Patent ID: 7996520

Claim:
A method for identifying a peer-to-peer protocol of a communication session in an Internet Protocol (IP) packet network, the method comprising: using a Deep Packet Inspection (DPI) process to classify a plurality of communication sessions in the network; measuring an amount of unclassified bandwidth of the communication sessions which the DPI process was unable to classify; responsive to the unclassified bandwidth exceeding a predetermined level, measuring behavioral characteristics of the unclassified bandwidth according to a ratio between upstream and downstream traffic and a distribution of packet arrival times; identifying, using the behavioral characteristics, a subset of the plurality of communication sessions such that sessions in the subset are suspected of using a target peer-to-peer communication protocol; selecting a candidate session from the subset; initiating a trial communication session with a node of the network participating in the candidate session, wherein the trial communication session imitates the target peer-to-peer communication protocol; responsively to receiving a positive response from the node to initiation of the trial communication session imitating the target peer-to-peer communication protocol, determining that one or more further sessions in the plurality are using the target peer-to-peer communication protocol; and controlling the one or more further sessions responsively to a predetermined control criterion that is applicable to the target peer-to-peer communication protocol.