Abacus: Accurate behavioral classification of P2P-TV traffic

Abstract Peer-to-Peer streaming (P2P-TV) applications offer the capability to watch real time video over the Internet at low cost. Some applications have started to become popular, raising the concern of Network Operators that fear the large amount of traffic they might generate. Unfortunately, most of P2P-TV applications are based on proprietary and unknown protocols, and this makes the detection of such traffic challenging per se. In this paper, we propose a novel methodology to accurately classify P2P-TV traffic and to identify the specific P2P-TV application which generated it. Our proposal relies only on the count of packets and bytes exchanged among peers during small time-windows: the rationale is that these two counts convey a wealth of useful information, concerning several aspects of the application and its inner workings, such as signaling activities and video chunk size. Our classification framework, which uses Support Vector Machines, accurately identifies P2P-TV traffic as well as traffic that is generated by other kinds of applications, so that the number of false classification events is negligible. By means of a large experimental campaign, which uses both testbed and real network traffic, we show that it is actually possible to reliably discriminate between different P2P-TV applications by simply counting packets.

[1]  Andrew W. Moore,et al.  Internet traffic classification using bayesian analysis techniques , 2005, SIGMETRICS '05.

[2]  Zhi-Li Zhang,et al.  Profiling internet backbone traffic: behavior models and applications , 2005, SIGCOMM '05.

[3]  T. Kailath.  The Divergence and Bhattacharyya Distance Measures in Signal Selection , 1967 .

[4]  Wenjie Wang,et al.  Live streaming performance of the Zattoo network , 2009, IMC '09.

[5]  Matthew Roughan,et al.  Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification , 2004, IMC '04.

[6]  Dario Rossi,et al.  KISS: Stochastic Packet Inspection Classifier for UDP Traffic , 2010, IEEE/ACM Transactions on Networking.

[7]  Maurizio Dusi,et al.  Traffic classification through simple statistical fingerprinting , 2007, CCRV.

[8]  Anthony McGregor,et al.  Flow Clustering Using Machine Learning Techniques , 2004, PAM.

[9]  Marco Mellia,et al.  Measuring IP and TCP behavior on edge nodes with Tstat , 2005, Comput. Networks.

[10]  Keith W. Ross,et al.  A Measurement Study of a Large-Scale P2P IPTV System , 2007, IEEE Transactions on Multimedia.

[11]  Dario Rossi,et al.  An abacus for P2P-TV traffic classification , 2009, INFOCOM 2009.

[12]  Dario Rossi,et al.  Building a cooperative P2P-TV application over a wise network: the approach of the European FP-7 strep NAPA-WINE , 2008, IEEE Communications Magazine.

[13]  George Varghese,et al.  Graph-Based P2P Traffic Classification at the Internet Backbone , 2009, IEEE INFOCOM Workshops 2009.

[14]  Dario Rossi,et al.  Fine-grained traffic classification with netflow data , 2010, IWCMC.

[15]  Giuseppe Di Battista,et al.  26 Computer Networks , 2004 .

[16]  Michalis Faloutsos,et al.  Profiling the End Host , 2007, PAM.

[17]  Chih-Jen Lin,et al.  LIBSVM: A library for support vector machines , 2011, TIST.

[18]  Dario Rossi,et al.  Accurate, Fine-Grained Classification of P2P-TV Applications by Simply Counting Packets , 2009, TMA.

[19]  Danny Bickson,et al.  The eMule Protocol Specification , 2005 .

[20]  Konstantina Papagiannaki,et al.  Toward the Accurate Identification of Network Applications , 2005, PAM.

[21]  Michalis Faloutsos,et al.  BLINC: multilevel traffic classification in the dark , 2005, SIGCOMM '05.

[22]  Chuan Wu,et al.  Exploring large-scale peer-to-peer live streaming topologies , 2008, TOMCCAP.

[23]  Grenville J. Armitage,et al.  A survey of techniques for internet traffic classification using machine learning , 2008, IEEE Communications Surveys & Tutorials.

[24]  Oliver Spatscheck,et al.  Accurate, scalable in-network identification of p2p traffic using application signatures , 2004, WWW '04.

[25]  Michalis Faloutsos,et al.  Internet traffic classification demystified: myths, caveats, and the best practices , 2008, CoNEXT '08.

[26]  A. Singh.  Challenges " # , 2006 .

[27]  Dario Rossi,et al.  Network Awareness of P2P Live Streaming Applications: A Measurement Study , 2010, IEEE Transactions on Multimedia.

[28]  B. Cohen,et al.  Incentives Build Robustness in Bit-Torrent , 2003 .

[29]  Renata Teixeira,et al.  Early application identification , 2006, CoNEXT '06.

[30]  Carey L. Williamson,et al.  Identifying and discriminating between web and peer-to-peer traffic in the network core , 2007, WWW '07.

[31]  Bo Li,et al.  CoolStreaming/DONet: a data-driven overlay network for peer-to-peer live media streaming , 2005, Proceedings IEEE 24th Annual Joint Conference of the IEEE Computer and Communications Societies..

[32]  Yang Liu,et al.  Solving P2P Traffic Identification Problems Via Optimized Support Vector Machines , 2007, 2007 IEEE/ACS International Conference on Computer Systems and Applications.

[33]  Marco Mellia,et al.  Revealing skype traffic: when randomness plays with you , 2007, SIGCOMM 2007.

[34]  Benoit Claise,et al.  Cisco Systems NetFlow Services Export Version 9 , 2004, RFC.

[35]  Massimo Gallo,et al.  P2P-TV Systems under Adverse Network Conditions: A Measurement Study , 2009, IEEE INFOCOM 2009.

[36]  Olivier Fourmaux,et al.  Measuring P2P IPTV Systems , 2007 .

[37]  Sebastian Zander,et al.  A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification , 2006, CCRV.

[38]  R. Kondor,et al.  Bhattacharyya and Expected Likelihood Kernels , 2003 .

[39]  Hai Jin,et al.  AnySee: Scalable Live Stream-ing Service Based on Inter-Overlay Optimization , 2006, INFOCOM 2006.

[40]  Dario Rossi,et al.  Kiss to Abacus: A Comparison of P2P-TV Traffic Classifiers , 2010, TMA.

[41]  Nello Cristianini,et al.  An Introduction to Support Vector Machines and Other Kernel-based Learning Methods , 2000 .

[42]  Stefan Savage,et al.  Unexpected means of protocol inference , 2006, IMC '06.

[43]  Cheng Huang,et al.  Challenges, design and analysis of a large-scale p2p-vod system , 2008, SIGCOMM '08.