FENet: Roles Classification of IP Addresses Using Connection Patterns

Abstract

It is valuable to classify IP address roles based on network traffic behavior for network security analysis. Many previous studies have focused on coarse-grained classification (e.g., servers, clients and P2P, and so on.), these do not meet the increasingly diverse needs of applications. In this paper, we propose a novel approach for learning the continuous feature representation of connection patterns that we call FENet, which focuses on the low-dimensional embedding of IP address connection features. Thus, we trained two-tier neural networks that classified IP address roles in the given network dataset. Our approach can achieve more fine granularity representation and classification of IP address roles. Experimental results demonstrate the effectiveness of FENet over existing state-of-the-art techniques. In several real-world networks from active IP addresses, we have achieved very high classification accuracy and stability.