betolj / ndpi-netfilter

GNU General Public License v2.0
126 stars 69 forks source link

The state of BitTorrent detection? #40

Open sixtyfive opened 7 years ago

sixtyfive commented 7 years ago

Hello! Please forgive me for using your issue tracker in this way. I'm trying to figure out how feasible it is at this point in time to identify all BitTorrent traffic on a network, both encrypted or unencrypted, using F/OSS.

I'm aware of and have read both Velan et al. (2014) and Carvalho et al. (2009) and various online fora, etc., mostly focusing on Snort and nDPI. In your GitHub issue tracker, there are half a dozen threads on the topic, (the youngest of which I was able to find) not containing any helpful information, except perhaps for a post by Vitaly Lavrov (vel21ripn) mentioning a "branch [that] has [a?] parser [for?] DHT messages" which he says can do encrypted BT detection, but no further information is given and I'm not sure whether he's a contributor to nDPI. Neither you nor the Snort people seem to be using supervised machine learning methods at the moment.

What, in your opinion, is the state of reasonably reliable (encrypted esp.) BitTorrent detection, and what does the foreseeable future look like?