P2P流量识别

Research of P2P Traffic Identification Based on BP Neural NetworkShen FukeComputer ScienceDepartment, East China NormalUniversity Shanghai 200062, China fkshen@Change PanComputer ScienceDepartment,East China NormalUniversityShanghai 200062, Chinapchang @Ren XiaoliComputer ScienceDepartment,East China NormalUniversityShanghai 200062, Chinaxlren@AbstractToday’s P2P application is a big challenge to network traffic workload. In contrast to first generation P2P network s which used well-defined port numbers, current P2P applications have ability to disguise their existence through the use of arbitrary ports. Our goal is to give out a new approach for P2P traffic identification based BP Neural Network, and without relying on k eyword matching. This article introduces BP algorithm, analyzes the characters of P2P traffic, gives out the BP network based on connection patterns of P2P networks. The trained BPNN was applied as a P2P traffic identifier, which can be used to distinguish any k ind of P2P applications from non-P2P applications. This feasible solution has many advantages in P2P traffic identification. We believe our approach is the first method for characterizing P2P traffic using network dynamics based on BP network rather than any user payload.1. IntrodoctionToday’s Peer-to-Peer (P2P) application is a big challenge to Internet traffic workload and P2P represents a formidable component of campus network traffic. Network traffic identification on campus network exit link or backbone node can provide support to network resource planning and traffic control [5]. In contrast to first generation P2P networks which used well-defined port numbers, current P2P applications have ability to disguise their existence through the use of arbitrary ports [3]. Most existing traffic identification technology is based on the ports number or payload keyword matching named Deep Packet Inspection (DPI) [8]. Not only do most P2P applications now operate on top of nonstandard, custom-designed proprietary protocols, but also current P2P clients can easily operate on any port number, even HTTP, FTP, or other popular app’s port [9]. These circumstances portend a frustrating conclusion: robust identification of P2P traffic is only possible by inspecting user payload [10]. Yet packet payload capture and analysis poses a set of often insurmountable methodological landmines: legal, privacy, technical, efficient, etc. Further obfuscating workload characterization attempt is the increasing tendency of P2P protocols to support payload encryption. Indeed, the frequency with which P2P protocols are introduced and/or upgraded renders packet payload analysis not only impractical but also glaringly inefficient.P2P flow inspection based traffic flow characteristic can be viewed as a Pattern Recognition problem which has two output, one is Yes and another is No [11]. So, Neural Network technology can be usedin P2P traffic inspection based traffic characteristic. In this paper we develop a BP neural network method to identify P2P flows at the campus exit link, based on flow connection patterns of P2P traffic, and without depending on packet payload. The significance of our algorithm lies in its ability to identify P2P protocols without relying on their underlying format, and we can identify previously unknown P2P protocols.2. BP Neural Network (BPNN)The attraction of neural networks is that they are best suited to solving the problems that are the most difficult to solve by traditional computational methods. BP Neural Network is a multi-tier network which weight value is trained by non-linear differentiable function. BPNN’s structure is simple and fictile, It is widely used in pattern recognition, voice recognition, image processing, Compression, Data mining, etc.Suppose we have P training samples, that means we have P input/output pairs(I p,T p), p=1,2,…P, and:I p =(i p1,Ăi pm )T ,(input vector), T p =(t p1,Ăt pn )T ,(output vector),The m is the dimension number of input vector, and n is the dimension number of output vector.O p =(o p1,…,o pn )T is the actual output vector corresponding to the input vector I p . W ij is the weight value of i th (i=1,…,n) output component corresponding to the j th (j=1,…,m) input component. ǻW ij denotes modification value of increase by degrees one time, so one time increasing by degrees formula is:W ij +ǻW ij =>W ij (1)We can explain formula (1) with: put the W ij ’s modification value ǻW ij to W ij and get a new W ij . And ǻW ij =¦Ș(t pi -o pi )i pj =Șįpi i pj , (2)Pp 1¦Pp 1įpi =t pi -o piȘ is learning efficiency. Formula (1) and (2) are named Delta learning rule. A BP network learns by example, that is, we must provide a learning set that consists of some input examples and the known-correct output for each case. So, we use these input-output examples to show the network what type of behavior is expected, and the BP algorithm allows the network to adapt. When the BPNN is trained, compare the network Resulting output with desired output gradually, and change the connection weight value according to the Delta learning rule. The cycle is repeated until the overall error value drops below some pre-determined threshold.For BP network, a continuous function in any closed interval can be asymptotic by single hidden layer BPNN. One of the easiest forms of BPNN topology is made of three layers: one input layer (the inputs of our network), one hidden layer, one output layer (the outputs of our network). All neurons from one layer are connected to all neurons in the next layer. The number of input neurons is determined by the number of input class traits, the number of output layer neurons is the number of target class. So, before set up a BP Neural Network, we need determine the traits value of input dataset (the number is m), and the number of output layer nodes. If the BP Neural Network is used as a classifier, and there is n class mode, then the neurons number of output layer is n. The number of hidden layer neurons is related to requirement of problem, the number of input/output layer neurons, etc. Too big hidden layer neurons number can result to long training time, and the error is not always best of all, can result to bad fault-tolerant and can not identify sample unseen before. So, there must be a best hidden layer neurons number, neither very big nor very small. Here is a reference formula of best hidden layer neurons number [13].1n m n +a (3)Thereinto, m is input layer neurons number, n is output layer neurons number, a is a constant between 1 and 10.Another important parameter is the training times, which is the number of input training data set traversing the BP Neural Network. Increasing the training times can improve the veracity of the BPNN model, but also can cost long training time. Decreasing the training times can reduce the veracity of the BPNN model, but also can cost short training time. So, we can choice one between 100 and 300 by experience.Learning efficiency Ș can be chose between 0.1 and 0.9. Lower learning efficiency needs more training iterative loop. Higher learning efficiency can make the BPNN overlay speedily and get a more non-linear result. If the hidden layer neurons number is too small, we can get a higher training error rate, and we must tolerant higher generalization error rate. If the hidden layer neurons number is too big, although training error rate falls, we can also get a higher generalization error rate because of exceeding appropriate value.3. BPNN in P2P Traffic IdentificationBefore traffic identification, we need understand the traffic behavior of different applications, analyze and select the character of different traffic. Table 1 illustrates some character of popular Internet services. From Table 1, we can see, P2P flow is easy to be distinguished from other services except FTP service [7]. One way to distinguish P2P from FTP is to see if user interaction exists. P2P application has 2 states, message associate state and data transfer state, which alternates in a very high frequency. Message associating is a way of user interaction. We can distinguish P2P from FTP by this feature.Character Selection is defined as choosing a best subset from input character set. Character extraction is defined as conversion or integration of original characters. There are 2 characters which can represent user interaction of data flow [6][12]:ƔMean Squared Deviation (MSD) of every flow’s packet sizeWhen a date flow’s packet size is variational and the variation is very big, the mean squared deviation of this flow’s packet size is very big. Although both WWW and P2P service have big MSD, We can distinguish P2P from WWW by flow duration, P2P flow has longer duration than WWW.ƔSwitching Frequency of every flow’s packet size Switching Frequency of P2P flow’s packet size is higher than that of other services.Table 1. Some characters of popular Internet servicesSo, we choose MSD(Mean Squared Deviation of the flow’s packet size), Switching Freq(Switching Frequency of the flow’s packet size), Rates(Average of the flow’s packet size), Packets(packet quantity of the flow ) and Bytes(Total bytes of the flow) as input characters. That means m=5.We inspect the traffic flow, only to identify the flow is P2P or not. So, the output has 2 options, that means n=2.So, we get: Input neurons number m=5, output neurons number n=2, hidden layer neurons number=4, training times epcoh ˙250, learningefficiency Ș=0.7.1n Using MATLAB’s Neural Network toolskit, we analyzed the data flow captured from East China Normal University campus network, we get 250 groups’ data flow samples (Table 2 gives out 8 of them). There are P2P flows and non-P2P flows. Sample 1 to 4 is P2P flow, and sample 5 to 8 is non-P2P. We denote P2P flow with (1,0), denote non-P2P with (0,1), So, Sample 1 to 4’s output is (1,0), and sample 5 to 8’s output is (0,1).Now we have a BPNN. Before we use the BPNN, we must train it. Only after having been trained enough, It can be used as a data flow classifier. In our experiment, we set the satisfactory threshold to be over 98%, that means it can not exceed 5 mis-identifications among 250 training samples. For testing our BPNN, we use 5 computers running FTP and WWW together with 2 of them running BitTorrent and eMule, other 3 of them running eDonkey and Tuotu(supporting encrypted transmission). We get 48875 flows, 2340268packets, 643.7M bytes by sniffer. Through our identification system, we get the number of P2P flow is 2787 while the actual number is 2895, the discovery rate is 96.3%. After 6 experiments in different time slot, we get discovery rate between 93% and 99%. Because this resolution is based on traffic characters, it can identify encrypted and unknown P2P traffic, it has a very good adaptability. We compare our solution with[1],[2],[3], we get comparison table 3. [1] is solution 1 in table 3, based on Deep Packet Inspection. In [1], the claimed discovery rate 99.4% is aimed at known P2P, this solution can not identify unknown and encrypted P2P. [2] is based on network layer and transport layer connection patterns of P2P networks. [3] gives out a solution based on Bayesian Analysis Techniques. From table 3, we can see our solution has advantages in flexibility, adaptability and discovery rate.4. ConclusionThe application layer signature is not operational because it must enumerate all possible signatures and it is useful to unknown P2P applications. The trained BPNN is based on P2P traffic characters rather than any user payload, which can be used to distinguish any kind of P2P applications from non-P2P applications. This solution is independent of the type of P2P application, port number, and transmission encrypted or not. So it has good adaptability. Because our experiment is offline, what we will do next step is to test this solution online, which needsService Duration Average Rate Count of Bytes HTTPshorthighFrom lower to higher VPN long lowhigh G ames long lowhigh Streaming longmidhighTelnet long low mid FTP/P2PlongMid to highhighhigher performance. We also need more data to verify whether the five characters are enough toidentify unknown P2P.Table 2. Samples of flow captured from ECNUTable 3. Comparison with other solutionSolution Solution Description Encrypted or notForged portDiscovery Rate Solution 1 Based on packet payload NoYes99.4%Solution 2 Based on traffic behavior of network layer and transport layerYes Yes 95%Solution 3 Using Bayesian Analysis Techniques and FCBFYes Yes 55.18% Our SolutionBased on traffic charactersYesYes96%5. References[1]S. Sen, O.Spatscheck, D.Wang. Accurate, Scalable In-Network Identification of P2P traffic Using Application Signatures. May 2004[2]A. W. Moore, K. Papgiannaki. Toward the Accurate Identification of Network Applications. March 2005[3]T. Karagiannis, A.Broido, M.Faloutsos. Transport Layer Identification of P2P Traffic. October 2004[4]A. W. Moore, D.Zuev. Internet Traffic Classification Using Bayesian Analysis Techniques. June 2005[5]/adsl2006/adsl2006/p2p.html[6] Li JiangTao, Jiang YongLing <P2P Traffic Identification and management technology> Telecom Science,2005 49(3).[7] /infocus/1843/1~3 [8]/doc.aspx?nid=58&language=sc&mid=14&smid=58 [9] [10]Sample IDMSDSwitching FreqRatesPacketsBytesType1 464.1424 1.4312 1363.875 152 207309 P2P 2 452.6442 1.0364 1397.611 163 227811 P2P 3534.8935 4.4694 893.5 149 133132 P2P 4 558.6362 3.8437 1074.848 154165527 P2P5701.5207 0.2592 747.25 9772483 Non-P2P 6103.6535 0.0069 14512417980 Non-P2P 7102.6203 0.0086 149.0357 136 20269 Non-P2P 8103.1136 0.0122151.0654 13119790Non-P2P[11]/PUBLICATIONS/AB STRACTS/EAGE98/eage98_hcd.pdf [12][13]FeiSi Science and Technology R&D Center <Neural Network Theory and MATLAB7 Implementation>,Beijng. Electronic Industry Public House. Mar. 2005.。