Detection and classification of peer-to-peer traffic

Abstract

The emergence of new Internet paradigms has changed the common properties of network data, increasing the bandwidth consumption and balancing traffic in both directions. These facts raise important challenges, making it necessary to devise effective solutions for managing network traffic. Since traditional methods are rather ineffective and easily bypassed, particular attention has been paid to the development of new approaches for traffic classification. This article surveys the studies on peer-to-peer traffic detection and classification, making an extended review of the literature. Furthermore, it provides a comprehensive analysis of the concepts and strategies for network monitoring.

PeerRush: Mining for Unwanted P2P Traffic

“…For example, we first used these two hosts to run two instances of eMule for about 9 consecutive days. During this period, we initiated a variety of file searches and downloads 4 . Whenever possible, we used AutoIt to automate user interactions with the client applications.…”

“…Because of space limitations, we cannot mention all related work here and we therefore refer the reader to a recent survey by Gomes et al [4]. In the following, we limit our discussion to the most relevant work on P2P traffic categorization, and on P2P botnet detection.…”

“…While there exists a vast body of work dedicated to P2P traffic detection [4], a large portion of previous work focuses on signature-based approaches that require deep packet inspection (DPI), or on port-number-based identification [17,7]. Because modern P2P applications avoid using fixed port numbers and implement encryption to prevent DPI-based detection [13], more recent work has addressed the problem of identifying P2P traffic based on statistical traffic analysis [10,11].…”

Network Traffic Classification using Genetic Algorithms based on Support Vector Machine

“…In recent years, the technology of traffic classification based on machine learning method has been widely researched. The machine learning methods include supervised learning methods and unsupervised learning methods [2] [3]. Support vector machine (SVM) is proposed by Vapnik et al, and it is based on the theory of structural risk minimization principle of statistical learning theory [4].…”

An Adaptive Trust Sampling Method for P2P Traffic Inspection

“…[5]. The early P2P applications used well-known ports for peer-to-peer communication, and now most P2P applications take dynamic ports to hide its traffic through firewall or avoid traffic monitoring devices.…”