Using traffic analysis for simultaneous detection of BitTorrent and streaming video traffic sources

Abstract

This paper presents a framework for a firewall to analyze and block BitTorrent file-sharing protocol using Traffic Analysis (TA) methods. BitTorrent traffic can be a concern of network administrators and is a valuable target for TA based investigation. In this work, the ability of a TA based classifier to identify the existence of BitTorrent traffic is tested under the condition that it is not only encrypted by a Virtual Private Network (VPN) tunnel but also mixed with other types of network traffic (including video streaming traffic and web traffic). The TA based classifier is comprised of 2 steps: a pre-filtering step and the actual classification step. The test results show that not only is it possible for the TA based classifier to distinguish BitTorrent traffic from the encrypted mixture, but the classifier can also tell the source of the streaming video in the mixture with high accuracy. The 2-step classifier is also proven to have boosted the accuracy by 15%. The results indicate the possibility of implementing a TA based firewall for monitoring BitTorrent traffic.