Detecting P2P traffic from the P2P flow graph

Abstract

Accurate identification of P2P (peer-to-peer) applications' flows is important for network capacity planning, provisioning, application traffic engineering, network service pricing, traffic shaping/policing, and flow prioritization. To this end, many identification methods have been developed based on the transport layer port, analysis of packet payloads, statistical observation on flows and graph-based structural properties. One deficiency of those methods is that they concentrate only on a decision of whether a single flow is P2P flow or not. This paper presents methods for detecting P2P flows by constructing a graph where each flow is a vertex. Edges are constructed by applying various rules that consider the ports used by previously detected P2P flows. In this graph, we find that around 90% of the P2P flows are within a large connected component. The remaining 10% is composed of many smaller connected components. Edges between the large connected component and these other components can be constructed with some heuristics. The methods proposed are tested on traffic traces that included signature matching, so that we are able to ensure that significant P2P applications are detected.