一种混合式BitTorrent流量检测方法  

Hybrid BitTorrent traffic detection

作　　者：李麟青[1,2] 杨哲[1,2] 朱艳琴[1,2] 

机构地区：[1]苏州大学计算机科学与技术学院,江苏苏州215006 [2]苏州大学江苏省计算机信息处理技术重点实验室,江苏苏州215006

出　　处：《计算机应用》2011年第12期3210-3214,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(61070170);江苏省自然科学基金资助项目(BK2009589)

摘　　要：P2P流量已经成为互联网流量的主要部分,消耗大量的带宽,影响了服务质量,准确并实时检测出P2P流量有助于对P2P应用的监管,并研究其行为和发展。针对P2P流量中比例最大的BitTorrent(BT)流量,提出了一种混合式的检测方法。该方法由三个子方法构成,分别用基于应用层签名、基于消息流和基于信令的方法针对BT流量中的明文流、密文流和信令流进行检测,并预知即将发生的BT流量。实验结果表明,该方法的召回率、准确率和实时性均优于目前实时性最好的几种机器学习方法。Peer-to-peer（P2P） applications generate a large volume of traffic and seriously affect the quality of normal network services.Accurate and real-time identification of P2P traffic is important for network management.A hybrid approach composed of three sub-methods was proposed to identify BitTorrent（BT） traffic.It applied application signatures to identify unencrypted traffic.And for those encrypted flows,a message-based method according to the features of the Message Stream Encryption（MSE） protocol was proposed.And a pre-identification method based on signaling analysis was applied to predict BT flows and distinguish them even at the first packet with SYN flag.And some modified Vuze clients were used to label BT traffic in real traffic traces,which made high accurate benchmark datasets to evaluate the hybrid approach.The experimental results show that the recall,accuracy and real-time quality of the method are better than the current several machine learning methods of the best real-time feature.

关 键 词：流量检测 应用层签名 消息重组 信令分析 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]