficult to set correctly. By applying clustering techniques, we define a novel methodology to identify Web user-sessions without requiring an a priori definition of threshold values. We define a clustering based approach, we discuss pros and cons of this approach, and we apply it to real traffic traces. The proposed methodology is applied to artificially generated traces to evaluate its benefits against traditional threshold based approaches. We also analyze the characteristics of user-sessions extracted by the clustering methodology from real traces and study their statistical properties. Web user-sessions tend to be Poisson, but correlation may arise during periods of network/hosts anomalous behavior.

REFERENCES

• 1: Vern Paxson , Sally Floyd, Wide area traffic: the failure of Poisson modeling, IEEE/ACM Transactions on Networking (TON), v.3 n.3, p.226-244, June 1995 [doi>10.1109/90.392383]
• 2: Mark E. Crovella , Azer Bestavros, Self-similarity in World Wide Web traffic: evidence and possible causes, IEEE/ACM Transactions on Networking (TON), v.5 n.6, p.835-846, Dec. 1997 [doi>10.1109/90.650143]
• 3: Ramón Cáceres , Peter B. Danzig , Sugih Jamin , Danny J. Mitzel, Characteristics of wide-area TCP/IP conversations, Proceedings of the conference on Communications architecture & protocols, p.101-112, September 03-06, 1991, Zurich, Switzerland
• 4: P. Danzig and S. Jamin, "Tcplib: A library of TCP Internetwork traffic characteristics," USC, Tech. rep., 1991.
• 5: P. Danzig, S. Jamin, R. Caceres, D. Mitzel, and D. Mestrin, "An empirical workload model for driving wide-area TCP/IP network simulations," Internetworking: Research and Experience, vol. 3, no. 1, pp. 1-26, 1992.
• 6: Vern Paxson, Empirically derived analytic models of wide-area TCP connections, IEEE/ACM Transactions on Networking (TON), v.2 n.4, p.316-336, Aug. 1994 [doi>10.1109/90.330413]
• 7: Carl Nuzman , Iraj Saniee , Wim Sweldens , Alan Weiss, A compound model for TCP connection arrivals for LAN and WAN applications, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.40 n.3, p.319-337, 22 October 2002 [doi>10.1016/S1389-1286(02)00298-0]
• 8: F. Donelson Smith , Félix Hernández Campos , Kevin Jeffay , David Ott, What TCP/IP protocol headers can tell us about the web, ACM SIGMETRICS Performance Evaluation Review, v.29 n.1, p.245-256, June 2001
• 9: Walter Willinger , Vern Paxson , Murad S. Taqqu, Self-similarity and heavy tails: structural modeling of network traffic, A practical guide to heavy tails: statistical techniques and applications, Birkhauser Boston Inc., Cambridge, MA, 1998
• 10: T. Bonald, A. Proutière, G. Régnié, and J. W. Roberts, "Insensitivity results in statistical bandwidth sharing," in Proc. Int. Teletraffic Congr. (ITC) 17, Salvador, Brazil, Dec. 2001, 12 pp.
• 11: Paul Barford , Mark Crovella, Generating representative Web workloads for network and server performance evaluation, Proceedings of the 1998 ACM SIGMETRICS joint international conference on Measurement and modeling of computer systems, p.151-160, June 22-26, 1998, Madison, Wisconsin, United States
• 12: Ludmila Cherkasova , Peter Phaal, Session-Based Admission Control: A Mechanism for Peak Load Management of Commercial Web Sites, IEEE Transactions on Computers, v.51 n.6, p.669-685, June 2002 [doi>10.1109/TC.2002.1009151]
• 13: Michal Pióro , Deepankar Medhi, Routing, Flow, and Capacity Design in Communication and Computer Networks, Morgan Kaufmann Publishers Inc., San Francisco, CA, 2004
• 14: Universal Mobile Telecommunications System (UMTS), Selection Procedures for the Choice of Radio Transmission Technologies of the UMTS (UMTS 30.03 Version 3.2.0), ETSI TR 101 112 V3.2.0 (1998-04), (1998-04).
• 15: S. Ben Fred , T. Bonald , A. Proutiere , G. Régnié , J. W. Roberts, Statistical bandwidth sharing: a study of congestion at flow level, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.111-122, August 2001, San Diego, California, United States
• 16: Martin F. Arlitt , Carey L. Williamson, Web server workload characterization: the search for invariants, Proceedings of the 1996 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, p.126-137, May 23-26, 1996, Philadelphia, Pennsylvania, United States
• 17: Yun Fu , Amin Vahdat , Ludmila Cherkasova , Wenting Tang, EtE: Passive End-to-End Internet Service Performance Monitoring, Proceedings of the General Track of the annual conference on USENIX Annual Technical Conference, p.115-130, June 10-15, 2002
• 18: David J. Hand , Padhraic Smyth , Heikki Mannila, Principles of data mining, MIT Press, Cambridge, MA, 2001
• 19: A. Bianco, G. Mardente, M. Mellia, M. Munafò, and L. Muscariello, "Web user session characterization via clustering techniques," in Proc. IEEE GLOBECOM 2005, St. Louis, MO, Nov. 2005, vol. 2, pp. 1102-1107.
• 20: The GARR Network Topology. 2005 [Online]. Available: http://www. garr.it/reteGARR/mappe.php
• 21: M. Mellia, A. Carpani, and R. Lo Cigno, "Measuring IP and TCP behavior on edge nodes," in Proc. IEEE GLOBECOM 2002, Taipei, Taiwan, R.O.C., Nov. 2002, vol. 3, pp. 2533-2537.
• 22: M. Mellia, R. Lo Cigno, and F. Neri, Tstat Web Page. 2001 [Online]. Available: http://tstat.tlc.polito.it
• 23: What You Should Know About the Sasser Worm. May 2004 [Online]. Available: http://www.microsoft.com/security/incident/sasser.mspx
• 24: S. McCanne, C. Leres, and V. Jacobson, Tcpdump. 2001 [Online]. Available: http://www.tcpdump.org
• 25: Gianluca Iannaccone , Christophe Diot , Ian Graham , Nick McKeown, Monitoring very high speed links, Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement, November 01-02, 2001, San Francisco, California, USA [doi>10.1145/505202.505235]
• 26: A. Feldmann, "Characteristics of TCP connection arrivals," AT&T Labs Research, Florham Park, NJ, Tech. rep., 1998.
• 27: Goodness-of-Fit Techniques, R. B. D'Agostino and M. A. Stephens, Eds. New York: Marcel Dekker, 1986.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network management

Additional Classification:
  C. Computer Systems Organization
  C.4 PERFORMANCE OF SYSTEMS
      Subjects: Performance attributes

  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.4 Systems and Software

          Nouns: World Wide Web (WWW)

  I. Computing Methodologies
  I.5 PATTERN RECOGNITION
      I.5.3 Clustering
          Subjects: Algorithms

General Terms:
Algorithms, Design, Management, Performance

Keywords:
clustering methods, traffic measurement, web traffic characterization