Abstract-Flooding Peer-to-Peer (P2P) networks form the basis of services such as the electronic currency system Bitcoin. The decentralized architecture enables robustness against failure. However, knowledge of the network's topology can allow adversaries to attack specific peers in order to, e.g., isolate certain peers or even partition the network. Knowledge of the topology might be gained by observing the flooding process, which is inherently possible in such networks, and performing a timing analysis on the observations. In this paper we present a timing analysis method that targets flooding P2P networks and show its theoretical and practical feasibility. A validation in the real-world Bitcoin network proves the possibility of inferring network links of actively participating peers with substantial precision and recall (both ∼ 40 %), potentially enabling attacks on the network. Additionally, we analyze the countermeasure of trickling and quantify the tradeoff between the effectiveness of the countermeasure and the expected performance penalty. The analysis shows that inappropriate parametrization can actually facilitate inference attacks. A number of today's highly distributed internet services employ public Peer-to-Peer (P2P) networks as their main communication infrastructure. One of the challenges in P2P networks is the robustness against failure and adversarial attacks. The network's topology can be the key to both preventing service disruptions as well as performing successful attacks on the network. From an attacker's point of view, knowing the topology of a network can be advantageous, for example if the attacker wants to split the network by performing Denial-ofService attacks on selected network nodes. Additionally, the anonymity of users might be an application's goal (e.g., Tor), which can be compromised if an attacker is able to reconstruct communication paths. The electronic currency system Bitcoin [14] uses a P2P network to transmit information on financial transactions through the network in order to reach consensus among all participants on the set of accepted transactions. Information exchange is performed using a gossip protocol: if a peer receives a new transaction, it checks the validity of the transaction and rebroadcasts it to its neighboring peers. An attacker could observe this information propagation process in the network in order to infer connections in the P2P network or link transactions to the originating IP address. This knowledge could be used to perform precise attacks on the network's topology (e.g., eclipsing attack [7] , [9] ) or as a basis for deanonymization of users.
In REF , Neudecker et al. present a method to infer the topology of a peer-to-peer flooding network like Bitcoin with the help of an analytical model.
Timing Analysis for Inferring the Topology of the Bitcoin Peer-to-Peer Network
2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC/ATC/ScalCom/CBDCom/IoP/SmartWorld)
2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC/ATC/ScalCom/CBDCom/IoP/SmartWorld)
Computer Science