Measurement of eDonkey Activity with Distributed Honeypots

> By Oussama Allali, Matthieu Latapy and Clémence Magnien

Measurement of eDonkey Activity with Distributed Honeypots

Measurement of eDonkey Activity with Distributed Honeypots

We propose in Measurement of eDonkey Activity with Distributed Honeypots a new way to observe activity in a P2P system. It relies on a set of honeypost, i.e. fake peers which claim to provide some files and record the queries they receive for these files.

These measurements may be conducted with any number of honeypots. The plot shows how the number of distinct peers observed (vertical axis) evolves when the number of honeypots (on the horizontal axis) grows.

More precisely, we conducted a measurement with 24 honeypots (see the paper for details). Then, for n between 0 and 24, we randomly chose n honeypots among the 24 ones and computed the number of distinct peers observed by these n honeypots alone. As the choice of the n honeypots may have a significant influence on the result, we repeated this computation 100 times, and we plot here the average, maximal, and minimal obtained values.
The average makes it possible to observe what one may expect. The maximal and minimal values give an indication of the dispersion of obtained results.

This plot clearly shows that there is an important benefit in using several honeypots rather than only one. It also shows that, even when 24 honeypots are used, there is a significant benefit in adding more honeypots, thus calling for the use of large-scale distributed infrastructures. However, the benefit obtained by using more honeypots progressively decreases. This indicates that, even though many more honeypots may be used, at some reasonable point the benefit will become very low. Exploring this further requires distributed measurements from many more machines, which we leave for future work.

This entry was posted in Plots and tagged , , ,