Method and system for identifying P2P (peer-to-peer) protocol on basis of DNS (domain name server) protocol

Abstract

The present invention relates to the field of the Internet. Disclosed are a DNS protocol-based method and system for identifying a P2P protocol. The method comprises: extracting domain name keywords of different applications employing the P2P protocol, compiling into a feature library; scanning a DNS request of a host, determining whether or not a domain name for which parsing is requested matches the domain name keyword of a currently parsing-pending application, if yes, recording an IP address parsed by a DNS, executing the next step, and if not, repeating the present step; determining whether or not a UDP connection destined to the IP address is present, if yes, recording a corresponding UDP source port, executing the next step, and if not, repeating the present step; and, identifying the connection established by the host via the UDP source port as the connection corresponding to the currently parsing-pending application employing the P2P protocol. The method and system efficiently and accurately complete the identification of the application employing the P2P protocol, thus are instrumental in implementing effective control of network traffic.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a method and system for identifying P2P protocols based on the DNS protocol. Background technique [0002] There are mainly two methods for traditional protocol identification, one of which is based on the content of the message. This identification method mainly uses the method of scanning the content of the message and comparing it with the protocol feature library. For example, BT (a content distribution protocol) ) protocol message will contain "BitTorrent protocol" keywords, which can be identified according to these keywords. The advantage of this method is that the identification accuracy is high, but the disadvantage is that this method is invalid for encrypted traffic. [0003] Another method is mainly to use the statistical model for identification. The statistical objects include IP (Internet Protocol, a protocol for interconnection between networks) addresses, p...

AI Technical Summary

Problems solved by technology

The advantage of this method is that the recognition accuracy is high, but the disadvantage is that this method is invalid for encrypted traffic

The advantage is that there is no need to scan the content of the message, and the disadvantage is that the recognition rate is poor and the false recognition rate is high

[0004] The current Internet TV software such as Fengxing, Baofengyingyin, etc. all adopt the P2P (Peer-to-Peer, point-to-point) architecture, and they all belong to the application of the P2P protocol. The communication protocol is encrypted, and the first identification method cannot be used. , using the second method, the missed recognition rate and false recognition rate are larger

Images