Two-Step P2P Traffic Classification with Connection Heuristics

Abstract

The basis of P2P traffic control is to classify P2P traffic accurately. Several methods such as port-based, signature-based, pattern-based and statistics-based method have been proposed for P2P traffic classification. However, as P2P applications have tried to avoid being easily detected, it becomes hard to classify P2P traffic accurately using only one method. In this paper, we propose an improved two-step P2P traffic classifier by combining signature-based classifier with connection heuristics in packet-level, and statistics-based classifier in flow-level. With connection heuristics, our scheme detects P2P traffic quickly in packet-level classification and reduces the amount of computation. Through verification with real datasets, we show that our two-step scheme has high accuracy and low overhead compared to simple combination of signature-based scheme and statistics-based scheme.

Multi-Level P2P Traffic Classification Using Heuristic and Statistical-Based Techniques: A Hybrid Approach

“…Table 5 shows the summary regarding the approach used in the first and second step classification process along with the classification accuracy of various existing hybrid P2P traffic classification techniques. During the classification process, the techniques used in [5,[19][20][21]52,55], rely on the signature-based approach, which is computationally expensive [6,30,31] and has various other limitations as discussed in Section 2. In addition, the techniques in [19][20][21] do not classify the UDP traffic.…”

“…During the classification process, the techniques used in [5,[19][20][21]52,55], rely on the signature-based approach, which is computationally expensive [6,30,31] and has various other limitations as discussed in Section 2. In addition, the techniques in [19][20][21] do not classify the UDP traffic. The technique used in [53] relies on dedicated hardware for the P2P classification, whereas the technique used in [22] may lead to many false negatives since during the classification process, it filters out all the traffic using well-known port numbers (such as 20, 21, 443, etc.)…”

“…However, this technique also relies on the payload based approach, which has various limitations. Ye and Cho [19][20][21] proposed a hybrid technique to classify P2P traffic in two steps. The first step performs classification at the packet-level by combining signature-based and heuristic-based techniques.…”