What is the impact of p2p traffic on anomaly detection

摘要: Recent studies estimate that peer-to-peer (p2p) traffic comprises 40-70% of today's Internet [1]. Surprisingly, the impact p2p on anomaly detection has not been investigated. In this paper, we collect and use a labeled dataset containing diverse network anomalies (portscans, TCP floods, UDP at varying rates) (encrypted unencrypted with BitTorrent, Vuze, Flashget, µTorrent, Deluge, BitComet, Halite, eDonkey Kademlia clients) to empirically quantify detection. Four prominent detectors (TRW-CB [7], Rate Limiting [8], Maximum Entropy [10] NETAD [11]) are evaluated dataset. Our results reveal that: 1) in up 30% decrease rate 45% increase false positive rate; 2) due partial overlap behaviors, inadvertently provides an effective evasion cover for high- low-rate attacks; 3) training detector traffic, instead improving accuracy, introduces significant accuracy degradation detector. Based these results, argue only filtering can provide pragmatic, yet short-term, solution problem. We incorporate two classifiers (OpenDPI [23] Karagiannis' Payload Classifier(KPC) [24]) as pre-processors into show existing non-proprietary do have sufficient accuracies mitigate negative impacts detection. Given premise is here stay, our work demonstrates need rethink classical design philosophy focus performing presence traffic. make publicly available evaluation future designed operate