Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing (extended)

Genevieve Bartlett, John Heidemann, and Christos Papadopoulos
USC/Information Sciences Institute

Abstract

Blind techniques to detect network applications--approaches that do not consider packet contents--are increasingly desirable because they have fewer legal and privacy concerns, and they can be robust to application changes and intentional cloaking. In this paper we identify several behaviors that are inherent to peer-to-peer (P2P) traffic and demonstrate that they can detect both BitTorrent and Gnutella hosts using only packet header and timing information. We identify three basic behaviors: failed connections, the ratio of incoming and outgoing connections, and the use of unprivileged ports. We show that while individual behaviors are sometimes effective, they work best when used together. We quantify the effectiveness of our approach using two day-long traces, from 2005 and 2006, showing that they are quite accurate: BitTorrent hosts are detected with an 83% true positive rate and only a 2% false positive rate, and Gnutella hosts with a 75% true positive rate and a 4% false postivie rate. Our system is suitable for on-line use, with 75% of BitTorrent hosts detected in less than 10 minutes of trace data.

Availability

This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below.

Reference

Bartlett06a

Genevieve Bartlett, John Heidemann, and Christos Papadopoulos. Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing (extended). Technical Report ISI-TR-2006-627, USC/Information Sciences Institute, December, 2006. <http://www.isi.edu/~johnh/PAPERS/Bartlett06a.html>.

@techreport{Bartlett06a,
	author = "Genevieve Bartlett and John Heidemann and Christos Papadopoulos",
	title = "Inherent Behaviors for On-line Detection of
         Peer-to-Peer File Sharing (extended)",
	institution = "USC/Information Sciences Institute",
	year = "2006",
	number = "ISI-TR-2006-627",
	month = "December",
	url = "http://www.isi.edu/~johnh/PAPERS/Bartlett06a.html",
	pdfurl = "http://www.isi.edu/~johnh/PAPERS/Bartlett06a.pdf",
	myorganization = "USC/Information Sciences Institute",
	copyrightholder = "authors",
}

Copyright

This paper is copyright © 2006 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted.

To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.