An early Intelligent P2P Traffic Identification Method

Abstract:

In order to identify P2P traffic quickly and accurately as early as possible, an early intelligent P2P traffic identification method(EIIC) is proposed, which uses the size of early three packets payload and server port number obtained from the TCP flow as flow feature and classifies the traffic based on C4.5 algorithm. The results show that EIIC satisfies the following conditions: extracted features used, training samples selected under the unbiased conditions, it can be adaptive to actual network conditions and early classify the Internet traffic into application among WEB, MAIL, BitTorrent and eMule categories efficiently and quickly.

• Periodical: Applied Mechanics and Materials (Volumes 321-324)
• Pages: 2812-2817
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.321-324.2812
• Online since: June 2013
• Authors: Jian Fen Peng, Xu Yan Tu, Hong Bing Wang, Ya Jian Zhou
• Keywords: C4.5, Early Traffic Classification, Machine Learning (ML), Packet Payload

References

[1] Internet Study 2008/2009 http://www.ipoque.com/resources/internet-studies.

[2] J. Erman, A. Mahanti, M. Arlitt, and C. Williamson, "Identifying and discriminating between web and peer-to-peer traffic in the network core", in WWW '07: Proceedings of the 16th international conference on World Wide Web. Banff, Alberta, Canada: ACM Press, May:p.883–892, (2007)

DOI: 10.1145/1242572.1242692

[3] N. Williams, S. Zander, and G. Armitage, "A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification", Special Interest Group on Data Communication (SIGCOMM) Computer Communication Review, Vol. 36, No. 5, p.5–16,2006.

DOI: 10.1145/1163593.1163596

[4] Auld T, Moore A. W, Gull S. F. "Bayesian neural networks for Internet traffic classification". IEEE Transactions on Neural Networks, Vol.18,No.1,p.223－239, (2007)

DOI: 10.1109/tnn.2006.883010

[5] Moore A, Zuev D, "Internet Traffic Classification Using Bayesian Analysis Techniques", in ACM International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) 2005. Banff, Canada:ACM Press,p.50－60,2005.

DOI: 10.1145/1064212.1064220

[6] Erman J, Arlitt M., Mahanti A, "Traffic classification using clustering algorithms" in MineNet '06: Proceedings of the 2006 SIGCOMM workshop on Mining network data. New York, NY, USA: ACM Press, p.281－286,2006.

DOI: 10.1145/1162678.1162679

[7] Bernaille L, Teixeira R, Salamatian K, "Early application identication", Proceedings of the 2006 ACM CoNEXT conference. New York:ACM. 2006: 1－12.

DOI: 10.1145/1368436.1368445

[8] Bernaille L, Laurent; R.Teixeira, et al. Akodkenou, Ismael; Soule, Augustin and Salamantian, Kave, "Traffic Classification On The Fly", ACM SIGCOMM Computer Communication Review, Vol.36,No.2, p.23－26,April 2006.

DOI: 10.1145/1129582.1129589

[9] PENG Jian-fen, ZHOU Ya-jian, WANG Cong, "Early TCP Traffic Classification".Journal of applied scientces,Vol.29,No.1,pp.73-77, 2011.

[10] Quinlan J R.C4.5:programs for machine learning[M].San Mateo: Morgan Kaufmann, p.22－24,1993.

[11] J. Fonseca, B. Reza, L. Fjeldsted . BitTorrent Protocol-BTP 1.0[EB/OL], (2005-04)[2010-9-8]. http://mongie.navidot.com/nv_btp.htm

[12] The UNIBS Anonymized 2009 Internet Traces [EB/OL]. (18 Mar. 2011 http://www.ing.unibs.it/ntw/tools/traces.

[13] Lim Y.S， Kim H.C，Jeong J, et al. "Internet Traffic Classification Demystified: On the Sources of the Discriminative Power", In Proceedings of ACM CoNext 2010. Philadelphia,USA:Association for Computing Machinery, Inc,November 2010.

DOI: 10.1145/1921168.1921180