CN101558604B - Method and apparatus for peer-to-peer network traffic analysis - Google Patents

Abstract

Methods and apparatus may be provided for identifying and separately processing peer to peer traffic in a network. For example, the method may include: intelligent heuristics are used to identify supernodes of a peer-to-peer network. The method may also include using the feedback to identify additional nodes of the peer-to-peer network. The method may further comprise: the super node and the additional nodes are marked as peer nodes in the list. In some embodiments, the method may additionally include updating the list using intelligent updates.

Description

Method and device for peer-to-peer network traffic analysis

Cross References to Related Applications

This application is related to and claims priority to US Provisional Patent Application No. 60/661,447, filed November 29, 2006, which is hereby incorporated by reference in its entirety.

technical field

The present invention generally relates to network traffic analysis for discovering a peer-to-peer (P2P) network connection from a plurality of existing network connections. It is known that P2P network traffic can cause congestion in certain computer networks. Identifying and handling such traffic in a mobile network such as General Packet Radio Service (GPRS) is helpful in maximizing the efficiency of network resources.

Background technique

A network connection in a computer network such as a Transmission Control Protocol/Internet Protocol (TCP/IP) network is typically identified by a 5-tuple, such as the network protocol used, source address, source port, destination address, and destination port . These five characteristics, or quintuples, are sufficient to uniquely identify a network connection. These five settings can be identified and addressed in various ways when performing network traffic analysis. For example, Hypertext Transfer Protocol (HTTP) traffic is identified as: protocol=TCP/IP, destination port 80, and other settings in the quintuple can vary. In this way, it can be seen that if two settings in the quintuple are known, the business type can be identified and classified. The content of the traffic may also be used to identify the applicable protocol in terms of bytes of data in the stream, but traffic may sometimes be encrypted. This encryption can make it difficult to know what type of data is being transmitted and thus complicate network analysis.

Contents of the invention

An embodiment of the invention may be a method. The method may include identifying a peer-to-peer connection mode. The method may also include marking the traffic identified by the pattern as peer-to-peer traffic. The method may also include identifying the destination address of the traffic as a peer host. The method may additionally include marking the peer host as a supernode. The method may also include treating network connections to said supernodes as peer-to-peer network connections. In some implementations, the method may also include identifying peer nodes that no longer receive peer-to-peer traffic; and once a node that does not receive peer-to-peer traffic is identified, ceasing to treat the node as a peer-to-peer client.

Another embodiment of the present application may be an apparatus. The device may include a first identifying unit configured to identify peer-to-peer traffic based on a connection mode. The device may further include a marking unit configured to mark the service as a peer-to-peer service. The device may also include a master control unit configured to specify a destination host for the traffic as a peer host and to mark the host as a supernode, wherein the master control unit is configured to direct traffic destined for All services of the super node and all network connections to the super node are regarded as peer-to-peer network connections. It should be noted that "mastering unit" as used in this application uses the term "master" not because the unit masters (participates in the action of mastering something), but because the unit can, for example, classify nodes as host. In some implementations, the device may further include: a second identifying unit configured to identify a peer-to-peer designated node that no longer receives peer-to-peer services, and remove the designation of the node as a peer-to-peer client.

Another embodiment of the invention is another method. The method may include using intelligent heuristics to identify supernodes of the peer-to-peer network. The method may also include using the feedback to identify additional nodes of the peer-to-peer network. The method may also include marking the supernode and additional nodes as peer nodes in the list. In some implementations, the method may additionally include updating the list using smart updates.

An additional embodiment of the invention is another device. The device may include: a first identification unit configured to use intelligent heuristics to identify super nodes of the peer-to-peer network. The device may also include a second identifying unit configured to use the feedback to identify additional nodes of the peer-to-peer network. The device may further comprise a marking unit configured to mark said supernode and additional nodes as peer nodes in the list. In some implementations, the device may additionally include updating the list using smart updates.

Yet another embodiment of the present invention may be a computer program tangibly embodied on a computer-readable medium encoding instructions for performing various functions. The computer program may include instructions for using intelligent heuristics to identify supernodes of the peer-to-peer network. The computer program may also include instructions for using the feedback to identify additional nodes of the peer-to-peer network. The computer program may also include instructions for marking the supernode and additional nodes as peer nodes in the list. In some embodiments, the computer program may additionally include instructions for updating said list using smart update.

An additional embodiment of the invention may be yet another device. The apparatus may comprise identifying means for using intelligent heuristics to identify supernodes of the peer-to-peer network and feedback to identify additional nodes of said peer-to-peer network. The device may also include marking means for marking said supernode and additional nodes as peer nodes in the list. In some embodiments of the present invention, the device may further include updating means for updating the list by using intelligent updating.

Description of drawings

For a proper understanding of the invention, reference is made to the accompanying drawings, in which:

Fig. 1 shows a flowchart according to an embodiment of the present invention;

Figure 2 is a general illustration of a P2P network, where multiple nodes can be virtually directly connected to each other through a hub or a switch;

Figure 3 shows a block diagram of a device configured to implement the present invention; and

FIG. 4 is a flowchart illustrating another embodiment of the present invention.

Detailed ways

Exemplary methods according to the present invention may be methods that perform network analysis to identify P2P traffic, and block P2P traffic, charge for P2P traffic, or perform specific processing on the P2P traffic in order to maximize the use of valuable network resources. Use effectively.

In a P2P network such as eg Skype ^™ traffic is encrypted and there is no central server to which P2P clients are constantly connected. This configuration makes it difficult to identify the five-tuples that identify the utilization of the P2P protocol. Certain P2P networks may treat certain P2P nodes specially; for example, P2P traffic may be routed through this node in some cases if the node has sufficient network capacity. Such nodes are often referred to as supernodes due to their capacity or capacity for carrying large amounts of data and/or traffic.

In the network service analysis method and system, the identification of super nodes can help to simplify service processing. Typically, a large amount of traffic (or sometimes all traffic) to and from supernodes is P2P traffic. As such, generally, all connections to and from supernodes are P2P connections.

Certain embodiments of the invention may use intelligent heuristics with feedback to identify P2P quintuples in network traffic analysis. For example, a P2P client, which may be referred to as Node A, may be identified by the fact that it creates a large number of connections to other peers within a short time window (in many cases, may be less than 1 second).

Certain methods and systems according to the present invention can identify this connection mode and mark the traffic as P2P traffic. Certain embodiments of the invention may, for example, identify two characteristics in the quintuple, namely, protocol and source address. Therefore, network connections can be classified as P2P traffic. This stage of analysis can be called the intelligent heuristic stage.

When a quintuple is found, then a destination host or other peer in the P2P network, which may be called (for convenience) a Node B, may be considered a potential P2P host/client. If there are many connections to Node B, then Node B can also be marked as a super node, and all network connections to it can be regarded as P2P network connections. This analysis phase can be called the feedback phase.

Certain embodiments of the present invention may also identify P2P nodes that no longer receive P2P traffic. In many cases, computer networks may use dynamic Internet Protocol (IP) address assignments. In other words, the IP address of a host or client can change over time. Some embodiments of the present invention may identify that: within a certain period of time, the existing P2P client/host (for example, node A) has not received any P2P data or service. Therefore, this embodiment of the invention will no longer consider node A to be a P2P client. This can be called the intelligent update phase of the analysis.

As such, certain embodiments of the present invention may identify P2P quintuple information from network traffic using intelligent heuristics, feedback, and intelligent updates. This identification can support the classification of P2P network services, and support the treatment of P2P services in a manner different from other network services.

Such an implementation can help to significantly increase the efficient use of network resources and potentially avoid exhausting valuable network resources. Existing network analysis methods and systems cannot identify and analyze P2P network traffic in a manner comparable in advantages to embodiments of the present invention.

Therefore, some methods and devices according to embodiments of the present invention can detect that a node initiates at least a predetermined number of connections to other nodes within a predetermined time; and classify such initiating nodes as P2P nodes and/or obtain P2P quintuple Group. Certain embodiments of the invention may also detect whether such connected nodes have more than a predetermined number of connections to other nodes.

Certain embodiments of the invention may then classify such nodes as P2P nodes. The predetermined time window for identifying whether to make a predetermined number of connections may be, for example, 1 second, and the predetermined number of connections may be, for example, five connections within a time period of 1 second. Certain embodiments of the invention may make such parameters configurable.

Various embodiments of the invention can be implemented in many types of networks and systems, including computer networks in which many P2P nodes are deployed, and cellular/IP Multimedia Subsystem (IMS) networks in which cellular or mobile The user equipment communicates via a base station or directly, wherein the user terminal may be or include a node and/or the base station may be or include a node.

Certain embodiments of the present invention can also be implemented as computer software contained on a computer-readable medium, where the software can run on a processor and control the processor to perform, for example, the steps of the above-mentioned methods. Such software also enables the processor to be configured as the various hardware elements discussed herein.

More specifically, certain embodiments of the invention may, for example, be embodied in traffic analyzer and/or firewall computer hardware, computer software, or a mixture thereof. As such, certain embodiments of the invention may be implemented on, for example, a general purpose computer or an application specific integrated circuit (ASIC).

Fig. 1 shows a flowchart according to an embodiment of the present invention. According to Fig. 1, a check 110 is made to see if the P2P client has initiated a predetermined number of connections within a given period of time. If the answer is "yes", then the initiating node is identified 120 as a P2P node. A check 130 is then made to determine if other nodes connected to the initiating node have sufficient connection capacity for a given period of time. If so (eg, if they have sufficient capacity to trigger an inference that they are supernodes), these other nodes are classified 140 as P2P nodes.

The embodiment shown in FIG. 1 and various other embodiments of the invention may then monitor 150 traffic to a P2P node to determine whether P2P traffic for that node is still being transmitted. If no P2P traffic is received within a predetermined period, the node is no longer considered a 160 P2P node.

Fig. 2 is a general illustration of a P2P network in which multiple nodes can be virtually directly connected to each other through a hub or switch (hub or switch not shown). Such a network may differ from a client-server network in which all network nodes are logically connected to a common file server for file serving.

For example, in one popular implementation of a P2P network, a node directly shares a file with another node without uploading the file to a file server for subsequent retrieval. As previously mentioned, the nodes of FIG. 2 may include various types of user equipment, including cellular telephones, base stations, computers, laptops, desktops, and the like.

Thus, eg Node A, Node B, Node C, Node D and Node E may eg be mobile communication devices capable of communicating with each other eg via a Mobile Switching Center (MSC), Base Station (BS) or similar technology. Alternatively, the nodes may be nodes of a LAN connected by a single router or switch in a physical star topology. All nodes need not be part of the same physical network.

Fig. 3 shows a block diagram of a device configured to implement the present invention. The device may comprise an initiating unit 310 that monitors connections initiated by client nodes. The identifying unit 320 may identify the originating node as a P2P node, and the marking unit 330 may mark the service as a P2P service.

The identification unit 320 may rely on various indicators of the P2P traffic, such as the number of connections generated within a certain time frame. Other techniques for distinguishing P2P traffic forms from eg traditional web browsing HTTP traffic may also be used. These units can perform the intelligent heuristic phase of the analysis.

Another identification unit 340 may then identify other P2P nodes based on the number of connections to other P2P nodes meeting certain criteria, and return to the marking unit 330 to mark other P2P nodes. These units can perform the feedback phase of the analysis. The declassification unit 350 may monitor P2P traffic destined for those nodes that have been identified as P2P nodes, and may remove P2P destinations from P2P nodes that no longer receive P2P traffic.

The declassification unit 350 may cooperate with the identification unit 320, the marking unit 330 and another identification unit 340 in order to perform its operations. These units can perform the intelligent update phase of the analysis.

FIG. 4 is a flowchart illustrating another embodiment of the present invention. According to FIG. 4, at 401, a P2P client creates a predetermined number of connections within a given amount of time. At 402, traffic from the P2P client is marked as P2P traffic. At 403, the connection is classified as a P2P connection using the protocol and source address, which are two items in the quintuple.

At 404, as shown in FIG. 4, the destination host can be identified based on the five-tuple. If the connection capacity meets predetermined criteria for connection capacity over a period of time, then at 405 the destination host is classified as a P2P host or supernode.

At 406, when the P2P traffic falls below a predetermined threshold or drops to 0, the P2P node is declassified as a non-P2P node. The process shown in FIG. 4 may be performed repeatedly, and the steps described do not have to be performed in the order shown just because they are shown in that order.

Those of ordinary skill in the art will readily appreciate that the present invention described above may be performed using steps in a different order, and/or implemented using hardware elements in configurations other than those disclosed herein. Therefore, while the invention has been described based on these preferred embodiments, certain modifications, variations, and alternative constructions will be apparent to those skilled in the art, while falling within the spirit and scope of the invention. In order to determine the metes and bounds of the invention, therefore, reference should be made to the appended claims.

Claims (28)

1. A method for peer-to-peer network traffic analysis, comprising: identifying a peer-to-peer connection mode, wherein identifying the peer-to-peer connection mode includes determining that a predetermined number of connections have been initiated within a predetermined time; marking traffic identified by said peer-to-peer connection mode as peer-to-peer traffic; identifying the destination address of the traffic as a peer host; mark the peer host as a supernode; and Treat network connections to marked supernodes as peer-to-peer network connections. 2. The method of claim 1, further comprising: Identify peer nodes that are no longer receiving peer-to-peer traffic; and Once a node that does not receive peer-to-peer traffic is identified, the node is ceased to be considered a peer-to-peer client. 3. A device for peer-to-peer network service analysis, comprising: A first identification unit configured to identify a peer-to-peer service based on a connection mode, wherein identifying the peer-to-peer service includes determining that a predetermined number of connections have been initiated within a predetermined time; a marking unit configured to mark the service as a peer-to-peer service; a master control unit configured to specify a destination host for the traffic as a peer host and to mark the host as a supernode, wherein the master control unit is configured for all traffic destined for the marked supernode Business and all network connections to the supernodes are considered peer-to-peer network connections. 4. The apparatus of claim 3, further comprising: The second identifying unit is configured to identify peer-to-peer designated nodes that no longer receive peer-to-peer services, and remove the designation of the node as a peer-to-peer client. 5. A method for peer-to-peer network traffic analysis, comprising: using intelligent heuristics to identify supernodes of the peer-to-peer network, wherein identifying supernodes of the peer-to-peer network includes determining that a predetermined number of connections have been initiated within a predetermined time; using feedback to identify additional nodes of the peer-to-peer network; and Mark the supernode and additional nodes as peers in the list. 6. The method of claim 5, further comprising: Use Smart Update to update the list. 7. The method of claim 6, wherein updating the list comprises removing a node from the list when the node is no longer participating in peer-to-peer network traffic. 8. The method of claim 5, wherein identifying the supernode comprises identifying at least two characteristics of a quintuple of the supernode. 9. The method of claim 8, wherein the at least two characteristics include protocol and source address. 10. The method of claim 5, wherein identifying the supernode comprises identifying that the number of connections encountered by the supernode is greater than a predetermined threshold for a predetermined amount of time. 11. The method of claim 10, wherein the predetermined amount of time is 1 second, and wherein the predetermined threshold is five. 12. The method of claim 5, wherein identifying additional nodes comprises identifying nodes in communication with the supernode. 13. The method of claim 5, further comprising: Based on the list, communication with nodes on the list is blocked. 14. The method of claim 5, further comprising: Based on the list, the nodes on the list are billed or charged. 15. The method of claim 5, wherein marking the supernodes and additional nodes comprises specifically distinguishing between normal nodes and supernodes. 16. A device for peer-to-peer network traffic analysis, comprising: A first identifying unit configured to identify a supernode of the peer-to-peer network using intelligent heuristics, wherein identifying the supernode of the peer-to-peer network includes determining that a predetermined number of connections have been initiated within a predetermined time; a second identification unit configured to use feedback to identify additional nodes of the peer-to-peer network; and A marking unit configured to mark the supernode and additional nodes as peer nodes in the list. 17. The apparatus of claim 16, further comprising: Use Smart Update to update the list. 18. The apparatus of claim 17, wherein updating the list comprises removing a node from the list when the node is no longer participating in peer-to-peer network traffic. 19. The apparatus of claim 16, wherein labeling the supernodes and additional nodes comprises specifically distinguishing normal nodes from supernodes. 20. The apparatus of claim 16, wherein identifying the supernode comprises identifying at least two characteristics of a quintuple of the supernode. 21. The apparatus of claim 20, wherein the at least two characteristics include a protocol and a source address. 22. The apparatus of claim 16, wherein identifying the supernode comprises identifying that the number of connections encountered by the supernode is greater than a predetermined threshold for a predetermined amount of time. 23. The apparatus of claim 22, wherein the predetermined amount of time is 1 second, and wherein the predetermined threshold is five. 24. The apparatus of claim 16, wherein identifying additional nodes comprises identifying nodes in communication with the supernode. 25. The device of claim 16, further comprising: Based on the list, communication with nodes on the list is blocked. 26. The device of claim 16, further comprising: Based on the list, the nodes on the list are billed or charged. 27. A device for peer-to-peer network traffic analysis, comprising: identifying means for identifying supernodes of a peer-to-peer network using intelligent heuristics and identifying additional nodes of said peer-to-peer network using feedback, wherein identifying supernodes of a peer-to-peer network comprises determining that a predetermined number of connections have been initiated within a predetermined time ;as well as marking means for marking said supernode and additional nodes as peer nodes in the list. 28. The apparatus of claim 27, further comprising: updating means, configured to update the list using intelligent updating.

Images