Classification of IP hosts using NetFlow

Classification of IP hosts using NetFlow


Master’s thesis


This work aims at developing a classifier that is able to distinguishing between client/server and peer-to-peer (i.e. client/client, server/server) communication on a per-host level based on information provided in or derivable from NetFlow version 5. More specifically, the classifier should be able to decide whether a specific IP address, for a flow or set of flows given, shows typical client or server behaviour and whether the flow corresponds to a client/server or a peer-to-peer connection.

This work directly contributes to our BMBF funded research project INSAIN.


  • Knowledge in the ML/pattern recognition area
  • Good coding skills (C, Python, Java) and/or knowledge of GNU R
  • Good knowledge of prevalent Internet protocols and standards
  • Very good in German or good in English language
  • Linux skills are a plus
  • Creativity and ability to work independently
  • Willingness to actively communicate with peers

Working condition

Flexible, no presence required. Home office is possible. Details will be discussed in regular personal meetings. Working place at CASED or h_da can be offered if required/wished.


Sebastian Abt