rabish

原创于 2010-05-12 21:45:00 发布 · 1.4k 阅读

本内容遵循CC 4.0 BY-SA版权协议

本文介绍了一种针对P2P-TCP流量的检测算法，通过对比数据包的有效载荷长度，并利用Smith-Waterman算法寻找相似字符串来识别潜在的P2P通信。该算法首先过滤掉数据包数量小于3的TCP流，然后对剩余流量进行深度分析。

Switch (App-type) case P2P-TCP: Flow-set{F1…Fx} // Pure Traffic Flow Set For Fi[] in Flow-set if(Is-TCP-Flow==True && Fi.packet-num < 3) continue For Fj in Flow-set if(Is-TCP-Flow==True && Fi.packet-num < 3) continue While m from 0 to Fi.packet-num While n from 0 to Fj.packet-num If(|Fi[].payload-len – Fj.payload-len| < threshold) CommonString = Smith-Waterman(Fi[m],Fj[n]) if CommonString in SigSet SigSet[CommonString]++ else SigSet.insert(CommonString) n++ //end while m++ //end while j++ //end for i++ //end for case P2P-UDP://omit case NOT-P2P-TCP: //omit case NOT-P2P-UDP://omit