P2P Network Identification via Directed Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methodologies for identifying peer-to-peer (P2P) networks are ineffective, particularly in low traffic networks such as C&C-based botnets or instant message applications, due to traffic encryption and the reliance on high traffic volumes.
Innovation Solution
A method involving the interception and analysis of data communication between connected devices to construct a directed graph, where initiated connections are defined as directed edges, allowing for the identification of P2P networks by analyzing source/destination-pairs and indegree/outdegree ratios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic encryption is used to protect data communication, then cybersecurity protection is improved, but P2P network identification becomes more difficult
Solution Approach 1:
The patent uses TCP connection information (source IP, destination IP, port numbers, connection timing) as an intermediary to identify P2P networks without decrypting the encrypted payload. This intermediary data allows network identification while maintaining encryption-based security protection.
Solution Approach 2:
Instead of analyzing encrypted application-layer payload data, the patent shifts to analyzing transport-layer TCP connection metadata (a different dimension of network data). This dimensional shift enables identification without breaking encryption, as connection patterns reveal P2P behavior even when content is encrypted.
2Measurement precision
If high traffic volume inspection is used to identify P2P networks, then content sharing networks are detected effectively, but low traffic networks such as C&C botnets or instant message applications are not detected
Solution Approach 1:
Instead of requiring high traffic volumes for detection, the patent uses partial information (TCP connection metadata) that is sufficient for identification regardless of traffic volume. This allows detection of both high-traffic content sharing networks and low-traffic C&C botnets using the same approach.
Solution Approach 2:
The patent changes the detection parameter from traffic volume (quantitative measure) to connection pattern analysis (qualitative measure). By analyzing indegree/outdegree ratios and connection timing patterns, the system can identify P2P networks regardless of whether they generate high or low traffic volumes.
3Ease of operation
If payload/header inspection methodology is used to identify P2P networks, then network identification is straightforward, but traffic encryption prevents effective identification
Solution Approach 1:
The patent uses TCP connection information as an intermediary that bridges the gap between ease of operation and identification effectiveness. Connection metadata is easily accessible and analyzes straightforwardly, yet contains sufficient information to reliably identify P2P networks even when payload inspection is blocked by encryption.
Data Source
AI summary
Information related to data communication between a plurality of connected devices is obtained. A plurality of initiated connections between the plurality of connected devices as directed edges between nodes in a directed graph based on the information are defined. Each initiated connection is represented by a directed edge from a source node to a destination node in the directed graph, and each node comprises an internet protocol (IP) address of the node. The directed graph is explored to determine a plurality of source/destination-pairs, wherein each source/destination-pair contains a source IP address of a source node of a directed edge, and a destination IP address of a destination node of the directed edge. A peer-to-peer (P2P) network including a plurality of P2P devices is detected based on the source/destination-pairs.