Skype协议分析及流量识别

近几年来,P2P网络技术发展迅速,Skype是创建Kazaa的组织开发的一个基于P2P的VoIP客户端,用户可以用Skype通过互联网进行语音通话.本文通过抓取Skype的流量数据进行协议分析,主要关注PC2PC的登录/注销,文字通讯,语音通信,文件传输及PC2Phone等过程,进而总结协议特征,提出了一种基于协议分析的Skype流量识别方法,结果显示识别率达到95％以上.     

Skype‐Hunter: A real‐time system for the detection and classification of Skype traffic

In the previous years, Skype has gained more and more popularity, since it is seen as the best VoIP software with good quality of sound, ease of use and one that works everywhere and with every OS. Because of its great diffusion, both the operators and the users are, for different reasons, interested in detecting Skype traffic. In this paper we propose a real‐time algorithm (named Skype‐Hunter) to detect and classify Skype traffic. In more detail, this novel method, by means of both signature‐based and statistical procedures, is able to correctly reveal and classify the signaling traffic as well as the data traffic (calls and file transfers). To assess the effectiveness of the algorithm, experimental tests have been performed with several traffic data sets, collected in different network scenarios. Our system outperforms the ‘classical’ statistical traffic classifiers as well as the state‐of‐the‐art ad hoc Skype classifier. Copyright © 2011 John Wiley & Sons, Ltd.     

基于P2P的Skype与常规业务的流量分析和识别

首先介绍了P2P流量识别的一般方法和与识别P2P相关的新技术,然后研究论述了基于P2P的Skype的流量特征,并在此基础上提出了P2P和基于P2P的Skype与其他常规业务的流量识别方法。     

A Technique for Adaptive Voice Flow Control in Integrated Packet Networks

Integrated packet-switched networks have potential for providing improved performance by dynamically sharing transmission bandwidths between various users and user types, but new flow control methods are needed to deal with packetized voice traffic. This paper describes a packet voice flow control concept based on embedded speech coding. Results are presented from a computer simulation study of the technique in the context of a multilink wideband packet speech network. Several control methodologies are described, leading to an end-to end feedback approach that achieves stable operation and efficient utilization of network resources by adaptively matching transmitted voice bit rates to prevailing network conditions. Issues in the design of embedded speech coding algorithms are reviewed and a candidate structure based on channel vocoding principles is presented, along with the subjective results of some preliminary listening tests     

Split agent‐based routing in interconnected networks

Adaptive behaviour of swarm‐based agents (BT Technol. J. 1994; 12 :104–113; AAMAS Conference '02, Melbourne, Australia, Month 1–2, 2002; Softcomput. J. 2001; 5 (4):313–317.) is being studied in this paper with respect to network throughput for a certain amount of data traffic. Algorithmically complex problems like routing data packets in a network need to be faced with a dynamically adaptive approach such as agent‐based scheme. Particularly in interconnected networks where multiple networks are participating in order to figure a large‐scale network with different QoS levels and heterogeneity in the service of delay sensitive packets, routing algorithm must adopt in frequent network changes to anticipate such situations. Split agent‐based routing technique (SART) is a variant of swarm‐based routing (Adapt. Behav. 1997; 5 :169–207; Proceedings of 2003 International Symposium on Performance Evaluation of Computer and Telecommunication Systems—SPECTS, Montreal, Canada, July 20–24, 2003; 240–247.) where agents are split after their departure to the next node on a hop‐by‐hop basis. Packets that are delay sensitive are marked as prioritized which agents recognize‐as being a part of a packet‐ and try to influence the two‐way routing tables. Thorough examination is made, for the performance of the proposed algorithm in the network and the QoS offered, taking into account a number of metrics. It is shown that the split agent routing scheme applied to interconnected networks offers a decentralized control in the network and an efficient way to increase overall performance and packet control reducing at the same time the packet loss concept. Copyright © 2004 John Wiley & Sons, Ltd.     

A Per-Flow Based Node Architecture for Integrated Services Packet Networks

As the Internet transforms from the traditional best-effort service network into QoS-capable multi-service network, it is essential to have new architectural design and appropriate traffic control algorithms in place. This paper presents a network node architecture and several traffic management mechanisms that are capable of achieving QoS provisioning for the guaranteed service (GS), the controlled-load (CL) service, and the best-effort (BE) service for future integrated services networks. A key feature of our architecture is that it resolves the out-of-sequence problem associated with the traditional design. We also propose two novel packet discarding mechanisms called selective pushout (SP) and selective pushout plus (SP+). Simulation results show that, once admitted into the network, our architecture and traffic management algorithms provide, under all conditions, hard performance guarantees to GS flows and consistent (or soft) performance guarantees to CL flows, respectively; minimal negative impact to in-profile GS, CL and BE traffic should there be any out-of-profile behavior from some CL flows.     

Network application profiling with traffic causality graphs

A network application profiling framework is proposed that is based on traffic causality graphs (TCGs), representing temporal and spatial causality of flows to identify application programs. The proposed framework consists of three modules: the feature vector space construction using discriminative patterns extracted from TCGs by a graph‐mining algorithm; a feature vector supervised learning procedure in the constructed vector space; and an application identification program using a similarity measure in the feature vector space. Accuracy of the proposed framework for application identification is evaluated, making use of ground truth packet traces from seven peer‐to‐peer (P2P) application programs. It is demonstrated that this framework achieves an overall 90.0% accuracy in application identification. Contributions are twofold: (1) using a graph‐mining algorithm, the proposed framework enables automatic extraction of discriminative patterns serving as identification features; 2) high accuracy in application identification is achieved, notably for P2P applications that are more difficult to identify because of their using random ports and potential communication encryption. Copyright © 2014 John Wiley & Sons, Ltd.     

Integrated video and voice transmission using packet reservation multiple access

This paper proposes a new protocol for the integration of voice and video transmission over the packet reservation multiple access (PRMA) system that is a modification of reservation‐ALOHA protocol. We focus on low bit‐rate video applications like video conferencing and visual telephony for wireless communications. The ITU–T H.263 standard provides a solution to the need for low bit‐rate video compression under 64 kbytes/s. The proposed protocol assumes that each voice terminal follows a traffic pattern of talk spurts and silent gaps with fixed permission probability (p=0.3), and each video terminal has the higher permission probability (p=1) to access the available slot based on ITU–T H.263 standard. Again, we present a ‘pseudo‐reservation’ scheme to release slots reserved by video terminals according to the contents of each video transmission buffer, and the active voice terminals can temporarily access the additional slots to improve the performance without sacrificing the video capacity of the system. The packet dropping probability of the active voice terminals and bandwidth utilization of the system are superior to the original PRMA, as indicated in simulation results. Copyright © 2001 John Wiley & Sons, Ltd.     

An efficient method of P2P traffic identification based on wavelet packet decomposition and kernel principal component analysis

Peer‐to‐peer (P2P) traffic identification is currently an important challenge to network management and measurement. Many approaches based on statistics have been proposed to identify P2P traffic. However, flow features extracted by traditional methods are rough and one‐sided, which might lead to inaccuracy identification of network traffic. Besides, P2P traffic has too many statistical features, which is a challenge to the time complexity and space complexity of the classifier. This work focuses on the study of flow features. First, micro features of flow signals are extracted based on wavelet packet decomposition, and we combine them with the traditional features into combination features. The experimental results show that combination features have better performance than traditional features for P2P traffic identification, and 16 kinds of wavelet functions were tested to find the best one. Second, a feature reduction algorithm based on improved kernel principal component analysis is provided. The results show that the feature reduction algorithm proposed in this paper plays good performance to P2P traffic identification, because it could greatly reduced the number of features while having no affection on identification accuracy. Copyright © 2012 John Wiley & Sons, Ltd.     

A novel four-tier software-defined network architecture for scalable secure routing and load balancing

Software-defined networking is an emerging paradigm for supporting flexible network management. In the traditional architecture for a software-defined network (SDN), the controller commonly uses a general routing algorithm such as Open Shortest Path First (OSPF), which chooses the shortest path for communication. This may cause the largest amount of network traffic, especially in large-scale environments. In this paper, we present the design for a novel SDN-based four-tier architecture for scalable secure routing and load balancing. In Tier 1, user authentication is conducted using elliptic curve cryptography (ECC); this avoids unnecessary loads from unauthorized users. In Tier 2, packet classification is performed based on the packet characteristics using the fuzzy analytical hierarchy process (fuzzy AHP), and packets are placed into three individual queues. In Tier 3, scalable secure routing is achieved by selecting the optimal path using the improved particle swarm optimization and ant colony optimization algorithms. With these optimization algorithms, we can adaptively change the number of users, the number of switches, and other parameters. In Tier 4, the recommended secure cluster (multicontroller) management is accomplished using an algorithm that employs modified k-means clustering and a recurrent neural network. Deep reinforcement learning (DRL) is also proposed for updating the controller information. Experimental results are analyzed using the OMNeT++ network simulator, and the evaluated performance displayed improvement over a variety of existing methods in terms of response time (50% to 60%), load (55%), execution time (3.2%), throughput (9.8%), packet loss rate (1.02%), end-to-end delay (50%), and bandwidth consumption (45%).     

Application‐Level Traffic Monitoring and an Analysis on IP Networks

Traditional traffic identification methods based on well‐known port numbers are not appropriate for the identification of new types of Internet applications. This paper proposes a new method to identify current Internet traffic, which is a preliminary but essential step toward traffic characterization. We categorized most current network‐based applications into several classes according to their traffic patterns. Then, using this categorization, we developed a flow grouping method that determines the application name of traffic flows. We have incorporated our method into NG‐MON, a traffic analysis system, to analyze Internet traffic between our enterprise network and the Internet, and characterized all the traffic according to their application types.     

RAD‐EI: A routing attack detection scheme for edge‐based Internet of Things environment

Internet of Things (IoT) offers various types of application services in different domains, such as “smart infrastructure, health‐care, critical infrastructure, and intelligent transportation system.” The name edge computing signifies a corner or edge in a network at which traffic enters or exits from the network. In edge computing, the data analysis task happens very close to the IoT smart sensors and devices. Edge computing can also speed up the analysis process, which allows decision makers to take action within a short duration of time. However, edge‐based IoT environment has several security and privacy issues similar to those for the cloud‐based IoT environment. Various types of attacks, such as “replay, man‐in‐the middle, impersonation, password guessing, routing attack, and other denial of service attacks” may be possible in edge‐based IoT environment. The routing attacker nodes have the capability to deviate and disrupt the normal flow of traffic. These malicious nodes do not send packets (messages) to the edge node and only send packets to its neighbor collaborator attacker nodes. Therefore, in the presence of such kind of routing attack, edge node does not get the information or sometimes it gets the partial information. This further affects the overall performance of communication of edge‐based IoT environment. In the presence of such an attack, the “throughput of the network” decreases, “end‐to‐end delay” increases, “packet delivery ratio” decreases, and other parameters also get affected. Consequently, it is important to provide solution for such kind of attack. In this paper, we design an intrusion detection scheme for the detection of routing attack in edge‐based IoT environment called as RAD‐EI. We simulate RAD‐EI using the widely used “NS2 simulator” to measure different network parameters. Furthermore, we provide the security analysis of RAD‐EI to prove its resilience against routing attacks. RAD‐EI accomplishes around 95.0% “detection rate” and 1.23% “false positive rate” that are notably better than other related existing schemes. In addition, RAD‐EI is efficient in terms of computation and communication costs. As a result, RAD‐EI is a good match for some critical and sensitive applications, such as smart security and surveillance system.     

A distributed MAC scheme supporting voice services in mobile ad hoc networks

Future mobile ad hoc networks are expected to support voice traffic. The requirement for small delay and jitter of voice traffic poses a significant challenge for medium access control (MAC) in such networks. User mobility presents unique difficulties in this context due to the associated dynamic path attenuation. In this paper, a MAC scheme for mobile ad hoc networks supporting voice traffic is proposed. With the aid of a low‐power probe prior to DATA transmissions, resource reservation is achieved in a distributed manner, thus leading to small packet transmission delay and jitter. The proposed scheme can automatically adapt to dynamic path attenuation in a mobile environment. Statistical multiplexing of on/off voice traffic can also be achieved by partial resource reservation for off voice flows. Simulation results demonstrate the effectiveness of the proposed scheme. Copyright © 2009 John Wiley & Sons, Ltd.     

Back to the future

In the 1970s - before dense wavelength-division multiplexing (DWDM), Google, Facebook, iPhone, and Skype - we had a telephone network based on circuit-switching technology for primarily real-time services (voice) and also for a very small traffic volume of data. This network provided reasonable voice quality, reliability, availability, and accessibility to customers. The telephone exchanges of the '70s somehow could maintain call state information, which is considered "unscalable" by many in the 21st century despite the tremendous technological advances in chip technology of the last 40 years. Furthermore, according to the recent Cisco White Paper [1], "The sum of all forms of video (TV, VoD, Internet, and P2P) will account for close to 90 percent of consumer traffic by 2012." This immediately leads to the question: if we are going to have fundamentally similar services, why shouldn't we consider increasing the use of networking concepts and solutions we had in the '70s?     

P2P VoIP应用的性能评测

基于IP技术的语音分组传输(VoIP)电话目前被广泛使用,Skype与GTalk是VoIP应用的两个典型代表.在可控网络环境下,通过调整信道容量、时延、丢包、抖动等网络参数,利用PESQ MOS方法评测了Skype与GTalk的语音质量,并且讨论了在可变网络环境下的动态适应性策略.     

Providing deterministic packet delays and packet losses in multimedia wireless networks

‘Anytime, anywhere’ communication, information access and processing are much cherished in modern societies because of their ability to bring flexibility, freedom and increased efficiency to individuals and organizations. Wireless communications, by providing ubiquitous and tetherless network connectivity to mobile users, are therefore bound to play a major role in the advancement of our society. Although initial proposals and implementations of wireless communications are generally focused on near‐term voice and electronic messaging applications, it is recognized that future wireless communications will have to evolve towards supporting a wider range of applications, including voice, video, data, images and connections to wired networks. This implies that future wireless networks must provide quality‐of‐service (QoS) guarantees to various multimedia applications in a wireless environment. Typical traffic in multimedia applications can be classified as either Constant‐Bit‐Rate (CBR) traffic or Variable‐Bit‐Rate (VBR) traffic. In particular, scheduling the transmission of VBR multimedia traffic streams in a wireless environment is very challenging and is still an open problem. In general, there are two ways to guarantee the QoS of VBR multimedia streams, either deterministically or statistically. In particular, most connection admission control (CAC) algorithms and medium access control (MAC) protocols that have been proposed for multimedia wireless networks only provide statistical, or soft, QoS guarantees. In this paper, we consider deterministic QoS guarantees in multimedia wireless networks. We propose a method for constructing a packet‐dropping mechanism that is based on a mathematical framework that determines how many packets can be dropped while the required QoS can still be preserved. This is achieved by employing: (1) An accurate traffic characterization of the VBR multimedia traffic streams; (2) A traffic regulator that can provide bounded packet loss and (3) A traffic scheduler that can provide bounded packet delay. The combination of traffic characterization, regulation and scheduling can provide bounded loss and delay deterministically. This is a distinction from traditional deterministic QoS schemes in which a 0% packet loss are always assumed with deterministically bounding the delay. We performed a set of performance evaluation experiments. The results will demonstrate that our proposed QoS guarantee schemes can significantly support more connections than a system, which does not allow any loss, at the same required QoS. Moreover, from our evaluation experiments, we found that the proposed algorithms are able to out‐perform scheduling algorithms adopted in state‐of‐the‐art wireless MAC protocols, for example Mobile Access Scheme Based on Contention and Reservation for ATM (MASCARA) when the worst‐case traffic is being considered. Copyright © 2002 John Wiley & Sons, Ltd.     

Performance of cellular packet CDMA in an integrated voice/data network

This paper presents a simulation-based study of cellular packet CDMA systems operating in an integrated voice/data traffic scenario. Spread-spectrum CDMA provides a suitable framework for resource-shared packet transport capable of combining isochronous (voice, ISDN) and bursty data services. In this work, a general network model for cellular packet CDMA with mixed voice/data traffic is described and used to evaluate the capacity/performance impact of several key system parameters. First, the effect of spreading factor (N) and forward error correction (FEC) rate are studied, confirming earlier work indicating a weak dependence onN and a well-defined optimum code rate in the range of 0.5–0.7 (with BCH coding). Next, the effect of propagation loss coefficient () on network capacity is investigated over a range of possible assumptions for, including both constant and distance-dependent models. The results show that system capacity depends strongly on, varying by as much as a factor of 2 over the range of parameters considered. For a given distance-dependent assumption, performance results are also obtained for different cell sizes in order to understand the overall spatial reuse efficiency achievable in different cellular and microcellular scenarios. This is followed by an investigation of traffic source model effects: first the capacity improvement from voice activity detection VAD) is presented, showing the expected 21 gains. Results for varying proportions of voice and data traffic intensities indicate that the operating efficiency does not change significantly as the proportion of bursty data relative to voice is varied.     

Low‐cost and high‐performance: VoIP monitoring and full‐data retention at multi‐Gb/s rates using commodity hardware

Voice over IP (VoIP) is increasingly replacing the old public switched telephone network (PSTN) technology. In this new scenario, there are several challenges for VoIP providers. First, VoIP requires a detailed monitoring of both users' quality of service (QoS) and experience (QoE) to a greater extent than in traditional PSTNs. Second, such a monitoring process must be able to track VoIP traffic in high‐speed networks, nowadays typically of multi‐Gb/s rates. Third, recent government directives require that providers retain information from their users' calls. Similarly, the convergence of data and voice services allows operators to provide new services such as full‐data retention, in which users' calls can be recorded for either quality assessment (call centers, QoE) or security purposes (lawful interception). This implies a significant investment in infrastructure, especially in large‐scale networks which require multiple points of measurement and redundancy. This paper proposes a novel methodology, architecture and system to fulfill such challenges, called VoIPCallMon, as well as the data structures and necessary hardware‐tuning knowledge for its development. As distinguishing features, VoIPCallMon provides very high performance, being able to process VoIP traffic on‐the‐fly at high bitrates, novel services and significant cost reduction by using commodity hardware with minimal interference with operational VoIP networks. The performance evaluation shows that the system copes with the VoIP load of real‐world operators. We further evaluated the system performance at a fully saturated 10 Gb/s link and no packet loss was reported, therefore demonstrating the potential of commodity hardware solutions. Copyright © 2014 John Wiley & Sons, Ltd.     

Multiclass rate control mechanism for prioritised voice service inpacket networks

A new multiclass rate control method for real-time voice traffic transmission in packet networks is proposed. The class for rate control is defined according to the requested voice quality. In the proposed control mechanism, a source coding rate is adjusted based on network feedback information and class type. It is shown that, using the proposed method, multiple voice qualities can be supported without voice quality degradation in traffic with low priority     

基于UDP流量的P2P流媒体流量识别算法研究

以几款主流的P2P流媒体网络电视作为研究对象,深入分析了其产生的流量在端口使用方面的特点和报文长度分布上的差异。通过对这些特征的总结和提取,获得了基于端口特性“在一次交互过程中,特定主机的特定端口唯一确定一种应用”等结论。在此基础上提出了一种基于带有扩展属性的流记录准确识别P2P应用UDP流量的EXID算法。通过对CERNET江苏省边界10G主干信道上采集的Trace数据中5种P2P流媒体应用进行识别,并与机器学习流量识别算法进行比较,其结果表明提出的方案具有很高的查准率和查全率,时间效率高,且不易受样本比重的影响。