Research on P2P Traffic Monitoring System based on DPI Technology

This paper focuses on the key technologies of P2P technology and network traffic monitoring, which focuses on AC automaton and bypass interference control technology, and on based of it, we design a new P2P traffic monitoring system. The system uses DPI and DFI recognition technology, as well as straight loss and bypass interference control technology, basically meet the recognition and control of P2P traffic. Finally, the test results show that this system recognition accuracy of P2P traffic is high, good control effect, function and performance meet the design requirements.

Accurate P2P traffic identification based on data transfer behavior

Peer-to-Peer (P2P) technology is one of the most popular techniques nowadays, and accurate identification of P2P traffic is important for many network activities. The classification of network traffic by using port-based or payload-based analysis is becoming increasingly difficult when many applications use dynamic port numbers, masquerading techniques, and encryption to avoid detection. A novel method for P2P traffic identification is proposed in this work, and the methodology relies only on the statistics of end-point, which is a pair of destination IP address and destination port. Features of end-point behaviors are extracted and with which the Support Vector Machine classification model is built. The experimental results demonstrate that this method can classify network applications by using TCP or UDP protocol effectively. A large set of experiments has been carried over to assess the performance of this approach, and the results prove that the proposed approach has good performance both at accuracy and robustness.

Identifying file-sharing P2P traffic based on traffic characteristics

This article focuses on identifying file-sharing peer-to-peer （P2P） （such as BitTorrent （BT）） traffic at the borders of a stub network. By analyzing protocols and traffic of applications, it is found that file-sharing P2P traffic of a single user differs greatly from traditional and other P2P （such as QQ） applications＇ traffic in the distribution of involved remote hosts and remote ports. Therefore, a method based on discreteness of remote hosts （RHD） and discreteness of remote ports （RPD） is proposed to identify BT-like traffic. This method only relies on flow information of each user host in a stub network, and no packet payload needs to be monitored. At intervals, instant RHD for concurrent transmission control protocol and user datagram protocol flows for each host are calculated respectively through grouping flows by the stub network that the remote host of each flow belongs to. On given conditions, instant RPD are calculated through grouping flows by the remote port to amend instant RHD. Whether a host has been using a BT-like application or not can be deduced from instant RHD or average RHD for a period of time. The proposed method based on traffic characteristics is more suitable for identifying protean file-sharing P2P traffic than content-based methods Experimental results show that this method is effective with high accuracy.

Fine-grained P2P traffic classification by simply counting flows

The continuous emerging of peer-to-peer(P2P) applications enriches resource sharing by networks, but it also brings about many challenges to network management. Therefore, P2 P applications monitoring, in particular,P2 P traffic classification, is becoming increasingly important. In this paper, we propose a novel approach for accurate P2 P traffic classification at a fine-grained level. Our approach relies only on counting some special flows that are appearing frequently and steadily in the traffic generated by specific P2 P applications. In contrast to existing methods, the main contribution of our approach can be summarized as the following two aspects. Firstly, it can achieve a high classification accuracy by exploiting only several generic properties of flows rather than complicated features and sophisticated techniques. Secondly, it can work well even if the classification target is running with other high bandwidth-consuming applications, outperforming most existing host-based approaches, which are incapable of dealing with this situation. We evaluated the performance of our approach on a real-world trace. Experimental results show that P2 P applications can be classified with a true positive rate higher than 97.22% and a false positive rate lower than 2.78%.

P2P Streaming Traffic Classification in High-Speed Networks

The growing P2P streaming traffic brings a variety of problems and challenges to ISP networks and service providers.A P2P streaming traffic classification method based on sampling technology is presented in this paper.By analyzing traffic statistical features and network behavior of P2P streaming,a group of flow characteristics were found,which can make P2P streaming more recognizable among other applications.Attributes from Netflow and those proposed by us are compared in terms of classification accuracy,and so are the results of different sampling rates.It is proved that the unified classification model with the proposed attributes can identify P2P streaming quickly and efficiently in the online system.Even with 1:50 sampling rate,the recognition accuracy can be higher than 94%.Moreover,we have evaluated the CPU resources,storage capacity and time consumption before and after the sampling,it is shown that the classification model after the sampling can significantly reduce the resource requirements with the same recognition accuracy.

P2P业务流量识别、分析和控制研究

P2P业务流量在对Internet起巨大推动作用的同时,也带来了因资源过度占用而引起的网络拥塞以及安全隐患等问题,妨碍了正常的网络业务的开展。该文通过对P2P业务的有效识别、控制和管理技术的研究,设计出网络业务流量综合识别系统和网络业务流量识别和策略控制系统原型。

基于P2P应用的网络流量特征分析

为了解和掌握网络中P2P流量的特征,对网络中的P2P文件共享应用的流量进行了分析。发现在P2P文件共享应用Maze产生的流量中:流量具有突发性特点;流量的局部性比WWW和FTP应用相比更不明显;流长分布明显不同于WWW应用;而在流持续时间上明显比WWW和FTP应用要长;所传输的流量中传输量大的流所占的比例要比WWW和FTP要高。

P2P流量识别技术综述

在归纳P2P流量识别问题概念的基础上,对现有的P2P流量识别技术进行了较全面地分析。借助分类模型形式化地定义P2P流量识别问题,依据所采用的识别特征将已有技术分为基于端口号、基于流量特征、基于应用层签名、基于双重特征和基于统计行为特征五类方法,并对各类方法进行了介绍、分析与优劣对比。探讨了新兴的P2P流媒体流量识别问题,总结了P2P流量识别技术的发展趋势。

一种基于P2P流量规划的网络资源可重构分配方法

现有IP网络的无连接性和网络资源的松散管理结构使得网络流量存在全局范围内的分布不均情况,造成网络资源利用率低并且对运营商的一些突发的QoS需求很难做到快速响应.具备网络资源集中式管理特征的可重构网络虽然弥补了这一不足,但对特定业务的流量优化能力以及按需合理重构网络资源的能力不足,使得可重构网络资源分配及QoS保障技术仍有待进一步提高,尤其是占据网络流量主体的P2P业务流量和突发性高优先级QoS保障.当前的P2P优化以及流量工程技术不但自身存在不完善,并且也不能高效地直接适用于可重构网络环境中.因此,文中站在网络资源全局统筹的角度,提出了一种应用于可重构网络环境中的、基于P2P流量规划的网络资源动态可重构技术,使得可重构网络的资源管理机制有能力对全网P2P流量进行优化调度,尤其是能够在网络资源不足的情况下,通过调整P2P流量,释放指定网络资源以响应突发高优先级需求.通过仿真验证可见,以P2P流量规划的手段对全网资源进行全局规划、动态重构,形成弹性的可重构网络环境中,网络流量负担、P2P节点出、入度等多方面均有较大幅度提升,从而赋予了运营商一种对各种优先级业务的规划手段.

P2P流量识别与管理技术

P2P流量在推动Internet宽带化的同时也带来了资源过度占用和网络安全等问题。本文调查和研究了P2P流量识别和策略控制的最新技术及相关设备,总结出P2P流量综合控制模型,并指出进一步的研究方向。

基于流相似性的两阶段P2P僵尸网络检测方法

僵尸网络利用诸如蠕虫、木马以及rootkit等传统恶意程序,进行分布式拒绝服务攻击、发送钓鱼链接、提供恶意服务,已经成为网络安全的主要威胁之一。由于P2P僵尸网络的典型特征是去中心化和分布式,相对于IRC、HTTP等类型的僵尸网络具有更大的检测难度。为了解决这一问题,该文提出了一个具有两阶段的流量分类方法来检测P2P僵尸网络。首先,根据知名端口、DNS查询、流计数和端口判断来过滤网络流量中的非P2P流量;其次基于数据流特征和流相似性来提取会话特征;最后使用基于决策树模型的随机森林算法来检测P2P僵尸网络。使用UNB ISCX僵尸网络数据集对该方法进行验证,实验结果表明,该两阶段检测方法比传统P2P僵尸网络检测方法具有更高的准确率。

P2P环境下的蠕虫检测算法

P2P下载与网络蠕虫具有相似的搜索机制,导致网络蠕虫难以被检测并定位。该文提出一种融合危险理论和ID3分类算法的检测算法D-ID3。利用熵理论分析P2P应用、蠕虫、正常主机的属性特征,得到轴属性。利用ID3分类算法得到可以区分蠕虫、P2P和正常流量的分类规则。实验结果表明,该算法能成功检测出网络蠕虫,其误警率较低。

一种基于点路结合的骨干网P2P缓存部署方法

P2P应用的广泛流行给ISP骨干网络带来了前所未有的流量压力,P2P缓存(peer-to-peer caching)技术是目前缓解这种流量压力的最有效手段之一,缓存部署方法对P2P缓存系统的运行效率有重要影响.已有缓存部署方法分为两类:基于骨干节点的部署方法(node-based cache deployment,NCD)和基于骨干链路的部署方法(link-based cache deployment,LCD).在不同的P2P流量分布情形下,NCD与LCD各有优劣,但是,这两类方法未能充分发挥缓存的性能.提出一种基于点路结合的骨干网P2P缓存部署方法(node-Link based cache deployment,NLCD),根据缓存部署过程中P2P流量分布和缓存存储状态的动态变化,灵活选择骨干节点或骨干链路作为部署位置.建立了以网络负载最小化为目标的缓存部署模型,基于该模型将P2P缓存部署问题建模为一个最优化问题,由于流量分布和缓存状态会在部署过程中不断变化,不具有最优子结构性质.证明了该最优化问题为NP完全问题,并设计了一种启发式贪婪算法进行求解.实验结果表明,针对典型的H&S型、Ladder型骨干网络拓扑,使用NLCD的平均链路使用率比使用LCD低5%～15%,比使用NCD低7%～30%.

基于UDP流量的P2P流媒体流量识别算法研究

以几款主流的P2P流媒体网络电视作为研究对象,深入分析了其产生的流量在端口使用方面的特点和报文长度分布上的差异。通过对这些特征的总结和提取,获得了基于端口特性"在一次交互过程中,特定主机的特定端口唯一确定一种应用"等结论。在此基础上提出了一种基于带有扩展属性的流记录准确识别P2P应用UDP流量的EXID算法。通过对CERNET江苏省边界10G主干信道上采集的Trace数据中5种P2P流媒体应用进行识别,并与机器学习流量识别算法进行比较,其结果表明提出的方案具有很高的查准率和查全率,时间效率高,且不易受样本比重的影响。

基于决策树模型的P2P流量分类方法

P2P流量逐渐成为互联网流量的重要组成部分,精确分类P2P流量对于有效管理网络和合理利用网络资源都具有重要意义。近年来,利用机器学习方法处理P2P流量分类问题已成为流量识别领域的一个新兴研究方向。利用决策树中的C4.5算法和P2P流量的特征属性来构建决策树模型,进而完成P2P流量分类问题。实验结果表明,基于决策树模型的方法能有效避免P2P网络流分布变化所带来的不稳定性;与SVM(support vectormachine,支持向量机)、NBK(na ve Bayes using kernel density estimation,改进的朴素贝叶斯)方法相比,其平均分类准确率能提高至少3.83个百分点。

基于最优ABC-SVM算法的P2P流量识别

目前对等网络(peer-to-peer,P2P)流量的识别是网络管理研究的热门话题。基于支持向量机(support vector machine,SVM)的P2P流量识别方法是常用的P2P流量识别方法之一。然而SVM的性能主要受参数和其使用特征的影响,传统的方法是将SVM的参数优化和特征选择问题分开处理,但是难以获得整体性能最优的SVM分类器。针对以上问题进行了研究,提出了一种基于最优人工蜂群算法与支持向量机相结合的P2P流量识别方法。利用人工蜂群算法,将SVM的参数和特征选择问题视为最优化问题同步处理,可以获得整体性能最优的参数和特征子集。在真实的P2P数据上的实验结果表明,提出的方法具有很好的自适应性和分类精度,能够同时获取特征子集和SVM参数的最优解,提高SVM分类器的整体性能。

基于主机行为关联的加密P2P流量实时分类方法

提出了一种基于主机行为关联的加密P2P流量实时分类方法,该方法基于P2P系统中节点间的连接关系,以一定的先验知识为初始条件进行节点发现,并根据网络行为不断进行迭代检测,持续发现P2P网络中的新节点及其对应的流量,从而达到对加密P2P流量实时分类的目的。真实流量环境中的对比实验表明,该方法对典型加密P2P流量的分类准确率、召回率均超过95%,计算代价小、性能高,不依赖于内容检测,不侵犯用户隐私,能有效应用于实时流分类环境中。

基于K均值和双支持向量机的P2P流量识别方法

针对目前常用于P2P流量识别的有监督机器学习方法普遍存在时间代价较高的现状,提出采用时间代价为标准支持向量机四分之一的双支持向量机来构建分类器,并采用K均值集成方法快速生成有标签样本集,组合有标签样本集构成双支持向量机的训练样本,最后利用构建好的双支持向量机分类模型进行P2P流量的识别。实验结果表明采用基于K均值集成结合双支持向量机的方法在P2P流量识别的时间代价、准确率和稳定性方面要远优于标准支持向量机。

基于C4.5决策树的单向P2P流量识别方法研究

P2P流量识别方法已能对基于TCP传输的双向P2P流量进行高准确率的识别,但少有论文研究单向P2P流量的识别方法.针对单向P2P流量的识别难点,提出一种基于C4.5决策树的单向P2P流量识别方法.该方法仅利用10个网络流统计特征,且这些特征可在一个流的前若干个数据包内快速计算完成,并对承载P2P流量的传输层协议具有通用性.实验结果表明,该方法识别准确率高,识别时间短,可用于高速骨干链路P2P流量的实时识别.

利用半监督近邻传播聚类算法实现P2P流量识别

为了解决利用少量标记样本实现准确的P2P流量识别,提出了一种基于半监督近邻传播(AP)聚类算法的P2P流量识别方法.首先对少量样本进行标记,然后在聚类过程中为标记样本和非标记样本设置不同的参考度,使标记样本能够优先成为类代表点,进而通过样本间的消息加权更新完成聚类,最后按照相应的"标记-类别映射"规则实现对P2P流量的识别.研究了参考度与消息加权更新对识别性能的影响,实验结果显示:当标记样本的比例为5%时,对P2P流量的识别准确率高于90%,误识别率低于3%;当标记样本的比例达到15%后,识别准确率高于95%,最高可达98%,而误识别率则低于1%;识别性能随标记样本比例的提高而提高.