Thomas Karagiannis                                       Curriculum Vitae


Microsoft Research

15 JJ Thomson Ave

Cambridge, UK









Research Interests

  • Internet measurements and monitoring.
  • Analysis and modeling of Internet traffic dynamics.
  • Traffic analysis, identification and classification of Internet applications (e.g., web, peer-to-peer, streaming, etc.)
  • Peer-to-peer networks: Measurements, characterization and identification of peer-to-peer Internet traffic; economics of peer-to-peer networks.
  • Security: Intrusion detection and prevention methodologies for large enterprise networks.




2000  - 2006

Ph.D. in Computer Science at the University of California, Riverside.

Supervised by Associate Professor Michalis Faloutsos.

Dissertation Title: Novel Techniques and Models for Network Traffic Profiling: Characterizing the Unknown.


1996 - 2000

B.S. at the University of Macedonia, Greece.

Department of Applied Informatics with GPA 8.8/10 (Excellent).




Conference Publications

  • Planet Scale Software Updates

Christos Gkantsidis, Thomas Karagiannis, Pablo Rodriguez, Milan Vojnovic
ACM SIGCOMM, Pisa, Italy, September 2006.


  • Should Internet Service Providers Fear Peer-Assisted Content Distribution?

Thomas Karagiannis, Pablo Rodriguez, Dina Papagiannaki
ACM/USENIX Internet Measurement Conference (IMC), Berkeley, CA, October, 2005


  • BLINC: Multilevel Traffic Classification in the Dark.

Thomas Karagiannis, Dina Papagiannaki, Michalis Faloutsos

ACM SIGCOMM, Philadelphia, PA, USA, August 2005.


  • Transport layer identification of p2p traffic.

      Thomas Karagiannis, Andre Broido,  Michalis Faloutsos, kc claffy

ACM/USENIX Internet Measurement Conference (IMC), Taormina, Italy, October, 2004.


  • Is P2P dying or just hiding?

      Thomas Karagiannis, Andre Broido, Nevil Brownlee, kc claffy, Michalis Faloutsos

      IEEE GLOBECOM, Global Internet/Next Generation Networks, Dallas, TX, Nov. 2004.


  • A Nonstationary Poisson View of Internet Traffic.
    Thomas Karagiannis, Mart Molle, Michalis Faloutsos, Andre Broido
    Hong Kong, March 2004.


·         Long-Range Dependence: Now you see it, now you don’t!

Thomas Karagiannis, Michalis Faloutsos, Rudolf H. Riedi

IEEE GLOBECOM, Global Internet Symposium, Taipei, Taiwan, November 17-21, 2002.



Journal Articles

  • Long-range dependence: Ten years of Internet traffic modeling.

Thomas Karagiannis, Mart Molle, Michalis Faloutsos

 IEEE Internet Computing, Special Issue -- Measuring the Internet, September, 2004.


  • A User-Friendly Self-Similarity Analysis Tool.

Thomas Karagiannis, Michalis Faloutsos, Mart Molle

ACM SIGCOMM Computer Communication Review, Special issue -- Tools and technologies for networking research and education, 2003.



Technical Reports

  • BLINC: Multilevel Traffic Classification in the Dark.

Thomas Karagiannis, Dina Papagiannaki, Michalis Faloutsos

Technical report (January 2005)

  • File-sharing in the Internet: A characterization of P2P traffic in the backbone.

Thomas Karagiannis, Andre Broido, Nevil Brownlee, Kc Claffy, Michalis Faloutsos

Technical report (November 2003)



Honors and Awards

  • Chancellor’s Distinguished Fellowship offered by UC, Riverside (2000).
  • Scholarship from the Greek State Scholarships Foundation (1996).

(Top score in the Greek National Examinations out of approx. 150,000 participants.)

  • Scholarship from the Greek Telecommunications Organization (1999, 2000).

(Awarded to the top three students of the dept. of Applied Informatics,

 Univ. of Macedonia, Greece.)

  • Annual awards from the Greek State Scholarships Foundation (1996 - 2000).

(Awarded to the top three students of the dept. of Applied Informatics,

 Univ. of Macedonia, Greece.)



Invited talks and acclaims

  • Press interviews: Wired magazine and MIT Technology Review on trends of peer-to-peer file-sharing networks.
  • News and articles: The peer-to-peer measurement work appeared in numerous articles in newspapers, professional

 magazines and Internet news sites such as USA Today – “The rise and fall (?) of P2P music downloading”,

Advisory Committee Congressional Internet Caucus, Electronic Frontier Foundation, ACM tech news, and others.

  • Courses syllabus: The papers on peer-to-peer traffic measurements and traffic analysis have been included in the reading

material of computer science and law courses (e.g., Infosys 296A section 2, School of Information Management and Systems,

UC Berkeley, CPSC 641: Performance issues in High Speed Networks, Univ. of Calgary, Advanced Computer Networks, Univ. of Delaware, etc.).

  • NANOG Fall 2005: BLINC: Multilevel Traffic Classification in the Dark.
  • NANOG Fall 2005: Should Internet Service Providers Fear Peer-Assisted Content?
  • ISMA 2004 Workshop on Internet Signal Processing (WISP)
  • SAMSI Workshop on Congestion Control and Heavy Traffic Modeling (2003)



Work and Research Experience

September 2006

Microsoft Research. Associate Researcher.

Traffic modeling and characterization, P2P networks, end-host profiling, security and anomaly detection.

July 2006-August 2006

Foundation for Research and Technology, Hellas. (Visiting Researcher)

Application classification of WLAN traffic, characterization and profiling of mobile users.

October 2005 –

April 2006


Intel Research at Cambridge.  (internship)

Anomaly detection and security for enterprise networks through end-host profiling. Proposed a novel methodology to profile individual host behavior through a graph-based footprint that generates a compact, robust and intuitive description of the behavior with the goal of anomaly detection.

June 2005 –

September 2005


Microsoft Research at Cambridge. (internship)

Analysis of the properties of Microsoft's patching service with a goal to design a system for rapid patch propagation. Analyzed patch-request patterns and user profiles, and studied the benefits and impact of alternative architectures for efficient patch distribution such as peer-to-peer and caching.

July 2004 –

May 2005


Intel Research at Cambridge.  (internship)

Characterization, analysis, traffic profiling and classification of Internet applications. Proposed and implemented a novel methodology for traffic flow classification according to the applications that generate them based on exploiting host-interactions and traffic patterns at the end-hosts.

Peer-to-peer networks: Analysis of the impact of peer-assisted content distribution on Internet service providers, content providers and end-users based on real Internet traces.

July 2003 –

September 2003

Cooperative Association for Internet Data Analysis (CAIDA).(internship)

Identification, measurement and characterization of peer-to-peer traffic in the Internet backbone. Proposed and implemented payload-based and transport-layer based methodologies for the identification of peer-to-peer file-sharing traffic at the Internet backbone.


March 2001 –

July 2004

University of California, Riverside.

Research Assistant at the Networking & Communications Laboratory.

Analysis and modeling of Internet traffic dynamics: Studied the self-similar and long-memory properties of Internet traffic at the backbone and proposed the modeling of backbone traffic as a nonstationary Poisson process.



University of Macedonia, Greece.

Career and Liaison office, Full-time. Technical support and supervision of student internships. Design and implementation of intern database.


July 1997 –

October 1997

National Bank of Greece.

Department of Commercial Loans. Risk analysis and assessment.




Teaching Experience


University of California, Riverside. Teaching Assistant.

Principles of Programming Languages, Intermediate Data Structures & Algorithms.



University of Macedonia, Greece. Teaching Assistant.

Dept. of International & European Economic & Political Studies.

MS Windows, MS Office.



Software Development

  • The SELFIS tool: Designed and implemented the SELF-similarity analysIS software tool.

SELFIS is a java-based tool for the analysis of the self-similar and long-range dependence

properties of time-series with focus on networking. It has been downloaded over

600 times and is in use by researchers spanning various disciplines and institutions. 



  • BLINC: Designed and implemented the BLINd Classification tool, a multilevel transport-layer

 methodology to classify Internet traffic flows according to the applications that generate

 them without the knowledge of port numbers or the use of payload signatures.

BLINC was implemented in C++.


  • PTP: Design and implementation of the P2P Traffic Profiling tool.  The PTP tool is a methodology

 for the identification of P2P file-sharing traffic at the transport-layer without the use

 of payload signatures and is implemented in C++ and Python.


  • Peer-to-peer file-sharing and application-specific protocol dissectors: Reverse-engineering,

design and implementation of payload signature-based traffic identification of the nine most popular

 file-sharing peer-to-peer networks (Kazaa, Gnutella, BitTorrent, eDonkey, Ares, WinMx, OpenNap,

 Soulseek, MP2P). Identification of the traffic of the majority of Internet applications (web, streaming,

 ftp, chat, mail, news, gaming, etc).

 Implemented in C/C++ on top of the CoralReef Internet Traffic monitoring software suite.



Professional service

  • Member of ACM Sigcomm shadow PC (2005).
  • Journal referee for JSAC special issue on “High-speed Network Security – Architecture,

 Algorithms and Implementation” (2005) , Performance Evaluation special issue on

Long-Range Dependence and Heavy Tail Distributions (2004),

 IEEE Transactions on Signal Processing (2003), Machine Learning (2004).

  • Referee for IEEE Infocom (2004, 2005, 2006), Globecom-Global Internet and Next Generation Networks (2004),

1st EuroNGI Conference on Next Generation Internet Networks - Traffic Engineering (2005), COMSWARE (2006).



Personal Information






  • English (Cambridge First Certificate in English & Cambridge Certificate of Proficiency in English)
  • German (Grundstufe & Mittelstufe)
  • Greek



  • Available on request