Methodology for detection and restraint of p2p applications in the network
ICCSA'12 Proceedings of the 12th international conference on Computational Science and Its Applications - Volume Part IV
Computer Networks: The International Journal of Computer and Telecommunications Networking
| Hi-index | 0.00 |
Peer-to-peer protocols are increasingly implementing encryption and port randomisation to circumvent detection by traditional, signature-based classification systems. This paper proposes a novel method of identifying hosts and connections generating peer-to-peer traffic by observing the statistical attributes of the traffic. The method builds on existing statistical-based detection, but it uses a two-stage neural network to process the data and identify the peer-to-peer connections. A full architecture is also proposed to link the detection with a module producing ACL rules allowing segregating and blocking or shaping the peer-to-peer traffic in real time. The method was tested on real traffic, achieving accuracy between 85% and 98% at detecting peer-to-peer traffic from two packet traces.