Fast and Configurable Detection of Device Dependencies in Network Traffic

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F25%3A00142396" target="_blank" >RIV/00216224:14330/25:00142396 - isvavai.cz</a>

Result on the web

<a href="https://opendl.ifip-tc6.org/db/conf/cnsm/cnsm2025/1571195022.pdf" target="_blank" >https://opendl.ifip-tc6.org/db/conf/cnsm/cnsm2025/1571195022.pdf</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.23919/CNSM67658.2025.11297543" target="_blank" >10.23919/CNSM67658.2025.11297543</a>

Result language

angličtina

Original language name

Fast and Configurable Detection of Device Dependencies in Network Traffic

Original language description

Device dependencies are recurring communication patterns between IP addresses that reveal how networked entities rely on one another. Understanding these relationships is essential for reliability, troubleshooting, and security, yet detecting them efficiently from operational traffic remains challenging. We propose a fast and accurate tool for dependency detection from passive flow-level data using a link prediction approach. In contrast to the prior implementation, the tool introduces a parallelized processing pipeline with early termination of stalled random walks, an expanded feature set that combines embedding-derived and graph-theoretic metrics, and a fully externalized configuration of sampling, embedding, and classification parameters. These design choices enable scalable execution and more reliable identification of dependencies across diverse network environments. Evaluation on synthetic traffic from cyber-defense exercises and real-world campus flows demonstrates up to 100$times$ faster runtime and markedly higher classification accuracy compared to the prior implementation. Further analysis shows that structural graph features improve stability in sparse settings, while extended embedding training enhances accuracy in low-signal scenarios. Together, these results confirm that the proposed tool advances link prediction-based dependency detection toward practical, near-real-time use.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10200 - Computer and information sciences

Project

—

Continuities

S - Specificky vyzkum na vysokych skolach

Publication year

2025

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

21st International Conference on Network and Service Management

ISBN

9783903176751

ISSN

—

e-ISSN

—

Number of pages

6

Pages from-to

1-6

Publisher name

IEEE

Place of publication

New York, NY

Event location

Bologna

Event date

Oct 27, 2025

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—