Identifying and Characterizing Sybils in the Tor Network
summary
Analyzes nine years (~100 GB) of hourly Tor consensuses plus active scans to detect coordinated relays, using a tool called sybilhunter that produces CSVs and images and an exitmap scanner that finds 250 malicious exit relays. Detection methods include visual “uptime art” clustering, hourly network churn, fingerprint-change tracking for DHT manipulation, and Levenshtein nearest-neighbor on relay config strings. Results catalog 20 Sybil groups (botnets, research projects, DoS attempts, and exit relays that hijack Bitcoin donation URLs).
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:11Identifying and characterizing Sybils in the Tor network
- 0:51The double-edged sword of volunteer-run networks
- 2:24Existing Sybil defenses don't help
- 3:58Passive dataset
- 4:58Active dataset
- 7:18Visualizing uptimes (method #1)
- 9:012,034 relays in July 2014
- 10:091.629 relays in June 2010
- 12:13Network churn (method #2)
- 13:35Changing fingerprints (method #3)
- 15:04Nearest neighbour ranking method #4
- 18:12Discussion of "Bitcoin Sybils"
- 19:51Limitations
- 23:50Acknowledgements
related talks
26mCharacterizing the Nature and Dynamics of Tor Exit Blocking
43mWho are the people in your neighborhood? Tracking 'Shady' CIDR blocks
50mCyber-crime and attacks in the dark side of the web
36mCyber Crime and Attacks on the Dark Side of the Web
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
59mCatching Malware En Masse: DNS and IP Style
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce