Abstract
Peer-to-Peer (P2P) traffic is widely used for the purpose of streaming media, file-sharing, instant messaging, games, software etc., which often involves copyrighted data. From the past decade, P2P traffic has been contributing to major portion of Internet traffic which is still rising and hence is consuming a lot of network traffic bandwidth. It also worsens congestion of network traffic significantly and degrades the performance of traditional client–server applications. Popularity of various P2P applications has led Internet Service Providers (ISPs) to face various challenges regarding efficiently and fairly utilizing network resources. The traditional methods of identifying P2P traffic such as port-based and payload-based are proving ineffective due to their significant limitations and can be bypassed. Hence, new approaches based on statistics or behaviour of network traffic needs to be developed and adopted in order to accurately identify existing and new P2P traffic which emerge over the time. This article presents a survey regarding various strategies involved in identifying P2P traffic. Furthermore, conceptual analysis of network traffic measurement and monitoring is also presented.
Similar content being viewed by others
References
Hurley J, Garcia-Palacios E, Sezer S (2009) Classification of P2P and HTTP using specific protocol characteristics. Lecture notes in The Internet of the Future, Proceedings of 15th Open European Summer School and IFIP TC6.6 Workshop, EUNICE 2009, Barcelona, Spain, vol. 5733, pp 31–40
Mohammadi M, Raahemi B, Akbari A, Moeinzadeh H, Nasershari B (2011) Genetic-based minimum classification error mapping for accurate identifying Peer-to-Peer applications in the internet traffic. Expert Syst Appl: Int J 38(6):6417–6423
Sen S, Wang J (2004) Analyzing peer-to-peer traffic across large networks. IEEE/ACM Trans Networking 12(2):219–232
Dai L, Yang J, Lin L (2010) A comprehensive system for P2P classification. In: 2nd IEEE international conference on network infrastructure and digital content, pp 561–563
Chu H, Yi H, Zhang H (2011) A new P2P traffic identification methodology based on flow statistics. In: 3rd IEEE international conference on communication software and networks (ICCSN 2011), pp 277–281
Keralapura R, Nucci A, Chuah C-N (2010) A novel self-learning architecture for p2p traffic classification in high speed networks. Comput Netw 54(7):1055–1068
Azzouna NB, Guillemin F (2003) Analysis of ADSL traffic on an IP backbone link. In: IEEE Global Telecommunication Conference (GLOBECOM’03), vol. 7, pp. 3742–3746
Schulze H, Mochalski K (2007) Internet study 2007. Tech. report, ipoque
Karagiannis T, Broido A, Brownlee N, Claffy KC, Faloutsos M (2004) File-sharing in the Internet: a characterization of P2P traffic in the backbone. Tech. report
Madhukar A, Williamson C (2006) A longitudinal study of P2P traffic classification. In: Proceedings of 14th IEEE international symposium on modeling, analysis, and simulation of computer and telecommunication systems, Washington, DC, USA, pp. 179–188
Nguyen TTT, Armitage G (2009) A survey of techniques for internet traffic classification using machine learning. In: IEEE Communications surveys and tutorials, vol. 10, no.4
Callado A, Kamienski C, Szabo G, Gero B, Kelner J, Fernandes S, Sadok D (2009) A survey on internet traffic identification. IEEE Commun Surv Tutorials 11(3):37–52
Li W, Canini M, Moore AW, Bolla R (2009) Efficient application identification and the temporal and spatial stability of classification schema. Comput Netw 53(6):790–809
Williamson C (2001) Internet traffic measurement. IEEE Internet Comput 5(3):70–74
McGregor T (2002) Quality in measurement: beyond the deployment barrier. In: Proceedings of the symposium on applications and the internet workshops (SAINT), IEEE Computer Society, pp 66–73
Paxson V (2004) Strategies for sound Internet measurement. In: Proceedings of the ACM SIGCOMM Internet Measurement Conference (IMC 2004), NY, USA, pp 263–271
Enterprise network monitoring tools – network security system – application performance monitoring. http://www.endace.com
IPOQUE (2015) Bandwidth management with deep packet inspection. http://www.ipoque.com
WildPackets: Network analyzer, voip monitoring, protocol analysis. http://www.wildpackets.com
Intelligent real-time network analysis. http://www.napatech.com
SNORT. http://www.snort.org
Bro intrusion detection system. http://bro-ids.org
Wireshark, go deep. http://www.wireshark.org
ETTERCAP. http://ettercap.sourceforge.net
Claffy KC, McCreary S (1999) Internet measurement and data analysis: passive and active measurement. In: American Statistical Association
Duffield NG (2004) Sampling for passive internet measurement: a review. Stat Sci 19(3):472–498
Duffield N, LUND C, Thorup M (2005) Estimating flow distributions from sampled flow statistics. IEEE/ACM Trans Netw 13(5):933–946
Claffy KC, Braun H-W, Polyzos GC (1995) A parameterizable methodology for Internet traffic flow profiling. IEEE J Sel Areas Commun 13(8):1481–1494
Apisdorf J, Claffy KC, Thompson K, Wilder R (1996) OC3MON: flexible, affordable, high performance statistics collection. In: Proceedings of the 10th USENIX conference on systems administration (LISA 1996), USENIX Association, Berkeley, CA, USA, pp. 97–112
Moore D, Keys K, Koga R, Lagache E, Claffy KC (2001) The CoralReef software suite as a tool for system and network administrators. In: Proceedings of the 15th USENIX conference on system administration (LISA 2001), USENIX Association, Berkeley, CA, USA, pp 133–144
CISCO NETFLOW. http://www.cisco.com/web/go/netflow
IETF (2008) Specification of the IP flow information export (IPFIX) protocol for the exchange of IP traffic flow information. In: RFC 5101
Allman M, Paxson V (2007) Issues and etiquette concerning use of shared measurement data. In: Proceedings of the 7th ACM SIGCOMM conference on Internet Measurement (IMC 2007), ACM, New York, NY, USA, pp 135–140
TCPDUMP/LIBPCAP public repository. http://www.tcpdump.org
WINDUMP. tcpdump forWindows usingWinPcap. http://www.winpcap.org/windump
Jurga RE, Hulbój MM (2007) Packet sampling for network monitoring. Technical report, CERN - HP Procurve openlab project
Sperotto A, Sadre R, Vliet F, Pras A (2009) A labeled data set for flow-based intrusion detection. In: Proceedings of the 9th IEEE international workshop on ip operations and management(IPOM 2009) (Venice, Italy, Oct.), LNCS Series, Springer-Verlag, Berlin Heidelberg, vol. 5843, pp 39–50
Zuev D, Moore AW (2005) Traffic classification using a statistical approach. In: Proceedings of the passive and active measurement conference (PAM 2005), LNCS Series, Springer-Verlag, Berlin Heidelberg, vol. 3431, pp 321–324
Karagiannis T, Papagiannaki K, Faloutsos M (2005) BLINC: multilevel traffic classification in the dark. In: Proceedings of the ACM SIGCOMM conferenece. on applications, technologies, architectures, and protocols for computer communications, ACM, New York, NY, USA, vol. 35, no. 4, pp 229–240
Salgarelli L, Gringoli F, Karagiannis T (2007) Comparing traffic classifiers. ACM SIGCOMM Comput Commun Rev 37(3):65–68
Canini M, Li W, Moore AW, Bolla R (2009) GTVS: boosting the collection of application traffic ground truth. In: Proceedings of the 1st international workshop on traffic monitoring and analysis (TMA’09) (Aachen, Germany), Springer Verlag, Heidelberg, Germany, pp 54–63
Gringoli F, Salgarelli L, Dusi M, Cascarano N, Risso F, Claffy KC (2009) GT: picking up the truth from the ground for Internet traffic. ACM SIGCOMM Comput Commun Rev 39(5):13–18
Szabó G, Orincsay D, Malomsoky S, Szabó I (2008) On the validation of traffic classification algorithms. In: Proceedings of the passive and active measurement conference (PAM 2008) (Cleveland, OH, USA), LNCS Series, Springer-Verlag, Berlin Heidelberg, vol. 4979, pp 72–81
Makhoul J, Kubala F, Schwartz R, Weischedel R (1999) Performance measures for information extraction. In: Proceedings of the DARPA Broadcast News Workshop (Herndon, VA, USA), pp 249–252
Olson DL, Delen D (2008) Advanced data mining techniques, 1st edition, Springer
Wang Y (2008) Statistical techniques for network security: modern statistically-based intrusion detection and protection. In: Premier Reference Source, Information Science Reference
Raahemi B, Zhong W, Liu J (2008) Peer-to-peer traffic identification by mining IP layer data streams using concept-adapting very fast decision tree. In: Proceedings of the 20th IEEE international conference on tools with artificial intelligence (ICTAI’08), IEEE, vol. 1, pp. 525–532
Internet Assigned Numbers Authority (IANA), http://www.iana.org/assignments/port-numbers
Gomes JV, Inacio PRM, Pereira M, Freire MM, Monteiro PP (2013) Detection and classification of peer-to-peer traffic: A survey. In: ACM Computing Surveys (CSUR), NY, USA, vol. 45, no. 3
Moore AW, Papagiannaki K (2005) Toward the accurate identification of network applications. In: Proceedings of the 6th international conference on Passive and Active Network Measurement (PAM 2005), pp 41–54
Karagiannis T, Broido A, Brownlee N, Claffy KC, Faloutsos M (2004) Is P2P dying or just hiding?. In: Proceedings of the IEEE global telecommunications conference (GLOBECOM’04), vol. 3, pp. 1532–1538
Roughan M, Sen S, Spatscheck O, Duffield N (2004) Class-of-service mapping for QoS: A statistical signature-based approach to IP traffic classification. In: Proceedings of the 4th ACM SIGCOMM conference on Internet Measurement (IMC 2004), ACM, New York, NY, USA, pp 135–148
Sen S, Spatscheck O, Wang D (2004) Accurate, scalable in network identification of P2P traffic using application signatures. In: Proceedings of the 13th international conference on World Wide Web (WWW 2004), ACM, New York, NY, USA, pp 512–521
Karagiannis T, Broido A, Faloutsos M, Claffy KC (2004) Transport layer identification of P2P traffic. In: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, (IMC 2004), pp 121–134
Wang K, Stolfo SJ (2004) Anomalous payload-based network intrusion detection. In: Lecture Notes in Computer Science, Springer, Berlin, vol. 3224, pp 203–222
Song T, Zhou Z (2013) File aware P2P traffic classification: an aid to network management. J Peer-to-Peer Netw Appl (Springer) 6(3):325–339
Turkett WH, Karode AV, Fulp EW (2008) In-the-dark network traffic classification using support vector machines. In: Proceedings of the 20th National Conference on innovative applications of artificial intelligence (IAAI 2008), AAAI Press, pp 1745–1750
Freire EP, Ziviani A, Salles RM (2008) Detecting Skype flows in web traffic. In: Proceedings of the IEEE network operations and management symposium (NOMS 2008), IEEE, pp. 89–96
Freire EP, Ziviani A, Salles RM (2008) Detecting VoIP calls hidden in web traffic. IEEE Trans Netw Serv Manag 5(4):204–214
Gomes JVP, Inácio PRM, Freire MM, Pereira M, Monteiro PP (2008) Analysis of peer-to-peer traffic using a behavioural method based on entropy. In: Proceedings of the 27th IEEE International Performance Computing and Communications Conference (IPCCC 2008), IEEE Computer Society Press, Austin, Texas, pp. 201–208
Sun M, Chen J (2011) Research of the traffic characteristics for the real time online traffic classification. J China Univ Posts Telecommun (Elsevier) 18(3):92–98
Moore AW, Zuev D (2006) Discriminators for use in flow-based classification. In: Proceedings of the 20th BCS HCI Group Conference (HCI’06), London, UK, Sep 11–15
Bernaille L, Teixeira R, Akodkenou I, Soule A, Salamatian K (2006) Traffic classification on the fly. ACM SIGCOMM Comput Commun Rev 36(2):23–26
He J, Yang Y, Qiao Y, Deng W (2015) Fine-grained P2P traffic classification by simply counting flows. Front Inf Technol Electron Eng 16(5):391–403
Yang Kai, Wang B, Zhang Z (2013) A method of identifying P2P live streaming based on union features. In 4th IEEE International Conference on Software Engineering and Service Science (ICSESS), Beijing, pp. 426–429
Qin T, Wang L, Zhao D, Zhu M (2015) CUFTI: methods for core users finding and traffic identification in P2P systems. J Peer-to-Peer Netw Appl (Springer) 9(2):424–435
Zhang Q, Ma Y, Zhang P, Wang J, Li X (2004) Netflow Based P2P detection in UDP traffic. In IEEE 5th International Conference on Intelligent Control and Information Processing (ICICIP), Dalian, pp. 250–254
Perényi M, Dang TD, Gefferth A, Molnár S (2006) Identification and analysis of peer-to-peer traffic. J Commun 1(7):36–46
John W, Tafvelin S (2008) Heuristics to classify Internet backbone traffic based on connection patterns. In: Proceedings of the international conference on information networking (ICOIN 2008), IEEE, pp. 1–5
Hong W (2011) A novel method for P2P traffic identification. In: Procedia Engineering (Elsevier), vol. 23, pp. 204–209
Reddy JM, Hota C (2015) Heuristic-based real-time P2P traffic identification. In IEEE international conference on emerging information technology and engineering solutions (EITES), Pune, pp. 38–43
Bashir A, Huang C, Nandy B, Seddigh N (2013) Classifying P2P activity in netflow records: a case study on BitTorrent. In IEEE International Conference on Communications (ICC), Budapest, pp. 3018–3023
Mcgregor A, Hall M, Lorier P, Brunskill J (2004) Flow clustering using machine learning techniques. In: Proceedings of the passive and active measurement workshop (PAM 2004) (Antibes Juanles- Pins, France). LNCS Series, Springer-Verlag, Berlin Heidelberg, vol. 3015, pp 205–214
Moore AW, Zuev D (2005) Internet traffic classification using bayesian analysis techniques. ACM SIGMETRICS Perform Eval Rev 33(1):50–60
Branch PA, Heyde A, Armitage GJ (2009) Rapid identification of Skype traffic flows. In: Proceedings of the 18th international workshop on network and operating system support for digital audio and video (NOSSDAV’09), ACM, NY, USA, pp 91–96
Schmidt SEG, Soysal M (2006) An intrusion detection based approach for the scalable detection of P2P traffic in the national academic backbone network. In: Proceedings of the International Symposium on Computer Networks (ISCN 2006), IEEE, pp. 128–133
Cao J, Chen A, Widjaja I, Zhou N (2008) Online identification of applications using statistical behavior analysis. In: Proceedings of the IEEE Global Telecommunications Conference (GLOBECOM 2008), IEEE, pp. 1–6
Angevine D, Zincir-heywood AN (2008) A preliminary investigation of Skype traffic classification using a minimalist feature set. In: Proceedings of the 3rd International Conference on Availability, Reliability and Security (ARES 08), IEEE Computer Society Press, pp. 1075–1079
Wang Y-H, Gau V, Bosaw T, Hwang J-N, Lippman A, Liebennan D, Wu I-C (2008) Generalization performance analysis of flow-based peer-to-peer traffic identification. In: Proceedings of the IEEE Workshop on Machine Learning for Signal Processing (MLSP 2008), IEEE, pp 267–272
Dainotti A, de Donato W, Pescape A, Rossi PS (2008) Classification of network traffic via packet-level hidden markov models. In: Proceedings of the IEEE Global Telecommunications Conference (GLOBECOM 2008), IEEE, pp. 1–5
Valenti S, Rossi D, Meo M, Mellia M, Bermolen P (2009) Accurate, fine-grained classification of P2P-TV applications by simply counting packets. In: Proceedings of the 1st international workshop on traffic monitoring and analysis (TMA’09), LNCS Series, vol. 5537. Springer-Verlag, Berlin, Heidelberg, pp. 84–92
Liu H, Feng W, Huang Y, Li X (2007) A peer-to-peer traffic identification method using machine learning. In: Proceedings of the international conference on networking, architecture, and storage (NAS 2007), IEEE, pp. 155–160
Raahemi B, Kouznetsov A, Hayajneh A, Rabinovitch P (2008) Classification of peer-to-peer traffic using incremental neural networks (fuzzy ARTMAP). In: Proceedings of the Canadian conference on electrical and computer engineering (CCECE 2008), IEEE, pp. 719–724
Hu Y, Chiu D-M, Lui JCS (2008) Application identification based on network behavioral profiles. In: Proceedings of the 16th International Workshop on Quality of Service (IWQoS 2008), IEEE, pp. 219–228
Hu Y, Chiu D-M, Lui JCS (2009) Profiling and identification of P2P traffic. Comput Netw 53(6):849–863
Liu S-M, Sun Z-X (2014) Active learning for P2P traffic identification. In: Journal of Peer-to-Peer Networking and Applications (Springer)
Moore AW, Zuev D (2005) Internet traffic classification using Bayesian analysis techniques. In: Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, ACM, NY, USA, pp. 50–60
Jiang D, Tao L (2013) P2P traffic identification research based on the SVM. In: 22nd Wireless and Optical Communication Conference (WOCC, 2013), IEEE, Chongqing, China, pp. 683–686
Gong J, Wang W, Wang P, Sun Z (2014) P2P traffic identification method based on an improvement incremental SVM learning algorithm. In: Proceeding of international symposium on wireless personal multimedia communications (WPMC 2014), IEEE, Sydney, NSW, pp. 174–179
Deng S, Luo J, Liu Y, Wang X, Yang J (2014) Ensemble learning model for P2P traffic identification. In: 11th international conference on fuzzy systems and knowledge discovery (FSKD 2014), IEEE, Xiamen, pp. 436–440
Jie H, Yuexiang Y, Yong Q, Chuan T (2013) Accurate classification of P2P traffic by clustering flows. Commun China IEEE 10(11):42–51
Bozdogan C, Gokcen Y, Zincir I (2015) A preliminary investigation on the identification of peer to peer network applications. In Proceedings of the Companion Publication of the 2015 Annual Conference on Genetic and Evolutionary Computation, ACM, NY, USA, pp. 883–888
Dedinski I, Meer HD, Han L, Mathy L, Pezaros DP, Sventek JS, Xiaoying Z (2005) Cross-layer peer-to-peer traffic identification and optimization based on active networking. In: Proceedings of the 7th annual international working conference on active and programmable networks (IWAN 2005) (Sophia Antipolis, France, Nov.). Springer-Verlag, Berlin Heidelberg, pp. 13–27
Adami D, Callegari C, Giordano S, Pagano M, Pepe T (2009) A real-time algorithm for Skype traffic detection and classification. In: Proceedings of the 9th international conference on next generation wired/wireless networking (NEW2AN’09) (St. Petersburg, Russia, Sept.), LNCS Series, vol. 5764. Springer-Verlag, Berlin Heidelberg, pp. 168–179
Yan J, Wu Z, Luo H, Zhang S (2013) P2P traffic identification based on host and flow behaviour characteristics. Cybern Inf Technol 13(3):64–76
Ye W, Cho K (2014) Hybrid P2P traffic classification with heuristic rules and machine learning. J Soft Comput, Springer, Berlin Heidelberg 18(9):1815–1827
Ye W, Cho K (2015) P2P and P2P botnet traffic classification in two stages. In Journal of Soft Computing, Springer Berlin Heidelberg, pp. 1–12
Wang D, Zhang L, Yuan Z, Xue Y, Dong Y (2014) Characterizing application behaviors for classifying P2P traffic. In: International Conference on Computing, Networking and Communications (ICNC 2014), IEEE, Honolulu, HI, pp. 21–25
Yang Z, Li L, Ji Q, Zhu Y (2012) Cocktail method for BitTorrent traffic identification in real time. J Comput 7(1):85–95
Korczynski M, Duda A (2014) Markov chain fingerprinting to classify encrypted traffic. In: Proceedings of 2014 IEEE, INFOCOM, Toronto, pp. 781–789
Alshammari R, Zincir-Heywood AN (2015) Identification of VoIP encrypted traffic using a machine learning approach. J King Saud Univ Comput Inf Sci NY, USA 27(1):77–92
Kumano Y, Ata S, Nakamura N, Nakahira Y, Oka I (2014) Towards real-time processing for application identification of encrypted traffic. In: International conference on computing, networking and communications (ICNC), Honolulu, pp. 136–140
Wang X, Yang Y, He J (2014) Identifying P2P network activities on encrypted traffic. In: 13th IEEE international conference on trust, security and privacy in computing and communications (TrustCom), Beijing, pp. 893–899
Du Y, Zhang R (2013) Design of a method for encrypted P2P traffic identification using K-means algorithm. J Telecommun Syst (Springer) 53(1):163–168
Datta J, Kataria N, Hubballi N (2015) Network traffic classification in encrypted environment: a case study of google hangout. In 21st IEEE National Conference on Communications (NCC), Mumbai, pp. 1–6
Saroiu S, Gummadi KP, Dunn RJ, Gribble SD, Levy HM (2002) An analysis of Internet content delivery systems. In: Proceedings of the 5th symposium on operating systems design and implementation (OSDI’02), ACM, New York, NY, USA, vol. 36, pp 315–327
Leibowitz N, Bergman A, Ben-shaul R, Shavit A (2002) Are file swapping networks cacheable? Characterizing P2P traffic. In: Proceedings of the 7th international workshop on web content caching and distribution (WCW)
Gerber A, Houle J, Nguyen H, Roughan M, Sen S (2003) P2P, the gorilla in the cable. In: Proceedings of the national cable & telecommunications association (NCTA), pp 8–11
Spognardi A, Lucarelli A, Pietro RD (2005) A methodology for P2P file-sharing traffic detection. In: Proceedings of the 2nd international workshop on hot topics in peer-to-peer systems (HOT-P2P’05), IEEE Computer Society, Washington, DC, USA, pp. 52–61
Bin L, Zhi-Tang L, Hao T (2007) A methodology for P2P traffic measurement using application signature work-in-progress. In: Proceedings of the 2nd international conference on scalable information systems (InfoScale’07), ICST, Brussels, Belgium
Dewes C, Wichmann A, Feldmann A (2003) An analysis of Internet chat systems. In: Proceedings of the ACM SIGCOMM internet measurement conference (IMC 2003), ACM, New York, NY, USA, pp. 51–64
Guo Z, Qiu Z (2008) Identification peer-to-peer traffic for high speed networks using packet sampling and application signatures. In: Proceedings of the 9th international conference on signal processing (ICSP 2008), IEEE, pp. 2013–2019
Cascarano N, Ciminiera L, Risso F (2010) Improving cost and accuracy of DPI traffic classifiers. In: Proceedings of the 2010 ACM symposium on applied computing (SAC 2010), ACM, New York, NY, USA, pp. 641–646
Carvalho DA, Pereira M, Freire MM (2009) Towards the detection of encrypted BitTorrent traffic through deep packet inspection. In: Proceedings of the international conference on security technology (SecTech 2009), communications in computer and information science series, Springer-Verlag, Berlin Heidelberg, vol. 58, pp. 265–272
Carvalho DA, Pereira M, Freire MM (2009) Detection of peer-to-peer TV traffic through deep packet inspection. In: Acta da 9a Conference sobre Redes de Computadores (Oeiras, Portugal, Oct.). INESC-ID and Instituto Superior Técnico, 6
Freire MM, Carvalho DA, Pereira M (2009) Detection of encrypted traffic in eDonkey network through application signatures. In: Proceedings of the 1st international conference on advances in P2P systems (AP2PS 2009), IEEE Computer Society Press, Los Alamitos, CA, USA, pp.174–179
Park B.-C, Won YJ, Kim M.-S, Hong JW (2008) Towards automated application signature generation for traffic identification. In: Proceedings of the IEEE/IFIP Network Operations and Management Symposium (NOMS 2008), IEEE, pp. 160–167
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Bhatia, M., Rai, M.K. Identifying P2P traffic: A survey. Peer-to-Peer Netw. Appl. 10, 1182–1203 (2017). https://doi.org/10.1007/s12083-016-0471-2
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s12083-016-0471-2