Experimental analysis of the socio-economic phenomena in the BitTorrent ecosystem

BitTorrent is the most successful Peer-to-Peer (P2P) application and is responsible for a major portion of Internet traffic. It has been largely studied using simulations, models and real measurements. Although simulations and modelling are easier to perform, they typically simplify analysed problems and in case of BitTorrent they are likely to miss some of the effects which occur in real swarms. Thus, in this thesis we rely on real measurements. In the first part of the thesis we present the summary of measurement techniques used so far and we use it as a base to design our tools that allow us to perform different types of analysis at different resolution level. Using these tools we collect several large-scale datasets to study different aspects of BitTorrent with a special focus on socio-economic aspects. Using our datasets, we first investigate the topology of real BitTorrent swarms and how the traffic is actually exchanged among peers. Our analysis shows that the resilience of BitTorrent swarms is lower than corresponding random graphs. We also observe that ISP policies, locality-aware clients and network events (e.g., network congestion) lead to locality-biased composition of neighbourhood in the swarms. This means that the peer contains more neighbours from local provider than expected from purely random neighbours selection process. Those results are of interest to the companies which use BitTorrent for daily operations as well as for ISPs which carry BitTorrent traffic. In the next part of the thesis we look at the BitTorrent from the perspective of the content and content publishers in a major BitTorrent portals. We focus on the factors that seem to drive the popularity of the BitTorrent and, as a result, could affect its associated traffic in the Internet. We show that a small fraction of publishers (around 100 users) is responsible for more than two-thirds of the published content. Those publishers can be divided into two groups: (i) profit driven and (ii)fake publishers. The former group leverages the published copyrighted content (typically very popular) on BitTorrent portals to attract content consumers to their web sites for financial gain. Removing this group may have a significant impact on the popularity of BitTorrent portals and, as a result, may affect a big portion of the Internet traffic associated to BitTorrent. The latter group is responsible for fake content, which is mostly linked to malicious activity and creates a serious threat for the Bit- Torrent ecosystem and for the Internet in general. To mitigate this threat, in the last part of the thesis we present a new tool named TorrentGuard for the early detection of fake content that could help to significantly reduce the number of computer infections and scams suffered by BitTorrent users. This tool is available through web portal and as a plugin to Vuze, a popular BitTorrent client. Finally, we present MYPROBE, the web portal that allows to query our database and to gather different pieces of information regarding BitTorrent content publishers. ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------BitTorrent es la aplicación peer-to-peer para compartición de ficheros de mayor éxito y responsable de una fracción importante del tráfico de Internet. Trabajos previos han estudiado BitTorrent usando técnicas de simulación, modelos analíticos y medidas reales. Aunque las técnicas analíticas y de simulación son más sencillas de aplicar, típicamente presentan versiones simplificadas de los problemas analizados y en el caso concreto de BitTorrent pueden obviar aspectos o interacciones fundamentales que ocurren en los enjambres de BitTorrent. Por lo tanto, en esta tesis utilizaremos como pilar de nuestra investigación técnicas de medidas reales. En primer lugar presentaremos un resumen de las técnicas de medidas usadas hasta el momento en el ámbito de BitTorrent que suponen la base teórica para el diseño de nuestras propias herramientas de medida que nos permitirán analizar enjambres reales de BitTorrent. Usando los datos obtenidos con estas herramientas estudiaremos aspectos diferentes de BitTorrent con un enfoque especial de los aspectos socioeconómicos. En la primera parte de la tesis, realizaremos un estudio detallado de la topología de los enjambres reales de BitTorrent así como de detalles acerca de las interacciones entre peers. Nuestro análisis demuestra que la resistencia de la topología de los enjambres reales de BitTorrent es menor que la ofrecida por grafos aleatorios equivalentes. Además, los resultados revelan que las políticas de los Provedores de Internet junto con la incipiente utilización de clientes de BitTorrent modificados y otros efectos en la red (p.ej. congestión) hacen que los enjambres reales de BitTorrent presentan una composicin de localidad. Es decir, un nodo tiene un número de vecinos dentro de su mismo Proveedor de Internet mayor del que obtendría en una topología puramente aleatoria. Estos resultados son de interés para las empresas que utilizan BitTorrent en sus operaciones, así como para los Provedores de Internet responsables de transportar el tráfico de BitTorrent. En la segunda parte de la tesis, analizamos los aspectos de publicación de contenido en los mayores portales de BitTorrent. En concreto, los resultados presentados muestran que sólo un pequeño grupo de publicadores (alrededor de 100) es responsable de hacer disponible más de dos tercios del contenido publicado. Además estos publicadores se pueden dividir en dos grupos: (i) aquellos con incentivos económicos y (ii) publicadores de contenido falso. El primer grupo hace disponible contenido protegido por derechos de autor (que es típicamente muy popular) en los principales portales de BitTorrent con el objetivo de atraer a los consumidores de dicho contenido a sus propios sitios web y obtener un beneficio económico. La eliminación de este grupo puede tener un impacto importante en la popularidad de los principales portales de BitTorrent así como en el tráfico generado por BitTorrent en Internet. El segundo grupo es responsable de la publicación de contenidos falsos. La mayor parte de dichos contenidos están asociados a una actividad maliciosa (p.ej. la distribución de software malicioso) y por tanto suponen una seria amenaza para el ecosistema de BitTorrent, en particular, y para Internet en general. Para minimizar los efectos de la amenaza que presentan estos publicadores, en la última parte de la tesis presentaremos una nueva herramienta denominada TorrentGuard para la pronta detección de contenidos falsos. Esta herramienta puede accederse a través de un portal web y a través de un plugin del cliente de BitTorrent Vuze. Finalmente, presentamos MYPROBE, un portal web que permite consultar una base de datos con información actualizada sobre los publicadores de contenidos en BitTorrent

Is Content Publishing in BitTorrent Altruistic or Profit-Driven

BitTorrent is the most popular P2P content delivery application where individual users share various type of content with tens of thousands of other users. The growing popularity of BitTorrent is primarily due to the availability of valuable content without any cost for the consumers. However, apart from required resources, publishing (sharing) valuable (and often copyrighted) content has serious legal implications for user who publish the material (or publishers). This raises a question that whether (at least major) content publishers behave in an altruistic fashion or have other incentives such as financial. In this study, we identify the content publishers of more than 55k torrents in 2 major BitTorrent portals and examine their behavior. We demonstrate that a small fraction of publishers are responsible for 66% of published content and 75% of the downloads. Our investigations reveal that these major publishers respond to two different profiles. On one hand, antipiracy agencies and malicious publishers publish a large amount of fake files to protect copyrighted content and spread malware respectively. On the other hand, content publishing in BitTorrent is largely driven by companies with financial incentive. Therefore, if these companies lose their interest or are unable to publish content, BitTorrent traffic/portals may disappear or at least their associated traffic will significantly reduce

A First Step Towards User Assisted Online Social Networks

This work is at: 3rd ACM Workshop on Social Network Systems (SNS'10), co-located with EuroSys 2010 Conference, took place April, 13-16, 2010 in Paris, France.The current Online Social Networks' infrastructure is com- posed by thousands of servers distributed across data-centers spread over several geographical locations. These servers store all the users' information (pro le, contacts, contents, etc). Such an infrastructure incurs high operational and maintenance costs. Furthermore, this may threaten the scal- ability, the reliability, the availability and the privacy of the o ered service. On the other hand this centralized approach gives to the OSN provider full control over a huge amount of valuable information. This information constitutes the basis of the OSN provider's business. Most of the storage capacity is dedicated to store the user's content (e.g. photos, videos, etc). We believe that OSN provider does not have strong incentive to dedicate a large part of its infrastructure to store majority part of this content. In this position paper we introduce the concept of user assisted Online Social Network (uaOSN). This novel archi- tecture seeks to distribute the storage load associated to the content (e.g. photos, videos, etc) among the OSN's users. Thus the OSN provider keeps the control on the relevant in- formation while reducing the operational and maintenance costs. We discuss the bene ts that this proposal may pro- duce for both, the OSN provider and the users. We also discuss the technical aspects to be considered and compare this solution to other distributed approaches.This research is funded in part by the EU grant for the SO- CIALNETS project, 217141, by the Spanish Ministery of Science and Innovation through the CONPARTE project, TEC2007-67966-C03-03/TCM, and by the Regional Gover- ment ofMadrid through theMEDIANET project, S2009/TIC- 1468.Publicad

Measuring the bittorrent ecosystem: techniques, tips, and tricks

BitTorrent is the most successful peer-to-peer application. In the last years the research community has studied the BitTorrent ecosystem by collecting data from real BitTorrent swarms using different measurement techniques. In this article we present the first survey of these techniques that constitutes a first step in the design of future measurement techniques and tools for analyzing large-scale systems. The techniques are classified into macroscopic, microscopic, and complementary. Macroscopic techniques allow us to collect aggregated information of torrents and present very high scalability, able to monitor up to hundreds of thousands of torrents in short periods of time. Microscopic techniques operate at the peer level and focus on understanding performance aspects such as the peers¿ download rates. They offer higher granularity but do not scale as well as macroscopic techniques. Finally, complementary techniques utilize recent extensions to the BitTorrent protocol in order to obtain both aggregated and peer-level information. The article also summarizes the main challenges faced by the research community to accurately measure the BitTorrent ecosystem such as accurately identifying peers and estimating peers' upload rates. Furthermore, we provide possible solutions to address the described challenges.The research leading to these results has received funding from the European Union Seventh Framework Program (FP7/2007-2013) through the TREND NoE project (grant agreement no. 25774) and the Regional Government of Madrid through the MEDIANET project (S- 2009/TIC-1468).Publicad

TorrentGuard: Stopping scam and malware distribution in the BitTorrent ecosystem

In this paper we conduct a large scale measurement study in order to analyse the fake content publishing phenomenon in the BitTorrent ecosystem. Our results reveal that fake content represents an important portion (35%) of those files shared in BitTorrent and just a few tens of users are responsible for 90% of this content. Furthermore, more than 99% of the analysed fake files are linked to either malware or scam websites. This creates a serious threat for the BitTorrent ecosystem. To address this issue, we present a new tool named TorrentGuard for the early detection of fake content. Based on our evaluation this tool may prevent end users from downloading more than 35 millions fake files per year. This could help to reduce the number of computer infections and scams suffered by BitTorrent users. TorrentGuard is already available and it can be accessed through both a webpage or a Vuze plugin.The research leading to these results has been partially funded by the European Union's FP7 Program under the project eCOUSIN (318398), the Spanish Ministry of Economy and Competitiveness under the eeCONTENT project (TEC2011-29688-C02-02), and the Regional Government of Madrid under the MEDIANET project (S2009/TIC-1468)

Investigating the reaction of BitTorrent content publishers to antipiracy actions

During recent years, a few countries have put in place online antipiracy laws and there has been some major enforcement actions against violators. This raises the question that to what extent antipiracy actions have been effective in deterring online piracy? This is a challenging issue to explore because of the difficulty to capture user behavior, and to identify the subtle effect of various underlying (and potentially opposing) causes. In this paper, we tackle this question by examining the impact of two major antipiracy actions, the closure of Megaupload and the implementation of the French antipiracy law, on publishers in the largest BitTorrent portal who are major providers of copyrighted content online. We capture snapshots of BitTorrent publishers at proper times relative to the targeted antipiracy event and use the trends in the number and the level of activity of these publishers to assess their reaction to these events. Our investigation illustrates the importance of examining the impact of antipiracy events on different groups of publishers and provides valuable insights on the effect of selected major antipiracy actions on publishers' behavior.This work has been partially supported by the European Union through the FP7 eCOUSIN (318398) and TREND (257740) Projects and the ITEA2 TWIRL Project (Call 5-10029), the Spanish Government under the CRAMNET project (TEC2012-38362-C03-01) and eeCONTENT Project (TEC2011- 29688-C02-02), the Regional Government of Madrid through the MEDIANET project (S-2009/TIC-1468), and the National Science Foundation under Grant IIS-0917381.European Community's Seventh Framework Progra

Investigating the reaction of BitTorrent content publishers to antipiracy actions

International audienceDuring recent years, a few countries have put inplace online antipiracy laws and there has been some major enforcement actions against violators. This raises the question that to what extent antipiracy actions have been effective in deterring online piracy? This is a challenging issue to explore because of the difficulty to capture user behavior, and to identify the subtle effect of various underlying (and potentially opposing) causes. In this paper, we tackle this question by examining the impact of two major antipiracy actions, the closure of Megaupload and the implementation of the French antipiracy law, on publishers in the largest BitTorrent portal who are major providers of copyrighted content online. We capture snapshots of BitTorrent publishers at proper times relative to the targeted antipiracy event and use the trends in the number and the level of activity of these publishers to assess their reaction to these events. Our investigation illustrates the importance of examining the impact of antipiracy events on different groups of publishers and provides valuable insights on the effect of selected major antipiracy actions on publishers' behavio

Management of coronary disease in patients with advanced kidney disease

BACKGROUND Clinical trials that have assessed the effect of revascularization in patients with stable coronary disease have routinely excluded those with advanced chronic kidney disease. METHODS We randomly assigned 777 patients with advanced kidney disease and moderate or severe ischemia on stress testing to be treated with an initial invasive strategy consisting of coronary angiography and revascularization (if appropriate) added to medical therapy or an initial conservative strategy consisting of medical therapy alone and angiography reserved for those in whom medical therapy had failed. The primary outcome was a composite of death or nonfatal myocardial infarction. A key secondary outcome was a composite of death, nonfatal myocardial infarction, or hospitalization for unstable angina, heart failure, or resuscitated cardiac arrest. RESULTS At a median follow-up of 2.2 years, a primary outcome event had occurred in 123 patients in the invasive-strategy group and in 129 patients in the conservative-strategy group (estimated 3-year event rate, 36.4% vs. 36.7%; adjusted hazard ratio, 1.01; 95% confidence interval [CI], 0.79 to 1.29; P=0.95). Results for the key secondary outcome were similar (38.5% vs. 39.7%; hazard ratio, 1.01; 95% CI, 0.79 to 1.29). The invasive strategy was associated with a higher incidence of stroke than the conservative strategy (hazard ratio, 3.76; 95% CI, 1.52 to 9.32; P=0.004) and with a higher incidence of death or initiation of dialysis (hazard ratio, 1.48; 95% CI, 1.04 to 2.11; P=0.03). CONCLUSIONS Among patients with stable coronary disease, advanced chronic kidney disease, and moderate or severe ischemia, we did not find evidence that an initial invasive strategy, as compared with an initial conservative strategy, reduced the risk of death or nonfatal myocardial infarction

Health status after invasive or conservative care in coronary and advanced kidney disease

BACKGROUND In the ISCHEMIA-CKD trial, the primary analysis showed no significant difference in the risk of death or myocardial infarction with initial angiography and revascularization plus guideline-based medical therapy (invasive strategy) as compared with guideline-based medical therapy alone (conservative strategy) in participants with stable ischemic heart disease, moderate or severe ischemia, and advanced chronic kidney disease (an estimated glomerular filtration rate of <30 ml per minute per 1.73 m2 or receipt of dialysis). A secondary objective of the trial was to assess angina-related health status. METHODS We assessed health status with the Seattle Angina Questionnaire (SAQ) before randomization and at 1.5, 3, and 6 months and every 6 months thereafter. The primary outcome of this analysis was the SAQ Summary score (ranging from 0 to 100, with higher scores indicating less frequent angina and better function and quality of life). Mixed-effects cumulative probability models within a Bayesian framework were used to estimate the treatment effect with the invasive strategy. RESULTS Health status was assessed in 705 of 777 participants. Nearly half the participants (49%) had had no angina during the month before randomization. At 3 months, the estimated mean difference between the invasive-strategy group and the conservative-strategy group in the SAQ Summary score was 2.1 points (95% credible interval, 120.4 to 4.6), a result that favored the invasive strategy. The mean difference in score at 3 months was largest among participants with daily or weekly angina at baseline (10.1 points; 95% credible interval, 0.0 to 19.9), smaller among those with monthly angina at baseline (2.2 points; 95% credible interval, 122.0 to 6.2), and nearly absent among those without angina at baseline (0.6 points; 95% credible interval, 121.9 to 3.3). By 6 months, the between-group difference in the overall trial population was attenuated (0.5 points; 95% credible interval, 122.2 to 3.4). CONCLUSIONS Participants with stable ischemic heart disease, moderate or severe ischemia, and advanced chronic kidney disease did not have substantial or sustained benefits with regard to angina-related health status with an initially invasive strategy as compared with a conservative strategy