Peer-to-Peer IP Traffic Classification Using Decision Tree and IP Layer Attributes

Abstract

We present a new approach using data-mining technique and, in particular, decision tree to classify peer-to-peer (P2P) traffic in IP networks. We captured the Internet traffic at a main gateway router, performed preprocessing on the data, selected the most significant attributes, and prepared a training-data set to which the decision-tree algorithm was applied. We built several models using a combination of various attribute sets for different ratios of P2P to non-P2P traffic in the training data. We observed that the accuracy of the model increases significantly when we include the attributes "Src IP addr" and "Dst IP addr" in building the model. By detecting communities of peers, we achieved classification accuracy of higher than 98%. Consequently, we recommend that: (a) the classification must be done within the authority of the Internet service providers (ISP) in order to detect communities of peers, and (b) the decision tree needs to be frequently trained to ensure the fairness and correctness of the classification algorithm. Our approach is based only on information in the IP layer, eliminating the privacy issues associated with deep-packet inspection.

Exploiting unlabeled data to improve peer-to-peer traffic classification using incremental tri-training method

“…It is worth noting that in our previous work [6,7] we inspected several P2P applications to confirm that they all allow users to randomly select port numbers only in the range of 1024-65535.…”

“…Raahemi et al applied supervised machine learning techniques in [6,7], namely Neural Networks and decision trees, to classify P2P traffic. They pre-processed and labelled the data, and built several models using a combination of different attributes for various ratios of P2P/NonP2P in the training data set.…”

“…In our previous work [6,7], in order to detect new communities of peers attending and old communities of peers leaving (a phenomenon called concept drift in data mining and machine learning), we used a window-based classification method that divides stream data into fixed-size windows of examples and builds a model on the window, then reevaluates the model on each upcoming window. When the accuracy drops below 90%, the model is rebuilt using the subsequent window.…”

“…In particular, P2P applications may use randomly selected non-standard ports to communicate which makes it difficult to distinguish them from other types of traffic by inspecting only port numbers [3]. Thus, in recent years, several data mining techniques were proposed to identify the Internet traffic based on the statistical characteristics [4][5][6][7]. These approaches assume that P2P applications typically send data in some sort of pattern, and these patterns can be used as a means of identification.…”

P2P Simulator for Queries Routing Using Data Mining

“…average, sum, max, execution time) on P2P networks. For instance, Raahemi et al [5] presented a new approach using data-mining technique, in particular Decision Tree, to classify Peer-to-Peer (P2P) traffic in IP networks by capturing Internet traffic at a main gateway router, perform data pre-processing, select the most significant attributes, and prepare a training-data set to which the decision-tree algorithm to be applied. They built several models using a combination of various attribute sets for different ratios of P2P to non-P2P traffic in the training data.…”