Graph-Based P2P Traffic Classification at the Internet Backbone

Iliofotou, Marios; Kim, Hyunchul; Faloutsos, Michalis; Mitzenmacher, Michael; Pappu, Prashanth; Varghese, George

doi:10.1109/infcomw.2009.5072151

Cited by 36 publications

(24 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, But et al [2007] proposed the ANGEL system for detecting and then prioritizing game traffic in ISP network. Iliofotou et al [2009b] developed a graph-based framework for classifying P2P traffic. Armitage [2006a, 2006b] proposed training the classifier on a combination of short subflows for fast traffic classification and demonstrated that good classification results could be achieved with subflows formed by as few as only 25 packets.…”

Section: Related Workmentioning

confidence: 99%

A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks

Jin

Duffield

Erman

et al. 2012

ACM Trans. Knowl. Discov. Data

View full text Add to dashboard Cite

The ability to accurately and scalably classify network traffic is of critical importance to a wide range of management tasks of large networks, such as tier-1 ISP networks and global enterprise networks. Guided by the practical constraints and requirements of traffic classification in large networks, in this article, we explore the design of an accurate and scalable machine learning based flow-level traffic classification system, which is trained on a dataset of flow-level data that has been annotated with application protocol labels by a packet-level classifier. Our system employs a lightweight modular architecture, which combines a series of simple linear binary classifiers, each of which can be efficiently implemented and trained on vast amounts of flow data in parallel, and embraces three key innovative mechanisms, weighted threshold sampling, logistic calibration, and intelligent data partitioning, to achieve scalability while attaining high accuracy. Evaluations using real traffic data from multiple locations in a large ISP show that our system accurately reproduces the labels of the packet level classifier when runs on (unlabeled) flow records, while meeting the scalability and stability requirements of large ISP networks. Using training and test datasets that are two months apart and collected from two different locations, the flow error rates are only 3% for TCP flows and 0.4% for UDP flows. We further show that such error rates can be reduced by combining the information of spatial distributions of flows, or collective traffic statistics, during classification. We propose a novel two-step model, which seamlessly integrates these collective traffic statistics into the existing traffic classification system. Experimental results display performance improvement on all traffic classes and an overall error rate reduction by 15%. In addition to a high accuracy, at runtime, our implementation easily scales to classify traffic on 10Gbps links.

show abstract

Section: Related Workmentioning

confidence: 99%

A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks

Jin

Duffield

Erman

et al. 2012

ACM Trans. Knowl. Discov. Data

View full text Add to dashboard Cite

show abstract

“…First, since our techniques are applied at the structure-level via graph analysis, they will also identify regular P2P file-sharing topologies. To avoid misclassifying such regular P2P networks as botnets, we can perform preprocessing such as flow filtering and clustering [9] based on known patterns of regular P2P networks such as the port numbers. Also, bots identified locally in edge networks are helpful as their presence in a communication graph makes other nodes suspicious as well, so our approach may need assistance from detection mechanisms at the edge to further confirm that a graph is indeed formed by a botnet.…”

Section: Discussionmentioning

confidence: 99%

“…For simplicity, all edges carry the same weight. Graph metrics to determine whether the traffic is P2P are proposed in [9] and adopted to analyze the modified chord in [11]. In our analysis, we inspect the same set of features as in [11] for consistency.…”

Section: F Graph Analysismentioning

confidence: 99%

Measuring the effectiveness of infrastructure-level detection of large-scale botnets

Zeng¹,

Yan²,

Eidenbenz³

et al. 2011

2011 IEEE Nineteenth IEEE International Workshop on Quality of Service

View full text Add to dashboard Cite

Abstract-Botnets are one of the most serious security threats to the Internet and its end users. In recent years, utilizing P2P as a Command and Control (C&C) protocol has become popular due to its decentralized nature that can help hide the botmaster's identity. Most bot detection approaches targeting P2P botnets either rely on behavior monitoring or traffic flow and packet analysis, requiring fine-grained information collected locally. This requirement limits the scale of detection. In this paper, we consider detection of P2P botnets at a high-levelthe infrastructure level-by exploiting their structural properties from a graph analysis perspective. Using three different P2P overlay structures, we measure the effectiveness of detecting each structure at various locations (the Autonomous System (AS), the Point of Presence (PoP), and the router rendezvous) in the Internet infrastructure.

show abstract

“…We gathered information from two groups: the authors of the papers that [ Annapureddy et al 2007b;Yunhao et al 2007;Xie et al 2008;Mol et al 2008;Silva et al 2008;Iliofotou et al 2009;Pianese et al 2007;Annapureddy et al 2007a;Leonardi et al 2008;Doulkeridis et al 2007a;Cheng et al 2007;Chi et al 2007;Rowaihy et al 2007;Ahmed and Boutaba 2007;Belenkiy et al 2007;Kantere et al 2009;Huang et al 2007b;Garbacki et al 2007;Buchegger et al 2009;Crainiceanu et al 2007;Zhou and Hwang 2007;Bharambe et al 2008;Terpstra et al 2007;Zaharia and Keshav 2008;Wang et al 2007;Guo et al 2007;Hefeeda and Saleh 2008;Ren et al 2008;Zhou et al 2008;Zhuge and Li 2007;Haridasan and van Renesse 2008;Feng and Li 2008;Magharei and Rejaie 2009a;Liu 2007;Yang and Chen 2008;Do et al 2008;Do et al 2009;Boufkhad et al 2008;Duminuco and Biersack 2008;Yiu et al 2007;Doulkeridis et al 2007b;…”

Section: Features Questionnairementioning

confidence: 99%

The state of peer-to-peer network simulators

et al. 2013

View full text Add to dashboard Cite

Copyright and reuse:Sussex Research Online is a digital repository of the research output of the University.Copyright and all moral rights to the version of the paper presented here belong to the individual author(s) and/or other copyright owners. To the extent reasonable and practicable, the material made available in SRO has been checked for eligibility before being made available.Copies of full text items generally can be reproduced, displayed or performed and given to third parties in any format or medium for personal research or study, educational, or not-for-profit purposes without prior permission or charge, provided that the authors, title and full bibliographic details are credited, a hyperlink and/or URL is given for the original metadata page and the content is not changed in any way. Networking research often relies on simulation in order to test and evaluate new ideas. An important requirement of this process is that results must be reproducible so that other researchers can replicate, validate and extend existing work. We look at the landscape of simulators for research in peer-to-peer (P2P) networks by conducting a survey of a combined total of over 280 papers from before and after 2007 (the year of the last survey in this area), and comment on the large quantity of research using bespoke, closedsource simulators. We propose a set of criteria that P2P simulators should meet, and poll the P2P research community for their agreement. We aim to drive the community towards performing their experiments on simulators that allow for others to validate their results.

show abstract

Graph-Based P2P Traffic Classification at the Internet Backbone

Cited by 36 publications

References 21 publications

A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks

A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks

Measuring the effectiveness of infrastructure-level detection of large-scale botnets

The state of peer-to-peer network simulators

Contact Info

Product

Resources

About