{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:36:14Z","timestamp":1750221374759,"version":"3.41.0"},"reference-count":13,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2017,10,25]],"date-time":"2017-10-25T00:00:00Z","timestamp":1508889600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGCOMM Comput. Commun. Rev."],"published-print":{"date-parts":[[2017,10,25]]},"abstract":"<jats:p>The analysis of flow traces can help to understand a network's usage patterns. We present a hierarchical clustering algorithm for network flow data that can summarize terabytes of IP traffic into a parsimonious tree model. The method automatically finds an appropriate scale of aggregation so that each cluster represents a local maximum of the traffic density from a block of source addresses to a block of destination addresses. We apply this clustering method on NetFlow data from an enterprise network, find the largest traffic clusters, and analyze their stationarity across time. The existence of heavy-volume clusters that persist over long time scales can help network operators to perform usage-based accounting, capacity provisioning and traffic engineering. Also, changes in the layout of hierarchical clusters can facilitate the detection of anomalies and significant changes in the network workload.<\/jats:p>","DOI":"10.1145\/3155055.3155063","type":"journal-article","created":{"date-parts":[[2017,10,26]],"date-time":"2017-10-26T14:19:33Z","timestamp":1509027573000},"page":"48-53","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Hierarchical IP flow clustering"],"prefix":"10.1145","volume":"47","author":[{"given":"Kamal","family":"Shadi","sequence":"first","affiliation":[{"name":"Georgia Institute of Technology"}]},{"given":"Preethi","family":"Natarajan","sequence":"additional","affiliation":[{"name":"Cisco Systems"}]},{"given":"Constantine","family":"Dovrolis","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology"}]}],"member":"320","published-online":{"date-parts":[[2017,10,25]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1281192.1281197"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/361002.361007"},{"key":"e_1_2_1_3_1","first-page":"2011","article-title":"Numerical differentiation of noisy, nonsmooth data","author":"Chartrand R","year":"2011","unstructured":"Chartrand , R . Numerical differentiation of noisy, nonsmooth data . ISRN Applied Mathematics 2011 ( 2011 ). Chartrand, R. Numerical differentiation of noisy, nonsmooth data. ISRN Applied Mathematics 2011 (2011).","journal-title":"ISRN Applied Mathematics"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/863955.863972"},{"key":"e_1_2_1_5_1","first-page":"226","volume-title":"Kdd","volume":"96","author":"Ester M.","year":"1996","unstructured":"Ester , M. , Kriegel , H.-P. , Sander , J. , Xu , X. , A density-based algorithm for discovering clusters in large spatial databases with noise . In Kdd ( 1996 ), vol. 96 , pp. 226 - 231 . Ester, M., Kriegel, H.-P., Sander, J., Xu, X., et al. A density-based algorithm for discovering clusters in large spatial databases with noise. In Kdd (1996), vol. 96, pp. 226-231."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2006.227"},{"key":"e_1_2_1_7_1","first-page":"6","article-title":"An efficient clustering scheme to exploit hierarchical data in network traffic analysis. Knowledge and Data Engineering","volume":"20","author":"Mahmood A. N.","year":"2008","unstructured":"Mahmood , A. N. , Leckie , C. , and Udaya , P . An efficient clustering scheme to exploit hierarchical data in network traffic analysis. Knowledge and Data Engineering , IEEE Transactions on 20 , 6 ( 2008 ), 752-767. Mahmood, A. N., Leckie, C., and Udaya, P. An efficient clustering scheme to exploit hierarchical data in network traffic analysis. Knowledge and Data Engineering, IEEE Transactions on 20, 6 (2008), 752-767.","journal-title":"IEEE Transactions on"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1070873.1070876"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1096536.1096551"},{"key":"e_1_2_1_10_1","unstructured":"Shadi K. https:\/\/github.com\/kamalshadi\/mfc.  Shadi K. https:\/\/github.com\/kamalshadi\/mfc."},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/72.846731"},{"key":"e_1_2_1_12_1","first-page":"10","article-title":"Efficient mining of the multidimensional traffic cluster hierarchy for digesting, visualization, and anomaly identification. Selected Areas in Communications","volume":"24","author":"Wang J.","year":"2006","unstructured":"Wang , J. , Miller , D. J. , and Kesidis , G . Efficient mining of the multidimensional traffic cluster hierarchy for digesting, visualization, and anomaly identification. Selected Areas in Communications , IEEE Journal on 24 , 10 ( 2006 ), 1929-1941. Wang, J., Miller, D. J., and Kesidis, G. Efficient mining of the multidimensional traffic cluster hierarchy for digesting, visualization, and anomaly identification. Selected Areas in Communications, IEEE Journal on 24, 10 (2006), 1929-1941.","journal-title":"IEEE Journal on"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028802"}],"container-title":["ACM SIGCOMM Computer Communication Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3155055.3155063","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3155055.3155063","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:26:40Z","timestamp":1750213600000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3155055.3155063"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,10,25]]},"references-count":13,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2017,10,25]]}},"alternative-id":["10.1145\/3155055.3155063"],"URL":"https:\/\/doi.org\/10.1145\/3155055.3155063","relation":{},"ISSN":["0146-4833"],"issn-type":[{"type":"print","value":"0146-4833"}],"subject":[],"published":{"date-parts":[[2017,10,25]]},"assertion":[{"value":"2017-10-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}