Encrypted peer-to-peer detection

A system comprising a processor, the system further comprising:

• an application signature check engine for monitoring a network traffic from a first client to determine whether the first client is executing a peer-to-peer application;
• and
• a peer-to-peer traffic generator for generating a network traffic that emulates peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting an unknown network traffic sent from the first client to the second client,
• wherein the peer-to-peer traffic generator for generating of the network traffic that emulates peer-to-peer network traffic further comprises:
• sending, to the second client, the emulated peer-to-peer network traffic identifying non-existent peers or spoofed peers, wherein the emulated peer-to-peer network traffic identifying the non-existent peers or spoofed peers indicates that the emulated peer-to-peer network traffic originated from a peer that does not exist;
• and
• in the event that one of the non-existent peers or spoofed peers is being contacted, emulating a peer-to-peer traffic response including dummy data.

A method, comprising:

• monitoring a network traffic sent from a first client to determine whether the first client is executing a peer-to-peer application;
• and
• generating a network traffic, using a processor, that emulates peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting an unknown network traffic sent from the first client to the second client, wherein the generating of the network traffic that emulates peer-to-peer network traffic comprises:
• sending, to the second client, the emulated peer-to-peer network traffic identifying non-existent peers or spoofed peers, wherein the emulated peer-to-peer network traffic identifying the non-existent peers or spoofed peers indicates that the emulated peer-to-peer network traffic originated from a peer that does not exist;
• and
• in the event that one of the non-existent peers or spoofed peers is being contacted, emulating a peer-to-peer traffic response including dummy data.

A computer program being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

• monitoring a network traffic sent from a first client to determine whether the first client is executing a peer-to-peer application;
• and
• generating a network traffic that emulates peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting an unknown network traffic sent from the first client to the second client, wherein the generating of the network traffic that emulates peer-to-peer network traffic comprises:
• sending, to the second client, the emulated peer-to-peer network traffic identifying non-existent peers or spoofed peers, wherein the emulated peer-to-peer network traffic identifying the non-existent peers or spoofed peers indicates that the emulated peer-to-peer network traffic originated from a peer that does not exist;
• and
• in the event that one of the non-existent peers or spoofed peers is being contacted, emulating a peer-to-peer traffic response including dummy data.