Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing. Bartlett, G., Heidemann, J., & Papadopoulos, C. In Proceedings of the 10thIEEE Global Internet Symposium, Anchorage, Alaska, USA, May, 2007. IEEE. An extended version of this paper is available as ISI-TR-2006-627![Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing [link]](https://bibbase.org/img/filetypes/link.svg "link")
Paper abstract bibtex Blind techniques to detect network applications—approaches that do not consider packet contents—are increasingly desirable because they have fewer legal and privacy concerns, and they can be robust to application changes and intentional cloaking. In this paper we identify several behaviors that are \emphinherent to peer-to-peer (P2P) traffic and demonstrate that they can detect both BitTorrent and Gnutella hosts using only packet header and timing information. We identify three basic behaviors: failed connections, the ratio of incoming and outgoing connections, and the use of unprivileged ports. We show that while individual behaviors are sometimes effective, they work best when used together. We quantify the effectiveness of our approach using two day-long traces, from 2005 and 2006, showing that they are quite accurate: BitTorrent hosts are detected with an 83% true positive rate and only a 2% false positive rate, and Gnutella hosts with a 75% true positive rate and a 4% false postivie rate. Our system is suitable for on-line use, with 75% of BitTorrent hosts detected in less than 10 minutes of trace data.
@InProceedings{Bartlett07a,
author = "Genevieve Bartlett and John Heidemann and Christos Papadopoulos",
title = "Inherent Behaviors for On-line Detection of
Peer-to-Peer File Sharing",
booktitle = "Proceedings of the " # "10th" # " IEEE Global Internet Symposium",
year = 2007,
sortdate = "2007-05-01",
month = may,
publisher = "IEEE",
address = "Anchorage, Alaska, USA",
xxxpages = "xxx",
jlocation = "johnh: pafile",
note = "An extended version of this paper is available as ISI-TR-2006-627",
keywords = "peer-to-peer, traffic classification, encryption",
project = "ant, lander, predict",
jsubject = "traffic_detection",
url = "https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07a.html",
pdfurl = "https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07a.pdf",
myorganization = "USC/Information Sciences Institute",
copyrightholder = "IEEE",
copyrightterms = " Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. ",
abstract = "
Blind techniques to detect network applications---approaches that do
not consider packet contents---are increasingly desirable because they
have fewer legal and privacy concerns, and they can be robust to
application changes and intentional cloaking. In this paper we
identify several behaviors that are \emph{inherent} to peer-to-peer
(P2P) traffic and demonstrate that they can detect both BitTorrent and
Gnutella hosts using only packet header and timing information. We
identify three basic behaviors: failed connections, the ratio of
incoming and outgoing connections, and the use of unprivileged ports.
We show that while individual behaviors are sometimes effective, they
work best when used together. We quantify the effectiveness of our
approach using two day-long traces, from 2005 and 2006, showing that
they are quite accurate: BitTorrent hosts are detected with an 83\%
true positive rate and only a 2\% false positive rate, and Gnutella
hosts with a 75\% true positive rate and a 4\% false postivie rate.
Our system is suitable for on-line use, with 75\% of BitTorrent hosts
detected in less than 10 minutes of trace data.
",
}
Downloads: 0
{"_id":"Qv4QdZQmJw9TzLMbh","bibbaseid":"bartlett-heidemann-papadopoulos-inherentbehaviorsforonlinedetectionofpeertopeerfilesharing-2007","author_short":["Bartlett, G.","Heidemann, J.","Papadopoulos, C."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","author":[{"firstnames":["Genevieve"],"propositions":[],"lastnames":["Bartlett"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]},{"firstnames":["Christos"],"propositions":[],"lastnames":["Papadopoulos"],"suffixes":[]}],"title":"Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing","booktitle":"Proceedings of the 10thIEEE Global Internet Symposium","year":"2007","sortdate":"2007-05-01","month":"May","publisher":"IEEE","address":"Anchorage, Alaska, USA","xxxpages":"xxx","jlocation":"johnh: pafile","note":"An extended version of this paper is available as ISI-TR-2006-627","keywords":"peer-to-peer, traffic classification, encryption","project":"ant, lander, predict","jsubject":"traffic_detection","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07a.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07a.pdf","myorganization":"USC/Information Sciences Institute","copyrightholder":"IEEE","copyrightterms":"Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. ","abstract":"Blind techniques to detect network applications—approaches that do not consider packet contents—are increasingly desirable because they have fewer legal and privacy concerns, and they can be robust to application changes and intentional cloaking. In this paper we identify several behaviors that are \\emphinherent to peer-to-peer (P2P) traffic and demonstrate that they can detect both BitTorrent and Gnutella hosts using only packet header and timing information. We identify three basic behaviors: failed connections, the ratio of incoming and outgoing connections, and the use of unprivileged ports. We show that while individual behaviors are sometimes effective, they work best when used together. We quantify the effectiveness of our approach using two day-long traces, from 2005 and 2006, showing that they are quite accurate: BitTorrent hosts are detected with an 83% true positive rate and only a 2% false positive rate, and Gnutella hosts with a 75% true positive rate and a 4% false postivie rate. Our system is suitable for on-line use, with 75% of BitTorrent hosts detected in less than 10 minutes of trace data. ","bibtex":"@InProceedings{Bartlett07a,\n\tauthor = \"Genevieve Bartlett and John Heidemann and Christos Papadopoulos\",\n\ttitle = \t\"Inherent Behaviors for On-line Detection of\n Peer-to-Peer File Sharing\",\n\tbooktitle = \t\"Proceedings of the \" # \"10th\" # \" IEEE Global Internet Symposium\",\n\tyear = \t\t2007,\n\tsortdate = \t\t\"2007-05-01\",\n\tmonth =\t\tmay, \n\tpublisher =\t\"IEEE\",\n\taddress =\t\"Anchorage, Alaska, USA\",\n\txxxpages =\t\t\"xxx\",\n\tjlocation =\t\"johnh: pafile\",\n\tnote = \"An extended version of this paper is available as ISI-TR-2006-627\",\n\tkeywords = \"peer-to-peer, traffic classification, encryption\",\n\tproject = \"ant, lander, predict\",\n\tjsubject = \"traffic_detection\",\n\turl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07a.html\",\n\tpdfurl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07a.pdf\",\n\tmyorganization =\t\"USC/Information Sciences Institute\",\n\tcopyrightholder = \"IEEE\",\n\tcopyrightterms = \"\tPersonal use of this material is permitted. However, \tpermission to reprint/republish this material for advertising \tor promotional purposes or for creating new collective works for resale or redistribution to servers or lists, \tor to reuse any copyrighted component of this work in other works \tmust be obtained from the IEEE. \",\n\tabstract = \"\nBlind techniques to detect network applications---approaches that do\nnot consider packet contents---are increasingly desirable because they\nhave fewer legal and privacy concerns, and they can be robust to\napplication changes and intentional cloaking. In this paper we\nidentify several behaviors that are \\emph{inherent} to peer-to-peer\n(P2P) traffic and demonstrate that they can detect both BitTorrent and\nGnutella hosts using only packet header and timing information. We\nidentify three basic behaviors: failed connections, the ratio of\nincoming and outgoing connections, and the use of unprivileged ports.\nWe show that while individual behaviors are sometimes effective, they\nwork best when used together. We quantify the effectiveness of our\napproach using two day-long traces, from 2005 and 2006, showing that\nthey are quite accurate: BitTorrent hosts are detected with an 83\\%\ntrue positive rate and only a 2\\% false positive rate, and Gnutella\nhosts with a 75\\% true positive rate and a 4\\% false postivie rate.\nOur system is suitable for on-line use, with 75\\% of BitTorrent hosts\ndetected in less than 10 minutes of trace data.\n\",\n}\n\n","author_short":["Bartlett, G.","Heidemann, J.","Papadopoulos, C."],"bibbaseid":"bartlett-heidemann-papadopoulos-inherentbehaviorsforonlinedetectionofpeertopeerfilesharing-2007","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07a.html"},"keyword":["peer-to-peer","traffic classification","encryption"],"metadata":{"authorlinks":{}}},"bibtype":"inproceedings","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["DTXTQhi8vCYSmtrPK","YLyu3mj3xsBeoqiHK","fLZcDgNSoSuatv6aX","fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["peer-to-peer","traffic classification","encryption"],"search_terms":["inherent","behaviors","line","detection","peer","peer","file","sharing","bartlett","heidemann","papadopoulos"],"title":"Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing","year":2007}