Identifying Skype nodes by NetFlow-based graph analysis

Abstract

In this paper we present an algorithm that is able to progressively discover nodes of a Skype overlay P2P network. Starting from a single, known Skype node, we can easily identify other Skype nodes in the network, through the analysis of widely available and standardized IPFIX (NetFlow) data. Instead of relying on the analysis of content characteristics or packet properties, we monitor connections of known Skype nodes in the network and then progressively discover other nodes through the analysis of their mutual contacts. We show that our results are comparable to the methods using more complex data analytics. The use of standardized input data allows for easy deployment onto real networks. Moreover, because this approach requires only short processing times, it scales very well in larger and higher speed networks.