Inference on the Network Evolution in BitTorrent Mainline DHT

TL;DR

This paper demonstrates that Fourier transform-based analysis of network size time series in BitTorrent Mainline DHT can reveal user behavior patterns and detect anomalies such as attacks and real-world events automatically.

Contribution

It introduces a novel application of Fourier transform to extract features from network size data for behavior analysis and anomaly detection in peer-to-peer systems.

Findings

Successfully clusters countries by user behavior

Detects anomalies like Sybil attacks with high accuracy

Highlights the effectiveness of advanced time series analysis

Abstract

Network size is a fundamental statistic for a peer-to-peer system but is generally considered to contain too little information to be useful. However, most existing work only considers the metric by itself and does not explore what features could be extracted from this seem- ingly trivial metric. In this paper, we show that Fourier transform allows us to extract frequency features from such time series data, which can further be used to characterize user behaviors and detect system anoma- lies in a peer-to-peer system automatically without needing to resort to visual comparisons. By using the proposed algorithm, our system suc- cessfully discovers and clusters countries of similar user behavior and captures the anomalies like Sybil attacks and other real-world events with high accuracy. Our work in this paper highlights the usefulness of more advanced time series processing techniques in analyzing network measurements.