A Novel Device Identification Method Based on Passive Measurement

Algorithm 1

Process of server-like node detection.

Input: : Graph based on netflow; : Select the front section to filter nodes;

eps: Neighbor radius to form a density area; minPts: Minimum number to form

a high density area;

Output:  Label of nodes: server or terminal;

1:

2:

3: for each node in do

4://calculate average neighbor degree of the node

5: Put in list

6: sorting node according to //ascending order

7: of the front node in H//filtering nodes

8:

9: for each in do

10://calculate stronghold index of the node

11://calculate degree of the node

12: Put in list C

13: Running DBSCAN with eps and minPts//with dataset

14: return outliers//outlier represent Server, others represent Terminal