Identify P2P Traffic by Inspecting Data Transfer Behaviour

Authors:
Mingjiang Ye;Jianping Wu;Ke Xu;Dah Ming Chiu
Affiliations:
Tsinghua National Laboratory for Information Science and Technology, Department of Computer Science, Tsinghua University, Beijing, P.R. China 100084;Tsinghua National Laboratory for Information Science and Technology, Department of Computer Science, Tsinghua University, Beijing, P.R. China 100084;Tsinghua National Laboratory for Information Science and Technology, Department of Computer Science, Tsinghua University, Beijing, P.R. China 100084;Dept. of Information Engineering, The Chinese University of Hong Kong, Hong Kong, P.R. China
Venue:
NETWORKING '09 Proceedings of the 8th International IFIP-TC 6 Networking Conference
Year:
2009

Citing 15
Cited 1

A low-bandwidth network file system

SOSP '01 Proceedings of the eighteenth ACM symposium on Operating systems principles
Accurate, scalable in-network identification of p2p traffic using application signatures

Proceedings of the 13th international conference on World Wide Web
Transport layer identification of P2P traffic

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Internet traffic classification using bayesian analysis techniques

SIGMETRICS '05 Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
BLINC: multilevel traffic classification in the dark

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
ACAS: automated construction of application signatures

Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data
A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification

ACM SIGCOMM Computer Communication Review
Comprehensive view of a live network coding P2P system

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Unexpected means of protocol inference

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Autograph: toward automated, distributed worm signature detection

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Semi-supervised network traffic classification

Proceedings of the 2007 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
Comparing traffic classifiers

ACM SIGCOMM Computer Communication Review
Revealing skype traffic: when randomness plays with you

Proceedings of the 2007 conference on Applications, technologies, architectures, and protocols for computer communications
Toward the accurate identification of network applications

PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement
Self-Learning IP traffic classification based on statistical flow characteristics

PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement

Network traffic classification via HMM under the guidance of syntactic structure

Computer Networks: The International Journal of Computer and Telecommunications Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

Classifying network traffic according to its applications is important to a broad range of network areas. Since new applications, especially P2P applications, no longer use well-known fixed port numbers, the native port based traffic classification technique has become much less effective. In this paper, we propose a novel approach to identify P2P traffic by leveraging on the data transfer behaviour of P2P applications. The behaviour investigated in the paper is that downloaded data from a P2P host will be uploaded to other hosts later. To find the shared data of downloading flows and uploading flows online, the content based partitioning schema is used to partition the flows into data blocks. Flows sharing the same data blocks are identified as P2P flows. The effectiveness of this method is demonstrated by experiments on various P2P applications. The results show that the algorithm can identify P2P applications very accurately while only keeping a small set of data blocks. The method is generic and can be applied to most P2P applications.