Based on these results, we argue that only p2p traffic filtering can provide a pragmatic, yet short-term, solution to this problem.

Our results reveal that: 1) p2p traffic results in up to 30% decrease in detection rate and up to 45% increase in false positive rate 2) due to a partial overlap of traffic behaviors, p2p traffic inadvertently provides an effective evasion cover for high- and low-rate attacks and 3) training an anomaly detector on p2p traffic, instead of improving accuracy, introduces a significant accuracy degradation for the anomaly detector. Four prominent anomaly detectors (TRW-CB, Rate Limiting, Maximum Entropy and NETAD ) are evaluated on this dataset.

In this paper, we collect and use a labeled dataset containing diverse network anomalies (portscans, TCP floods, UDP floods, at varying rates) and p2p traffic (encrypted and unencrypted with BitTorrent, Vuze, Flashget, μTorrent, Deluge, BitComet, Halite, eDonkey and Kademlia clients) to empirically quantify the impact of p2p traffic on anomaly detection. Surprisingly, the impact of p2p traffic on anomaly detection has not been investigated. Recent studies estimate that peer-to-peer (p2p) traffic comprises 40-70% of today’s Internet traffic. We develop and report results for three diverse ISP applications that demonstrate the practicality and flexibility of iSDF, namely distributed VPN (control plane decisions), pay-per-site (rapid deployment), and Bit Torrent blocking (data plane processing). It also includes an application server to disseminate, configure, and update ISP services. We present an ISP service delivery framework (iSDF) that provides ISPs a domain-specific API for network function virtualization by leveraging a programmable middlebox built from commodity home-routers. We show that meeting these constraints necessitates an SDN philosophy for a centralized management plane, a decoupled (from data) control plane, and a programmable data plane at customer premises. We present iSDF, a new SDN-enabled framework that can meet an ISP's service delivery constraints concerning cost, scalability, deployment flexibility, and operational ease. However, ISPs currently do not have a well-defined architecture for rapid, cost-effective, and scalable dissemination of new services. With only access billing no longer ensuring profits, an ISP's growth now relies on rolling out new and differentiated services.

Quant analyzer torrent