摘要
現在的 P2P(peer-to-peer)，或稱為點對點檔案共享服務，是屬於使用者對使用者 間的通訊方式，相對於傳統的HTTP/FTP傳送檔案方式，是屬於伺服器對使用者 的通訊。P2P 比例佔整體網路頻寬越來越多，急速擴充的 P2P 檔案服務型態使得 ISP 頻寬使用量大增，也衝擊到網際網路的服務品質。 新形態的P2P技術可以使用任意的 port number 來避免偵測且可以偽裝成常 用的網際網路服務來穿越防火牆，如:HTTP 使用的 80 port及 HTTPS 使用的 443 port。對於封包內容可以用加密技術來隱藏協定來避免偵測，目前網路上有多種 P2P 工具，包含 eMule、eDonkey、Bittorrent、Bitcomet、foxy 等等，都相當受 到使用者的喜愛。因為從這些P2P軟體可以獲得合法或非法的檔案資料，所以吸 引人們去使用。 每天有上百萬使用者以及難以數計的檔案及資訊透過這些 P2P 軟體在網路上 進行交換，而資訊安全威脅也就跟著提高。P2P 除了下載的程式或是檔案可能含 有病毒外，往往會同時植入間諜軟體或惡意程式,對個人或企業來說也暗藏了資安 風險。在一些舊有的P2P封包辨識技術,是利用 port number 結合封包特徵來進行 P2P 流量辨識。對於新形態的 P2P 軟體辨識能力效果卻有限,所以在此我們利用 深層識別技術來辨識 P2P 流量封包，並製作一套P2P辨識流量系統來管理網路上 的使用者使用 P2P 軟體，以避免頻寬無謂的耗用及加強資安管理。
並列摘要
P2P(peer-to-peer) or called point-to-point file sharing service belongs to a com- munication method between end-users. Compared with traditional Http/FTP files deliver method, P2P belongs to the communication from server to end-users. P2P is more and more active in whole Network and will occupy more and more band- width. The great growth rate of P2P files type will increase using persentage of ISP bandwidth and will also impact the service quality of Network. New type P2P technology could avoid detecting and disguise as generally Net- wok Service to go through firewall by random port number, for example port 80 of HTTP and port 443 of HTTPS. With regard to that package could use private protocol to avoid detecting by encode technology, there are serveral P2P tools in Netwok included of eMule, eDonkey, BT, Bitcome.foxy, and so on. End-users are quite fond of these tools because they could get data which they failed to obtain in the past by employing indefinite definition. Millions of end-users and inestimable data circulate hither and thither by these P2P softwares. With this, the minacity of data security will be raising up. Expect for that downloaded files might be included of virvus, emissary activitie or malicious virus will be implement on P2P software. No mater personal issues or commercial affairs, the minacity of data security will be raising up. It is to identify P2P flow by combining port number and package feature in the traditional P2P package detacting technology. And new type P2P identify ability is limited, so we use depth recognition technology to identify P2P flow and then arrange P2P softwares used by end-users in the Network.
參考文獻
[1] S. Fuke, C. Pan, and R. Xiaoli, “Research of p2p traffic identification based
Processing, 2007. IIHMSP 2007. Third International Conference on, vol. 2,
[2] K. Kothapalli and C. Scheideler, “Supervised peer-to-peer systems,” Parallel
[3] M. Johnson, D. McGuire, and N. Willey, “The evolution of the peer-to-peer
file sharing industry and the security risks for users,” Hawaii International