We investigate the emergence of the exploit-as-a-service model for driveby browser compromise. In this regime, attackers pay for an exploit kit or service to do the "dirty work" of exploiting a victim's browser, decoupling the complexities of browser and plugin vulnerabilities from the challenges of generating traffic to a website under the attacker's control. Upon a successful exploit, these kits load and execute a binary provided by the attacker, effectively transferring control of a victim's machine to the attacker.

Class-of-Service identification is a very useful task for enterprise, university and ISP networks. Peer-to-peer (P2P) traffic, being a significant portion of the network traffic today, constitutes a highly desirable class for identification. Accurate classification of P2P traffic is a challenging problem, and becomes even more challenging when we are constrained to use only transport-layer header information. In this paper, we present a new approach for P2P traffic identification, that uses fundamental characteristics of P2P protocols, such as a large network diameter and the presence of many hosts acting both as servers and clients. We do not use any application-specific information, but we are, however able to identify both known and unknown P2P protocols in a simple and efficient way.