【摘要】 如何快速而准确的检测出P2P流量,是如今网络管理中的1个重要的问题。现在常见的检测方法有基于端口检测法,DPI深度包检测,以及根据传输层特征来检测。DPI深度包检测方法需要及时跟新特征库,对于加密协议无法识别等缺陷限制了其应用。机器学习的传输层检测方法通过分析流的统计特征来检测P2P流量。较之DPI,该方法能检测出DPI无法检测出的加密的P2P流量以及特征库外的流量。本文提出了1种新的结合DPI与基于机器学习的传输层检测方法的模型,并通过实验验证该模型能弥补DPI方法的缺陷,提高检测的准确性。更多还原

【Abstract】 A fast and accurate method to identify P2P traffic plays an important role in network management.Port-based classification,DPI(deep payload inspection) and flow-based classification are 3 main methods to inspect network traffic.DPI is widely used nowadays.But the approach is limited by the fact that classification rules must update when new P2P applications appear and it is effect less when faces the encrypted flows.Machine learning flow-based technique is based on per-flow statistics.Comparing with DPI,it can detect encrypted P2P flows and new P2P flows which are not included in the character database.A new method based on DPI and machine learning flow-based classification was proposed and tested in this paper,which can enhance the accuracy and efficiency.更多还原