Method for recognizing P2P application encipher flux

Abstract

The invention discloses a method for identifying a P2P application encryption flow, which comprises: firstly, acquiring messages communicated between nodes and a seed server according to data characteristics of an application layer, decoding the messages and acquiring binary information; secondly, decoding returned messages of a distributed network and acquiring binary information; thirdly, storing the binary information into a binary information table and simultaneously acquiring destination IP addresses and destination port numbers of all the flows; fourthly, matching the destination IP addresses and the destination port numbers with the binary information table, and labeling the destination IP addresses and the destination port numbers as corresponding P2P application if the destination IP addresses and the destination port numbers are matched with the binary information table; and fifthly, judging message length combination during data exchange according to specified message length combination, and identifying the message length combination as the P2P application encryption flow having the specified message length combination if the message length combination meets the specified message length combination. The method has the advantage of being capable of identifying the P2P application encryption flow and being accurate in identification.

Description

technical field [0001] The invention relates to a method for identifying encrypted flow in flow management, in particular to an identification method for the characteristics of bidirectional connection and dynamic port in P2P network, which flexibly utilizes the characteristics of node information exchange in the peer-to-peer protocol. Background technique [0002] The emergence of peer-to-peer network (Peer to Peer, P2P for short) technology makes the core of network applications spread from the central server to the edge of the network. At present, the encrypted traffic of peer-to-peer network applications represented by file sharing applications BitTorrent and eMule accounts for more than 50% of the bandwidth of operators, becoming the largest consumer of network bandwidth, which also hinders the development of normal network services and key applications popularity. [0003] P2P is a distributed network, in which each node is both a resource provider and a resource acqu...

AI Technical Summary

Problems solved by technology

[0005] Among them, since most P2P application softwares have their own unique feature fields when using plaintext transmission, the accuracy of using DPI technology to identify P2P traffic is relatively high, but it cannot identify encrypted peer-to-peer network traffic.

Since DFI technology does not need to analyze application layer data, although it can identify application layer encrypted data, the accuracy of identification is not high.

Images