基于UDP流量的P2P流媒体流量识别算法研究?

doi:10.3969/j.issn.1000-436x.2012.12.004

Abstract

Abstract:

Several popular P2P networks TV were studied,and their differences in port usage and packet size distribution were analyzed thoroughly.By observing the above characteristics,the conclusions that network TV application employs only one port to generate most of UDP traffic in one communicat period were summarized,and the UDP packet sizes in various network TV differ significantly.Thus,a method that can identify P2P application’s UDP traffic accurately and effectively was proposed based on extended flow records.Through identifying and verifying the five P2P streaming application traffic which was called Trace data collected from the backbone channel of CERNET (China education and research network) border in Jiangsu Province,and traffic identification results compared with machine learning algorithms show that the proposed method has a high precision rate and recall rate,high time efficient,and not susceptible to the impact of the proportion of the sample.

Key words: UDP, P2P, traffic identification, extended flow records

Shi DONG,Gang WANG. Research on P2P streaming media identification based on UDP[J]. Journal on Communications, 2012, 33(12): 25-34.

Figures/Tables 10

References 34

[1]	IP trace distribution system[EB/OL]. , 2010.
[2]	张艺濒, 张志斌, 赵咏 ,等. TCP与UDP网络流量对比分析研究[J]. 计算机应用研究, 2010,27(6): 2192-2197. ZHANG Y B , ZHANG Z B , ZHAO Y ,et al. TCP and UDP network traffic comparison analysis[J]. Application Research of Computers, 2010,27(6): 2192-2197.
[3]	LEE D , CARPENTER B E , BROWNLEE N . Observations of UDP to TCP ratio and port numbers[A]. Proc Int Conf on Internet Monitoring and Protection (ICIMP)[C]. Barcelona,Spain, 2010. 99-104.
[4]	Tcpudpratio[EB/OL]. , 2009.
[5]	樊华, 李理, 袁坚 ,等. 互联网流量控制的朗之万模型及相变分析[J]. 物理学报, 2009,58(11): 7507-7513. FAN H , LI L , YUAN J ,et al. Langevin model of the flow control in the internet and its phase transition analysis[J]. Acta Physica Sinica, 2009,58(11): 7507-7513.
[6]	Coralreef[EB/OL]. , 1999.
[7]	ROUGHAN M , SEN S , SPATSCHECK O ,et al. Class-of-service mapping for QOS:a statistical signature-based approach to IP traffic classification[A]. Proc of the ACM SIGCOMM Internet Measurement Conf[C]. Taormina,Italy, 2004. 135-148.
[8]	MOORE A W , ZUEV D . Internet traffic classification using Bayesian analysis techniques[A]. Proc of the 2005 ACM SIGMETRICS Int’l Conf on Measurement and Modeling of Computer Systems[C]. Banff,Alberta,Canada, 2005. 50-60.
[9]	李君, 张顺颐, 王浩云 ,等. 基于贝叶斯网络的Peer to peer识别方法[J]. 应用科学学报, 2009,27(2): 124-130. LI J , ZHANG S Y , WANG H Y ,et al. Peer to peer identification using Bayesian networks[J]. Journal of Applied Sciences, 2009,27(2): 124-130.
[10]	徐鹏, 刘琼, 林森 . 基于支持向量机的 Internet 流量分类研究[J]. 计算机研究与发展, 2009,46(3): 407-414. XU P , LIU Q , LIN S . Internet traffic classification based on support vector machines[J]. Journal of Computer Research and Development, 2009,46(3): 407-414.
[11]	KARAGIANNIS T , PAPAGIANNAKI K , FALOUTSOS M . BLINC:Multilevel traffic classification in the dark[A]. Proc of the ACM Sigcomm[C]. Philadelphia,USA, 2005. 229-240.
[12]	L7-filter,application layer packet classifier for Linux[EB/OL]. , 2003.
[13]	胡超, 陈鸣, 许博 ,等. 一种基于爬虫的分布式PPLive流实时检测系统[J]. 解放军理工大学学报, 2008,9(5): 512-516. HU C , CHEN M , XU B ,et al. Reptiles distributed PPLive streaming real-time detection system[J]. Journal of PLA University of Science and Technology (Natural Science Edition), 2008,9(5): 512-516.
[14]	Cisco system,IOS netflow feature(S)[EB/OL]. , 2004.
[15]	胡超 . 一种P2P 流识别和分析系统的设计与实现[D]. 南京:解放军理工大学, 2008. HU C . Design and Implementation of a P2P Flow Identification and Analysis System[D]. Nanjing:PLA University, 2008.
[16]	BLEUL H , RATHGEB E P , ZILLING S . Advanced P2P multiprotocol traffic analysis based on application level signature ion[A]. Proc of the Telecommunications Network Strategy and Planning[C]. New Delhi,India, 2006. 1-6.
[17]	XU K , ZHANG M , YE M J ,et al. Identify P2P traffic by inspecting data transfer behavior[J]. Journal of Computer Communi ions, 2010,33(10): 1141-1150.
[18]	LIU X B , YANG J H , XIE G G ,et al. Automated mining of packet signatures for traffic identification at application a with apriori algorithm[J]. Journal on Communications, 2009,30(12): 51-59.
[19]	TEUFL P , PAYER U , AMLING M ,et al. InfeCT-network traffic classification[A]. Proc of the 7th Int’l Conf on Networkin (ICN)[C]. Cancun,Mexico, 2008. 439-444.
[20]	PERéNYI M , MOLNáR S . Enhanced skype traffic identification[A]. Proc of the 2nd Int’l Conf on Performance Evaluation Methodologies and Tools[C]. Brussels,Belgium, 2007. 1-9.
[21]	BONFIGLIO D , MELLIA M , MEO M ,et al. Revealing skype traffic:when randomness plays with you[A]. ACM SIGCOMM Computer Communication Review[C]. New York,USA, 2007. 37-48.
[22]	YANG A M , JIANG S Y , DENG H . A P2P network traffic classification method using SVM[A]. Proc of the 9th Int’l Conf for Young Computer Scientists (ICYCS 2008)[C]. Zhangjiajie,China, 2008.398403.
[23]	ESTE A , GRINGOLI F , SALGARELLI L . On the stability of the information carried by traffic flow features at the packet level[A]. ACM SIGCOMM Computer Communication Review[C]. New York,USA, 2009. 13-18.
[24]	ESTE A , GRINGOLI F , SALGARELLI L . Support vector machines for TCP traffic classification[J]. Computer Networks, 2009,53(14): 2476-2490.
[25]	ROUGHAN M , SEN S , SPATSCHECK O ,et al. Class-of-service mapping for QoS:a statistical signature-based approach to IP traffic classification[A]. Proc of the 4th ACM SIGCOMM Conf on Internet Measurement[C]. New York,USA, 2004. 135-148.
[26]	MORI T , UCHIDA M , GOTO S . Flow analysis of Internet traffic:world wide web versus peer-to-peer[J]. Journal Systems and Computers in Japan, 2005,36(11): 70-81.
[27]	BASHER N , MAHANTI A , WILLIAMSON C ,et al. A comparative analysis of Web and peer-to-peer traffic[A]. Proc of the 17th Int’l Conf on world wide web[C]. New York,USA, 2008. 287-296.
[28]	CHEN Q Z , SHAO B , CHEN C . Design and implementation of P2P traffic identification system based on compound characteristics[J]. Journal of Southeast University (Natural Science Edition), 2008,38(S1): 109-113.
[29]	MOORE A W , ZUEV D . Internet traffic classification using bayesian analysis techniques[A]. ACM SIGMETRICS Performance Eva uation Review[C]. New York,USA, 2005. 50-60.
[30]	LI W , CANINI M , MOORE A W ,et al. Efficient application identification and the temporal and spatial stability of classification schema[J]. Computer Networks, 2009,53(6): 790-809.
[31]	ERMAN J , MAHANTI A , ARLITT M ,et al. Offline/realtime traffic classification using semi-supervised learning[J]. Performance Evaluation, 2007,64(9-12): 1194-1213.
[32]	SEN S , SPATSCHECK O , AND D . WANG accurate,scalable in-network identification of P2P traffic using application signatures[A]. in WWW[C]. New York,USA, 2004. 512-521
[33]	KARAGIANNIS T , BROIDO A , FALOUTSOS M . Transport layer identification of P2P traffic[A]. Proc of International Measurement Conference[C]. Sicily,Italy, 2004. 121-134.
[34]	鲁文斌, 杨家海, 刘洪波 . 基于节点连接模式的 P2P 节点识别算法[J]. 清华大学学报(自然科学版), 2009,49(7): 1045-1049. LU W B , YANG J H , LIU H B . Identification of P2P peers based on connection patterns[J]. Journal of Tsinghua University (Natural Science Edition), 2009,49(7): 1045-1049.

Metrics

Recommended 0

No Suggested Reading articles found!

应用类型	报文数量	大报文长度集合	小报文长度集合
PPS点播	401 448	{1 104,1 151,1 136}	{53,45}
PPLIVE	109 742	{1 103，1 257}	{73,77,58}
UUSEE	37 102	{1 076}	{36}
QQLIVE	145 363	{1 080,1 122}	{ 41,57,63}
皮皮点播	44 431	{1 308}	{38,40}

Trace	报文数	流数
ALL_Trace₁(0:00-1:00)	3.70×10⁸	3.74×10⁶
ALL_Trace₂(19:00-20:00)	9.78×10⁸	1.12×10⁷

ALL_Trace₁	占总报文数/%	占总字节数/%	占UDP报文数/%	占UDP字节数/%
PPS点播	5.12	4.00	12.40	12.78
PPLIVE点播	2.49	2.04	6.03	6.51
QQLIVE点播	0.24	0.15	0.59	0.49
UUSEE点播	0.13	0.14	0.32	0.44
PIPI点播	0.021	0.025	0.052	0.078
合计	8.00	6.36	19.39	20.30
ALL_Trace₂	占总报文数(%)	占总字节数(%)	占UDP报文数(%)	占UDP字节数(%)
PPS点播	6.22	4.89	13.48	12.50
PPLIVE点播	2.45	1.79	5.31	4.57
QQLIVE点播	0.44	0.36	0.95	0.91
UUSEE点播	0.47	0.55	1.02	1.41
PIPI点播	0.088	0.11	0.19	0.28
合计	9.67	7.70	20.95	19.67

评价指标	PPS点播	PPLIVE	UUSEE	QQLIVE	皮皮点播
查准率	99.5%	98.6%	99.3%	99.4%	99.2%
查全率	97.5%	97.8%	98.7%	98.5%	98.7%
总体正确率	98.5%	98%	98.9%	98.6%	98.2%

流测度	测度说明
双向报文数	两方向报文数之和
双向字节数	两方向字节数之和
平均报文长度	双向字节数 / 双向报文数
持续时间	流结束时间—流开始时间
TOS	两方向TOS之OR
TCPFlags1	某方向流的TCPFlags
TCPFlags2	另一方向流的TCPFlags
传输层协议	?
低位端口	?
高位端口	?
PPS	报文数/持续时间
byte/s	字节数/持续时间
平均报文到达间隔	持续时间/报文数
双向报文数比	流中两方向报文数的比率（≥1），其等于双向PPS之比和双向报文到达间隔之比
双向字节数比	流中两方向字节数的比率（≥1），其等于双向byte/s之比
双向报文长度比	流中两方向报文长度比率（≥1），(字节数 1/报文数1) / (字节数2/报文数2)

Research on P2P streaming media identification based on UDP

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 10

References 34

Related Articles 15

Metrics

Recommended 0

[1]	Bingli GUO,Ning ZHAO,Zhiwen ZHU,Fan NING,Shanguo HUANG. Research on traffic identification and scheduling based on optical interconnection architecture in data center [J]. Journal on Communications, 2018, 39(9): 122-128.
[2]	Hui HU,Ming CHEN,Bo LIU,Bo XU,Chang-you XING,Chao HU. Mechanism of eliminating UDP redundancy control packets in OpenFlow network [J]. Journal on Communications, 2017, 38(9): 167-175.
[3]	Wu-bin PAN,Guang CHENG,Xiao-jun GUO,Shun-xiang HUANG. Review and perspective on encrypted traffic identification research [J]. Journal on Communications, 2016, 37(9): 154-167.
[4]	Yi-chun LIU,Ying-hong LIANG. Dynamic P2P trust model based on context factors [J]. Journal on Communications, 2016, 37(8): 34-45.
[5]	Yan LIU,yin ZHANGGuo,zhou HEJin,Feng XU. MP2P high capacity and security resource node selection strategy based on Bayesian game [J]. Journal on Communications, 2016, 37(1): 110-115.
[6]	Hua NIE,Min ZHANG,Jing-rong GUO,Xiao-long YANG. Content popularity difference-aware cache eviction scheme for CDN-P2P hybrid networks [J]. Journal on Communications, 2015, 36(Z1): 9-15.
[7]	Yin-long LIU,Min WANG,Wei MA,Xu ZHOU,Ya-hui HU. Cooperative caching scheme based on the minimization of total cost for P2P caches [J]. Journal on Communications, 2015, 36(3): 187-194.
[8]	Shun-fu JIN,Chen-fei WANG,Ling-ling CHEN,Zhan-qiang HUO. Modeling and analysis of Cloud-P2P storage architecture [J]. Journal on Communications, 2015, 36(3): 216-223.
[9]	ONGXin C,HUANGKai S,USen S,ANGFang-chun Y,ILing-ling Z. Video migration strategy based on bandwidth demand prediction and cloud resource reservation [J]. Journal on Communications, 2014, 35(5): 167-174.
[10]	. Video migration strategy based on bandwidth demand prediction and cloud resource reservation [J]. Journal on Communications, 2014, 35(5): 22-175.
[11]	. Implementation of P2P nodes detection based on decision tree [J]. Journal on Communications, 2013, 34(Z2): 9-46.
[12]	Yong-ping DONG,Xiang-zhan YU,Gang WU. Implementation of P2P nodes detection based on decision tree [J]. Journal on Communications, 2013, 34(Z2): 40-46.
[13]	. Smart-blacklisting: an efficient methodology for mitigating fake block attack in P2P file-sharing systems [J]. Journal on Communications, 2013, 34(8): 12-94.
[14]	Ru-hao YAO,Bing-shuang LIU,De-shuai QU,Yuan ZHOU,Xin-hui HAN. Smart-blacklisting:an efficient methodology for mitigating fake block attack in P2P file-sharing systems [J]. Journal on Communications, 2013, 34(8): 88-94.
[15]	. Leftover bandwidth-aware peer selection algorithm for inter-datacenter content distribution [J]. Journal on Communications, 2013, 34(7): 3-33.

算法	时间效率/s
NaiveBayes	0.08
C4.5	0.97
EXID	0.001