P2P论文基于DPI和DFI的P2P流量检测技术研究.doc

P2P论文：基于DPI和DFI的P2P流量检测技术研究 【中文摘要】基于P2P技术的各类应用越来越广泛,但在给大家带来方便的同时,已逐渐演变成为宽带网络的带宽杀手,极易造成网络拥堵,严重影响网络服务质量并存在诸多安全隐患。因此,在相应层级的网络出口能否提供高效的P2P流量管理成为网络能否持续发展的关键要素之一。论文结合企业级边界网关研发项目,针对当前P2P检测技术中遇到的带宽高速化和应用多样化两大难题,讨论了P2P技术的发展历程及检测技术,通过深入研究分析P2P协议,提出了一种基于DPI和DFI的P2P流量检测方案,并予以工程实现。论文的主要工作如下:深入细致地分析了目前主流P2P协议,提取整理出协议的特征字符串,并针对当前软件实现的检测方法无法应用于高速带宽环境的问题,提出了一种基于TCAM的P2P流量检测算法,通过硬件加速,实现了在企业级网络环境下基于深度包检测技术的P2P流量线速检测。测试结果显示,本算法可以精确地检测出已知的P2P流量。针对基于TCAM深度包检测技术无法有效检测新型或传输加密P2P协议的问题,提出了一种基于深度流检测技术的加权P2P流量检测算法,通过运用TCP/UDP法、{IP,Port}法、并发连接数法等三种识别技术,分别对流量进行检测,并根据综合判决识别出P2P流量。测试结果显示,基于DFI加权P2P流量检测技术的检出率、误检率及漏检率明显优于单独的识别技术,并且具备对传输加密的P2P流量检测能力。针对单独使用基于深度包检测技术和基于深度流检测技术存在一定缺陷的问题,结合项目研发环境,提出并工程实现了一种较完备的P2P流量检测方案,通过融合两种P2P检测算法,实现取长补短,具备了对已知、未知及传输加密等绝大部分P2P流量的检测能力,并采用一种已知数据流优先处理的策略,最大限度地保证了通信质量。理论分析和测试表明,本方案能在GE接口中实现线速P2P流量检测,完全满足项目研发要求。目前,该方案已经在企业级边界网关系统中得到成功应用。 【英文摘要】Various applications based on P2P technology have been widely adopted, which brings us many conveniences. Meanwhile, it gradually evolves into an‘assassin’to the wide-band network, constantly brings on network jams, severely affects the quality of network services, brings out lots of potential safety hazards. Thus, high efficient P2P flow management measures to the relevant network level exit becomes one of the key factors to the maintaining development of the internet.Based on the project of the enterprise-level border gateway, this paper shoots the two problems, Hi-Speed and applying diversification, in current development of the P2P detection technology, and discusses the development course of P2P technology and its detecting technology. By a deeply research and analysis of P2P protocol, it brings forward a P2P flow detection solution based on DPI DFI, achieves engineering implementation.The paper mainly discusses as follow:It deeply and meticulously analyzed current main-stream P2P protocols, extracted characteristic strings from them. Then aiming at the problem that