Fine-grained P2P traffic classification by simply counting flows

HE Jie; YANG Yue-xiang; QIAO Yong; DENG Wen-ping

doi:10.1631/FITEE.1400267

Your Location：

Home >

Browse articles >

Fine-grained P2P traffic classification by simply counting flows

Computer & Automation | Updated：2022-06-06

- Fine-grained P2P traffic classification by simply counting flows
- 基于簇流的细粒度P2P流量分类
- Frontiers of Information Technology & Electronic Engineering Vol. 16, Issue 5, Pages: 391-403(2015)
- Affiliations：
  
  1.College of Computer, National University of Defense Technology, Changsha 410073, China
  2.The Research Institution, China Electronic Equipment & System Engineering Company, Beijing 100141, China
- Author bio：
  
  Jie HE, E-mail:hejie@nudt.edu.cn
  [ "Yue-xiang YANG, E-mail:yyx@nudt.edu.cn" ]
  [ "Yong QIAO, E-mail:brave_jo@163.com" ]
  [ "Wen-ping DENG, E-mail:wpdeng.nudt@gmail.com" ]
- Funds：
- DOI：10.1631/FITEE.1400267
  CLC： TP393
- Received：22 July 2014，
  
  Revised：2015-04-09，
  
  Published：2015-05
- Accepted：
Scan QR Code
HE Jie, YANG Yue-xiang, QIAO Yong, et al. Fine-grained P2P traffic classification by simply counting flows[J]. Frontiers of Information Technology & Electronic Engineering, 2015, 16(5): 391-403.
DOI：

HE Jie, YANG Yue-xiang, QIAO Yong, et al. Fine-grained P2P traffic classification by simply counting flows[J]. Frontiers of Information Technology & Electronic Engineering, 2015, 16(5): 391-403. DOI： 10.1631/FITEE.1400267.

摘要

目的

P2P流量的不断增长带来网络管理和安全方面的各类问题。因此对P2P流量进行精确分类显得尤为重要。本文旨在提出一种能对P2P流量实现高效精确且细粒度分类的方法。

创新点

本文方法不依赖于对报文负载内容的检查，也无需借助复杂的统计特征和机器学习方法。仅利用网络流的几个基本属性就能实现对P2P流量的精确且细粒度分类。当待检测主机的网络流量组成较为复杂时，其他基于主机的流量分类方法将失效，但本文方法仍然有效。

方法

首先，将P2P应用产生的流量中出现最频繁且稳定的相似流簇定义为簇流，并认为一组簇流是由一类P2P网络活动所产生（图2）。本文P2P流量分类方法分两步进行（图3）。在簇流提取阶段，为每一种P2P应用采集训练流量集，并从中提取出对应的簇流集合。在流量分类阶段，监测待检测主机在单位时间窗口内所产生的簇流的类型和数量，并根据一个记分函数对流量进行分类。

结论

提出一种能对P2P流量实现高效精确且细粒度分类的方法。根据现实流量评价所提方法的性能。实验结果达到高于97.22%的正确率和低于2.78%的误报率。

Abstract

The continuous emerging of peer-to-peer (P2P) applications enriches resource sharing by networks

but it also brings about many challenges to network management. Therefore

P2P applications monitoring

in particular

P2P traffic classification

is becoming increasingly important. In this paper

we propose a novel approach for accurate P2P traffic classification at a fine-grained level. Our approach relies only on counting some special flows that are appearing frequently and steadily in the traffic generated by specific P2P applications. In contrast to existing methods

the main contribution of our approach can be summarized as the following two aspects. Firstly

it can achieve a high classification accuracy by exploiting only several generic properties of flows rather than complicated features and sophisticated techniques. Secondly

it can work well even if the classification target is running with other high bandwidth-consuming applications

outperforming most existing host-based approaches

which are incapable of dealing with this situation. We evaluated the performance of our approach on a real-world trace. Experimental results show that P2P applications can be classified with a true positive rate higher than 97.22% and a false positive rate lower than 2.78%.

关键词

Keywords

references

T. Auld , A.W. Moore , S.F. Gull . Bayesian neural networks for Internet traffic classification . IEEE Trans. Neur. Netw. , 2007 . 18 ( 1 ): 223 - 239 . DOI: 10.1109/TNN.2006.883010 http://doi.org/10.1109/TNN.2006.883010 .

T. Ban , S. Guo , M. Eto , 等 . A study on cost-effective P2P traffic classification . Proc. Int. Joint Conf. on Neural Networks , 2012 . p.1 - 7 . DOI: 10.1109/IJCNN.2012.6252672 http://doi.org/10.1109/IJCNN.2012.6252672 .

N. Basher , A. Mahanti , A. Mahanti , 等 . Acomparative analysis of web and peer-to-peer traffic . Proc. 17th Int. Conf. on World Wide Web , 2008 . p.287 - 296 . DOI: 10.1145/1367497.1367537 http://doi.org/10.1145/1367497.1367537 .

P. Bermolen , M. Mellia , M. Meo , 等 . Abacus: accurate behavioral classification of P2P-TV traffic . Comput. Netw. , 2011 . 55 ( 6 ): 1394 - 1411 . DOI: 10.1016/j.comnet.2010.12.004 http://doi.org/10.1016/j.comnet.2010.12.004 .

J.B. Chen . Fuzzy based approach for P2P file sharing detection . J. Internet Technol. , 2011 . 12 ( 6 ): 921 - 930 . .

A. Dainotti , A. Pescapè , K.C. Claffy . Issues and future directions in traffic classification . IEEE Network , 2012 . 26 ( 1 ): 35 - 40 . DOI: 10.1109/MNET.2012.6135854 http://doi.org/10.1109/MNET.2012.6135854 .

R. Dhamankar , R. King . Protocol Identification via Statistical Analysis (PISA) . White Paper, Tipping Point , 2007 .

A. Este , F. Gringoli , L. Salgarelli . On the stability of the information carried by traffic flow features at the packet level . ACM SIGCOMM Comput. Commun. Rev. , 2009 . 39 ( 3 ): 13 - 18 . DOI: 10.1145/1568613.1568616 http://doi.org/10.1145/1568613.1568616 .

A. Finamore , M. Mellia , M. Meo , 等 . KISS: stochastic packet inspection classifier for UDP traffic . IEEE/ACM Trans. Netw. , 2010 . 18 ( 5 ): 1505 - 1515 . DOI: 10.1109/TNET.2010.2044046 http://doi.org/10.1109/TNET.2010.2044046 .

B. Gallagher , M. Iliofotou , T. Eliassi-Rad , 等 . Link homophily in the application layer and its usage in traffic classification . Proc. IEEE INFOCOM , 2010 . p.1 - 5 . DOI: 10.1109/INFCOM.2010.5462239 http://doi.org/10.1109/INFCOM.2010.5462239 .

J.V. Gomes , P.R.M. Inácio , M. Pereira , 等 . Detection and classification of peer-to-peer traffic: a survey . ACM Comput. Surv. , 2013 . 45 ( 3 ): Article 30 DOI: 10.1145/2480741.2480747 http://doi.org/10.1145/2480741.2480747 .

J. He , Y. Yang , Y. Qiao , 等 . Accurate classification of P2P traffic by clustering flows . China Commun. , 2013 . 10 ( 11 ): 42 - 51 . DOI: 10.1109/CC.2013.6674209 http://doi.org/10.1109/CC.2013.6674209 .

N.F. Huang , G.Y. Jai , H.C. Chao . Early identifying application traffic with application characteristics . Proc. IEEE Int. Conf. on Communications , 2008 . p.5788 - 5792 . DOI: 10.1109/ICC.2008.1083 http://doi.org/10.1109/ICC.2008.1083 .

B. Hullár , S. Laki , A. Gyorgy . Early identification of peer-to-peer traffic . Proc. IEEE Int. Conf. on Communications , 2011 . p.1 - 6 . DOI: 10.1109/icc.2011.5963023 http://doi.org/10.1109/icc.2011.5963023 .

J. Hurley , E. Garcia-Palacios , S. Sezer . Host-based P2P flow identification and use in real-time . ACM Trans. Web , 2011 . 5 ( 2 ): Article 7 DOI: 10.1145/1961659.1961661 http://doi.org/10.1145/1961659.1961661 .

M. Iliofotou , H. Kim , M. Faloutsos , 等 . Graption: a graph-based P2P traffic classification framework for the Internet backbone . Comput. Netw. , 2011 . 55 ( 8 ): 1909 - 1920 . DOI: 10.1016/j.comnet.2011.01.020 http://doi.org/10.1016/j.comnet.2011.01.020 .

T. Karagiannis , K. Papagiannaki , M. Faloutsos . BLINC: multilevel traffic classification in the dark . ACM SIGCOMM Comput. Commun. Rev. , 2005 . 35 ( 4 ): 229 - 240 . DOI: 10.1145/1090191.1080119 http://doi.org/10.1145/1090191.1080119 .

A. Moore , D. Zuev , M. Crogan . Discriminators for Use in Flow-Based Classification . Technical Report, University of London, UK , 2005 .

T.T.T. Nguyen , G. Armitage . Clustering to assist supervised machine learning for real-time IP traffic classification . Proc. IEEE Int. Conf. on Communications , 2008 . p.5857 - 5862 . DOI: 10.1109/ICC.2008.1095 http://doi.org/10.1109/ICC.2008.1095 .

S. Ohzahata , Y. Hagiwara , M. Terada , 等 . Atraffic identification method and evaluations for a pure P2P application . Proc. 6th Int. Workshop on Passive and Active Network Measurement , 2005 . p.55 - 68 . DOI: 10.1007/978-3-540-31966-5_5 http://doi.org/10.1007/978-3-540-31966-5_5 .

Sandvine . Global Internet Phenomena Report 1H 2014 . Technical Report. Sandvine Incorporated ULC, Waterloo, Ontario, Canada , 2014 .

T.S. Tabatabaei , M. Adel , F. Karray , 等 . Machine learning-based classification of encrypted Internet traffic . Proc. 8th Int. Conf. on Machine Learning and Data Mining in Pattern Recognition , 2012 . p.578 - 592 . DOI: 10.1007/978-3-642-31537-4_45 http://doi.org/10.1007/978-3-642-31537-4_45 .

S. Valenti , D. Rossi . Identifying key features for P2P traffic classification . Proc. IEEE Int. Conf. on Communications , 2011 . p.1 - 6 . DOI: 10.1109/icc.2011.5963018 http://doi.org/10.1109/icc.2011.5963018 .

D. Yang , Y. Zhang , H. Zhang , 等 . Multi-factors oriented study of P2P Churn . Int. J. Commun. Syst. , 2009 . 22 ( 9 ): 1089 - 1103 . DOI: 10.1002/dac.1001 http://doi.org/10.1002/dac.1001 .

T. Zhang , R. Ramakrishnan , M. Livny . BIRCH: an efficient data clustering method for very large databases . ACM SIGMOD Rec. , 1996 . 25 ( 2 ): 103 - 114 . DOI: 10.1145/235968.233324 http://doi.org/10.1145/235968.233324 .

Views

Downloads

CSCD

Alert me when the article has been cited

Submit

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

Chat

Address：Zhejiang University Press, 148 Tianmushan Road, Hangzhou, China Postal code：310028
Tel：+86-571-88273162 Email：fitee@zju.edu.cn
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.

⁰