Adaptive traffic sampling for P2P botnet detection

Peer‐to‐peer (P2P) botnets have become one of the major threats to network security. Most existing botnet detection systems detect bots by examining network traffic. Unfortunately, the traffic volumes typical of current high‐speed Internet Service Provider and enterprise networks are challenging for these network‐based systems, which perform computationally complex analyses. In this paper, we propose an adaptive traffic sampling system that aims to effectively reduce the volume of traffic that P2P botnet detectors need to process while not degrading their detection accuracy. Our system first identifies a small number of potential P2P bots in high‐speed networks as soon as possible, and then samples as many botnet‐related packets as possible with a predefined target sampling rate. The sampled traffic then can be delivered to fine‐grained detectors for further in‐depth analysis. We evaluate our system using traffic datasets of real‐world and popular P2P botnets. The experiments demonstrate that our system can identify potential P2P bots quickly and accurately with few false positives and greatly increase the proportion of botnet‐related packets in the sampled packets while maintain the high detection accuracy of the fine‐grained detectors.     

P2P业务流量特性及其对Web业务的影响

近年来各种P2P应用不断出现及演进,P2P应用正逐渐成为下一代互联网的杀手级应用。但同时P2P消耗了Internet的大部分带宽,造成了网络技术服务商(ISP)接入网络的拥塞,从而使传统Internet应用性能受到严重影响。从P2P流数量、服务器负载、网络瓶颈点分布、往返时间(RTT)的异构特性等方面可以看出,P2P流量消耗了巨大的网络带宽,影响了传统Internet业务的性能,增加了运营成本。利用P2P流量和Web流量的集成模型,可以量化分析P2P流对Web流的影响,使网络运营商可以在网络瓶颈点对P2P连接数进行优化和调整,从而有效地控制P2P流量。NS2仿真结果较好地验证了该模型的有效性。     

P2P与三网融合

随着互联网的迅猛发展,P2P技术在互联网上的应用超过了Web而成为在流量上占据统治地位的新型应用。同时,P2P技术的影响力不仅限于互联网,还间接地延伸到了电信网和广电网。使用P2P技术的新业务对传统领域带来冲击的同时,也协助解决了三网融合的技术瓶颈。ENUM技术作为跨越互联网和电信网的基础性架构,是融合网络的一条重要的技术途径。将ENUM技术与P2P相结合,可以使P2P共享的优势延伸到电信网络,加速网络融合。     

高速网络环境下的P2P流媒体业务分析和识别方法

The growing P2P streaming traffic brings a variety of problems and challenges to ISP networks and service providers.A P2P streaming traffic classification method based on sampling technology is presented in this paper.By analyzing traffic statistical features and network behavior of P2P streaming,a group of flow characteristics were found,which can make P2P streaming more recognizable among other applications.Attributes from Netflow and those proposed by us are compared in terms of classification accuracy,a...     

Timely traffic identification on P2P streaming media

Since the year of 2006,peer-to-peer (P2P) streaming media service has been developing rapidly,the user scale and income scale achieve synchronous growth.However,while people enjoying the benefits of th...     

Entropy Based Adaptive Flow Aggregation

Internet traffic flow measurement is vitally important for network management, accounting and performance studies. Cisco's NetFlow is a widely deployed flow measurement solution that uses a configurable static sampling rate to control processor and memory usage on the router and the amount of reporting flow records generated. But during flooding attacks the memory and network bandwidth consumed by flow records can increase beyond what is available. Currently available countermeasures have their own problems: 1) reject new flows when the cache is full - some legitimate new flows will not be counted; 2) export not-terminated flows to make room for new ones - this will exhaust the export bandwidth; and 3) adapt the sampling rate to traffic rate - this will reduce the overall accuracy of accounting, including legitimate flows. In this paper, we propose an entropy based adaptive flow aggregation algorithm. Relying on information-theoretic techniques, the algorithm efficiently identifies the clusters of attack flows in real time and aggregates those large number of short attack flows into a few metaflows. Compared to currently available solutions, our solution not only alleviates the problem in memory and export bandwidth, but also significantly improves the accuracy of legitimate flows. Finally, we evaluate our system using both synthetic trace file and real trace files from the Internet.     

P2P网络的位置知晓性研究

P2P网络的应用越来越广泛,同时也在互联网上产生了巨大的网络流量.但P2P网络通常将所有节点看作对等的,不考虑节点的实际网络位置,这就带来了大量的网络冗余流量.本文对P2P网络的位置知晓性进行了相关研究.首先总结了以往对P2P网络位置知晓性的研究,而后提出了采用多源文件下载机制的P2P网络的位置知晓性问题,并通过对真实的BitTorrent网络的测量试验论证了该问题.对P2P网络位置知晓性进行研究和改进,可以减少网络冗余流量,改进网络效率,减少网络运营商的成本.     

电信运营企业引入P4P技术的风险约束策略研究

当前P2P流量是互联网流量的主要组成部分,它造成电信运营企业的网络拥塞。而P4P作为一种互联网流量管理技术在现网中有着良好的实验效果,可以有效地疏导优化电信运营企业的网络流量,但是由于P4P技术需要提供网络拓扑信息才能运作,这对于电信运营企业而言是一种巨大的风险。为了让电信运营企业能够引进此类效果良好但同时具有巨大风险的技术。通过建立重复博弈模型,提出了电信运营企业对于风险惩罚力度及惩罚期的相关策略并进行了详细分析,为其提供理论参考依据。     

对等计算中的基于多移动Agent的协作联盟机制

对等计算技术为Internet这样开放式的、动态变化的网络环境里各节点间的协同工作,进行复杂的分布式业务处理提供了运行基础设施。但是P2P环境中各节点随机加入和退出网络的、工作承担者事先不确定等特点也为工作的顺利完成带来了困难。该文提出一种对等计算环境中基于多移动Agent的柔性的、动态的协作联盟机制,适合部署于复杂、多变的应用环境之中,以克服对等节点协作的困难。主要思想是在某一需求目标的驱动下,主导节点建立项目,经过工作主体遴选,形成暂时的、优化的协作联盟,在复杂的处理流程的规范下,基于合作承诺,联合完成项目设定的任务。该文还将该机制应用于构建虚拟的敏捷企业供应链管理原型系统,以此证明了该机制的实用性价值。     

P2P network traffic control mechanism based on global evaluation values

Peer-to-peer (P2P) computing technology has been widely used on the Internet to exchange data. However, it occupies much network bandwidth, and thus greatly influences traditional business on the Interact. Besides, problems about free-riders and 'tragedy of the commons' in the P2P environment estrange from it P2P users who constantly contribute to the network with quality resources. This article proposes a new P2P network traffic control mechanism based on global evaluation values. It aims to help individual users to avoid peak traffic time as much as possible, ease network congestion and protect traditional business on the Interact, as well as differentiating priority grades of peers according to their contributions and stimulating them to share their valuable resources actively. This article first analyzes the current state of network traffic, and then elaborates on P2P network traffic control policies and proposes the peer's priority level differentiation mechanism based on global evaluation values. Finally,after the testing results and analysis of the proposed P2P network traffic control mechanism are discussed, conclusions are drawn.     

P2P流量疏导与优化

针对目前P2P应用的普及,对互联网带宽的占用情况越来越严重的问题,介绍了吉林联通利用P2P流量疏导与优化系统,运用先进的P4P技术和创新模式,有效缓释电信运营商迅猛增长的P2P应用流量压力问题,并最终使得运营商具备对P2P流量和业务进行有效监控、管理和运营的能力。     

缓存技术优化P2P流量

随着P2P文件共享应用的泛滥,P2P应用大量占用了基础网络运营商的核心带宽,并在影响运营商利润的同时影响了P2P技术的继续发展.本文介绍了一种P2P流量优化技术--P2P缓存系统.通过对P2P流量进行缓存过滤,可使P2P流量占用的核心网络带宽大大降低,从而解决P2P文件共享同基础网络运营的矛盾.本文讨论了P2P缓存系统所面临的主要问题,并提出了相关的解决方案.     

Efficient complementary caching for ISP-aware networks

Internet service providers(ISPs) have taken some measures to reduce intolerable inter-ISP peer-to-peer(P2P) traffic costs,therefore user experiences of various P2P applications have been affected.The recently emerging offline downloading service seeks to improve user experience by using dedicate servers to cache requested files and provide high-speed uploading.However,with rapid increase in user population,the server-side bandwidth resource of offline downloading system is expected to be insufficient in the near future.We propose a novel complementary caching scheme with the goal of mitigating inter-ISP traffic,alleviating the load on servers of Internet applications and enhancing user experience.Both architecture and caching algorithm are presented in this paper.On the one hand,with full knowledge of P2P file sharing system and offline downloading service,the infrastructure of complementary caching is designed to conveniently be deployed and work together with existing platforms.The co-operational mechanisms among different major components are also included.On the other hand,with in-depth understanding of traffic characteristics that are relevant to caching,we develop complementary caching algorithm with respect to the density of requests,the redundancy of file and file size.Since such relevant information can be real-time captured in our design,the proposed policy can be implemented to guide the storage and replacement of caching unities.Based on real-world traces over 3 months,we demonstrate that the complementary caching scheme is capable to achieve the ’three-win’ objective.That is,for P2P downloading,over 50% of traffic is redirected to cache;for offline downloading,the average server-dependence of tasks drops from 0.71 to 0.32;for user experience,the average P2P transfer rate is increased by more than 50 KB/s.     

P2P技术现状及未来发展

P2P应用软件主要包括文件分发软件、语音服务软件、流媒体软件。目前P2P应用种类多、形式多样,没有统一的网络协议标准,其体系结构和组织形式也在不断发展。P2P应用已占运营商业务总量的60%～80%,P2P应用所产生的流量具有分布非均衡、上下行流量对称、流量隐蔽、数据集中等特性。在P2P技术的发展道路上,有许多尚待解决的问题。版权问题一直是P2P发展的一个不确定因素,如何在技术层面支持合法文件的分发是需要解决的重要问题。安全问题也是P2P领域的重要研究课题,如何在P2P网络中实现数据存取安全、路由安全、用户身份认证和身份管理都需要进一步研究。此外,如果能够实现P2P应用之间的统一资源定位,统一路由,使得P2P技术有一个统一开发标准,那么就能够融合P2P技术,提升P2P应用的整体性能。     

Building a cooperative P2P-TV application over a wise network: the approach of the European FP-7 strep NAPA-WINE [very large projects]

Introduction TV services over the Internet can be provided by either exploiting IP multicast functionalities or relying on a pure peer-to-peer (P2P) approach. The first technique will only work on a network infrastructure controlled by a single broadband operator due to limitations of IP multicast facilities. The main goal of the project is the study of a future system suitable for HQTV live streaming over the Internet based on P2P technology, or a P2P-HQTV system. The major focus is on overcoming today's pure layered approach through a cooperative paradigm in which the application and network layers cooperate to optimize the quality of service offered to end users.     

Extending P2PMesh: topology‐aware schemes for efficient peer‐to‐peer data sharing in wireless mesh networks

Wireless mesh networks (WMNs) have emerged as a promising technology that provides low‐cost broadband access to the Internet for fixed and mobile wireless end users. An orthogonal evolution in computer networking has been the rise of peer‐to‐peer (P2P) applications such as P2P data sharing. It is of interest to enable effective P2P data sharing in this type of networks. Conventional P2P data sharing systems are not cognizant of the underlying network topology and therefore suffer from inefficiency. We argue for dual‐layer mesh network architecture with support from wireless mesh routers for P2P applications. The main contribution of this paper is P2PMesh: a topology‐aware system that provides combined architecture and efficient schemes for enabling efficient P2P data sharing in WMNs. The P2PMesh architecture utilizes three schemes: (i) an efficient content lookup that mitigates traffic load imbalance at mesh routers; (ii) an efficient establishment of download paths; and (iii) a data transfer protocol for multi‐hop wireless networks with limited capacity. We note here that the path establishment and data transfer schemes are specific to P2P traffic and that other traffic would use routes determined by the default routing protocol in the WMN. Simulation results suggest that P2PMesh has the potential to improve the performance of P2P applications in a wireless multi‐hop setting; specifically, we focused on data sharing, but other P2P applications can also be supported by this approach. Copyright © 2011 John Wiley & Sons, Ltd.     

P2P网络流媒体关键技术

P2P网络流媒体技术一直是学术界和产业界的研究热点.本文围绕覆盖网络拓扑结构,对现有的P2P流媒体系统作了全面的归类总结,深入介绍和分析了覆盖网络构建、数据块调度策略等P2P流媒体核心技术,并概要讨论视频编码、网络编码、覆盖网络拓扑优化、安全与激励机制等P2P流媒体相关增强技术.对典型P2P流媒体系统的性能进行了比较,...     

Distributed out-bound load balancing in inter-AS routing by random matchings

The Internet is composed of a collection of inter-connected and self-administered Autonomous Systems (ASms). Inter-AS routing is accomplished by having neighboring ASms exchange reachability information via the Border Gateway Protocol. An AS is said to be a transit AS if it allows traffic from other ASms to cross through it. In particular, transit ASms provide transit services for traffic between customer and provider ASms. In this article, we focus on maximizing the utilization of resources at transit ASms. In particular, inter-AS links have been shown to be a bottleneck. To make better use of inter-AS links, we consider the problem of balancing the load among inter-AS links. We refer to this problem as the Balanced-Flow Assignment ProbleM (B-FAPM). We show that the B-FAPM is NP-hard, and thus, likely intractable. We then present a heuristic protocol, the Balanced-Flow Assignment ProtocoL (B-FAPL), that balances the out-bound traffic loads on inter-AS links. We show via simulation that the B-FAPL effectively balances outgoing traffic over inter-AS links. Our solution is fully distributed and uses random matchings to assign in-bound flows to out-bound inter-AS links. Ravi Musunuri received his Bachelors degree from R. V. College of Engineering, Bangalore, India, in 1998, and his Masters and Ph.D. degrees in the Computer Science Department from the University of Texas at Dallas in 2002 and 2006, respectively. He is currently with Cisco Systems, San Jose. His research interest broadly is in Computer Networks area with emphasis on Internet routing, Wireless Sensor Networks, and Content Delivery Networks. Jorge Arturo Cobb received his B.S. degree in computer science with highest honors from the University of Texas at El Paso in 1987, and M.A. and Ph.D. degrees, both in computer science, from the University of Texas at Austin in 1989 and 1996, respectively. He is currently an associate professor in the Department of Computer Science at the University of Texas at Dallas. His main research interest is in computer networking, with an emphasis on scheduling for quality of service guarantees and mobile computing.     

面向智能管道的PCC闭环系统部署方案研究

近年来,随着移动互联网的高速发展,移动数据流量迅猛增长。为保障和提升数据流量价值,移动通信网络部署了PCC网络,但有效的策略管控机制仍未形成。为推进PCC规模部署,提出了PCC闭环体系的概念,对如何构建数据业务智能管道,实现网络智能管控的具体方案进行研究,同时提供可在现有网络中部署的数据业务管控策略。     

Repeated Public Goods Game Mode for Trust Based P2P Networks

In recent years, peer-to-peer (P2P) network systems have been widely used in the Internet. Particularly, P2P file sharing mechanism has emerged popularity and attract millions of users. However, to create an efficient P2P system, end users should share their resources among a group of other users. To satisfy this objective, this paper applies the repeated public goods game model to P2P systems. By adopting an interactive self-learning mechanism, the proposed scheme gradually leads the P2P system into an efficient network equilibrium. In a distributed manner, our approach is a practical and suitable method in real world P2P network operations. With a simulation study, it is demonstrated that the proposed scheme can obtain better performance than other existing schemes under widely diverse file request rates.