CN101668035B - Method for recognizing various P2P-TV application video flows in real time - Google Patents
Method for recognizing various P2P-TV application video flows in real time Download PDFInfo
- Publication number
- CN101668035B CN101668035B CN2009100354594A CN200910035459A CN101668035B CN 101668035 B CN101668035 B CN 101668035B CN 2009100354594 A CN2009100354594 A CN 2009100354594A CN 200910035459 A CN200910035459 A CN 200910035459A CN 101668035 B CN101668035 B CN 101668035B
- Authority
- CN
- China
- Prior art keywords
- address
- message
- server
- nodeset
- source
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Abstract
The invention provides a method for recognizing various P2P-TV application video flows in real time, which accurately recognizes P2P-TV application system video flows, such as PPLive, PPStream, SopCast, UUSee, and the like, in real time from a network flow. The method comprises the following basic ideas: aiming at the behaviour that a P2P-TV node is necessary for accessing a server address set, obtaining IP addresses communicated with a server in the server address set and eliminating a non-P2P-TV application flow subgroup; comparing the residual flows and judging whether the residual flows have the characteristics of an application layer characteristic word or not, if so, recognizing the flow into a specific P2P-TV video flow. The invention has the advantages of high recognition rate, low recognition error rate and strong instantaneity.
Description
Technical field
The invention belongs to the network data communication field; Particularly a kind of method that from network traffics, identifies P2P-TV application system video flowings such as PPLive, PPStream, SopCast and UUSee real-time and accurately, the heuristic of the multiple P2P-TV application video flows of specifically a kind of Real time identification.
Background technology
Current is a kind of mainstream applications of internet through the IP agreement to desktop user distribution TV flowing content; And because the economy of the resource polymerization that has of P2P technology, the advantages such as dynamic of autgmentability and reliability, self-organizing preferably make these systems mostly utilize the P2P overlay network to broadcasting (peercast) flowing content.Be meant through the mode of P2P network that to broadcasting commonly used is P2P multicast and P2P broadcasting with multicast, broadcasting or unicast transmission data flow.What we saw at present the most popular comprises P2P employing wireless electricity, P2P streaming music and based on the Internet television (also claiming P2P-TV) of P2P to broadcasting to use.And P2P-TV can be divided into the live and program request dual mode of streaming.Different with the P2P file-sharing, the peer in the above-mentioned application need not downloaded whole file just can watch or listen to streaming (streaming) content to this locality, and this has just improved user experience greatly.
Because TV media is to the material impact power of human culture and life style; And its huge flow of in network, producing; The behavior that understanding, management and guiding P2P-TV use is the theme that current each research institution, ISP pay close attention to and study, and the prerequisite of everything is at first wanted to discern P2P-TV stream.So-called P2P-TV stream is meant the TV signal message set of transmitting with the P2P mode; They meet five-tuple { source IP address; Source port number, purpose IP address, destination slogan; The transition layer protocol type } bidirectional flow [1] of stream standard and overtime definition in 64 seconds, can adopt as document [4] similarly thinking solve that stream forms and by problems such as flow analysis.The technology of the Real time identification P2P-TV application video flows that this patent provides mainly is meant the video flowing of PPLive, PPStream, SopCast and UUSee application system of identification current popular.
All adopted the random port technology because current most of P2P uses, thereby can't utilize known port numbers that P2P is used and discern.The method of current identification P2P-TV application video flows can be divided into 3 types: based on the recognition methods of application protocol features word, based on the recognition methods of behavioural characteristic with based on the sorting technique of machine learning.Through analyzing the application layer load of P2P agreement, extract the feature string that can unique identification goes out protocol type based on the recognition methods of application protocol features word, use to identify P2P.This recognition methods is also referred to as deep packet and detects that (Deep Packet Inspection, DPI), it has the recognition accuracy height, but shortcoming is to discern enciphered data.Fully utilized the behavioural characteristic of attribute, statistical property and the stream of stream based on the recognition methods of behavioural characteristic, convection current is analyzed according to heuristic rule, reaches identification P2P application aims.This method recognition time is longer, and recognition accuracy is not high enough.Based on information such as stream through extracting types of applications of the sorting technique of machine learning, groupings grader is trained, utilize the grader that trains that data are classified then.This method recognition time is long, and accuracy has much room for improvement.Document [2] is different according to different P2P-TV systems at the grouping number that initial period sent; The time period of fixed size after the system start-up is divided into several timeslices according to Geometric Sequence; And calculate the ratio that the packet count of being sent in each timeslice accounts for the total packet number; Constitute a vector, and utilize the P2P-TV flow in the SVMs recognition network.Document [3] obtains the PPLive nodal information in the network through analyzing the PPLive message structure through structure node list request message, thereby has proposed a kind of method of active detecting PPLive stream.The method of present these identification P2P-TV video flowing still exists the defective that discrimination is not high enough, identification lags behind and the nodal information survival time is long, needs development better recognition method.
Summary of the invention
The objective of the invention is the defective that discrimination is not high enough, identification lags behind and the nodal information survival time is long that exists to the present method of identification P2P-TV video flowing, propose a kind of method that from network traffics, identifies multiple P2P-TV application system video flowing real-time and accurately.
Technical scheme of the present invention is:
1. the method for the multiple P2P-TV application video flows of Real time identification (is called for short based on didactic video flowing identification (Heuristic-based Identifying Video Flows, HIVF) method), it is characterized in that, comprise the following steps:
A. initialization step: obtain the IP address of respective server and deposit among the server address collection ServIPAddr by the server domain name information (referring to table 1) of the P2P-TV system that is identified; By preceding n the byte (n ∈ 2～5) of the UDP of the P2P-TV system message application layer that is identified as tagged word (referring to table 2) put into application layer characteristic word table StringBase; Construct an informational table of nodes NodeSet, to store the current host IP address of having discerned that moves P2P-TV, each address list item all has a time T TL related with it, and NodeSet is initially sky, continues;
B. preliminary identification step:,, judge through hash function whether it belongs to existing and flow by four-tuple { source IP address, purpose IP address, source port number, destination slogan } information if stream type is unknown to the new message of the network link of each arrival; If the known step B that then is back to of this stream record type; Otherwise, when message is TCP grouping then commentaries on classics C, when message is that UDP divides into groups to change D;
C. discern step: the server ip address among message purpose IP address and source IP address and the server address collection ServIPAddr is compared with server communication; If server address is concentrated the purpose IP matching addresses that an IP address and a message are arranged; P2P-TV type under source IP address that then will divide into groups and the associated server is put into NodeSet; And to establish corresponding TTL be 10, is back to step B; Otherwise directly be back to step B;
The step of D. mating the application layer tagged word: compared in the message source address among message source IP address and purpose IP address and the NodeSet, if message source IP address and purpose IP address all not in NodeSet, are back to step B; Otherwise with corresponding P2P-TV application layer tagged word comparison among the 1st～5 byte of message application layer and the StringBase, if do not match continuation; Otherwise this traffic identifier is the P2P-TV video flowing of corresponding types, and to establish corresponding TTL be 10, is back to step B;
E. upgrade NodeSet table step: whenever just check all non-NULL list items of NodeSet through 16 seconds, its ttl value is subtracted 1, if zero this list item of deletion is back to step B; Otherwise be back to step B.
The main server domain name of the various P2P-TV of table 1 system
| The P2P-TV system | The P2P-TV server domain name |
| PPLive | passport.pplive.com，vodchannel.pplive.com， iptable.pplive.com，pp.pplive.com， update.pplive.com，list.pplive.com |
| PPStream | fds.ppstream.com，tvguide.pps.tv，vodguide.pps.tv， msg.ppstream.com，download.ppstream.com， |
| PPStream | stat.ppstream.com，notice.ppstream.com |
| SopCast | as?1.sopserv.com，home.sopserv.com， broker.sopcast.com |
| UUSee | log.uusee.com，update.uusee.com，player.uusee.com， traffic.uusee.com，home.uusee.com |
Annotate: the information in the table 1 is basicly stable, but also may change later on
Several kinds of P2P-TV system applies of table 2 layer tagged word and positional information thereof (0x representes 16 systems)
| The P2P-TV system | UDP message characteristic word | Original position |
| PPLive | ?0x2100 | The 1st byte |
| PPStream | ?0x004300 | The 2nd byte |
| SopCast | ?0xffff | The 1st byte |
| UUSee | ?0x0909 | The 1st byte |
Annotate: table 2 information is applicable to that the version number of recent P2P-TV application system: PPLive is 2.2.26.0002, and PPStream is 2.3.550.1950, and SopCast is 3.0.3, and UUSee is 5.9.710.2.
Utilize each node all to have the characteristics of constant UDP listening port; Construct a listening port table ListenPort; Obtain the listening port number of each node and be recorded among the ListenPort through statistics, at this moment can adopt the higher port identification method of efficient to come identification video stream.
The present invention has the following advantages with respect to prior art:
1, discrimination is high.Than existing recognition methods, the present invention has high recognition, lower identification error rate.This mainly has benefited from the HIVF method and has adopted two stage identifyings: with the process of server communication, be the behavior according to the necessary access server address set of P2P-TV node; Application layer tagged word matching process, several packet package are drawn together the application layer tagged word before the stream.
2, efficient is higher, and is strong in real time.Through at first getting rid of the stream of identification types, the method process object of making greatly reduces; Recognition methods has lower computational complexity, can in time handle all groupings on (can not overstock) network link by real-time online, requires solution.
Description of drawings
Fig. 1 is the environment of embodiment of the invention operation.
Fig. 2 is the corresponding HIVF method flow diagram of the embodiment of the invention.
Embodiment
Bottom combines accompanying drawing and embodiment that the present invention is done explanation further.
At first need provide the needed environment of recognition methods provided by the invention; As shown in Figure 1: the software of on the PC of Intel-Linux framework, installing and move the HIVF recognition methods of the present invention that has; The 100/1000Mb/s Ethernet card of this PC is connected on the LAN switch of access network trunk, and enables to receive all flows on the link.If under high speed network environment, use recognition methods of the present invention, should consider to realize relative identifying method with hardware.
The system configuration of moving identification P2P-TV video flowing provided by the invention is following: installation and operation are based on the software of HIVF of the present invention on the PC of Intel-Linux framework, and the 100/1000Mb/s Ethernet card of PC links to each other with the network switch.The PC of the dominant frequency 3.0GHz of these PC hardware and above Pentium double-core CPU, internal memory >=2GB, hard disk 80GB, operation Fedora 10 operating systems.
Fig. 2 has provided the workflow diagram of the basic HIVF method of the present invention, and this flow process starts from step S101, is obtained the IP address of respective server and is deposited among the server address collection ServIPAddr by the domain-name information of the P2P-TV system that is identified; Put into application layer characteristic word table StringBase by several bytes before the UDP of the P2P-TV system message application layer that is identified as tagged word; Construct an informational table of nodes NodeSet, to store the current host IP address of having discerned that moves P2P-TV, NodeSet is initially sky, and each address list item all has a time T TL related with it, and NodeSet is initially sky, continues to change S102.
In step S102,,, judge through hash function whether it belongs to existing stream by four-tuple { source IP address, purpose IP address, source port number, destination slogan } information if stream type is unknown to the new message of each arrival; If the known commentaries on classics of this stream record type S102; Otherwise, when message is TCP grouping then commentaries on classics S103, when message is that UDP divides into groups to change S104.
In step S103; Server ip address among message purpose IP address and source IP address and the server address collection ServIPAddr is compared; If server address is concentrated the purpose IP matching addresses that an IP address and a message are arranged; Then change source IP address that S105 will divide into groups and the P2P-TV type under the associated server and put into NodeSet, and to establish corresponding TTL be 10, change S102; Otherwise change S102.
At step S104, if message source and destination address be all in NodeSet, commentaries on classics S102; Otherwise change S106.
In step S106,, do not change S108 if match with corresponding P2P-TV application layer tagged word comparison among the 1st～5 byte of message application layer and the StringBase; Otherwise changeing S107, is the P2P-TV video flowing of corresponding types with this traffic identifier, and to establish corresponding TTL be 10, changes S102.
In step S108, whenever just check all non-NULL list items of NodeSet through 16 seconds, its ttl value is subtracted 1, if zero this list item of deletion changes S102; Otherwise change S102.
This method can withdraw from through interrupt mode.
Embodiment
Present embodiment has provided certain ISP and on PC, has moved based on the software of recognizer of the present invention the P2P-TV video flowing that certain enterprise network enters the Internet is discerned, with the applicable cases of grasping P2P-TV video flowing in this enterprise network and serve as that formulation control and management P2P-TV video flowing scheme provides scientific basis.
Suppose that this enterprise network links to each other with certain ISP's network through the ethernet link of 100/1000Mb/s speed.Operation is based on the software of recognition methods of the present invention on PC; The 100/1000Mb/s Ethernet card of this PC is connected on the LAN switch that is connected with ISP's network, and with this switch configuration for can monitor the all-network flow that links to each other with backbone network.
For example, when this enterprise network directly links to each other with the internet, all machines all have unique Internet IP address, and at this moment the network user uses PPLive, PPStream, SopCast and UUSee application system to watch Web TV.Recognition system will be called the HIVF method, identify the video flowing based on these application of UDP.
Through collecting the above-mentioned P2P-TV Video stream information that identifies, ISP just can count the user and use situation such as quantity, time span, user distribution of P2P-TV Web TV etc.In view of the above, ISP just can formulate corresponding tactical management and control the P2P-TV Web TV.
The present invention does not relate to all identical with the prior art prior art that maybe can adopt of part and realizes.
List of references
K.claffy.Internet?traffic?characterization.San?Diego：University?of?California，1994.
S.Valenti，D.Rossi，M.Meo，M.Mellia，P.Bermolen.Accurate，fine-grainedclassification?of?P2P-TV?applications?by?simply?counting?packets.In?InternationalIn?Traffic?Measurement?and?Analysis(TMA)Workshop?at?IFIP?Networking’09Aachen，Germany，May?2009.
Hu Chao, Chen Ming is permitted to win Li Bing. a kind of distributed PPLive stream real-time detecting system based on reptile. and Polytechnics of PLA journal, 2008,9 (5): 512-516
N.Brownlee，C.Mills，and?G.Ruth.，Traffic?Flow?Measurement：Architecture.RFC?2722，1999.
Claims (2)
1. the method for the multiple P2P-TV application video flows of Real time identification is characterized in that, comprises the following steps:
A. initialization step: obtain the IP address of respective server and deposit among the server address collection ServIPAddr by the server domain name information of the P2P-TV system that is identified; Preceding n byte by the UDP of the P2P-TV system message application layer that is identified put into application layer characteristic word table StringBase as tagged word; Construct an informational table of nodes NodeSet, to store the current host IP address of having discerned that moves P2P-TV, each address list item all has a time T TL related with it, and NodeSet is initially sky, continues;
B. preliminary identification step:,, judge through hash function whether it belongs to existing and flow by four-tuple { source IP address, purpose IP address, source port number, destination slogan } information if stream type is unknown to the new message of the network link of each arrival; If the known step B that then is back to of stream type; Otherwise, when message is TCP grouping then commentaries on classics C, when message is that UDP divides into groups to change D;
C. discern step: the server ip address among message purpose IP address and source IP address and the server address collection ServIPAddr is compared with server communication; If server address is concentrated the purpose IP matching addresses that an IP address and a message are arranged; P2P-TV type under source IP address that then will divide into groups and the associated server is put into NodeSet; And to establish corresponding TTL be 10, is back to step B; Otherwise directly be back to step B;
The step of D. mating the application layer tagged word: compared in the IP address among message source IP address and purpose IP address and the NodeSet, if message source IP address and purpose IP address all not in NodeSet, are back to step B; Otherwise with corresponding P2P-TV application layer tagged word comparison among the 1st～5 byte of message application layer and the StringBase, if do not match continuation; Otherwise this traffic identifier is the P2P-TV video flowing of corresponding types, and to establish corresponding TTL be 10, is back to step B;
E. upgrade NodeSet table step: whenever just check all non-NULL list items of NodeSet through 16 seconds, its ttl value is subtracted 1, if zero this list item of deletion is back to step B; Otherwise directly be back to step B.
2. according to the method for the multiple P2P-TV application video flows of the Real time identification of claim 1; It is characterized in that in steps A; Utilize each node all to have the characteristics of constant UDP listening port; Construct a listening port table ListenPort, obtain the listening port number of each node and be recorded among the ListenPort, at this moment can adopt the higher port identification method of efficient to come identification video stream through statistics.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2009100354594A CN101668035B (en) | 2009-09-28 | 2009-09-28 | Method for recognizing various P2P-TV application video flows in real time |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2009100354594A CN101668035B (en) | 2009-09-28 | 2009-09-28 | Method for recognizing various P2P-TV application video flows in real time |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101668035A CN101668035A (en) | 2010-03-10 |
| CN101668035B true CN101668035B (en) | 2012-08-22 |
Family
ID=41804475
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2009100354594A Expired - Fee Related CN101668035B (en) | 2009-09-28 | 2009-09-28 | Method for recognizing various P2P-TV application video flows in real time |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101668035B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102420830A (en) * | 2010-12-16 | 2012-04-18 | 北京大学 | Peer-to-peer (P2P) protocol type identification method |
| CN102624878B (en) * | 2012-02-23 | 2014-06-18 | 汉柏科技有限公司 | Method and system for identifying P2P (peer-to-peer) protocol on basis of DNS (domain name server) protocol |
| CN103118078B (en) * | 2013-01-16 | 2019-01-22 | 北京邮电大学 | The recognition methods and equipment of P2P flow |
| CN107787003A (en) * | 2016-08-24 | 2018-03-09 | 中兴通讯股份有限公司 | A kind of method and apparatus of flow detection |
| CN109936512B (en) * | 2017-12-15 | 2021-10-01 | 华为技术有限公司 | Flow analysis method, public service flow attribution method and corresponding computer system |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1662047A (en) * | 2004-02-25 | 2005-08-31 | 松下电器产业株式会社 | Video/audio playback apparatus and video/audio playback method |
| CN1866903A (en) * | 2005-05-20 | 2006-11-22 | 上海卓誉数码科技有限公司 | Real-time transmission, storage and reducing device and method for video information on Internet |
-
2009
- 2009-09-28 CN CN2009100354594A patent/CN101668035B/en not_active Expired - Fee Related
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1662047A (en) * | 2004-02-25 | 2005-08-31 | 松下电器产业株式会社 | Video/audio playback apparatus and video/audio playback method |
| CN1866903A (en) * | 2005-05-20 | 2006-11-22 | 上海卓誉数码科技有限公司 | Real-time transmission, storage and reducing device and method for video information on Internet |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101668035A (en) | 2010-03-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10284440B2 (en) | Real-time adaptive processing of network data packets for analysis | |
| CN112714045B (en) | Rapid protocol identification method based on device fingerprint and port | |
| US8694627B2 (en) | Method and apparatus for correlating end to end measurements through control plane monitoring of wireless traffic | |
| US20130282890A1 (en) | In-stream collection of analytics information in a content delivery system | |
| CN101668035B (en) | Method for recognizing various P2P-TV application video flows in real time | |
| CN102148854B (en) | Method and device for identifying peer-to-peer (P2P) shared flows | |
| US20150188879A1 (en) | Apparatus for grouping servers, a method for grouping servers and a recording medium | |
| US9674728B2 (en) | Method and apparatus for managing a degree of parallelism of streams | |
| US10146682B2 (en) | Method and apparatus for improving non-uniform memory access | |
| Fiadino et al. | HTTPTag: A flexible on-line HTTP classification system for operational 3G networks | |
| CN103281211A (en) | Large-scale network node grouping management system and management method | |
| CN114222086B (en) | Method, system, medium and electronic device for scheduling audio and video code stream | |
| US8750146B2 (en) | Method and apparatus for applying uniform hashing to wireless traffic | |
| CN101635831B (en) | Method, device and agent system for sharing node data of P2P live video | |
| US20120155293A1 (en) | Method and apparatus for providing a two-layer architecture for processing wireless traffic | |
| WO2008058884A1 (en) | Method for identifying peer to peer services in a communications network | |
| Yin et al. | Demystifying commercial content delivery networks in China | |
| KR101158369B1 (en) | System for refreshing content using user's location information and content taste, and method thereof | |
| CN113746654A (en) | IPv6 address management and flow analysis method and device | |
| CN110958186A (en) | Network equipment data processing method and system | |
| CN115412465B (en) | Method and system for generating distributed real network flow data set based on client | |
| KR101605187B1 (en) | Apparatus and method for collecting unknown traffic flow to analysis application traffic | |
| Dong et al. | Dynamic Policy Deployment in SDN Switch Based on Monitoring and Analysis of User Behaviors | |
| Shen et al. | The research of a new streaming media network architecture based on the fusion of P2P and CDN | |
| Giacomazzi et al. | Push-pull techniques in peer-to-peer video streaming systems with tree/forest topology |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20120822 Termination date: 20170928 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |