基于复合特征的P2P业务识别系统的研究与实现

Design and implementation of P2P traffic identification system based on compound characteristics

着重分析了P2P流量统计特征,根据不同应用的流量模式和实验结果,提出了一种基于流统计特征的P2P识别方法.这种方法不需要对数据报文载荷信息进行检查,因此不受数据是否加密的限制,扩大了P2P识别的范围.论文将基于流统计特征的识别方法与端口法、有效载荷特征串识别法等结合起来,构成复合的P2P流量识别系统.实验数据证明,该系统不仅能识别出更多的P2P应用,而且还具有较高的识别率和较低的误报率和漏报率,应用到实际网络中效果良好.

The fast development of P2P（peer-to-peer） also brings some problems such as the bandwidth shortage, internet piracy, and network security management etc. A key technology to solve these problems is to identify and control P2P flow. In this paper, the characteristics of P2P traffics are analyzed, especially, on the flow statistic characteristics. According to the different flow patterns and experimental results, a new P2P traffic identification method based on the flow statistic characteristics is presented. The payload information doesn＇t need to be checked by this method; as a result, the method is not affected by data encryption, which enhances the applications of the identifications of P2P protocols. A new P2P traffic identification system is constructed by combining the technology of compound characteristics with the port-based, signature-based and transport layer characteristics identification method. According to the experiment data, the system not only can identify more P2P applications, but also has higher identify-rate and lower false negative and false positive. It has good effects in the actual network.