The Research On Identification Of P2P Streaming Traffic

With the growing popularity of the P2P technology, especially the expansion of file-sharing and streaming applications, the potential security threats posed by P2P technologies and the resource abuse by P2P applications concern Internet Service Providers (ISPs). For traffic-specific network engineering, ISPs must be able to classify Internet traffic, which highlights the need for P2P traffic detection. At present, commercial products for identifying P2P traffic are mainly based on application-layer signature matching. Any approach based on software-special characteristic matching will easily become useless along with software renewal or while payloads are encrypted, and can keep never outdated only according to nature-behavior patterns. To this day, there is none of studies on behavior patterns of P2P-streaming peer while the application spreads and softwares are evolving more rapidly than others, it makes the problems of security and copyright infringement more severe and uncontrollable than other systems. It is important and worthy of challenging for the Internet research community to acquire an in-depth understanding of the delivery of P2P streaming, particularly for the delivery architectures that hold the greatest promise for broad deployment in the near future so that the knowledge can be used to detect any unknown or encrypted traffic.Supported by many related works and the analysis of main characteristics of P2P system , a conclusion can be gained that dynamic behavior characterics, in theory, the dynamic nature of a P2P system distinguishes it from any traditional systems. As far as we know, it is the first time all dynamic characters of P2P system are reduced to two aspects: churn of peers and resource evanescence.From the perspective of peers churn an identification algorithm applied to all types of P2P traffic is presented. In P2P network , the dynamics of peer participation will cause low probability of success of connection establishment when peers are accessed randomly. Based on it, CSI algorithm is proposed which can identify a P2P peer by calculating the its success probability to contact with other peers within a period of time, and then analyzing the probability serial calculated in time order with Kernel Density Estimation aiding in understanding the most potential value of probability. Armed with the churn model and the joint lifetime distribution of the users of P2P system, the residual lifetime distribution of a randomly selected alive peer in the network is obtained. The contact-success probability of peers in structured P2P systems using distributed hash tables,also in centralized systems, is calculated according to the residual lifetime distribution. Both the not-so-high results consolidate the idea that is impossible for P2P system to make every connecting between peers successful due to large-scale network and churn. And the results of experiments also conform the effectiveness of CSI.The theory that P2P streaming traffic can be charactered in two levels: P2P and streaming media. It conducts a two-level traffic classification model of P2P streaming which filters all traffic with P2P-level characters and then identifying streaming traffic within the P2P traffic filtered in the first step . That is obvious this model can reach good performance for its simpleness and small-cost.As resources in P2P live network with very temporary nature, so through the average percentage of BM information receiving a live peer can be detected effectively, and IRI algorithm is proposed. Since the transmission of streaming media both need a high standard of real-time, as well as the timing of the continuity, so that the P2P live system deploys a high-frequent and cyclical download scheduling and information exchange mechanisms to achieve the inter-peer maximum resource sharing. Through the frequent exchange of structure of resources in their buffer , live peers can overcome the failures caused by the rapid rise of expired resources. From this, a character that Buffer Map informations should be transmitted continually in live traffic is revealed and followed by the measurement model of it. Further, the residual lifetime distribution of any randomly selected resource in peer' s buffer is derived which can be used to deduce a threshold of the identification of live traffic . The actual results of experiments show that IRI algorithm has a very small rate of missing detection, and samely a slightly higher rate of mistaken detection which can be effectively eliminated by IRI combined with the considerations of the bit rate and waveform of flow . Similarly, from the perspective of resource evanescence the research of the flow-based traffic detection techniques of the other application—media-on-demand(MoD) can be conducted . As a result of resource evanescence and the requirement for real-time and smooth playback, the frequent periodic scheduling mechanism to download must be needed by P2P-based MoD systems. BSI algorithm is proposed which classifies traffic into MoD and no-MoD by measuring the consistency of scheduling at breakpoints in the downloading process of a peer. As hard disk-storage and CDN servers are deployed in MoD systems, resources stay for a longer time than live system, but resource evanescence still is one of the most important characters. In addition to this, the requirement for real-time and continuity playback, the download scheduling and information exchange mechanisms also keep frequent as live system ,however, with a relative increasing cycle, so the detecting technology for live traffic is no longer suitable. In MoD system, the demand for high interactive operations with users makes the downloading mode within a period from one-time-scheduling of live system to multiple-random-scheduling through which peers can be responded more rapidly. The frequent and periodic mode of downloading is the key reason for considerable breakpionts in the process of data transmission. Data transmission following every breakpoint almost is triggered by scheduling which is more easily to measure than live system with bigger-payload packets to instruct downloading. The correspoding measurement model is proposd ,also with the threshold for classification whose effectiveness proved by Maximum Entrop Method. Experimental results show that BSI algorithm is not only applicable to MoD but also live traffic.