P2P流量精准分类：聚类流方法

2 浏览量更新于2024-08-26 收藏 1.78MB PDF 举报

"通过聚类流对P2P流量进行准确分类" 文章"通过聚类流对P2P流量进行准确分类"是一篇研究论文，主要探讨了如何精确地识别和分类P2P（peer-to-peer）网络流量。P2P自上世纪90年代末出现以来，一直占据了互联网流量的主要部分。对于互联网服务提供商（ISPs）和网络管理者来说，准确地识别P2P流量是一项关键任务，因为它涉及到网络管理、带宽分配以及内容过滤等问题。该论文提出了一种新颖的方法，即利用"聚类流"（Clustering Flows, CFs）在细粒度级别上对P2P流量进行精确分类。聚类流是指P2P应用在短时间内产生的最频繁且稳定的流量流。这些特殊流量流具有明显的特征，可以作为识别P2P应用的关键指标。通过检测到相应的聚类流，研究者能够有效地对P2P应用进行分类。与现有的流量分类方法相比，该方法的优势在于其高精度。它依赖于在小时间间隔内出现的特殊流数量，而不是依赖于复杂的特征提取或深度学习模型。这种方法可能更易于实施，并且对网络环境的适应性更强，因为它减少了对流量特征的复杂分析。论文中可能涉及了以下知识点： 1. P2P流量分析：理解P2P网络流量的特性，包括其分散性、不可预测性和对网络带宽的影响。 2. 流量分类技术：介绍现有的P2P流量分类方法，如基于端口、协议、会话模式或统计特征的分类。 3. 聚类流定义：详细解释聚类流的概念、形成机制以及其作为P2P应用标识符的原因。 4. 分类算法：可能涉及一种或多种用于识别聚类流的算法，如K-means聚类、DBSCAN等。 5. 实验设计与评估：通过实验验证提出的聚类流分类方法的准确性和效率，可能包括与其他方法的对比测试。 6. 应用场景：讨论该方法在实际网络管理、流量优化、内容过滤和网络安全中的潜在应用。这篇论文为解决P2P流量分类问题提供了一个创新思路，对于网络管理和优化具有重要的理论和实践价值。

42 China Communications

•

November 2013

TRUSTED COMPUTING AND INFORMATION SECURITY

Accurate Classification of P2P Traffic by

Clustering Flows

HE Jie

, YANG Yuexiang

, QIAO Yong

, TANG Chuan

College of Computer, National University of Defense Technology, Changsha 410073, China

Information Center, National University of Defense Technology, Changsha 410073, China

Abstract: P2P traffic has always been a

dominant portion of Internet traffic since its

emergence in the late 1990s. The method used

to accurately classify P2P traffic remains a key

problem for Internet Service Producers (ISPs)

and network managers. This paper proposes a

novel approach to the accurate classification

of P2P traffic at a fine-grained level, which

depends solely on the number of special flows

during small time intervals. These special

flows, named Clustering Flows (CFs), are de-

fined as the most frequent and steady flows

generated by P2P applications. Hence we are

able to classify P2P applications by detecting

the appearance of corresponding CFs. Com-

pared to existing approaches, our classifier can

realise high classification accuracy by ex-

ploiting only several generic properties of

flows, instead of extracting sophisticated fea-

tures from host behaviours or transport layer

data. We validate our framework on a large set

of P2P traffic traces using a Support Vector

Machine (SVM). Experimental results show

that our approach correctly classifies P2P ap-

plications with an average true positive rate of

above 98% and a negligible false positive rate

of about 0.01%.

Key words: traffic classification; P2P; fine-gr-

ained; support vector machine

I. INTRODUCTION

The continuous emerging of P2P applications

enriches the resources sharing by network, but

it also raises many challenges to network

management. Therefore, the monitor of P2P

applications is very important, and P2P traffic

classification is the key point. Unfortunately,

classifying P2P traffic is problematic both due

to the large number of new emerging P2P ap-

plications and the intentional use of random port

numbers and encryption for network traffic.

Currently, there are roughly three approaches

in the state of the art in traffic classification

according to application protocols [1].

Firstly, traditional port-based classification

[2] is a simple approach based on the assump-

tion that applications use their standard port

numbers assigned by INNA. However, this app-

roach has become unreliable due to the ran-

domness of ports.

Secondly, payload-based techniques, also ca-

lled Deep Packet Inspection (DPI), are based

on the inspection of packets payload [3-7].

Traditional DPI methods inspect the content of

packets looking for distinctive signatures that

allow recognising a given application. These

techniques can only identify traffic generated

by those specific applications, and will be-

come unavailable when the traffic is encrypted.

To overcome these drawbacks, some new DPI

approaches which use the payload data in dif-

ferent perspectives are emerging recently. For

example, Dhamankar et al. [5] used entropy to

reveal the randomness of the encrypted pay-

loads of Skype traffic; Hullar et al. [6] ad-

dressed the classification of P2P applications

using the first 16 bytes of payload of the first



Received: 2013-06-13

Revised: 2013-08-27

Editor: ZHANG Huanguo

下载后可阅读完整内容，剩余9页未读，立即下载

weixin_38712578

粉丝: 4

P2P流量精准分类：聚类流方法

基于微集群的P2P流量分类数据流聚类方法

2013年精准识别P2P流量：细粒度下的聚类流分类法

论文研究-基于通信流量特征的隐秘P2P僵尸网络检测.pdf

机器学习分类下网络流量的特征选取.pdf

P2P僵尸网络的快速检测技术 (2010年)

网络游戏-基于周期性通讯行为分析的P2P僵尸网络检测方法、系统.zip

P2P流量检测：基于流特征与数据挖掘的方法

基于聚类的流量识别系统：算法比较与90%以上识别率

KTSVM：一种P2P流量识别的两阶段策略模型

基于SVDD的P2P流量识别：简化模型与高精度

最新资源