BitTorrent Worm Sensor Network : P2P Worms Detection and Containment

Sinan Hatahet (1) , Yacine Challal (1) , Abdelmadjid Bouabdallah (1)

1 Heudiasyc - Heuristique et Diagnostic des Systèmes Complexes [Compiègne]

Peer-to-peer (p2p) networking technology has gained popularity as an efficient mechanism for users to obtain free services without the need for centralized servers. Protecting these networks from intruders and attackers is a real challenge. One of the constant threats on P2P networks is the propagation of active worms. In 2007, Worms have caused damages worth the amount of 8,391,800 USD in the United States alone. Nowadays, BitTorrent is becoming more and more popular, mainly due to its fair load distribution mechanism. Unfortunately, BitTorrent is particularly vulnerable to active worms. In this paper, we propose a novel worm detection system in BitTorrent and evaluate it. We show that our solution can detect various worm scans before 1% of the vulnerable hosts are infected in worst case scenarios. Our solution, the BitTorrent Worm Sensor Network, is built over a network of immunized agents, which their main job is to efficiently stop worm spread in BitTorrent.

Domaines: Réseaux et télécommunications [cs.NI]; Cryptographie et sécurité [cs.CR]

Sinan Hatahet, Yacine Challal, Abdelmadjid Bouabdallah. BitTorrent Worm Sensor Network : P2P Worms Detection and Containment. Euromicro International Conference on Parallel, Distributed, and network based Processing, Feb 2009, Weimar, Germany, Germany. pp.293-300. ⟨hal-00390059⟩