T-MAW: Online Network Traffic Monitoring and Analysis using Weighted Stochastic Block Models

A significant portion of modern network traffic analysis still relies on human expertise only. To overcome human limitations in light of increases in volume, dynamicity, and overall traffic complexity, modern networks need to autonomously gain an understanding of traffic patterns and present them in an interpretable way. This work presents T-MAW, an approach for Traffic Monitoring and Analysis using Weighted Stochastic Block Models (WSBMs). T-MAW applies WSBMs to network data to create traffic characterizations in human-interpretable form. In addition to the insights gained from the fitted models, T-MAW evaluates unseen traffic against these models to perform anomaly detection. Both, network node behavior characterization and anomaly detection complement human expertise in modern network traffic analysis. As an example, we show how T-MAW can be used to create a behavior-based structured view of network nodes in a real campus network. In the anomaly detection context, we present results for an IP scan attack against the network, as well as from a layer-2 device fault that caused network disruption.