Communities of interest (COI) have been applied in a variety of envi-
ronments ranging from characterizing the online buying behavior of individuals
to detecting fraud in telephone networks. The common thread among these ap-
plications is that the historical COI of an individual can be used to predict future
behavior as well as the behavior of other members of the COI. It would clearly be
beneficial if COIs can be used in the same manner to characterize and predict the
behavior of hosts within a data network. In this paper, we introduce a methodol-
ogy for evaluating various aspects of COIs of hosts within an IP network. In the
context of this study, we broadly define a COI as a collection of interacting hosts.
We apply our methodology using data collected from a large enterprise network
over a eleven week period. First, we study the distributions and stability of the
size of COIs. Second, we evaluate multiple heuristics to determine a stable core
set of COIs and determine the stability of these sets over time. Third, we evaluate
how much of the communication is not captured by these core COI sets.
www.research.att.com
