基于流身份识别的P2P流量检测  

P2P identification method based on flow identification

作　　者：焦程波[1,2] 

机构地区：[1]信息工程大学信息工程学院,郑州450002 [2]西南电子电信技术研究所,成都610041

出　　处：《计算机应用》2011年第11期2965-2968,2972,共5页journal of Computer Applications

基　　金：国家973计划项目(2007CB307104)

摘　　要：网络地址翻译器转发的混合流与P2P数据流呈现相似的流量外部特征。实际测试结果显示,如果数据捕获点位于网络地址翻译器之后,当前P2P流量特征识别方法(TLI)因为没有对网络地址翻译器(NAT)转发混合流进行区分而将导致虚警和漏报情况。为了解决此类问题,提出了基于流身份识别的P2P流量检测方法,首先通过分析IP标识时间序列完成对NAT转发混合流中源自不同设备数据流的身份识别,在此基础上采用流量特征检测P2P流量。以当前主要的P2P应用为例进行测试,结果说明,利用该方法可以有效识别NAT混合流中的P2P流量,较大幅度降低虚警率和漏报率。Mixed flows retransmitted by Network Address Translator（NAT） are similar to Peer-to-Peer（P2P） flows in terms of traffic characteristics.The measurement result shows that without flow identification the TLI method will have high false positives and false negatives.In order to solve this problem,a new P2P traffic identification method based on flow classification was proposed.Firstly,flow classification was done by analyzing IP identification time series.Based on classification results,P2P traffic was identified by checking its traffic characteristics.The proposed method was put to test through popular P2P application.The result shows that it can reduce the false positives and false negatives widely,so new P2P traffic classification method has better application value.

关 键 词：对等流量 流量特征 流身份识别 网络地址翻译器 网络拓扑 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]