CobWeb: A System for Automated In-Network Cobbling of Web Service Traffic

We consider the problem of in-network categorization of all traffic associated with a given set of web services. While this problem can be viewed as a generalization of per-session traffic monitoring, a key difficulty is that we have to construct the entire session tree that represents the transitive closure of all traffic downloaded as a result of a user accessing a given web service. Such in-network session tree construction and monitoring is useful for many measurement, monitoring, and new types of billing services such as ‘reverse billing’ where usage charges are paid for by either the service provider or the ISP itself as an incentive to the user. Automated construction of the session tree based on network traffic observation is challenging and to our knowledge unaddressed. The challenges arise due to the complexities inherent in today’s web services and the lack of universal standards that are followed when designing web services. This necessitates the use of heuristics that rely upon prevalent web service design practices. In this paper, we present a system, called COBWEB, that performs this automated innetwork cobbling and monitoring of web services traffic. We evaluate the classification accuracy of COBWEB by extensive experimentation using controlled downloads and by analysis of about 100 popular web sites using large traffic traces (over 700 GB) collected at a major university’s gateway. Our experiments suggests that COBWEB can achieve good accuracy with low (< 5%) false positive and negative rates.