Adamsky, F.

Jager, R.

Khan, H.

Khayam, S. A.

Rajarajan, M.

English

City Research Online

Rajarajan, M., Adamsky, F., Khan, H., Khayam, S. A. & Jager, R. (2011). Destabilizing BitTorrent's clusters to attack high bandwidth lechers. Paper presented at the 18th ACM Conference on Computer and Communications Security (CCS 2011), 17 Oct 2011 - 21 Oct 2011, SWISSÔTEL Chicago, Chicago, IL, USA.City Research OnlineOriginal citation: Rajarajan, M., Adamsky, F., Khan, H., Khayam, S. A. & Jager, R. (2011). Destabilizing BitTorrent's clusters to attack high bandwidth lechers. Paper presented at the 18th ACM Conference on Computer and Communications Security (CCS 2011), 17 Oct 2011 - 21 Oct 2011, SWISSÔTEL Chicago, Chicago, IL, USA.Permanent City Research Online URL: http://openaccess.city.ac.uk/621/ Copyright & reuseCity  University  London has developed City  Research Online  so that  its  users  may access the research outputs of City University London's staff. Copyright © and Moral Rights for this paper are retained by the individual author(s) and/ or other copyright holders. Users may download and/ or print one  copy  of  any  article(s)  in  City  Research  Online  to  facilitate  their  private  study  or  for  non-commercial research. Users may not engage in further distribution of the material or use it for any profit-making activities or any commercial gain. All material in City Research Online is checked for eligibility for copyright before being made available in the live archive. URLs from City Research Online may be freely distributed and linked to from other web pages. Versions of researchThe version in City Research Online may differ from the final published version. Users are advised to check the Permanent City Research Online URL above for the status of the paper.EnquiriesIf you have any enquiries about any aspect of City Research Online, or if you wish to make contact  with the author(s) of this paper, please email the team at publications@city.ac.uk.POSTER: Destabilizing BitTorrent’s Clusters to Attack HighBandwidth LeechersFlorian AdamskyCity University LondonLondon, Englandflorian.adamsky.1@city.ac.ukHassan KhanSEECS, NUSTIslamabad, Pakistanhassan.khan@seecs.nust.edu.pkMuttukrishnan RajarajanCity University LondonLondon, Englandr.muttukrishnan@city.ac.ukSyed Ali KhayamSEECS, NUSTIslamabad, Pakistanali.khayam@seecs.nust.edu.pkRudolf JägerTHM University ofApplied SciencesCampus Friedberg, Germanyrudolf.jaeger@iem.thm.deABSTRACTBitTorrent protocol incentivizes sharing through its chokingalgorithm. BitTorrent choking algorithm creates clusters ofleechers with similar upload capacity to achieve higher over-all transfer rates. We show that a malicious peer can exploitBitTorrent’s choking algorithm to reduce the upload utiliza-tion of high bandwidth leechers. We use a testbed com-prising of 24 nodes to provide experimental evidence of adistributed attack in which the malicious peers increase thedownload time for high bandwidth leechers by up to 16 %and increases average download time of the swarm by upto 15 % by using distributed and loosely-coupled maliciouspeers which comprise only 4.7 % of the swarm. The coun-termeasures of this attack are a part of our ongoing researchwork.1. INTRODUCTIONBitTorrent is one of the most popular P2P protocols andit comprises the largest share of P2P traffic on the Inter-net [5]. Consequently, BitTorrent is a target of many at-tacks launched by anti-P2P companies which are workingclosely with the music, television and film industries [4]. Ac-tive measurement based studies on live torrents on Internetprove the existence of such attacks [2].In this paper we show that a malicious peer can exploit theincentive-based sharing mechanism of BitTorrent to attackhigh bandwidth leechers. The incentive-based sharing mech-anism of BitTorrent is based on the choking algorithm whichcreates clusters of leechers with similar upload capacity andresults in higher overall data transfer rates among leecherswith higher bandwidth. A malicious peer can launch an at-tack to destabilize the clusters in a swarm to decrease intra-cluster communication, which results in decrease in datatransfer among high bandwidth leechers and increases theaverage download time of the swarm.We provide empirical evidence of the efficacy of this attackusing a testbed of 24 nodes. In our experimental evaluations,we first demonstrate that the malicious peer can successfullydestabilize clusters of leechers with similar bandwidth. ThisCopyright is held by the author/owner(s).CCS’11, October 17–21, 2011, Chicago, Illinois, USA.ACM 978-1-4503-0948-6/11/10.destabilization of clusters results in up to 6 % decrease inintra-cluster communication. We then show that a set ofdistributed and loosely-coupled malicious nodes which com-prises only 4.7 % of the swarm results in an up to 16 % in-crease in download time for high bandwidth leechers and anup to 15 % increase in average download time of the swarm.The aim of this paper is to expose a weakness in BitTorrentprotocol’s choking algorithm so that the research communitycan find countermeasures to this attack.2. BACKGROUNDIn this section we first introduce the BitTorrent terminol-ogy used in this paper. We then briefly discuss the BitTor-rent’s choking algorithm.Swarm: All the peers sharing a torrent are called a swarm.Leecher: A peer is a leecher when it is downloading contentof a torrent.Seeder: A peer is seeder when it has downloaded all thecontent and is sharing the content with other leechers.Peer Set: Each peer maintains a list of other peers that itknows about within a swarm. This list is known aspeer set.Active Peer Set: Active peer set for a peer is the subsetof its peer set that it can send data.Interested and Choked: A peer P is interested in peer Qwhen peer Q has some contents that peer P does nothave. Peer P is choked by peer Q when peer Q doesnot want to send data to peer P .With the necessary terminology chalked out, we now dis-cuss the choking algorithm. A leecher determines its activepeer set through the choking algorithm. The choking algo-rithm works in rounds of 10 seconds and during its executionin each round, the choking algorithm works in the followingway [1]:1. The leecher orders the peers in its peer set accordingto their upload rate and ignores peers who have notsent any data to it.2. The leecher then unchokes n− 1 peers, where n is thenumber of parallel uploads the leecher is allowed.3. After every three executions of choking algorithm, apeer is chosen at random and optimistically unchoked.The choking algorithm works in a tit-for-tat-ish way andfavors the leechers who upload. Consequently, leechers willmore frequently unchoke other leechers with similar uploadcapacities. This reciprocation of data rates results in con-vergence towards good clustering by grouping of leecherswith similar upload capacity. Good clustering ensures thatthe leechers with high upload bandwidth are rewarded withhigher download rates and they are able to complete theirdownloads more quickly. Finally, the choking algorithm hasbeen shown to converge towards good clustering shortly af-ter the beginning of the download [3]. We refer interestedreaders to [1] for a detailed description of the choking algo-rithm.3. EXPERIMENTAL SETUPWe perform experiments using private torrents in our test-bed consisting of 24 nodes and a controller and monitornode. The nodes are desktop machines which are runningBitTorrent client Transmission1 v. 2.3 over CentOS 5.3. Weselected Transmission client since it provides a powerful com-mand-line interface (CLI) which can be used to throttle traf-fic using shell scripts. In order to simultaneously control allthe nodes, we make use of the parallel-ssh 2 client. We wroteseveral scripts to monitor and record the status of each peerat every second. This information includes nodes in peerset, nodes in active peer set, interested and choked statesfor each of the peers in the active peer set, and upload anddownload rate with each of the peers in the active peer set.The controller executes the experiments and monitors eachof these nodes.In our experiments, we divide the peers into three differ-ent classes based on their upload and download rate lim-its. The fast class has peers with 2000 kbps bandwidth(class 1), the medium class has peers with 1500 kbps band-width (class 2), and the slow class has peers with 1000 kbpsbandwidth (class 3). It should be noted that these band-width limits are for both the upload rate and the downloadrate. During our experiments, each peer class had samenumber of peers and the upload and download bandwidthwithin each of these peer classes were not changed. A fileof 887 MiB was seeded by a seeder and all the peers joinedthe torrent at the same time. This created a flash crowdscenario which resulted in reproducible results. To create amore realistic scenario, on every node some random HTTPbackground traffic was also generated. Finally, every leecherdisconnected after receiving a complete copy of the file andonly the initial seeder stayed connected for the completeduration of the experiment. Finally, every experiment wasrepeated 10 times and the average values for these experi-ments are reported in subsequent sections.1http://www.transmissionbt.com/2http://code.google.com/p/parallel-ssh4. ATTACK DETAILS AND EXPERIMEN-TAL EVALUATIONWe now show how a malicious peer can exploit the cluster-ing algorithm to increase the download time for high band-width leechers. Legout et al. [3] showed that the cluster-ing produced by the choking algorithm favors leechers withhigher upload bandwidth. The malicious leecher (we use theterm malicious peer and malicious leecher interchangeably)perturbs the clustering produced by the choking algorithm.To this end, the malicious leecher Lar provides high uploadbandwidth whenever it is optimistically unchoked by the at-tackee leecher Lae. Furthermore, Lar keeps on providing theLae with high upload bandwidth for a few rounds. Conse-quently, Lae adds Lar to its active peer set and changes thestate of one of the existing leechers Lex from unchoked tochoked. After providing high upload bandwidth for a fewrounds to Lae, Lar drops its upload bandwidth significantly.Meanwhile, Lex has found another leecher which it has un-choked and added to its active peer set. Now it would be atleast three more rounds before Lae and Lex could transferdata among themselves (using optimistic unchoke). Sincedata transfer between Lae and Lex would have resulted inthe most optimum data exchange between the two, the ma-licious leecher managed to trick them into forming clusterwith a peer which probably did not belong to the same clus-ter as Lae or Lex. Continued attacks by Lar on the highbandwidth leechers destabilizes the clusters and results inlonger download times for the higher bandwidth leechers.Figure 1: Affect of attack on intra- and inter-clusteractivity. Arrows show the direction of data trans-fer. Seeder is omitted for simplicity (results withoutmalicious peer are given in black; results with 1 ma-licious peer are given in red)We first demonstrate that the malicious peer destabilizesthe high bandwidth cluster. To this end, we first allow allthe peers to download the file without any malicious peerand note the intra- and inter-cluster activity (data trans-fer). We then introduce a malicious peer and repeat thesame experiment. The malicious peer behaves like a highbandwidth leecher for 35 seconds with an upload bandwidthof 2000 kbps and after 35 seconds (one optimistic unchokecycle + grace period) malicious peer drops its bandwidth to1 20510152012.7616.360.99 1.21−1.46 −1.68Number of mailcious peers%increaseindownloadtimeClass 1Class 2Class 3Figure 2: Increase/decrease in download time fordifferent peer classes when malicious peers are in-troduced20 kbps. To compare the results of these experiments, wefirst plot the percentage of intra- and inter-cluster activitywithout the malicious peer in Figure 1 (the values withoutmalicious peer are displayed in black color). Due to spaceconstraints, we plot the results with the malicious peer inthe same figure using red color. Figure 1 shows that withoutthe malicious peer, the intra-cluster activity is much morethan the inter-cluster activity. However, after introducingthe malicious peer, the intra-cluster activity drops by up to6 % and the inter-cluster activity increases by up to 6 %.We now determine the affect of destabilization of clusterson different classes of leechers with respect to file downloadtime. To this end, we first download the file without anymalicious peer and compare the download time for differentclasses of leechers when malicious peers are introduced. Itcan be observed from Figure 2 that when malicious peers areintroduced, the download time for the fast leechers increasesby up to 16 %. This is because the fast leechers are no longertransferring data with peers of similar (higher) bandwidth.Similarly the affect on medium leechers is a mere increaseof 1 % in download time. This happens because the mali-cious peer forces the medium leechers to not only communi-cate with the fast leechers but also to communicate with theslow leechers, therefore, for the medium leechers the com-munication with slow leechers almost neutralizes their dataexchange with the fast leechers. Finally, the slow leechersare able to download the file in 1.5 % less time. This is be-cause, the slow leechers are now communicating more withthe leechers of higher bandwidth.5. FUTUREWORKIn this paper we demonstrated a malicious peer which at-tacks on a swarm and results in increased download time forfast leechers. While countermeasures is a part of our ongoingresearch work, a simple yet less elegant solution would beto keep a blacklist of IP addresses which are mounting suchattack and during random selection of choking algorithm,such peers are not chosen. As additional future work, weare planning to test this attack in PlanetLab. We also planto investigate the affect of increasing the number of ma-licious peers and the affect of scaling of this attack whenmore malicious peers are added to the swarm.6. REFERENCES[1] B. Cohen. The Bittorrent Protocol Specification, Feb.2008. http://bittorrent.org/beps/bep_0003.html.[2] P. Dhungel, D. Wu, X. Hei, B. Schonhorst, and K. W.Ross. A Measurement Study of Attacks on BitTorrentLeechers. IPTPS, 2008.[3] A. Legout, N. Liogkas, E. Kohler, and L. Zhang.Clustering and sharing incentives in BitTorrentsystems. In Proceedings of the 2007 ACMSIGMETRICS International Conference onMeasurement and Modeling of Computer Systems,pages 301–312, New York, USA, 2007. ACM.[4] Media Defender, March 2011.http://www.mediadefender.com.[5] E. Van Der Sar. BitTorrent Traffic Surges AfterLimeWire Shutdown. http://goo.gl/UIRmS, March2011.

Destabilizing BitTorrent's clusters to attack high bandwidth lechers

Abstract

Similar works

Full text

Available Versions

City Research Online