Mingjiang Ye

Identify P2P traffic by inspecting data transfer behavior

Classifying network traffic according to its applications is important to a broad range of network areas. Since new applications, especially P2P applications, no longer use well-known fixed port numbers, the native port-based traffic classification technique has become much less effective. In this paper, we propose a novel approach to identify P2P traffic by leveraging the data transfer behavior of P2P applications. The behavior investigated in the paper is that downloaded data from a P2P host will be uploaded to other hosts later. To find the shared data of downloading flows and uploading flows online, the content-based partitioning scheme is proposed to partition the flows into data blocks. Flows sharing the same data blocks are identified as P2P flows. Theoretical analysis proves that the content-based partitioning scheme is stable and effective. Experiments on various P2P applications demonstrate that the method is generic and can be applied to most P2P applications. Experimental results show that the algorithm can identify P2P applications accurately while only keeping a small set of data blocks.

AutoSig-Automatically Generating Signatures for Applications

Classifying network traffic according to the applications is important to a broad range of network areas. Compared with the traditional method which classifies traffic using predefined well-known port numbers, the method using application signatures is more accurate. Unfortunately, analyzing signatures and maintaining up-to-date signatures for various applications is very difficult. To solve the problem, the paper proposes AutoSig which is an automatic application signature generation system. AutoSig extracts multiple common substring sequences from sample flows as application signature. First all possible common substrings in an application protocol are extracted and then a substring tree is constructed to generate the final signature of the application. The method is evaluated on campus traffic traces, and the experiment results show that AutoSig can generate effective application signatures with very high accuracy automatically.

Proxy caching for peer-to-peer live streaming

Peer-to-Peer (P2P) live streaming has become increasingly popular over the Internet. To alleviate the inter-ISP traffic load and to minimize the access latency, proxy caching has been widely suggested for P2P applications. In this paper, we carry out an extensive measurement study on the properties of P2P live streaming data requests. Our measurement demonstrates that the P2P living streaming traffic exhibits strong localities that could be explored by caching. This is particularly noticeable for the temporal locality, which is often much weaker in the conventional P2P file sharing applications. Our results further suggest that the request time of the same data piece from different peers exhibits a generalized extreme value distribution. We then propose a novel sliding window (SLW)-based caching algorithm, which predicts and caches popular data pieces according to the measured distribution. Our experimental results suggest that the P2P live streaming can greatly benefit from the proxy caching. And, with much lower overhead, our SLW algorithm works closer to an off-line optimal algorithm that holds the complete knowledge of future requests.

A model approach to estimate Peer-to-Peer traffic matrices

Peer-to-Peer (P2P) applications have become increasingly popular in recent few years, which bring new challenges to network management and traffic engineering (TE). As basic input information, P2P traffic matrices are of significant importance for TE. Due to excessively high cost of direct measurement, a lot of studies aim at modeling and estimating general traffic matrices, but few focus on P2P traffic matrices. In this paper, we proposed a model to estimate P2P traffic matrices in networks. Important factors are considered, including the number of peers, the localization ratio of P2P traffic, and the distances among different networks. Here distance can be hop counts or geographic distance accordingly. To validate our model, we have evaluated the performance using both real P2P live steaming traces and file sharing application traces. Evaluation results show that the proposed model outperforms the other two typical models for general traffic matrices estimation, in terms of estimate errors. To the best of our knowledge, this is the first research on P2P traffic matrices estimation. P2P traffic matrices, derived from the model, can be applied to P2P traffic optimization and other TE fields.

Caching the P2P Traffic in ISP Network

The rise in peer-to-peer(P2P) networking has been tremendous in last several years. P2P traffic has significant impact on ISPs as it accounts for more than half of all traffic. Although many methods have been proposed to manage P2P traffic, little effort was spent on the deployment issues. In this paper, we have studied how to deploy P2P traffic cache devices in the backbone network to maximize the benefit of the ISP. A novel model is proposed to evaluate the benefits of deploying cache devices on different links. Guided by our model, two algorithms were developed to instruct the deployment of cache devices in the network. The experiment shows that deploying cached devices on less than 10% links can efficiently reduce the heavy load of the backbone network.

A Model Approach to the Estimation of Peer-to-Peer Traffic Matrices

Peer-to-Peer (P2P) applications have witnessed an increasing popularity in recent years, which brings new challenges to network management and traffic engineering (TE). As basic input information, P2P traffic matrices are of significant importance for TE. Because of the excessively high cost of direct measurement, many studies aim to model and estimate general traffic matrices, but few focus on P2P traffic matrices. In this paper, we propose a model to estimate P2P traffic matrices in operational networks. Important factors are considered, including the number of peers, the localization ratio of P2P traffic, and the network distance. Here, the distance can be measured with AS hop counts or geographic distance. To validate our model, we evaluate its performance using traffic traces collected from both the real P2P video-on-demand (VoD) and file-sharing applications. Evaluation results show that the proposed model outperforms the other two typical models for the estimation of the general traffic matrices in several metrics, including spatial and temporal estimation errors, stability in the cases of oscillating and dynamic flows, and estimation bias. To the best of our knowledge, this is the first research on P2P traffic matrices estimation. P2P traffic matrices, derived from the model, can be applied to P2P traffic optimization and other TE fields.

Identify P2P Traffic by Inspecting Data Transfer Behaviour

Classifying network traffic according to its applications is important to a broad range of network areas. Since new applications, especially P2P applications, no longer use well-known fixed port numbers, the native port-based traffic classification technique has become much less effective. In this paper, we propose a novel approach to identify P2P traffic by leveraging the data transfer behavior of P2P applications. The behavior investigated in the paper is that downloaded data from a P2P host will be uploaded to other hosts later. To find the shared data of downloading flows and uploading flows online, the content-based partitioning scheme is proposed to partition the flows into data blocks. Flows sharing the same data blocks are identified as P2P flows. Theoretical analysis proves that the content-based partitioning scheme is stable and effective. Experiments on various P2P applications demonstrate that the method is generic and can be applied to most P2P applications. Experimental results show that the algorithm can identify P2P applications accurately while only keeping a small set of data blocks.

A High Performance and Scalable Packet Pattern-Matching Architecture

Pattern-matching is often used in network security mechanisms, which detect the predefined signature strings or keywords starting at an arbitrary location in the payload. Such mechanisms require the network to inspect the packet payload at line rates to filter the worms or virus. These signature sets are large and some signature can be as long as more than 2000 byte. This paper propose a high performance and scalable packet pattern-matching architecture. Bloom filter engines are used in front-end for membership query which can achieve high performance, and an lookup table is used in back-end to performance deterministic string-matching. In order to solve the scalability problem in using Bloom filter to detect long pattern, prefix register heap is used to keep the intermediate status. The architecture can achieve gigabytes throughput with large pattern set and long patterns. A great saving in hardware resource also proves that the architecture is very scalable.