Identification of P2P flows through host activity

Abstract

With the increasing quantity and varying nature of traffic crossing the internet, coupled with techniques such as fluctuating port numbers and transport layer encryption, the identification of individual packet flows is becoming more difficult. We introduce and investigate a new method for the detection of P2P flows based on the activity of the hosts (IP addresses) involved in the connection. Heuristics are generated that examine properties of these hosts and used to uniquely detect individual P2P and non-P2P flows. The identification strategy has been tested on two real network data traces from a core internet router with some classification accuracies showing higher than 99%.