Abstract
The Peer-to-Peer (P2P) application has taken on a great deal of attention and importance in the last few years. It aggregates many computers in the world and makes use of their combined computing power and storage space. However the network traffic induced by the use of P2P applications is gradually becoming a significant problem. P2P network peers produce large volumes of messages whilst communicating with other peers, especially when file exchanging is occurring. The P2P technologies are also affected by issues regarding the copyright of spreading files of music, movies, or software. There has been much recent research focusing on this topic. The main objective of recent research on P2P networks mostly focuses on how to detect the existence of P2P applications. Their identification, based only on IP address and port number, produces many false positive situations because the listening ports of P2P clients are usually configurable. Therefore we have to identify P2P networks using application layer content. However it won’t be sufficient to detect their existence if we also want to control the P2P traffic. There are many behavior types in a P2P network. To effectively control P2P network traffic we need to identify all of these. In this thesis we first analyze the protocol and connection behaviors of the four most famous P2P networks - Gnutella, FastTrack, edonkey2000, and BitTorrent. Each one represents a classical type of P2P behavior. After knowing what they are and how they work, we will determine the most effective signatures for identifying all behaviors of P2P applications. We examine the effectiveness of our application-layer signatures on an Intrusion Prevention System (IPS) that can drop packets with specific contents inside. Almost all P2P connections are identified and blocked and network bandwidth is saved.