臺灣博碩士論文加值系統

本論文之P2P封包辨識系統，主要係運用埠號結合封包特徵來進行P2P網路流量的辨識。由於P2P應用程式的出現，造成網路頻寬大量的被P2P流量所佔用，嚴重影響其他網路使用者之網路使用品質，另由於P2P傳遞之檔案通常為非合法授權之檔案，以致有觸法之可能。在資安意識高漲的今日，為能將P2P網路流量進行有效管理，首先需能辨識P2P封包與非P2P封包流量的不同。能有效辨識P2P的網路流量，網路管理人員方可進一步來調整或管制網路頻寬的使用，使得網路品質得以提升。
本研究收集相關P2P封包數據，並根據封包內容進行分類及特徵分析比對，將分析所得之封包特徵以正規表示式進行表示，再依埠號搭配封包特徵，撰寫應用程式來進行自動化封包特徵的比對。為驗證系統之可用性，以實際網路流量進行驗證，擷取企業網際網路流量作為實驗封包數據來源，運用封包特徵辨識方式進行網路流量辨識，以驗證系統是否符合預期結果。並將系統以分散式負載平衡架構進行建構，以驗證系統具延展性，可應付未來網路流量的成長。在驗證系統各項功能後，實驗數據顯示可達良好的運作結果。

The P2P packets Identification system is using the well-known port combine with packet characteristic to detect the P2P network flows. Because of the P2P application appearance, the network bandwidth has been abused by the P2P flows which also make the poor network performance. To manage network flow more effectively, the network administrator first must be able to recognize the difference between P2P flow and non-P2P flow. Then the network administrator may further adjust or control the network bandwidth use to improve network quality.
This research collected the P2P packets data, analyzed and classified the data according to the packet characteristic, used the regular expression to present the packet characteristic and then developed an automation packet characteristic recognizing system. The system was built as load balance processing structure and was testified by capture the real enterprise internet network flow.

書名頁 i
論文口試委員審定書 ii
授權書 iii
中文摘要 iv
英文摘要 v
誌 謝 vi
目 錄 vii
表目錄 ix
圖目錄 x
第一章、前言 1
1.1 背景 1
1.2 動機與目的 1
1.3 研究範圍 3
1.4 論文架構 4
第二章、文獻探討 5
2.1 P2P的運作方式 5
2.2 P2P的應用領域 7
2.3 封包辨識相關研究回顧 8
2.4 平行與分散式處理 10
2.4.1 平行處理之介紹 10
2.4.2 訊息傳遞語言之介紹 11
2.4.3 負載平衡演算法之介紹 12
第三章、系統設計 15
3.1 觀念與作法 15
3.1.1 封包辨識觀念介紹 15
3.1.2 封包特徵解析及比對方式 15
3.1.3 已知埠號結合封包特徵比對的作法 21
3.2 系統規劃 22
3.3 系統運作架構 23
3.4 系統細部流程說明 27
第四章、實驗與實作分析 34
4.1 實驗數據說明 34
4.2 實驗環境配置 38
4.3 系統實驗與分析 40
4.3.1 封包發送系統效能分析實驗 40
4.3.2 辨識率及誤判率分析實驗 42
4.3.3 辨識效率分析實驗 47
4.3.4 分散式架構效能及封包漏失率分析實驗 49
第五章、結論 60
5.1 研究成果 60
5.2 研究限制 60
5.3 未來發展 61
參考文獻 62
附錄一 65

1. Andrew Moore, and Denis Zuev, "Internet Traffic Classification Using Bayesian Analysis Techniques", ACM Press, pp. 50-60, 2005.
2. Andrew Moore, and Konstantina Papagiannaki, "Toward the Accurate Identification of Network Applications", Passive and Active Measurement Workshop 2005(PAM 2005), Boston, MA, USA, March 31 - April 1 2005.
3. Andrew Moore, James Hall, Christian Kreibich, Euan Harris, and Ian Pratt, "Architecture of a Network Monitor", Passive & Active Measurement Workshop 2003(PAM 2003), San Diego, CA, USA, pp. 229-240, 2003.
4. Application Layer Packet Classifier for Linux,
http://l7-filter.sourceforge.net/
5. Cheng Guang, Gong Jian, and Ding Wei, "A New Hash Function for Sampling IP Traffic", October 2005.
6. Cisco Systems, "NetFlow Services Solutions Guide", Version 3, October 2004.
7. Dimitri DeFigueiredo, Antonio Garcia, and Bill Kramer, "Analysis of Peer-to-Peer Network Security using Gnutella", University of California Report, December 2002.
8. Douglas Comer, "Internetworking with TCP/IP Principles, Protocols, and architectures", Fourth Edition, Volume 1, pp. 98, 197-198, 209-251, 2000.
9. Dragos Ilie, David Erman, Adrian Popescu, and Arne Nilsson, "Traffic Measurements of P2P Systems", 2004.
10. Ethereal: A Network Protocol Analyzer,
http://www.ethereal.com/
11. Fivos Constantinou, and Panayiotis Mavrommatis, "Identifying Known and Unknown Peer-to-Peer Traffic", Massachusetts Institute of Technology, 2006.
12. Fulvio Risso, "Challenges in High Performance Network Monitoring", 12th International Conference on Software, Telecommunications and Computer Networks (SoftCom 2004), October 2004.
13. Fulvio Risso, and Loris Degioanni, "An Architecture for High Performance Network Analysis", Proceedings of the 6th IEEE Symposium on Computers and Communications (ISCC 2001), pp. 686-693, July 2001.
14. IANA, "Port numbers",
http://www.iana.org/assignments/port-numbers
15. InMon Corporation''s sFlow, "A Method for Monitoring Traffic in Switched and Routed Networks", http://www.ietf.org/rfc/rfc3176.txt
16. IP Flow Information Export (ipfix), http://www.ietf.org/html.charters/ipfix-charter.html
17. Karl Abere, and Manfred Hauswirth, "An Overview on Peer-to-Peer Information Systems", Swiss Federal Institute of Technology(EPFL), 2002.
18. libpcap project,
http://www.tcpdump.org/
19. Mario Baldi, Elena Baralis, and Fulvio Risso, "Data Mining Techniques for Effective Flow-based Analysis of Multi-Gigabit Network Traffic", Computer Engineering Department, October 2004.
20. Message Passing Interface Forum,
http://www.mpi-forum.org/
21. Napster,
http://www.napster.com.
22. Official IPP2P homepage,
http://ipp2p.org
23. protocol info,
http://www.protocolinfo.org/wiki/Main_Page
24. PVM: Parallel Virtual Machine,
http://www.csm.ornl.gov/pvm
25. Rakesh Agrawal, and Ramakrishnan Srikant, "Fast Algorithms for Mining Association Rules", Proceedings of the 20th VLDB Conference, 1994.
26. Regular Expressions,
http://www.regular-expressions.info/
27. Robert Kruse, Bruce Leung, and Clovis Tondo, "Data Structures and Program Design in C 2nd", International Edition, pp. 353-364,367-371, 1996.
28. SETI@home,
http://setiathome.ssl.berkeley.edu
29. Subhabrata Sen, and Jia Wang, "Analyzing Peer-To-Peer Traffic Across Large Networks". ACM/IEEE Transactions on Networking, Vol. 12, No. 2, pp. 137-150, April 2004.
30. Subhabrata Sen, Oliver Spatscheck, and Dongmei Wang, "Accurate, Scalable In-Network Identification of P2P Traffic Using Application Signatures", WWW2004, New York, USA, May 17-22 2004.
31. Tcptrace,
http://www.tcptrace.org
32. The Linux Virtual Server Project – Linux Server Cluster, http://www.linuxvirtualserver.org/
33. Thomas Karagiannis, Andre Broido, Michalis Faloutsos, and Kc claffy, "Transport Layer Identification of P2P Traffic", ACM Press, pp. 121-134, October 25-27 2004.
34. WinPcap: The Windows Packet Capture Library,
http://www.winpcap.org/
35. Zseby Tanja, Molina Maurizio, Raspall Fredric, and Duffield Nick, "Sampling and Filtering Techniques for IP Packet Selection", Internet Draft , January 2006.
36. 吳富宇，「具負載平衡機制之虛擬伺服器的設計與實作及其應用」，元智大學資訊管理學系，碩士論文，2004年
37. 周豐谷，「P2P資料流偵測」，台灣科技大學電子工程系，碩士論文，2005年