Research and Implementate of P2P Flow Identification Technologybased on Keywords
|School||Huazhong University of Science and Technology|
|Keywords||Peer-to-peer keyword recognition Protocol stack architecture Packet filtering Behavioral characteristics|
In recent years , the rapid development of peer - to - peer applications to bring \On the one hand , P2P applications swallowed a lot of bandwidth resources seriously affected the quality of other network services , on the other hand , the dynamic nature of the P2P network structure makes the network very complex P2P application network security issues have become increasingly prominent . In order to better control and management of P2P network , the identification of P2P traffic becomes more and more important . P2P traffic identification methods are: high port analysis , flow pattern recognition method , the connection pattern recognition method , flow feature recognition method , these methods are through statistical analysis of some of the common characteristics of P2P , this feature identification of P2P flow conditions . These methods are based on the statistical characteristics , when used alone , a detection error is often higher . Linux systems, has been the netfilter / iptables framework provides a platform packet filtering , packet through the system kernel , passes through a fixed point of the Netfilter / iptables framework . Set the hook function at these points , and the hook function is other modules within the system is registered , the packets will be accepted through the fixed point hook function verification of the registration module , the packet filtering function . The original of the Netfilter / iptables and did not identify P2P traffic , this paper extend the original framework , increasing inspection P2P traffic packet functions , in order to achieve packet recognition feature of P2P traffic based on keywords . Achieve system test analysis , draw system for the known keyword P2P traffic identification efficiency is higher , and for an unknown keyword traffic identification was powerless to do anything . Therefore propose a new solution , the use of the current system , combined with the flow characteristics of the detection method , known keywords and an unknown keyword P2P traffic identification , to ensure that the premise of the original high accuracy to improve efficiency of the system , so that the identification system is more complete. Experimental tests showed that the new solution has greatly improved efficiency .