World Wide Web

Discretization

Biology

Identification (biology)

Curse of dimensionality

Data mining

Computer science

Botany

Supervised learning

Mathematics

Flow (mathematics)

Inference

Feature selection

Mathematical analysis

Artificial intelligence

Geometry

Artificial neural network

Session (web analytics)

Unsupervised learning

Machine learning

High level traffic characteristics have the potential to be useful for inference of various host characteristics. This work proposes the novel Flow-Discretize Order (FDO) approach for describing session characteristics in an intuitive manner, while also retaining flow ordering information. The FDO approach allows for flexible construction of flow descriptors, by using different flow properties and applying appropriate discretization. The individual flow descriptors are concatenated to form session descriptors. By utilizing string distance metrics, such as the Damerau-Levenshtein distance (DLD), it is possible to perform both unsupervised and supervised learning on the FDO session descriptors. Here, we utilize FDO as a tool for OS and browser identification coupled to a particular user activity, in this case watching YouTube videos. The variable-length nature of FDO session descriptors precludes learning methods expecting fixed dimensionality from being used. However, experiments show that excellent performance are provided by methods operating on distances such as hierarchical Ward for the unsupervised case, and k-NN for the supervised case. The supervised learning evaluation shows that over 99% accuracy can be achieved for both operating system and browser identification based on video session characteristics. The FDO framework also provides multiple promising avenues for further research and improvements such as improved methods for discretization boundary placement, more elaborate feature selection approaches, and more fine-grained DLD weights.

A Novel Flow-level Session Descriptor With Application to OS and Browser Identification