Answers are grounded in this paper and cite their sources.
Existing traffic analysis tools focus on traffic volume. They identify the heavy-hitters - flows that exchange high volumes of data, yet fail to identify the structure implicit in network traffic - do certain flows happen before, after or along with each other repeatedly over time? Since most traffic is generated by applications (web browsing, email, p2p), network traffic tends to be governed by a set of underlying rules. Malicious traffic such as network-wide scans for vulnerable hosts (mySQLbot) also presents distinct patterns.
No takes yet. Share an insight, caveat, or question.
Kandula et al. (2008) studied this question.
Synapse has enriched 3 closely related papers on similar clinical questions. Consider them for comparative context: