HMC: A Novel Mechanism for Identifying Encrypted P2P Thunder Traffic

Thunder (also called Xunlei) is the most popular P2P file sharing application in China and probably the most popular P2P software in term of traffic volume and number of users. Precisely identifying Thunder traffic can help network administrators to efficiently manage their networks. Traditional methods of identifying P2P traffic such as port-based or content-based approaches are ineffective to Thunder traffic, because of its dynamic packet format, flexible port numbers, and payload encryption. In this paper, we developed a novel Heuristic Message Clustering approach (HMC) to identify Thunder traffic, and obtain its state machine and key transaction cycles, thus identifying Thunder traffic fast and accurately. We first evaluate our method in a controlled environment and then with real campus traces. The results show that HMC is able to identify Thunder flows with high precision and low error rate.