Identifying Different Behaviours Behind the Network Address Translation / Proxy Systems

The usage of Network Address Translation (NAT) and/or Network Proxy systems is very common among thedevices such as computers, laptops and smart phones connecting to the Internet. These systems act as an agentbetween the Internet and a private network, e.g. user's local area network. This means that only a single IPaddress is required to represent one or more computers (users) to the rest of the Internet. Thus, NATs/Proxiesare used for many reasons including a solution to the shortage of IPv4 addresses, security, or anonymity. In thisresearch, our goal is to explore whether we can find specific patterns in the network traffic that will enable usto identify NAT/Proxy like behaviors and the different users and services behind them. In doing so, we aim todifferentiate malicious usage of these systems from legitimate usage.