Two-Step P2P Traffic Classification with Connection Heuristics

The basis of P2P traffic control is to classify P2P traffic accurately. Several methods such as port-based, signature-based, pattern-based and statistics-based method have been proposed for P2P traffic classification. However, as P2P applications have tried to avoid being easily detected, it becomes hard to classify P2P traffic accurately using only one method. In this paper, we propose an improved two-step P2P traffic classifier by combining signature-based classifier with connection heuristics in packet-level, and statistics-based classifier in flow-level. With connection heuristics, our scheme detects P2P traffic quickly in packet-level classification and reduces the amount of computation. Through verification with real datasets, we show that our two-step scheme has high accuracy and low overhead compared to simple combination of signature-based scheme and statistics-based scheme.