Research On P2P Traffic Feature Analysis And Traffic Identification

With the rapid development of peer-to-peer applications, more and more network resource is consumed by recreational traffic. The P2P traffic brings lots of security risks to Internet, affecting the operation of other network services. In order to improve the network environment, the big P2P traffic must be controlled. To control the P2P traffic must be on the basic of being able to identify it firstly. So the ability to accurately detect P2P traffic becomes a crucial problem for some ISPs and Enterprises.Now the domestic and international traffic identification methods focus on P2P applications based on TCP protocol. For the traffic traces offered by foreign web site, the early P2P service traffic does use the TCP protocol to transmit data likely. However, with the development of P2P technology and its combining with steaming media technology, the importance of UDP protocol in P2P traffic can not be ignored. The P2P traffic identification pre-methods mostly study on files-sharing applications, less considering the service traffic characteristics of P2P streaming media which plays while downloading. Taking into account the increasing importance of UDP protocol, this thesis studys on UDP streams and finds the P2P traffic identification algorithm. The main work is as follows:(1) Summarize and analyse the existing major P2P traffic identification techniques, and point out their problems.(2) Based on the analysis of the four kind of domestic popular P2P streaming media, we find that they all use application-layer protocol characteristics. We can still induct their application-layer protocol characteristics through statistical analyzing, though they don't use plaintext protocol like BT applications. In the light of methods of detecting of file-sharing P2P application traffic, we propose the way to indentify P2P streaming media traffic based on protocol feature matching. Theoretical analysis and experiments show that the algorithm is effective. Because the protocol features almost present in every UDP packets, there is not the situation that losing packets leads to fail to detect like TCP protocol.(3) In order to resolve the detecting problem caused by the changes of protocol feature and protocol encryption, we use SVM algorithm to training P2P traffic characteristics and construct classification model after considering traffic features both of streaming media and file-sharing P2P. We normalize experimental data to balance the effect between feature data, and bring the grid search method to find the optimal parameters. The algorithm overcomes the problems of threshold setting and parameters choosing, and can identify P2P traffic effectively.