Peer-to-peer (P2P) networks are known and used for various purposes such as exchange of data between nodes in the network, —peers in the network—without the need for an intermediary, e.g., a central server providing the data. One popular use of P2P networks is the illegal exchange of copyrighted material.
P2P monitoring is used to monitor P2P exchanges and to determine, e.g., if an exchange is legitimate or not, and if illegitimate, e.g., involving illegal exchange of copyrighted material, to identify one or more of the participants.
Monitoring techniques typically are classified into two types which we call network monitoring and local monitoring herein.
Network monitoring includes using one or more processes, called network monitor, e.g., Internet monitor agents, or simply Internet monitors herein, each running on a device, e.g., a computer system connected to the network. The term “Internet” in Internet monitoring suggests this is applicable only to the Internet, but in fact, network monitoring is applicable to any network in which the activity is being monitored. Typically, the network is the Internet. The device, e.g., the computer running the network monitoring process, e.g., agent is also called a network monitor herein. A network monitor is configured to use one or more P2P protocols, e.g., to join a P2P network to monitor P2P activity in the network being monitored, to collect information on the activity, including information on data exchanged in the activity or activities being monitored, and possibly to act in response to determined information. Network monitoring has advantages, but also has disadvantages.
Local monitoring involves monitoring traffic in a part of the network and analyzing that traffic. One example of local monitoring is a packet sniffer analyzes packets flowing through some point in the network, e.g., that examines packet exchanges at the point in the network and analyzes the packets and/or packet flow to determine what protocols are being used and possibly the data involved in such use. Local monitoring has advantages, but also has disadvantages.
Method embodiments of the present invention include methods that combine one or more features of local monitoring with one or more features of Internet monitoring. Other embodiments include software that when executed implements such a method, and an apparatus that implements such a method.