Identify P2P traffic by inspecting data transfer behavior

Authors:
Ke Xu;Ming Zhang;Mingjiang Ye;Dah Ming Chiu;Jianping Wu
Affiliations:
Tsinghua National Laboratory for Information Science and Technology, Department of Computer Science, Tsinghua University, Beijing 100084, PR China;Tsinghua National Laboratory for Information Science and Technology, Department of Computer Science, Tsinghua University, Beijing 100084, PR China;Tsinghua National Laboratory for Information Science and Technology, Department of Computer Science, Tsinghua University, Beijing 100084, PR China;Department of Information Engineering, The Chinese University of Hong Kong, Hong Kong, PR China;Tsinghua National Laboratory for Information Science and Technology, Department of Computer Science, Tsinghua University, Beijing 100084, PR China
Venue:
Computer Communications
Year:
2010

Citing 15
Cited 1

A low-bandwidth network file system

SOSP '01 Proceedings of the eighteenth ACM symposium on Operating systems principles
Accurate, scalable in-network identification of p2p traffic using application signatures

Proceedings of the 13th international conference on World Wide Web
Transport layer identification of P2P traffic

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Internet traffic classification using bayesian analysis techniques

SIGMETRICS '05 Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
BLINC: multilevel traffic classification in the dark

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
ACAS: automated construction of application signatures

Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data
A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification

ACM SIGCOMM Computer Communication Review
Comprehensive view of a live network coding P2P system

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Unexpected means of protocol inference

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Autograph: toward automated, distributed worm signature detection

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Semi-supervised network traffic classification

Proceedings of the 2007 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
Comparing traffic classifiers

ACM SIGCOMM Computer Communication Review
Revealing skype traffic: when randomness plays with you

Proceedings of the 2007 conference on Applications, technologies, architectures, and protocols for computer communications
Toward the accurate identification of network applications

PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement
Self-Learning IP traffic classification based on statistical flow characteristics

PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement

A Bayesian approach for user aware peer-to-peer video streaming systems

Image Communication

Quantified Score

Hi-index	0.24

Visualization

Abstract

Classifying network traffic according to its applications is important to a broad range of network areas. Since new applications, especially P2P applications, no longer use well-known fixed port numbers, the native port-based traffic classification technique has become much less effective. In this paper, we propose a novel approach to identify P2P traffic by leveraging the data transfer behavior of P2P applications. The behavior investigated in the paper is that downloaded data from a P2P host will be uploaded to other hosts later. To find the shared data of downloading flows and uploading flows online, the content-based partitioning scheme is proposed to partition the flows into data blocks. Flows sharing the same data blocks are identified as P2P flows. Theoretical analysis proves that the content-based partitioning scheme is stable and effective. Experiments on various P2P applications demonstrate that the method is generic and can be applied to most P2P applications. Experimental results show that the algorithm can identify P2P applications accurately while only keeping a small set of data blocks.