HFBP: Identifying P2P Traffic by Host Level and Flow Level Behavior Profiles

Recently, Peer-to-peer (P2P) networks have been widely applied in streaming media, instant messaging, file sharing and other fields, which have occupied more and more network bandwidth. Accurately identify P2P traffic is very important to management and control P2P traffic. In this paper, we introduce HFBP, a novel P2P identification scheme based on the host level and flow level behavior profiles of P2P traffic. HFBP consists of two stages. In the first stage, we calculate the probability that a host takes part in P2P application by matching its behavior with some host level behavior rules. In the second stage, we compute the probability that a flow belonging to P2P application by comparing the statistical features of each flow in the host with several flow feature profiles. We evaluate HFBP using real traffic traces. The identification accuracy achieves 93.1% and 95.1% in terms of flow and byte respectively. The experimental results prove that HFBP obtains satisfactory performance in identifying P2P traffic.