基于多重特性的P2P流量识别方法  

Method for P2P traffic identification based on multiple features

作　　者：刘剑刚[1] 秦拯[1] 祝仰金[2] 

机构地区：[1]湖南大学软件学院,长沙410082 [2]湖南大学计算机与通信学院,长沙410082

出　　处：《微计算机信息》2010年第33期69-71,共3页Control & Automation

基　　金：基金申请人:秦拯;项目名称:广东省科技计划项目"基于P2P分流技术的高速网络入侵检测系统"(0711020400157);基金申请人:秦拯;项目名称:广东省自然基金项目"面向高速网络入侵检测的基于P2P的分流技术研究"(粤科基办字[2007]6号;7007730);基金申请人:秦拯;项目名称:国家发改委信息安全专项"PowerSEC高性能监控一体化网络安全平台"(发改办高技[2009]1886号文)

摘　　要：精确识别P2P流量对于有效管理网络和合理利用网络资源都具有重要意义。然而随着新型的P2P应用逐渐采用随机端口、应用层数据加密以及协议特征模糊化,给P2P流量检测带来困难,导致目前单一的流量检测方法识别率较低。为此,在研究现有检测算法的基础上,提出一种新的P2P流量检测算法,该新算法分多个模块,综合利用了端口识别、DPI识别以及传输层特性识别,能快速,有效地识别端口跳变、协议加密以及未知的P2P流量。实验结果表明,新算法比单一的流量检测方法具有更高的识别率。Accurate identification of P2P traffic makes great sense for efficient network management and reasonable utility of network resources.Random port,application level data encryption as well as blurred protocol have become development trends of P2P application which give a very big problem for Detection of P2P traffic.Then,we proposes a novel inspection model,based on some kinds of traditional methods with the purpose of overcoming difficulties of the inspection of P2P traffic.The algorithm in several modules, comprehensive utilization of the port identification, DPI recognition and transport layer characteristics identification, can be fast, efficient identification of the port hopping, protocol encryption, and unknown P2P traffic.And through experiments proved the feasibility of this method. The results showed that this method has a higher recognition rate.

关 键 词：P2P流量识别 识别hash表 传输层 流量特性 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]