Detection of Peer-to-Peer Nodes based on Query Routing

In this paper, we propose a novel P2P node detection method by analyzing network traffic and extracting packets which contain query messages. Most previous methods detect P2P nodes by using signatures of known applications or taking advantages of traffic features in P2P nodes. However, they cannot detect hosts running unknown P2P applications while keeping low false positive rate. To address the problem, we focus on the resource discovery mechanism where query messages are routed and transmitted through several nodes to locate hosts providing certain files. Then, we attempt to detect hosts that appear to receive and transmit queries with other hosts. To do so, our approach monitors the traffic of targets and searches for pairs of inbound/outbound packets which are likely to contain same queries by computing their similarities. Through evaluation experiments with two popular P2P based file sharing software, LimeWire and Winny, we show this approach detects P2P nodes within a few hundreds of seconds with a few false alerts in a week.