Investigating the fractal nature of individual user netflow data

Modeling and characterizing Internet traffic has been a widely studied problem since the conception of the Internet. The self-similar, bursty nature of the traffic has led to a number of conventional statistical models that unfortunately provide relatively weak modeling power. Recently, fractal analysis techniques have emerged to better characterize and model Internet traffic data. However, past research studies have focused on describing and quantifying the fractal nature of Internet traffic on user groups, instead of a single user. In this paper the authors investigate the issue of individual users exhibiting fractal (self-similar behavior) behavior across multiple application types. Using real Internet traffic traces (collected via Net-Flow logs) collected at a college campus for 30 days, our investigations reveal that in a number of application categories (http, chatting, p2p, email etc.) at least one user exhibits long-range correlations typical of fractal behavior. Of the 10 application groups, 7 had over 80% of users demonstrating self-similar behavior with 3 of those groups having > 98%. Potential benefits of our study in the realm of smart health and network security, by reducing the dimensionality of large Internet traffic datasets, are discussed.