Forensic Investigation of Peer-to-Peer Networks

Abstract

The community of peer-to-peer (P2P) file-sharing networks has been expanding swiftly since the appearance of the very first P2P application (Napster) in 2001. These networks are famous for their excellent file transfer rates and adversely, the flooding of copyright-infringed digital materials. Recently, a number of documents containing personal data or sensitive information have been shared in an unbridled manner over the Foxy network (a popular P2P network in Chinese regions). These incidents have urged the authors to develop an investigation model for tracing suspicious P2P activities. Unfortunately, hindered by the distributed design and anonymous nature of these networks, P2P investigation can be practically difficult and complicated. In this chapter, the authors briefly review the characteristics of current P2P networks. By observing the behaviors of these networks, they propose some heuristic rules for identifying the first uploader of a shared file. Also, the rules have been demonstrated to be applicable to some simulated cases. The authors believe their findings provide a foundation for future development in P2P file-sharing networks investigation.

Identifying First Seeders in Foxy Peer-to-Peer Networks

“…As reported elsewhere [5,6], our experiments confirmed that the number of query packets increase shortly before and after the appearance of the first seeder. Increases in the number of queries with SHA-1 values generated from multiple IP addresses were also observed.…”

“…A single seeder in a Foxy network can be identified, but verifying that the seeder is one of the initial seeders is not a simple task. In our previous research [6], we showed that a seeder can be identified as one of the first few seeders if the sharing of the resource falls within the slowrising period of the seeder curve. However, confirming whether or not the period of interest falls within the slow-rising period is also difficult.…”

“…The first method (Method 1) [5] repeatedly issues identical query patterns submitted by requesting addresses within a short period of time in the Foxy network for the query hits of interest that are returned. The second method (Method 2) [6] is based on the assumption that the growth of seeders in a P2P network follows the cumulative amount of seeders ("seeder curve"). Method 2 engages two rules:…”

“…The propagation of a file can be restricted by identifying and dealing with the first (and early) seeders before the file is widely disseminated. Moreover, the identification of the first seeder is a key goal in investigations involving the illegal distribution of files in P2P networks [1,2,5,6]. This is because only the initial seeders of a file can be prosecuted for their intention to distribute the file under the Hong Kong legal system.…”

A Model for Foxy Peer-to-Peer Network Investigations

“…In any file-sharing environment, there are five stages before a downloader obtains a file: preparation, initiation, publication, waiting and downloading [10]. The publication, waiting and downloading stages are the only stages where an investigator can collect digital evidence remotely on the Internet, i.e., before examining the suspect machine.…”