A hybrid packet clustering approach for NAT host analysis

For a number of reasons, including the shortage of IPv4 addresses, many hosts are connected to the Internet through NAT devices. NAT devices effectively anonymize the origin of communication traffic, and remove many identifying features, which makes it difficult to isolate web traffic into mutually disjoint same-host sets called packet groups. However, ISPs or network supervisors can do product suggestions, targeted advertising, and online criminal detection by analyzing the packet group of one host. In this paper, we provide a hybrid packet clustering approach that can cluster NAT host's packets into packet groups. Our hybrid approach could group an NAT host's traffic from visiting different websites and would not suffer from bad network communications or anonymizing behavior of NAT devices. We use our isolating method on datasets obtained from two local area networks and both of them can get good results that accuracy is more than 90% and coverage is more than 50%.