A Hybrid Approach for Accurate BT Traffic Identification

Abstract:

In this paper, a hybrid approach for identifying the traffic running over BitTorrent (BT) protocol is proposed. Besides the conventional port-based and signature-based methods, another two BT-oriented methods dealing with the peer-information and flow-information of BT traffic are also adopted. The peer-information method makes use of the unencrypted peer-transfer mechanism of BT protocol, and the flow-information method focuses on identifying the encrypted traffic, which evades the above three methods, with low false-positive ratio. The preliminary evaluation shows that our hybrid approach is effective and comprehensive for BT traffic identification.

• Periodical: Advanced Materials Research (Volumes 108-111)
• Pages: 279-284
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.108-111.279
• Online since: May 2010
• Authors: Ru Hui Zhang, Ye Du, Xing Wang, Zhong Lan Yuan
• Keywords: BitTorrent Protocol, Encrypted Traffic, Hybrid Approach, Traffic Identification

References

[1] Bittorrent Protocol Specification, information on http: /wiki. theory. org/BitTorrentSpecification.

[2] BitTorrent A technical description of BitTorrent protocol, Information on http: /www. cs. chalme rs. se/~tsigas/Courses/DCDSeminar/.. /BitTorrent. pdf.

[3] S. Sen, O. Spatscheck and D. Wang, in: Accurate, Scalable In-Network Identification of P2P Traffic Using Application Signature, Proceedings of the 13 th international conference on World Wide Web (WWW 04), ACM Press (2004), pp.512-521.

DOI: 10.1145/988672.988742

[4] K. Thomas, B. Andre, F. Michalis and K. Claffy, in: Transport Layer Identification of P2P Traffic, Proceedings of the 4th ACM SIGCOMM conference on Internet measurement (IMC 04), ACM Press (2004), pp.121-134.

DOI: 10.1145/1028788.1028804

[5] A. Madhukar and C. Williamson, in: A Longitudinal Study of P2P Traffic Classification, Proceedings of the 14 th IEEE international symposium on Modeling, analysis, and simulation (MASCOTS 06), IEEE Computer Society Press (2006), pp.179-188.

DOI: 10.1109/mascots.2006.6

[6] T. Karagiannis, K. Papagiannaki and M. Faloutsos, in: BLINC: Multilevel Traffic Classification in the Dark, Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, ACM Press (2005).

DOI: 10.1145/1080091.1080119

[7] J. Erman, M. Arlitt and A. Mahanti, in: Traffic Classification Using Clustering Algorithms, Proceedings of the 2006 SIGCOMM workshop on Mining network data, ACM Press (2006), pp.281-286.

DOI: 10.1145/1162678.1162679

[8] L. Bernaille, R. Teixeira, I. Akodjenou, A. Soule and K. Salamatian, in: Traffic Classification on the Fly, ACM SIGCOMM Computer Communication Review, Vol. 36, No. 2 (2006), pp.23-26.

DOI: 10.1145/1129582.1129589

[9] T.T.T. Nguyen and G. Armitage, in: A Survey of Techniques for Internet Traffic Classification Using Machine Learning, Communications Surveys & Tutorials, IEEE, Vol. 10, No. 4 (2008), pp.56-76.

DOI: 10.1109/surv.2008.080406

[10] M. F. Horng, C. W. Chen C. S. Chuang and C. Y. Lin, in: Identification and Analysis of P2P Traffic- An Example of BitTorrent, volume 2 of Proceedings of the 1 st international conference on Innovative computing, information and control (ICICIC 06), IEEE Computer Society Press (2006).

DOI: 10.1109/icicic.2006.294

[11] R. H. Zhang, Y. Du and Y. Zhang, in: A BT Traffic Identification Method Based on Peer-Cache, Proceedings of the 4th international conference on Internet computing for engineering and science (ICICSE 09), (to be published).

DOI: 10.1109/icicse.2009.39

[12] R. A. Wagner and M. J. Fischer, in: The String to String Correction Problem, Journal of ACM, Vol. 21, No. 1 (1974), pp.168-173.

DOI: 10.1145/321796.321811

[13] M. Ester, H. Kriegel, J. Sander and X. Xu, in: A Density-based Algorithm for Discovering Clusters in Large Spatial Databases with Noise, Proceedings of the 2 nd international conference on Knowledge Discovery and Data Mining (KDD 96), AAAI Press (1996).

DOI: 10.1109/icde.1998.655795