Black-box analysis of Internet P2P applications

Abstract

After P2P file-sharing and VoIP telephony applications, VoD and live-streaming P2P applications have finally gained a large Internet audience as well. In this work, we define a framework for the comparison of these applications, based on the measurement and analysis of the traffic they generate. In order for the framework to be descriptive for all P2P applications, we first define a minimum set of observables of interest: such features either pertain to different layers of the protocol stack (from network up to the application), or convey cross-layer information (such as the degree of awareness, at overlay layer, of properties characterizing the underlying physical network). The framework is compact (as it allows to represent all the above information at once), general (as is can be extended to consider features different from the one reported in this work), and flexible in both space and time (as it allows different levels of spatial aggregation, and also to represent the temporal evolution of the quantities of interest). Using the minimum feature set, we analyze some of the most popular P2P application nowadays, highlighting their main similarities and differences. We then apply the framework, using also different features and metrics, to two interesting case study: namely, the detection of malfunctioning or misbehaving peers, and a fine-grained analysis of P2P network-awareness and friendliness.

An efficient reinforcement learning-based Botnet detection approach

“…First, bot infected hosts share particular malicious behavior, and the features differ from those of a normal host [58]. Second, the Bot's behavior during propagation repeats itself in a frequent manner since it is attempting to infect multiple hosts [10,59].…”

P2PTV multi-channel peers analysis

“…Several studies and experiments have been done to analyse P2PTV applications [1], [2], [3], [4], [5], [6], [7]. Rossi et al…”

“…proposed a framework for comparing P2P applications [6] in which they define a set of observable features related to the protocols used by the applications. They highlighted the main similarities and differences between several P2P applications.…”