Monitoring network traffic and detecting unwanted applications has become a challenging problem, since many applications obfuscate their traffic using unregistered port numbers
or payload encryption. Apart from some notable exceptions,
most traffic monitoring tools use two types of approaches:
(a) keeping traffic statistics such as packet sizes and interarrivals, flow counts, byte volumes, etc., or (b) analyzing
packet content. In this paper, we propose the use of Traffic
Dispersion Graphs (TDGs) as a way to monitor, analyze,
and visualize network traffic. TDGs model the social behavior of hosts (“who talks to whom”), where the edges can be
defined to represent different interactions (e.g. the exchange
of a certain number or type of packets). With the introduction of TDGs, we are able to harness a wealth of tools and
graph modeling techniques from a diverse set of disciplines
