Profiling and identification of P2P traffic

Accurate identification of network applications is important for many network activities. The traditional port-based technique has become much less effective since many new applications no longer use well-known fixed port numbers. In this paper, we propose a novel profile-based approach to identifying traffic flows belonging to the target application. In contrast to the method used in previous studies, of classifying traffic based on statistics of individual flows, we build behavioral profiles of the target application, which describe dominant patterns in the application. Based on the behavior profiles, a two-level matching method is used to identify new traffic. We first determine whether a host participates in the target application by comparing its behavior with the profiles. Subsequently, we compare each flow of the host with those patterns in the application profiles to determine which flows belong to this application. We demonstrate the effectiveness of our method on-campus traffic traces. Our results show that one can identify popular P2P applications with very high accuracy.     

P2P流量识别技术综述

在归纳P2P流量识别问题概念的基础上,对现有的P2P流量识别技术进行了较全面地分析.借助分类模型形式化地定义P2P流量识别问题,依据所采用的识别特征将已有技术分为基于端口号、基于流量特征、基于应用层签名、基于双重特征和基于统计行为特征五类方法,并对各类方法进行了介绍、分析与优劣对比.探讨了新兴的P2P流媒体流量识别问题,总结了P2P流量识别技术的发展趋势.     

基于聚类和流量传播图的P2P流量识别方法

为有效监管网络,快速精确识别P2P流量,通过分析P2P网络流量中节点与节点、节点与链路之间的交互和行为特征,将聚类方法与流量传播图方法相结合,提出了一种基于网络行为特征的P2P流量识别方法。该方法首先通过采集网络流的包级和流级统计特征对不同种类的网络应用的流量进行聚类,然后利用流量传播图对P2P流量进行识别。实验结果表明,提出的方法在骨干网络数据上能够有效识别P2P网络应用流量,◢F◣▼1▽-measure达到95%以上。     

基于流量模式的P2P流量识别方法综述*

通过综述目前主流的基于流量模式的识别方法在基于人工经验和基于机器学习两方面的研究成果,分析了各种方法经验上的或理论上的合理性。最后分析了目前研究中存在的不足,对后续研究工作具有参考意义。     

一种有效的P2P流媒体点播的供应者发现机制

提出了一种新的供应者发现机制,在源服务器上创建类似目录的数据结构维护系统中少量特定P2P节点的信息,用来锁定与目标供应者播放进度接近的节点,再通过这些节点的缓存交迭表与其邻近节点直接通信来找到合适的供应者。仿真实验结果表明,该供应者发现机制能够加快P2P节点的加入和恢复操作,且整个系统的通信负担明显降低。     

基于签名的P2P流量识别模型的设计与实现*

为了克服P2P流量识别传统方法与现有方法的不足,设计了一种新型基于签名的P2P流量识别模型。在分析BitTorrent与eMule两种典型P2P协议的基础上,提取了协议签名,并对P2P流的行为特征进行了研究,且分别对网络数据包和流进行了统一的描述,然后使用哈希映射表查找与签名匹配相结合的方式判断了流量的归属。最后在真实的网络环境下实现了该模型,实验结果表明此模型可以有效地识别P2P流量。     

基于免疫粒子群的P2P协议识别方法

为了解决基于统计特征的P2P协议识别中,因特征选择不当而引起的识别准确率低的问题,采用免疫粒子群算法(Immune-PSO)选取最优特征子集,选择出最能区分P2P协议的特征子集。实验结果表明,该算法较标准粒子群算法具有更高的全局搜索能力,能更准确地找出最优特征子集,该方法能有效地提高协议的识别率,对常见的P2P协议如BitTorrent、eMule等有高达90%的识别率。     

一种基于节点状态的P2P流量检测模型

现有的P2P流量检测方法多基于流量特征或深度包检测技术,而新型的P2P应用已逐渐发展为采用随机端口、协议特征模糊化以及HTTP隧道技术,这使得采用目前的流量检测方法识别率较低。针对此问题,提出一种基于节点状态的P2P流量检测模型。该模型通过多级检测模块,将节点状态信息存入Hash表中,并映射形成可信列表反馈到检测端,通过活跃因子、增量因子以及连接缓存的定义,可以快速、有效识别端口跳跃及协议加密引发的P2P流量。     

Reducing network traffic in unstructured P2P systems using Top-k queries

A major problem of unstructured P2P systems is their heavy network traffic. This is caused mainly by high numbers of query answers, many of which are irrelevant for users. One solution to this problem is to use Top-k queries whereby the user can specify a limited number (k) of the most relevant answers. In this paper, we present FD, a (Fully Distributed) framework for executing Top-k queries in unstructured P2P systems, with the objective of reducing network traffic. FD consists of a family of algorithms that are simple but effective. FD is completely distributed, does not depend on the existence of certain peers, and addresses the volatility of peers during query execution. We validated FD through implementation over a 64-node cluster and simulation using the BRITE topology generator and SimJava. Our performance evaluation shows that FD can achieve major performance gains in terms of communication and response time. Recommended by: Sunil Prabhakar Work partially funded by the ARA Massive Data of the Agence Nationale de la Recherche.     

Supporting users in finding successful matches in reciprocal recommender systems

User Modeling and User-Adapted Interaction - Online platforms which assist users in finding a suitable match, such as online-dating and job recruiting environments, have become increasingly popular...     

基于连接模式的P2P流量识别的研究与实现*

提出基于网络层连接模式的P2P流量识别算法,并对识别过程中的几个关键问题进行了研究。提出采用分光技术对链路数据进行旁路处理,通过在链路层加入过滤策略减少对冗余数据的采集,对采集到的有效数据通过流归并技术进行预处理,并介绍了识别结果显示阶段的相关处理方法。     

Characterization of community based-P2P systems and implications for traffic localization

In this paper, we present one of the first and most extensive characterizations of closed community-based P2P systems. Such systems are organic groups of peer-to-peer (P2P) clients, which can be joined only by users belonging to a certain network (e.g., connected to a given Internet Service Provider (ISP)). A number of factors motivate the growth of these communities, such as quality of content, anonymity of transfers, and the potential for better performance that enhances user experience. Our study is conducted in two contrasting environments—a campus network and a national ISP—located in different continents. In both cases, large-scale closed communities have been found to be the predominant P2P systems in use. We shed light both on the factors motivating the growth of such communities, and present results characterizing the extensiveness of their usage, the performance achievable by the systems, and the implications of such communities for network providers. While our findings are interesting in their own right, they also offer important lessons for ongoing research that seeks to localize traffic within ISP boundaries. In particular, our results suggest that (i) in ISPs with heterogeneous access technologies, the performance benefits to users on localizing P2P traffic is largely dependent on the degree of seed-like behavior of peers behind high-bandwidth access technologies; and (ii) while localization can reduce the traffic on Internet peering links, it has the potential to cause a significant increase in traffic on internal links of providers, potentially requiring upgrades of network links.     

基于应用层签名特征的P2P流量识别

P2P的广泛使用带来了带宽过量消耗、病毒传播迅速等严重问题。如何在享受P2P技术带来便利的同时又能有效地识别、控制P2P流量是当前的研究热点。通过基于报文TRACE的数据分析方法,获得了当前五种主流的P2P流的应用层签名特征,提出了一个基于应用层签名特征的识别算法,并通过实际实验对所提识别算法的有效性进行了验证,研究成果可直接应用于P2P流量的识别与管理。     

基于K均值和双支持向量机的P2P流量识别方法

针对目前常用于P2P流量识别的有监督机器学习方法普遍存在时间代价较高的现状,提出采用时间代价为标准支持向量机四分之一的双支持向量机来构建分类器,并采用K均值集成方法快速生成有标签样本集,组合有标签样本集构成双支持向量机的训练样本,最后利用构建好的双支持向量机分类模型进行P2P流量的识别。实验结果表明采用基于K均值集成结合双支持向量机的方法在P2P流量识别的时间代价、准确率和稳定性方面要远优于标准支持向量机。     

Writer identification using intra-stroke and inter-stroke information for security enhancements in P2P systems

Chinese language has enormous number of characters and complicated stroke structures. So it is very difficult to efficiently and accurately identify a Chinese writer from his/her handwritings. This paper proposes a novel writer identification method for Chinese characters commonly used in Japan which can be used in peer-to-peer (P2P) systems. As a preliminary task, we have analyzed the shapes of strokes and the types of block division structures in Chinese characters and selected some characters for writer identification. The method consists of two efficient algorithms, i.e. the Hidden-feature analysis and the Block-type model, which respectively utilize intra-stroke and inter-stroke features of handwritings to enhance the writer identification accuracy. The Hidden-feature analysis makes template classes of reference characters with online features of training samples such as pen-pressure, pen-speed, pen-altitude, and pen-azimuth of each stroke. The Block-type model also creates such classes for writer identification based on offline features, i.e. the positional information about blocks of sample characters. The experimental results show that the Hidden-feature analysis requires eight Chinese characters while the Block-type model requires only four characters and four ones to achieve writer identification accuracy over 98%. Additionally, the results also demonstrate that any eight Chinese characters are enough to achieve an identification accuracy over 99.9% when the combination of the two algorithms is applied.     

基于网络流内在特征的P2P业务识别技术研究

分析了几类主要的P2P业务识别方法,重点分析了基于流的内在特征的各种识别方法,并对其优缺点作出评价,指出了P2P识别技术进一步的发展方向.     

RDF-Chord: A hybrid PDMS for P2P systems

Peer-to-peer (P2P) computing has gained great attention in both research and industrial communities. Although many P2P systems, such as CAN, Pastry, Chord, and Tapstry have been proposed, they only support exact-match lookups. To overcome the limitation, a new area of P2P research, called peer data management system (PDMS), has emerged. In PDMS, metadata were used for annotating resources to support complex queries. This paper proposed a hybrid PDMS called RDF-Chord. In RDF-Chord, a set of keys is ingeniously designed to significantly reduce the search spaces. In experiments, it shows that RDF-Chord is highly scalable and efficient, especially in range queries.     

Polymorphic queries for P2P systems

When a query is posed on a centralized database, if it refers to attributes that are not defined in the database, the user is warranted to get either an error or an empty set. In contrast, when a query is posed on a peer in a P2P system and refers to attributes not found in the local database, the query should not be simply rejected if the relevant information is available at other peers. This paper proposes a query model for unstructured P2P systems to answer such queries. (a) We introduce a class of polymorphic queries, a revision of conjunctive queries by incorporating type variables to accommodate attributes not defined in the local database. (b) We define the semantics of polymorphic queries in terms of horizontal and vertical object expansions, to find attributes and tuples, respectively, missing from the local database. We show that both expansions can be conducted in a uniform framework. (c) We develop a top-K algorithm to approximately answer polymorphic queries. (d) We also provide a method to merge tuples collected from various peers, based on matching keys specified in polymorphic queries. Our experimental study verifies that polymorphic queries are able to find more sensible information than traditional queries supported by P2P systems, and that these queries can be evaluated efficiently.