Hybrid P2P traffic classification with heuristic rules and machine learning

Ye, Wujian; Cho, Kyungsan

doi:10.1007/s00500-014-1253-5

Cited by 31 publications

(20 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, none of P2P botnets is involved in their experiments. Wujian Ye et al [15] proposed an improved two-step hybrid P2P traffic classifier which provides high accuracy and low overhead compared to other known schemes. The first step consists of a signature-based classifier at the packet-level combined with connection heuristics.…”

Section: Related Workmentioning

confidence: 99%

“…This kind of method also gradually begins to fail since more and more P2P applications are adopting the technique of payload encryption [3]. The in-the-dark method [10]- [15] conducts P2P traffic identification based on statistical features extracted from transport layer data or host network behaviors. This kind of method seem to be very promising for detecting unknown and encrypted P2P traffic accurately without inspecting the port number and payload content.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

PeerSorter: Classifying Generic P2P Traffic in Real-Time

Yang

Wang

et al. 2014

2014 IEEE 17th International Conference on Computational Science and Engineering

View full text Add to dashboard Cite

The rapid development of Peer-to-Peer (P2P) technology brings challenges to quality of service (QoS), network planning and access control. An accurate classification of P2P traffic is vital for addressing those challenges. Traditional portbased and payload-based methods fail to cope with emerging port disguise and payload encryption techniques. In this paper, we present PeerSorter, a system for the classification of generic P2P traffic in real-time. PeerSorter is featured by four characteristics. Firstly, it can accurately classify nearly all kinds of legitimate P2P applications as well as various P2P botnets, by building application profiles of their significant network activity patterns. Moreover, PeerSorter is capable of real-time processing, because of its simplicity of mechanism and small classification time windows. In addition, PeerSorter can be readily extended by adding profiles of new P2P applications. Finally, PeerSorter can work well even in the scenario where the classification target is running along with other bandwidth consumer (including P2P applications) at the same time. We evaluate the performance of PeerSorter on traffic datasets of a large variety of P2P applications, including two popular P2P botnets. The experimental results demonstrate that we can classify all the considered types of P2P traffic with an average true positive rate of 97.83% and an average false positive rate below 0.04% within 2 minutes.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

PeerSorter: Classifying Generic P2P Traffic in Real-Time

Yang

Wang

et al. 2014

2014 IEEE 17th International Conference on Computational Science and Engineering

View full text Add to dashboard Cite

show abstract

“…The traffic traces were collected at edge router of the campus network and consists of Web (http and https), Mail (pop3, pop3s, imap, imaps) and P2P (bittorrent, edonkey, skype) traffic; and accuracy rate achieved by this technique in terms of flows and bytes were 93.9 and 96.3 %, respectively. Ye and Cho [96] proposed two-step hybrid P2P traffic classification approach by combining packet-level and flow-level classifier. First step (which is packet-level classification) is the combination of signature-based and heuristicbased technique; where the packets if not classified with former approach, are checked with the latter one for classification.…”

Section: Classification Of Traffic In the Darkmentioning

confidence: 99%

Identifying P2P traffic: A survey

Bhatia

Kumar

2016

Peer-to-Peer Netw. Appl.

View full text Add to dashboard Cite

Peer-to-Peer (P2P) traffic is widely used for the purpose of streaming media, file-sharing, instant messaging, games, software etc., which often involves copyrighted data. From the past decade, P2P traffic has been contributing to major portion of Internet traffic which is still rising and hence is consuming a lot of network traffic bandwidth. It also worsens congestion of network traffic significantly and degrades the performance of traditional client-server applications. Popularity of various P2P applications has led Internet Service Providers (ISPs) to face various challenges regarding efficiently and fairly utilizing network resources. The traditional methods of identifying P2P traffic such as port-based and payload-based are proving ineffective due to their significant limitations and can be bypassed. Hence, new approaches based on statistics or behaviour of network traffic needs to be developed and adopted in order to accurately identify existing and new P2P traffic which emerge over the time. This article presents a survey regarding various strategies involved in identifying P2P traffic. Furthermore, conceptual analysis of network traffic measurement and monitoring is also presented.

show abstract

“…Machine learning based traffic classification techniques (Dewaele et al 2010;Ye and Cho 2014;Palmieri et al 2013) as effective alternatives, can avoid deep packet inspection (DPI) and create new features from transport layer statistics (e.g., packet size and inter-arrival time). However, most traffic classifiers only pursue high FCA (ratio between the number of correctly classified flows and the total number of flows), which ignore the BCA (ratio between the number of correctly classified bytes and the total number of bytes).…”

Section: Introductionmentioning

confidence: 99%

SmoteAdaNL: a learning method for network traffic classification

Liu

Wang

Tao

2015

J Ambient Intell Human Comput

View full text Add to dashboard Cite

Machine learning based network traffic classification is a critical technique for network management, and has attracted much attention. Recently, most of the researchers focus on achieving high flow classification accuracy (FCA). However the amount of ''mice'' flows is more than that of ''elephant'' flows in the Internet, these classifiers hence are more suitable for ''mice'' flows, but have low byte classification accuracy (BCA). To address this issue, the notion of byte misclassification is firstly explored. According to the exploration that most misclassified bytes belong to the minority class, a novel method of network traffic classification is proposed by combining the data re-sampling and ensemble learning algorithms. To enhance the classification accuracy of the minority class, the data re-sampling algorithm is employed to increase the number of minority class flows. The data re-sampling however will change the data distribution and degrade the generalization of a classifier. A boosting-style ensemble learning algorithm with the consideration of ensemble diversity hence is employed to improve the generalization. The experiments conducted on the real-world traffic datasets show that the proposed method achieves over 90 % BCA and 96 % FCA on average, and improves about 7.15 % BCA by comparing with the existing methods.

show abstract

Hybrid P2P traffic classification with heuristic rules and machine learning

Cited by 31 publications

References 23 publications

PeerSorter: Classifying Generic P2P Traffic in Real-Time

PeerSorter: Classifying Generic P2P Traffic in Real-Time

Identifying P2P traffic: A survey

SmoteAdaNL: a learning method for network traffic classification

Contact Info

Product

Resources

About