中国邮电高校学报(英文) ›› 2008, Vol. 15 ›› Issue (4): 112-120.doi:

• P2P • 上一篇    下一篇

Identifying file-sharing P2P traffic based on traffic characteristics

成卫青,龚俭,丁伟   

  1. College of Computer, Nanjing University of Posts and Telecommunications, Nanjing 210003, China
  • 收稿日期:2008-04-01 修回日期:1900-01-01 出版日期:2008-12-30
  • 通讯作者: 成卫青

Identifying file-sharing P2P traffic based on traffic characteristics

CHENG Wei-qing, GONG Jian, DING Wei   

  1. College of Computer, Nanjing University of Posts and Telecommunications, Nanjing 210003, China
  • Received:2008-04-01 Revised:1900-01-01 Online:2008-12-30
  • Contact: CHENG Wei-qing,

摘要:

This article focuses on identifying file-sharing peer-to-peer (P2P) (such as BitTorrent (BT)) traffic at the borders of a stub network. By analyzing protocols and traffic of applications, it is found that file-sharing P2P traffic of a single user differs greatly from traditional and other P2P (such as QQ) applications’ traffic in the distribution of involved remote hosts and remote ports. Therefore, a method based on discreteness of remote hosts (RHD) and discreteness of remote ports (RPD) is proposed to identify BT-like traffic. This method only relies on flow information of each user host in a stub network, and no packet payload needs to be monitored. At intervals, instant RHD for concurrent transmission control protocol and user datagram protocol flows for each host are calculated respectively through grouping flows by the stub network that the remote host of each flow belongs to. On given conditions, instant RPD are calculated through grouping flows by the remote port to amend instant RHD. Whether a host has been using a BT-like application or not can be deduced from instant RHD or average RHD for a period of time. The proposed method based on traffic characteristics is more suitable for identifying protean file-sharing P2P traffic than content-based methods. Experimental results show that this method is effective with high accuracy.

关键词:

traffic;identification,;concurrent;flows,;P2P,;discreteness;of;remote;hosts,;discreteness;of;remote;ports

Abstract:

This article focuses on identifying file-sharing peer-to-peer (P2P) (such as BitTorrent (BT)) traffic at the borders of a stub network. By analyzing protocols and traffic of applications, it is found that file-sharing P2P traffic of a single user differs greatly from traditional and other P2P (such as QQ) applications’ traffic in the distribution of involved remote hosts and remote ports. Therefore, a method based on discreteness of remote hosts (RHD) and discreteness of remote ports (RPD) is proposed to identify BT-like traffic. This method only relies on flow information of each user host in a stub network, and no packet payload needs to be monitored. At intervals, instant RHD for concurrent transmission control protocol and user datagram protocol flows for each host are calculated respectively through grouping flows by the stub network that the remote host of each flow belongs to. On given conditions, instant RPD are calculated through grouping flows by the remote port to amend instant RHD. Whether a host has been using a BT-like application or not can be deduced from instant RHD or average RHD for a period of time. The proposed method based on traffic characteristics is more suitable for identifying protean file-sharing P2P traffic than content-based methods. Experimental results show that this method is effective with high accuracy.

Key words:

traffic identification;concurrent flows;P2P;discreteness of remote hosts;discreteness of remote ports