Identifying P2P Application with DHT Behaviors

Since, the emergence of peer-to-peer applications, their traffic has gradually become the dominant component on some links, which has a significant impact on the underlying infrastructure, such as internet topology, routing systems and network strategies. It is necessary to make some adjustments in design for future, which first needs accurate identification of P2P traffic. In this study, we focus on the explicit behaviors of Distributed Hash Tables (DHT), which are deployed widely in different P2P applications. Therefore, we develop a systematic methodology to identify P2P hosts in a statistical way, i.e., based on behavior patterns of DHT functions. We analyze four representative behaviors in the view of functions, including bootstrap pattern, routing pattern, diversity pattern and short-session pattern. Actually, it is proved that these behaviors are very different from traditional applications in pattern through a series of detailed experiments. At last a novel algorithm that relies on behavior patterns of DHT is proposed. Our experiment results show that we are able to identify more than 90% of P2P hosts with at least 95% accuracy and also can deal with the silent clients, which figures out the identification in a new aspect.