It is shown in the literature that network address translation devices have become a convenient way to hide the source of malicious behaviors. In this research, we explore how far we can push a machine learning (ML) approach to identify such behaviors using only network flows. We evaluate our proposed approach on different traffic data sets against passive fingerprinting approaches and show that the performance of a machine learning approach is very promising evenwithout using any payload (application layer) information.

Identification of P2P (peer to peer) applications inside network traffic plays an important role for route provisioning, traffic policing, flow prioritization, network service pricing, network capacity planning and network resource management. Inspecting and identifying the P2P applications is one of the most important tasks to have a network that runs efficiently. In this paper, we focus on identification of different P2P applications. To this end, we explore four commonly used supervised machine learning algorithms as C4.5, Ripper, SVM(Support Vector Machines), Naïve Bayesian and well known unsupervised machine learning algorithm K-Means on four different datasets. We evaluate their performances to identify the P2P applications that each traffic flow belongs to. Evaluations show that, Ripper algorithm gives better results than the others.