基于决策树的P2P节点识别技术研究

doi:10.3969/j.issn.1000-436x.2013.Z2.009

Abstract

Abstract:

A P2P nodes detection method based on decision model was proposed by a long time of observation.As this method is a statistical analysis of the transport layer packet characteristics,identification of the network node for encrypted or unencrypted P2P applications is effective.Experiment shows that this method has higher accuracy and lower false positive rate and false negative rate.

Key words: P2P, traffic identification, decision tree, traffic characteristic

Yong-ping DONG,Xiang-zhan YU,Gang WU. Implementation of P2P nodes detection based on decision tree[J]. Journal on Communications, 2013, 34(Z2): 40-46.

Figures/Tables 7

References 16

[1]	MADHUKAR A , WILLIAMSON C . A longitudinal study of P2P traffic classification[A]. Proceedings of the 14th IEEE International Symposium on Modeling,Analysis,and Simulation[C]. 2006. 179-188.
[2]	SEN S , SPATSCHECK O . Accurate,scalable in-network identification of P2P traffic using application signatures[A]. Proceedings of the 13th International Conference on World Wide Web[C]. 2004. 512-521.
[3]	LIU X B , YANG J H , XIE G G . Automated mining of packet signatures for traffic identification at application layer with apriori algorithm[J]. Journal on Communications, 2008,29(12): 51-59.
[4]	CONSTANTINOUS F , MAVROMMATIS P . Identifying known and unknown peer-to-peer traffc transport layer identification of P2P traffic[A]. Proceedings of the Fifth IEEE International Symposium on Network Computing and Applications[C]. 2006. 93-102.
[5]	WANG J S , ZHANG Y . Connection pattern-based P2P application identification characteristic[A]. Proceedings of the 2007 IFIP International Conference on Network and Parallel Computing Workshops[C]. 2007. 437-441.
[6]	RAFFAELE B , MARCO C . Characterizing the network behavior of P2P traffic[A]. Proceedings of the 2008 4th International Telecommunication Networking Workshop on QoS in Multiservice IP Networks[C]. 2008. 14-19.
[7]	ALSHAMMARI R , ZINCIR-HEYWOOD A N . Can encrypted traffic be identified without port numbers,IP addresses and payload inspection?[J]. Computer Networks, 2010,6(55): 1326-1350.
[8]	DUSI M , ESTE A . Using GMM and SVM-based techniques for the classification of SSH-encrypted traffic[A]. Proceedings of the 2009 IEEE International Conference on Communications[C]. 2009. 702-707.
[9]	MOORE A W , ZUEV D . Internet traffic classification using bayesian analysis techniques[A]. Proceedings of the 2005 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems[C]. 2005. 50-60.
[10]	YUAN R , LI Z ， An SVM-based machine learning method for accurate internet traffic classification[J]. Information Systems Frontiers, 2012,12(2): 149-156.
[11]	JUN L , SHUNYI Z , Active P2P traffic identification technique[A]. Proceedings of the 2007 International Conference on Computational Intelligence and Security[C]. 2007. 37-41.
[12]	LIU F , LI Z T . Research on Server Role Based P2P Nodes Identification Methods[D]. Wuhan:Huazhong University, 2010.
[13]	QUINLAN J R.C4 . 5 Programs for Machine Learning[M]. Morgan Kaufmann Publishers, 1993.
[14]	LU G , ZHANG H L . P2P traffic identification[J]. Journal of Software, 2011,22(6): 1281-1298.
[15]	LU X , DUAN H , Identification of P2P traffic based on the content redistribution characteristic[A]. Proceedings of 2007 International Symposium on Communications and Information Technologies[C]. 2007. 596-601.
[16]	L7-filter[EB/OL]..2012.

Metrics

Recommended 0

No Suggested Reading articles found!

节点特征	标号	公式描述
服务端口与远端IP数之比	F1	ownPorts/distIPs
远端端口与远端IP数之比	F2	distPorts/distIPs
长连接数所占比重	F3	longConnFlows/(posTcpFlows+posUdpFlows+n egTcpFlows+negUdpFlows)
反向流中上传与下载量之比	F4	negUpload/negdownload
正向流与反向流数之比	F5	(posTcpFlows+posUdpFlows)/(negTcpFlows+negUdpFlows)
正向连接成功率	F6	(posTcpFlows+posUdpFlows)/posConns
服务率	F7	(negTcpFlows+negUdpFLows)/negConns

应用名	负载特征
Thunder	'\x00\x00\x00\x16\x00\x00\x00\x6a\x01'
PPLIVE	'\x00\x00\x00\xe9\x03\x41\x41\x01\x98\xab\x01\x02'
BitTorrent	'\x13BitTorrent protocol'
eMule	'\xe3,\xc5,\xd4,\xe4,\xe5,\xf1'

应用类型	P2P应用				非P2P应用
应用类型	Thunder	PPLIVE	BT	eMule	FTP	Mail	DNS	Web
训练样本数测试样本数总数	9044134	9045135	8040120	12055175	12049169	503080	8047127	603393

分类算法	准确率	漏报率	误报率
C4.5	338/343 (98.54%)	4/343	1/343
SVM	330/343 (96.2%)	0/343	13/343
NBC	332/3430(96.79%)	9/343	2/343
kNN	331/343 (96.5%)	8/343	4/343

Implementation of P2P nodes detection based on decision tree

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 7

References 16

Related Articles 15

Metrics

Recommended 0

[1]	Lichuan MA, Jiayi PENG, Qingqi PEI, Haojin ZHU. Efficient privacy-preserving decision tree classification protocol [J]. Journal on Communications, 2021, 42(8): 80-89.
[2]	Sheng GAO, Kang XIANG, Youliang TIAN, Weijie TAN, Tao FENG, Xiaoxue WU. BCP-based joint delegation learning model and protocol [J]. Journal on Communications, 2021, 42(5): 137-148.
[3]	Bingli GUO,Ning ZHAO,Zhiwen ZHU,Fan NING,Shanguo HUANG. Research on traffic identification and scheduling based on optical interconnection architecture in data center [J]. Journal on Communications, 2018, 39(9): 122-128.
[4]	Wu-bin PAN,Guang CHENG,Xiao-jun GUO,Shun-xiang HUANG. Review and perspective on encrypted traffic identification research [J]. Journal on Communications, 2016, 37(9): 154-167.
[5]	Yi-chun LIU,Ying-hong LIANG. Dynamic P2P trust model based on context factors [J]. Journal on Communications, 2016, 37(8): 34-45.
[6]	Yan LIU,yin ZHANGGuo,zhou HEJin,Feng XU. MP2P high capacity and security resource node selection strategy based on Bayesian game [J]. Journal on Communications, 2016, 37(1): 110-115.
[7]	Hua NIE,Min ZHANG,Jing-rong GUO,Xiao-long YANG. Content popularity difference-aware cache eviction scheme for CDN-P2P hybrid networks [J]. Journal on Communications, 2015, 36(Z1): 9-15.
[8]	Shun-fu JIN,Chen-fei WANG,Ling-ling CHEN,Zhan-qiang HUO. Modeling and analysis of Cloud-P2P storage architecture [J]. Journal on Communications, 2015, 36(3): 216-223.
[9]	Yin-long LIU,Min WANG,Wei MA,Xu ZHOU,Ya-hui HU. Cooperative caching scheme based on the minimization of total cost for P2P caches [J]. Journal on Communications, 2015, 36(3): 187-194.
[10]	. Efficent-cutting packet classification algorithm based on the statistical decision tree [J]. Journal on Communications, 2014, 35(Z1): 12-64.
[11]	Li-nan CHEN,Yang LIU,Yan MA,Xiao-hong HUANG,Qing-cong ZHAO,Wei WEI. Efficent-cutting packet classification algorithm based on the statistical decision tree [J]. Journal on Communications, 2014, 35(Z1): 58-64.
[12]	ONGXin C,HUANGKai S,USen S,ANGFang-chun Y,ILing-ling Z. Video migration strategy based on bandwidth demand prediction and cloud resource reservation [J]. Journal on Communications, 2014, 35(5): 167-174.
[13]	. Video migration strategy based on bandwidth demand prediction and cloud resource reservation [J]. Journal on Communications, 2014, 35(5): 22-175.
[14]	. Implementation of P2P nodes detection based on decision tree [J]. Journal on Communications, 2013, 34(Z2): 9-46.
[15]	. Smart-blacklisting: an efficient methodology for mitigating fake block attack in P2P file-sharing systems [J]. Journal on Communications, 2013, 34(8): 12-94.