Abstract—Internet TV sites often use source IP addresses in received packets to identify users or to retrieve user-related information such as organizations, geographic locations, etc. Users, on the other hand, consult a blacklist to check whether packets are from malicious websites or not. Source IP addresses in received packets, however, do not always agree with addresses of true source hosts due to VPN, NAT, proxy technologies, or malicious attacks. To improve end host identification, this paper proposes using video traffic features, which are the decay rates of the aggregated variance, as a signature of a source or destination host. Experimental results show that if sample decay rates of 100 Internet TV sites are given as a training dataset, 94.5% of the TV sites are correctly identified by the naive Bayes classifier.

Index Terms—End host identification, video traffic, decay rate, classifier, information gain

The authors are with the Department of Computer Science and Engineering, Fukuoka Institute of Technology, 3-30-1 Wajiro-Higashi,Higashi-ku, Fukuoka, 811-0295 Japan (e-mail: oida@fit.ac.jp)

Cite: Kazumasa Oida and Kenichi Yamashita, "Video Traffic Attributes for End Host Identification," International Journal of Computer and Communication Engineering vol. 1, no. 4, pp. 396-401 , 2012.