Detection and mitigation of localized attacks in a widely deployed P2P network

Abstract

Several large scale P2P networks operating on the Internet are based on a Distributed Hash Table. These networks offer valuable services, but they all suffer from a critical issue allowing malicious nodes to be inserted in specific places on the DHT for undesirable purposes (monitoring, distributed denial of service, pollution, etc.). While several attacks and attack scenarios have been documented, few studies have measured the actual deployment of such attacks and none of the documented countermeasures have been tested for compatibility with an already deployed network. In this article, we focus on the KAD network. Based on large scale monitoring campaigns, we show that the world-wide deployed KAD network suffers large number of suspicious insertions around shared contents and we quantify them. To cope with these peers, we propose a new efficient protection algorithm based on analyzing the distribution of the peers' ID found around an entry after a DHT lookup. We evaluate our solution and show that it detects the most efficient configurations of inserted peers with a very small false-negative rate, and that the countermeasures successfully filter almost all the suspicious peers. We demonstrate the direct applicability of our approach by implementing and testing our solution in real P2P networks.The final publication is available at http://link.springer.com/article/10. 1007%2Fs12083-012-0137-7.

Aurora-Trinity: A Super-Light Client for Distributed Ledger Networks Extending the Ethereum Trinity Client

“…The influence of adversarial nodes in P2P networks has been thoroughly researched in [10][11][12], with recent work focusing on DLT networks such as Ethereum [13][14][15][16][17] and Bitcoin [7,17,18]. The identified problems are diverse and include, but are not limited to the following: Eclipse Attacks, DoS and DDoS attacks, manipulation of routing advertisements (i.e., BGP hijacks), man-in-the-middle attacks and Sybil attacks (a recent study reported a Sybil attack that was executed on the Bitcoin Cash network with up to 5000 Sybil nodes [19]).…”

“…In a loop, APREQ and APRES messages are exchanged and the contents of the APRES messages are used to update α (lines (6-8)). A random, uncontacted node from S h is used for the next hop (lines (11)(12)). If d hops were made (line (5)), or z reaches (0) (line (9)), the walk ends and the result is returned (line ( 14)).…”

Novel Trusted Hierarchy Construction for RFID Sensor–Based MANETs Using ECCs

“…In the wider literature, various methods to limit this type of attack have been proposed. These methods can be classified based on the following parameters:  Strong identification of peers [35]  Authentication and authorization [36]  Trust score [37] ■ Eclipse attack. In a network, many versions of this attack are possible.…”

A Model to Quantify the Success of a Sybil Attack Targeting RELOAD/Chord Resources

“…Several researchers [6], [7] have reported ongoing Sybil attacks in the KAD network, and even performed it themselves for research purposes. Therefore multiple works in the literature [8] have proposed solutions to prevent or mitigate the harm produced by Sybil attacks.…”

“…Some of the most popular DHT systems like KAD, the one employed by the eMule file-sharing network, or the two main DHTs associated to BitTorrent, account for millions of concurrently connected users. In particular, Steiner et al [12], and more recently Cholez et al [7], reported that the number of users concurrently connected to the KAD network varies between 3.3 and 4.5 millions. Furthermore, the minimum number of replicas of KAD resources is r = 10.…”