用流程挖掘分析游戏网络流量，自动识别游戏类型并建模行为状态。
Network Traffic Analysis with Process Mining: The UPSIDE Case Study
- 基于流程挖掘从游戏流量中无监督提取行为状态
- 将状态编码为可解释的佩特里网，准确区分两款游戏
- 适合网络安全与网络行为分析研究者参考
在线游戏是涉及复杂系统与网络基础设施的流行活动，其带来的巨大市场收入推动了对网络设备行为建模的研究，以评估带宽消耗、预测高负载及检测恶意活动。在此背景下，流程挖掘因其结合数据驱动分析与模型化洞察的能力而展现出潜力。本文提出一种基于流程挖掘的方法，用于分析游戏网络流量：实现对游戏网络数据中不同状态的无监督表征；通过流程挖掘将这些状态编码为可解释的佩特里网；并分类网络流量以识别正在运行的不同视频游戏。该方法应用于UPSIDE案例研究，涵盖多个设备与两款游戏（Clash Royale 和 Rocket League）的交互数据。结果表明，游戏网络行为可通过佩特里网有效且可解释地建模，状态表示具有充分的一致性与特异性，同时对两种游戏的分类准确率良好。
原文摘要 · Abstract (English)
Online gaming is a popular activity involving the adoption of complex systems and network infrastructures. The relevance of gaming, which generates large amounts of market revenue, drove research in modeling network devices' behavior to evaluate bandwidth consumption, predict and sustain high loads, and detect malicious activity. In this context, process mining appears promising due to its ability to combine data-driven analyses with model-based insights. In this paper, we propose a process mining-based method that analyzes gaming network traffic, allowing: unsupervised characterization of different states from gaming network data; encoding such states through process mining into interpretable Petri nets; and classification of gaming network traffic data to identify different video games being played. We apply the method to the UPSIDE case study, involving gaming network data of several devices interacting with two video games: Clash Royale and Rocket League. Results demonstrate that the gaming network behavior can be effectively and interpretably modeled through states represented as Petri nets with sufficient coherence and specificity while maintaining a good classification accuracy of the two different video games.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。