The growing P2P streaming traffic brings a variety of problems and challenges to ISP networks and service providers.A P2P streaming traffic classification method based on sampling technology is presented in this paper...The growing P2P streaming traffic brings a variety of problems and challenges to ISP networks and service providers.A P2P streaming traffic classification method based on sampling technology is presented in this paper.By analyzing traffic statistical features and network behavior of P2P streaming,a group of flow characteristics were found,which can make P2P streaming more recognizable among other applications.Attributes from Netflow and those proposed by us are compared in terms of classification accuracy,and so are the results of different sampling rates.It is proved that the unified classification model with the proposed attributes can identify P2P streaming quickly and efficiently in the online system.Even with 1:50 sampling rate,the recognition accuracy can be higher than 94%.Moreover,we have evaluated the CPU resources,storage capacity and time consumption before and after the sampling,it is shown that the classification model after the sampling can significantly reduce the resource requirements with the same recognition accuracy.展开更多
Since the year of 2006, peer-to-peer （P2P） streaming media service has been developing rapidly, the user scale and income scale achieve synchronous growth. However, while people enjoying the benefits of the distribu...Since the year of 2006, peer-to-peer （P2P） streaming media service has been developing rapidly, the user scale and income scale achieve synchronous growth. However, while people enjoying the benefits of the distributed resources, a great deal of network bandwidth is consumed at the same time. Research on P2P streaming traffic characteristics and identification is essential to Internet service providers （ISPs） in terms of network planning and resource allocation. In this paper, we introduce the current common P2P traffic detection technology, and analyze the payload length distribution and payload length pattern in one flow of four popular P2P streaming media applications. Combining with the deep flow inspection and machine learning algorithm, a nearly real-time The experiments proved that this approach can achieve a high identification approach for P2P streaming media is proposed. accuracy with low false positives.展开更多
Botnets are networks composed with malware-infect ed computers.They are designed and organized to be controlled by an adversary.As victims are infected through their inappropriate network behaviors in most cases,the I...Botnets are networks composed with malware-infect ed computers.They are designed and organized to be controlled by an adversary.As victims are infected through their inappropriate network behaviors in most cases,the Internet protocol（IP） addresses of infected bots are unpredictable.Plus,a bot can get an IP address through dynamic host configuration protocol（DHCP）,so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can＇t be always online.The whole process is carried out under the command and control（C＆C） channel.Our goal is to characterize the network traffic under the C＆C channel on the time domain.Our analysis draws upon massive data obtained from honeynet and a large Internet service provider（ISP） Network.We extract and summarize fingerprints of the bots collected in our honeynet.Next,with the fingerprints,we use deep packet inspection（DPI） Technology to search active bots and controllers in the Internet.Then,we gather and analyze flow records reported from network traffic monitoring equipments.In this paper,we propose a flow record interval analysis on the time domain characteristics of botnets control traffic,and we propose the algorithm to identify the communications in the C＆C channel based on our analysis.After that,we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory.In addition,we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection（DFI） technology.展开更多
基金supported by State Key Program of National Natural Science Foundation of China under Grant No.61072061111 Project of China under Grant No.B08004the Fundamental Research Funds for the Central Universities under Grant No.2009RC0122
文摘The growing P2P streaming traffic brings a variety of problems and challenges to ISP networks and service providers.A P2P streaming traffic classification method based on sampling technology is presented in this paper.By analyzing traffic statistical features and network behavior of P2P streaming,a group of flow characteristics were found,which can make P2P streaming more recognizable among other applications.Attributes from Netflow and those proposed by us are compared in terms of classification accuracy,and so are the results of different sampling rates.It is proved that the unified classification model with the proposed attributes can identify P2P streaming quickly and efficiently in the online system.Even with 1:50 sampling rate,the recognition accuracy can be higher than 94%.Moreover,we have evaluated the CPU resources,storage capacity and time consumption before and after the sampling,it is shown that the classification model after the sampling can significantly reduce the resource requirements with the same recognition accuracy.
基金supported by the National Natural Science Foundation of China (61072061)the National Science and Technology Major Project (2012ZX03002008003)+1 种基金the 111 Project of China (B08004)the Chinese Universities Scientific Fund(2011RC0116)
文摘Since the year of 2006, peer-to-peer （P2P） streaming media service has been developing rapidly, the user scale and income scale achieve synchronous growth. However, while people enjoying the benefits of the distributed resources, a great deal of network bandwidth is consumed at the same time. Research on P2P streaming traffic characteristics and identification is essential to Internet service providers （ISPs） in terms of network planning and resource allocation. In this paper, we introduce the current common P2P traffic detection technology, and analyze the payload length distribution and payload length pattern in one flow of four popular P2P streaming media applications. Combining with the deep flow inspection and machine learning algorithm, a nearly real-time The experiments proved that this approach can achieve a high identification approach for P2P streaming media is proposed. accuracy with low false positives.
基金supported by the National Science & Technology Pillar Program (2008BAH37B04)
文摘Botnets are networks composed with malware-infect ed computers.They are designed and organized to be controlled by an adversary.As victims are infected through their inappropriate network behaviors in most cases,the Internet protocol（IP） addresses of infected bots are unpredictable.Plus,a bot can get an IP address through dynamic host configuration protocol（DHCP）,so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can＇t be always online.The whole process is carried out under the command and control（C＆C） channel.Our goal is to characterize the network traffic under the C＆C channel on the time domain.Our analysis draws upon massive data obtained from honeynet and a large Internet service provider（ISP） Network.We extract and summarize fingerprints of the bots collected in our honeynet.Next,with the fingerprints,we use deep packet inspection（DPI） Technology to search active bots and controllers in the Internet.Then,we gather and analyze flow records reported from network traffic monitoring equipments.In this paper,we propose a flow record interval analysis on the time domain characteristics of botnets control traffic,and we propose the algorithm to identify the communications in the C＆C channel based on our analysis.After that,we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory.In addition,we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection（DFI） technology.
