P2P流的测量与识别方法研究
|
摘要
P2P(Peer to Peer)是一种新的网络应用模式,其最大特点是P2P网络依靠网络边缘节点,而非中心节点实现自组织和资源共享。近些年来,P2P技术被广泛应用于文件共享、语音服务、流媒体、即时通信等领域。P2P技术在快速发展的同时也给网络管理带来了许多新的问题。如P2P应用消耗了大量带宽,版权纠纷以及安全问题等。P2P采用了动态端口,报文加密等逃避网络监测的技术,这使得传统的端口识别法对P2P流的识别不再有效。因此,研究有效的P2P流识别方法成为P2P流管理的重要课题。
从典型的P2P系统测量,启发式识别方法,未知P2P流发现以及机器学习等四个方面对P2P流的测量和识别方法进行了研究。
BitTorrent是目前广泛使用的混合式P2P系统的典型代表。从BitTorrent协议的主动测量,被动测量以及BitTorrent流的模型化三个方面展开了研究。首先提出了一种BitTorrent系统的主动测量方法,通过在BitTorrent节点中插入消息测量和状态测量模块,采集BitTorrent节点在下载过程中收发的各种消息以及状态变化信息,从协议内部对BitTorrent节点的下载过程进行观察。测量结果表明:BitTorrent节点下载时从群中少数节点获得大量数据,同时也主要向群中极少数节点上传数据,且下载量最多的节点通常也是上载量最多的节点。在被动测量研究中,提出了一种基于应用层特征的BitTorrent流实时测量方法。采用了流匹配测量框架,以流为基本单位进行匹配,设计了一种基于异或运算的哈希算法用于流匹配。利用应用层特征对BitTorrent报文进行识别,准确度较高。建立了测量算法的误报和漏报模型,并分析了特征报文与流长度的关系,提出应重点关注长流的应用层特征。分别提出了BitTorrent流流长和流时间间隔的分布模型。研究表明:BitTorrent流时间间隔可以用Weibull分布描述。BitTorrent流流长可以用Lognormal分布描述。
对启发式P2P流识别方法进行了研究。提出了一种基于多行为特征的P2P主机识别算法。首先在分析P2P节点连接形式,远端地址分布以及端口行为特点的基础上,提取了双向连接率,IP地址随机测度和高端口连接率三种特征,然后通过阈值分类实现P2P流识别。实验表明该算法误报率低。与此同时,提出了一种基于支持向量机的P2P流应用级分类方法,利用支持向量机优良的分类性能,对不同应用类型的P2P流进行了分类。通过对BitTorrent,Emule,PPLive,PPstream 4种P2P流的分类实验,验证了方法的有效性,平均分类准确率为92.2%。
对未知P2P应用的发现进行了研究。首先提出了一种基于多维聚类树的流分析方法(Multi-dimensional Clustering Tree,MCT)。该方法首先对流数据的每一维进行单维聚类,发现单维显著类。然后,构建多维聚类树发现多维显著类。MCT算法能自动挖掘网络中的显著流,描述显著流的多维属性,同时可以反映流量显著的IP子网。在MCT算法的基础上,提出了一种未知P2P流的识别方法。首先,利用P2P流的远端地址分布、双向性和高端口特征,定义了P2P流疑似度指标sp2p,对MCT算法挖掘出来的多维显著流进行P2P流疑似度判别。对高疑似度的P2P流,通过应用层特征匹配方法,去掉已知的P2P流,实现未知P2P流的识别。实验结果表明:MCT算法可以清楚了解网络流量的构成情况,利用sp2p能够有效识别出网络中流量较大的多种P2P应用。
将机器学习方法应用到应用流的识别问题中,提出了一种基于熵函数的串联式特征选择算法。首先利用特征的后验概率分布来衡量特征对分类的有效性,接着采用顺序后退搜索方法,以分类器本身的分类准确率作为评估标准去除冗余特征。采用上述特征选择方法从Andew Moore数据集的249种特征中筛选出了11种分类特征。同时,提出了一种基于半监督聚类的应用流分类方法。首先采用粒子群优化的K均值聚类方法对混合数据进行聚类,然后利用少量标记数据确定簇与应用类型的映射关系,从而实现应用流分类。通过对Andew Moore数据集的实验表明:基于半监督聚类的应用流分类方法有较高的流识别准确率。
P2P (peer-to-peer) is a new model of network application, which is characterized by relying on the edge node of the network, rather than center node to achieve self-organizing and sharing resources. P2P networks are typically used for file sharing, media streaming, instant communication etc. While P2P is in the rapid development in recent years, it also has brought many new problems for network management, such as much bandwidth occupying and network security. Since most of P2P applications are using dynamic random port numbers, data encryption, the traditional port matching technology has become useless for P2P flow identification. Research on P2P flow identification has become the most important problem of P2P flow management.
In this paper, four research areas of P2P flow measurement and identification methods have been deeply studied, including the typical P2P system measurement, heuristic identification method, finding unknown P2P application, as well as machine learning method.
BitTorrent is a recent, yet successful P2P protocol focused on efficient content delivery. To gain a better understanding of BitTorrent protocol, an active measurement system which modified BitTorrent client is designed. This method allows us to get detailed information on all exchanged messages and protocol events. Experimental evaluation showed that the peers from which the local peer download the most are also the peers that receive the most uploaded bytes. In the passive measurement study, a BitTorrent measurement method using application signature is present. The measurement framework included two parts, connection tracking and application-layer signature match. A hash algorithm for connection tracking based on XOR operation is provided. Matching BitTorrent application-layer signature, the method can identify BitTorrent flow accurately. BitTorrent flow length characteristics, and flows inter-arrival characteristics are analyzed. It is found that the BitTorrent flow's inter-arrival distribution follows Weibull distribution, BitTorrent flow's length distribution follows Lognormal distribution.
The heuristic method for identifying P2P application has been studied. BEH algorithm which is a P2P host identification method based on the multiple characteristics is proposed. Firstly, several behaviors that are inherent to P2P flow are explored. These behaviors have been translated to metrics: the ratio of incoming and outgoing connections, remote hosts' IP address entropy and the use of high ports. BEH which combined three individual metric together showed low false positive in experiment. A method to realize the P2P flow classification based on the support vector machine is proposed. Researches had been focused on four kinds of P2P application BitTorrent, Emule, PPLive and PPstream. The experimental results confirm the validity of proposed method, the average precise rate is 92. 2%.
A new flow analysis method called MCT based on multi-dimensional clustering tree is proposed. Firstly, each dimensional of flow data is hierarchical clustered to identify the dominant flows. After mining the significant one-dimensional rules, using multi-dimensional clustering tree, these rules are combined to find significant multi-dimensional rules. An unknown P2P identification method based on MCT is present. According to entropy of IP, IP prefix and the two-way property of P2P flow, metric Sp2p is defined to identify P2P flow. The results show that: by multidimensional flow mining, the composition of current network traffic can be understood clearly. Moreover, the system is able to identify a variety of P2P flow which take up a large proportion of the total traffic.
Machine learning techniques provide a promising method in classifying flows based on application protocol. A two-phase combined feature selection algorithm called ESBS is designed. In the first phase, a entropy method is used to filter the irrelevant features. In the second phase, backward sequential search algorithm is used to remove the redundant features with the performance of the induction algorithm. Using ESBS, 11 features have been selected from 249 features of Andew Moore datasets. A semi-supervised clustering method called PSOSC for the flow classification of application is proposed. Firstly, a novel Kmeans clustering algorithm based on Particle Swarm Optimization for a few labeled and many unlabeled flows had been present. Then, using a few labeled flows, clusters were mapped application. Experimental evaluation by Andew Moore datasets showed that high flow classification accuracy can be achieved.
从典型的P2P系统测量,启发式识别方法,未知P2P流发现以及机器学习等四个方面对P2P流的测量和识别方法进行了研究。
BitTorrent是目前广泛使用的混合式P2P系统的典型代表。从BitTorrent协议的主动测量,被动测量以及BitTorrent流的模型化三个方面展开了研究。首先提出了一种BitTorrent系统的主动测量方法,通过在BitTorrent节点中插入消息测量和状态测量模块,采集BitTorrent节点在下载过程中收发的各种消息以及状态变化信息,从协议内部对BitTorrent节点的下载过程进行观察。测量结果表明:BitTorrent节点下载时从群中少数节点获得大量数据,同时也主要向群中极少数节点上传数据,且下载量最多的节点通常也是上载量最多的节点。在被动测量研究中,提出了一种基于应用层特征的BitTorrent流实时测量方法。采用了流匹配测量框架,以流为基本单位进行匹配,设计了一种基于异或运算的哈希算法用于流匹配。利用应用层特征对BitTorrent报文进行识别,准确度较高。建立了测量算法的误报和漏报模型,并分析了特征报文与流长度的关系,提出应重点关注长流的应用层特征。分别提出了BitTorrent流流长和流时间间隔的分布模型。研究表明:BitTorrent流时间间隔可以用Weibull分布描述。BitTorrent流流长可以用Lognormal分布描述。
对启发式P2P流识别方法进行了研究。提出了一种基于多行为特征的P2P主机识别算法。首先在分析P2P节点连接形式,远端地址分布以及端口行为特点的基础上,提取了双向连接率,IP地址随机测度和高端口连接率三种特征,然后通过阈值分类实现P2P流识别。实验表明该算法误报率低。与此同时,提出了一种基于支持向量机的P2P流应用级分类方法,利用支持向量机优良的分类性能,对不同应用类型的P2P流进行了分类。通过对BitTorrent,Emule,PPLive,PPstream 4种P2P流的分类实验,验证了方法的有效性,平均分类准确率为92.2%。
对未知P2P应用的发现进行了研究。首先提出了一种基于多维聚类树的流分析方法(Multi-dimensional Clustering Tree,MCT)。该方法首先对流数据的每一维进行单维聚类,发现单维显著类。然后,构建多维聚类树发现多维显著类。MCT算法能自动挖掘网络中的显著流,描述显著流的多维属性,同时可以反映流量显著的IP子网。在MCT算法的基础上,提出了一种未知P2P流的识别方法。首先,利用P2P流的远端地址分布、双向性和高端口特征,定义了P2P流疑似度指标sp2p,对MCT算法挖掘出来的多维显著流进行P2P流疑似度判别。对高疑似度的P2P流,通过应用层特征匹配方法,去掉已知的P2P流,实现未知P2P流的识别。实验结果表明:MCT算法可以清楚了解网络流量的构成情况,利用sp2p能够有效识别出网络中流量较大的多种P2P应用。
将机器学习方法应用到应用流的识别问题中,提出了一种基于熵函数的串联式特征选择算法。首先利用特征的后验概率分布来衡量特征对分类的有效性,接着采用顺序后退搜索方法,以分类器本身的分类准确率作为评估标准去除冗余特征。采用上述特征选择方法从Andew Moore数据集的249种特征中筛选出了11种分类特征。同时,提出了一种基于半监督聚类的应用流分类方法。首先采用粒子群优化的K均值聚类方法对混合数据进行聚类,然后利用少量标记数据确定簇与应用类型的映射关系,从而实现应用流分类。通过对Andew Moore数据集的实验表明:基于半监督聚类的应用流分类方法有较高的流识别准确率。
P2P (peer-to-peer) is a new model of network application, which is characterized by relying on the edge node of the network, rather than center node to achieve self-organizing and sharing resources. P2P networks are typically used for file sharing, media streaming, instant communication etc. While P2P is in the rapid development in recent years, it also has brought many new problems for network management, such as much bandwidth occupying and network security. Since most of P2P applications are using dynamic random port numbers, data encryption, the traditional port matching technology has become useless for P2P flow identification. Research on P2P flow identification has become the most important problem of P2P flow management.
In this paper, four research areas of P2P flow measurement and identification methods have been deeply studied, including the typical P2P system measurement, heuristic identification method, finding unknown P2P application, as well as machine learning method.
BitTorrent is a recent, yet successful P2P protocol focused on efficient content delivery. To gain a better understanding of BitTorrent protocol, an active measurement system which modified BitTorrent client is designed. This method allows us to get detailed information on all exchanged messages and protocol events. Experimental evaluation showed that the peers from which the local peer download the most are also the peers that receive the most uploaded bytes. In the passive measurement study, a BitTorrent measurement method using application signature is present. The measurement framework included two parts, connection tracking and application-layer signature match. A hash algorithm for connection tracking based on XOR operation is provided. Matching BitTorrent application-layer signature, the method can identify BitTorrent flow accurately. BitTorrent flow length characteristics, and flows inter-arrival characteristics are analyzed. It is found that the BitTorrent flow's inter-arrival distribution follows Weibull distribution, BitTorrent flow's length distribution follows Lognormal distribution.
The heuristic method for identifying P2P application has been studied. BEH algorithm which is a P2P host identification method based on the multiple characteristics is proposed. Firstly, several behaviors that are inherent to P2P flow are explored. These behaviors have been translated to metrics: the ratio of incoming and outgoing connections, remote hosts' IP address entropy and the use of high ports. BEH which combined three individual metric together showed low false positive in experiment. A method to realize the P2P flow classification based on the support vector machine is proposed. Researches had been focused on four kinds of P2P application BitTorrent, Emule, PPLive and PPstream. The experimental results confirm the validity of proposed method, the average precise rate is 92. 2%.
A new flow analysis method called MCT based on multi-dimensional clustering tree is proposed. Firstly, each dimensional of flow data is hierarchical clustered to identify the dominant flows. After mining the significant one-dimensional rules, using multi-dimensional clustering tree, these rules are combined to find significant multi-dimensional rules. An unknown P2P identification method based on MCT is present. According to entropy of IP, IP prefix and the two-way property of P2P flow, metric Sp2p is defined to identify P2P flow. The results show that: by multidimensional flow mining, the composition of current network traffic can be understood clearly. Moreover, the system is able to identify a variety of P2P flow which take up a large proportion of the total traffic.
Machine learning techniques provide a promising method in classifying flows based on application protocol. A two-phase combined feature selection algorithm called ESBS is designed. In the first phase, a entropy method is used to filter the irrelevant features. In the second phase, backward sequential search algorithm is used to remove the redundant features with the performance of the induction algorithm. Using ESBS, 11 features have been selected from 249 features of Andew Moore datasets. A semi-supervised clustering method called PSOSC for the flow classification of application is proposed. Firstly, a novel Kmeans clustering algorithm based on Particle Swarm Optimization for a few labeled and many unlabeled flows had been present. Then, using a few labeled flows, clusters were mapped application. Experimental evaluation by Andew Moore datasets showed that high flow classification accuracy can be achieved.
引文
[1] Foster I., lamnitchi A. On death, taxes, and the convergence of peer-to-peer and grid computing. in Peer-to-Peer Systems II. Second International Workshop, IPTPS 2003. Berkeley, CA, USA: Springer-Verlag, 2003. 118-128
[2] A. Parker. The true picture of peer-to-peer filesharing. http: //www. cachelogic. com/, 2004
[3] Chuanfu C, Congjing R., Qiong T., et al. Application of law of copyright disputes of P2P file-sharing technology. in 2008 Fourth International Conference on Networked Computing and Advanced Information Management Gyeongju, South Korea: IEEE, 2008. 232-237
[4] Ratnasamy S., Francis P., Handley M., et al. A scalable content-addressable network. in Computer Communication Review. San Diego, CA, USA: ACM, 2001. 161-72
[5] Zhao B. Y., Ling H., Stribling J., et al. Tapestry: a resilient global-scale overlay for service deployment. IEEE Journal on Selected Areas in Communications, 2004, 22(1): 41-53
[6] Stoica I., Morris R., Liben-Nowell D., et al. Chord: a scalable peer-to-peer lookup protocol for Internet applications. IEEE/ACM Transactions on Networking, 2003, 11(1): 17-32
[7] Herbert A. What happened to Pastry. Operating Systems Review, 2007, 41 (2): 10-16
[8] Kwok S. H., Chan K. Y. An enhanced Gnutella P2P protocol: a search perspective. in 18th International Conference on Advanced Information Networking and Applications. Fukuoka, Japan: IEEE Comput. Soc, 2004. 599-604
[9] Leibowitz N., Ripeanu M., Wierzbicki A. Deconstructing the Kazaa network. in Proceedings the Third IEEE Workshop on Internet Applications. San Jose, CA, USA: IEEE Comput. Soc, 2003. 112-120
[10] Saroiu S., Gummandi K. P., Gribble S. D. Measuring and analyzing the characteristics of Napster and Gnutella hosts. Multimedia Systems, 2003, 9(2): 170-184
[11] Kalafut A., Acharya A., Gupta M. A study of malware in peer-to-peer networks. in Proceedings of the ACM SIGCOMM Internet Measurement Conference. Rio de Janeriro, Brazil: Association for Computing Machinery, United States, 2006. 327-332
[12] Madhukar A. Williamson C. A Longitudinal Study of P2P Traffic Classification. in Modeling, Analysis, and Simulation of Computer and Telecommunication Systems. Monterey, California: IEEE, 2006. 179-188
[13] Sen S., Jia W. Analyzing peer-to-peer traffic across large networks. IEEE/ACM Transactions on Networking, 2004, 12(2): 219-232
[14] Plissonneau L., Costeux J. L., Brown P. Analysis of peer-to-peer traffic on ADSL. in 6th International Workshop on Passive and Active Network Measurement. Boston, MA, United States: Springer Verlag, Heidelberg, Germany, 2005. 69-82
[15] IPP2P. 2006. http: //www. ipp2p. org
[16] Strait M. Application Layer Packet Classifier for Linux. 2006. http: //17-filter. sourceforge. net
[17] Sen S., Spatscheck O., Wang D. Accurate, scalable in-network identification of P2P traffic using application signatures. in Thirteenth International World Wide Web Conference Proceedings. New York, NY, United States: Association for Computing Machinery, United States, 2004. 512-521
[18] Spognardi A., Lucarelli A., Di Pietro R. A methodology for P2P file-sharing traffic detection. in Second International Workshop on Hot Topics in Peer-to-Peer Systems. San Diego, CA, United States: Institute of Electrical and Electronics Engineers Computer Society, United States, 2005. 52-61
[19] Karagiannis T., Broido A., Brownlee N., et al. Is P2P dying or just hiding? in IEEE Global Telecommunications Conference. Dallas, TX, United States: Institute of Electrical and Electronics Engineers Inc, United States, 2004. 1532-1538
[20] Bleuil H., Rathgeb E. P., Zilling S. Evaluation of an efficient measurement concept for P2P multiprotocol traffic analysis. in Proceedings - 32nd Euromicro Conference on Software Engineering and Advanced Applications. Cavtat/Dubrovnik, Croatia: Institute of Electrical and Electronics Engineers Computer Society, United States, 2006.414-421
[21] Bleul H., Rathgeb E. P. A simple, efficient and flexible approach to measure multi-protocol peer-to-peer traffic. in 4th International Conference on Networking. Reunion Island, France: Springer Verlag, Heidelberg, Germany, 2005. 606-616
[22] Bleul H., Rathgeb E. P., Zilling S. Advanced P2P multiprotocol traffic analysis based on application level signature detection. in 12th International Telecommunications Network Strategy and Planning Symposium. New Delhi, India: Institute of Electrical and Electronics Engineers Inc. United States, 2007. 408-418
[23]Constantinou F.,Mavrommatis P.Identifying Known and Unknown Peer-to-Peer Traffic.in 5th IEEE International Symposium on Network Computing and Applications.Cambridge,MA,USA:IEEE Comput.Soc,USA,2006.93-102
[24]Karagiarmis T.,Broido A.,Faloutsos M.,et al.Transport layer identification of P2P traffic,in Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference.Taormina,Italy:Association for Computing Machinery,United States,2004.121-134
[25]Mong-Fong H.,Chun-Wei C.,Chin-Shun C.,et al.Identification and Analysis of P2P Traffic- An Example of BitTorrent.in First International Conference on Innovative Computing,Information and Control.Beijing,China:IEEE,2006.266-269
[26]DedinskiI I.,H D.M.,L H.,et al.Cross-Layer Peer-to-Peer Traffic Identification and Optimization Based on Active Networking.in the Seventh Annual International Working Conference on Active and Programmable Networks.French Riviera:IEEE,2005.111-121
[27]杨岳湘,王锐,唐川.基于双重特征的P2P流量检测方法.通信学报,2006,27(11A):135-138
[28]Suh K.,Figueiredo D.R.,Kurose J.,et al.Characterizing and detecting Skype-relayed traffic,in 25th IEEE International Conference on Computer Communications.Barcelona,Spain:Institute of Electrical and Electronics Engineers Inc.United States,2006.414-420
[29]Saroiu S.,Gummadi P.K.,Gribble S.D.A measurement study of peer-to-peer file sharing systems,in Proceedings of SPIE-The International Society for Optical Engineering.San Jose,CA,United States:International Society for Optical Engineering,Bellingham WA,WA 98227-0010,United States,2002.156-170
[30]Liang J.,Kumar R.,Ross K.The KaZaA overlay:A measurement study,in the 19th IEEE Annual Computer Communications Workshop.Florida:IEEE,2004.980-986
[31]Wang J.,Hamadeh L.,Kesidis G.,et al.Polymorphic worm detection and defense:System design,experimental methodology,and data resources,in Proceedings of the 2006 SIGCOMM Workshop on Large-scale Attack Defense.Pisa,Italy:Association for Computing Machinery,United States,2006.169-176
[32]Wang J.,Miller D.J.,Kesidis G.Efficient Mining of the Multidimensional Traffic Cluster Hierarchy for Digesting,Visualization,and Anomaly Identification.IEEE Journal on Selected Areas in Communications,2006,24(10):1929-1941
[33]杜阿宁,程晓明.网络流量分析中的频繁项监测技术研究.通信学报,2006,27(2):48-53
[34]Vitter J.S.Random sampling with a reservoir.ACM Transactions on Mathematical Software,1985,11(1):37-57
[35]Krishnamurthy B.,Sen S.,Zhang Y.,et al.Sketch-based change detection:Methods,evaluation,and applications,in Proceedings of the ACM SIGCOMM Internet Measurement Conference.Miami Beach,FL,United States:Association for Computing Machinery,United States,2003.234-247
[36]Demaine E.D.,Lopez-Ortiz A.,Munro J.I.Frequency estimation of Internet packet streams with limited space,in Algorithms-ESA 2002.10th Annual European Symposium.Rome,Italy:Springer-Verlag,2002.348-360
[37]Fullmer M.,Romig S.The OSU flow-tools package and Cisco NetFlow logs.in Proceedings of the Fourteenth Systems Administration Conference New Orleans,LA,USA:USENIX Assoc,2000.291-303
[38]杨嵘,张国清,韦卫等.基于NetFlow流量分析的网络攻击行为发现.计算机工程,2005,31(13):137-141
[39]Plonka D.FlowScan:a network traffic flow reporting and visualization tool.in Proceedings of the Fourteenth Systems Administration Conference.New Orleans,LA,USA:USENIX Assoc,2000.305-317
[40]Estan C.,Savage S.,Varghese G.Automatically Inferring Patterns of Resource Consumption in Network Traffic.in Computer Communication Review.Karlsruhe,Germany:Association for Computing Machinery,United States,2003.137-148
[41]Mahmood A.N.,Leckie C.,Udaya P.Echidna:Efficient clustering of hierarchical data for network traffic analysis,in 5th International IFIP-TC6 Networking Conference.Coimbra,Portugal:Springer Verlag,Heidelberg,Germany,2006.1092-1098
[42]Gupta R,McKeown N.Packet classification on multiple fields.Computer Communication Review,1999,29(4):147-160
[43]Estan C.,Varghese G.New directions in traffic measurement and accounting:focusing on the elephants,ignoring the mice.ACM Transactions on Computer Systems,2003,21(3):270-313
[44]Duffield N.,Lund C.,Thorup M.Charging from sampled network usage,in Proceedings of the First ACM SIGCOMM Internet Measurement Workshop.San Francisco,CA,USA:ACM,2001.245-256
[45]Agrawal R.,Imielinski T.,Swami A.Mining association rules between sets of items in large databases,in Proceedings of the 1993 ACM SIGMOD International Conference on Management of Data.Washington,DC,USA:ACM,1993.207-216
[46]Kumar A.,Minho S.,Jun X.,et al.Data streaming algorithms for efficient and accurate estimation of flow size distribution,in Performance Evaluation,New York,NY,USA:ACM,2004.177-188
[47]Cormode G.,Muthukfishnan S.What's new:finding significant differences in network data streams.IEEE/ACM Transactions on Networking,2005,13(6):1219-1232
[48]Xu K.,Zhang Z.L.,Bhattacharyya S.Profiling Internet backbone traffic:behavior models and applications.Computer Communication Review,2005,35(4):169-180
[49]Cormode G.,Korn F.,Muthukrishnan S.,et al.Finding hierarchical heavy hitters in streaming data.ACM Transactions on Knowledge Discovery from Data,2008,1(4):16-23
[50]冯文峰,郭巧,吴素妍.基于多层概要结构的数据流的频繁项集发现算法.北京理工大学学报,2006,26(6):512-516
[51]Erman J.,Mahanti A.,Arlitt M.,et al.Offiine/realtime traffic classification using semi-supervised learning.Performance Evaluation,2007,64(9-12):1194-1213
[52]Moore A.W.,Zuev D.Internet traffic classification using bayesian analysis techniques,in Performance Evaluation Review.Banff,AB,Canada:Association for Computing Machinery,United States,2005.50-60
[53]Moore A.W.,Zuev D.Discriminators for use in flow-based classification,in Technical Report RR-05-13:Department of Computer Science,Queen Mary,University of London,2005
[54]Williams N.,Zander S.,Armitage G.A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification.Computer Communication Review,2006,36(5):7-15
[55]Nguyen T.T.T.,Armitage G.Training on multiple sub-flows to optimise the use of machine learning classifiers in real-world IP networks,in 31st IEEE Conference on Local Computer Networks Tampa,FL,USA:IEEE,2006.369-376
[56]Roughan M.,Sen S.,Spatscheck O.,et al.Class-of-Service mapping for QoS:A statistical signature-based approach to IP traffic classification,in Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference.Taormina,Italy: Association for Computing Machinery, United States, 2004. 135-148
[57] McGregor A., Hall M., Lorier P., et al. Flow clustering using machine learning techniques. in 5th International Workshop on Passive and Active Network Measurement. Antibes Juan-les-Pins, France: Springer-Verlag, 2004. 205-214
[58] Zander S., Nguyen T., Armitage G. Automated traffic classification and application identification using machine learning. in The IEEE Conference on Local Computer Networks-30th Anniversary. Sydney, NSW, Australia: IEEE, 2006. 250-257
[59] Liu H., Feng W., Huang Y., et al. A peer-to-peer traffic identification method using machine learning. in 2007 International Conference on Networking, Architecture, and Storage. Guilin, China: IEEE, 2007. 155-160
[60] Erman J., Mahanti A., Arlitt M. Internet Traffic Identification using Machine Learning. in 2006 Global Telecommunications Conference San Francisco, CA, United States: Institute of Electrical and Electronics Engineers Inc, 2006. 415-420
[61] Erman J., Arlitt M., Mahanti A. Traffic classification using clustering algorithms. in Proceedings of the 2006 SIGCOMM Workshop on Mining Network Data. Pisa, Italy: Association for Computing Machinery, United States, 2006. 281-286
[62] Bernaille L., Teixeira R., Akodkenou I., et al. Traffic classification on the fly. Computer Communication Review, 2006, 36(2): 23-26
[63] Bernaille L., Teixeira R. Early recognition of encrypted applications. in 8th International Conference on Passive and Active Network Measurement. Louvain-la-Neuve, Belgium: Springer, 2007. 165-175
[64] Bin L., Zhitang L., Hao T. A measurement study of peer-to-peer applications. in Proceedings of SPIE . The International Society for Optical Engineering. Wuhan, China: SPIE, Bellingham WA, WA 98227-0010, United States, 2007. 679-683
[65] Liu B., Li Z., Li Y., et al. Design and implementation of an Intrusion Detection System based on IPv6 protocol. in Proceedings of SPIE - The International Society for Optical Engineering. Wuhan, China: International Society for Optical Engineering, Bellingham WA, WA 98227-0010, United States, 2005. 598-602
[66] Liu B., Li Z., Li Z. A scalable intrusion detection system for IPv6. Wuhan University Journal of Natural Sciences, 2006, 11(6): 1723-1726
[67] Liu B., Li Z., Li Z. Traffic measurements of BitTorrent system based on Netfilter. in 2006 International Conference on Computational Intelligence and Security Guangzhou, China: IEEE, 2006. 768-772
[68] Zhou L., Li Z., Hao T. Proposition and provement of A TCP feature of P2P traffic- An example of BitTorrent and emule,in Proceedings of the Second International Conference on Communications and Networking in China.Shanghai,China:Institute of Electrical and Electronics Engineers Inc.,Piscataway,NJ 08855-1331,United States,2008.61-65
[69]Zhou L.,Li Z.,Liu B.P2P traffic identification by TCP flow analysis,in 2006International Workshop on Networking,Architecture,and Storage.Shenyang,China:IEEE Comput.Soc,2006.65-66
[70]Zhou L.,Li Z.,Tu H.Proposion and analysis of a TCP feature of P2P traffic,in Advances in Knowledge Discovery and Data Mining.11th Pacific-Asia Conference.Nanjing,China:Springer Verlag,Heidelberg,Germany,2007.1148-1155
[71]柳斌,李之棠,李佳.一种基于流特征的P2P流量实时识别方法.厦门大学学报(自然科学版),2007,46(s2):126-129
[72]柳斌,李之棠,李站春等.一种基于Netfilter的Bittorrent流量测量方法.计算机科学,2007,4(3):38-41
[73]Zuev D.,Moore A.W.Traffic classification using a statistical approach,in Passive and Active Network Measurement.6th International Workshop.Boston,MA,USA:Springer-Verlag,2005.321-324
[74]IANA.2008.http://www.iana.org/assignments/port-numbers
[75]Bartlett G.,Heidemann J.,Papadopoulos C.Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing.in Proceedings of the 10th IEEE Global Internet.Anchorage,Alaska,USA:IEEE,2007.55-60
[76]Karagiannis T.,Papagiannaki K.,Faloutsos M.BLINC:Multilevel traffic classification in the dark.Computer Communication Review,2005,35(4):229-240
[77]Matsuda T.,Nakamura F.,Wakahara Y.,et al.Traffic features fit for P2P discrimination,in 6th Asia-Pacific Symposium on Information and Telecommunication Technologies.Yangon,Myanmar:Institute of Electrical and Electronics Engineers Computer Society,United States,2005.230-235
[78]Jun L.,Shunyi Z.,Yanqing L.,et al.Internet traffic classification using machine learning,in Proceedings of the Second International Conference on Communications and Networking in China.Shanghai,China:Institute of Electrical and Electronics Engineers Inc.United States,2008.239-243
[79]Auld T.,Moore A.W.,Gull S.F.Bayesian neural networks for Internet traffic classification.IEEE Transactions on Neural Networks,2007,18(1):223-239
[80] Siqueira Jr G. P., Maia J. E. B., Holanda R., et al. P2P traffic identification using cluster analysis. in 2007 1st International Global Information Infrastructure Symposium. Marrakech, Morocco: Institute of Electrical and Electronics Engineers Computer Society, United States, 2007. 128-133
[81] Soysal M, Schmidt E. G. An accurate evaluation of machine learning algorithms for flow-based P2P traffic detection. in 22nd International Symposium on Computer and Information Sciences. Ankara, Turkey: Institute of Electrical and Electronics Engineers Computer Society, United States, 2007. 393-398
[82] Dietterich T., Kearns M, Mansour Y. Applying the weak learning framework to understand and improve C4. 5. in Proceedings of the Thirteenth International Conference on Machine Learning. Bari, Italy: Morgan Kaufmann Publishers, 1996. 96-104
[83] 陈安, 陈宁. 数据挖掘技术及应用.北京: 科学出版社, 2006. 163-165
[84] B. Cohen. Incentives Build Robustness in BitTorrent. in P2P Economics Workshop. Berkeley, California 2003
[85] Xiangying Y., Veciana G. Service capacity of peer to peer networks. in IEEE INFOCOM 2004. Hong Kong, China: IEEE, 2004. 2242-2252
[86] Qiu D., Srikant R. Modeling and performance analysis of bittorrent-like peer-to-peer networks. in Computer Communication Review. Portland, OR, USA: ACM, 2004. 367-377
[87] Bharambe A. R., Herley C, Padmanabhan V. N. Analyzing and improving a BitTorrent network's performance mechanisms. in 25th IEEE INFOCOM Conference. Barcelona, Spain: IEEE, 2006. 2884-2895
[88] Izal M., Urvoy-Keller G., Biersack E. W., et al. Dissecting BitTorrent: five months in a torrent's lifetime. in 5th International Workshop on Passive and Active Network Measurement. Antibes Juan-les-Pins, France: Springer-Verlag, 2004. 1-11
[89] Bindal R., Pei C, Chan W., et al. Improving Traffic Locality in BitTorrent via Biased Neighbor Selection. in 26th IEEE International Conference on Distributed Computing Systems. Lisboa, Portugal: Institute of Electrical and Electronics Engineers Inc, 2006. 66-72
[90] Pouwelse J., Garbacki P., Epema D., et al. The BitTorrent p2p file-sharing system: measurements and analysis. in Peer-to-Peer Systems IV. 4th International Workshop. Ithaca, NY, USA: Springer-Verlag, 2005. 205-216
[91] Guo L., Chen S., Xiao Z., et al. A performance study of BitTorrent-like peer-to-peer systems.IEEE Journal on Selected Areas in Communications,2007,25(1):155-169
[92]Xiaojun H.,Chao L.,Jian L.,et al.A measurement study of a large-scale P2P IPTV system.IEEE Transactions on Multimedia,2007,9(8):1672-1687
[93]Cheng W.Q.,Gong J.,Ding W.Identifying BT-like P2P traffic by the discreteness of remote hosts,in Proceedings-Conference on Local Computer Networks.Dublin,Ireland:IEEE Computer Society,United States,2007.237-238
[94]YuHong.Ctorrent.2004.http://sourceforge.net/projects/dtorrent/
[95]郭振滨,裘正定.应用于高速网络的基于报文采样和应用签名的BitTorrent流量识别算法.计算机研究与发展,2008,45(2):227-236
[96]Zhiruo C.,Zheng W.,Zegura E.Performance of hashing-based schemes for Intemet load balancing,in IEEE INFOCOM 2000.Tel Aviv,Israel:IEEE,Piscataway,NJ,USA,2000.332-341
[97]Thompson K.,Miller G.J.,Wilder R.Wide-area Internet traffic patterns and characteristics.Network,IEEE,1997,11(6):10-23
[98]Mellia M.,Zhang H.TCP model for short lived flows.Communications Letters,IEEE,2002,6(2):85-87
[99]He G.,Hou J.,Chen W.P.,et al.One size does not fit all:A detailed analysis and modeling of P2P traffic,in IEEE Global Telecommunications Conference.Washington,DC,United States:Institute of Electrical and Electronics Engineers Inc,United States,2007.393-398
[100]Downey A.B.Evidence for long-tailed distributions in the Intemet.in Proceedings of the First ACM SIGCOMM Internet Measurement Workshop.San Francisco,CA,USA:ACM,2001.229-241
[101]Downey A.B.Lognormal and Pareto distributions in the Internet.Computer Communications,2005,28(7):790-801
[102]Fan S.,Maosong S.A new transductive support vector machine approach to text categorization,in Proceedings of the 12th IEEE International Conference on Natural Language Processing and Knowledge Engineering.Wuhan,China:IEEE,2005.631-636
[103]Tin-Yau Kwok J.Support vector mixture for classification and regression problems.in Fourteenth International Conference on Pattern Recognition.Brisbane,Qld.,Australia IEEE Comput.Soc,Los Alamitos,CA,USA 1998.255-258
[104]Chu-Hsing L.,Jung-Chun L.,Chia-Han H.Anomaly Detection Using LibSVM Training Tools.in 2nd International Conference on Information Security and Assurance. Busan, South Korea Institute of Electrical and Electronics Engineers Computer Society, 2008. 166-171
[105] Lingras P., Butz C. J. Reducing the storage requirements of 1-v-1 support vector machine multi-classifiers. in Proceedings of SPIE - The International Society for Optical Engineering. San Jose, CA, United States: International Society for Optical Engineering, United States, 2006. 166-173
[106] Anguita D., Ridella S., Rivieccio F. K-fold generalization capability assessment for support vector classifiers. in Proceedings of the International Joint Conference on Neural Networks. Montreal, QC, Canada: Institute of Electrical and Electronics Engineers Inc, United States, 2005. 855-858
[107] Xinyan Z., Jiangchuan L., Bo L., et al. CoolStreaming/DONet: a data-driven overlay network for peer-to-peer live media streaming. in Proceedings IEEE Infocom 2005. Miami, FL, USA: IEEE, 2005. 2102-2111
[108] Xiaofei L., Hai J., Yuahao L., et al. AnySee: peer-to-peer live streaming. in 25th IEEE INFOCOM Conference. Barcelona, Spain: IEEE, 2006. 2411-2431
[109] Drake P. Using SNMP to manage networks. in IEE Colloquium on Designing Resilient Architectures. London, UK: IEE, 1991. 1-4
[110] Schonwalder J., Pras A., Harvan M., et al. SNMP Traffic Analysis: Approaches, Tools, and First Results. in 10th IFIP/IEEE International Symposium on Integrated Network Management 2007. Munich, Germany Institute of Electrical and Electronics Engineers Computer Society 2007. 323-332
[111] Estan C, Keys K., Moore D., et al. Building a better netflow. in Comput. Commun. Rev. (USA). Portland, OR, USA: ACM, 2004. 245-256
[112] 钟珞. 模式识别. 武汉: 武汉大学出版社, 2006. 128-130
[113] Cover T. M. The best two independent measurements are not the two best. IEEE Transactions on Systems, Man and Cybernetics, 1974, SMC-4(1): 116-117
[114] John G. H., Kohavi R., Pfleger K. Irrelevant Features and the Subset Selection Problem. in International Conference on Machine Learning. New Brunswick, NJ, USA: ACM, 1994. 121-129
[115] Liu H., Dougherty E. R., Dy J. G. Evolving feature selection. IEEE Intelligent Systems, 2005, 20(6): 64-76
[116] Liu H., Motoda K., Dash M. A monotonic measure for optimal feature selection. in 10th European Conference on Machine Learning. Chemnitz, Germany: Springer-Verlag, 1998. 101-106
[117]Jain A.,Zongker D.Feature selection:evaluation,application,and small sample performance.Pattern Analysis and Machine Intelligence,IEEE Transactions on,1997,19(2):153-158
[118]Siedlecki W.,Sklansky J.A note on genetic algorithms for large-scale feature selection.Pattern Recognition Letters,1989,10(5):335-347
[119]Liu H.,Setiono R.A probabilistic approach to feature selection-a filter solution,in Machine Learning.Proceedings of the Thirteenth International Conference.Bad,Italy:Morgan Kaufmann Publishers,1996.319-327
[120]Ostermann S.Tcptrace.2006.http://www.tcptrace.org
[121]Eberhart R.,Kennedy J.A new optimizer using particle swarm theory,in Proceedings of the Sixth International Symposium on Micro Machine and Human Science.Nagoya,Japan:IEEE,1995.39-43
[122]Zhang Q.,Li X.,Quang-Ahn T.A modified particle swarm optimization algorithm.in Proceedings of 2005 International Conference on Machine Learning and Cybernetics Guangzhou,China:IEEE,2005.2993-2995
[123]杨淑莹.模式识别与智能计算.Matlab技术实现.北京:电子工业出版社,2008.337-345
[2] A. Parker. The true picture of peer-to-peer filesharing. http: //www. cachelogic. com/, 2004
[3] Chuanfu C, Congjing R., Qiong T., et al. Application of law of copyright disputes of P2P file-sharing technology. in 2008 Fourth International Conference on Networked Computing and Advanced Information Management Gyeongju, South Korea: IEEE, 2008. 232-237
[4] Ratnasamy S., Francis P., Handley M., et al. A scalable content-addressable network. in Computer Communication Review. San Diego, CA, USA: ACM, 2001. 161-72
[5] Zhao B. Y., Ling H., Stribling J., et al. Tapestry: a resilient global-scale overlay for service deployment. IEEE Journal on Selected Areas in Communications, 2004, 22(1): 41-53
[6] Stoica I., Morris R., Liben-Nowell D., et al. Chord: a scalable peer-to-peer lookup protocol for Internet applications. IEEE/ACM Transactions on Networking, 2003, 11(1): 17-32
[7] Herbert A. What happened to Pastry. Operating Systems Review, 2007, 41 (2): 10-16
[8] Kwok S. H., Chan K. Y. An enhanced Gnutella P2P protocol: a search perspective. in 18th International Conference on Advanced Information Networking and Applications. Fukuoka, Japan: IEEE Comput. Soc, 2004. 599-604
[9] Leibowitz N., Ripeanu M., Wierzbicki A. Deconstructing the Kazaa network. in Proceedings the Third IEEE Workshop on Internet Applications. San Jose, CA, USA: IEEE Comput. Soc, 2003. 112-120
[10] Saroiu S., Gummandi K. P., Gribble S. D. Measuring and analyzing the characteristics of Napster and Gnutella hosts. Multimedia Systems, 2003, 9(2): 170-184
[11] Kalafut A., Acharya A., Gupta M. A study of malware in peer-to-peer networks. in Proceedings of the ACM SIGCOMM Internet Measurement Conference. Rio de Janeriro, Brazil: Association for Computing Machinery, United States, 2006. 327-332
[12] Madhukar A. Williamson C. A Longitudinal Study of P2P Traffic Classification. in Modeling, Analysis, and Simulation of Computer and Telecommunication Systems. Monterey, California: IEEE, 2006. 179-188
[13] Sen S., Jia W. Analyzing peer-to-peer traffic across large networks. IEEE/ACM Transactions on Networking, 2004, 12(2): 219-232
[14] Plissonneau L., Costeux J. L., Brown P. Analysis of peer-to-peer traffic on ADSL. in 6th International Workshop on Passive and Active Network Measurement. Boston, MA, United States: Springer Verlag, Heidelberg, Germany, 2005. 69-82
[15] IPP2P. 2006. http: //www. ipp2p. org
[16] Strait M. Application Layer Packet Classifier for Linux. 2006. http: //17-filter. sourceforge. net
[17] Sen S., Spatscheck O., Wang D. Accurate, scalable in-network identification of P2P traffic using application signatures. in Thirteenth International World Wide Web Conference Proceedings. New York, NY, United States: Association for Computing Machinery, United States, 2004. 512-521
[18] Spognardi A., Lucarelli A., Di Pietro R. A methodology for P2P file-sharing traffic detection. in Second International Workshop on Hot Topics in Peer-to-Peer Systems. San Diego, CA, United States: Institute of Electrical and Electronics Engineers Computer Society, United States, 2005. 52-61
[19] Karagiannis T., Broido A., Brownlee N., et al. Is P2P dying or just hiding? in IEEE Global Telecommunications Conference. Dallas, TX, United States: Institute of Electrical and Electronics Engineers Inc, United States, 2004. 1532-1538
[20] Bleuil H., Rathgeb E. P., Zilling S. Evaluation of an efficient measurement concept for P2P multiprotocol traffic analysis. in Proceedings - 32nd Euromicro Conference on Software Engineering and Advanced Applications. Cavtat/Dubrovnik, Croatia: Institute of Electrical and Electronics Engineers Computer Society, United States, 2006.414-421
[21] Bleul H., Rathgeb E. P. A simple, efficient and flexible approach to measure multi-protocol peer-to-peer traffic. in 4th International Conference on Networking. Reunion Island, France: Springer Verlag, Heidelberg, Germany, 2005. 606-616
[22] Bleul H., Rathgeb E. P., Zilling S. Advanced P2P multiprotocol traffic analysis based on application level signature detection. in 12th International Telecommunications Network Strategy and Planning Symposium. New Delhi, India: Institute of Electrical and Electronics Engineers Inc. United States, 2007. 408-418
[23]Constantinou F.,Mavrommatis P.Identifying Known and Unknown Peer-to-Peer Traffic.in 5th IEEE International Symposium on Network Computing and Applications.Cambridge,MA,USA:IEEE Comput.Soc,USA,2006.93-102
[24]Karagiarmis T.,Broido A.,Faloutsos M.,et al.Transport layer identification of P2P traffic,in Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference.Taormina,Italy:Association for Computing Machinery,United States,2004.121-134
[25]Mong-Fong H.,Chun-Wei C.,Chin-Shun C.,et al.Identification and Analysis of P2P Traffic- An Example of BitTorrent.in First International Conference on Innovative Computing,Information and Control.Beijing,China:IEEE,2006.266-269
[26]DedinskiI I.,H D.M.,L H.,et al.Cross-Layer Peer-to-Peer Traffic Identification and Optimization Based on Active Networking.in the Seventh Annual International Working Conference on Active and Programmable Networks.French Riviera:IEEE,2005.111-121
[27]杨岳湘,王锐,唐川.基于双重特征的P2P流量检测方法.通信学报,2006,27(11A):135-138
[28]Suh K.,Figueiredo D.R.,Kurose J.,et al.Characterizing and detecting Skype-relayed traffic,in 25th IEEE International Conference on Computer Communications.Barcelona,Spain:Institute of Electrical and Electronics Engineers Inc.United States,2006.414-420
[29]Saroiu S.,Gummadi P.K.,Gribble S.D.A measurement study of peer-to-peer file sharing systems,in Proceedings of SPIE-The International Society for Optical Engineering.San Jose,CA,United States:International Society for Optical Engineering,Bellingham WA,WA 98227-0010,United States,2002.156-170
[30]Liang J.,Kumar R.,Ross K.The KaZaA overlay:A measurement study,in the 19th IEEE Annual Computer Communications Workshop.Florida:IEEE,2004.980-986
[31]Wang J.,Hamadeh L.,Kesidis G.,et al.Polymorphic worm detection and defense:System design,experimental methodology,and data resources,in Proceedings of the 2006 SIGCOMM Workshop on Large-scale Attack Defense.Pisa,Italy:Association for Computing Machinery,United States,2006.169-176
[32]Wang J.,Miller D.J.,Kesidis G.Efficient Mining of the Multidimensional Traffic Cluster Hierarchy for Digesting,Visualization,and Anomaly Identification.IEEE Journal on Selected Areas in Communications,2006,24(10):1929-1941
[33]杜阿宁,程晓明.网络流量分析中的频繁项监测技术研究.通信学报,2006,27(2):48-53
[34]Vitter J.S.Random sampling with a reservoir.ACM Transactions on Mathematical Software,1985,11(1):37-57
[35]Krishnamurthy B.,Sen S.,Zhang Y.,et al.Sketch-based change detection:Methods,evaluation,and applications,in Proceedings of the ACM SIGCOMM Internet Measurement Conference.Miami Beach,FL,United States:Association for Computing Machinery,United States,2003.234-247
[36]Demaine E.D.,Lopez-Ortiz A.,Munro J.I.Frequency estimation of Internet packet streams with limited space,in Algorithms-ESA 2002.10th Annual European Symposium.Rome,Italy:Springer-Verlag,2002.348-360
[37]Fullmer M.,Romig S.The OSU flow-tools package and Cisco NetFlow logs.in Proceedings of the Fourteenth Systems Administration Conference New Orleans,LA,USA:USENIX Assoc,2000.291-303
[38]杨嵘,张国清,韦卫等.基于NetFlow流量分析的网络攻击行为发现.计算机工程,2005,31(13):137-141
[39]Plonka D.FlowScan:a network traffic flow reporting and visualization tool.in Proceedings of the Fourteenth Systems Administration Conference.New Orleans,LA,USA:USENIX Assoc,2000.305-317
[40]Estan C.,Savage S.,Varghese G.Automatically Inferring Patterns of Resource Consumption in Network Traffic.in Computer Communication Review.Karlsruhe,Germany:Association for Computing Machinery,United States,2003.137-148
[41]Mahmood A.N.,Leckie C.,Udaya P.Echidna:Efficient clustering of hierarchical data for network traffic analysis,in 5th International IFIP-TC6 Networking Conference.Coimbra,Portugal:Springer Verlag,Heidelberg,Germany,2006.1092-1098
[42]Gupta R,McKeown N.Packet classification on multiple fields.Computer Communication Review,1999,29(4):147-160
[43]Estan C.,Varghese G.New directions in traffic measurement and accounting:focusing on the elephants,ignoring the mice.ACM Transactions on Computer Systems,2003,21(3):270-313
[44]Duffield N.,Lund C.,Thorup M.Charging from sampled network usage,in Proceedings of the First ACM SIGCOMM Internet Measurement Workshop.San Francisco,CA,USA:ACM,2001.245-256
[45]Agrawal R.,Imielinski T.,Swami A.Mining association rules between sets of items in large databases,in Proceedings of the 1993 ACM SIGMOD International Conference on Management of Data.Washington,DC,USA:ACM,1993.207-216
[46]Kumar A.,Minho S.,Jun X.,et al.Data streaming algorithms for efficient and accurate estimation of flow size distribution,in Performance Evaluation,New York,NY,USA:ACM,2004.177-188
[47]Cormode G.,Muthukfishnan S.What's new:finding significant differences in network data streams.IEEE/ACM Transactions on Networking,2005,13(6):1219-1232
[48]Xu K.,Zhang Z.L.,Bhattacharyya S.Profiling Internet backbone traffic:behavior models and applications.Computer Communication Review,2005,35(4):169-180
[49]Cormode G.,Korn F.,Muthukrishnan S.,et al.Finding hierarchical heavy hitters in streaming data.ACM Transactions on Knowledge Discovery from Data,2008,1(4):16-23
[50]冯文峰,郭巧,吴素妍.基于多层概要结构的数据流的频繁项集发现算法.北京理工大学学报,2006,26(6):512-516
[51]Erman J.,Mahanti A.,Arlitt M.,et al.Offiine/realtime traffic classification using semi-supervised learning.Performance Evaluation,2007,64(9-12):1194-1213
[52]Moore A.W.,Zuev D.Internet traffic classification using bayesian analysis techniques,in Performance Evaluation Review.Banff,AB,Canada:Association for Computing Machinery,United States,2005.50-60
[53]Moore A.W.,Zuev D.Discriminators for use in flow-based classification,in Technical Report RR-05-13:Department of Computer Science,Queen Mary,University of London,2005
[54]Williams N.,Zander S.,Armitage G.A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification.Computer Communication Review,2006,36(5):7-15
[55]Nguyen T.T.T.,Armitage G.Training on multiple sub-flows to optimise the use of machine learning classifiers in real-world IP networks,in 31st IEEE Conference on Local Computer Networks Tampa,FL,USA:IEEE,2006.369-376
[56]Roughan M.,Sen S.,Spatscheck O.,et al.Class-of-Service mapping for QoS:A statistical signature-based approach to IP traffic classification,in Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference.Taormina,Italy: Association for Computing Machinery, United States, 2004. 135-148
[57] McGregor A., Hall M., Lorier P., et al. Flow clustering using machine learning techniques. in 5th International Workshop on Passive and Active Network Measurement. Antibes Juan-les-Pins, France: Springer-Verlag, 2004. 205-214
[58] Zander S., Nguyen T., Armitage G. Automated traffic classification and application identification using machine learning. in The IEEE Conference on Local Computer Networks-30th Anniversary. Sydney, NSW, Australia: IEEE, 2006. 250-257
[59] Liu H., Feng W., Huang Y., et al. A peer-to-peer traffic identification method using machine learning. in 2007 International Conference on Networking, Architecture, and Storage. Guilin, China: IEEE, 2007. 155-160
[60] Erman J., Mahanti A., Arlitt M. Internet Traffic Identification using Machine Learning. in 2006 Global Telecommunications Conference San Francisco, CA, United States: Institute of Electrical and Electronics Engineers Inc, 2006. 415-420
[61] Erman J., Arlitt M., Mahanti A. Traffic classification using clustering algorithms. in Proceedings of the 2006 SIGCOMM Workshop on Mining Network Data. Pisa, Italy: Association for Computing Machinery, United States, 2006. 281-286
[62] Bernaille L., Teixeira R., Akodkenou I., et al. Traffic classification on the fly. Computer Communication Review, 2006, 36(2): 23-26
[63] Bernaille L., Teixeira R. Early recognition of encrypted applications. in 8th International Conference on Passive and Active Network Measurement. Louvain-la-Neuve, Belgium: Springer, 2007. 165-175
[64] Bin L., Zhitang L., Hao T. A measurement study of peer-to-peer applications. in Proceedings of SPIE . The International Society for Optical Engineering. Wuhan, China: SPIE, Bellingham WA, WA 98227-0010, United States, 2007. 679-683
[65] Liu B., Li Z., Li Y., et al. Design and implementation of an Intrusion Detection System based on IPv6 protocol. in Proceedings of SPIE - The International Society for Optical Engineering. Wuhan, China: International Society for Optical Engineering, Bellingham WA, WA 98227-0010, United States, 2005. 598-602
[66] Liu B., Li Z., Li Z. A scalable intrusion detection system for IPv6. Wuhan University Journal of Natural Sciences, 2006, 11(6): 1723-1726
[67] Liu B., Li Z., Li Z. Traffic measurements of BitTorrent system based on Netfilter. in 2006 International Conference on Computational Intelligence and Security Guangzhou, China: IEEE, 2006. 768-772
[68] Zhou L., Li Z., Hao T. Proposition and provement of A TCP feature of P2P traffic- An example of BitTorrent and emule,in Proceedings of the Second International Conference on Communications and Networking in China.Shanghai,China:Institute of Electrical and Electronics Engineers Inc.,Piscataway,NJ 08855-1331,United States,2008.61-65
[69]Zhou L.,Li Z.,Liu B.P2P traffic identification by TCP flow analysis,in 2006International Workshop on Networking,Architecture,and Storage.Shenyang,China:IEEE Comput.Soc,2006.65-66
[70]Zhou L.,Li Z.,Tu H.Proposion and analysis of a TCP feature of P2P traffic,in Advances in Knowledge Discovery and Data Mining.11th Pacific-Asia Conference.Nanjing,China:Springer Verlag,Heidelberg,Germany,2007.1148-1155
[71]柳斌,李之棠,李佳.一种基于流特征的P2P流量实时识别方法.厦门大学学报(自然科学版),2007,46(s2):126-129
[72]柳斌,李之棠,李站春等.一种基于Netfilter的Bittorrent流量测量方法.计算机科学,2007,4(3):38-41
[73]Zuev D.,Moore A.W.Traffic classification using a statistical approach,in Passive and Active Network Measurement.6th International Workshop.Boston,MA,USA:Springer-Verlag,2005.321-324
[74]IANA.2008.http://www.iana.org/assignments/port-numbers
[75]Bartlett G.,Heidemann J.,Papadopoulos C.Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing.in Proceedings of the 10th IEEE Global Internet.Anchorage,Alaska,USA:IEEE,2007.55-60
[76]Karagiannis T.,Papagiannaki K.,Faloutsos M.BLINC:Multilevel traffic classification in the dark.Computer Communication Review,2005,35(4):229-240
[77]Matsuda T.,Nakamura F.,Wakahara Y.,et al.Traffic features fit for P2P discrimination,in 6th Asia-Pacific Symposium on Information and Telecommunication Technologies.Yangon,Myanmar:Institute of Electrical and Electronics Engineers Computer Society,United States,2005.230-235
[78]Jun L.,Shunyi Z.,Yanqing L.,et al.Internet traffic classification using machine learning,in Proceedings of the Second International Conference on Communications and Networking in China.Shanghai,China:Institute of Electrical and Electronics Engineers Inc.United States,2008.239-243
[79]Auld T.,Moore A.W.,Gull S.F.Bayesian neural networks for Internet traffic classification.IEEE Transactions on Neural Networks,2007,18(1):223-239
[80] Siqueira Jr G. P., Maia J. E. B., Holanda R., et al. P2P traffic identification using cluster analysis. in 2007 1st International Global Information Infrastructure Symposium. Marrakech, Morocco: Institute of Electrical and Electronics Engineers Computer Society, United States, 2007. 128-133
[81] Soysal M, Schmidt E. G. An accurate evaluation of machine learning algorithms for flow-based P2P traffic detection. in 22nd International Symposium on Computer and Information Sciences. Ankara, Turkey: Institute of Electrical and Electronics Engineers Computer Society, United States, 2007. 393-398
[82] Dietterich T., Kearns M, Mansour Y. Applying the weak learning framework to understand and improve C4. 5. in Proceedings of the Thirteenth International Conference on Machine Learning. Bari, Italy: Morgan Kaufmann Publishers, 1996. 96-104
[83] 陈安, 陈宁. 数据挖掘技术及应用.北京: 科学出版社, 2006. 163-165
[84] B. Cohen. Incentives Build Robustness in BitTorrent. in P2P Economics Workshop. Berkeley, California 2003
[85] Xiangying Y., Veciana G. Service capacity of peer to peer networks. in IEEE INFOCOM 2004. Hong Kong, China: IEEE, 2004. 2242-2252
[86] Qiu D., Srikant R. Modeling and performance analysis of bittorrent-like peer-to-peer networks. in Computer Communication Review. Portland, OR, USA: ACM, 2004. 367-377
[87] Bharambe A. R., Herley C, Padmanabhan V. N. Analyzing and improving a BitTorrent network's performance mechanisms. in 25th IEEE INFOCOM Conference. Barcelona, Spain: IEEE, 2006. 2884-2895
[88] Izal M., Urvoy-Keller G., Biersack E. W., et al. Dissecting BitTorrent: five months in a torrent's lifetime. in 5th International Workshop on Passive and Active Network Measurement. Antibes Juan-les-Pins, France: Springer-Verlag, 2004. 1-11
[89] Bindal R., Pei C, Chan W., et al. Improving Traffic Locality in BitTorrent via Biased Neighbor Selection. in 26th IEEE International Conference on Distributed Computing Systems. Lisboa, Portugal: Institute of Electrical and Electronics Engineers Inc, 2006. 66-72
[90] Pouwelse J., Garbacki P., Epema D., et al. The BitTorrent p2p file-sharing system: measurements and analysis. in Peer-to-Peer Systems IV. 4th International Workshop. Ithaca, NY, USA: Springer-Verlag, 2005. 205-216
[91] Guo L., Chen S., Xiao Z., et al. A performance study of BitTorrent-like peer-to-peer systems.IEEE Journal on Selected Areas in Communications,2007,25(1):155-169
[92]Xiaojun H.,Chao L.,Jian L.,et al.A measurement study of a large-scale P2P IPTV system.IEEE Transactions on Multimedia,2007,9(8):1672-1687
[93]Cheng W.Q.,Gong J.,Ding W.Identifying BT-like P2P traffic by the discreteness of remote hosts,in Proceedings-Conference on Local Computer Networks.Dublin,Ireland:IEEE Computer Society,United States,2007.237-238
[94]YuHong.Ctorrent.2004.http://sourceforge.net/projects/dtorrent/
[95]郭振滨,裘正定.应用于高速网络的基于报文采样和应用签名的BitTorrent流量识别算法.计算机研究与发展,2008,45(2):227-236
[96]Zhiruo C.,Zheng W.,Zegura E.Performance of hashing-based schemes for Intemet load balancing,in IEEE INFOCOM 2000.Tel Aviv,Israel:IEEE,Piscataway,NJ,USA,2000.332-341
[97]Thompson K.,Miller G.J.,Wilder R.Wide-area Internet traffic patterns and characteristics.Network,IEEE,1997,11(6):10-23
[98]Mellia M.,Zhang H.TCP model for short lived flows.Communications Letters,IEEE,2002,6(2):85-87
[99]He G.,Hou J.,Chen W.P.,et al.One size does not fit all:A detailed analysis and modeling of P2P traffic,in IEEE Global Telecommunications Conference.Washington,DC,United States:Institute of Electrical and Electronics Engineers Inc,United States,2007.393-398
[100]Downey A.B.Evidence for long-tailed distributions in the Intemet.in Proceedings of the First ACM SIGCOMM Internet Measurement Workshop.San Francisco,CA,USA:ACM,2001.229-241
[101]Downey A.B.Lognormal and Pareto distributions in the Internet.Computer Communications,2005,28(7):790-801
[102]Fan S.,Maosong S.A new transductive support vector machine approach to text categorization,in Proceedings of the 12th IEEE International Conference on Natural Language Processing and Knowledge Engineering.Wuhan,China:IEEE,2005.631-636
[103]Tin-Yau Kwok J.Support vector mixture for classification and regression problems.in Fourteenth International Conference on Pattern Recognition.Brisbane,Qld.,Australia IEEE Comput.Soc,Los Alamitos,CA,USA 1998.255-258
[104]Chu-Hsing L.,Jung-Chun L.,Chia-Han H.Anomaly Detection Using LibSVM Training Tools.in 2nd International Conference on Information Security and Assurance. Busan, South Korea Institute of Electrical and Electronics Engineers Computer Society, 2008. 166-171
[105] Lingras P., Butz C. J. Reducing the storage requirements of 1-v-1 support vector machine multi-classifiers. in Proceedings of SPIE - The International Society for Optical Engineering. San Jose, CA, United States: International Society for Optical Engineering, United States, 2006. 166-173
[106] Anguita D., Ridella S., Rivieccio F. K-fold generalization capability assessment for support vector classifiers. in Proceedings of the International Joint Conference on Neural Networks. Montreal, QC, Canada: Institute of Electrical and Electronics Engineers Inc, United States, 2005. 855-858
[107] Xinyan Z., Jiangchuan L., Bo L., et al. CoolStreaming/DONet: a data-driven overlay network for peer-to-peer live media streaming. in Proceedings IEEE Infocom 2005. Miami, FL, USA: IEEE, 2005. 2102-2111
[108] Xiaofei L., Hai J., Yuahao L., et al. AnySee: peer-to-peer live streaming. in 25th IEEE INFOCOM Conference. Barcelona, Spain: IEEE, 2006. 2411-2431
[109] Drake P. Using SNMP to manage networks. in IEE Colloquium on Designing Resilient Architectures. London, UK: IEE, 1991. 1-4
[110] Schonwalder J., Pras A., Harvan M., et al. SNMP Traffic Analysis: Approaches, Tools, and First Results. in 10th IFIP/IEEE International Symposium on Integrated Network Management 2007. Munich, Germany Institute of Electrical and Electronics Engineers Computer Society 2007. 323-332
[111] Estan C, Keys K., Moore D., et al. Building a better netflow. in Comput. Commun. Rev. (USA). Portland, OR, USA: ACM, 2004. 245-256
[112] 钟珞. 模式识别. 武汉: 武汉大学出版社, 2006. 128-130
[113] Cover T. M. The best two independent measurements are not the two best. IEEE Transactions on Systems, Man and Cybernetics, 1974, SMC-4(1): 116-117
[114] John G. H., Kohavi R., Pfleger K. Irrelevant Features and the Subset Selection Problem. in International Conference on Machine Learning. New Brunswick, NJ, USA: ACM, 1994. 121-129
[115] Liu H., Dougherty E. R., Dy J. G. Evolving feature selection. IEEE Intelligent Systems, 2005, 20(6): 64-76
[116] Liu H., Motoda K., Dash M. A monotonic measure for optimal feature selection. in 10th European Conference on Machine Learning. Chemnitz, Germany: Springer-Verlag, 1998. 101-106
[117]Jain A.,Zongker D.Feature selection:evaluation,application,and small sample performance.Pattern Analysis and Machine Intelligence,IEEE Transactions on,1997,19(2):153-158
[118]Siedlecki W.,Sklansky J.A note on genetic algorithms for large-scale feature selection.Pattern Recognition Letters,1989,10(5):335-347
[119]Liu H.,Setiono R.A probabilistic approach to feature selection-a filter solution,in Machine Learning.Proceedings of the Thirteenth International Conference.Bad,Italy:Morgan Kaufmann Publishers,1996.319-327
[120]Ostermann S.Tcptrace.2006.http://www.tcptrace.org
[121]Eberhart R.,Kennedy J.A new optimizer using particle swarm theory,in Proceedings of the Sixth International Symposium on Micro Machine and Human Science.Nagoya,Japan:IEEE,1995.39-43
[122]Zhang Q.,Li X.,Quang-Ahn T.A modified particle swarm optimization algorithm.in Proceedings of 2005 International Conference on Machine Learning and Cybernetics Guangzhou,China:IEEE,2005.2993-2995
[123]杨淑莹.模式识别与智能计算.Matlab技术实现.北京:电子工业出版社,2008.337-345