New Heuristics for eDonkey Node and Flow Detection

Rafael A. Rodríguez-Gómez; Gabriel Maciá-Fernández; Pedro García-Teodoro

Abstract:

The development and use of applications based on peer-to-peer (P2P) networks have exponentially grown in the last years. In fact, the traffic volume generated by these applications supposes almost the 80% of all the network bandwith nowadays. For this reason, the interest of Internet Service Providers (ISPs) for classifying this large amount of traffic has also grown in a considerable manner. In this context, the present paper describes two detection algorithms for eDonkey services. The first one is aimed to detect eDonkey flows. It is based on the hypothesis that clients that begin connections are in charge of sending the information. The second algorithm has been developed to detect nodes that generate eDonkey traffic. It is based on the hypothesis that the up-rate of these nodes follows a constant pattern along the time. Both detection algorithms have been proved in three different groups of network traces. As a result, our detection hypothesis is checked. Additionally, the experiments carried out show that the proposed algorithms have a high classification rate and a low false positive rate.

Research areas:

• Ethical hacking and digital forensics

Year:

2011

Type of Publication:

In Proceedings

Editor:

3rd Int. Conference on Advances in P2P Systems (AP2PS)

Pages:

90-95