Comparation Of Three Methods For P2P Traffic Identification Using Neural Networks

P2P technology has broken the traditional C/S mode restrictions and becomes one of the mainstream technology of new era Internet. More and more people enjoy the convenience brought by P2P technology, at the same time, some new P2P applications are also emerging. However, along with the rapid development of P2P technology, many diffcult questions have arised, such as network bandwidth by the amount consumed, monitoring network resources and security risks, thus, how to identify and control P2P traffic effectively has become a hot issue.Traditional P2P traffic identification methods are based on port identification, or deep packet inspection technology, or based on identifying technology of flow characteristics. Identification technology based on neural network which has the characters including self-learning, self-organizing and self-adaption, could resolve all the problems in traditional methods.By means of the analysis of the variety of P2P traffic identification technology, this paper proposed a way of P2P flow identification which based on neural networks combined with statistical characteristics of P2P traffic, and focused on three types of neural network who can be used to identify the P2P traffic, and each neural network recognition effects were compared. The main job of this paper can be summarized as follows:①Through existing detailed analysis of P2P traffic identification technologies, we point out the advantages and disadvantages of the various traditional methods. Due to the advantages and disadvantages of each method, we proposed a P2P traffic identification method based on the combination of features statistics and neural network characteristics.②Based on protocol analysis of two main P2P streaming media system PPLive and PPStream, we summarized the statistical features of P2P traffic, and selected five features as the characteristic vector. Including the total number of packages, average packet length, the proportion of TCP flow in total traffic, the proportion of upload traffic in total and the ratio of ports number and the number of different IP.③Three types of neural networks which can be used for P2P traffic identification, including BP neural network, LVQ neural network and FUZZY ARTMAP neural network, have been studied deeply. They were analyzed in detail on the aspects of network structure, principle, learning algorithm and their advantages.④We built the experimental system, and pick up five representative P2P traffic (Bit Torrent, eMule, PPLive and PPStream) and non-P2P traffic. These traffic samples were extracted to train the three neural netowrk. Combined with characteristics of neural network itself and based on the comparation of accurate identification rate and real time, we ultimately select an optimal program, and optimiz the neural network indentification by adjusting the parameters and the sample sequences.The experimental results indicate that FUZZY ARTMAP neural network has the best performance on P2P traffic identification. Due to further optimization of the neural network, the rate of P2P traffic identification is higher than 94%, increasing by 0.66%~4.00%. The time cost in neural network training is no more than two seconds, completely satisfy the real-time requirements.