基于主机行为关联的加密P2P流量实时分类方法  

Real-time classification of encrypted P2P traffic based on host behavior association

作　　者：熊刚[1,2,3] 赵咏[2] 曹自刚[4] 

机构地区：[1]中国科学院计算技术研究所,北京100190 [2]中国科学院信息工程研究所,北京100093 [3]中国科学院大学,北京100049 [4]北京邮电大学计算机学院,北京100876

出　　处：《高技术通讯》2013年第10期1008-1015,共8页Chinese High Technology Letters

基　　金：863计划(2011AA010703);国家自然科学基金(61070184);国家科技支撑计划(2012BAH46B02);中国科学院战略性先导科技专项课题(XDA06030200)资助项目

摘　　要：提出了一种基于主机行为关联的加密P2P流量实时分类方法,该方法基于P2P系统中节点间的连接关系,以一定的先验知识为初始条件进行节点发现,并根据网络行为不断进行迭代检测,持续发现P2P网络中的新节点及其对应的流量,从而达到对加密P2P流量实时分类的目的。真实流量环境中的对比实验表明,该方法对典型加密P2P流量的分类准确率、召回率均超过95%,计算代价小、性能高,不依赖于内容检测,不侵犯用户隐私,能有效应用于实时流分类环境中。A real-time method for classification of encrypted P2P traffic based on host behavior association is proposed. Initialized with some priori knowledge, this method finds the nodes in a P2P network according to the nodes＇ con- nection relationship, and constantly finds the P2P network＇ s new nodes and their corresponding traffic by examining the iterating over nodes＇ network behavior to achieve the real-time classification of encrypted P2P traffic. The re- suits of the experiment on a real campus network showed that, besides low computational cost, both the accuracy and recall rate of the proposed method were above 95 %. Meanwhile, by classifying traffic without content inspection, the proposal violates no users＇ privacy, so it can be used flexibly in high-speed network environments.

关 键 词：加密P2P流量 主机行为 关联 流量分类 实时分类 

分 类 号：TP393.06[自动化与计算机技术—计算机应用技术]