Ali Safari KhatouniLan ZhangKhurram AzizIbrahim ZincirZhang, LanZincir, IbrahimKhatouni, Ali SafariAziz, KhurramZincir-Heywood, NurH. Lutfiyya , Y. Diao , N. Zincir-Heywood , R. Badonnel , E. Madeira2025-10-06201997839031762492165-960510.23919/CNSM46954.2019.90126842-s2.0-85078840366https://www.scopus.com/inward/record.uri?eid=2-s2.0-85078840366&doi=10.23919%2FCNSM46954.2019.9012684&partnerID=40&md5=7df5fe82bae58c88b4512f4565dc2937https://gcris.yasar.edu.tr/handle/123456789/9359https://doi.org/10.23919/cnsm46954.2019.9012684https://doi.org/10.23919/CNSM46954.2019.9012684The usage of Network Address Translation (NAT) devices is common among end users organizations and Internet Service Providers. NAT provides anonymity for users within an organization by replacing their internal IP addresses with a single external wide area network address. While such anonymity provides an added measure of security for legitimate users it can also be taken advantage of by malicious users hiding behind NAT devices. Thus identifying NAT devices and hosts behind them is essential to detect malicious behaviors in traffic and application usage. In this paper we propose a machine learning based solution to detect hosts behind NAT devices by using flow level statistics (excluding IP addresses port numbers and application layer information) from passive traffic measurements. We capture a large dataset and perform an extensive evaluation of our proposed approach with four existing approaches from the literature. Our results show that the proposed approach could identify NAT behaviors and hosts not only with higher accuracy but also demonstrates the impact of parameter sensitivity of the proposed approach. © 2020 Elsevier B.V. All rights reserved.Englishinfo:eu-repo/semantics/closedAccessInternet Protocols, Large Dataset, Machine Learning, Flow Level, Ip Addresss, Legitimate Users, Malicious Behavior, Network Address Translations, Parameter Sensitivities, Port Numbers, Traffic Measurements, Wide Area NetworksInternet protocols, Large dataset, Machine learning, Flow level, IP addresss, Legitimate users, Malicious behavior, Network address translations, Parameter sensitivities, Port numbers, Traffic measurements, Wide area networksConference Object