As the prevalence of novel applications (peer-to-peer, real-time media, VoIP, etc.) and the manifestation of growing malicious activity transform the nature of the Internet traffic, collection and interpretation of empirical Internet data remains a critical yet challenging task. While measurement provides the only accurate source of information regarding the usage of the network resources, the community no longer enjoys the fleeting benefit of traditional network traffic, which was relatively easily profiled due to the existence of limited applications with well-defined structure.

My work addresses the challenge of profiling the "unknown" by focusing on robust network measurements and characterization of network traffic in the face of a constantly changing traffic mix. In this talk, I will introduce a novel perspective into the analysis of Internet traffic based on two key elements: a) shifting the focus from modeling the statistics of the individual network flows to studying the behavior of the Internet host, and b) understanding the intrinsic properties of application connection patterns. I will further describe how such an approach can be successfully applied to the identification of peer-to-peer traffic and in general to the characterization of the majority of popular applications in today's Internet. Finally, I will briefly discuss the implications of my work on different aspects of the network (e.g., content distribution), and how this concept of traffic modeling stimulates interesting new directions for future research in various areas, such as security and network management and configuration.