Publication details

Home Publications Publication details

Non-intrusive Identification of Peer-to-Peer Traffic
Ulliac A, Ghita BV
Proceedings of the Third International Conference on Communication Theory, Reliability, and Quality of Service (CTRQ), 13-19 June, pp116-121, ISBN: 978-1-4244-7273-4, 2010
Links:  External link available

Peer-to-peer protocols are increasingly implementing encryption and port randomisation to circumvent detection by traditional, signature-based classification systems. This paper proposes a novel method of identifying hosts and connections generating peer-to-peer traffic by observing the statistical attributes of the traffic. The method builds on existing statistical-based detection, but it uses a two-stage neural network to process the data and identify the peer-to-peer connections. A full architecture is also proposed to link the detection with a module producing ACL rules allowing segregating and blocking or shaping the peer-to-peer traffic in real time. The method was tested on real traffic, achieving accuracy between 85% and 98% at detecting peer-to-peer traffic from two packet traces.

Ulliac A, Ghita BV