Initialization and acquisition of peers in a peers' list in a peer-to-peer network

• US 20050105476A1
• Filed: 09/29/2004
• Published: 05/19/2005
• Est. Priority Date: 11/18/2003
• Status: Active Grant

• Current Assignee: Cisco Systems Israel Ltd. (Cisco Systems, Inc.)
• Original Assignee: P-Cure Limited
• Inventors: Sagy, Ravid, Gotesdyner, Rony
• Granted Patent: US 7,660,889 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1093 Some peer nodes performing special functions
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

A method for creating an initial list of peers in a peer-to-peer (P2P) network comprising initiating a connection from a spy node to a suspect node in the network. A peer list is updated if a transaction between said spy node and said suspect node is successful. If the transaction is not successful; the method is started from the beginning if it is necessary to continue initialization process. On the other hand, if the transaction is not successful and if it is not necessary to continue the initialization process the execution is terminated.

Claims

1. A method for creating an initial list of peers in a peer-to-peer (P2P) network, the method comprising:

a) initiating a connection from a spy node to a suspect node in the network;

b) updating a peer list if a transaction between said spy node and said suspect node is successful;

c) if the transaction is not successful;

continuing with step a if it is necessary to continue initialization process; and

d) if the transaction is not successful and if it is not necessary to continue the initialization process, terminating execution.

2. The method of claim 1, wherein the spy node is added to said P2P network prior to the method steps.

3. The method of claim 1, wherein a node of said P2P network is configured to be a spy node.

4. The method of claim 1, wherein said transaction is one of:

file download, file upload, and query.

5. The method of claim 1, wherein at least one classifying heuristic is used to determine that the transaction is not successful.

6. The method of claim 5, wherein the classifying heuristic is one of:

transaction time, minimum transaction time, maximum transaction time, amount of data, minimum amount of data, maximum amount of data, amount of upstream data, amount of downstream data, ration between upstream and downstream data, number of connections and rate of connections.

7. The method of claim 5, wherein said classifying heuristics is capable of identifying characteristics of said P2P protocol.

8. The method of claim 1, wherein said spy node is configured to generate communication in a desired P2P protocol.

9. The method of claim 8, wherein said P2P protocol is at least one of:

AIM, FastTrack, FreeNet, Gnutella, ICQ, and Napster.

10. The method of claim 1, wherein said network further comprises a packet classifier.

11. The method of claim 10, wherein said packet classifier is operable to classify layer seven.

12. The method of claim 11, wherein said packet classifier is operable to classify encrypted P2P protocols.

13. The method of claim 11, wherein said classification further comprises classification of:

layer two, layer three, layer four, layer five, layer six, packet bundles, flow identification, process flow, transaction time, minimum transaction time, maximum transaction time, amount of data, minimum amount of data, maximum amount of data, amount of upstream data, amount of downstream data, and ration between upstream and downstream data.

14. The method of claim 10, wherein said packet classifier is further capable of monitoring a network traffic to and from said spy node.

15. The method of claim 14, wherein said packet classifier is operable to allow for said updating of the peer list.

16. The method of claim 15, wherein said updating of the peer list comprises:

b1) classifying a source and destination of a packet; and

b2) updating said peer list based on said classification;

17. The method of claim 16, wherein said classification is one of a:

spy, known peer, temporary known peer, known IP address, and unknown user.

18. The method of claim 17, wherein communication from the spy node results in the destination IP address and destination port to be listed in a known peers list if said communication is to one of three nodes:

temporary known peer, known IP address, and unknown user.

19. The method of claim 17, wherein each combination of an IP address and port number is associated with a counter.

20. The method of claim 19, wherein the value of said counter is increased by a predetermined delta value corresponding to said classification.

21. The method of claim 20, wherein a first delta value is added to said counter when communication is made from a known participant to a temporary known participant.

22. The method of claim 20, wherein a second delta value is added to said counter when communication is made from a known participant to a known IP participant.

23. The method of claim 20, wherein a third delta value is added to said counter when communication is made from a known participant to an unknown user.

24. The method of claim 20, wherein a fourth delta value is added to said counter when communication is made from a temporary known participant to a temporary known participant.

25. The method of claim 20, wherein a fifth delta value is added to said counter when communication is made from a temporary known participant to an unknown participant.

26. The method of claim 20, wherein a sixth delta value is added to said counter when communication is made from a known IP participant to a temporary known participant.

27. The method of claim 20, wherein a seventh delta value is added to said counter when communication is made from a known IP participant to a known IP participant.

28. The method of claim 20, wherein if said counter has a value above a minimum value and below a maximum value then a participant is considered to be a member of the P2P network.

29. The method of claim 28, wherein said minimum value and said maximum value are determined over a predefined period of time.

30. The method of claim 17, wherein communication from an unknown user results in the source IP address of said unknown user to be listed in a known IP participants list if communication is to one of the spy node and a known participant.

31. A method for identifying peers to be added to an existing list of peers in a peer-to-peer (P2P) network, the method comprising:

a) getting a tuple from a packet classifier if a P2P protocol matches a predetermined P2P protocol;

b) if IP addresses and port numbers in the tuple correspond to peers in said list of peers then continuing with step a);

otherwise, updating list of peers; and

c) continuing with step a if it is necessary to process more tuples;

otherwise, terminating execution.

32. The method of claim 31, wherein said packet classifier performs classification using at least one classifying heuristic.

33. The method of claim 32, wherein said heuristic is one of transaction time, minimum transaction time, maximum transaction time, amount of data, minimum amount of data, maximum amount of data, amount of upstream data, amount of downstream data, ration between upstream and downstream data.

34. The method of claim 31, wherein said P2P protocol is one of:

AIM, FastTrack, FreeNet, Gnutella, ICQ, and Napster.

35. The method of claim 31, wherein said P2P network further comprises a spy node.

36. The method of claim 31, wherein said packet classifier is further capable of monitoring traffic in the P2P network.

37. The method of claim 36, wherein said packet classifier operable to classify layer seven.

38. The method of claim 37, wherein said packet classifier is further operable to classify encrypted P2P protocols.

39. The method of claim 37, wherein said classification further comprises classification of at least one of layer two, layer three, layer four, layer five, layer six, packet bundles, flow identification, process flow, transaction time, minimum transaction time, maximum transaction time, amount of data, minimum amount of data, maximum amount of data, amount of upstream data, amount of downstream data, ration between upstream and downstream data.

40. The method of claim 35, wherein said packet classifier is further operable to allow for said updating of list of peers.

41. The method of claim 35, wherein said classifier is operable to perform classification into one of a:

spy, known peer, temporary known peer, known IP address, and unknown user.

42. The method of claim 41, wherein communication from the spy node results in the destination IP address and destination port to be listed in a known peers list if said communication is to one of three nodes:

temporary known peer, known IP address, or unknown user.

43. The method of claim 41, wherein for each combination of an IP address and port number is associated with counter.

44. The method of claim 43, wherein the value of said counter is increased by a predetermined delta value corresponding to said classification.

45. The method of claim 44, wherein a first delta value is added to said counter when communication is made from a known participant to a temporary known participant.

46. The method of claim 44, wherein a second delta value is added to said counter when communication is made from a known participant to a known IP participant.

47. The method of claim 44, wherein a third delta value is added to said counter when communication is made from a known participant to an unknown user.

48. The method of claim 44, wherein a fourth delta value is added to said counter when communication is made from a temporary known participant to a temporary known participant.

49. The method of claim 44, wherein a fifth delta value is added to said counter when communication is made from a temporary known participant to an unknown participant.

50. The method of claim 44, wherein a sixth delta value is added to said counter when communication is made from a known IP participant to a temporary known participant.

51. The method of claim 44, wherein a seventh delta value is added to said counter when communication is made from a known IP participant to a known IP participant.

52. The method of claim 44, wherein if said counter has a value above a minimum value and below a maximum value then the participant is considered to be a member of the P2P network.

53. The method of claim 52, wherein said minimum value and said maximum value are determined over a predefined period of time.

54. The method of claim 41, wherein communication from an unknown user results in the source IP address of said unknown user to be listed in a known IP participants list if communication is to one of the spy node and a known participant.

55. A system for initializing a list of peers in a peer-to-peer (P2P) network, said system comprising:

a spy node connected to said network; and

,

a packet classifier operable to classify a P2P tuple and further operable to add a peer to a list of peers based on the classification.

56. The system of claim 55, wherein said spy node is a node in the P2P network.

57. The system of claim 55, wherein said spy node is capable of initiating a connection from said spy node to a suspect node of the network.

58. The system of claim 57, wherein said spy node operable to attempt to perform a transaction between said spy node and said suspect node.

59. The system of claim 58, wherein said spy node is further capable of updating peer lists if said transaction was successful.

60. The system of claim 58, wherein said transaction is one of:

file download, file upload and query.

61. The system of claim 58, wherein the system is operable to use at least one classifying heuristic to determine that the transaction is successful.

62. The system of claim 61, wherein said classifying heuristic is one of transaction time, minimum transaction time, maximum transaction time, amount of data, minimum amount of data, maximum amount of data, amount of upstream data, amount of downstream data, ration between upstream and downstream data.

63. The system of claim 61, wherein said classifying heuristic is capable of identifying characteristics of said P2P protocol.

64. The system of claim 57, wherein said connection is attempted in a P2P protocol of the P2P network.

65. The system of claim 64, wherein said P2P protocol one of:

AIM, FastTrack, FreeNet, Gnutella, ICQ, and Napster.

66. The system of claim 55, wherein said packet classifier operable to classify layer seven.

67. The system of claim 66, wherein said packet classifier is operable to classify encrypted P2P protocols.

68. The system of claim 66, wherein said classification further comprises classification of at least one of layer two, layer three, layer four, layer five, layer six, packet bundles, flow identification, process flow, transaction time, minimum transaction time, maximum transaction time, amount of data, minimum amount of data, maximum amount of data, amount of upstream data, amount of downstream data, ration between upstream and downstream data.

69. The system of claim 55, wherein said packet classifier is further operable to monitor the network traffic to and from said spy node.

70. The system of claim 69, wherein said packet classifier is further operable to allow for said updating of peer lists.

71. The system of claim 70, wherein said packet classifier is operable to classify the source and destination of a packet and update the list of peers based on the classification.

72. The system of claim 71, wherein said classification is to one of a:

spy, known peer, temporary known peer, known IP address, and unknown user.

73. The system of claim 72, wherein communication from the spy node results in the destination IP address and destination port to be listed in a known peers list if said communication is to one of three nodes:

temporary known peer, known IP address, or unknown user.

74. The system of claim 72, wherein each combination of an IP address and port number is associated with a counter.

75. The system of claim 74, wherein the value of said counter is increased by a predetermined delta value corresponding to said classification.

76. The system of claim 75, wherein a first delta value is added to said counter when communication is made from a known participant to a temporary known participant.

77. The system of claim 75, wherein a second delta value is added to said counter when communication is made from a known participant to a known IP participant.

78. The system of claim 75, wherein a third delta value is added to said counter when communication is made from a known participant to an unknown user.

79. The system of claim 75, wherein a fourth delta value is added to said counter when communication is made from a temporary known participant to a temporary known participant.

80. The system of claim 75, wherein a fifth delta value is added to said counter when communication is made from a temporary known participant to an unknown participant.

81. The system of claim 75, wherein a sixth delta value is added to said counter when communication is made from a known IP participant to a temporary known participant.

82. A system for identifying peers to be added to an existing list of peers in a peer-to-peer (P2P) network, the system comprising:

a packet classifier operable to classify a P2P tuple and further operable to add a peer to a peers'"'"' list based on the classification of the tuple; and

,

a list of peers of said P2P network containing at least a peer.

83. The system of claim 82, wherein said system is further operable to get a tuple from said packet classifier if the P2P protocol of said tuple matches a predetermined P2P protocol,

and the system is further operable to update the list of peers if IP addresses and port numbers in the tuple does not correspond to peers already existing in said list of peers.

84. The system of claim 83, wherein said system is further operable to terminate execution if it is not necessary to continue processing further tuples.

85. The system of claim 82, wherein said packet classifier is operable to use at least one classifying heuristic to perform classification.

86. The system of claim 85, wherein said classifying heuristic is one of transaction time, minimum transaction time, maximum transaction time, amount of data, minimum amount of data, maximum amount of data, amount of upstream data, amount of downstream data, ration between upstream and downstream data.

87. The system of claim 82, wherein said P2P protocol is one of AIM, FastTrack, FreeNet, Gnutella, ICQ, and Napster.

88. The system of claim 82, wherein said system further comprises a spy node.

89. The system of claim 82, wherein said packet classifier operable to classify layer seven.

90. The system of claim 89, wherein said packet classifier is further operable to classify P2P protocols.

91. The system of claim 89, wherein said classification further comprises classification of at least one of layer two, layer three, layer four, layer five, layer six, packet bundles, flow identification, process flow, transaction time, minimum transaction time, maximum transaction time, amount of data, minimum amount of data, maximum amount of data, amount of upstream data, amount of downstream data, ration between upstream and downstream data.

92. The system of claim 82, wherein said packet classifier is operable to allow for said updating list of peers.

93. The system of claim 82, wherein said classifier is capable of performing classification into one of a:

spy, known peer, temporary known peer, known IP address, and unknown user.

94. The system of claim 93, wherein communication from a spy node results in the destination IP address and destination port to be listed in a known peers list if said communication is to one of three nodes:

temporary known peer, known IP address, or unknown user.

95. The system of claim 93, wherein each combination of an IP address and port number there is associated with a counter.

96. The system of claim 95, wherein the value of said counter is increased by a predetermined delta value corresponding to said classification.

97. The system of claim 96, wherein a first delta value is added to said counter when communication is made from a known participant to a temporary known participant.

98. The system of claim 96, wherein a second delta value is added to said counter when communication is made from a known participant to a known IP participant.

99. The system of claim 96, wherein a third delta value is added to said counter when communication is made from a known participant to an unknown user.

100. The system of claim 96, wherein a fourth delta value is added to said counter when communication is made from a temporary known participant to a temporary known participant.

101. The system of claim 96, wherein a fifth delta value is added to said counter when communication is made from a temporary known participant to an unknown participant.

102. The system of claim 96, wherein a sixth delta value is added to said counter when communication is made from a known IP participant to a temporary known participant.

103. The method of claim 96, wherein a seventh delta value is added to said counter when communication is made from a known IP participant to a known IP participant.

104. The method of claim 96, wherein if said counter has a value above a minimum value and below a maximum value then the participant is considered to be a member of the P2P network.

105. The method of claim 104, wherein said minimum value and said maximum value are determined over a predefined period of time.

106. The method of claim 92, wherein communication from an unknown user results in the source IP address of said unknown user to be listed in a known IP participants list if communication is to one of two nodes:

spy, or known participant.