Peer-to-peer (P2P) flow identification method based on real-time behavior characteristics
A P2P traffic and feature identification technology, applied in the Internet field, can solve the problems of P2P traffic identification, unsatisfied port association and data transmission association, etc., and achieve the effect of improving the protocol identification rate
Inactive Publication Date: 2013-07-10
OPZOON TECH
View PDF2 Cites 0 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
[0005] The purpose of the present invention is to provide a method for identifying P2P traffic using real-time behavioral characteristics, which solves the identification problem of P2P traffic that does not meet the preconditions of port association and data transmission association
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0017] The present invention will be described in further detail below in conjunction with the accompanying drawings and specific embodiments.
[0018] The invention provides a method for identifying P2P traffic based on real-time behavior characteristics. The real-time behavior characteristics are: sequence distribution of TCP ports and aggregation distribution of UDP ports, which are real-time behavior characteristics of the P2P protocol. The sequence distribution of TCP ports refers to: the connection of the applied TCP protocol, its ports show a sequence distribution phenomenon, such as the appearance of many TCP connections with ports 4945, 4947, 4912, 4943, etc., that is, the ports are adjacent; the aggregation distribution of UDP ports It means: the connection of the applied UDP protocol has exactly the same port, for example, there are many UDP connections with port 4015. Such as figure 1 As shown, the steps of this method are:
[0019] S1. Obtain information about a...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
The invention provides a peer-to-peer (P2P) flow identification method based on real-time behavior characteristics. The method comprises the steps of obtaining all linkage information under a present Internet protocol (IP); judging whether an aggregate distribution phenomenon or a sequence distribution phenomenon appears on connected ports according to the obtained linkage information; checking belonging application of connected ports where the port aggregate distribution phenomenon or the sequence distribution phenomenon appears, identifying the linkage as the P2P application if P2P application appears,, identifying the linkage as 'the other P2P application' if the P2P application does appear; and sequentially sampling and tracking 'the other P2P application', and conducting relevance identification. According to the P2P flow identification method based on the real-time behavior characteristics, the identification problem that a situation which does not meet preconditions of port relevance and data transmission relevance but belongs to P2P flow is solved.
Description
technical field [0001] The invention relates to the technical field of the Internet, in particular to a method for identifying P2P traffic based on real-time behavior characteristics. Background technique [0002] Traditional P2P traffic identification methods mainly rely on application layer data feature detection methods, fixed port detection methods, etc., relying on application layer data feature detection methods can only identify the traffic when P2P software connects to fixed domain names or hosts, while fixed port detection methods , most of the current P2P protocols use random ports or protocol masquerading techniques, and the accuracy of this method is poor. [0003] In order to effectively identify P2P traffic, a method of port association or data transmission association is proposed. The premise of port association is that the connection to which the listening port or the newly created continuous port belongs must meet the condition that at least one connection c...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More IPC IPC(8): H04L12/26
Inventor 杨宇云董茂培陈金达余兆许晶刘伟祝方方
Owner OPZOON TECH