Identifying P2P applications based on behavioral-signatures

Due to the significant increase of peer-to-peer (P2P) traffic in the past few years, network operators in the ISPs and enter-prise networks want to be able to identify P2P applications and their associated traffic so as to perform a better traffic en-gineering and capacity planning. In this paper, we propose a novel approach to identify P2P applications, as well as pin-pointing a specific P2P software from packet traces based on behavioral signatures. The main advantage of the proposed approach is that we do not need to examine the packet pay-loads, but instead, we only need to check whether a specific periodic signature of a given P2P application is available in the traffic. We provide justifications as to why P2P traffic has some inherent periodic signatures, and show how to ex-tract the signature for a given P2P software. The proposed methodology is effective not only in identifying P2P applica-tions but discovering specific P2P softwares such as BitTor-rent, Emule, (P2P content distribution applications), PPLive and PPStream (P2P video streaming applications),...etc. We apply our approach to real traffic traces and show its effec-tiveness in P2P software identification. 1