Research On P2p Flow Identification Using Behavior Characteristics

The identification technology of P2P flow is an important part of network control technology, which has great impact on the QoS. With the fast development of network technology, Internet has been massively changed in the scale and system hierarchy, and the P2P application has been developed at very fast speed. P2P traffic occupies a mass of the Internet bandwidth, which influences the ordinary work of the other applications badly. Furthermore, the identification of P2P flow has been a part of the bottleneck of network development, as traditional identification Technology of P2P flow couldn't meet the need.To fulfill the demand of the development of new circumstances, National Digital Switching System Engineering & Technology Center takes on the fundamental technique research task of the "New Generation Network with High Trustability" project of the National High-Tech Research and Development Program of China (863 Program) for the Eleventh-Five-Year Plan in the information technology. The research focuses on the real time analysis of network traffic, and in the thesis the research focuses on the identification of P2P flow.This thesis based on the project above aims at the demand of identification and supervision of P2P flows. This thesis has researched on the veracity and expansibility of identification, and proposes a solution to P2P flow identification to fulfill the need of the research and manufacture of network management. The main work and contributions are outlined as follows:Several traffic behavior characteristics of popular P2P applications have been analyzed. Based on the characteristic of varied packet size, this thesis proposes an identification method based on the improved packet size oscillation frequency. This method combined the packet size oscillation with the characteristic of successive short udp packets of same size. The experiment results show that this method exhibits good performance for identifying P2P flow.This thesis proposes an identification method based on the weighed-behavior characteristics parallel matching to avoid the limitation of single characteristic identification. According to the different impacts on identification efficiency by different behavior characteristic, it sets different weights to those characteristics. Furthermore it adopts parallel matching policy in order to shorten the matching time and improve the efficiency.This thesis proposes an identification scheme using gradual-convergency weighed-behavior characteristics parallel matching. To fulfill the demand of traffic identification and control technology, this thesis adopts the method of gradual convergency to reduce processing data while considering the characteristic of huge network traffic. Moreover this identification method has an off-line training module, which is used to obtain new characteristics. The method has good expansibility. The experiment results show that this method exhibits good performance in speed and veracity for identifying P2P flow.