Features Based Approach to Identify the P2P File Sharing

With the improvement of computer networks and the growth of bandwidth, the types of Internet traffic have changed. The P2P file sharing application became the significant source of network traffic. This paper examines the features for P2P file sharing application according to the packets of OSI layer 3 and layer 4. Four features are defined in this paper, including quantity of packet count, percentage of TCP packet count, percentage of specific size of packet count, and percentage of duplicate destination port numbers. Based on these features, the hosts running P2P file sharing application can be identified. The specific signatures in the payload of OSI layer 7 are used to verify which P2P file sharing application the host is running.