| Peer-to-peer (P2P) is a new model of network applications, which is characterized by relying on the edge node of the network, rather than a central server to achieve self-organizing and resource sharing. In recent years, P2P technology has made tremendous development in several fields, such as file sharing, media streaming, instant message etc. P2P traffic has become the most significant component of internet traffic. However, the rapid development of P2P technology has also brought some negative effects, such as a lot of bandwidth consumed by P2P applications, copyright disputes and security issues. Therefore, the study of effective traffic detection methods has become the most important issue of network management.This article firstly introduces the traditional P2P traffic identification algorithm. And then using reverse engineering methods, we study similarities and differences of typical protocols, such as Thunder, PPLive, PPStream, in the fields of node sharing, operation principles and behavior characteristics, from which characteristic can be obtained to be used for flow identification. After that, a combination of these characteristics is used to detect a specific application. Experiments show that behavior-based traffic identification method has a good bit-rate recognition performance.Meanwhile, with the progress of research on accurate traffic classification, the major obstacle to achieving accurate traffic classification is the lack of an efficient ground truth (GT) generation method. However, current existing GT generation methods can only be made manually or with additional high-cost DPI (deep packet inspection) devices. To solve this problem, we presents and implements a lightweight GT generator, which is important for exploring the underlying characteristics of network traffic, building the traffic model, and verifying the classification result. The method can always reflect the real-time features of network traffic. |
PDF Full Text Request