WINNOWING : Protecting P2P Systems Against Pollution By Cooperative Index Filtering

Transcription

1 WINNOWING : Proecing P2P Sysems Agains Polluion By Cooperaive Index Filering Kyuyong Shin, Douglas S. Reeves, Injong Rhee, Yoonki Song Deparmen of Compuer Science Norh Carolina Sae Universiy Raleigh, NC kshin2, reeves, rhee, ysong2@ncsu.edu Absrac Polluion (i.e., sharing corruped files, or conaminaing index informaion wih bogus index records) is a de faco problem in many file sharing Peer-o-Peer (P2P) sysems. Since polluion squanders nework resources and frusraes users wih unprofiable downloads (due o pollued files) and unproducive download requess (due o bogus index records), he fuure success of file sharing based P2P sysems is quesionable unless properly addressed. In his paper, we propose a novel ani-polluion scheme called winnowing. Winnowing aims o purify he index records (i.e. he informaion on files or he publishers) held by each index node in he sysem, so ha download aemps based on hese index records are more likely o yield saisfacory resuls. To aain his goal, index nodes block bogus publish messages by verifying he publisher and he conens of he publish message upon receip of a keyword or conen publish message. Second, index nodes collec feedback from he users who have downloaded files via heir index records. The colleced feedback is hen processed and refleced in he maching index record in a novel way. Careful consideraion is given o reducing he impac of false feedback, and malicious index nodes. Publish message verificaion has been implemened on op of he laes emule clien and exensive daa has been colleced from he Kad nework, using his modified clien. The measuremen resuls are summarized in his paper. The he findings from he measuremen sudy are incorporaed ino our analyical model, which is used o invesigae he performance of user feedback mediaion. The model demonsraes he effeciveness of user feedback mediaion: fas convergence o near-opimal performance and insensiiviy o various polluion aacks including he aacks which aemp o bypass winnowing. I. INTRODUCTION Peer-o-Peer (P2P) sysems have emerged as a dominan way o exchange informaion in he Inerne. Unforunaely, he informaion currenly shared in P2P sysems frequenly urns ou o be mislabeled or corruped, wasing nework bandwidh, user ime, and sorage space. For example, iang e al. [] showed ha up o 8% of he copies of popular files in he KaZaA nework are conaminaed. This conaminaion is caused in par by polluion echniques ha are inenionally inroduced by copyrigh holders [ 3]. Because polluion was no considered in he design of P2P sysems, hey are highly vulnerable o such inenional aacks [2]. Subsanial research has been done on he prevenion of polluion in P2P sysems. Several modeling echniques [3 5] have been inroduced, which are useful in undersanding he proliferaion of polluion. Some previous work [, 2, 6, 7] has given general ideas on how polluion can be reduced. Peer repuaions [8, 9] and objec repuaions [] are he major soluions proposed hus far in his lieraure. Unforunaely, no repuaion echnique o dae has been noably successful in pracice a prevening or minimizing polluion. There may be muliple reasons for his failure, including he cold sar problem for newcomers [], vulnerabiliy o Sybil aacks [, 2, 3], and he complexiy of implemenaion of proposed repuaion sysems [, ]. As a resul, i has been found ha a random based selecion approach is mos effecive under severe polluion [4]. In addiion, he fac ha he version populariy of a ile follows a Zipf disribuion in mos file sharing P2P sysems [] srongly indicaes ha users end o selec a file based on is populariy, which is also confirmed by our measuremens on he Kad nework [4] as indicaed in secion VI-A. This paper addresses he polluion problem in DHT-based P2P sysems, wih a focus on he Kad nework. We propose a novel ani-polluion scheme, called winnowing. Winnowing direcly aims o reduce he number of fruiless requess o download non-exising files and he number of downloads of pollued files by offering clean (valid, poining o unpollued files) index records o requesing peers. To aain his goal, index nodes firs deec (and ignore) bogus publish messages by verifying he publisher and he conens of he publish message upon receip of a publish message. Second, index nodes collec feedback from he users who have downloaded files via heir index records. The feedback is processed in a novel way o increase he likelihood ha index records poining o pollued files will quickly be eliminaed or disregarded. Careful consideraion is given o reducing he impac of false feedback, and malicious index nodes. The key insigh behind winnowing is ha he downloads of pollued files can be grealy reduced if index nodes aggressively mainain clean or valid index records. Publish message verificaion frusraes any aemps o inser bogus index records (poining o non-exising files or publishers) ino he sysem. User feedback mediaion helps prospecive users o efficienly find unpollued files wih he help of index nodes and oher downloaders. Winnowing has he following benefis: I can sharply reduce he number of bogus index records poining o non-exising files in a P2P sysem. Our measuremens (during Summer 28) have shown ha

2 beween 27% and 35% of he index records currenly shard in he Kad nework are bogus, which have been successfully filered ou by winnowing. I is easy o implemen, compleely disribued, and scalable. Winnowing does no require any rused hird paries, cenralized servers, or complex securiy mechanisms. Random numbers (crypographic nonces) are used insead for securiy purposes I converges quickly, and provides considerable immuniy o polluion even when accompanied by Sybil aacks. I does no have he cold sar problem as newcomers can immediaely benefi from he effors of index nodes and former downloaders o mainain clean index records. We implemen publish message verificaion on he laes version of emule clien. Using his modified clien, exensive daa has been colleced from he Kad nework. The resuls are summarized in his paper and he findings from he measuremen sudy are incorporaed ino our analyical model which is used o sudy he performance of user feedback mediaion. The model demonsraes he effeciveness of user feedback mediaion: fas convergence o near-opimal performance and insensiiviy o various polluion aacks. The remainder of his paper is as follows: In secion II, some P2P erminology and a brief overview of he Kad nework are inroduced. Exising polluion sraegies are discussed in he laer par of he secion. Secion III briefly describes and analyzes exising mehods of ani-polluion approaches. Secion IV presens he basic proocol descripion of winnowing. Some securiy consideraions are discussed in secion V. The resuls of he measuremen and analysis are presened in secion VI and VII respecively. Secion VIII discusses limiaions of he proposed mehod and possible soluions. Finally, secion IX concludes his paper. II. BACKGROUND In his secion, some P2P erminology and a brief overview of he Kad nework, he larges DHT-based P2P nework in exisence, will be inroduced, emphasizing on he publish and search mechanisms. Exising polluion sraegies will be discussed in he laer par of his secion. A. Basic P2P Terminology Here, we invesigae polluion problems in he DHT-based file sharing P2P neworks, focusing on he disribuion of movies or songs. A specific file, wheher a movie or song or somehing else, is referred o as a ile. There may be differen versions of a ile, and for one version of a ile, muliple copies could exis if he version is downloaded and shared by many users in he nework. There can also be many decoys, which appear o be versions of he ile, bu which do no in fac exis in he nework, or which conain corruped/lowerqualiy conen. Each file has meadaa, which is srucured informaion ha describes he file. Meadaa includes he file name, he file size, and he file ype or forma, ec [, 4]. A hp://emulemorph.sourceforge.ne/ keyword is a single oken exraced from he meadaa of a file, usually from he file name. I mus be composed of a leas hree characers [4]. Each file migh have many keywords. A key is an idenifier used o sore and rerieve informaion in and from he DHT, and has he same bi size as all Kad IDs. There are wo ypes of keys, a conen key and a keyword key. A conen key may be generaed by hashing he enire conen of a file, whereas a keyword key is obained by hashing a keyword of he file. A user is an operaor of a P2P clien applicaion, whereas a peer (or inerchangeably a node) is he clien applicaion iself. A user is called a conen owner (or alernaively a publisher) when he user conribues a file o he P2P nework. A user downloading a file from he he nework is referred o as a downloader. <kk2, ck, meadaa> 2 2 kk=hash( dragon ), keyword publish (kk) <keyword key, conen key, meadaa> <ck, publisher info.> <kk, ck, meadaa> Fig.. A high level absrac overview of he publish mechanism in a DHT-based P2P sysem. In his example, we assume ha he publisher wans o publish a movie file, Dragon War.mpg. Firs, he publisher hashes he enire conen o ge he conen key (ck) of he file and sends conen publish messages o he conen key owner(s). Second, he publisher hashes each keyword (i.e. dragon and war ) o ge a keyword key (kk) and sends keyword publish messages o he keyword key owner(s) of each keyword. B. Publishing and Rerieving Publishing is used o index he informaion abou a file or a publisher o he node(s) in charge of a porion of he Kad ID space. A peer who wans o publish a file (i.e. publisher) firs generaes he conen key by hashing he file conens. The publisher locaes he node ha has he closes Kad ID o he conen key 2 hrough ieraive rouing [4, 5]. Once deermined, he closes node becomes a conen key owner of he file. The conen key owner updaes is local index able wih a record <conen key, locaion informaion>, which is called a conen index record. The locaion informaion includes he basic informaion on he publisher, such as he Kad ID, he IP address, he service (TCP) por number, ec. In addiion, he publisher hashes each keyword of he file o produce a keyword key, one per keyword. For each such keyword key, he publisher locaes he closes node (keyword key owner) o he keyword key, in he same way as before, 2 Currenly, emule uses a fuzzy algorihm which selecs several peers as key owners (i.e. a olerance zone). This means he IDs of he key owners are no necessarily he closes; he deails do no affec our mehod, so we coninue o use he erminology closes for simpliciy.

3 and publishes he index informaion of he file. Each keyword key owner updaes is index able wih a record <keyword key, conen key, meadaa >; his is ermed a keyword index record. For a given key, up o closes nodes can be seleced as key owners, referred o as a olerance zone, o deal wih high churn raes. This conen publishing followed by keyword publishing is called a 2-level publishing scheme [4]. Keys are periodically republished every 5 hours for conen keys and 24 hours for keyword keys. <kk2, ck, meadaa> <kk, ck, meadaa> 3 File download <ck, publisher info.> Fig. 2. A high level absrac overview of he search mechanism in a DHT-based P2P sysem. In his example, we assume ha he downloader wans o find he movie file, Dragon War.mpg, from he sysem. To find he file, firs, he downloader hashes a possible keyword (e.g. dragon in his example) o ge he keyword key. Then, sends keyword search messages o he keyword key owner(s). Second, he downloader selecs one conen key amongs all possible conen keys reurned by he keyword key owner(s) based on he meadaa of each index record and sends conen search messsages o he conen key owner(s). Finally, he downloader downloads he file from he conen owner(s) based on he publisher (i.e. locaion) informaion reurned by he conen key owner(s). Rerieving file informaion from he DHT is essenially he inverse of publishing. A peer wishing o locae a file obains a conen key hrough a keyword search. This conen key is hen used o obain locaion informaion via a conen search. Finally, he user aemps o download he file from he publisher(s) based on he locaion informaion obained. C. Exising Polluion Aacks Depending on he sraegies aken by polluers, polluion can be classified ino hree caegories; conen polluion, meadaa polluion, and index polluion. Conen polluion [, 3, 7] changes he conens of a shared file o degrade is qualiy by insering whie noise, shuffling conens, insering or subsiuing unrelaed informaion, ec. Polluers can easily generae muliple fake files which have he same conen hash value (i.e. he same conen key) by exploiing he weakness of he curren hash funcion of he Kad nework, MD4 [6]. Meadaa polluion [,2] ampers wih he meadaa of a file raher han is conen; as a resul, peers downloading files based on ha meadaa will obain conen differen from wha hey expec. Index nodes may unwiingly sore index records poining o pollued files affeced by conen or meadaa polluion, which are referred o here as 2 corruped index records. Under hese wo sraegies, polluers indeed upload he corruped files a heir own expenses of upload bandwidh. As opposed o he above wo, index polluion [7] direcly aacks he index srucure of a P2P nework. On he one hand, a polluer can generae a random conen key which migh no mach any file in he nework, and publish he informaion <keyword key, random conen key, meadaa> o he maching keyword key owners. One he oher hand, a polluer can generae an invalid IP address ha does no correspond o any nodes (or an unavailable service por number), and publish he informaion <conen key, spurious locaion informaion> o maching conen key owners. Index nodes may unconsciously sore index records poining o non-exising files or publishers, which are referred o here as bogus index records. Wih index polluion, users fail o locae he arge file (or he publisher) when relying upon he informaion in a bogus index record. Since index nodes in mos file-sharing based P2P sysems oday do no auhenicae or verify publish messages, polluers easily conaminae he index records [7]. Moreover, polluers don need o ransfer any files, which makes his polluion sraegy prevalen in curren P2P sysems. III. REATED WORK Due o he imporance of ani-polluion in P2P sysems, here has been considerable work on he problem, saring wih modeling and measuremen. Dumiriu e al. [4] analyzed he influence of file- and nework-argeed aacks on file sharing neworks. They concluded ha randomized reply selecion provides considerable immuniy o polluion aacks, bu significanly hurs sysem performance in he absence of an aack. Kumar e al. [5] developed fluid models o capure he spread of pollued files, and user behavior. ee e al. [3] measured he awareness of real users of pollued files and incorporaed he resuls ino heir analyic model, concluding ha awareness is a key facor in polluion dynamics. One of he major direcions in resolving he polluion problem is peer repuaion [8, 9]. EigenTrus [8] calculaes and mainains a global repuaion for each peer, based on he opinion of all oher peers who have ineraced wih ha peer in he pas. Wih Scrubber [9], a peer idenifies malicious peers (who inenionally disribue pollued files) based on is direc experience, and he peer esimonials given by is neighbors. Scrubber also offers a peer rehabiliaion mechanism by giving incenive o passive polluers who volunarily remove pollued conen. Is decenralized archiecure faciliaes easy deploymens. Previous sudies [4, ], however, have shown ha peer repuaion approaches do no effecively deal wih index polluion, paricularly in a large P2P sysem. Winnowing can address index polluion wih publish message verificaion as indicaed in our measuremen resuls in secion VI. Anoher major direcion is objec (or file) repuaion [, 8]. Credence [] is a disribued voe gahering proocol in which a peer collecs voes from is neighbors o assess he auheniciy of he conen i wans o download. This mehod deermines correlaion beween wo peers based on

4 he similariy of heir voing hisories. Pracical difficulies of he mehod are he slow convergence ime o find srong relaionships [3], and he use of crypographic keys o proec voes. Differen from Credence, a downloader in winnowing needs no individually find such correlaion wih oher users in ha responsible index nodes (i.e. keyword key owners) evaluae he repuaion of an objec on behalf of individual downloaers. IP [8] is a varian of objec repuaion. IP uses a lifeime and populariy based ranking approach o filer ou pollued files. However, he major assumpion ha users end o reain a real file longer and delee a fake file more quickly, is somewha conroversial if he discoveries in [3, 9] are considered. Cosa e al. [3] ake a hybrid approach beween he peer repuaion and objec repuaion mehods. Even hough repuaion sysems are he main sream of ani-polluion in curren P2P sysems, here do exis some oher approaches. Blackising [6] is a way o find he IP address ranges ha include he large majoriy of polluers. This is done by he use of crawlers specially designed o collec meadaa from P2P neworks. This mehodology is efficien and effecive. The cenralized naure of his approach, however, could suffer from scalabiliy, faul-olerance, and securiy problems as menioned in [9]. User Filering [, 9] could reduce a large fracion of polluion if users are aware of he polluion. This approach is, however, no robus o index polluion. The Query Resul Ranking approach [2], Trus based approach [], and Traffic Encrypion approach [7] are also inroduced in his lieraure wihou implemenaion. Recenly Wang e al. [2] inroduced several aacks ha exploi criical design weaknesses of he Kad rouing, which hinders users from searching he index informaion iself. These aacks can be reduced by some minor modificaions of he Kad rouing mechanism, mos of which are already implemened in up-o-dae emule cliens (e.g. emule.49a). Moreover, since hey are insering malicious index nodes in he sysem, winnowing can handle he aacks wih he imbalanced feedback mechanism explained in secion V-B. IV. OUR APPROACH : WINNOWING In his secion we presen he basic proocol descripion of winnowing. Winnowing aims o reduce decoy (i.e. bogus or corruped) index records in P2P sysems 3. This is accomplished by publish message verificaion and user feedback mediaion. A. Publish Message Verificaion To preven index polluion (secion II-C), index nodes in winnowing verify he publisher and he conens of each (keyword and conen) publish message whenever received. The imporan principle here is ha no informaion published is acceped a face value; i is confirmed by he index nodes before accepance. 3 We focus on keyword index records in his paper, for he sake of breviy of explanaion. Publish Message Verificaion User Feedback Mediaion downloader keyword key owner(s) publisher conen key owner(s) KE Y W OR D _ S E A R C H_ R E Q K E Y W O R D _S E A R C H _R E S AFR_REQ and RES CONTENT_DOWNOAD MJR_REQ and RES K E Y W O R D _P U B I S H _R E Q P U B IS HE R _ V E R I_ R E Q P U B I S H E R _ V E R I _ R E S CONT E NT _ KE Y_ VE RI_ RE Q C O N T E N T _K E Y _V E R I _R E S KE Y W OR D _ P U B IS H_ R E S CONTENT_SEARCH_REQ CONTENT_SEARCH_RES AFR_REQ and RES MJR_REQ and RES C ON T E N T _ P U B IS H_ R E Q P U B I S H E R _ V E R I _ R E Q P U B IS HE R _ V E R I_ R E S O C A T I O N _ V E R I _ R E Q OC A T ION _ V E R I_ R E S C ON T E N T _ P U B IS H_ R E S Fig. 3. Message processing in emule wih winnowing. Black solid arrows are he normal emule messages; red dashed arrows are messages added by winnowing. Winnowing uses publish message verificaion (➀ ➃) o preven index polluion and user feedback mediaion (➄ ➉) o address conen and meadaa polluion. ) Publisher Verificaion: Index nodes mus verify wheher he publisher is a member of he nework whenever a publish message is received from a publisher, ermed publisher verificaion. Since he Kad nework adops he ieraive rouing, any peer could send publish messages direcly o maching index nodes once idenified. If no verified, one single polluer, which may or may no be a member of he nework, could repeaedly send bogus publish messages o he index nodes. This would cause he index nodes o keep many bogus index records. Publisher verificaion can simply be accomplished by sending an applicaion level hello message o he publisher (➀ and ➁), and waiing for a response. Any publish messages from he publishers wih no response are disregarded. Publisher verificaion could reduce he effec of IP spoofing presumably aken by polluers. 2) Message Conen Verificaion: The publisher verificaion above canno refrain polluers from sending publish messages wih bogus informaion if hey join he nework as a legiimae member. To block he bogus publish messages received from such polluers, index nodes should aemp o verify he conen of each publish message. Each keyword key owner mus verify he conen key in a keyword publish message, which is called conen key verificaion. A polluer can generae a random conen key which migh no mach any file in he nework, and publish he informaion <keyword key, random conen key, meadaa> o he maching keyword key owners, which is prevalen in curren P2P sysems [7]. Verificaion of he keyword publish

5 message is accomplished by issuing conen search messages, using as a arge he conen key in he keyword publish message (➃). A successful reply indicaes he conen key is valid 4. Only valid conen keys are indexed by maching keyword key owners. To bypass conen key verificaion, he polluer may send conen publish messages o he maching conen owners corresponding wih he random conen key. This, however, coss even more ime, effors, and resources of he polluer. In addiion, since each conen publish message is again verified by he maching conen key owner, he effec of his kind of aack is highly resriced. Moreover, winnowing will furher filer ou such bogus index record wih user feedback mediaion explained below. ocaion verificaion, performed by each conen key owner (➂), is very similar. B. User Feedback Mediaion The verificaion seps explained above canno preven conen and meadaa polluion by hemselves, as index nodes are unable o judge he auheniciy or qualiy of file conens. Therefore, polluers can sill sore corruped informaion (i.e. corruped index records) in he P2P sysem. To deal wih hese polluion aacks, an index node makes use of feedback provided by he users who download files based on informaion mainained and provided by he index node. The index node collecs his feedback (hrough voing) and disseminaes i (in condensed form) o poenial downloaders, along wih he oher index informaion. In fac, user feedback mediaion is a kind of repuaion and he use of repuaion is a raional choice in a disribued sysem wih malicious aackers. The novely of our scheme lies in he way of implemenaion of he repuaion. ) User Feedback Collecion: To collec user feedback, each keyword key owner mainains wo kinds of liss: keyword reference liss (KRs) and conen key voer liss (CKVs). One KR is allocaed o each keyword key and one CKV is assigned o each conen key. Once a keyword key owner receives a keyword search query from a peer P, i generaes a random number R 5 and insers <IP address, R > ino he maching KR (➅). If here is feedback o a conen key from a peer, he keyword key owner checks he KR o see wheher he peer has ever issued a keyword search query before. This can be done based on he peer s IP address and he random number presened as he proof of he peer s keyword search. If yes, hen i checks he mapping CKV o see wheher he peer has previously cas is opinion o he conen key. If no, hen i reflecs he feedback by increasing (for a posiive voe) or decreasing (for a negaive voe) he voing credis for he conen key (➇ and ➉). Finally, he keyword key owner insers <IP address, 4 Conversely, if here is no reply for he conen searches wih he conen key wihin given period of ime, he conen key will be considered as bogus. Noe ha search queries succeeds 99.9% of he ime in curren emule [2], which means he his assumpion is raional. 5 This random number (a crypographic nonce) prevens aackers from using IP addresses on he ouside of heir local sub-neworks. R> ino he CKV, prevening he peer from casing he same voe muliple imes. User feedback collecion done by each conen key owner is virually he same (➄, ➆, and ➈). 2) User Feedback Repors: To help eliminae pollued conen, some fracion of users will repor heir file download experiences o he appropriae index nodes. The user feedback repor comprises he auomaed failure repor (AFR) and he manual judgemen repor (MJR). An auomaed failure repor message is auomaically generaed and marked as pollued by he clien program for every failed download rial (➇, ➆) wihou any user inervenion. The repor is direcly sen o he mapping keyword key owner if no locaion informaion is reurned for he conen key aemped (➇) or o he mapping conen key owner if a download rial wih given locaion informaion has failed (➆). This failure could be caused by eiher a bogus index record no being properly filered ou by he maching index nodes or by a sale index record. If a download aemp is successful, and upon viewing or lisening o he file s conens, he user may send a manual judgemen repor (➉, ➈) by simply marking i as eiher clean or pollued a his or her own discreion. This repor is sen direcly o boh index nodes, keyword key owner (➉) and conen key owner (➈), so ha he resuls are refleced o he voing credis for he mapping index records. 3) Voing Credi Updae Approaches: Wih regard o he voing credi updaing, 3 differen approaches are envisioned: Addiive Increase Addiive Decrease (AIAD), Addiive Increase Muliplicaive Decrease (AIMD), and Muliplicaive Increase Muliplicaive Decrease (MIMD). Noe ha, in all approaches, he iniial amoun of voing credis for an index record is, assuming ha he original publisher of he file auomaically cass a posiive voe. Firs, in he AIAD approach, index nodes add or subrac poin o or from he amoun of voing credis for he index record (i.e. conen key or locaion informaion), if a posiive or negaive voe is received for a index record. This approach would be effecive when he probabiliy ha a downloader cass a voe is high and he cos of casing a voe is almos he same regardless of posiive or negaive. The approach, however, may no fi well wih winnowing if he imbalanced feedback mechanism (secion V-B) is considered. Second, in he AIMD approach, he amoun of voing credis for an index record increases by one whenever a posiive voe is received and conversely decreases by half for a negaive voe. This approach is effecive when more value needs o be given o a negaive voe, which is he case in winnowing due o he imbalanced feedback. Third, in MIMD approach, he amoun of voing credis for an index record doubles for a posiive voe bu decreases by half for a negaive voe. This approach is appropriae when he user feedback rae is relaively low because i increases he amoun of voing credis for he index records of clean files much faser han AIMD. Throughou his paper, we mainly focus on he analysis

6 of AIMD and MIMD approaches, considering ha () more value should be given o a negaive voe due o he imbalanced feedback of winnowing (he reason for he use of AIMD) and (2) i s difficul o expec exremely high user feedback in real P2P sysems (he reason for he use of MIMD). V. SECURITY ANAYSIS OF WINNOWING The purpose of winnowing is o uilize he index srucure of a P2P sysem o remove decoy index records; non-pollued files will hen be easily locaed by downloaders hrough he remaining valid index records. The obvious response of polluers will be o preserve decoy index records as long as possible. A. Reverse Voing Aack A likely arge of aack will be he user feedback mediaion mechanism of winnowing. Tha is, malicious nodes will lie (i.e., voe posiively for decoy index records and voe negaively for clean index records). This is referred o here as reverse voing. Such users may also aemp o amplify he impac by forging false ideniies (i.e., resoring o he Sybil aack [2]). Winnowing addresses his problem by he IP/24 prefix based binning sraegy wih weighed voing. In his approach, one IP/24 address prefix 6 is mapped ino a bin, and he weigh of a voe in he same bin decreases as he number of voes in he bin increases. This prevens muliple voes in he same IP range from being weighed oo much. The moivaion for his approach is ha i has been found ha he majoriy of users in P2P sysems are benign, and only a small facion of users in a resriced IP range are polluers. This was shown in previous work [6] and confirmed in our own measuremen resuls VI-A. In addiion, noe ha aackers can easily change or creae heir IDs (i.e. Sybil nodes) wih lile cos, bu he use of muliple IP addresses ouside of heir local sub-nes is highly resriced due o he nonce, R, explained in IV-B. B. Index Node Inserion Aack Alernaively, aackers can ry o inser hemselves as an index node of he arge file so ha hey can easily falsify he index records as hey wish. This will be possible if an aacker inenionally manipulaes is Clien ID so ha he ID maches he hash of a keyword or a conen key of he arge file. Once he aacker becomes he index node(s) of he arge ile and reurns only decoy index records whenever asked, a clean copy of he desired file canno be locaed by benign requesers. Aackers may use he Sybil aack o enhance he effeciveness of he aack. To deal wih his problem, winnowing adops a so called imbalanced feedback mechanism in which he size of voing messages differs based on wheher he voing is posiive or negaive. Tha is, he size of a posiive voe is very small (e.g. a few ens of byes) whereas he size of a negaive voe is 6 IP/24 prefix is used for he binning sraegy here based on our observaion, bu any range of prefixes of IP addresses could be applicable depend on he circumsance. relaively large (e.g. a few megabyes). This echnique has wo unique advanages. Firs, i penalizes malicious index nodes in ha index nodes wih decoy index records will suffer from a high volume of negaive voes in erms of quaniy. Second, he echnique makes i more difficul for aackers o cas many reverse voes for clean index records since ha will consume heir own resources. Noe ha even hough he size of negaive voe is large, i will no burden complian users much. This is because since winnowing converges fas, he number of negaive voes which benign users need o cas will be very small in normal case. However, acive polluers need o cas many negaive voes o nullify user feedback mediaion offered by winnowing, which demands exorbian upload bandwidh. C. Keyword Index Hijacking A final aack is simply o creae malicious index nodes (i.e. keyword owners in his case) which own a porion of he keyword address space, and fail o provide any keyword index records for seleced files. By doing so, he aacker prevens legiimae users from finding a conen key for he ile. Unforunaely, he imbalanced feedback mechanism of winnowing won help agains his kind of aack, since no search resuls are provided. We believe such aacks will be difficul and expensive, given he degree of redundancy of keyword index records in curren sysems. For insance, i has been found ha here are an average of 9 keyword key owners for a single keyword in he KAD nework [2], and each ile is indexed by a number of keywords. In addiion, Kad nework adop a so called α query (i.e. loose concurren lookup) [4] where hree searches for one search reques are launched in parallel o avoid sale rouing able enries, which could furher reduce he effec of his ype of aack. VI. MEASUREMENT RESUTS To check he effeciveness of winnowing and for beer undersanding of he Kad nework, parial funcionaliies of winnowing, he publish message verificaion (secion IV-A), is implemened on op of he up-o-dae emule clien (.49a MorphXT version. [22]). Even hough he winnowing clien does no implemen user feedback mediaion (secion IV-B), i suffices o undersand he index polluion problem in he Kad nework and how efficienly winnowing deals wih he problem. Five mp3 songs are invesigaed in he measuremen. The firs 4 famous songs (T T 4 ) were seleced from he Top Songs [23] in June of 28. The las one (T 5 ) is seleced for comparison from he lae 97 s billboard chars, which hi # a ha ime bu is relaively less popular nowadays. To collec resuls, we insered he winnowing cliens ino he Kad nework. Firs, for he keyword key owners, one keyword per each ile (K Ti ) is exraced from he file name and hashed ino he 28-bi keyword key. Then, he clien ID of he mapping keyword key owner is configured o have he same key value as he keyword key. By doing ha, each winnowing clien can receive keyword publish messages for he mapping keyword. Each keyword key owner verifies he

7 2:3 7:3 22:3 3:3 8:3 3:3 8:3 23:3 4:3 9:3 3 x 4 4 K T K T2 K T3 K T4 K T5 35 K T K T2 K T3 K T4 K T5.9 oal number of keyword publish messages conenkey search failure rae (%) fracion of failed keyword publish messages K T K T2 K T3 K T4 T 5 k 5. ime of he day 2:3 7:3 22:3 3:3 8:3 3:3 8:3 23:3 4:3 9:3 ime of he day fracion of disinc IPs of he publishers (a) oal # of keyword publish messages (b) conen key verificaion failure rae per hour (c) CDF of publishers of failed ones 6% conen key verificaion failure rae (cumulaive) 55% 5% 45% 4% 35% 3% 25% 2% 5% K T K T2 K T3 K T4 K T5 PDF of copies (log scale) T T 2 T 3 T 4 T 5 PDF of copies (log scale) 2 3 T T 2 T 3 T 4 T 5 % 2:3 7:3 22:3 3:3 8:3 3:3 8:3 23:3 4:3 9:3 ime of he day 2 conenkey number (ordered by populariy log scale) 4 2 conen key number (ordered by populariy log scale) (d) cumulaive conen key verificaion failure rae (e) op conen keys passed (f) op conen keys failed Fig. 4. Keyword publish saisics in he Kad nework publisher whenever i receives a keyword publish message by sending a KADEMIA HEO REQ message (i.e. PUB- ISHER VERI REQ). Conen key verificaion follows for he keyword publish message which has passed he publisher verificaion by sending KEDEMIA SEARCH REQ (i.e. CONTENT KEY VERI REQ) messages. If any reply is reurned wihin 45 seconds, he conen key is reaed as successful and will no be esed furher in following keyword publicaions. The failed conen keys, however, are coninually being verified. Only he conen keys which have never passed he conen key verificaion hroughou he measuremen period are marked as bogus. Second, for each conen key owner, he opmos popular conen key (i.e. version) amongs all conen keys of each ile is seleced. The conen key mus pass he wo verificaions by he maching keyword key owner. The opmos popular conen key is hen configured as is clien ID. Conen key owners carry ou he publisher verificaion and locaion verificaion in a similar way. Daa is colleced for 48 hours for keyword publish messages and hours for conen publish messages, hus reflecing a wice long ime period of he normal republish cycle. A. Keyword Publish Saisics Figure 4(a) shows he oal number of keyword publish messages received by each keyword key owner. I clearly demonsraes he ime of day effec on he oal number of keyword publish messages. I also describes load inequaliies in keyword key owners by an order of magniude. Figure 4(b) presens he conen key verificaion failure raes per hour wih respec o he oal number of keyword publish messages which have passed he publisher verificaion. The average failure rae was.6% for he publisher verificaion (graph is no shown) and 7.69% for he conen key verificaion respecively. Ineresingly, similar o 4(a), he conen key verificaion failure rae also shows he ime of day effec bu exacly in reverse. This indicaes ha some fixed amoun of bogus keyword publish messages coninue o be published by polluers. Thus, when here exiss a relaively high number of legiimae keyword publishes, he rae is low, bu as he number of legiimae keyword publishes decrease, he rae increases. Figure 4(c) plos he cumulaive disribuion funcion (CDF) for he fracion of keyword publish messages failed wih respec o he fracion of disinc IPs of he publishers. In his figure, IPs are reordered according o he number of keyword publish messages hey adverised (he mos, he firs). As indicaed, more han 6% of failed keyword publish messages are published from less han 2% of IPs for he 4 famous mp3 songs. This clearly shows ha here exiss a small fracion of users who cas massive bogus keyword publish messages for he famous songs. In fac, we idenified wo IP/24 ranges in which mos polluers reside, which appear in all he 4 mp3 songs. I is, however, no rue for he las less popular song. The polluion so far is described in erms of he oal number of keyword publish messages received by each keyword key owner. I is noed, however, ha here exis muliple keyword publish messages for he same conen key. In addiion, each keyword key owner receives he keyword publish messages no only for he arge keyword, bu also for he keywords whose hash values are numerically close enough o is clien ID. Since a user firs sends a keyword search message o find a ile, and he resuls include only he conen keys whose file

8 name includes he keyword, we need o consider he index polluion level in erms of disinc conen keys. Figure 4(d) demonsraes he cumulaive conen key verificaion failure raes wih regard o he oal number of disinc conen keys whose file name ruly includes he arge keyword. This falls in he range from 27% o 35%. Meaning ha, if a user sends a keyword search message wih he keyword K T2 o find he ile of T 2, up o 35% of conen keys amongs all he conen keys reurned are bogus, herefore he user canno find any locaion informaion wih he conen keys. Finally, version populariy of each arge song is invesigaed. In he Kad nework, he number of keyword publish messages for a conen key represens he populariy of he version (i.e. conen key) because here mus be a keyword publish message whenever a version is downloaded. To check he populariy, conen keys are ordered based on he number of keyword publish messages received during he measuremen period. Figure 4(e) demonsraes he PDF on a log-log scale for he number of copies wih respec o he op conen keys which have passed he conen key verificaion. The near lineariy of he curves confirms ha he version populariy of a ile in he Kad nework follows a Zipf disribuion, which addiionally confirms he resuls of previous sudies [, 9] on oher P2P sysems. Similar examinaion was made for he conen keys failed in he conen key verificaion. Figure 4(f) shows he PDF on a log-log scale for he number of copies wih respec o he op conen keys failed. The resuls shows ha mos bogus conen keys are published only once. B. Conen Publish Saisics Similar measuremens are conduced for conen publish messages, bu only he resuls for he saisics of users who have downloaded he same version in he same IP/24 ranges are shown here because he resuls are mos relevan o he analyic models in secion VII. TABE I THE NUMBER OF USERS PER IP/24 users / IP24 T T2 T3 T4 T5 2,362 6,827 4,292 4, ,435 9, Table I shows he number of users in each IP/24 for he opmos popular conen key of each ile. Ineresingly, he average number of users per IP/24 range who have downloaded he same version was only.. Noe ha he daa was colleced for hours, which is wice longer han he conen republish cycle, meaning ha he acual number migh be lower. VII. MODE BASED ANAYSIS AND RESUTS In his secion, we develop an analyical model for winnowing o sudy he relaive performance of he approach, focusing on user feedback mediaion (secion IV-B). The model exends previous analyical models [3 5] and capures he dynamics of he proliferaion of he good and bad copies of a single ile in he sysem. Here, he model is briefly described and compared wih previous models (he random selecion model and he populariy based selecion model in [3 5]). Noaion used in his analysis is shown in able II. TABE II SUMMARY OF NOTATIONS IN THIS SECTION M oal # of fresh users joining he nework λ user arrival rae a ime (Mλ users join he sysem a ime ) G # of good copies currenly shared in he nework a ime Nv G # of good versions (assume Nv G = G ) B # of bad copies currenly shared in he nework a ime Nv B # of bad versions (assume Nv B = B ) G # of users downloading a good version a ime B # of users downloading a bad version a ime R # of rerials a ime V G oal amoun of voing credis of good versions a ime V B oal amoun of voing credis of bad versions a ime p a probabiliy ha a user recognizes he polluion p s probabiliy ha a user shares a file afer download p v probabiliy ha a user cass a voe afer download α weighing facor([.]) maximum slackness (ime from download o auheniciy check) A. Analyic Models Iniially, here exis G differen good versions fed by benign users and B differen bad versions inroduced by polluers for he arge ile in he sysem. e M be he oal number of non-malicious, fresh users joining he sysem o download a version of he arge ile (users wih inen o download only desired iles). The users arrive he sysem wih he rae of λ a ime. When a user queries for he ile, he maching keyword key owner reurns o he user a lis of versions (conen keys) available in he sysem. Then, he user selecs one from he lis a is own discreion. We will make he following assumpions abou user behavior. The iniial benign users and polluer(s) who have inroduced he incipien versions never leave he sysem and he versions keep being copied by oher users. Once a user has downloaded a version, he auheniciy of he version is checked wihin j hours, which is an independen and idenically disribued (i.i.d.) random variable wih an upper bound. If he version is auhenic, he user decides wheher o share i wih probabiliy p s. If pollued, hen he user immediaely delees i and ries anoher download by issuing a new query unil a valid copy is obained. When checking he auheniciy of a version, users migh fail o deec he polluion of a bad version (false negaive) wih he probabiliy p a. For he auhenic ones, however, no false posiive is assumed. For aack models, here exiss only one inenional polluer for he arge ile, bu he polluer could operae muliple machines (polluing peers) wih differen IP addresses. Wihou loss of generaliy, he iniial bad versions (B ) are inroduced by his polluer.

9 In addiion o he above assumpions, for simpliciy, we only focus on how efficienly users can find a good version in he sysem raher han how fas hey can download i. So, we assume ha i equally akes one ime slo (one hour) for all users o download a copy (including he query reques and response ime). In his sense, for winnowing, only he user feedback mediaion (secion IV-B) done by (maching) keyword key owners will be considered. Iniially, no aacks excep he iniial bad copies are considered o develop each model, bu will be discussed furher laer in secion VII-B. ) Random Selecion Model: When a user sends a keyword search message, he maching keyword key owner reurns a lis of possible versions of he ile currenly available in he sysem. In he random selecion model, i is assumed ha he user randomly selecs one from he lis. So, he iniial N probabiliy ha he user selecs a good version is G v Nv G+N. As v B a consequence, a ime, he number of users downloading a good version is G Nv G = Mλ Nv G + Nv B and he number of users downloading a bad version is B Nv B = Mλ Nv G + Nv B (). (2) Since he downloaded copies are immediaely shared in mos file sharing P2P sysems including he Kad nework, he number of good copies shared a ime + would be G + G. Some of he users, however, migh decide eiher no o share heir downloaded good copies or leave he sysem (wih probabiliy p s ). Assume ha such decision happens wihin j ime slos wih equal probabiliy /. Then, he number of good copies shared in he nework a ime + is G + = G + G ( p s) j= G + j. (3) Wih regard o bad copies, a downloaded bad copy will be deleed if he user deecs he polluion (p a ) or decides no o share i ( p s ) afer polluion deecion failure. Thus, he number of bad copies shared in he nework a ime + is B + = B + B (p a + ( p a )( p s )) j= B + j. (4) If a user deecs ha he downloaded copy is pollued (wih probabiliy p a ), he user immediaely delees i and issues a new search query. So, he number of rerial a ime + will be B + j R + = p a (5) j= If he rerials are considered, he equaion and 2 need o be updaed as seen below. G = (Mλ + R ) N G v N G v + N B v (6) B = (Mλ + R ) N G v N B v + N B v. (7) Noe ha under he random selecion model, he probabiliy ha a user selecs a good version remains consan over ime. So does he probabiliy ha a user selecs a bad version. 2) Populariy Based Selecion Model: If users base heir download selecion purely on versions, he download experiences of former users are useless for new arrival users. If he experiences are shared, however, he probabiliy ha a new arriving user selecs a good version could increase. In fac, in mos file sharing P2P, when an inquiry is made, index nodes reurn a lis of versions wih informaion regarding how many copies of each version are available in he nework. In he populariy based selecion model, i is assumed ha a user selecs one version from he lis based on is populariy. Tha is, he probabiliy ha a version is seleced is proporional o he number of is copies currenly shared in he nework. So, he probabiliy ha a user selecs a good version a ime G is G +B. Thus, a ime, he number of users downloading a good version is G G = (Mλ + R ) (8) G + B and he number of users downloading a bad version is B B = (Mλ + R ). (9) G + B The fac ha he populariy of versions of a ile follows a Zipf disribuion in he Kad nework (secion VI-A) srongly indicaes ha Kad users ac as hose in his model. 3) Voing Credi Based Selecion Model (winnowing): In winnowing, each keyword key owner collecs user feedback for each version (conen key) via voing from users who have downloaded he version. Upon reques, he index nodes reurn a lis of versions wih he voing credis for each version o he requesing user. Iniially each version ges poin when published regardless of is auheniciy assuming ha he original publisher of he version auomaically cass a posiive voe for he version. Under his model, i is assumed ha users selec a version from he lis based on he voing credis of he version. Tha is, he probabiliy ha a version is seleced is proporional o he amoun of is voing credis. As a consequence, a ime, he number of users downloading a good version is G = (Mλ + R ) V G V G + V B and he number of users downloading a bad version is B = (Mλ + R ) V G V B + V B (). () Wih regard o he voing credi updae approaches, AIMD and MIMD are analyzed and evaluaed here due o he reasons discussed in secion IV-B3.

10 AIMD approach: The amoun of voing credis of a version increases by one whenever a posiive voe is received and conversely decreases by half for a negaive voe. Wihou loss of generaliy, a user can cas is voe afer checking he auheniciy of he downloaded version. If he probabiliy ha a user cass is voe afer download is p v, hen he oal amoun of voing credis for all good versions a ime + will be V+ G = V G + p v j= G + j (2) Nex, how much will voing credis be reduced if here is one negaive voe? Since here are Nv B bad versions and he oal amoun of voing credis for all bad versions a ime is V B, one negaive voe reduces he credis by V B Nv B 2 on average. So, he amoun of voing credis afer reflecing he firs negaive voe is V B V B = V B 2N B 2Nv B v. If one more negaive voe 2Nv B is refleced, hen he amoun of voing credis will be V B 2N B v V B 2N B 2Nv B v = V B (2N B (2Nv B v )2 )2. In his way, he (2Nv B oal amoun of final voing credis for )2 all bad versions afer n negaive voes will be V B (2N B v )n = V B (2Nv B)n ( ) n. Since here are 2N B v n EN = p a p v j= B + j possible effecive negaive voes (n EN ) a ime and a porion ( p a ) of users who fail o deec he polluion will cas a posiive voe wih he probabiliy p v. Thus, we have V B + = V B ( 2N B v ) nen + ( p a)p v j= j= B + j. (3) MIMD approach : The amoun of voing credis for a version doubles for a posiive voe bu decreases by half for a negaive voe. We can simply calculae he amoun of voing credis ha are increased by one posiive voe. Since here are Nv G good versions and he oal amoun of voing credis for all good versions a ime is V G, one posiive voe increases he credis by V G Nv G on average. So, he oal amoun of voing credis for all good versions afer reflecing he firs posiive voe is V G + V G = V G N B Nv G v +. Afer similar ieraion, he final Nv G voing credis wih n posiive voes will be V G (+ ) n. Nv G Since here are n EP G + j = p v possible effecive posiive voes (n EP ) a ime, we ge V G + = V G ( + N G v ) nep. (4) By he way, wih bad versions, one posiive voe and one negaive voe offse each oher wih regard o V+, B and he number of possible effecive negaive voes is n EN B + j B + j = p ap v ( p a)p v j= = (2p a )p v j= B + j j= In his case, if n EN, hen V+ B decreases bu increases oherwise. So, we have V B + = { V B ( ) nen 2Nv B V B ( + N B v ) nen when n EN oherwise. (5) Using hese resuls, he effeciveness of user-mediaed feedback is now examined for a specific scenario. B. Analyical Resuls ) The scenario: For numerical comparison, values of key parameers were se as follows: M = 2,, G = 25, B = 5, and = 48. These values were adaped from previous sudies [3 5]. Wih regard o he user arrival rae (λ ), RedHa 9 Torren racker race [24] is used o reflec he realisic user ineres and arrival rae. The meric for comparison is goodpu, which is defined as he raio of he number of good copies (G ) o he oal number of copies (G + B ) shared in he sysem G a ime (i.e. goodpu = G +B ). The final goodpu refers o goodpu where = 6 [5]. Unless oherwise specified, hese basic seings were used o generae all resuls. 2) Wihou oher aacks excep B : Figure 5(a) shows goodpus of he differen models, as a funcion of ime, under perfec condiions (p a =, p s =, p v = ). The upper bound ha is shown would be achieved if each user always seleced a good (non-pollued) file version; he lower bound is if each user always seleced a bad (pollued) file version. This is possible if here exiss an omnipoen big broher in he sysem who les users know wha versions are auhenic whenever asked, which is he upper bound of any repuaion sysem. The lower bound is he reverse case, so ha he probabiliy ha a user selecs a good copy is always, which is he ulimae objecive of polluers. As seen in his graph, if no polluion aack excep B is performed, winnowing wih eiher AIMD or MIMD reaches opimal performance much faser han eiher he populariy based approach or he random selecion approach. The random selecion approach does no reach he opimal performance level even under perfec condiions. Perfec condiions are obviously unrealisic in real sysems. Therefore, he relaive performance of each approach is invesigaed under more realisic condiions (p a =.8, p s =.6, p v =.6). In his case, p a and p s are adaped from he previous work [3 5] whereas p s is se under he assumpion ha users who decide o share he