P2P Traffic Identification Method Based on Traffic Statistical Characteristics

摘要

Different from traditional P2P traffic identification methods based on keywords or well-known ports, this paper presents a new identification method of P2P traffic based on the most basic characteristics of P2P protocol. We compare and analyze P2P traffic and traditional C/S traffic using statistical analysis techniques, and obtain two statistical characteristics of P2P traffic: continuity and multi-connectivity. In addition, the mechanism of sliding window is introduced in the quantification of the statistical characteristics to establish a P2P traffic identification model. Finally, we develop a P2P traffic identification emulation system based on the proposed model, and the experiment results reveal that this new model can identify known and unknown P2P traffic effectively.