Social Network Behaviour Inferred from O-D Pair Traffic

Main Article Content

Mostfa Mohsin Albdair
Ronald Addie
David Fatseas


Social Network, Origin–Destination, Traffic Matrix, Principal Component Analysis


All network traffic is a by-product of social networking behaviour. In this paper, Anonymized Internet (IP) Trace Datasets obtained from the Center for Applied Internet Data Analysis (CAIDA) have been used to identify and estimate characteristics of the underlying social network from the overall traffic. The analysis methods used here fall into two groups, the first being based on frequency analysis and second method being based on the use of traffic matrices, with the later analysis method being further sub-divided into groups based on the traffic mean, variance and co-variance. The frequency analysis of origin (O), destination (D) and O-D Pair statistics exhibit heavy tailed behaviour. Because the large number of IP addresses contained in the CAIDA Datasets, only the most predominate IP Addresses are used when estimating all three sub-divided groups of traffic matrices. Principal Component Analysis (PCA) and related methods are applied to identify key features of each type of traffic matrix. A new system called Antraff has been developed to carry out all the analysis procedures.

Abstract 287 | PDF Downloads 1 HTML Downloads 0


Adas, A. (1997, Jul). Traffic models in broadband networks. Communications Magazine, IEEE, 35(7), 82-89. doi: 10.1109/35.601746

Addie, R. G. (2016). Antraff traffic analysis software user manual (Tech. Rep.). USQ.

The CAIDA UCSD Anonymized Internet Traces 2014 - [20140320]. (n.d.). Retrieved from

Center for applied internet data analysis. (2016). (

Chandrasekaran, B. (2009). Survey of network traffic models. Waschington University in St. Louis CSE, 567.

Crovella, M., & Bestavros, A. (1997). Self-similarity in world wide web traffic: Evidence and possible causes. IEEE/ACM Transactions on Networking, 5(6), 835–846.

Erramill, V., Crovella, M., & Taft, N. (2006). An independent-connection model for traffic matrices. In Proceedings of the 6th acm sigcomm conference on internet measurement (pp. 251–256).

Fan, J., Xu, J., Ammar, M. H., & Moon, S. B. (2004). Prefix-preserving ip address anonymization: measurement-based security evaluation and a new cryptography-based scheme. Computer Networks, 46(2), 253–272.

Lakhina, A., Papagiannaki, K., Crovella, M., Diot, C., Kolaczyk, E. D., & Taft, N. (2004). Structural analysis of network traffic flows. In Acm sigmetrics performance evaluation review (Vol. 32, pp. 61–72).

Ringberg, H., Soule, A., Rexford, J., & Diot, C. (2007). Sensitivity of PCA for traffic anomaly detection. ACM SIGMETRICS Performance Evaluation Review, 35(1), 109–120.

Susitaival, R., Juva, I., Peuhkuri, M., & Aalto, S. (2006). Characteristics of origin-destination pair traffic in funet. Telecommunication Systems, 33(1-3), 67–88.

Tsybakov, B., & Georganas, N. D. (1998, September). Self-similar processes in communications networks. IEEE Transactions on Information Theory, 44(5), 1713–1725.

Vardi, Y. (1996). Network tomography: Estimating source-destination traffic intensities from link data. Journal of the American Statistical Association, 91(433), 365-377.