In recent years, a novel BitTorrent (BT) technology, Private Tracker (PT), has received extensive attentions in academia. Due to its huge amount of traffic volumes and population, it is essential to understand the characteristics for system management. In this paper, by using the data crawled from a number of well-known PT sites in China, we present an in-depth measurement and analysis on the PT system, in terms of resources characteristics and user behavior characteristics. Our analysis on the activity and age distribution of torrents reveals that the sequence of torrent activities follows a power-law distribution and the sequence of torrent ages follows a linear distribution. By investigating the characteristics of the core users and the resources in different PT sites, two observations have been made. Firstly, every PT site has a number of users with stable levels who contribute to the survivability and popularity of the site. Secondly, a large amount of redundancy exists among the distributed resources and many popular resources are duplicated among these sites, which leads to the quick spread of pirate resources. Based on the measurement results, we analyze the drawbacks of PT mechanisms and propose useful suggestions to promote the healthy development and performance of PT.

Due to the massive amount of data in high-speed network traffic and the limit on processing capability, it is a great challenge to accurately measure and monitor network traffic over high-speed links online. A new data structure is presented in this paper for locating the hosts associated with large connection degrees or significant changes in connection degrees based on the reversible connection degree sketch to monitor anomalous network traffic. The reversible connection degree sketch builds a compact summary of host connection degrees efficiently and accurately. For each packet coming, it only needs to set several bits selected in a bit array by a group of hash functions. These hash functions are designed based on the Chinese Remainder Theorem so that the in-degree or out-degree associated with a given host can be accurately estimated. With this new data structure, we develop a new reverse sketch method for locating abnormal hosts. Although the reversible connection degree sketch does not preserve any host address information, we can analytically reconstruct the host addresses associated with large connection degrees or significant changes in connection degrees by a simple calculation purely based on the characteristics of the hash functions. Furthermore, a reinforced reversible connection degree sketch, the double connection degree sketch, is developed to reduce false positives which are commonly encountered in the sketch-based methods. A traffic monitoring system based on this double connection degree is developed to detect and classify the abnormal hosts associated with large connection degrees or significant changes in connection degrees. The experiments are conducted based on the actual network traffic and the testing results show that our method is accurate and efficient.