对等网络流量检测技术研究

P2P流量检测技术可分为基于流量特征的识别方法(TLI)和基于深层数据包识别方法(DPI)。TLI通过对传输层数据包进行分析并结合P2P系统所表现出来的流量特征,来识别某个网络流是否属于P2P。DPI采用协议分析与还原技术,提取P2P应用层数据,通过分析其载荷所包含的协议特征值,来判断网络流量是否属于P2P应用。DPI由于具有准确性高、健壮性好、具有分类功能,是P2P流量识别的主要方法。如果能够结合TLI和DPI的优点,就有可能设计出一个准确、高效的P2P流量实时识别算法。

Research on the Technology of Peer-to-Peer Network Traffic Identification

The Peer-to-Peer (P2P) network traffic identification technology includes Transport Layer Identification (TLI) and Deep Packet Inspection (DPI) methods. By analyzing packets of the transport layer and the traffic characteristic in the P2P system, TLI can identify whether or not the network data flow belongs to the P2P system. The DPI method adopts protocol analysis technology and reverting technology. It picks up data from the P2P application layer and analyzes the characteristics of the payload to judge if the network traffic belongs to P2P applications. Due to its accuracy, robustness and classifying ability, DPI is the main method used to identify P2P traffic. Adopting the advantages of TLI and DPI, a precise and efficient technology for P2P network traffic identification can be designed.