Qingfeng Tan

Empirical Measurement and Analysis of I2P Routers

With the increased focus on Internet privacy, especially after the exposure of PRISM(an Internet surveillance program), anonymous communication have been getting more and more attentions. One of the most widely used anonymous communication systems is I2P(Invisible Internet Project). And as opposed to Tor’s(another popular anonymous communication system) directory-based approach, which provides a centralized directory server to manage the overall ‘view’ of the network, I2P is fully distributed and self organizing, which aims to avoid attackers’ enumeration of all I2P’s routers. In this paper, based on I2P’s operating mechanism, we presented two passive and two active methods to discover I2P routers. In a more than two week’s collecting experiment, about 25640 routers were discovered everyday, which turned out to be an almost full coverage(94.9%) of the I2P network compared with the data announced on the official website [1]. And based on the routers collected, this paper further made a preliminary analysis of both the I2P network’s overall status and its security. The result showed that I2P is a well structured P2P network, while some powerful attackers operating several routers are still possible to perform compromise attack to break I2P users’ anonymity given the current I2P’s security mechanism. Finally, this paper discussed some countermeasures to improve the security of the I2P network.

Identifying Users across Different Sites Using Usernames

Identifying users across different sites is to find the accounts that belong to the same individual. The problem is fundamental and important, and its results can benefit many applications such as social recommendation. Observing that 1) usernames are essential elements for all sites; 2) most users have limited number of usernames on the Internet; 3) usernames carries information that reflect an individuals characteristics and habits etc., this paper tries to identify users based on username similarity. Specifically, we introduce the self-information vector model to integrate our proposed content and pattern features extracted from usernames into vectors. In this paper, we define two usernames similarity as the cosine similarity between their self-information vectors. We further propose an abbreviation detection method to discover the initialism phenomenon in usernames, which can improve our user identification results. Experimental results on real-world username sets show that we can achieve 86.19% precision rate, 68.53% recall rate and 76.21% F1-measure in average, which is better than the state-of-the-art work.

IX-Level Adversaries on Entry- and Exit-Transmission Paths in Tor Network

Tor is a worldwide publicly deployed low-latency anonymity system. In order to prevent observers from telling where the data came from and where its going, data packets on the Tor network take a pathway through several intermediate relays. However, nodes selection to build such a pathway is oblivious to Internet routing, so anonymity guarantees can break down in cases where an attacker can correlate traffic across the entry- and exit-segments of a Tor circuit. Although many works have been done to avoid this kind of collusion attack, recent researches [18] indicated that some Internet exchanges (IXes) locating at the entry- and exit-transmission paths in Tor network (that are the paths from the client to the chosen entry node and from the chosen exit node to the destination) are still possible to perform a correlation attack. However, few works have been done to suggest and verify modifications to Tors path selection algorithm that would help clients avoid an IX-level observer. In this paper, we first, based on the entry-exit pairs chosen by Tors path selection algorithm, demonstrated that the probability of a single IX observing both ends of an anonymous Tor connection is greater than previously thought. And then, we proposed and evaluated the effectiveness of a simple IX-awareness path selection algorithm that help to resist IX-level attackers.

Large-scale discovery and empirical analysis for I2P eepSites

I2P is a widely used low-latency anonymous network that provides privacy to service providers, such as anonymous web services called eepSites. The large-scale discovery of eepSites allows us to grasp their size, content and popularity. In this paper, three approaches were proposed to discover eepSites: (1) running floodfill routers, (2) gathering hosts.txt files actively and (3) crawling popular portal eepSites. In our nineteen-day real-world experiments, the combination of the three methods in total discovered 1861 online eepSites covering over 80% of all eepSites in I2P network. And the coupon collectors problem was used for theoretical analysis, showing that eepSites discovery based on running floodfill routers is straightforward and efficient with low cost. Besides, the popularity and availability of eepSites were estimated and analyzed.

A closer look at Eclipse attacks against Tor hidden services

Tor hidden Services are used to provide anonymity service to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor hidden services use decentralized architecture making it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor hidden services that allow an adversary with an extremely low cost to block arbitrary Tor hidden services. We found that the dominant cost of this attack is IP address resources. The experimental results show that we can eclipse an arbitrary hidden service with 100% success probability with only 6 IP addresses. To understand the severity of the Eclipse attack problems on Tors hidden services, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of hidden services at any time.

Towards Improving Service Accessibility by Adaptive Resource Distribution Strategy

Along with the rapid development of Internet, accessibility has become one of the most basic and important requirements for Internet service. Service resource, the knowledge that can help users get access to the service finally, is the focus of accessibility confrontation between the adversary and Internet services. Most of current resource distribution strategies adopt the “many access points” design and limit the number of service resources distributed to any user. However, current design is vulnerable to enumeration attack where an adversary can enumerate many service resources under the disguise of many pseudonyms (Sybil identities). To mitigate this challenge, an adaptive resource distribution strategy based on trust management is proposed in this paper. Under this strategy, user’s trust is adjusted according to his behavior. Both client puzzle and the resources assigned to the user are dynamically generated according to his trust value. Simulation result indicates that, this strategy can distinguish honest users from adversary Sybils, thus increasing the difficulty for an attacker to enumerate service resources while ensuring access to service for honest users.

Unobservable Rendezvous Negotiation in P2P Networks

Internet has been the most popular platform for individuals to communicate and share ideas. With increasing threats against network privacy, anonymous and covert communication technology is becoming more and more important. In this paper, an unobservable rendezvous negotiation protocol is proposed based on P2P architecture, which establishes a covert channel leveraging an existing DHT to hide communicating behaviors and utilizes a tagging mechanism to ensure an indirect identification and mutual authentication. Experiments indicate that performance of the protocol is acceptable, and security analysis shows that the protocol can resist various threats.

A Covert Communication Method Based on User-Generated Content Sites

with the worldwide increasing of Internet censorship, censorship-resistance technology has attracted more and more attentions, some famous systems, such as Tor and JAP, have been deployed to provide public service for censorship-resistance. However, these systems all rely on dedicated infrastructure and entry points for service accessibility. The network infrastructure and entry points may become the target of censorship attack. In this paper, a UGC-based method is proposed (called user-generated content based covert communication, UGC3) for covert communication in a friends-to-friends (F2F) manner. It uses existing infrastructures (i.e., UGC sites ) to form a fully distributed overlay network. An efficient resource discovery algorithm is proposed to negotiate the rendezvous point. Analysis shows that this method is able to circumvent internet censorship with user repudiation and fault tolerance.