Characterizing cyberlocker traffic flows

Cyberlockers have recently become a very popular means of distributing content. Today, cyberlocker traffic accounts for a non-negligible fraction of the total Internet traffic volume, and is forecasted to grow significantly in the future. The underlying protocol used in cyberlockers is HTTP, and increased usage of these services could drastically alter the characteristics of Web traffic. In light of the evolving nature of Web traffic, updated traffic models are required to capture this change. Despite their popularity, there has been limited work on understanding the characteristics of traffic flows originating from cyberlockers. Using a year-long trace collected from a large campus network, we present a comprehensive characterization study of cyberlocker traffic at the transport layer. We use a combination of flow-level and host-level characteristics to provide insights into the behavior of cyberlockers and their impact on networks. We also develop statistical models that capture the salient features of cyberlocker traffic. Studying the transport-layer interaction is important for analyzing reliability, congestion, flow control, and impact on other layers as well as Internet hosts. Our results can be used in developing improved traffic simulation models that can aid in capacity planning and network traffic management.