Hybrid BitTorrent traffic detection
Yanqin Zhu · Journal of Computer Applications · 2011
Peer-to-peer(P2P) applications generate a large volume of traffic and seriously affect the quality of normal network services.Accurate and real-time identification of P2P traffic is important for network management.A hybrid approach composed of three sub-methods was proposed to identify BitTorrent(BT) traffic.It applied application signatures to identify unencrypted traffic.And for those encrypted flows,a message-based method according to the features of the Message Stream Encryption(MSE) protocol was proposed.And a pre-identification method based on signaling analysis was applied to predict BT flows and distinguish them even at the first packet with SYN flag.And some modified Vuze clients were used to label BT traffic in real traffic traces,which made high accurate benchmark datasets to evaluate the hybrid approach.The experimental results show that the recall,accuracy and real-time quality of the method are better than the current several machine learning methods of the best real-time feature.