A Study on P2P Traffic Identification, Measurement and Analysis

(1) P2P流量识别方法P2P （peer -to- peer）文件共享应用广泛。在覆盖网络中，传输的主要是音乐和视频文件，众所周知，其流量要比传统的Client/Server应用大得多。然而，由于使用了匿名通信架构，当前P2P应用程序流量的性质并不为人所知。为了解决这个问题，我们开发了一种纯P2P应用流量的识别方法，特别是针对日本最流行的纯P2P文件共享应用Winny。我们的方法仅依赖于对等体之间的客户机/服务器关系，而不依赖于应用程序标头信息。我们的实验表明，我们对FN的鉴定为0.053-0.116，FP低于1/10000。(2) P2P流量特征评价将该方法应用于ISP流量，并对识别出的Winny流量进行了评价。Winny流的特征对于流出互联网的流和流入互联网的流几乎是对称的。少数对等体负责产生几乎所有的流量。在一个对等体中，上传流量和下载流量之间的相关性很小。这是因为Winny网络中没有明确的激励机制。

(1) P2P Traffic Identification MethodPeer-to-Peer (P2P) file sharing applications are widely used nowadays. In overlay networks, it is mainly music and video files that are transferred, and it is known that the traffic volume is much larger than that of classical Client/Server applications. However, the nature of current P2P application traffic is not well known because of the anonymous communication architectures used. To solve this problem, we have developed an identification method for pure P2P application traffic, especially for Winny, the most popular pure P2P file sharing application in Japan. Our method relies only on Client/Server relationships among the peers, without recourse to application header information. Our experiment shows that our identification of FN is 0.053-0.116 and FP is lower than 1/10000.(2) Characteristics Evaluation of P2P TrafficWe applied our method to ISP traffic and gave an evaluation of the identified Winny traffic. The characteristics of the Winny flows are almost symmetric for the outgoing flows to the Internet and the incoming flows. A small number of peers are responsible for producing almost all the traffic volume. Small correlation is observed between uploading traffic and downloading traffic in one peer. This is because that there is not explicit incentive mechanism in Winny network.