Identifying sessions to websites as an aggregation of related flows

In the field of traffic classification, previous efforts have been centered on identifying applications (HTTP, SMTP, FTP, etc) rather than the actual services that they provide (email, file transfer, video streaming, etc.). Nowadays, however, a single application as HTTP can provide multiple services for the end-user. Network traffic for a web-based service is composed by a characteristic pattern of flows rather than characteristic individual flows. In this paper we study the traffic of different web-based services (webmail, social networks, video streaming and online newspapers) as summarized by Netflow-type records. A method that clusters flows that belong to the same web session using only the data provided by those records is also proposed. The obtained clusters will contain more information about the service whose traffic they comprise, and thus it will be easier to assign those clusters to the right service.