基於連線模式之即時P2P檔案分享的流量辨識方法

Abstract

由於P2P應用的日漸風行，尤其是檔案分享的應用造成了一些問題，如大量的網際網路頻寬被P2P流量所佔用及非合法授權軟體或檔案之侵權等。為了解決這些問題，在本論文中，我們提出一種基於連線模式之即時P2P檔案分享的流量辨識方法，簡稱 RTI，來協助網路管理。RTI只需要五秒的流量便可即時地辨識出P2P檔案分享的流量，以供網路管理用。RTI分成三個階段，第一個階段是利用埠號來過濾掉非P2P的封包。第二個階段利用三個探索法則來辨識有使用P2P的主機位址。最後階段我們從有使用P2P的主機中，利用四個探索法則來辨識出P2P檔案分享的流量。為了評估此方法的有效性，我們收集了校園的網路流量，並根據封包特徵碼的分類器來驗證我們的結果。實驗結果顯示，我們提供的RTI辨識正確率高達96.2%，且只有3.5%的誤判率。相對於的一樣利用五秒的流量，John [9] 只有64.8%的正確率和高達74.19%的誤判率。

The use of peer-to-peer (P2P) applications is growing dramatically, particularly for sharing large video/audio files and software, which results in several serious problems, such as internet piracy and unreasonable utilization of network resources. To conquer these problems, in this thesis, we propose a heuristic-based real time file sharing traffic identification (RTI) scheme at the transport layer for facilitating network management. The proposed RTI only needs a 5 seconds trace to effectively identify P2P file sharing traffic in real time for network management tools to timely filter, block, or record the traffic. The proposed RTI can be divided into three phases. In the first phase, we use port numbers to filter out non-P2P packets. In the second phase, we use three heuristics to identify P2P-using hosts. These heuristics are based on connection patterns of P2P networks, i.e., the numbers of distinct destination IPs and ports, and the usage of UDP packets. In the last phase, we use four heuristics to identify P2P file sharing traffic from the P2P-using hosts identified in the second phase. To evaluate the effectiveness of our scheme, we used traces collected in our campus network for P2P file sharing traffic identification and a payload-based classifier for verifying our traffic identification results. Experimental results indicate that the proposed RTI had the accuracy of 96.2% and the FPRate (false positive rate) of 3.5%. In contrast, John [9] had the accuracy of only 64.8% and FPRate of 74.19% using the same trace.