A Study on P2P Traffic Identification, Measurement and Analysis

(1)P2P流量识别方法P2P(Peer-to-Peer，P2P)文件共享应用日益广泛。在覆盖网络中，传输的主要是音乐和视频文件，并且众所周知，其业务量比传统的客户/服务器应用程序大得多。然而，由于所使用的匿名通信体系结构，当前P2P应用流量的性质并不是很清楚。为了解决这一问题，我们开发了一种纯P2P应用流量的识别方法，特别是针对日本最流行的纯P2P文件共享应用Winny。我们的方法只依赖于对等体之间的客户端/服务器关系，而不依赖于应用程序报头信息。我们的实验表明，我们对FN的识别率为0.053-0.116，FP低于1/10000。(2)P2P流量的特征评估我们将该方法应用于运营商流量，并对识别出的Winny流量进行了评估。对于到Internet的传出流和传入流，Winny流的特征几乎是对称的。少数对等点负责产生几乎所有的业务量。在一个对等体中观察到上传流量和下载流量之间的小相关性。这是因为Winny网络没有明确的激励机制。

(1) P2P Traffic Identification MethodPeer-to-Peer (P2P) file sharing applications are widely used nowadays. In overlay networks, it is mainly music and video files that are transferred, and it is known that the traffic volume is much larger than that of classical Client/Server applications. However, the nature of current P2P application traffic is not well known because of the anonymous communication architectures used. To solve this problem, we have developed an identification method for pure P2P application traffic, especially for Winny, the most popular pure P2P file sharing application in Japan. Our method relies only on Client/Server relationships among the peers, without recourse to application header information. Our experiment shows that our identification of FN is 0.053-0.116 and FP is lower than 1/10000.(2) Characteristics Evaluation of P2P TrafficWe applied our method to ISP traffic and gave an evaluation of the identified Winny traffic. The characteristics of the Winny flows are almost symmetric for the outgoing flows to the Internet and the incoming flows. A small number of peers are responsible for producing almost all the traffic volume. Small correlation is observed between uploading traffic and downloading traffic in one peer. This is because that there is not explicit incentive mechanism in Winny network.