一种混合式BitTorrent流量检测方法

P2P流量已经成为互联网流量的主要部分，消耗大量的带宽，影响了服务质量，准确并实时检测出P2P流量有助于对P2P应用的监管，并研究其行为和发展。针对P2P流量中比例最大的BT流量，提出了一种混合式的检测方法。该方法由三个子方法构成，分别针对BT流量中的明文流、密文流和信令流进行检测，并预知即将发生的BT流量。实验结果表明，该方法的召回率、准确率和实时性，均优于目前实时性最好的几种机器学习方法。

Hybrid BitTorrent traffic detection

Peer-to-peer (P2P) applications generate a large volume of traffic and seriously affect quality of normal network services. Accurate and real-time identification of P2P traffic is important for network management. A hybrid approach consists of three sub-methods was proposed to identify BitTorrent (BT) traffic. It applied application signatures to identify unencrypted traffic. And for those encrypted flows, message-based method according to the features of the message stream encryption (MSE) protocol was proposed. And a pre-identification method based on signaling analysis was applied to predict BT flows and distinguish them even at the first packet with SYN flag. And some modified Vuze clients were used to label BT traffic in real traffic traces, which made high accuracy benchmark datasets to evaluate the hybrid approach. The results illustrate its effectiveness, especially for those un- or semi- established flows, which have no obvious signatures or flow statistics.