VII Jornadas de Ingeniería Telemática. JITEL 2008 95 ! X%=+-'/!%#!)'!,(%#$,3,1'1,2#!(%!$-43,1+!(%! '7),1'1,2#!?'/'(+!%#!3,-&'/ ! _./$+-!K'#$+)'8'<!J(6'-(+!X';'`'<!X,a%)!O0')!8!b'#,%)!X+-'$2! "#,*%-/,('(!N@?),1'!(%!_'*'--'H! b%7'-$'&%#$+!(%!^6$+&4$,1'!8!c+&76$'1,2#! c'&76/!^--+/'(,'<!UHSSQ!N'&7)+#'! J&',)d!%(6'-(+9&';'#'e6#'*'--'9%/! Abstract— Traffic identification has been based traditionally on transport protocol ports, associating always the same ports with the same applications. Nowadays that assumption is not true and new methods like signature identification or statistical techniques are applied. This work presents a method based on signature identification with some improvements. The use of regular expressions for typical applications has been studied deeply and its use has been improved in the aspects of percentage identification and resources consumption. On the other hand, a flows-record structure has been applied in order to classify those packets that do not verify any regular expression. Results are compared with the opensource related project L7-filter, and the improvements are presented. Finally, detailed regular expressions for analyzed applications are included in the paper, especially P2P applications. I. INTRODUCCIÓN "#! $%&'! (%! %)%*'(+! ,#$%-./! %#! )'! &+#,$+-,0'1,2#! (%! -%(%/!(%!('$+/!%/!)'!,(%#$,3,1'1,2#!(%)!$-43,1+!56%!1,-16)'!7+-! %))'/! 1+#! '7),1'1,+#%/! %#! &68! (,*%-/+/! 1'&7+/9! :'! ,(%#$,3,1'1,2#! 1+#/,/$%! %#! '*%-,;6'-! '! 56.! '7),1'1,2#! 7%-$%#%1%!(%$%-&,#'(+!$-43,1+!(%!)'!-%(<!76(,%#(+!))%*'-!%/$'! ,#(%#$,3,1'1,2#! '! ;-'#6)'-,('(! (%! 3)6=+/! +! ,#1)6/+! (%! 7'56%$%/9! >-'(,1,+#')&%#$%! %/$'! )'?+-! /%! -%'),0'?'! 1+&7-+?'#(+! %)! #@&%-+! (%! 76%-$+! (%)! #,*%)! (%! $-'#/7+-$%! 1+--%/7+#(,%#$%!7+-!%)!56%!/%!A'?B'!%#*,'(+!+!-%1,?,(+!1'('! 7'56%$%<!8'!56%!1'('!'7),1'1,2#!/%!%#1+#$-'?'!A'?,$6')&%#$%! '/+1,'('! 8! (%! &'#%-'! 6#B*+1'! '! 6#! ,(%#$,3,1'(+-! (%! 76%-$+! C)+/!(%#+&,#'(+/!1+&+!D76%-$+/!?,%#!1+#+1,(+/EF!GHI!9!J/$'! ,(%#$,3,1'1,2#!%/!(%!6$,),('(!%#!'6(,$+-B'/!(%!-%(!C1+#+1%-!)+/! /%-*,1,+/! (%&'#('(+/! 7+-! )+/! 6/6'-,+/F<! 1+#$-+)! (%! $-43,1+! C7+(%-! ?)+56%'-! /%-*,1,+/! #+! (%/%'(+/! +! ,#1)6/+! '/7%1$+/! '*'#0'(+/! (%! /%;6-,('(F<! ! 8! 1'),('(! (%! /%-*,1,+! C7+(%-! 7-,+-,0'-!6#'/!'7),1'1,+#%/!3-%#$%!'!+$-'/F9!! K,#! %&?'-;+<! %#! )'! '1$6'),('(<! )'! %/7%1,'),0'1,2#! (%)! /+3$L'-%! (%! 1+&6#,1'1,+#%/! 8! )'/! -%/$-,11,+#%/! ,&76%/$'/! 7+-!7-+M8/!8!3,-%L'))/!A'#!A%1A+!56%!)'!,(%#$,3,1'1,2#!?'/'('! %#!76%-$+/!#+!/%'!3,'?)%9!K%!%/$4#!,&7+#,%#(+!#6%*'/!3+-&'/! (%!7-+1%(%-!%#!)'/!56%!16')56,%-!7-+;-'&'!/%!76%(%!1'&63)'-! '! #,*%)! (%! -%(! 7'-'! %*,$'-! 3,-%L'))/<! /67)'#$'-! ,(%#$,('(%/! +! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !J/$%!$-'?'=+!A'!/,(+!3,#'#1,'(+!7+-!%)!N-+8%1$+!O#$%;-'(+!J*%-;-+L!CPNQR H ONRSSHTUVF! 8! K>WJN! X+&%#$! CPNYRK>WJNRSZHVZZVF! (%! N-+;-'&'/! (%! )'! "#,2#!J6-+7%'9! %#*,'-!12(,;+! &'),1,+/+9!J/%!1'&63)'=%!)+!1+#/,;6%#!'!?'/%! (%! 6$,),0'-! 76%-$+/! '/+1,'(+/! '! +$-'/! '7),1'1,+#%/! ?,%#! 1+#+1,('/! 8! 56%! '! %3%1$+/! 7-41$,1+/! )%/! 7%-&,$'#! 7'/'-! ,#'(*%-$,('/! 8'! 56%! )+/! 1+#$-+)%/! (%! '11%/+! /%! A'#! ?'/'(+! $-'(,1,+#')&%#$%!%#! %)! 3,)$-'(+! 7+-! 76%-$+/! GZI! 9!>'&?,.#!/%! ?'/'#!%#!&+#$'-!$@#%)%/![>>N!56%!7%-&,$%!'$-'*%/'-!7-+M8/! 8! 3,-%L'))/! /,#! &'8+-%/! 7-+?)%&'/! GHI! 9! N'-'! 1+&7),1'-)+! &4/!'@#<!%#!%)!1'/+!(%!'7),1'1,+#%/!NZN!%)!7-+?)%&'!%/!56%! 1'('! ,#/$'#1,'! (%)! 7-+;-'&'! 76%(%! 6$,),0'-! 6#! 76%-$+! (,3%-%#$%!7'-'!(%!#6%*+!%*,$'-!%/$'/!&%(,('/!(%!1+#$-+)<!1+#! )+! 56%! /%! A'1%! &4/! 1+&7),1'('! $+('*B'! )'! ,(%#$,3,1'1,2#! 1+--%1$'! (%)! $-43,1+! ?'/4#(+#+/! @#,1'&%#$%! %#! )+/! ,(%#$,3,1'(+-%/!(%!76%-$+/!GUI!9! JM,/$%#! +$-'/! 7+/,?,),('(%/! 7'-'! )'! ,(%#$,3,1'1,2#! (%! $-43,1+9! N+-! 6#! )'(+! $%#%&+/! /+)61,+#%/! ?'/'('/! %#! 3,-&'/<! 56%! 1+#/,/$%#! %#! ?6/1'-! (%$%-&,#'(+/! 7'$-+#%/! %#! %)! 1+#$%#,(+! (%! )+/! 7'56%$%/! '#'),0'#(+! )+/! 7-+7,+/! ('$+/! ;%#%-'(+/!7+-!%)!#,*%)!(%!'7),1'1,2#!G\I!9!]$-'!7+/,?,),('(!%/! )'! (%! (%1+(,3,1'-! )+/! ('$+/! (%)! 7'56%$%! 7'-'! 1+&7-+?'-! /,! /,;6%! %)! 3)6=+! (%! (%$%-&,#'(+! 7-+$+1+)+! '/+1,'(+! '! 1,%-$'! '7),1'1,2#!GVI!9!!O#1)6/+!/%!76%(%#!%#1+#$-'-!1+&?,#'1,+#%/! (%!'&?'/!&%$+(+)+;B'/!GQI!9!:'!*%#$'='!(%!%/$+/!&.$+(+/!%/! /6! %)%*'('! 7-%1,/,2#! 1+#/,;6,%#(+! %)%*'(+/! 7+-1%#$'=%/! (%! ,(%#$,3,1'1,2#! 1+--%1$'9! K,#! %&?'-;+<! %/$+/! &.$+(+/! ,#$-+(61%#! &61A'! /+?-%1'-;'! (%?,(+! ')! '#4),/,/! (%$'))'(+! 56%! $,%#%#! 56%! A'1%-! (%! )+/! ('$+/! %#1'7/6)'(+/! %#! 1'('! 7'56%$%9!^(%&4/!%/$+/!&.$+(+/!#+!76%(%#!A'1%-!#'('!1+#$-'! '56%))'/! '7),1'1,+#%/! 56%! %#1-,7$%#! /6/! ('$+/! '6#56%! %#! )'! '1$6'),('(!%/$'/!'7),1'1,+#%/!/+#!&,#+-B'!GUI!9! N+-! +$-+! )'(+<! -%1,%#$%&%#$%! A'#! '7'-%1,(+! 7-+76%/$'/! (%! ,(%#$,3,1'1,2#! ?'/'('/! %#! %/$'(B/$,1+/! GZI! 56%! /,! ?,%#! #+! 7-+*%%#! $'#$'! 7-%1,/,2#! %#! )+/! -%/6)$'(+/! /6! 1+/$%! 1+&76$'1,+#')!%/!&61A+!&%#+-!8!7+-!$'#$+!(%!'7),1'1,2#!%#! -%(%/! (%! ')$'! *%)+1,('(9! ^(%&4/! #+! /%! *%#! '3%1$'('/! 7+-! )'! %#1-,7$'1,2#!(%!)+/!3)6=+/!7+-!)+!56%!7'-%1%!6#!1'&7+!7+-!%)! 56%!/%!76%(%!'7+/$'-!%#!%)!36$6-+9! :'!,(%#$,3,1'1,2#!(%)!$-43,1+!(%!-%(!'!#,*%)!(%!'7),1'1,2#! /%! A'! '7),1'(+! 7-,#1,7')&%#$%! '! )+/! 3,-%L'))/! 8! &4/! 1+#1-%$'&%#$%!'!)'!(%$%11,2#!(%)!7-+$+1+)+![>>N9!J/$%!$,7+! (%! ,(%#$,3,1'1,2#! 1+#/$,$68%! /,#! (6('! 6#! 7'/+! &4/! %#! )'! %*+)61,2#! (%! )+/! /,/$%&'/! 3,-%L'))/<! 8'! 56%! %#! %/$%! 1'/+! '#'),0'#!$+(+!%)!7'56%$%!'!#,*%)!(%!'7),1'1,2#!+<!)+!56%!%/!)+! &,/&+<!1+#$-+)'#!#+!/2)+!)+/!76%-$+/!+!)'/!/%/,+#%/<!/,#+! %)! 7-+$+1+)+!56%! /%!6$,),0'!7'-'! )'!1+&6#,1'1,2#<!%*,$'#(+!56%! 76%('#! 3')/%'-/%! /%-*,1,+/9! N+-! %=%&7)+<! /%-B'! 7+/,?)%! 7-+A,?,-! %)! '11%/+! [>>N! ,#(%7%#(,%#$%&%#$%! (%! 56%! %)! 96 VII Jornadas de Ingeniería Telemática. JITEL 2008 ! /%-*,1,+! [>>N! %/$6*,%-'! )%*'#$'(+! %#! %)! 76%-$+! fS! +! %#! %)! 76%-$+! H\V<!8'!56%!%)!3,-%L'))!'#'),0'-B'!%)!7-+$+1+)+!(%!)+/! 7'56%$%/!8!')!*%-![>>N!?)+56%'-B'!)'!1+#%M,2#9!! J/$%! $-'?'=+! /%! 1%#$-'! %#! %)! %/$6(,+! (%! 6#! /,/$%&'! (%! ,(%#$,3,1'1,2#!(%!$-43,1+!?'/'(+!%#! 3,-&'/9!K,!?,%#!%/!(%!)+/! &.$+(+/!&4/!%&7)%'(+/!7'-'!)'!,(%#$,3,1'1,2#!(%!$-43,1+<!#+! %M,/$%#! 7-+76%/$'/! '?,%-$'/! 56%! 7%-&,$'#! -%7),1'-! /6! ,&7)%&%#$'1,2#! 7'-'! '7),1'-)+! '! #%1%/,('(%/! 1+#1-%$'/! #,! $'&7+1+!-%/6)$'(+/!%MA'6/$,*+/!(%!,(%#$,3,1'1,2#!GZI!G\I!9! J)! $-'?'=+! /%! +-;'#,0'! 1+&+! /,;6%9! J#! )'! /,;6,%#$%! /%11,2#!/%!,#$-+(61%#!$-'?'=+/!'#$%-,+-%/!%#!,(%#$,3,1'1,2#!(%! $-43,1+! ?'/'(+! %#! 3,-&'/9! ^! 1+#$,#6'1,2#! /%! ,#$-+(61%! %)! 36#1,+#'&,%#$+!(%!)'/!%M7-%/,+#%/!-%;6)'-%/!1+&+!#@1)%+!(%! )'! ,(%#$,3,1'1,2#! ?'/'('! %#! 3,-&'/9! J#! )'! /%11,2#! 16'-$'! /%! 7-%/%#$'! )'! '-56,$%1$6-'! (%)! /,/$%&'! (%/'--+))'(+9! J#! )'! /%11,2#!56,#$'!8!/%M$'!/%!%M7+#%#!-%/7%1$,*'&%#$%!)'/!$-'0'/! (%!$-43,1+!6$,),0'('/!8!)'!&%=+-'!%#!%M7-%/,+#%/!-%;6)'-%/9!J#! )'! /%11,2#! /.7$,&'! /%! 7-%/%#$'! %)! '#4),/,/! (%)! /,/$%&'! 7-+76%/$+9! N'-'! 3,#'),0'-! /%! 7-%/%#$'#! )'/! 1+#1)6/,+#%/! (%)! $-'?'=+9! II. ESTADO DEL ARTE EN INDENTIFICACIÓN DE TRÁFICO BASADO EN FIRMAS J#!)'!),$%-'$6-'!/%!6$,),0'#!/,/$%&'/!(%!,(%#$,3,1'1,2#!(%! $-43,1+! ?'/'(+! %#! 3,-&'/9! K%! $-'$'! (%! ?6/1'-! 1'(%#'/! %/7%1B3,1'/! (%! $%M$+! +! ('$+/! ?,#'-,+/! %#! %)! 7'8)+'(! (%! )+/! 7'56%$%/9! J/$'/! 1'(%#'/! %/$4#! '/+1,'('/! 6#B*+1'&%#$%! ')! 7-+$+1+)+! (%! )'! '7),1'1,2#! 8! 76%(%#! /%-! 7')'?-'/! 1)'*%<! 1+&'#(+/<!+71,+#%/!+!16')56,%-!+$-+!1+#$%#,(+!,(%#$,3,1'?)%9! J#!GYI!7'-$%#!(%!)'!(+16&%#$'1,2#!(%!)+/!7-+$+1+)+/!8! $-'0'/! (%! $-43,1+! -%')! 7'-'! ,(%#$,3,1'-! )'/! 3,-&'/! '! ?6/1'-! %#! )+/!('$+/!(%!#,*%)!(%!'7),1'1,2#<!1%#$-4#(+/%!%#!'7),1'1,+#%/! NZN9! J*')@'! 1'-'1$%-B/$,1'/! (%! 7-%1,/,2#! C3')/+/! 7+/,$,*+/! 8! 3')/+/! #%;'$,*+/F<! %/1')'?,),('(! C1+&7)%=,('(F! 8! 3+-$')%0'! C'! 7.-(,('/<!-%+-(%#'&,%#$+<!%$19F!(%!)'/!3,-&'/!%#1+#$-'('/9!:'! ?@/56%('! (%! 3,-&'/! /%! ?'/'! %#! %)! 6/+! (%! %M7-%/,+#%/! -%;6)'-%/9! K,#! %&?'-;+<! )'/! 3,-&'/! -%/6)$'#$%/! #+! /%! 7-%/%#$'#!%#!%)!$-'?'=+9! J#! +$-+! $-'?'=+! GfI! ! /%! -%'),0'! 6#! %/$6(,+! (%! ,(%#$,3,1'1,2#!?'/'('!%#!3,-&'/!/+?-%!6#!7%-,+(+!(%!Z!'`+/!8! 6$,),0'#(+!$-43,1+!-%')9!K,#!%&?'-;+<!)'/!3,-&'/!6$,),0'('/!/+#! &68!/,&7)%/<! 6/'#(+!7+-!%=%&7)+!)'!?@/56%('!(%!)'!1'(%#'! Dg_">J::^E! 7'-'! ,(%#$,3,1'-! )+/! 7'56%$%/! 56%! 1+--%/7+#(%#! '! )'! '7),1'1,2#! NZN! ;_6$%))'9! ^(%&4/! /%! 1+&7'-'! /6! %3%1$,*,('(! 1+#! A%6-B/$,1+/! ?'/'(+/! %#! (,-%11,+#%/!ON!8!76%-$+/9!_+!'#'),0'#!)'!7+/,?,),('(!(%!3')/+/! 7+/,$,*+/!7+-!)+!56%!%)!'#4),/,/!#+!%/!1+&7)%$+9! N'-'! '7),1'-! (,/1,7),#'/! (%! 1'),('(! (%! /%-*,1,+! '! )'/! (,3%-%#$%/!'7),1'1,+#%/<!%#!G\I!!6$,),0'#!,(%#$,3,1'1,2#!?'/'('! %#! 3,-&'/9! _+! %#$-'#! %#! (%$'))%/! (%! )+/! 7-+1%(,&,%#$+/! 6$,),0'(+/! %#! 16%#$+! '! 3,-&'/! 8! /%! 1%#$-'#! %#! '`'(,-! 1'-'1$%-B/$,1'/!%/$'(B/$,1'/!'!)'!,(%#$,3,1'1,2#9! J#! 16'#$+! '!7-+76%/$'/!(%!/+3$L'-%! ),?-%! %M,/$%#$%/<!%)! 3,-%L'))! (%! #,*%)! (%! '7),1'1,2#! &4/! 1+#+1,(+! %/! %)! ^77),1'$,+#!:'8%-!N'1a%$!c)'//,3,%-!3+-!:,#6M!C:YR3,)$%-F![7]9! J)! :YR3,)$%-! %/! 6#! 1)'/,3,1'(+-! (%! 7-+$+1+)+/! ?'/'(+! %#! _%$3,)$%-hON$'?)%/! (%! :,#6M<! %)! 16')! ,(%#$,3,1'! 7'56%$%/! '! #,*%)! (%! '7),1'1,2#! &%(,'#$%! %M7-%/,+#%/! -%;6)'-%/9! J/$%! 7-+8%1$+! /+7+-$'! 6#'! ;-'#! *'-,%('(! (%! 7-+$+1+)+/! (%/(%! [>>N! '! &')L'-%! 7'/'#(+! 7+-! (,*%-/+/! $,7+/! (%! NZN! %! ,#1)6/+! ,(%#$,3,1'1,2#! (%! 3,1A%-+/9! N'-'! 1'('! 6#+! (%! %))+/! '7+-$'! /6! 1+--%/7+#(,%#$%! %M7-%/,2#! -%;6)'-! 8! )+/! 1)'/,3,1'! /%;@#! )'! 7-%1,/,2#! %#! )'! ,(%#$,3,1'1,2#! 8! )'! *%)+1,('(! (%! )'! &,/&'9! :YR3,)$%-! $-'?'='! '7),1'#(+! %M7-%/,+#%/! -%;6)'-%/! 7'56%$%!'!7'56%$%!$%#,%#(+!%#!16%#$'!3)6=+/!&'#$%#,(+/!7+-! _%$3,)$%-9! ^(%&4/! 1+--%! '! #,*%)! (%! a%-#%)! =6#$+! '! _%$3,)$%-hON$'?)%/! 7+-! )+! 56%! %/! 1+&7)%=+! '7),1'-! /6! 12(,;+! 7'-'!+$-'/!$'-%'/!(,3%-%#$%/!'!)'!+-,;,#')9! J#! %/$%! $-'?'=+! /%! -%'),0'! 6#'! +7$,&,0'1,2#! (%! )'/! %M7-%/,+#%/!-%;6)'-%/!7'-'!,(%#$,3,1'1,2#!(%!'7),1'1,+#%/<!/%! 7-%/%#$'#! &%=+-'/!%#!%)! &+$+-!(%!?@/56%('/!8!/%!(%$'))'-4#! -%/6)$'(+/! %MA'6/$,*+/! 1+&7'-'#(+! )+/! &,/&+/! 1+#! )+/! 56%! +?$,%#%!)'!'7),1'1,2#!:YR3,)$%-9! III. EXPRESIONES REGULARES :'/! %M7-%/,+#%/! -%;6)'-%/! /+#! 6#'! /%-,%! (%! 1'-'1$%-%/! 56%! 3+-&'#! 6#! 7'$-2#<! #+-&')&%#$%! -%7-%/%#$'$,*+! (%! +$-+! ;-67+! (%! 1'-'1$%-%/! &'8+-<! (%! $')! 3+-&'! 56%! 7+('&+/! 1+&7'-'-!%)!7'$-2#!1+#!+$-+!1+#=6#$+!(%!1'-'1$%-%/!7'-'!*%-! )'/!1+,#1,(%#1,'/!GHSI!9!:'!,(%#$,3,1'1,2#!(%!7'56%$%/!?'/'('! %#! 3,-&'/! 6$,),0'! )'/! %M7-%/,+#%/! -%;6)'-%/! 1+&+! ?'/%! 36#('&%#$')9! J#!#6%/$-+!1'/+<!/%;@#!%/$'!(%3,#,1,2#<!)'/!%M7-%/,+#%/! -%;6)'-%/! /+#! 1'(%#'/! (%! 1'-'1$%-%/! 56%! ';-67'#! 7+/,?,),('(%/! %#! $+-#+! '! )'! ?@/56%('! (%! 6#! (%$%-&,#'(+! 7'$-2#!(%!6#!7-+$+1+)+!(%#$-+!(%!6#!1+#$%#,(+!&'8+-<!56%!%#! #6%/$-+! 1'/+! 1+--%/7+#(%! ')! 7'8)+'(! (%)! 7'56%$%! +! (%! )+/! 7'56%$%/! '! '#'),0'-9! J/$+! /,;#,3,1'! 56%! &%(,'#$%! 6#'! %M7-%/,2#! -%;6)'-! ?,%#! (%3,#,('! 7+(%&+/! -%'),0'-! )'! ?@/56%('! (%! 16')56,%-! 1'(%#'! 56%! 56%-'&+/<! 1+&+! 6#! #@&%-+! (%! $%).3+#+! (%)! 56%! /'?%&+/! 7'-$%! %#! 6#'! ;6B'! $%)%32#,1'<! ?6/1'-! %#! 6#'! 74;,#'! L%?! ');@#! ('$+! +! 7')'?-'! (%)! 56%! /'?%&+/! 7'-$%! (%! /6! 1+#$%#,(+<! +! ,#1)6/+<! 1+&+! %/! #6%/$-+! 1'/+<! %#1+#$-'-! 7'$-+#%/! 7-%*,'&%#$%! (%3,#,(+/! %#! )+/!7'56%$%/!56%!'$-'*,%/'#!)'!-%(9! J#! -%'),('(<! )'/! %M7-%/,+#%/! -%;6)'-%/! /+#! )'! ?'/%! (%! 7-+;-'&'1,2#!(%!16')56,%-!$,7+!(%!?@/56%('<!8'!/%'!/,&7)%!+! '*'#0'('<!)+!56%!(%/%&?+1'!%#!/6/!#6&%-+/'/!'7),1'1,+#%/9! J#!#6%/$-+!1'/+<!)'/!%M7-%/,+#%/!-%;6)'-%/!/+#!)'!A%--'&,%#$'! 56%!/%!#%1%/,$'!7'-'!';-67'-!$+('/!)'/!+71,+#%/!(%!?@/56%('! (%)! 7'$-2#9! N+-! %=%&7)+<! %#! %)! 1'/+! -%')! (%)! 7-+$+1+)+! ;_6$%))'<! /%! 76%(%! (%1,(,-! 56%! 16')56,%-! 7'56%$%! 56%! 1+#$%#;'! ')! 1+&,%#0+! (%)! &,/&+! 6#'! (%! )'/! (+/! /,;6,%#$%/! )B#%'/!$,%#%!6#'!')$'!7-+?'?,),('(!(%!7%-$%#%1%-!')!7-+$+1+)+! ;_6$%))'d! gnutella get /uri-res :'/! %M7-%/,+#%/! -%;6)'-%/! 1+#/,;6%#! ';-67'-! %/$'/! (+/! 1'(%#'/! (%! ?@/56%('/! $+$')&%#$%! (,3%-%#1,'('/! %#! 6#'! /+)'! /+)61,2#!(%!?@/56%('9!^!)'!*%0!7%-&,$%#!'7),1'-!+71,+#%/!(%! ?@/56%('<! 1+&+! 56%! )'! 1'(%#'! 56%! /%! (%/%'! %#1+#$-'-! /2)+! /,-*%! /,! /%! %#16%#$-'! ')! 1+&,%#0+! (%)! 7'56%$%<! +! ,#1)6/+! (%3,#,-! 6#! 1'-41$%-! %/7%1B3,1+! +! 6#'! 1'#$,('(! *'-,'?)%! (%! 1'-'1$%-%/!56%! /%!76%(%#!%#1+#$-'-! $-'/!)'!7')'?-'!;_6$%))'<! 1+&+!%)!1'-41$%-!A%M'(%1,&')!iMZS!+!%)!iMZP9!c+#!$+('/!%/$'/! +71,+#%/<! )'! %M7-%/,2#! -%;6)'-! (%)! 7-+$+1+)+! ;_6$%))'! 56%('-B'!(%!)'!/,;6,%#$%!3+-&'d! VII Jornadas de Ingeniería Telemática. JITEL 2008 97 ! ^(gnutella[\x20\x2f]|get /uri-res) J#! %/$'! %M7-%/,2#! -%;6)'-! /%! 76%(%#! %#1+#$-'-! (+/! 7'-$%/!(,3%-%#1,'('/9!J)!1'-41$%-!DjE!/,;#,3,1'!56%!7'-'!56%!)'! %M7-%/,2#!/%!16&7)'<!?'/$'!1+#!56%!/%'!1,%-$'!6#'!/+)'!(%!)'/! (+/!+71,+#%/!56%!/%!/,$@'#!'!/6!,056,%-('!8!(%-%1A'9!J#!%/$%! 1'/+<!)'/!(+/!+71,+#%/!/+#!)'/!56%!8'!A%&+/!1+&%#$'(+d! %M7-%/,2#!-%;6)'-<!/2)+!'/6&,%#(+!56%!$+(+/!)+/!7'56%$%/!(%! 6#!&,/&+!3)6=+!7%-$%#%1%#!'!)'!&,/&'!'7),1'1,2#9! K,! /%! -%1,?%#! 7'56%$%/! (%)! &,/&+! 3)6=+! /%! '1$6'),0'! %)! $,&%/$'&79! J/$%! $,&%/$'&7! /%! 6$,),0'-4! 7'-'! '7),1'-! 6#! $%&7+-,0'(+-! 56%! 7%-&,$'! ),?%-'-! )'/! %/$-61$6-'/! (%! 3)6=+/! 56%!#+!A'#!;%#%-'(+!$-43,1+!%#!)+/!@)$,&+/!&,#6$+/9!! ! gnutella[\x20\x2f] get /uri-res J)! 1'-41$%-! DkE! 56%! '7'-%1%! ')! 1+&,%#0+! ,#(,1'! 56%! $+(+!)+!56%!)%!/,;6%!(%?%!%/$'-!')!1+&,%#0+!(%)!7'56%$%<!7+-! )+!56%!#+!#+/!/%-*,-4!6#!7'56%$%!56%!$%#;'!6#'!(%!%/$'/!(+/! 1'(%#'/!%#!6#'!7+/,1,2#!(,3%-%#$%9!! IV. ARQUITECTURA DEL SISTEMA A. Introducción :'! '7),1'1,2#! (%/'--+))'('! 7'-'! )'! ,(%#$,3,1'1,2#! (%! $-43,1+!(%!-%(!'!#,*%)!(%!'7),1'1,2#!&%(,'#$%!%)!6/+!(%!3,-&'/! /%!A'!(%#+&,#'(+!l%NO9! J)!7-+;-'&'!$,%#%!(+/!$,7+/!(%!36#1,+#'&,%#$+<!%#!*,*+! 8! 1+#! $-'0'/9! J)! &+(+! (%! 36#1,+#'&,%#$+! %#! *,*+! $+&'! %)! 1+#$-+)! (%! )'! $'-=%$'! (%! -%(<! 1'7$6-'! )+/! 7'56%$%/!56%! ))%;'#! %#!$,%&7+!-%')!8!)+/!*'!'#'),0'#(+!/%;@#!/%!1'7$6-'#9!J)!+$-+! &+(+!(%!36#1,+#'&,%#$+!%/!%)!'#4),/,/!(%!$-'0'/!7-%*,'&%#$%! 1'7$6-'('/<! 36#1,+#'),('(! @$,)! 7'-'! /6! %*')6'1,2#! 1+#! 6#! $-43,1+! 1+#$-+)'(+9! X%(,'#$%! %/$%! &+(+! /%! 76%(%! -%'),0'-! (,3%-%#$%/! ?@/56%('/! /+?-%! )'/! $-'0'/! /%;@#! )+! 56%! ,#$%-%/%! %/$6(,'-!%#!1'('!&+&%#$+9!! B. Identificación de paquetes "#'! *%0! 56%! /%! A'! ,(%#$,3,1'(+! 6#! 7'56%$%! &%(,'#$%! 6#'!(%!)'/!3,-&'/!(%!)'!?,?),+$%1'!(%!%M7-%/,+#%/!-%;6)'-%/<!)+! 56%! -%'),0'! %)! /,/$%&'! %/! ;6'-('-! 6#! -%;,/$-+! (%! 7'56%$%/! (%$%1$'(+/9! b%! %/$'! 3+-&'<! 16'#(+! /%! %#16%#$-%#! 7'56%$%/! 56%!#+!A'#!/,(+!,(%#$,3,1'(+/!7+-!#,#;6#'!%M7-%/,2#!-%;6)'-<! %)!/,/$%&'!%/!1'7'0!(%!1)'/,3,1'-!%/$+/!7'56%$%/!7+-!/,&,),$6(! 1+#! %)! A,/$+-,')! (%! )+/! 7'56%$%/! 56%! /%! A'#! (%$%1$'(+! 7+-! %M7-%/,2#!-%;6)'-!7-%*,'&%#$%9!J#!%)!%/56%&'!(%!)'!P,;6-'!H! /%!&6%/$-'!%)!7-+1%/+!56%!/,;6%!1'('!7'56%$%!56%!/%!'#'),0'9! J)! 7-+1%/'(+! /%! -%'),0'! '! #,*%)! (%! 6/6'-,+! 1+#! )'! 3)%M,?,),('(! 56%! %/+! /67+#%! 7'-'! %)! (%/'--+))+! (%! '7),1'1,+#%/! '! &%(,('9! ^! (,3%-%#1,'! (%! :YR3,)$%-<! $+(+/! )+/! 7'56%$%/! /%! 1+&7-6%?'#! 1+#$-'! )'/! 3,-&'/! (%! )+/! (,3%-%#$%/! 7-+$+1+)+/!'!,(%#$,3,1'-!8!%#!1'/+!(%!#+!*%-,3,1'-!#,#;6#'!/%! '16(%! '! 6$,),0'-! %)! A,/$+-,')! (%! 3)6=+/! 56%! /%! %M7),1'-4! 7+/$%-,+-&%#$%9!:'/!%M7-%/,+#%/!-%;6)'-%/!%/$4#!+7$,&,0'('/! (%! &'#%-'!56%! )'!1'7'1,('(! (%!7-+1%/+! #%1%/'-,+!/%!-%(61%! 1+#! -%/7%1$+! '! )'! (%! :YR3,)$%-! /,#! 7%-(%-! 7+-1%#$'=%/! (%! ,(%#$,3,1'1,2#9! "#'! *%0! 56%! /%! (%$%1$'! 6#! 7'56%$%! 7+-! %M7-%/,2#! -%;6)'-<! )+/! 76%-$+/! 8! )'/! ON/! (%! (,1A+! 7'56%$%! C('$+/! 1'-'1$%-B/$,1+/! (%! 1'('! 3)6=+F! 56%('#! ')&'1%#'(+/! %#! 6#'! %/$-61$6-'! (%! ('$+/! 56%! /%! 1+&%#$'-4! 7+/$%-,+-&%#$%! %#! (%$'))%9! b,1A+/! 3)6=+/! /%! ')&'1%#'#! '! /6! *%0! =6#$+! ')! $,&%/$'&7!(%)!7'56%$%!8!%)!,(%#$,3,1'(+-!(%)!7-+$+1+)+!')!56%! 7%-$%#%1%!(,1A+!7'56%$%9!b%!%/$'!3+-&'!/%!76%(%!,(%#$,3,1'-! %)! -%/$+! (%! 7'56%$%/! (%)! &,/&+! 3)6=+! /,#! 56%! *%-,3,56%#! )'! ! Figura 1 – Esquema de funcionamiento del bucle principal C. Historial de flujos N+-! 6#'! 7'-$%! %/! ,&7+-$'#$%! +7$,&,0'-! )'/! %M7-%/,+#%/! -%;6)'-%/! 7+-56%! 7%-&,$,-4! -%'),0'-! )'! ,(%#$,3,1'1,2#! &4/! -47,('&%#$%9!N+-!+$-+!)'(+<!/%!#%1%/,$'!))%*'-!16%#$'!(%!$+(+/! )+/! 3)6=+/! %/$'?)%1,(+/! %#! 1'('! &+&%#$+! 7'-'! 7+(%-! ,(%#$,3,1'-!$+(+/!)+/!7'56%$%/!(%)!3)6=+!'6#56%!/2)+!7'-$%!(%! %))+/! A'8'#! *%-,3,1'(+! )'! %M7-%/,2#! -%;6)'-! 1+--%/7+#(,%#$%9! J/!)+!56%!(%#+&,#'-%&+/!A,/$+-,')!(%!3)6=+/9! ^)!$%#%-!56%!-%*,/'-!$+(+/!)+/!3)6=+/!')&'1%#'(+/!1'('! *%0! 56%! 56%-%&+/! ,(%#$,3,1'-! 6#! 7'56%$%! #+! -%1+#+1,(+! 7+-! %M7-%/,2#!-%;6)'-<!)'!%/$-61$6-'!56%!')&'1%#'!)+/!3)6=+/!(%?%! %/$'-!7%#/'('!7'-'!A'1%-!?@/56%('/!%3,1,%#$%/9! J)! $,%&7+! (%! 7%-&'#%#1,'! (%! )+/! 3)6=+/! C&+(,3,1'?)%! 7+-!%)!6/6'-,+F!7%-&,$%!%),&,#'-!$+(+/!'56%))+/!3)6=+/!56%!#+! A'#!16-/'(+!$-43,1+!%#!1,%-$+!$,%&7+<!('#(+!1+#!%))+!%)!3)6=+! 7+-! 1%--'(+! 8! %*,$'#(+! 56%! )'! %/$-61$6-'! (%! ('$+/! 1-%01'! ,#(%3,#,('&%#$%9!J)!&+(+!(%!36#1,+#'&,%#$+!%/!&68!/,&7)%<! ?'/$'!$'#!/2)+!1+#!1+&7'-'-!%)!$,%&7+!56%!))%*'!%)!3)6=+!%#!)'! %/$-61$6-'! 1+#! %)! $,%&7+! (%! 7%-&'#%#1,'! (%3,#,(+! 7+-! %)! 6/6'-,+9!K,!/%!*%#!#6%*+/!7'56%$%/!(%!6#!3)6=+!/%!'1$6'),0'-4! %)! $,&%/$'&7! %#! )'! %/$-61$6-'! 8! 1+#! %))+! /%! %M$%#(%-4! %)! $,%&7+!(%!*,('!(%)!3)6=+9!! :'! %/$-61$6-'! 1-%'('! %/! 6#'! *'-,'#$%! (%! $'?)'! (%! A'/A9! :'!%/$-61$6-'!(,/7+#%!(%!6#!#@&%-+!*'-,'?)%!C(%3,#,(+!7+-!%)! 6/6'-,+F! (%! 7+/,1,+#%/! (%! A'/A! /+?-%! 6#! *%1$+-! ,#(%M'(+<! 8! %#! 1'('! 7+/,1,2#! A'8! 6#'! ),/$'! /+?-%! )'! 16')! /%! *'! (,/$-,?68%#(+!)'!,#3+-&'1,2#!(%!)+/!3)6=+/!56%!1+),/,+#'#!%#! %/%! &,/&+! A'/A9! N'-'! /'?%-! /+?-%! 56.! ),/$'! /%! (%?%! ')&'1%#'-!1,%-$+!3)6=+!'7),1'&+/!6#!A'/A!/+?-%!)+/!76%-$+/!8! )'!7'-$%!&4/!*'-,'?)%!(%!)'/!(,-%11,+#%/!ON/!1+&+!&+/$-'&+/! '!1+#$,#6'1,2#d! 98 VII Jornadas de Ingeniería Telemática. JITEL 2008 ! Hash=(Puerto origen + Puerto destino + Byte 3 IP origen * 256 + Byte 4 IP origen + Byte 3 IP destino * 256 + Byte 4 IP destino) Mod (Numero de listas) Tiempo de programa dedicado al procesado de las listas Tiempo de programa dedicado al procesado de los paquetes µsegundos 3000 2500 2000 2500 Conexiones c6'#$+!&%=+-!(,/$-,?6,(+/!%/$.#!)+/!3)6=+/!'!)+!)'-;+!(%! $+('/!)'/!),/$'/<!&%=+-!/%-4!)'!%3,1,%#1,'!(%)!7-+;-'&'!7+-56%! )'/! ),/$'/! /%-4#! &4/! 1+-$'/! 8! )'! ?@/56%('! %#! 1'('! ),/$'! %/! /%16%#1,')<! 1+#! )+! 56%! %)! $,%&7+! (%! ?@/56%('! 1-%1%! 1+#! %)! $'&'`+! (%! )'/! ),/$'/9! J#! )'! P,;6-'! Z! 7+(%&+/! *%-! )'! (,/$-,?61,2#! (%! Z9SSS! 1+#%M,+#%/! (,/$-,?6,('/! '! )+! )'-;+! (%! VS! ),/$'/! 1+#! 6#! A'/A! 56%! /2)+! $,%#%! %#! 16%#$'! )+/! 76%-$+/<! &,%#$-'/! 56%! %#! )'! P,;6-'! U! 7+(%&+/! *%-! )'! (,/$-,?61,2#! (%! )'/! &,/&'/! 1+#%M,+#%/! %&7)%'#(+! %)! A'/A! 56%! A%&+/! 7-+76%/$+9!J/$+/!-%/6)$'(+/!/%!A'#!+?$%#,(+!%#!')-%(%(+-!(%! HV! &,#6$+/! (%! 6#'! 1'7$6-'! %#! *,*+! (%! *'-,+/! 7-+$+1+)+/! 16'#(+!/%!%/$'?'#!%=%16$'#(+!'7),1'1,+#%/!(%!)+/!7-+$+1+)+/! %X6)%! 8! m,$>+--%#$9! J#! )'! 7-,&%-'! A'8! (+/! ),/$'/! 1+#/,(%-'?)%&%#$%! &4/! )'-;'/! 56%! )'/! (%&4/! )+! 56%! /67+#%! &'8+-! $,%&7+! (%! ?@/56%('! &%(,+<! &,%#$-'/! 56%! %#! )'! /%;6#('! )'! (,/$-,?61,2#! (%! 3)6=+/! 7+-! ),/$'! %/! 6#,3+-&%! 8! (%! %/$'! 3+-&'! -%(61,&+/!')! &B#,&+!%)!$,%&7+! %&7)%'(+! 7+-!%)! 7-+1%/+!(%!?@/56%('9! )'/!f!3'/%/!(%)!%/56%&'!%#!56%!/%!A'!(,*,(,(+!%)!&,/&+9!:+/! -%/6)$'(+/!/%!+?$,%#%#!(%!)'!%=%161,2#!(%)!7-+;-'&'!/+?-%!)'/! $-'0'/!')&'1%#'('/!(%!$-43,1+!%b+#a%8<!56%!/%!(%$'))'-4#!%#! )'!/%11,2#!/,;6,%#$%9! :'! P,;6-'! \! &6%/$-'! )+/! -%/6)$'(+/! +?$%#,(+/! (%! (,1A'! %=%161,2#! 7'-'! %)! 1'/+! (%! 6#'! /+)'! ),/$'! C/,#! $'?)'! (%! A'/AF! /+?-%!)'!1'7$6-'!(%!$-43,1+!(%!HV!&,#6$+/!'#$%-,+-9!c'('!?'--'! *%-$,1')! %/! 6#! 7'56%$%! (,3%-%#$%! 8! $'#! /2)+! /%! A'! ;-'3,1'(+! 6#+!(%!1'('!&,)!7'-'!6#'!1+--%1$'!*,/6'),0'1,2#9!! c+&+!/%!76%(%!*%-!%#!)'!;-43,1'<!)+/!7-,&%-+/!7'56%$%/! C)+/! (%! )'! ,056,%-('F! 1+#/6&%#! &68! 7+1+! $,%&7+! (%! 7-+1%/'(+! $+$')9! J#! #%;-+! '7'-%1%! %)! $,%&7+! %&7)%'(+! %#! '7),1'-! )'/! %M7-%/,+#%/! -%;6)'-%/! 8! %#! ;-,/! %)! $,%&7+! (%! 7-+1%/'(+! -%)'1,+#'(+! 1+#! )'! ?@/56%('! %#! %)! A,/$+-,')! 7'-'! '56%))+/!7'56%$%/!56%!)+!#%1%/,$'-'#9!K,#!%&?'-;+<!1+#3+-&%! /%!'*'#0'!%#!)'!%=%161,2#!8!)'!),/$'!/%!*'!))%#'#(+!(%!%#$-'('/! 1+--%/7+#(,%#$%/!'!#6%*+/!3)6=+/<!)'/!3'/%/!56%!(%7%#(%#!(%)! $'&'`+!(%!)'/!),/$'/!/%! *'#!A'1,%#(+! &4/!#+$+-,'/9!['1,'! %)! 3,#')!(%!)'!%=%161,2#<!%)!$,%&7+!(%(,1'(+!'!7-+1%/'-!)'/!),/$'/! ))%;'!'!/%-!(%!&4/!(%!(+/!&,),/%;6#(+/!7+-!7'56%$%9!! 1500 2000 1000 500 1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49 Listas ! 1000 00 00 00 96 00 10 0 80 0 12 0 00 0 13 0 20 0 14 0 40 0 15 0 60 0 16 0 80 0 18 0 00 0 19 0 20 0 20 0 40 0 21 0 60 0 22 0 80 0 24 0 00 0 25 0 20 0 26 0 40 0 27 0 60 0 28 0 80 0 30 0 00 0 31 0 20 0 32 0 40 0 33 0 60 00 84 0 72 0 60 0 00 00 00 48 0 36 0 24 0 0 12 0 00 0 500 500 450 400 350 300 250 200 150 100 50 0 Número de paquete Figura 4 – Tiempo de programa por paquete para una lista 200 180 160 140 120 100 80 60 40 20 00 96 00 10 0 80 0 12 0 00 0 13 0 20 0 14 0 40 0 15 0 60 0 16 0 80 0 18 0 00 0 19 0 20 0 20 0 40 0 21 0 60 0 22 0 80 0 24 0 00 0 25 0 20 0 26 0 40 0 27 0 60 0 28 0 80 0 30 0 00 0 31 0 20 0 32 0 40 0 33 0 60 00 84 0 00 00 72 0 60 0 00 00 00 48 0 36 0 24 0 ! :'! (%3,#,1,2#! (%! 6#! ?6%#! A'/A! '86('! '! (,/$-,?6,-! 1+--%1$'&%#$%! )+/! 3)6=+/! (%$%1$'(+/! %#$-%! $+('/! )'/! ),/$'/! (,/7+#,?)%/9! K,! /%! 1+#/,;6%! &'#$%#%-! )'/! ),/$'/! (,/7+#,?)%/! 1+#! 6#! #@&%-+! -%(61,(+! (%! %#$-'('/! 1+#/%;6,-%&+/! 56%! %)! $,%&7+! 56%! (%(,1'! %)! 7-+;-'&'! '! 7-+1%/'-! )'/! ),/$'/! C?6/1'-! 3)6=+/<! ?+--'-! 3)6=+/! 1'(61'(+/! +! '1$6'),0'-! $,&%/$'&7/F! /%! -%(601'9! b%! %/$'! 3+-&'! (,/&,#6,-%&+/! )+/! $,%&7+/! (%! 7-+1%/'(+! (%! 1'('! 7'56%$%9! ^)! %)%*'-! %)! #@&%-+! (%! ),/$'/! +?$%#(-B'&+/! &%=+-%/! -%/6)$'(+/! A'/$'! %)! 1'/+! 27$,&+! %#! %)! 56%! )'/! ),/$'/! 36%-'#! (%! 6#! %)%&%#$+9! K,#! %&?'-;+<! %/$+! /67+#%!6#!1+#/6&+!(%!-%16-/+/!(%!&%&+-,'!&68!,&7+-$'#$%! 56%!)'/!),/$'/!(,#4&,1'/!/+)*%#$'#9! N'-'! -%'),0'-! %)! %/$6(,+! (%)! $,%&7+! (%! %=%161,2#! (%)! 7-+;-'&'! 7+-! 7'56%$%/! 56%! &+/$-'&+/! %#! )'/! /,;6,%#$%/! 3,;6-'/<! /%! A'#! 1+)+1'(+! 6#+/! &'-1'(+-%/! (%! $,%&7+! 1+#! 7-%1,/,2#!(%!!/;!%#!%)!,#$%-,+-!(%)!7-+;-'&'<!%#!1'('!6#'!(%! Tiempo de programa dedicado al procesado de las listas Tiempo de programa dedicado al procesado de los paquetes µsegundos 0 ! Figura 3 – Distribución sobre un hash bien definido ! 0 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49 Listas 00 1 3 12 0 Conexiones Figura 2 – Distribución sobre un hash mal definido 1500 0 Número de paquete Figura 5 – Tiempo de programa por paquete para 10.000 listas ! VII Jornadas de Ingeniería Telemática. JITEL 2008 99 ! :'! P,;6-'! V! &6%/$-'! )+/! -%/6)$'(+/! +?$%#,(+/! 7'-'! %)! 1'/+! (%! $%#%-! %)! A'/A! 1+#! HS9SSS! ),/$'/! /+?-%! )'! 1'7$6-'! (%! $-43,1+! (%! HV! &,#6$+/! '#$%-,+-9! c'('! ?'--'! *%-$,1')! ')! ,;6')! 56%! %#! %)! 1'/+! '#$%-,+-! %/! 6#! 7'56%$%! (,3%-%#$%<! 8! 1+--%/7+#(%!')!7-,&%-+!(%!1'('!&,)!7'56%$%/9!! J#! %/$%!1'/+!)+/!-%/6)$'(+/!/+#! &61A+! &%=+-%/9! c+&+! 7+(%&+/! *%-!%#! )'! P,;6-'!V<! )+/!-%/6)$'(+/! (%!1'('! 7'56%$%! /%! &'#$,%#%#! ,#(%7%#(,%#$%/! 6#+/! (%! +$-+/! 8! )+/! 7-,&%-+/! 7'56%$%/! $'-('#! 7-41$,1'&%#$%! )+! &,/&+! %#! /%-! 7-+1%/'(+/! 56%!)+/!@)$,&+/9!>'&?,.#!/%!+?/%-*'!56%!$+(+/!)+/!7'56%$%/! %/$4#!7+-!(%?'=+!(%!)+/!ZSS!!/;<!8!56%!)+/!56%!/+?-%7'/'#!)+/! QS! !/;! /%! 1+&7-6%?'! 56%! %/! 7+-56%! /+#! 7'56%$%/! &68! ;-'#(%/! CH9VSS! ?8$%/F<! )+! 56%! /67+#%! &'8+-! $,%&7+! (%! ?@/56%('!%#!)'!%M7-%/,2#!-%;6)'-9!^(%&4/<!'A+-'!)'!3'/%!56%! &4/! $,%&7+! )%! ))%*'! %/! 7-+1%/'-! )+/! 7'56%$%/! 1+#! %M7-%/,2#! -%;6)'-!3-%#$%!')!7-+1%/'(+!-%)'1,+#'(+!1+#!)'/!),/$'/9!! D. Comparativa de versiones Windows-Linux J)! 7-+;-'&'! l%NO! A'! /,(+! (%/'--+))'(+! 7'-'! '&?'/! 7)'$'3+-&'/! n,#(+L/! 8! :,#6M9! ^&?'/! *%-/,+#%/! A'#! /,(+! (%/'--+))'('/! %#! )%#;6'=%! coo! 8! 1+&7'-$%#! ;-'#! 7'-$%! (%! 12(,;+! 1+&@#9! :'! (,3%-%#1,'! 36#('&%#$')! %#$-%! '&?'/! 7)'$'3+-&'/! %/! )'! 6$,),0'1,2#! (%! (,3%-%#$%/! ),?-%-B'/! 7'-'! )'! 1'7$6-'!(%!7'56%$%/!Cn,#71'7!GHZI!h:,?71'7!GHUI!F!8!7'-'!)'! %*')6'1,2#!(%!%M7-%/,+#%/!-%;6)'-%/!Cg-%$'!GH\I!hm++/$!GHVI!F! 1+&+!'7'-%1%!%#!)'!>'?)'!H9!! K,!?,%#!%#!16'#$+!'!)'/!),?-%-B'/!(%!1'7$6-'!'7%#'/!A'8! (,3%-%#1,'/<!%#!)'/!),?-%-B'/!(%!%M7-%/,+#%/!-%;6)'-%/!%M,/$%#! (,3%-%#1,'/! 8! -%/6)$'#! (%! ,&7+-$'#1,'! (%?,(+! ')! ')$+! 1+/$%! 1+&76$'1,+#')! 56%! /67+#%! )'! '7),1'1,2#! (%! %M7-%/,+#%/! -%;6)'-%/9!J#!!GHHI!7+(%&+/!%#1+#$-'-!6#'!1+&7'-'$,*'!%#$-%! '&?'/! ),?-%-B'/! g-%$'! 8! m++/$! 56%! /%! -%/6&%! %#! )+/! -%/6)$'(+/! (%! )'! P,;6-'! Q! '7),1'#(+! (,3%-%#$%/! %M7-%/,+#%/! -%;6)'-%/! /+?-%! $%M$+/! %M$%#/+/9! J#! )'! &'8+-! 7'-$%! (%! )+/! 1'/+/! m++/$! -%(61%! )+/! $,%&7+/! (%! &'#%-'! /,;#,3,1'$,*'9! J#! %3%1$+<! )'! *%-/,2#! :,#6M! (%)! 7-+;-'&'! 1+#/,;6%! $,%&7+/! (%! 7-+1%/'(+! /%#/,?)%&%#$%! ,#3%-,+-%/! '! )+/! (%! )'! *%-/,2#! n,#(+L/<! @#,1'&%#$%! (%?,(+! '! )'/! 7%16),'-,('(%/! (%! 1'('! ),?-%-B'!(%!%*')6'1,2#!(%!%M7-%/,+#%/!-%;6)'-%/9! ! Windows 2000 Profesional 5.00.2195 SP4 Linux Fedora Core 4 2.6.11 n,#N1'7!\9S9H! :,?N1'7!S9T9f! gWJ>^!Z9Q9\! m]]K>!W%;%M!H9U\9H! Milisegundos BOOST '!"! &"! %"! $"! #"! !"! Expresión 2 Expresión 3 Expresión 4 Expresión 5 Expresión 6 Figura 6 – Comparativa Boost-Greta para un texto extenso ! Campo Explicación Type: J/$%!1'&7+!(%3,#%!12&+!'7),1'-!)'!%M7-%/,2#!-%;6)'-d S! /+?-%!('$+/!(%!$-'#/7+-$%!C)'!A'?,$6')F<!Z!/+?-%!('$+/!7+-! %#1,&'!(%!%#)'1%! Name:! _+&?-%!(%!)'!'7),1'1,2#!+!%)!7-+$+1+)+9! Number:! O(%#$,3,1'(+-!(%!7-+$+1+)+9!"#!&,/&+!7-+$+1+)+! 76%(%!$%#%-!*'-,'/!%M7-%/,+#%/!-%;6)'-%/!56%!/%! $+&'-4#!1+&+!7%-$%#%1,%#$%/!')!&,/&+!7-+$+1+)+!/,! 1+&7'-$%#!%/$%!#@&%-+9! TCP UDP NOIP! K+?-%!56.!$,7+!(%!7'56%$%/!/%!'7),1'!J#!%)!1'/+!(%! 56%!)'!%M7-%/,2#!/%'!(%!$,7+!Z<!%/$%!1'&7+!$+&'-4!%)! *')+-!_]ON9! Activated Disactivated! N'-'!$%#%-!+!#+!%#!16%#$'!%)!3,1A%-+!%#!%)!/,;6,%#$%! 7-+1%/'(+9! Expression:! JM7-%/,2#!-%;6)'-!'!?6/1'-9! Tabla 2 – Estructura de los archivos de protocolo ! Type:0 Name: bitTorrent TCP Number:7 TCP Activated Expression:^\x13bittorrent protocol V. ! Expresión 1 :'! 1'-;'! (%! 3,-&'/! '/+1,'('/! '! '7),1'1,+#%/! /%! -%'),0'! (%!&'#%-'!(,#4&,1'!%#!%)!7-+;-'&'9!N'-'!%))+!/%!(%3,#%#!)+! 56%! A%&+/! *%#,(+! '! ))'&'-! '-1A,*+/! (%! 7-+$+1+)+! 7+-! 1'('! '7),1'1,2#! 56%! /%! 56,%-'! /+7+-$'-9! K%! $-'$'! (%! #+! $%#%-! 56%! &+(,3,1'-! %)! 12(,;+! 36%#$%! (%)! 7-+;-'&'! 7'-'! /+7+-$'-! #6%*'/!'7),1'1,+#%/!/,#+!56%!/%'!$'#!/%#1,))+!1+&+!1-%'-!6#! '-1A,*+!(%!$%M$+!1+#!)'/!%/7%1,3,1'1,+#%/!(%!)'!'7),1'1,2#9!! :+/! '-1A,*+/! (%! 7-+$+1+)+! 1+#$,%#%#! )+/! 1'&7+/! &+/$-'(+/! %#! )'! >'?)'! Z<! 8! /%-4! #%1%/'-,+! 1-%'-! 6#! '-1A,*+! 1+#! %/%! 3+-&'$+! 7+-! 1'('! '7),1'1,2#! 56%! /%! (%/%%! /+7+-$'-9! J#! )'! P,;6-'! Y! /%! &6%/$-'! 6#! %=%&7)+! (%)! '-1A,*+! (%! 7-+$+1+)+!7'-'!m,$>+--%#$9! ! Figura 7– Ejemplo del archivo de protocolo BitTorrent para TCP Tabla 1 – Librerías empleadas en cada versión del programa GRETA E. Definición de firmas extensible ! TRAZAS DE TRÁFICO Y PROTOCOLOS SOPORTADOS N'-'!-%'),0'-!6#!%/$6(,+!%#!7-+36#(,('(!(%!)'!1'),('(!%#! )'! (%$%11,2#! (%! )+/! 7-+$+1+)+/<! %#! )+! 56%! -%/7%1$'! '! 7+-1%#$'=%!(%!,(%#$,3,1'1,2#!8!#+!,(%#$,3,1'1,2#<!8!(%#$-+!(%! )'!,(%#$,3,1'1,2#!1+--%1$'!+!,#1+--%1$'<!'(%&4/!(%!)+/!$,%&7+/! (%! 7-+1%/'(+! #%1%/'-,+/<! /%! A'1%! #%1%/'-,+! (,/7+#%-! (%! $-'0'/! (%! $-43,1+! -%')9! ^(%&4/! %/! ,&7-%/1,#(,?)%! 1+#+1%-! '! 7-,+-,! )'/! '7),1'1,+#%/! %#! %/%! $-43,1+! -%')! 7+-! )+! 56%! #+! #+/! /,-*%!6#'!1+)%11,2#!(%!$-'0'/!(%!$-43,1+!16')56,%-'9! N'-'!%/$%!$-'?'=+!A%&+/!1'7$6-'(+!$-'0'/!(%!$-43,1+!-%')! (%! *'-,+/! 1),%#$%/! 7'-'! 1'('! 7-+$+1+)+! %=%16$'#(+! 1'('! 6#'! (%! )'/! '7),1'1,+#%/! /+7+-$'('/<! (%! &'#%-'! 56%! &%(,'#$%! )+/! 3,)$-+/! (%! $-43,1+! /%16#('-,+! 56%! 76%('#! ;%#%-'-! )'/! &456,#'/<! 7+('&+/! %/$'-! /%;6-+/! (%! 1'7$6-'-! %#! 1'('! $-'0'! 100 VII Jornadas de Ingeniería Telemática. JITEL 2008 ! @#,1'&%#$%! $-43,1+! (%! 6#'! (%$%-&,#'('! '7),1'1,2#9! :+! ,&7+-$'#$%! A'! /,(+! +?$%#%-! $-'0'/! 1+#! $-43,1+! %/7%1B3,1+! 7+-! 7-+$+1+)+!8!#+!$'#$+!)'!1'#$,('(!(%!6/6'-,+/!+!$-43,1+!56%!#+! ,&7),1'-4! &4/! 56%! 6#! 1-%1,&,%#$+! ),#%')! %#! %)! $,%&7+! (%! 7-+1%/'(+! 1+#! %)! #@&%-+! (%! 7'56%$%/9! J#! )'! >'?)'! U! /%! 7-%/%#$'#!)'/!$-'0'/!6$,),0'('/!%#!%)!$-'?'=+9!J#!%))'!/%!76%(%! +?/%-*'-! 56%! 7'-'! *'-,+/! 7-+$+1+)+/! /%! A'#! 6$,),0'(+! (,3%-%#$%/! 1),%#$%/! 1+#! %)! +?=%$,*+! (%! $%#%-! %#! 16%#$'! )'/! 7%16),'-,('(%/! (%! ,&7)%&%#$'1,2#! (%)! 7-+$+1+)+! 7+-! 1'('! 1),%#$%9!! c+&+!)'!7-,+-,('(!%#!)'!(%$%11,2#!(%!7-+$+1+)+/!%-'!)'! (%$%11,2#!(%!)'!&'8+-B'!(%!)+/!1),%#$%/!NZN!&4/!%&7)%'(+/<! %)! %/$6(,+! /%! A'! 1%#$-'(+! %#! (,1A+/! 7-+$+1+)+/9! N+-! %))+<! '! 7%/'-!(%!(%$%1$'-!#'('!&4/!56%!Q!7-+$+1+)+/!NZN!/%!%/!1'7'0! (%!1+#$-+)'-!A'/$'!%)!TVp!(%)!$-43,1+!(%!-%(!;%#%-'(+!7+-!%/$%! $,7+!(%!'7),1'1,+#%/!NZN9! ! Protocolo Cliente HTTP P,-%3+M! JM7)+-%-! ]$-+/! FTP DNS eDonkey! gNutella! FastTrack! bitTorrent! Ares! Otros! %b+#a%8! %X6)%! m%'-3),M! :,&%L,-%! KA'-%'0'! m%'-/A'-%! q'0''! ^06-%6/! ?,$>+--%#$! ?,$c+&%$! ?,$>+-#'(+! !>+--%#$! ^-%/! n,#Xl! ,X%/A! Número capturas Tamaño capturas H! H! HT! HS! U! f! Q! H! \! Z! H! U! Z! U! H! H! H! \! Z! H! ZU9YVZ!am! ZZ9QV\!am! f9Y\\!am! Z\V9VYT!am! H9fV\!am! UY9HYH!am! V\9TYZ!am! \Z9fTU!am! \\9HTV!am! HZ9VYH!am! Z9T\Y!am! ZS9\ZY!am! ZU9\YU!am! HY9SfU!am! T9ZHT!am! Y9HfQ!am! \9TU\!am! VZ9VHY!am! Q9HH\!am! Z9U\Z!am! Tabla 3 – Trazas de paquetes empleadas ! c+&+!/%!A'!1+&%#$'(+<!/%!76%(%!%#1+#$-'-!(,*%-/,('(! (%! 1),%#$%/! 56%! /+7+-$'#! %)! &,/&+! 7-+$+1+)+! %/7%1,')&%#$%! %#!%)!1'/+!(%!'7),1'1,+#%/!NZN9!J#!)'!>'?)'!\!/%!&6%/$-'#!)'/! '7),1'1,+#%/! 56%! /%! 76%(%#! %#1+#$-'-! 7'-'! )+/! 7-+$+1+)+/! /+7+-$'(+/!7+-!#6%/$-+!/,/$%&'!1+#!)'/!%M7-%/,+#%/!-%;6)'-%/! (%/'--+))'('/9! c+&+! /%! A'! 1+&%#$'(+<! %/$%! 1+#=6#$+! (%! '7),1'1,+#%/! /+7+-$'('/! %/! 341,)&%#$%! '&7),'?)%! (%3,#,%#(+! %)!'-1A,*+!(%!7-+$+1+)+!7'-'!)'/!'7),1'1,+#%/!56%!/%!56,%-'#! '`'(,-9! VI. MEJORAS EN LAS EXPRESIONES REGULARES b6-'#$%! %)! $-'?'=+! /%! A'! (%(,1'(+! %/7%1,')! ,#$%-./! '! )'! +7$,&,0'1,2#!(%!)'/!%M7-%/,+#%/!-%;6)'-%/!-%/7+#/'?)%/!(%!)'! %3%1$,*,('(! (%! )'! ,(%#$,3,1'1,2#9! J#! ');6#+/! 1'/+/! /%! A'! 7'-$,(+! (%! )'/! %M7-%/,+#%/! :YR3,)$%-! GTI! 8! %#! +$-+/! /%! A'#! &%=+-'(+!+!(,-%1$'&%#$%!1-%'(+!'!7'-$,-!(%!)'!(+16&%#$'1,2#! (%! )+/! 7-+$+1+)+/! 8! (%! $-'0'/! (%! $-43,1+! -%')! +?/%-*'(+! 7'-'! )'/! '7),1'1,+#%/9! K%! A'! 1+#/%;6,(+! &%=+-'-! )+/! 7+-1%#$'=%/! (%! ,(%#$,3,1'1,2#! /,#! 56%! 7+-! %))+! '6&%#$%! )'! $'/'! (%! 3')/+/! 7+/,$,*+/<!%/!(%1,-<!'56%))+/!7'56%$%/!56%!/%!,(%#$,3,1'#!7'-'! 6#'!'7),1'1,2#!16'#(+!%#!-%'),('(!7%-$%#%1%#!'!+$-'9! ! Area Protocolo Clientes RFCs [>>N! b_K! P>N! P,-%3+M<!JM7)+-%-<!]7%-'<!_%$/1'7%999! %b+#a%8! m,$>+--%#$! P2P! ;_6$%))'! _'7/$%-! ^-%/! P'/$$-'1a! Otros c),%#$%/!P>N! %b+#a%8ZSSS<!%X6)%<!:X6)%<!:7A'#$<! KA'-%'0'<!MX6)%<!,X%/Ar! ^))N%%-/<!^mc<!^06-%6/<!m,$c+&%$<!! m,$>+-#'(+<!m,$>+--%#$<!:7A'#$<!! KA'-%'0'<!>-,?)%-<!s>+--%#$r! m%'-KA'-%<!g#61)%6/<!g-+a/$%-<!qc%'/8<! :,&%n,-%<!X+-7A%6/r! _'7,;'$+-<!]7%#_'7<!n,#Xlr! ^-%/!g')'M8<!P,)%c-+1<!qc%'/8r! ;,P><!g-+a/$%-<!,X%/A<!q'0''<!qc%'/8<! X'&&+$A<!&)X'1r! b[cN*Q! c,/1+! KXm! _m_K! K7'##,#;!>-%%! KKbN! WNc! Tabla 4 – Protocolos soportados por XePI ! J#! )'! >'?)'! V! /%! 7-%/%#$'#! )'/! %M7-%/,+#%/! -%;6)'-%/! 3,#')%/! '/+1,'('/! '! 1'('! 7-+$+1+)+! 8! 56%! A'#! ('(+! )+/! &%=+-%/!-%/6)$'(+/9!J#!%)!/,;6,%#$%!'7'-$'(+!/%!7-%/%#$'-4#!%)! '#4),/,/!1+&7'-'$,*+!1+#!:YR3,)$%-9! VII. EVALUACIÓN DE LA IDENTIFICACIÓN >-'/!7-%/%#$'-!)+/!7-+$+1+)+/!56%!%)!/,/$%&'!%/!1'7'0!(%! (%$%1$'-<!56%('!1+&7-+?'-!%)!1+--%1$+!36#1,+#'&,%#$+!(%!%/'! ,(%#$,3,1'1,2#9!:'!@#,1'!36%#$%!7+/,?)%!(%!1+&7'-'1,2#!%/!%)! 7-+8%1$+!:YR3,)$%-<!7+-!)+!56%!/%!A'!-%'),0'(+!6#!%/$6(,+!(%)! 36#1,+#'&,%#$+!(%!f!%M7-%/,+#%/!-%;6)'-%/!-%/7%1$+!'!)'/!56%! /%!76%(%#!%#1+#$-'-!%#!%)!7-+8%1$+!:YR3,)$%-9!! J#! )'! P,;6-'! f! /%! 7-%/%#$'! 6#'! ;-43,1'! 56%! &6%/$-'! %)! 7+-1%#$'=%! (%! ,(%#$,3,1'1,2#! (%! )'/! %M7-%/,+#%/! -%;6)'-%/! (%! l%NO! 8! (%! )'/! (%! :YR3,)$%-! '7),1'('/! 7'56%$%! '! 7'56%$%! /,#! '7),1'-! %)! A,/$+-,')! (%! 3)6=+/9! J#! (,1A'! ;-43,1'! /%! 76%(%! *%-! 1+&+!)'/!%M7-%/,+#%/!(%!l%NO!(%$%1$'#!6#'!1'#$,('(!/,&,)'-! 8!&61A'/!*%1%/!/67%-,+-!'!)'!56%!(%$%1$'#!)'/!%M7-%/,+#%/!(%! :YR3,)$%-9! J#! ');6#+/! 1'/+/! %/'! &%=+-'! %/! /,;#,3,1'$,*'! 1+#! -%/7%1$+!'!:YR3,)$%-<!1+&+!%#!%)!1'/+!(%!^-%/!+!;_6$%))'9!! K,#!%&?'-;+<!1+&+!8'!/%!A'!1+&%#$'(+<!l%NO!$,%#%!6#'! /%;6#('!+7+-$6#,('(!(%!(%$%11,2#!(%!)+/!7'56%$%/!?'/'('!%#! %)!A,/$+-,')!(%!3)6=+/9!K,! 6#! 7'56%$%! #+! *%-,3,1'!)'!%M7-%/,2#! -%;6)'-!8!A'!A'?,(+!+$-+/!7'56%$%/!(%!%/%!&,/&+!3)6=+!56%!/B! A'#! /,(+! ,(%#$,3,1'(+/<! /%! /67+#%! )'! &,/&'! '7),1'1,2#! 7'-'! $+(+/!)+/!7'56%$%/!(%)!3)6=+<!/,%&7-%!56%!))%;6%#!(%#$-+!(%)! $,%&7+! (%! 7%-&'#%#1,'! (%)! @)$,&+! 7'56%$%! (%)! 3)6=+! (%$%1$'(+!(,-%1$'&%#$%!7+-!)'!%M7-%/,2#!-%;6)'-9!J/$'!&%=+-'! #+! )'! 7+/%%! :YR3,)$%-! 56%! @#,1'&%#$%! /%! ?'/'! %#! '7),1'-! %M7-%/,+#%/! -%;6)'-%/! 7'56%$%! '! 7'56%$%9! K,! ,#1)6,&+/! %/$'! VII Jornadas de Ingeniería Telemática. JITEL 2008 101 ! 36#1,+#'),('(<! )+/! 7'56%$%/! 56%! (%$%1$'! l%NO! /+#! &4/! 56%! )+/!56%!(%$%1$'!:Y<!1+&+!/%!76%(%!1+&7-+?'-!%#!)'!P,;6-'!T9! ! ! 100 XEPI % L7 90 NBNS "bN! DNS "bN! eDonkey >cN! "bN! >cN! gNutella "bN! bitTorrent SSDP >cN! "bN! "bN! >cN! FTP ARP! Spanning Tree CISCO LOOP CISCO CDP DHCPv6 Tabla 5 – Expresiones regulares desarrolladas ! J#!%)!1'/+!(%!b_K<!)'!&%=+-'!!#+!%/!$')!(%?,(+!'!56%!%#! )'/! 1+#/6)$'/! (%! b_K! /%! ,#$%-1'&?,'#! Z! 7'56%$%/! A'?,$6')&%#$%! C)'! *%-/,2#! "bNF! 8! 7+-! $'#$+! %)! A,/$+-,')! (%! 3)6=+/!#+!'7+-$'!6#'!&%=+-B'!/,;#,3,1'$,*'9!J#!%)!1'/+!(%!P>N! /%!%/$4#!1+#/,(%-'#(+!@#,1'&%#$%!)'/!1+#%M,+#%/!(%!1+#$-+)! 8! #+! )'/! (%! ('$+/9! J)! /,/$%&'! /%! 7+(-B'! %M$%#(%-! 7'-'! -%1+#+1%-! ! )'/! 1+#%M,+#%/! (%! ('$+/! '/+1,'('/! '! 6#'! (%! 1+#$-+)<!7%-+!%#!%/$%!1'/+!/%-B'!/63,1,%#$%!1+#!,(%#$,3,1'-!)'/! 1+#%M,+#%/! /%;@#! )'/! (,-%11,+#%/! ON! 8! 76%-$+/<! 7+-56%! )+/! 76%-$+/!(%!)'!1+#%M,2#!(%!('$+/!/%!#+$,3,1'#!%M7-%/'&%#$%!%#! )'! 1+#%M,2#! (%! 1+#$-+)9! _+! /%-B'! #%1%/'-,+! 6#! '#4),/,/! (%! 3,-&'/!1+&+!$')9! ! eDonkey fastTrack gNutella FTP ! 100 XEPI % L7 90 80 70 60 50 40 30 20 10 0 eDonkey >cN! ! Figura 8 – Comparativa XePI-L7 de los paquetes detectados por las expresiones regulares de los principales protocolos fastTrack FastTrack 0 gNutella "bN! 10 FTP >cN! RPC 20 DNS >cN! Napster 30 DNS "bN! 40 BitTorrent Ares 50 BitTorrent >cN! "bN! >cN! 60 Ares SMB 70 Ares >cN! kGiMZSRiMY%ItA$$7hCGSHIi9GSRTIFGiMSTRiMS(RuI! tC1+##%1$,+#dj1+#$%#$R$87%dj1+#$%#$R)%#;$Adj('$%dF!! Ck9v\<\wjiM33FiM33KXm! k9v\<\wiM33KXm! kiMSUiM33GiMV'iMV(I99iMSV!! kiM%TGiMQSiMQHiMYSiMYViMYQiMfSRiMfUIj! kiMS(iM33vHY<HYwj'-%/iMZSGSRTI!! kC9GiMSZiMSQIGxRuIo!GxRuIo!GSRTIGSRTIyGSRTI! yGSRTIyGSRTIyzGiMSTRiMS(!RuIoz!CGSRTI! jHSFjHC/%#(j;%$FGxRuIo!zGiMSTRiMS(!RuIozF!! iM33vU<UwGiMSHiM33IiM33vU<UwGiMSHiMSZiMSU! iMS\IiM33iMSHiMfQGiM'SiM'UiM'\iM'V! iM'?iM?VIiM33vU<UwGiMSHiMSZiMSUiMS\I! iM33vU<UwGiMSHiM33IiM33vU<UwGiMSHiMSZiMSU! iMS\IiM33iMSHiMfQGiM'SiM'UiM'\iM'V! iM'?iM?VIiM33vU<UwGiMSHiMSZiMSUiMS\I!! k;%$!Ch9(+L#)+'(hG!RuItjh9/67%-#+(%GRuIjh9/$'$6/G!RuI jh9#%$L+-aG!RuItjh93,)%/jh9A'/A{GSRT'R3IthG!RuItF!A$$7! hH9Hj6/%-R';%#$da'0''jMRa'0''CR6/%-#'&%jR#%$L+-ajR ,7jR/67%-#+(%,7jRM3%-,(jRM3%-6,(j$';Fjk;,*%GSRTIGSRTI GSRTIGSRTIGSRTIGSRTIGSRTIGSRTIyGSRTIyGSRTIy!! k9vZ<ZwiMSHiMHS9iMSH9tiMZSiM\Q!! k9vV<VwGiMSHiMSZI9vQ<QwGiMSHRiMU3IG'R0SRTIGCiMSHR iMU3F'R0ItGiMSZRiMSQIG'R0IvZ<Uw9vZ<ZwGiMSHiMH1IiMPP! kGiM%UiM1VI9vZ<ZwiM33vZ<ZwGiMSHiMSZiMSViMS'iMH\R iMHQiMHfRiMH1iMZSiMZHiMUfiM\SRiM\UiM\QRiMVZiMV\R iMVTiMQSiMfHiMfZiMfVRiMfYiMf?iMf%iMTZiMTUiM'\I! kiM%UGiMS1RiMHQiMZHiMZ\iMT\iMTQRiMT1iMT%iM'SRiM'\I kC;#6$%))'GiMZSiMZ3Ij;%$!h6-,R-%/F!! kCCC9jiMS'FvHQ<HQwGiMSHiMUHiM\HiM\SiM33! iMfSiMfHIiMSHiM33FjCg_bFF!! kiMHU?,$$+--%#$!7-+$+1+)! (HdG'-I(Zd,(ZS!! _]>OP|iMZS9iMZSA$$7hCGSHIi9GSRTIFGiMSTRiMS(!RuI! t[]K>GiMSTRiMS(!RuItc^c[JRc]_>W]:GiMST! RiMS(!RuIt:]c^>O]_GiMSTRiMS(!RuItKJW}JW!! kGiMSTRiMS(!RuIt3$7!! kiM33iMSHiMSfiM3399iM33GiMSHiMSZI!! kiM\ZiM\Z9iM33vU<Uw!! kiM33iM33GiM33iMSHRiMS'IiM33v\U<\Uw!! kiM''iM''9t1,/1+!! k9v\S<\SwiMSZiMZUiMSZiMZU!! 80 HTTP HTTP Expresión regular HTTP Protocolo Tipo ! Figura 9 – Comparativa XePI-L7 de los paquetes detectados usando historial de flujo para XePI J#!16'#$+!')!$,%&7+!(%!%=%161,2#<!/%!76%(%!1+&7-+?'-! %#!)'!P,;6-'!HS!56%!$'#$+!l%NO!1+&+!:YR3,)$%-!/%!&6%*%#!%#! $,%&7+/! /,&,)'-%/! '6#! 16'#(+! )'! ,(%#$,3,1'1,2#! (%! l%NO! %/! &61A+! &'8+-9! J#! 7'-$%! %/! (%?,(+! '! 56%! )'/! %M7-%/,+#%/! -%;6)'-%/!(%!l%NO!/+#!%#!;%#%-')!&4/!-47,('/!56%!)'/!(%!:YR 3,)$%-<!1+#!)+!56%!%)!1+/$%!%M$-'!(%!7-+1%/'(+!(%)!A,/$+-,')!(%! 3)6=+!%/!7%-3%1$'&%#$%!'/6&,?)%!%#!l%NO9!b%!A%1A+<!1+&+!/%! A'! 1+&%#$'(+! '#$%-,+-&%#$%<! %)! 3'1$+-! (%$%-&,#'#$%! (%! )'! *%)+1,('(!(%)!/,/$%&'!*,%#%!3,='(+!1'/,!%M1)6/,*'&%#$%!7+-!)'! %*')6'1,2#!(%!)'/!%M7-%/,+#%/!-%;6)'-%/9! J#! 16'#$+! '! )+/! 3')/+/! 7+/,$,*+/<! l%NO! 8! :YR3,)$%-! +3-%1%#! -%/6)$'(+/! /,&,)'-%/<! 1+#! 3')/+/! 7+/,$,*+/! /,%&7-%! ,#3%-,+-%/! '! 6#! S<Zp<! /')*+! %#! %)! 1'/+! (%)! 7-+$+1+)+! [>>N! 1+&+! /%! 76%(%! *%-! %#! )'! P,;6-'! HH9! N'-'! [>>N! l%NO! $,%#%! 6#'!$'/'!/67%-,+-!')!U<Vp!(%!3')/+/!7+/,$,*+/!7%-+!56%!#+!/%! 1+#/,(%-'! ,&7+-$'#$%! 1+&7'-'(+! 1+#! %)! 7+-1%#$'=%! (%! ,(%#$,3,1'1,2#! 56%! 1+#/,;6%! 3-%#$%! '! :YR3,)$%-9! :'! %M7-%/,2#! -%;6)'-!(%!:YR3,)$%-!7'-'![>>N!%/!&4/!%/$-,1$'<!1+#!)+!56%!)'! ,(%#$,3,1'1,2#! %/! &%#+-! 8! 1+#! %))+! $'&?,.#! )+/! 3')/+/! 7+/,$,*+/9! J#! $+(+!1'/+<!)'!%M7-%/,2#!-%;6)'-!(%![>>N!7'-'! 102 VII Jornadas de Ingeniería Telemática. JITEL 2008 ! l%NO! (%?%-B'! /%-! +?=%$+! (%! %/$6(,+/! 7+/$%-,+-%/! &4/! 7-+36#(+/!1+#!%)!3,#!(%!-%(61,-!)'!$'/'!(%!3')/+/!7+/,$,*+/9!! ! 210 Tiempo XePI Segundos Tiempo L7 180 150 120 90 60 30 eDonkey fastTrack gNutella FTP DNS BitTorrent Ares HTTP 0 ! Figura 10 – Comparativa XePI-L7 del tiempo de procesado 4 XEPI % L7 3,5 3,)$%-9!J)!A,/$+-,')!(%!3)6=+/!7%-&,$%!))%*'-!%/$'(+!(%!$+(+/!)+/! 3)6=+/! %/$'?)%1,(+/! %#! 6#'! -%(! 1+&76%/$+/! 7+-! )+/! 7'56%$%/! 56%! 1+&7'-$%#! )'! $67)'! v,7~+-,;%#<! 76%-$+~+-,;%#<! ,7~(%/$,#+<!76%-$+~(%/$,#+w!C1+#%M,+#%/!>cN!+!3)6=+/!"bNF9! J/$+! 7%-&,$%! ,(%#$,3,1'-! $+(+/! )+/! 7'56%$%/! (%! 6#! 3)6=+! 1+#! $')! (%! 56%! /2)+! 6#+! (%! )+/! 7'56%$%/! A'8'! *%-,3,1'(+! 6#'! (%! )'/! %M7-%/,+#%/! -%;6)'-%/! '/+1,'('/! '! 6#'! '7),1'1,2#9! N'-'! '7),1'1,+#%/!1+#!3)6=+/!(%!(6-'1,2#!,&7+-$'#$%!/%!1+#/,;6%#! &%=+-B'/! /,;#,3,1'$,*'/! %#! %)! 7+-1%#$'=%! (%! 7'56%$%/! ,(%#$,3,1'(+/! /,#! 56%! 7+-! %))+! %&7%+-%! )'! $'/'! (%! 3')/+/! 7+/,$,*+/9! J)!(%/'--+))+!(%!%M7-%/,+#%/!-%;6)'-%/!%/!6#!7-+1%/+!(%! %*+)61,2#! 1+#$,#6'<! 8'! 56%! 1+#/$'#$%&%#$%! /%! (%/'--+))'#! #6%*+/! 7-+$+1+)+/! +! /%! &%=+-'#! )+/! %M,/$%#$%/9! ^(%&4/<! )'! ,(%#$,3,1'1,2#! (%! 1'('! 7'56%$%! %/! 6#! 7-+1%/+! 1+/$+/+! 8! 56%! 1'('!*%0!*'!'!-%/6)$'-!&4/!(,3B1,)!1+#!)'!1+#/$'#$%!&%=+-'!%#! )'! *%)+1,('(! (%! )'/! -%(%/9! J/! 7+-! %))+! 56%! %M,/$%#! +$-'/! $.1#,1'/! ?'/'(+/!%#!A%6-B/$,1+/! &68!7-+&%$%(+-'/! 7%-+!56%! #%1%/,$'#! (%! %/$+/! &.$+(+/! ?'/'(+/! %#! 3,-&'/! 7'-'! ;%#%-'-! )+/! ('$+/! (%! -%3%-%#1,'! +! %#$-%#'&,%#$+! (%)! /,/$%&'! 1+#! &'8+-!7-%1,/,2#9! 3 REFERENCIAS 2,5 [1] 2 [2] 1,5 [3] 1 0,5 [4] eDonkey fastTrack gNutella FTP DNS BitTorrent Ares HTTP 0 ! [5] >9!q'-';,'##,/<!^9!m-+,(+<!_9!m-+L#)%%<q1!c)'338<!'#(!X9!P')+6$/+/9! O/!7Z7!(8,#;!+-!=6/$!A,(,#;y!OJJJ!g)+?%1+&!ZSS\<!b'))'/<!>l<!"K^<! _+*%&?%-!ZSS\9! [6] ^9! n9! X++-%! '#(! q9! N'7';,'##'a,9! >+L'-(! $A%! ^116-'$%! O(%#$,3,1'$,+#! +3! _%$L+-a! ^77),1'$,+#/9! N-+1%%(,#;/! +3! K,M$A! N'//,*%! '#(! ^1$,*%! X%'/6-%&%#$! n+-a/A+7! CN^X! ZSSVF<! m+/$+#<! X^<! X'-1Ah^7-,)!ZSSV9! [7] K9!K%#<! ]9! K7'$/1A%1a<! '#(! b9! n'#;9! ^116-'$%<!K1')'?)%! O#R_%$L+-a! O(%#$,3,1'$,+#! +3! NZN! >-'33,1! 6/,#;! ^77),1'$,+#! K,;#'$6-%/9!! N-+1%%(,#;/! +3! $A%! HU$A! O#$%-#'$,+#')! n+-)(! n,(%! n%?! c+#3%-%#1%<! 779!VHZRVZH<!_|<!"K^<!X'8!ZSS\9! [8] ^)+a!X'(A6a'-!'#(!c'-%8!n,)),'&/+#9!^!:+#;,$6(,#')!K$6(8!+3!NZN! >-'33,1! c)'//,3,1'$,+#9! H\$A! OJJJ! O#$%-#'$,+#')! K8&7+/,6&! +#! X+(%),#;<! ^#')8/,/<! '#(! K,&6)'$,+#! +3! c+&76$%-! '#(! >%)%1+&&6#,1'$,+#! K8/$%&/<! X^Kc]>K! ZSSQ<! 779HYTRHff<! HHRH\! K%7$9!ZSSQ! Figura 11 – Comparativa XePI-L7 de los falsos positivos VIII. CONCLUSIONES :'! ,(%#$,3,1'1,2#! (%! $-43,1+! ?'/'('! %#! 3,-&'/! %/! 36%-$%&%#$%! (%7%#(,%#$%! (%! )'! 1'),('(! (%! )'/! %M7-%/,+#%/! -%;6)'-%/! 6$,),0'('/! %#! )'! ,(%#$,3,1'1,2#9! c'),('(! 7+-! 6#'! 7'-$%! %#! 16'#$+! '! $'/'! (%! ,(%#$,3,1'1,2#! 56%! +?$,%#%#! 8! $'&?,.#!%#!16'#$+!'!)'!$'/'!(%!3')/+/!7+/,$,*+/!56%!-%/6)$'#9! N+-! +$-+! )'(+<! )'! 1'),('(! $'&?,.#! %/$'-4! -%)'1,+#'('! 1+#! %)! $,%&7+!#%1%/'-,+!7'-'!'7),1'-!(%$%-&,#'('!%M7-%/,2#!-%;6)'-d! #+! /%-4! @$,)! 6#'! %M7-%/,2#! &68! )%#$'! '6#56%! ,(%#$,3,56%! 7%-3%1$'&%#$%!%)!$-43,1+!7+-56%!#+!/%-B'!+7%-'$,*'9! J#! %/$%! 1+&7-+&,/+! %/! /+?-%! %)! 56%! #'1%! l%NO! 1+&+! /,/$%&'!(,/%`'(+!7'-'!)'!,(%#$,3,1'1,2#!?'/'('!%#!3,-&'/9!K%! A'#! &%=+-'(+! )'/! %M7-%/,+#%/! -%;6)'-%/! (%)! 7-+8%1$+! :YR 3,)$%-! 56%! /%! $-'$'! (%! )'/! 7+1'/! 36%#$%/! (,/7+#,?)%/! (%! %M7-%/,+#%/!(%!/63,1,%#$%!1'),('(9!:'!&%=+-'!A'!*%#,(+!7+-!%)! '6&%#$+! %#! )'! $'/'! ,(%#$,3,1'1,2#! 1+#! *')+-%/! (%! 3')/+/! 7+/,$,*+/! (%)! &,/&+! +-(%#! %M1%7$+! 7'-'! %)! 1'/+! (%! [>>N9! >'&?,.#!/%!A'!&%=+-'(+!%#!16'#$+!'!)+/!$,%&7+/!#%1%/'-,+/! 7'-'! '7),1'-! )'/! %M7-%/,+#%/! -%;6)'-%/! /,&7),3,1'#(+! )'! 1+&7)%=,('(!(%!?6%#'!7'-$%!(%!%))'/9! J)! &%1'#,/&+! (%! A,/$+-,')! (%! 3)6=+/! 7)'#$%'(+! 7%-&,$%! &%=+-'-! '@#! &4/! )+/! -%/6)$'(+/! 3-%#$%! '! 7-+76%/$'/! 56%! /%! ),&,$'#!'!'7),1'-!%M7-%/,+#%/!-%;6)'-%/!7+-!7'56%$%!1+&+!:YR c9!P-')%,;A<!%$!')9!N'1a%$R)%*%)!$-'33,1!&%'/6-%&%#$/!3-+&!$A%!K7-,#$!ON! ?'1a?+#%9!OJJJ!_%$L+-a<!_+*%&?%-hb%1%&?%-!ZSSU9! >9! q'-';,'##,/<! q9! N'7';,'##'a,<! '#(! X9! P')+6$/+/9! m:O_cd! &6)$,)%*%)! $-'33,1! 1)'//,3,1'$,+#! ,#! $A%! ('-a9! KOgc]XX! c+&76$%-! c+&&6#,1'$,+#/9!W%*,%L!}+)9UV<!!_+9\<!779!ZZTRZ\S<!]1$9!ZSSV9! :9! K');'-%)),<! P9! g-,#;+),! '#(! >9! q'-';,'##,/9! c+&7'-,#;! $-'33,1! 1)'//,3,%-/9! KOgc]XX! c+&76$%-9! c+&&6#,1'$,+#/! W%*,%L! }+)9UY<! _+9U<!779QVRQf<!•6)9!ZSSY9! X9!W+6;A'#<!K9!K%#<!]9!K7'$/1A%1a<!'#(!_9!b633,%)(9!c)'//R+3R/%-*,1%! &'77,#;! 3+-! 5+/d! '! /$'$,/$,1')! /,;#'$6-%R?'/%(! '77-+'1A! $+! ON! $-'33,1! 1)'//,3,1'$,+#9! N-+1%%(,#;/! +3! $A%! \$A! ^cX! KOgc]XX! OXc€S\! 1+#3%-%#1%9!779HUV•H\f<!_%L!|+-a<!_|<!"K^<!ZSS\9! [9] •9! :%*'#(+/a,<! J9! K+&&%-! '#(! X9! K$-',$9! ^77),1'$,+#! :'8%-! N'1a%$! c)'//,3,%-!3+-!:,#6M9!A$$7dhh)YR3,)$%-9/+6-1%3+-;%9#%$! [10] :9! q'-$$6#%#<! •RN9! cA'#+(<! g9! g-%3%#/$%$$%<! '#(! ^9! K1A,))%-9! W%;6)'-! %M7-%//,+#/!3+-!)'#;6';%!%#;,#%%-,#;9!_'$6-')!:'#;6';%!J#;,#%%-,#;<! }+)9Z<!_+9\<!779USVRZUf<!HTTQ9! [11] •+A#! X'((+1a9! W%;6)'-! %M7-%//,+#! 7%-3+-&'#1%! 1+&7'-,/+#9! ZSS\9! A$$7dhh-%/%'-1A9&,1-+/+3$91+&h7-+=%1$/h;-%$'h-%;%M~7%-39A$&)!! [12] n,#N1'7d!>A%!n,#(+L/!N'1a%$!c'7$6-%!:,?-'-89!ZSSf9! A$$7dhhLLL9L,#71'79+-;! [13] >17(6&7h),?71'79!ZSSY9!A$$7dhhLLL9$17(6&79+-;! [14] >A%!g-%$'!W%;6)'-!JM7-%//,+#!>%&7)'$%!^-1A,*%9!X,1-+/+3$!ZSSY9! A$$7dhh-%/%'-1A9&,1-+/+3$91+&h7-+=%1$/h;-%$'! [15] •+A#!X'((+1a9!m++/$Rl7-%//,*%9ZSSf9!A$$7dhhLLL9?++/$9+-;!