Testing DTF method for applicability in a real environment

Abstract

This paper demonstrates the effectiveness of DTF method, by examining real traffic, collected from a large number of computers. The Destination Traffic Fingerprint Method, described in detail by the authors in [1][2], focuses on the fact that most computers have a constant traffic to a specific set of IP destinations. This paper presents results of the DTF method applied to real traffic and proves that it is possible to extract a reference fingerprint based on the traffic to constant IP destinations.