Real-Time P2P Traffic Identification

Zhang, Liangpei; Zhang, Shunyi; Lu, Yan‐qing; Yan, Junrong

doi:10.1109/glocom.2008.ecp.475

Cited by 30 publications

(22 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Most prior work has either focused on P2P traffic classification from the perspective of a more general problem of Internet traffic classification [18], [19], [20], or has given special attention to detection of botnets (centralized or distributed) in Internet traffic [21], [22], [23]. The detection of P2P botnet traffic in the presence of benign P2P traffic has not received much attention.…”

Section: Related Workmentioning

confidence: 99%

PeerShark: Detecting Peer-to-Peer Botnets by Tracking Conversations

Narang

Ray

Hota

et al. 2014

2014 IEEE Security and Privacy Workshops

View full text Add to dashboard Cite

Abstract-The decentralized nature of Peer-to-Peer (P2P) botnets makes them difficult to detect. Their distributed nature also exhibits resilience against take-down attempts. Moreover, smarter bots are stealthy in their communication patterns, and elude the standard discovery techniques which look for anomalous network or communication behavior. In this paper, we propose PeerShark, a novel methodology to detect P2P botnet traffic and differentiate it from benign P2P traffic in a network. Instead of the traditional 5-tuple 'flow-based' detection approach, we use a 2-tuple 'conversation-based' approach which is port-oblivious, protocol-oblivious and does not require Deep Packet Inspection. PeerShark could also classify different P2P applications with an accuracy of more than 95%.

show abstract

Section: Related Workmentioning

confidence: 99%

PeerShark: Detecting Peer-to-Peer Botnets by Tracking Conversations

Narang

Ray

Hota

et al. 2014

2014 IEEE Security and Privacy Workshops

View full text Add to dashboard Cite

show abstract

“…Apart from its universality, this method is very efficient to classify some protocols operating on fixed port numbers. Using it, however, gives very bad results in detection of protocols using dynamic port numbers, like P2P and Skype [1]- [3]. The second drawback is not less severe: many scam applications use well-known port numbers to be treated in the network with priority.…”

Section: Introductionmentioning

confidence: 99%

“…Deep Packet Inspection (DPI) solutions are quite slow and require a lot of processing power [1], [3]. Furthermore they relay on inspecting the user data and therefore privacy and confidentiality issues can appear [1]. Application signatures for every application must be created outside the system and kept up to date [1], what can be problematic.…”

Section: Introductionmentioning

confidence: 99%

“…The second drawback is not less severe: many scam applications use well-known port numbers to be treated in the network with priority. Deep Packet Inspection (DPI) solutions are quite slow and require a lot of processing power [1], [3]. Furthermore they relay on inspecting the user data and therefore privacy and confidentiality issues can appear [1].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A method for classification of network traffic based on C5.0 Machine Learning Algorithm

Bujlow

Riaz

Pedersen

2012

2012 International Conference on Computing, Networking and Communications (ICNC)

View full text Add to dashboard Cite

Monitoring of the network performance in highspeed Internet infrastructure is a challenging task, as the requirements for the given quality level are service-dependent. Backbone QoS monitoring and analysis in Multi-hop Networks requires therefore knowledge about types of applications forming current network traffic. To overcome the drawbacks of existing methods for traffic classification, usage of C5.0 Machine Learning Algorithm (MLA) was proposed. On the basis of statistical traffic information received from volunteers and C5.0 algorithm we constructed a boosted classifier, which was shown to have ability to distinguish between 7 different applications in test set of 76,632-1,622,710 unknown cases with average accuracy of 99.3-99.9 %. This high accuracy was achieved by using high quality training data collected by our system, a unique set of parameters used for both training and classification, an algorithm for recognizing flow direction and the C5.0 itself. Classified applications include Skype, FTP, torrent, web browser traffic, web radio, interactive gaming and SSH. We performed subsequent tries using different sets of parameters and both training and classification options. This paper shows how we collected accurate traffic data, presents arguments used in classification process, introduces the C5.0 classifier and its options, and finally evaluates and compares the obtained results.

show abstract

“…BLINC [6] proposed multilevel traffic identification at different levels -social, functional and application level from the 4-tuple flows. The research community has adopted Machine Leaning (ML) techniques [7], [8], [9] [10], [11], [12] to classify P2P traffic with higher accuracy. This approach is based on statistical characteristics obtained from the 5-tuple flows.…”

Section: Introductionmentioning

confidence: 99%

Behavior-based P2P traffic identification using fuzzy approach

Reddy

Hota

Rajarajan

2015

2015 International Conference on Applied and Theoretical Computing and Communication Technology (iCATccT)

View full text Add to dashboard Cite

The use of P2P applications has been in rise over past several years due to their capabilities to share large volumes of files, efficiently transport large amounts of voice and video, allow anonymous browsing etc. bypassing the controls enforced by the service providers. Therefore the detection of these applications has become a challenge for ISPs and network administrators. In this paper, we propose P2P host identification framework based on fuzzy pattern recognition. The fuzzy patterns are examined from the behavior of P2P and NonP2P flows. We define several membership functions based on the behavioral characteristics including: (1) Bytes per second, (2) Packet Inter Arrival Time, (3) Packet count per second and (4) Number of unique hosts contacted. The performance evaluation based on the real-time traces show that the proposed system promises more than 98% of accuracy and a low false positive rate of ≈2%.

show abstract

Real-Time P2P Traffic Identification

Cited by 30 publications

References 9 publications

PeerShark: Detecting Peer-to-Peer Botnets by Tracking Conversations

PeerShark: Detecting Peer-to-Peer Botnets by Tracking Conversations

A method for classification of network traffic based on C5.0 Machine Learning Algorithm

Behavior-based P2P traffic identification using fuzzy approach

Contact Info

Product

Resources

About