Weight Based Multiple Support Vector Machine Identification of Peer-to-Peer Traffic

Transcription

1 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY 577 Weght Based Multple Support Vector Machne Identfcaton of -to- Traffc Feng Lu, Zhtang L, Zhengbng Hu, Ljuan Zhou, Bn Lu, Junfeng Yu Department of Computer Scence and Technology, Network Center Huazhong Unversty of Scence and Technology Wuhan, Chna Emal: {lufeng, leeyng, hzb, ljzhou, blu Abstract These years, PP applcatons are very popular on the Internet and take a bg part of the Internet traffc workload. Identfyng the PP traffc and understandng ther behavor s an mportant feld. Prevous PP traffc dentfcaton methods by examnng user payload or welldefned port numbers no longer adapt to current PP applcatons. In ths paper, we develop a Mult-SVM based PP traffc dentfcaton approach by analyzng the data transmsson mechansm and connecton characterstcs of PP networks at the transport layer wthout relyng on the port number and packet payload. The result shows that the approach proposed n ths paper can dentfy PP traffc accurately. Index Terms PP traffc dentfcaton, Support Vector Machne, flow behavor features I. INTRODUCTION In recent years, PP applcatons have become more and more popular and occupy most of the Internet bandwdth. Identfyng PP traffc and understandng ther behavor has become an mportant feld. In the frst-generaton PP networks, most applcatons use a known port for all ther communcaton and known transport-layer port numbers used to be an accurate and effcent way for traffc classfcaton[, ]. However, current PP applcatons have the ablty to dsguse ther exstence through the use of arbtrary ports [, 3, 4] or allow and often encourage users to set the port that the applcatons wll use. PP applcatons can dsguse ther traffc as other known classes[]. Consequently, relable estmates of PP traffc requre examnaton of packet payload. The protocol specfc strng n the payload can be used for dentfcaton, so the PP traffc can be dentfed through analyzng the characterstc bt strngs n packet payload [5-7]. Sen et, al[5] provde an effcent approach for dentfyng the PP applcaton traffc trough applcaton level sgnatures. They dentfy the applcaton level sgnatures by examnng some avalable documentatons, and packetlevel traces, and then utlze he dentfed sgnatures to develop onlne flters that can effcently and accurately track the PP traffc even on hgh-speed network lnks. M. Roughan et, al[7] outlne a soluton framework for measurement based classfcaton of traffc for QoS, based on statstcal applcaton sgnatures. Payload-based classfers have two lmtatons: they cannot be used f payload nformaton s not avalable and they cannot, n general, dentfy unknown classes of traffc []. Some applcatons may also encrypt ther payload, thus makng t mpossble to read. In order to overcome the lmtatons of port and payload based classfcaton. Traffc classfcaton approaches, not usng port numbers and payload, have been proposed [8-]. Karaganns et, al[8]develops a systematc methodology to dentfy PP flows at the transport layer based on connecton patterns of PP networks. [9] Presents an approach based on observng and dentfyng patterns of host behavor at the transport layer. They analyze these patterns at three levels of ncreasng detal the socal, the functonal, and the applcaton level. Parsh et, al []nvestgated how the packet sze statstc can be used as an dentfcaton metrc for realtme, UDP-based network applcatons and proposed a prototype detector. Shnnosuke Yag et, al[3]propose a method for applcaton decmatons of montored traffc based on the transton pattern of payload length durng start up phase of communcaton. We also focus on the n PP flows, but take a dfferent way form [] and [3]. In ths paper, we develop a statstcal methodology by analyzng the data transmsson mechansm and connecton characterstcs of PP networks at the transport layer wthout relyng on the port numbers and packet payload. Our experment results ndcate that ths approach can effectvely dentfy PP applcatons. Our contrbutons are manly as follows: Flow constructng and updatng Algorthm. In order to dentfy PP traffc, we need to construct the flow nformaton at frst. The experment proves that the memory occupancy s stable n real envronment by usng flow updatng algorthm proposed n ths paper. New PP traffc dentfcaton Metrcs. In ths paper, we propose new PP traffc dentfcaton Metrcs through analyzng the data splttng mechansm usng n PP applcatons. New weght Based Mult-SVM dentfcaton Approach. In ths paper we propose a new weght based Mult-SVM method to mprove the dentfcaton accuracy. ACADEMY PUBLISHER do:.434/jnw

2 578 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY The remander of ths paper s organzed as follows. In Secton II, we study the behavor characterstcs of PP applcatons. In secton III we proposed the PP traffc dentfcaton metrcs. The Weght based Mult-SVM dentfcaton approach s dscussed n secton IV. In secton V we evaluate the approach proposed n ths paper and analyze the experment results. we conclude and expand our future work n Secton VI. II. BEHAVIOR CHARACTERISTICS OF PP APPLICATIONS In ths secton, we study the behavor features of PP applcatons from the Data Transmsson Mechansm and the connecton characterstcs. A Data Transmsson Mechansm n PP Applcatons In PP applcatons, peers act as a server and clent at the same tme, and they can upload and download dfferent parts of a fle to or from dfferent peers. Therefore, data transmtted n PP networks should be sptted nto a lot of blocks to acheve parallelsm. We wll take BtTorrent and PPLve as example to llumnate the transmsson mechansm n PP networks, because these are two of the most popular PP applcatons n Chna. In BtTorrent protocol, a user frst downloads.torrent fles from a server, and then asks to the tracker a lst of IP address of peers to connect to and cooperate wth, typcally 5 peers chosen at random n the lst of peers currently nvolved n the torrent[4]. The peer protocol operates over TCP, wth data and sgnalng traffc transferred together n the same connecton. The connecton between peers s symmetrcal n the sense that message sent n both drectons are dentcal. Fles transferred usng BtTorrent are spltted nto peces, and each pece s spltted nto blocks, as shown n Fg.. In practcal, Pece message s the only one that s used to send blocks. Each Pece Message contans only one block. For a default block sze of 4 bytes, the sze of the Pece message wll be 4 +3 bytes. Blocks are transmsson unt on the network, but the protocol only accounts for transferred peces[4]. In the other words, a peer can only upload peces wth full copy. In PPLve network, all the peers cooperatvely delver vdeo chunks among themselves from the channel streamng server va the streamng engne. The channel stream server converts the meda content nto small vdeo chunks for effcent dstrbuton among peers. The tracker server provdes streamng channel, peer and chunk nformaton for each peer node to jon the network and download vdeo chunks from multple peers n the system requestng the same meda content[5]. At any gven nstant, a peer buffers up to a few mnutes worth of chunks wthn a sldng wndow. Some of these chunks may be chunks that have been recently played; the remanng chunks are chunks scheduled to be played n the next few mnutes. s upload chunks to each other [5]. To ths end, peers send to each other buffer map messages; a buffer map message ndcates whch chunks a peer currently has buffered and can share. The buffer map message ncludes the offset (the ID of the frst chunk), the length of the buffer map, and a strng of zeroes and ones ndcatng whch chunks are avalable (startng wth the chunk desgnated by the offset) [5]. Ths feature shows the content dynamcs n PP streamng applcatons: Hgh Frequency n nformatonexchangng and download-schedulng. B Connecton Characterstcs n PP Applcatons In ths secton, we wll analyze the connecton characterstcs n PP networks. Fg. shows the connecton features between two peers n PP networks. We only consder the flows that are used to transfer data (over 5 large sze packets). A host can upload and download at the same tme to or from the certan peer n two dfferent flows or n a bdrectonal flows. A host can also only download or upload from a certan peer as depcted n fg.. Generally, uploadng and downloadng data n two dfferent flows s very common, but the bdrectonal flows are employed n some PP applcatons lke PPStream and Btcomet. The ports of two peers stay unchanged durng the communcaton perod n PP network. Fg.3 shows the connecton features between one host and other peers n PP networks. Fg 3 and descrbe that one host uploads and downloads at the same tme. Each peer normally has only one server port, as depcted n the fg. 3. The dfference between and Fgure. Connecton features between two peers n PP networks Fgure. BtTorrent Peces Spltted Mechansm (c) (d) (f) Fgure 3. Connecton features between one host and other peers ACADEMY PUBLISHER

3 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY 579 s that the host n use only one port to download from other peers. Some PP applcatons employ UDP protocol usually have the structure shown n. Fg 3(c), (d) and (f) show the structure when one host only uploads or downloads from or to other peers. There s usually only one uploadng port n a host, but dfferent PP applcatons has dfferent number of downloadng ports, whch depends on the realzaton of PP software. From fg. and fg.3 we can conclude: There are usually only one or two flows between peers n PP networks. However, n tradtonal C/S applcatons, Clents often open many consecutve ports to ntate connectons wth the server, such as Web. The rato of number of remote IPs and remote Ports s approxmately. The ports of two peers stay unchanged durng the communcaton perod n PP network. III. METRICS OF PP TRAFFIC IDENTIFICATION Based on the behavor characterstcs of PP applcatons studed n Secton II, n ths Secton, we propose there metrcs for PP traffc dentfcaton. A Packet Length Most applcatons have unque nteractons of messages, such as user authentcaton, software verson, and avalable optons and so on. These nteractons are defned by ther applcaton protocols[3]. We analyze dstrbutons of dfferent applcatons. In ths secton, through analyzng the dstrbuton of the popular network applcatons, we try to fnd out the dfference between PP applcatons and tradtonal C/S applcatons. Fg. 4 shows the emprcal Probablty Densty Functon (PDF) of of several popular applcatons: Web, FTP, Mal, BT, emule, PPlve and PPstream. Fg. 4 ndcates that dfferent applcatons have dfferent dstrbutons. The small sze packets (length <5bytes) are often used to transfer messages between servers and clents such as synchronzaton, acknowledgement, et, al. The large sze packets (length>=5bytes) are usually used to transfer data. From fg.,, and (c), we can see that the number of large sze packets s much more than the number of small sze packets. Ths phenomenon n FTP applcatons s more obvous as shown n fg. 4 and(c). It s because that Web and FTP applcatons employ the Clent/Server model to transfer data, and the servers, usually hgh-performance computers, are more stable than the clents. Once the connecton between server and clent s establshed by the messages packets, t can be used to transmt data. Due to the stable Web and FTP servers, not so many message packets are needed. Specally, FTP applcatons have less number of small sze packets than Web applcatons. It s because that the FTP applcatons are usually used to transfer fles, whch need more long packets than transfer web pages. Fg.4 (d) shows dstrbuton of Mal applcaton (c) 5 (e) 5 (g) (d) 5 (f) 5 (h) Fgure 4. The PDF of of some popular applcatons: Web FTP_Upload (c) FTP_Download (d) mal (e) BT (f) emule (g) PPLve (h) PPStream From ths fgure, we can see that the number of short packets s almost as the same as the long packets. Ths ndcates that the mal applcaton needs more messages packets than HTTP or FTP. Fg. 4(e) and (f) depcts the dstrbuton of BT and emule applcatons respectvely. They have almost the same number of large sze packets and small sze packets. Fg.4 (g) and (h) depcts the dstrbuton of PPLve and PPStream. They are both PP lve streamng applcatons, whch need more messages packets than PP fle-sharng applcatons, because they need to ensure the real-tme data transmsson. To descrbe dstrbuton, we defne varable P as: S p = () L S = L = 499 n = 5 n = 5 () (3) ACADEMY PUBLISHER

4 58 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY p HTTP FTP_Up FTP_Down Mal BT emule PPLve PPStream Fgure 5. The value of P for dfferent applcatons S represents the number of small sze packets, and L represents the number of large sze packets n the common applcatons. n represents the number of the packets whch length s. Fg. 5 shows the value of P for dfferent applcatons. Form Fg. 5 we can see that PP applcatons, both flesharng applcatons lke BT and emule, and lve streamng applcatons lke PPlve and PPStream have a larger P (>) than other applcatons P (<). Exceptonally, the Mal applcaton also has a hgh P value. B Large Sze Packet Number n Aggregate Because of the data splttng mechansm employed n PP applcatons, the long packets transferred n a flow s not consecutve, whch s dfferent from the applcatons as FTP, Web. In PP traffc, the packets over 5 bytes are often used to carry the fle /vdeo data and packet less than 5 bytes are often used to exchange message between peers. Therefore, we classfed these two knds of packets accordng to ther length (>=5 bytes and <5 bytes) as n secton A. In a flow, large sze packets are usually dvded nto several groups by small sze packets. We defne LPNA as the number of packets n large sze packet groups n flows. We use a Lnk-Lst to record packets group of a flow accordng to ther length. Let and respectvely denote the small sze packets (less than 5 bytes) and long sze packets (over 5 bytes). For example, suppose {89, 56, 875, 5, 488, 785 (5 consecutve large sze packets, whch length s all over 5 bytes), 36, 46} the packet length sequence n a flow. Fg. 6 llumnates the process of group packets n a flow. When a packet arrved, f ts length and ts pre- n ths flow are both larger or less than 5bytes, the Lnk-Lst s tal node s num add, otherwse, a new lnk node wll be made. Defnton (LPNA) LPNA (Large sze Packets Number n Aggregate) denotes the number of packets n large sze packet groups of flows. Let L denote the Lnk-Lst structure as shown n fg.6, N denote the th Node n lnk L and n the length of L. Then, LPNA ={L.N.Num N.Type =,=,,..n}. Some applcatons, such as DNS, manly use lght payload flows to transmt data. Some HTTP applcatons, Fgure 6. Large sze packets statstcal method n a flow pplve ppstream number of large sze packets btcomet xunle number of large sze packets FTP Yuku number of large sze packets (c) Fgure 7. The emprcal CDF of LPNA n dfferent applcatons ACADEMY PUBLISHER

5 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY 58 lke Yuku (a knd of VOD applcaton), employ the long duraton and heavy payload flows. In ths secton, we only focus on the heavy payload flows (flows transferred over large sze packets). Fg 7 shows the CDF of large sze packets number n aggregate. From Fg 7, we can conclude that dfferent applcatons have dfferent dstrbutons of LPNA. Both n PP flesharng and streamng applcatons, the value of LPNA most locate n the range (-4), and the number of large sze packets groups n a flow s larger than other applcatons as FTP and Yuku. The LPNA value n the applcaton of Xunle s usually, 4, 36, 48, whch llumnates the splttng mechansm. The LPNA value n FTP and Yuku s much larger than that n PP. C The Interval Tme Between Large Sze Packet In ths secton, we study the nterval tme between large sze packets n a flow. But we do not drectly analyze the nterval tme between two packets. Instead, we employ the statstcal method lke n secton B. In PP fle-sharng applcatons, lke BtTorrent, a peer can download one pece from many other peers or download several peces from one peer. Ths s dfferent form the tradtonal applcatons wth C/S structure, n whch almost all the clents download the whole copy of a fle from only one server. In PP networks, there wll be long nterval tme between downloadng two blocks, peces or chunks. Therefore, the nterval tme between packets n a flow wll have dfferent dstrbutons n PP applcatons and C/S applcatons. Furthermore, PP streamng applcatons requre real-tme and order data. Every peer wll perodcally exchanges ts data avalablty nformaton wth a set of partners n order to determne whch blocks can be subscrbe to others. In PP streamng applcatons, the avalablty of blocks n the buffer s represented by a data structure called buffer map or BM. The exchange of BM between peers wll also result n the long tme nterval between packets. In a flow, large sze packets are usually dvded nto several groups by long tme nterval. We defne NLPI as the number of packets n large sze packet groups, whch are dvded by long ntervals. In practcal, we also use a Lnk-Lst to record the packets n a flow, as show n Fg. 8. We only record the long packets (over 5bytes). When a packet n arrved, f the nterval tme between t and ts pre-packet s longer than 3 seconds, a new lnk node wll be made. Otherwse, the number n the Lnk s tal node wll add. For example, f the nterval tme between packets n a flow s {.,.5,.( packets), 3.5,.5.3(4 packets), 4.,.8.3(4 packets)}, we can record ths sequence as shown n fg.8 wth three lnk nodes. Defnton (NLPI) NLPI s the Number of Large sze Packets n groups dvded by Long tme nterval. Let L denote the Lnk-Lst structure as shown n fg.8, N denote the th Node n lnk L, and n s the length of L. Then, NLPI ={L.N.Num =,,n}. In FTP and Yuku, the nterval tme between large sze packets are mostly under 3 seconds, and a small number of long ntervals s manly caused by the networks bad Fgure 8. Packets nterval tme statstcal method PPstream PPlve number of large sze packets Btcomet Xunle number of large sze packets Fgure 9. The CDF of NLPI n dfferent applcatons condton. On the contrary, there are a large number of long ntervals n PP flows, as shown n Fg.9. Eghty percent of NLPI value s small than 3. Both n PP flesharng and streamng applcatons, there s several vary large NLPI value. It s because that, n some good condtons, the tme spent for exchangng data nformaton between peers s less than 3 seconds. IV. PP TRAFFIC IDENTIFICATION APPROACH A Flow Informaton Constructon. Currently, the PP dentfcaton system proposed n ths paper operates on the flow records collected from a ACADEMY PUBLISHER

6 58 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY router of our unversty network based on the dfferent behavor characterstcs between PP and other applcatons such as: Web, Mal, FTP and Yuku. We dentfy the start of a TCP flow usng connecton establshment semantcs (.e., SYN-SYNACK-ACK packet transmssons) or by the frst packet transmsson observed between hosts, and end of a TCP flow after observng a FIN or RST packet. We dentfy the start of a UDP flow by the frst packet transmsson observed between hosts, and ends when we see a packet that s not followed by any other packet. By default we consder a TCP or UDP flow termnated f t s dle for more than 6 seconds. In order to reduce the tme consumed by the process of comparng the 5-tuples of a flow, we use a hash table to record flow Informaton. A flow s hash value s defned as ts 5-tuples value. The followng pseudo-code summarzes the algorthm for constructng flow records. Partcularly, the two flows n a connecton are recorded n a same hash node. In order to reduce the complexty, we do not present the hash collson resolved method. In practce, we employ a lnk lst to record the dfferent flows wth the same hash value. When a flow s overtme, we wll remove ts record from the hash table to reduce the memory usage.. P = RecevePacket (). PI = GetPIInfo (P) //get the packet nformaton 3. HPI = HASH(PI) 4. CI = FndInflowHashTable(HPI); 5. f (CI == NULL) 6. PI = ExangePIInfo(PI) //exchange Scr and Dest 7. HPI = HASH(PI ) 8. CI = FndInflowHashTable(HPI ) 9. f (CI == NULL). PI = ExangePIInfo(PI ) //reset. CI = CreatedNewflowIP(PI). CI.State = Intated 3. AddNewFlowtoHashTable(CI) 4. else 5. UpDate_ResPonseFlow_InFO(CI, PI) 6. If (CI.State!= Connected) CI.State = Connected 7. else 8. UpDate_ReqestFlow_Info(CI, PI) B Traffc Preprocessng After constructng the flow nformaton, we do some traffc pre-processng to reduce the amount of data for further analyzng. Frst, we only choose the flows that transferred over large sze packets for further analyzng. Second, we extract the canddate IP addresses. Accordng to the connecton characterstcs dscussed n secton III, the hosts wth the connecton structures shown n fgure and 3 are chosen as canddate IP address, flows of whch wll be further analyzed. C Weght-based Mutl-SVM dentfcaton of PP traffc )The basc theory of SVM. Gven a tranng set wth N data ponts: {( x ), y,, ( x, y),, ( xn, yn)}, where the th sample X R n (n s the dmenson of the nput space) belongs to two separate classes labeled by. The classfcaton problem s to fnd a hyper-plane Y n a hgh dmensonal feature space Z, whch dvdes the set of examples n the feature space such that all the ponts wth the same label are on the same sde of the hyper-plane. SVM s to construct a map Z = φ(x) from the nput space R n to a hgh-dmensonal feature space Z T and to fnd an optmal hyper-plane w z + b = n Z such that the separaton margn between the postve and negatve examples s maxmzed. A decson functon of the classfer s then gven by: T fw, b = sgn[ w z + b] (4) where w s a weght vector and b s a threshold. )A Mutl-SVM PP Traffc Identfcaton Approach. After pre-processng the traffc, we employ a weghtbased mult-svm detecton strategy on the remanng suspcous traffc. Accordng to the flow characterstcs studed n Secton III, we defne there vectors to evaluate the flow transmsson pattern. Packet length vector v = l, l,... l ) (5) ( m m* n j j = m*( ) l = 5 (6) n j = The Maxmum Transfer Unt (MTU) n Ethernet s 5 bytes, m denotes the number of bns, every bn has the equal range length. For example, f m = 3, there wll be there bns: (-5), (5-), (-5). n j represents the number of the packets whch length s j. LPNA dstrbuton n flows Based on the analyses n Secton III, we employ quantles to descrbe the Packet length dstrbuton n flow packet sequence. Quantles are ponts taken at regular ntervals from the cumulatve dstrbuton functon (CDF) of a random varable. Dvdng ordered data nto q essentally equal-szed data subsets, quantles are the data values markng the boundares between consecutve subsets. In another word, the kth q-quantle s the value x such that the probablty that a random varable wll be less than x s at most k/q and the probablty that a random varable wll be more than or equal to x s at least (q-k)/q. There are q- quantles, wth k an nteger satsfyng <k<q. v = (q, q,... qm, a, n) (7) In secton III, we use Lnk node to record the number of consecutve long packets. In vector v, q denotes the th quantle. a represents the average value and n s the total number of Lnk nodes. NLPI dstrbuton n flows v3 = (q, q,... q m, a, n ) (8) j ACADEMY PUBLISHER

7 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY 583 Lke v, we also use quantles to descrbe the NLPI dstrbuton. a and n respectvely denote the average value and the total Lnk nodes number. All the three SVM make use of a lnear classfer of the form: F T wn x + bn > xn) = T wn x + bn < ( n =,,3) f x s PP n n( (9) f xn s not PP Where x n a vector of statstcal attrbutes and n s s the feature number. Every SVM has false postve and false negatve errors. Therefore, we propose a weght-based mult-svm detecton strategy to mprove the accuracy of PP traffc dentfcaton. F x, x, x ) = π F ( x ) + π F ( x ) + π F ( ) () F ( x3 π + π + π 3 = x 3 π F( x ) > PP x, x3) = < π F( x ) not PP = () γ π = 3 () ( γ ) = (, 3 j= α + β γ = (3) We extended the tradtonal SVM dentfcaton method as shown n formula () and (). In order to balance every SVM s nfluence on the dentfcaton result, we desgn a weght value π to every SVM. The weght π depends on the false postve and false negatve rate of every SVM when t dentfes the PP traffc. For the tranng data sets, we calculate each SVM s dentfcaton emprcal false postve and false negatve values: α and β. We defnte the weght values of each SVM, as shown n () and (3). Fg. depcts the algorthm for PP traffc dentfcaton. Fg. s the tranng process, and s the traffc dentfcaton process. V. EVALUATION AND EXPERIMENT RESULTS In ths secton, we evaluate the accuracy of our approach. The datasets that we use to evaluate our approach are packet traces collected from the campus network of Huazhong Unversty of Scence & Technology. We captured the traffc from Aprl, 9 to May, 9. We also generated packet traces of the PP applcatons usng several computers. Ths selfgenerated traffc can be accurately labeled. j Fgure. Flowchart of the approach for PP traffc dentfcaton by the weght-based mult-svm detecton strategy, the tranng process, the dentfyng process A Memory Occupancy Durng Flows Constructng and Updatng In secton IV, we present the flows constructng and updatng method. We examne the memory occupancy n a network wth M bandwdth. Durng the examnaton, the real traffc s 46.pkt/sec (8.68Mbt/sec) on overage. We compute the accumulatve number of flows and number of flows n memory every 5 seconds. From Fg., we can see that, the accumulatve number of flows ncreases rapdly, but through the flow overtme mechansm, the growth rate of memory occupancy s gradually slowed down. After ffty mnutes, the number of flows n the memory s bascally stable. Ths proves that the memory occupancy s stable by usng the flow constructng method and overtme mechansm proposed n ths paper. B PP Traffc Identfyng Results We choose Four popular PP applcatons: Btcomment, Xunle, PPlve and PPstream, and Four tradtonal C/S structure applcatons: Web, FTP, Mal, and DNS to evaluate our approach. ACADEMY PUBLISHER

8 584 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY flows x number of all flows number of flows n memory Accuracy BtComet Xunle PPLve PPStream tme(5seconds) Fgure. Memory occupancy durng flows constructng and updatng Frst, at the tranng phase, suffcent applcaton nstances are requred from the trace data. There s enough traffc n our datasets for these applcatons. In addton, the pror labelng applcaton on the tranng data must be accurate to guarantee the effectveness of our approach. In our experments, the tranng process s performed offlne and we use the self-generated traffc traces whch can be accurately labeled. Second, we examne the accuracy results of PP traffc dentfyng n new trace fles. We test our approach both n flow level and n host level. In flow level, we dentfy the flows that transmt data n the four PP applcatons. In host level we dentfy the hosts that partcpate n these applcatons. To dentfy the PP hosts, the frst step s to group all flows sent from and receved by ths host together. If over 5% percent flows of the PP hosts s dentfed as PP flows, we regard the host partcpate n PP applcatons. The accuracy result for flows s gven n Fg.. The four bars are average accuracy for BtComet, Xunle, PPLve and PPstream flows, respectvely. Fg. 3 shows the accuracy result for PP hosts dentfcaton. We can see that our approach has hgh accuracy n PP traffc dentfcaton. Because of the Mal applcaton has the smlar behavor characterstcs as the PP applcatons. The Mal Servers can also upload and download at the same tme as PP applcatons. We can dentfy Mal applcaton by the approach proposed n [8]. Frst, montor the set of destnaton port numbers for each IP for whch there Accuracy BtComet Xunle PPLve PPStream Fgure. Average accuracy result of PP flow dentfcaton Fgure 3. Average accuracy result of PP hosts dentfcaton exsts a source par (IP, 5) and then, f ths set of destnaton port numbers also contans 5, ths IP s consdered as a mal server [8]. When hosts n PP networks transmt a small amount of data, t s dffcult to dentfy. In ths stuaton, we need fgure out whether the nodes, t connected wth, are PP nodes. We consder the peer as a PP node, f some of the nodes t connected wth are PP nodes. VI. CONCLUSION In ths paper, we develop a statstcal methodology by analyzng the data transmsson mechansm and connecton characterstcs of PP networks at the transport layer wthout relyng on the port numbers and packet payload. In order to dentfy PP traffc, we frst record the flow nformaton by a hash table. Then we propose new PP traffc dentfcaton metrcs through analyzng the data splttng mechansm n PP applcatons. Next, a new weght based Mult-SVM dentfcaton approach s ntroduced. Fnally, our experment results ndcate that ths approach can effectvely dentfy PP applcatons We wll contnue our research along the followng two aspects. On the one hand, we wll further valdate the approach wth the new traces. On the other hand, we wll further analyss the flow behavor features to mprove the dentfcaton accuracy. ACKNOWLEDGMENT Ths work s supported by the Natonal Natural Scence Foundaton of Chna under Grant No. 6573, and by the Natonal Hgh Technology Research and Development Program of Chna(863 Program) under Grant No. 7AAZ4, and by the Key project sponsored by Natural Scence Foundaton of Hube Provnce under Grant No. 8CDA, and by specal foundaton of scentfc research of central unverstes of chna REFERENCES [] F. Constantnou, and P. Mavrommats, Identfyng Known and Unknown -to- Traffc, n Proceedngs of the Ffth IEEE Internatonal Symposum on Network Computng and Applcatons, 6. ACADEMY PUBLISHER

9 JOURNAL OF NETWORKS, VOL. 5, NO. 5, MAY 585 [] S. Sen, and J. Wang, Analyzng peer-to-peer traffc across large networks, n Proceedngs of the nd ACM SIGCOMM Workshop on Internet measurment, Marselle, France,, pp [3] T. Karaganns, A. Brodo, N. Brownlee et al., Is PP dyng or just hdng?, n Global Telecommuncatons Conference, 4, pp [4] A. Moore, and K. Papaannak, Toward the accurate dentfcaton of network applcaton, n Proc.PAM'5, USA, 5, pp [5] S. Sen, O. Spatscheck, and D. Wang, Accurate, scalable n-network dentfcaton of pp traffc usng applcaton sgnatures, n Proceedngs of the 3th nternatonal conference on World Wde Web, New York, NY, USA, 4, pp [6] P. Haffner, S.Sen, O. Spatscheck et al., Acas: Automated constructon of applcaton sgnatures, n SIGCOMM 5 Wrokshops, USA, 5, pp [7] M. Roughan, S. Sen, O. Spatscheck et al., Class-ofservce mappng for QoS: a statstcal sgnature-based approach to IP traffc classfcaton, n Proceedngs of the 4th ACM SIGCOMM conference on Internet measurement, Taormna, Scly, Italy, 4, pp [8] T. Karaganns, A. Brodo, M. Faloutsos et al., Transport layer dentfcaton of PP traffc, n Proceedngs of the 4th ACM SIGCOMM conference on Internet measurement, Taormna, Scly, Italy, 4. [9] T. Karaganns, K. Papagannak, and M. Faloutsos, BLINC: multlevel traffc classfcaton n the dark, n Proceedngs of the 5 conference on Applcatons, technologes, archtectures, and protocols for computer communcatons, Phladelpha, Pennsylvana, USA, 5, pp [] J. Erman, M. Arltt, and A. Mahant, Traffc classfcaton usng clusterng algorthms, n Proceedngs of the 6 SIGCOMM workshop on Mnng network data, Psa, Italy, 6, pp [] P. Xu, Q. Lu, and S. Ln, An Improved Transport Layer Identfcaton of -to- Traffc, Journal of Computer Research and Development, vol. 45, no. 5, pp , 8. [] D. J. Parsh, K. Bharada, A. Larkum et al., Usng packet sze dstrbutons to dentfy real-tme networked applcatons, Communcatons, vol. 5, no. 4, pp. - 7, 3. [3] S. Yag, Y. Wazum, H. Tsunoda et al., "Network applcaton dentfcaton usng transton pattern of payload length," IEEE Wreless Communcatons and Networkng Conference, Las Vegas, NE, 8, pp [4] A. Legout and S. Antpols, "understandng BtTorrent: an expermental perspectve," Sopha Antpols, France, 5. [5] X. He, C. Lang, J. Lang et al., A Measurement Study of a Large-Scale PP IPTV System, IEEE Transactons on Multmeda, vol. 9, no. 8, pp , 7. Feng Lu was born n Heze, Chna n 98, and receved hs B.S. degree n Computer Scence and Technology from Huazhong Agrculture Unversty, Wuhan, Chna, 4 and M.E. degree n Computer Archtecture from Huazhong Unversty of Scence and Technology, Wuhan, Chna, 7. He s currently a PHD student n the Department of Computer Scence and Technology at Huazhong Unversty of Scence and Technology. Hs research nterests nclude network securty and PP traffc measurement and dentfcaton. He has publshed several papers n the areas of PP traffc measurement, modelng and dentfcaton. Zhtang L was born n Janl, Chna n 95, and receved hs M.E. degree n Computer Archtecture from Huazhong Unversty of Scence and Technology, Wuhan, Chna, 987, and PHD degree n Computer Archtecture from Huazhong Unversty of Scence and Technology, Wuhan, Chna, 99. Hs research nterests nclude computer archtecture, network securty and PP networks. He s currently the drector of Chna Educaton and Research Network (CERNET) n Central Chna. He was a vce presdent of Department of Computer Scence and Technology, Huazhong Unversty of Scence and Technology, Chna. He has publshed more than one hundred papers n the areas of computer archtecture, network securty and PP networks. Professor L s a member of Experts Commttee of CERNET and a co-char of Computer Socety of Hube Provnce ACADEMY PUBLISHER