Abstract. Detecting clients with deviant behavior in the Bittorrent network is a challenging task that has not received the deserved attention. Typically, this question is seen as not 'politically' correct, since it is associated with the controversial issue of detecting copyright protection agencies. However, deviant behavior detection and associated blacklists might prove crucial for the well being of Bittorrent. We find that there are other deviant entities in Bittorrent besides monitors. Our goal is to provide some initial heuristics that can be used to automatically detect deviant clients. We analyze for 45 days the top 600 torrents of Pirate Bay. We show that the empirical observation of Bittorrent clients can be used to detect deviant behavior, and consequently, it is possible to automatically build dynamic blacklists.
Siganos et al. REF described a set of network-level features that can be used for automatically detecting "deviant" clients, some of which are deemed to be indirect monitors.
Monitoring the Bittorrent Monitors: A Bird's Eye View
PAM
Computer Science