Williamson, CareyArlitt, MartinHaffey, Mackenzie2017-08-232017-08-2320172017http://hdl.handle.net/11023/4030This thesis focuses on characterizing periodic communications in network traffic, which we refer to as network heartbeats. Heartbeat traffic can be used to assess the overall health of an operational network, based on the presence/absence of heartbeats for known network services, and also to detect unexpected/undesired network services, such as malicious traffic. We use a simple and flexible SQL-based method to detect a wide range of heartbeats in network traffic, using seven weeks of connection logs from a campus edge network. Our results show that heartbeat analysis is effective for detecting P2P, gaming, cloud, scanning, and botnet traffic flows, which often have periodic signatures.engUniversity of Calgary graduate students retain copyright ownership and moral rights for their thesis. You may use this material in any way that is permitted by the Copyright Act or through licensing that has been assigned to the document. For uses that are not allowable under copyright legislation or licensing, you are required to seek permission.Computer SciencePeriodicHeartbeatNetworksMeasurementmaster thesis10.11575/PRISM/25285