Bittorrent is currently one of the most popular peer-to-peer (P2P) file sharing protocols. However, it incurs such excessive amount of traffic that it may adversely affect users of legacy internet applications. To limit this adverse impact, an efficient methodology for bittorrent identification may be needed. In this paper, we propose a novel approach to identify local bittorrent peers. Our approach is based on behaviors of the choke algorithm, a main algorithm used in bittorrent. An advantage of our approach is that we can identify bittorrent peers without examining the packet pay-load. Therefore, our approach is free from privacy issues and still effective even though the packet payload is encrypted. Unlike previous works, we identify bittorrent hosts at the peer level instead of the flow level. Given that we use only information from network layer instead of transport layer, our work maintains fewer states and achieves robustness to changes in the transport layer. Furthermore, our work is effective even in restricted environments such as networks equipped with NAT devices or firewalls without modifications to existing network equipments. Our experimental result indicates that our approach can efficiently identify most of excessive bandwidth-consuming peers (i.e., peers transfer a large amount of data in our traces) with a low false-positive rate.
['Wanchai Ngiwlay', 'Chalermek Intanagonwiwat', 'Yunyong Teng-amnuay']
Bittorrent peer identification based on behaviors of a choke algorithm