1. The Index Poisoning Attack in P2P File Sharing Systems Keith W. Ross Polytechnic University

2. Jian LiangNaoum Naoumov Joint work with:

3. Internet Traffic CF: CacheLogic

4. File Distribution Systems: 2005

5. Attacks on P2P: Decoying Two types: File corruption: pollution Index poisoning Investigated in two networks: FastTrack/Kazaa –Unstructured P2P network Overnet –Structured (DHT) P2P network –Part of eDonkey

6. File Pollution pollution company polluted content original content

7. File Pollution pollution company pollution server pollution server pollution server pollution server file sharing network

8. File Pollution Unsuspecting users spread pollution !

9. File Pollution Unsuspecting users spread pollution ! Yuck

10. Index Poisoning index title location bigparty 123.12.7.98 smallfun 23.123.78.6 heyhey 234.8.89.20 file sharing network 123.12.7.98 23.123.78.6 234.8.89.20

11. Index Poisoning index title location bigparty 123.12.7.98 smallfun 23.123.78.6 heyhey 234.8.89.20 123.12.7.98 23.123.78.6 234.8.89.20 index title location bigparty 123.12.7.98 smallfun 23.123.78.6 heyhey 234.8.89.20 bighit 111.22.22.22 111.22.22.22

14. Overnet: DHT (version_id, location) stored in nodes with ids close to version_id (hash_title, version_id) stored in nodes with ids close to hash_title First search hash_title, get version_id and metada Then search version_id, get location

15. Overnet 0001 0011 0100 0101 1000 1010 1100 1111 Publish Query Download

16. FastTrack Overlay Each SN maintains a local index ON = ordinary node SN = super node SN ON

17. FastTrack Query ON = ordinary node SN = super node SN ON

18. FastTrack Download ON = ordinary node SN = super node SN ON HTTP request for hash value

19. FastTrack Download ON = ordinary node SN = super node SN ON P2P file transfer

20. Attacks: How Effective? For a given title, what fraction of the copies are –Clean ? –Poisoned? –Polluted? Brute-force approach: –attempt download all versions –For those versions that download, listen/watch each one How do we determine pollution levels without downloading?

21. Titles, versions, hashes & copies The title is the title of song/movie/software A given title can have thousands of versions Each version has its own hash Each version can have thousands of copies A title can also have non-existent versions, each identified by a hash

22. Definition of Pollution and Poisoning Levels (t, t+ Δ): investigation interval V: set of all versions of title T V 1, V 2, V 3 : sets of poisoned, polluted, clean versions C v : number of advertised copies of version v

23. How to Estimate? Need C v, vєV Need V 1, V 2, V 3 –Dont want to download and listen to files! Solution: Harvest C v, vєV, and copy locations –Overnet: Insert node, receive publish msgs –FastTrack: Crawl Heuristic for V 1, V 2, V 3

24. Copies at Users FastTrackOvernet

25. Heuristic Identify heavy and light publishers H h = set of hashes from heavy publishers H l = set of hashes from light publishers polluted versions clean versions poisoned versions HhHh HlHl

26. Heuristic: More Evaluation#Download# Success#Accuracy# False Polluted8,4508,40099.4%0.6% (positive) Poisoned33,1861,15696.5%3.5% (negative) Heuristic is accurate & does not involve any downloading!

27. FastTrack Versions

28. FastTrack Copies

29. Overnet Copies

30. Blacklisting Assign reputations to /n subnets –Bad reputation to subnets with large number of advertised copies of any title Obtain reputations locally; share with distributed algorithm Locally blacklist /n subnets with bad reputations

31. Blacklisting: More

32. The Inverse Attack Attacks on P2P systems: But can also exploit P2P sytems for DDoS attacks against innocent host:

33. Summary & Thank You!