Two-state peer-to-peer flow detection algorithm

Abstract

Peer-to-peer flow detection algorithm has been studied for several years. Port-based classification, regular expression, graphlet and various machine learning based algorithms have been proposed as solutions. Unfortunately, all previous algorithms have been failed in various aspects especially for the encrypted peer-to-peer traffic. In this paper, we present a new algorithm to delivers more effectiveness. We have also prototyped our algorithm and evaluate on a test-bed. The performance evaluation has demonstrated the better effectiveness of our algorithm in comparison to the previous ones.

Classifying peer-to-peer traffic using protocol hierarchy

“…The data types are based on thresholds. In a previous study [9], we have found several false positives and false negatives, caused by the thresholds.…”

“…As a result, RE fails to classify peer-to-peer traffic. RE problems have been evidently shown in previous studies [3,4,7,9,11]. However, network management tools (such as ClearOS [12] and pfSense [13]) still deploy RE to classify peer-to-peer traffic.…”

“…BLINK shows an interesting method. However, previous studies [9] have demonstrated that BLINK is not an effective method to classify peer-to-peer traffic.…”

“…Our previous work [9] has been successful in detecting peerto-peer traffic (for both encrypted and unencrypted). This work is an extended work from the previous one.…”

“…In this paper, we propose a peer-to-peer classification mechanism by extending our previous proposal [9] to detect both encrypted and unencrypted peer-to-peer. The extended peer-to-peer classification mechanism has been improved for different peer-to-peer applications.…”