2011.03 95

RESEARCH PAPER

论文集锦

A Measurement Study of Polluting a Large-Scale P2P IPTV System

Wang Haizhou, Chen Xingshu, Wang WenxianCollege of Computer Science, Sichuan University, Chengdu 610065, P. R. China

Abstract: With the rapid development of Peer-to-Peer (P2P) technology, IPTV applications based on that have received more and more attention from both industry and academia. Several applications using the data-driven mesh-pull architectures raised and gained great success commercially. At present, PPLive system is one of the most popular instances of IPTV applications which attract a large number of users from across the globe. At the same time, however, the dramatic rise in popularity makes it more likely to become a vulnerable target. In this paper, we propose an effective measurement architecture, which is based on the peer’s nature not only receiving polluted video chunks but also forwarding those to other peers, to measure the video streaming pollution attack and then use a dedicated crawler of PPLive developed by us to evaluate the impact of pollution in P2P live streaming. Specifi cally, the results show that a single polluter is capable of compromising all the system and its destructiveness is severe.Key words: peer-to-peer technology; IPTV; pollution attack; PPLive; measurement

I. INTRODUCTION

With the growing maturity of P2P technology, a

wide variety of distributed applications based on it have emerged and become more and more popular recently, which include fi le-sharing systems [1-3], audio-based VOIP systems [4], and video-based IPTV systems [6-9]. IPTV technology has been restricted by low broadband penetration in the past; however, the rapid and large-scale popularization of broadband technology makes it possible to become the next disruptive IP communication technology, which will greatly revolutionize the people’s lives and entertainment.

There have been several applications using the data-driven mesh-pull architectures raised and gained great success commercially, including CoolStreaming [5], PPLive [6], PPStream [7], QQLive [8], UUSee [9] and so on. PPLive system is one of the most popular instances of IPTV applications, which was reported that more than 5,000,000 online viewers simultaneously joined the PPLive Network at Beijing 2008 Olympic Games Opening Ceremony. As early as August 2005, there have been over 500,000 simultaneous viewers attracted by the popular Chinese entertainment show “Super Girls”, which hits the highest record in this industry fi eld [5]. What’s more, during the Chinese New Year 2006, Xiaojun Hei’s research team obtained a result that the peak number of

96 2011.03

China CommunicationsChina Communications

simultaneous viewers approached 200,000 from 14 PPLive channels which were broadcasting the event in the experiment [10].

Because of PPLive’s rapidly increasing popularity, the possibility of suffering potential security threats from various fields tend to increase. Some pollution schemes have been put into practice in P2P file sharing systems [11-12]. P2P file sharing systems are prone to be attacked because of the decentralized and non-authenticated nature. A malicious attacker may confuse targeted resources first, criticizing the resources useless or tortious, and then publish a large number of polluted resources attracting some naive users to download. Those naive users who cannot distinguish the polluted resources from pureness will also forward the resources to other unsuspecting users. In this way, the polluted resources spread through the global P2P file sharing systems eventually. These malicious techniques used in P2P fi le sharing systems could also be applied to P2P live streaming systems [13].

While undertaking detail measurement about this IPTV system, we were confronted with a few challenges owing to its commercial nature. First of all, PPLive is a proprietary protocol, which means that there are scarcely source codes or official documents published, and we have to develop the dedicated crawler to harvest peers or evaluate the impact of pollution in this live streaming system by analyzing packet traces and decoding the protocol. Secondly, it is difficult for crawler to probe all the peers due to the NAT problem and network congestion, which did not respond to our requests at all. Peer-list servers and each common peer maintain a list of peers watching the given channel, naturally, the number of peers which servers owned far exceed to the latter. Proved to be feasible [10], we can harvest almost all the peers’ accurate information from peer-list servers and partner peers depending on appropriate measurement intervals.

II. RELATED WORK

There have been several studies about different attacks deployed in P2P live streaming systems. Haridasan and Renesse discussed different attacks that multicast streaming systems were vulnerable to, including forgery, DoS, membership and omission attacks [14]. The authors also proposed and evaluated an intrusion-tolerant P2P live streaming system called Secure-Stream to guard against these attacks. Wang et al. [15] investigated the DoS attacks in P2P streaming and proposed Ripple-Stream to safeguard the system from such an attack. In [16], Conner et al presented a framework named Oversight for preventing both selfi shness and DoS attacks in P2P streaming system. Their simulations showed that the Oversight protocol was effective at reducing the number of requests granted to attackers and thus preventing DoS attacks. However, none of the above studies considered the content pollution attacks in P2P live video streaming.

Yang et al. [17] presented the fi rst system model capturing the effects of content pollution in P2P live streaming systems and demonstrated that the most crucial factor in content pollution was not the number of polluters but the access bandwidth and the degree of participating peers. Borges et al. [18] evaluated the impact of pollution attack in P2P live streaming and presented two reputation systems to avoid content polluted dissemination and isolate malicious peers. Further measurement studies were undertaken in [19], where the authors proposed a decentralized reputation system to fi ght attacks in P2P live streaming networks that is simpler and could also be much more effective than previously proposed mechanisms. Lin et al. [20] presented a simulation system named SPoIM to study the impact of pollution attack under various network settings and configurations. In [21], Hu et al. proposed a joint pollution detection and polluter identification system to defend pollution attacks

2011.03 97

RESEARCH PAPER

论文集锦

in P2P live streaming and their simulation results show that the proposed system can effectively resist pollution attacks while minimizing the user’s computation overhead. However, the above studies about content pollution were not deployed in a real P2P live streaming.

Dhungel et al. was the first to carry out an experiment in a real system and the results showed that the video playback quality could be significantly affected with content pollution [13]. Moreover, the authors proposed some solutions to defend the pollution. But the authors did not make the further measurement of the impact of pollution for the live streaming system.

Our study is different from prior works in that: (1) We proposed an effective measurement architecture to deploy the live video streaming pollution in a real-world P2P live streaming application; (2) we deeply evaluated the impact of pollution in P2P live streaming from the following three aspects: dynamic evolution of participating users, users lifetime characteristics, and users connectivity-performance.

III. POLLUTION MECHANISM

In this section, we will present the basic principle of pollution in this P2P live streaming system; illustrate a feasible and efficient architecture for pollution attack.A. The Principle of PollutionIn a P2P network, each peer has similar status in sharing resource that upload the data at the same time download them, which differs from the client-server model where communication is usually to and from a central server. In P2P file sharing system, the polluted fi les or chunks can be discarded owing to the perfect integrity verifi cation mechanism, for example, in the BitTorrent protocol, the file is divided into pieces with typically 256KBytes, which is further divided into blocks, preventing the polluted block propagating by checking the hash value of one entire piece [22].

Unfortunately in the PPLive live streaming, there has not corresponding identification mechanism to ensure the polluted chunks detected so that the polluted content received by an naive peer not only affect itself, but since the peer also forward cached chunks to other unsuspecting users, eventually, the polluted resource can maliciously spread through the P2P network.

In particular, a PPLive polluter registers itself in the given channel and retrieves all the peers that are watching the same channel. After trying to connect the active peers which are probed periodically, the polluter then broadcasts an especial buffer-map indicating a great quantity of chunks available to all the partner peers. Upon receiving chunks request, the attacker sends the polluted chunks which will be assembled in regular sequence into streaming file by PPLive client with other chunks receiving from ordinary peers instead of the natural ones to the victims, which can potentially affect the quality of the playback depending on the amount of the polluted data.B. The System Architecture of PollutionThe detailed pollution architecture of PPLive is described in Figure 1. The progress of pollution diffusion is divided into the following four stages:

Fig. 1 A pollution architecture of PPLiveStep 1: The PPLive polluter requests the latest

list of channels comprising channel GUID. In this experiment, we choose a very popular channel named “Doraemon” attracting over 4,000 distinct users simultaneously being online at some peak times during our measurement period. The polluter is located at Sichuan University of China with

98 2011.03

China CommunicationsChina Communications

10/100Mbps Ethernet network access.Step 2: As for the selected channel, the polluter

registers itself in the peer-list servers to get the initial list of peers and then obtain as many peers as possible in the same channel network, which is similar to the work process of normal PPLive client. While doing the pollution experiment, we deploy a dedicated crawler of PPLive developed by us to collect the number of simultaneous viewers periodically watching the same channel whose sampling frequency is 60s, which is also located at Sichuan University with the same Ethernet network environment.

Step 3: After harvesting enough peers, the polluter will try to connect the active ones to broadcast a special buffer-map indicating a great number of video chunks are available for the channel. As a result, the naive peers start request the chunks from polluter. Upon receiving chunks request, the polluter sends the polluted chunks which will be assembled in regular sequence into streaming fi le by PPLive client with other chunks receiving from ordinary peers instead of the natural ones to the victims. The polluter will also retrieve new peers from peer-list servers and its partner peers to update peers list periodically as normal PPLive client, over 5-minute period.

Step 4: After harvesting suffi cient video chunks, the victim peer will assemble the polluted chunks and normal ones in regular sequence into larger media blocks without any identifi cation mechanism and then forward cached chunks to other unsuspecting users puerilely. At last, the polluted video chunks spread in the PPLive network rapidly and degrade the performance of the playback signifi cantly. To investigate the proceedings of the propagation, we deploy a packet sniffer to collect the polluted packets flowing through the peer located in Shanghai, China. The polluted chunks can be distinguished from the clean chunks easily because of the unique binary content constructed by us.

IV. MEASUREMENT METHODOLOGY AND RESULTS

In this section, we fi rst describe dynamic evolution of participating users and lifetime characteristics of peers during experiment periods to show that the destructiveness of the pollution attack is severe. We then present the probable reasons why the number of peers is not below 500 during the pollution attack time by analyzing the connectivity-performance of users.A. Dynamic Evolution of Participating UsersA popular channel named “Doraemon” was chosen for the experiment because this channel has a clear diurnal trend of the evolution of peers viewing channel in Figure 2. By this way, we could make the result of the experiment prone to be more accurate. Figure 2 shows that the curves of the number of peers are very similar during the two measurement days.

0

500

1000

1500

2000

2500

3000

3500

4000

4500

5000

0 4 8 12 16 20 0 4 8 12 16 20

Num

bers

of

Peer

s

Hour(GMT+8)

Fig. 2 Evolution of the number of simultaneous users during two normal days

To understand the destructive effect of pollution attack for the service of the playback, we present how the number of the participating users evolves for the popular channel at pollution day and ordinary day, as shown in Figure 3. We can first observe that curves of the number of peers are quite different for the two measurement days. Before the pollution attack launched, there are more than 3000 users in this channel, however,

2011.03 99

RESEARCH PAPER

论文集锦

during the attack period the number of viewers reduce to about 500 rapidly. It begins to appear a sharp decrease in the number of users about 5 minutes after the pollution attack launched at 19:00 which continued until 20:30. About 15 minutes later, there is about 53.5% decrease in the number of participating users, furthermore, about 67.5% decrease occurs 30 minutes later.

500

1000

1500

2000

2500

3000

3500

4000

4500

18:30 18:45 19:00 19:15 19:30 19:45 20:00 20:15 20:30

Num

bers

of

Peer

s

Hour(GMT+8)

Normal Day

Pollution Day

Fig. 3 Evolution of the number of simultaneous users over normal day and experiment day

B. User Lifetime CharacteristicsTo present the destructive impact of pollution attack for the user behaviors of watching program from another side, we propose a concept of lifetime of a peer and show the great difference of the lifetime distribution between ordinary day and pollution day, in particular, the lifetime means the persistent period between the arrival and the contiguous departure of the peer over the PPLive network. The notations are listed in Table I.

Table I The NotationsSymbol Descriptiont0 starting time of the pollution attackt1 ending time of the pollution attackL[x] lifetime of peer xm number of times of one peer joins the PPLive network

tma[x]arrival time of peer x which joins in the PPLive network at the fi rst m times

tmd[x]departure time of peer x which joins in the PPLive network at the fi rst m times

In general, the lifetime of a peer watching some channels is mainly affected by following factors: channel popularity, viewing habits of users, network bandwidth, and quality of playback which

is the most influential factor. Upon the playback delay performance become unacceptable for a streaming service, it is very likely for the viewers to switch the channel. So we can evaluate the effect of pollution attack approximately by the difference of the lifetime distribution.

time

pollution period

t0 tma[x] tmd[x]

lifetimelifetime

tmd[x]t1

A B

tma[x]

Fig. 4 The lifetime of peer xOwing to the channel popularity and the habits

of viewers, some peers may join the channel again after last departure during pollution period even though the quality of playback is too bad to watch, which will be defi ned as two different arrival and departure events. According to the three cases of arriving and leaving the channel, we define the lifetime of the peer x, as shown in Figure 4. We also defi ne the function ( )L x as

0 1 0 1

0 1 1

1 0

1 0

[ ] [ ], if [ ] , [ ] ,

[ ] [ ]

[ ] [ ], if [ ] , [ ],( )

[ ] [ ] , [ ] [ ] t

,

md ma md ma

ma md

md ma ma md

ma md md ma

t x t x t t x t t t x t

t x t x

t x t x t t x t t t xL x

t x t x t x t x t

t t

−<

−=

< − < −−

„ „ „ „

„ „ „

0 1 1

1 0

if [ ] , [ ],

[ ] [ ] , [ ] [ ]ma md

ma md md ma

t t x t t t x

t x t x t x t x t t

⎧⎪⎪⎪⎪⎨⎪⎪⎪

< − −⎪⎩

„ „ „…

That is, (1) if a peer x arrives and leaves the channel during the pollution attack periods, then the lifetime of peer x ( ( )L x ) is [ ] [ ]md mat x t x− ; (2) if a peer x arrives at the pollution periods, leaves after it and the duration in the channel not more than pollution periods, then the lifetime equals

[ ] [ ]md mat x t x− ; (3) if the previous two conditions are the same as case 2 and the duration in the channel is much longer than pollution periods, then the lifetime equals 1 0t t− .

We collect user information of arrival and departure employing the dedicated crawler of PPLive developed by us. Our measurement result shows that 16105 distinct peers join the channel during the ordinary day and 15912 distinct peers during the pollution attack periods, furthermore,

100 2011.03

China CommunicationsChina Communications

peer lifetime vary from very small values up to pollution time-90 minutes. Especially, there is also two peers remain in the channel throughout the pollution attack period. We infer that those peers are video-distributed servers which will never leave the PPLive network. The peer lifetime distribution in Figure 5 suggests that the continuous watching behaviors of viewers affected seriously by pollution attack, and most of viewers prefer to stay shorter with the terrible service of playback. Our statistical result shows that 93.4% of peers have lifetimes shorter than 20 minutes at the pollution day; however, the number is only 68.8% at the ordinary day.

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0 10 20 30 40 50 60 70 80 90

CD

F Pr

obab

ility

Time(minute)

Usual Day

Pollution Day

Fig. 5 Peer lifetime distributions for normal day and pollution day

C. User Connectivity-PerformanceTe dynamic change frequency of arrival and departure for peers could represent the stability of the PPLive network structure. By analyzing the rate of change of peers, we are able to quantify the stability of the system and know the impact of pollution attack in more detail.

We define a peer x as a two-tuple {IP x, PO x}, where IPx is the IP address of host x and POx is the TCP port or UDP port of peer x, and one peer can be identifi ed by this two-tuple. A period ∆ is defi ned as sampling interval, where ∆=tn-tn-1, and the t0, t1...tn-1, tn is the observation time. Cn= {x1, x2… xi… xj …} is the set of peers at time tn in a channel.

{ }-1( ) ( -( ))a n n nR n C C C= ∩ ∩∆ : is the set of peers which arrive between tn-1 and tn.

{ }-1 -1( ) ( -(C ))l n n nR n C C= ∩ ∩∆ : is the set of peers which leave between tn-1 and tn.

We record the arrival event when the crawler finds a new peer joining in the experimental channel and the departure event when one old peer disappear for two sampling interval. We set the sampling interval ∆=60 seconds typically, which is proved that could refl ect the connection dynamics well.

The number of peer arrivals and departures in minutes on the ordinary day is plotted in Figure 6. It shows that the evolution of arrival rate is similar to that of departure rate and the curve of evolution is quite smooth. The peer arrival and departure rate for the pollution day in Figure 7 shows that there a peak with departure rate occur during experiment period, which means that a large number of peers leave the channel simultaneously due to pollution attacks. Especially, it begins to appear a sharp increase in the number of peer departure about 6 minutes after the pollution attack started at 19:00. At about 19:08, there appears a big peak which indicates that nearly 600 peers leave the polluted channel simultaneously in a minute. After that, the numbers of peer departure reduces gradually but always higher than arrival ones until the end of pollution attack. We conclude that pollution attack affects the stability of the PPLive network structure significantly, which cause a large number of viewers to leave the channel due to the unacceptable streaming service.

0

100

200

300

400

500

600

18:30 18:45 19:00 19:15 19:30 19:45 20:00 20:15 20:30

Num

bers

of

Peer

s

Hour(GTM-8)

Numbers of Arrival

Numbers of Depart

Fig. 6 Arrival/Departure rate for ordinary day

2011.03 101

RESEARCH PAPER

论文集锦

0

100

200

300

400

500

600

18:30 18:45 19:00 19:15 19:30 19:45 20:00 20:15 20:30

Num

bers

of

Peer

s

Hour(GMT+8)

Number of Arrival

Number of Depart

Fig. 7 Arrival/Departure rate for pollution attack dayBy analyzing the rate of change of peers, we

fi nd the probable reasons why the number of peers is always not below 500 during the pollution attack periods as follows: (1) the pollution attack will not impact the rate of peer arrival associated with the daily watching habits of viewers, consequently, the order of magnitude of the peer arrival and departure is close about 20 minutes after the pollution attack launched. (2) Owing to the popularity and attraction of the channel, some stubborn and naive viewers rejoin the channel network constantly during the pollution attack periods although the quality of playback is too bad to watch.

V. CONCLUSIONS AND FUTURE WORK

In this paper, we have studied the content pollution attack in a popular P2P live streaming system named PPLive. We proposed an effective measurement architecture to deploy the video streaming pollution attack and evaluate the impact of pollution in P2P live streaming from three following aspects: dynamic evolution of participating users, user lifetime characteristics, and user connectivity-performance. The results show that the destructiveness of the pollution attack is severe and a single polluter is capable of compromising all the system.

To provide and evaluate the effective and

flexible mechanism of reducing content pollution dissemination and to defend this attack in P2P live streaming are left for our future work.

Acknowledgements

This work was supported by the National 973 Key Basic Research Program under grant JG2008031.

References

[1] The Gnutella Homepage [EB/OL]. [2010–5–20] http://www.gnutella.com/.

[2] The BitTorrent Homepage [EB/OL]. [2010–5–20]. http://www.bittorrent.com/.

[3] The Emule Homepage [EB/OL]. [2010–5–20]. http://www.emule.com/.

[4] The Skype Homepage [EB/OL]. [2010–4–12]. http://skype.tom.com/.

[5] ZHANG Xinyan, LIU Jiangchuan, LI Bo, et al. DONet/CoolStreaming: A Data-driven Overlay Network for Peer-to-Peer Live Media Streaming[C]// Proceedings of 24th Annual Joint Conference of the IEEE Computer and Communications Societies. Miami, FL, USA: IEEE Press, 2005: 2102–2111.

[6] The PPLive Homepage [EB/OL]. [2010–4–12]. http://www.pplive.com/.

[7] The PPStream Homepage [EB/OL]. [2010–4–12]. http://www.ppstream.com/.

[8] The QQLive Homepage [EB/OL]. [2010–4–12]. http://www.qqlive.com/.

[9] The UUSee Homepage [EB/OL]. [2010–4–12]. http://www.uusee.com/.

[10] HEI Xiaojun, LIANG Chao, LIANG Jian, et al. A Measurement Study of a Large-scale P2P IPTV System [J]. IEEE Transactions on Multimedia, 2007, 9(8): 1672–1687.

[11] LIANG Jian, KUMAR R, Xi Yongjian, et al. Pollution in P2P File Sharing Systems[C]// Proceedings of 24th Annual Joint Conference of the IEEE Computer and Communications Societies. Miami, FL, USA: IEEE Press, 2005: 1174–1185.

[12] LIANG Jian, NAOUMOV N, ROSS K W. Efficient Blacklisting and Pollution-Level Estimation in P2P File-Sharing Systems[C]// Proceedings of AINTEC’05.

102 2011.03

China CommunicationsChina Communications

Bangkok, Thailand: Springer Press, 2005: 1–21.[13] DHUNGEL P, HEI Xiaojun, ROSS K W. The Pollution

Attack in P2P Live Video Streaming: Measurement Results and Defenses[C]// Proceedings of the 2007 Workshop on Peer-to-peer Streaming and IP-TV. Kyoto, Japan: ACM Press, 2007: 323–328.

[14] HARIDASAN M, VAN RENESSE R V. Defense Against Intrusion in a Live Streaming Multicast System[C]// Proceedings of the Sixth IEEE International Conference on Peer-to-Peer Computing. Cambridge, UK: IEEE Press, 2006: 185–192.

[15] WANG Wenjie, XIONG Yongqiang, ZHANG Qian, et al. Ripple-Stream: Safeguarding P2P Streaming Against DoS Attacks[C]// Proceedings of 2006 IEEE International Conference on Multimedia and Expo. Toronto, Ontario, Canada: IEEE Press, 2006: 1417–1420.

[16] CONNER W, NAHRSTEDT K, GUPTA I. Preventing DoS At tacks in Peer- to-Peer Media St reaming Systems[C]// Proceedings of Thirteenth Annual Multimedia Computing and Networking (MMCN’06). San Jose, California, USA, Jan 2006.

[17] YANG Sirui, JIN Hai, LI Bo, et al. The Content Pollution in Peer-to-Peer Live Streaming Systems: Analysis and Implications[C]// Proceedings of 37th International Conference on Parallel Processing. Portland, OR: IEEE Press, 2008: 652–659.

[18] BORGES A, ALMEIDA J, CAMPOS S. Fighting Pol lu t ion in P2P Live St reaming Systems[C]/ / Proceedings of 2008 IEEE International Conference on Multimedia and Expo. Hannover, Germany: IEEE Press, 2008: 481–484.

[19] VIEIRA A B, CAMPOS S, ALMEIDA J. Fighting Attacks in P2P Live Streaming. Simpler is Better[C]// Proceedings of IEEE INFOCOM Workshops 2009. Rio de Janeiro, Brazil: IEEE Press, 2009: 1–2.

[20] LIN E, DE CASTRO D M N, WANG Mea, et al. SPoIM: A Close Look at Pollution Attacks in P2P Live Streaming[C]// Proceedings of 2010 18th International

Quality of Service. Beijing, China: IEEE Press, 2010: 1–9.[21] HU Bo, ZHAO H V. Joint Pollution Detection and

Attacker Identifi cation in Peer-to-Peer Live Streaming[C]// Proceedings of 2010 IEEE International Conference on Acoustics Speech and Signal Processing. Dallas, Texas, USA: IEEE Press, 2010: 2318–2321.

[22 ] DHUNGEL P, WU Di , SCHONHORST B . A Measu remen t S tudy o f A t t acks on B i tTor ren t Leechers[C]// Proceedings of the 7th International Workshop Conference on Peer- to-Peer Systems

(IPTPS’08). Tampa Bay, Florida, USA: ACM Press, 2008.

Biographies

Wang Haizhou, received his B.E. degrees from College of Computer Science, Sichuan University, China, in 2008. He is currently working toward the Ph.D. degree at the same

University. His research interests include peer-to-peer IPTV systems, information security, and network measurement. E-mail: whzh.nc@qq.com

Chen Xingshu, received her Ph.D. degree from Institute of Information Security at the University of Sichuan of China, in 2004. She has been a professor at the Computer Science

College of Sichuan University, China, since 2005. Her general research interests lie in peer-to-peer networks, information security and computer networks. She is currently the director of the Network and Trusted Computing Institute, Computer College of Sichuan University. E-mail: chenxsh@scu.edu.cn

Wang Wenxian, received his M.E. degrees from College of Chemical Engineering, Sichuan University, China, in 2003. He is currently a Ph.D. candidate at the Institute of Information

Security, Sichuan University. His research interests include peer-to-peer networks, information security and trusted computing. E-mail: catean@163.com