{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T19:48:01Z","timestamp":1771703281302,"version":"3.50.1"},"reference-count":28,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2011,5,1]],"date-time":"2011-05-01T00:00:00Z","timestamp":1304208000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Web"],"published-print":{"date-parts":[[2011,5]]},"abstract":"<jats:p>Data identification and classification is a key task for any Internet Service Provider (ISP) or network administrator. As port fluctuation and encryption become more common in P2P applications wishing to avoid identification, new strategies must be developed to detect and classify their flows. This article introduces a method of separating P2P and standard web traffic that can be applied as part of an offline data analysis process, based on the activity of the hosts on the network. Heuristics are analyzed and a classification system proposed that focuses on classifying those \u201clong\u201d flows that transfer most of the bytes across a network. The accuracy of the system is then tested using real network traffic from a core Internet router showing misclassification rates as low as 0.54% of flows in some cases. We expand on this proposed strategy to investigate its relevance to real-time, early classification problems. New proposals are made and the results of real-time experiments are compared to those obtained in the offline analysis. It is shown that classification accuracies in the real-time strategy are similar to those achieved in offline analysis with a large portion of the total web and P2P flows correctly identified.<\/jats:p>","DOI":"10.1145\/1961659.1961661","type":"journal-article","created":{"date-parts":[[2011,5,24]],"date-time":"2011-05-24T13:04:30Z","timestamp":1306242270000},"page":"1-27","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":10,"title":["Host-Based P2P Flow Identification and Use in Real-Time"],"prefix":"10.1145","volume":"5","author":[{"given":"John","family":"Hurley","sequence":"first","affiliation":[{"name":"Queen\u2019s University of Belfast"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Emi","family":"Garcia-Palacios","sequence":"additional","affiliation":[{"name":"Queen\u2019s University of Belfast"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sakir","family":"Sezer","sequence":"additional","affiliation":[{"name":"Queen\u2019s University of Belfast"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2011,5]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1367497.1367537"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368436.1368445"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1129582.1129589"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/1762888.1762911"},{"key":"e_1_2_1_5_1","unstructured":"BitTorrent. A technical description of the BitTorrent protocol. http:\/\/www.cse.chalmers.se\/~tsigas\/Courses\/DCDSeminar\/Files\/BitTorrent.pdf. BitTorrent . A technical description of the BitTorrent protocol. http:\/\/www.cse.chalmers.se\/~tsigas\/Courses\/DCDSeminar\/Files\/BitTorrent.pdf."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/11863908_1"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/NCA.2006.34"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1269880.1269890"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.peva.2007.06.014"},{"key":"e_1_2_1_10_1","unstructured":"Gnutella -- The Gnutella protocol specification v0.4. http:\/\/www9.limewire.com\/developer\/gnutella_protocol_0.4.pdf. Gnutella -- The Gnutella protocol specification v0.4. http:\/\/www9.limewire.com\/developer\/gnutella_protocol_0.4.pdf."},{"key":"e_1_2_1_11_1","volume-title":"Proceedings of the 5th International Workshop on Peer-to-Peer Systems (IPTPS).","author":"Guha S.","unstructured":"Guha , S. , Daswani , N. , and Jain , R . 2006. An experimental study of the Skype peer-to-peer VoIP system . In Proceedings of the 5th International Workshop on Peer-to-Peer Systems (IPTPS). Guha, S., Daswani, N., and Jain, R. 2006. An experimental study of the Skype peer-to-peer VoIP system. In Proceedings of the 5th International Workshop on Peer-to-Peer Systems (IPTPS)."},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the 16th International Workshop on Quality of Service (IWQoS). 219--228","author":"Hu Y.","unstructured":"Hu , Y. , Chiu , D. , and Lui , J . 2008. Application identification based on network behavioural profiles . In Proceedings of the 16th International Workshop on Quality of Service (IWQoS). 219--228 . Hu, Y., Chiu, D., and Lui, J. 2008. Application identification based on network behavioural profiles. In Proceedings of the 16th International Workshop on Quality of Service (IWQoS). 219--228."},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the IEEE Conference on Communications (ICC\u201908)","author":"Huang G.","unstructured":"Huang , G. , Jai , G. , and Chao , H . 2008. Early identifying application traffic with application characteristics . In Proceedings of the IEEE Conference on Communications (ICC\u201908) . 5788--5792. Huang, G., Jai, G., and Chao, H. 2008. Early identifying application traffic with application characteristics. In Proceedings of the IEEE Conference on Communications (ICC\u201908). 5788--5792."},{"key":"e_1_2_1_14_1","unstructured":"Iana. Port numbers reference http:\/\/www.iana.org\/assignments\/port-numbers. Iana . Port numbers reference http:\/\/www.iana.org\/assignments\/port-numbers."},{"key":"e_1_2_1_15_1","volume-title":"Proceedings of the International Conference on Information Networking (ICOIN). 1--5.","author":"John W.","unstructured":"John , W. and Tafvelin , S . 2008. Heuristics to classify internet backbone traffic based on connection patterns . In Proceedings of the International Conference on Information Networking (ICOIN). 1--5. John, W. and Tafvelin, S. 2008. Heuristics to classify internet backbone traffic based on connection patterns. In Proceedings of the International Conference on Information Networking (ICOIN). 1--5."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/GIIS.2007.4404178"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028804"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080119"},{"key":"e_1_2_1_19_1","unstructured":"Kazaa http:\/\/www.kazaa.com. Kazaa http:\/\/www.kazaa.com."},{"key":"e_1_2_1_20_1","unstructured":"Kulbak Y. and Bickson D. eMule -- The eMule protocol specification. http:\/\/www.cs.huji.ac.il\/labs\/danss\/p2p\/resources\/emule.pdf. Kulbak Y. and Bickson D . eMule -- The eMule protocol specification. http:\/\/www.cs.huji.ac.il\/labs\/danss\/p2p\/resources\/emule.pdf."},{"key":"e_1_2_1_21_1","unstructured":"L7-Filter. Application layer packet classifier for Linux. http:\/\/l7-filter.sourceforge.net\/.  L7-Filter. Application layer packet classifier for Linux. http:\/\/l7-filter.sourceforge.net\/."},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICAS.2006.62"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-31966-5_5"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.4304\/jcm.1.7.36-46"},{"key":"e_1_2_1_25_1","unstructured":"Sandvine. 2009. Report on P2P. http:\/\/www.dslreports.com\/shownews\/Sandvine-P2P-Now-Just-20-Of-Internet-Use-105194. Sandvine . 2009. Report on P2P. http:\/\/www.dslreports.com\/shownews\/Sandvine-P2P-Now-Just-20-Of-Internet-Use-105194."},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/988672.988742"},{"key":"e_1_2_1_27_1","volume-title":"Proceedings of the Conference on Passive and Active Network Management (PAM\u201909)","author":"Zhang M.","unstructured":"Zhang , M. , John , W. , Claffy , K. C. , and Brownlee , N . 2009. State of the art in traffic classification: A research review . In Proceedings of the Conference on Passive and Active Network Management (PAM\u201909) . Zhang, M., John, W., Claffy, K. C., and Brownlee, N. 2009. State of the art in traffic classification: A research review. In Proceedings of the Conference on Passive and Active Network Management (PAM\u201909)."},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/IWNAS.2006.36"}],"container-title":["ACM Transactions on the Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1961659.1961661","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1961659.1961661","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T11:39:36Z","timestamp":1750246776000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1961659.1961661"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,5]]},"references-count":28,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2011,5]]}},"alternative-id":["10.1145\/1961659.1961661"],"URL":"https:\/\/doi.org\/10.1145\/1961659.1961661","relation":{},"ISSN":["1559-1131","1559-114X"],"issn-type":[{"value":"1559-1131","type":"print"},{"value":"1559-114X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2011,5]]},"assertion":[{"value":"2009-05-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2010-07-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2011-05-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}