# How can I group the entries of the network traffic by their similarity?

I have the traffic of my network (with hundreds of entries). Below I am showing only 9 entries.

1    ETH: 28:28:5d:fb:88:38 6c:71:d9:8e:88:54 (IP) 97
2    IP: 169.44.99.105 192.168.1.41 5 4 83 16384
3    ETH: 6c:71:d9:8e:88:54 28:28:5d:fb:88:38 (IP) 101
4    IP: 192.168.1.41 169.44.99.105 5 4 87 16384
5    ETH: 28:28:5d:fb:88:38 6c:71:d9:8e:88:54 (IP) 66
6    IP: 169.44.99.105 192.168.1.41 5 4 52 16384
7    ETH: 28:28:5d:fb:88:38 6c:71:d9:8e:88:54 (?) 139
8    ETH: 6c:71:d9:8e:88:54 28:28:5d:fb:88:38 (?) 86
9    ETH: 28:28:5d:fb:88:38 6c:71:d9:8e:88:54 (?) 117


I would like to group these entries by how similar they are among each other. But what should I do to group them? What do I need to do first e.g. to use a clustering algorithm?

i am following this tutorial to get the datas http://yuba.stanford.edu/~casado/pcap/section4.html

here there are a example:

ETH: 0:10:a4:8b:d3:b4 ff:ff:ff:ff:ff:ff (ARP) 42
ETH: 0:20:78:d1:e8:1 0:10:a4:8b:d3:b4 (ARP) 60
ETH: 0:10:a4:8b:d3:b4 0:20:78:d1:e8:1 (IP) 74
IP: 192.168.1.100 134.114.90.1 5 4 60 16384
ETH: 0:20:78:d1:e8:1 0:10:a4:8b:d3:b4 (IP) 60
IP: 134.114.90.1 192.168.1.100 5 4 40 0


Lets try and reconstruct the conversation shall we? my computer: Who has the gateways IP (192.168.1.100)?

ETH: 0:10:a4:8b:d3:b4 ff:ff:ff:ff:ff:ff (ARP) 42
gateway: I do!!
ETH: 0:20:78:d1:e8:1 0:10:a4:8b:d3:b4 (ARP) 60
my computer(through gateway): Hello Mr. 134.114.90.1 can we talk?
ETH: 0:10:a4:8b:d3:b4 0:20:78:d1:e8:1 (IP) 74 IP: 192.168.1.100 134.114.90.1 5 4 60 16384
134.114.90.1: Nope, I'm not listening
ETH: 0:20:78:d1:e8:1 0:10:a4:8b:d3:b4 (IP) 60 IP: 134.114.90.1 192.168.1.100 5 4 40 0

• Hi and welcome to AI SE! Your question is not really clear, could you reframe it explaining better what you are trying to achieve. In particularly the sentence "i have to create patterns to my neural networks" makes no sense written this way, could you explain better what you mean? – Edoardo Guerriero Apr 24 '20 at 14:45
• Ok but to train a classifier you need an input, package's traffic in your case, and a target label, that you don't mention. Do you have also labels, some target classes associated with the packages traffic? – Edoardo Guerriero Apr 24 '20 at 15:54
• @nonosehahaha Are you sure you want to perform supervised learning? As Edoardo said, you need labels to perform supervised learning. Or maybe you want to perform some kind of clustering? Do a little bit of research about "supervised learning" and "unsupervised learning". I will provisionally close this post until you clarify it. Please, edit your post to clarify it. – nbro Apr 25 '20 at 4:01
• @nonosehahaha Please, edit the body of your post to use understandable English. Maybe use Google translate. For example, change this "i have to create patterns of classifier to my neural networks" to say that you actually want to cluster. – nbro Apr 25 '20 at 14:16
• I still don't understand how you want to train the neural network once you have the clusters. – nbro Apr 25 '20 at 16:01