Phenix Peer-to-Peer System 1 Phenix: Supporting Resilient Low-Diameter Peer-to-Peer Topologies Rita...

Phenix Peer-to-Peer SystemPhenix Peer-to-Peer System 11

Phenix: Supporting Resilient Low-Phenix: Supporting Resilient Low-Diameter Peer-to-Peer TopologiesDiameter Peer-to-Peer Topologies

Rita H. Wouhaybi, and Andrew T. CampbellRita H. Wouhaybi, and Andrew T. Campbell

Antonis PapadogiannakisAntonis Papadogiannakis


OutlineOutline

IntroductionIntroduction Phenix Algorithm DescriptionPhenix Algorithm Description Simulation and EvaluationSimulation and Evaluation Experimental ResultsExperimental Results ConclusionConclusion


IntroductionIntroduction

P2P networks are mainly unstructured with no P2P networks are mainly unstructured with no specific topologyspecific topology

Resilient networks: their performance does not Resilient networks: their performance does not affect from network dynamics (nodes joining and affect from network dynamics (nodes joining and leaving, node failure and network attacks)leaving, node failure and network attacks)

Low diameter networks: low average distance Low diameter networks: low average distance between nodes, good performance, fast response between nodes, good performance, fast response timetime

Diameter: average shortest path between two Diameter: average shortest path between two nodesnodes

There are two classes of P2P networks: There are two classes of P2P networks: unstructured networks with better resilience (e.g. unstructured networks with better resilience (e.g. Gnutella, KaZaA) and structured networks with Gnutella, KaZaA) and structured networks with better performance (e.g. Chord, CAN)better performance (e.g. Chord, CAN)


Unstructured VS Structured Unstructured VS Structured networksnetworks

Unstructured NetworksUnstructured Networks Structured NetworksStructured NetworksNo specific topologyNo specific topology Predetermined topologyPredetermined topology

Random connectionsRandom connections Predetermined connections Predetermined connections (DHT)(DHT)

Offer better resilience to Offer better resilience to network dynamics (nodes network dynamics (nodes joining and leaving, node joining and leaving, node

failure and network attacks)failure and network attacks)

Degraded performance during Degraded performance during node removals (needs much node removals (needs much maintenance), node failures maintenance), node failures

and network attacksand network attacks

Bad performance, node Bad performance, node reachability, response time reachability, response time and no diameter quaranteeand no diameter quarantee

Better performance, faster Better performance, faster response time and low response time and low

diameterdiameter

Lack of scalability, network Lack of scalability, network partitioningpartitioning

More scalable, but problem in More scalable, but problem in generic keyword searchesgeneric keyword searches

Resilient in attacksResilient in attacks Vulnerable in attacksVulnerable in attacks

Examples: Gnutella, KaZaAExamples: Gnutella, KaZaA Examples: Chord, CAN (DHT)Examples: Chord, CAN (DHT)


Phenix: A P2P AlgorithmPhenix: A P2P Algorithm

Neither structured nor unstructured networks offer Neither structured nor unstructured networks offer both good performance and resilienceboth good performance and resilience

Phenix algorithm constructs low-diameter resilient Phenix algorithm constructs low-diameter resilient topologies so it offers both performance and topologies so it offers both performance and resiliencyresiliency

Does not impose structure but it create some order Does not impose structure but it create some order instead of total randomnessinstead of total randomness

Low diameter by creating topology of nodes whose Low diameter by creating topology of nodes whose degree distribution follows a power-lawdegree distribution follows a power-law

Phenix algorithm is fully distributed and does not Phenix algorithm is fully distributed and does not require any central serverrequire any central server

Even in targeted attacks Phenix preserves low Even in targeted attacks Phenix preserves low diameter by efficiently rearrange the nodes diameter by efficiently rearrange the nodes connectivity with low costconnectivity with low cost


Main Design Goals of PhenixMain Design Goals of Phenix

To construct low-diameter graphs for fast response To construct low-diameter graphs for fast response times and small number of hops between nodestimes and small number of hops between nodes

To maintain low-diameter topologies under conditions To maintain low-diameter topologies under conditions where nodes join/leave the network and under where nodes join/leave the network and under malicious conditions where nodes attacked and malicious conditions where nodes attacked and removed from networkremoved from network

To implement the algorithm fully distributed without To implement the algorithm fully distributed without the need of any central server (also without the need of any central server (also without “supernodes” or “ultrapeers” as in KaZaA and “supernodes” or “ultrapeers” as in KaZaA and Gnutella v0.6) as it is vulnerable in attacks and Gnutella v0.6) as it is vulnerable in attacks and malicious nodesmalicious nodes

To support the peer connectivity generally so a wide To support the peer connectivity generally so a wide variety of applications can use this networkvariety of applications can use this network


Phenix Algorithm Phenix Algorithm DescriptionDescription

OutlineOutline

Power-Law PropertiesPower-Law Properties Phenix Algorithm designPhenix Algorithm design Network resiliencyNetwork resiliency Preferential NodesPreferential Nodes


Power-Law Properties (1/2)Power-Law Properties (1/2) Power-law (or scale-free) networks: their degree distribution Power-law (or scale-free) networks: their degree distribution

follows a power law, p(K)=Kfollows a power law, p(K)=K--γγ , where K=degree, p(K)=the , where K=degree, p(K)=the number of nodes with degree K and number of nodes with degree K and γ γ is the exponent, in is the exponent, in most networks it tends to be close to 2most networks it tends to be close to 2

This means that in power-law networks many nodes have This means that in power-law networks many nodes have low degree and few nodes have a very high degreelow degree and few nodes have a very high degree

These high connected nodes act as hubs for the rest nodesThese high connected nodes act as hubs for the rest nodes In Phenix nodes with degree higher than the average In Phenix nodes with degree higher than the average

emerge as preferred nodesemerge as preferred nodes Every new node that joins the network wants to connect to a Every new node that joins the network wants to connect to a

preferred node (with high degree) for better visibilitypreferred node (with high degree) for better visibility This approach guarantees power-law for degree distributionThis approach guarantees power-law for degree distribution


Power-Law Properties (2/2)Power-Law Properties (2/2)

Power-law networks have a low diameter and they Power-law networks have a low diameter and they can grow while maintaining a low diameter (scale-can grow while maintaining a low diameter (scale-free)free)

Large diameters cause more network traffic or Large diameters cause more network traffic or degraded performance if lower radius search is degraded performance if lower radius search is chosen (tradeoff)chosen (tradeoff)

Phenix constructs P2P topologies that follows a Phenix constructs P2P topologies that follows a power-law for its node degree distribution and leads power-law for its node degree distribution and leads to low diameterto low diameter


Phenix Algorithm Design (1/2)Phenix Algorithm Design (1/2) Algorithm for node i joins the networkAlgorithm for node i joins the networkconnect_to_network(i)connect_to_network(i) { {

obtain obtain GGhost,ihost,i from host cache server; from host cache server;

divide divide GGhost,ihost,i into into GGrandom,irandom,i and and GGfriends,ifriends,i ; ;

let s be the size of let s be the size of GGfriends,ifriends,i ; ;

GGcandidates,icandidates,i =Ø; =Ø;

for (x=0; x<s; x++) {for (x=0; x<s; x++) {

send Msend M00 ; where M ; where M00=<source=i, dest==<source=i, dest=GGfriends,ifriends,i[x][x], type=ping, TTL=1, hops=0>, type=ping, TTL=1, hops=0>

GGcandidates,icandidates,i = = GGcandidates,icandidates,i U U GGneighbors[x]neighbors[x] ; [x sends a pong to i with its neighbors] ; [x sends a pong to i with its neighbors]

[[GGfriends,ifriends,i[x][x] sends a M1 ping message to its neighbors with source=i, hops=1 sends a M1 ping message to its neighbors with source=i, hops=1 and TTL=0 and each neighbor j adds i to a and TTL=0 and each neighbor j adds i to a ΓΓjj list for a period of time list for a period of time ττ]]

}}

GGpreferred,ipreferred,i = [g = [g11, g, g22, …, g, …, gpp] sorted( ] sorted( GGcandidates,icandidates,i ); [sort by appearance frequency]); [sort by appearance frequency]

create connection with all nodes in create connection with all nodes in GGii = = GGrandom,irandom,i U U GGpreferred,ipreferred,i ; ;


Phenix Algorithm Design (2/2)Phenix Algorithm Design (2/2)

for (every m that belongs in for (every m that belongs in GGpreferred,ipreferred,i) {) {if (i belongs in if (i belongs in ΓΓmm) c) cmm++;++;if (cif (cmm≥≥γγ) { ) { [creates backward connection][creates backward connection]

ccmm= c= cm m - - γγ; ; GGbackward,mbackward,m==GGbackward,mbackward,m U { i }; [at most d U { i }; [at most din,min,m//γ γ backward backward

connections]connections]GGpreferred,ipreferred,i = = GGpreferred,ipreferred,i – { m }; – { m };GGhighly_preferred,ihighly_preferred,i = = GGhighly_preferred,ihighly_preferred,i + { m }; + { m };

}} [list of neighbors: [list of neighbors: GGii= = GGrandom,irandom,i, , GGpreferred,ipreferred,i, , GGhighly_preferred,ihighly_preferred,i, , GGbackward,ibackward,i ] ]

}}

}} Example:Example:


Network ResiliencyNetwork Resiliency

Power-law networks often collapse under targeted Power-law networks often collapse under targeted attacks in nodes with high degrees (network attacks in nodes with high degrees (network partitioning)partitioning)

Guidelines for resiliency:Guidelines for resiliency:– Hide the identity of high connected nodesHide the identity of high connected nodes– Node maintenance, rearrange connections under attackNode maintenance, rearrange connections under attack

Assume that attacker can force a node to drop out of Assume that attacker can force a node to drop out of network (e.g. DOS attack) when it knows the node’s IPnetwork (e.g. DOS attack) when it knows the node’s IP

Goal of resilience in Phenix is a network graph close Goal of resilience in Phenix is a network graph close to a strongly connected graph as possibleto a strongly connected graph as possible


Hiding Node IdentitiesHiding Node Identities

Three mechanisms for limiting the knowledge of a Three mechanisms for limiting the knowledge of a malicious user for the network connections graph:malicious user for the network connections graph:

When a node i sends a ping message MWhen a node i sends a ping message M00 the receiver the receiver sends a Msends a M11 ping message to neighbors and they add i ping message to neighbors and they add i to their Lto their Ljj list (“black list”) for a period of time. If i list (“black list”) for a period of time. If i sends ping again (“crawling” – capture graph state) it sends ping again (“crawling” – capture graph state) it will be in the list and no pong will be sent back. This will be in the list and no pong will be sent back. This will slow the crawl progresswill slow the crawl progress

Discard any ping message with TTL greater than 1Discard any ping message with TTL greater than 1 Backward connections are not included in pong Backward connections are not included in pong

messages in order to protect possible preferential messages in order to protect possible preferential status for this node. Only the subset status for this node. Only the subset GGoutside_worldoutside_world=[=[GGrandomrandom, , GGpreferredpreferred, , GGhighly_preferredhighly_preferred] is included] is included


Node Maintenance Mechanism Node Maintenance Mechanism (1/3)(1/3)

A state probing mechanism for node failure or attack A state probing mechanism for node failure or attack cases:cases:

The number of neighbors of a node i (hThe number of neighbors of a node i (hii) is: h) is: hi i

= h= hiir r + h+ hii

p p +h+hiibb , where h , where hii

rr, h, hiipp, h, hii

bb represent random, represent random, preferential (standard and highly) and backward neighborspreferential (standard and highly) and backward neighbors

If hIf hiir r + h+ hii

p p < threshold, node i runs a maintenance < threshold, node i runs a maintenance procedureprocedure

If a node leaves gracefully it informs neighbors but if it If a node leaves gracefully it informs neighbors but if it leaves forcefully a neighbor node can be informed only leaves forcefully a neighbor node can be informed only through probingthrough probing

Probing: message Probing: message MM22=<source=i, type=ping, TTL=0, =<source=i, type=ping, TTL=0, hops=0>hops=0> is send to all neighbors by a node i waiting for is send to all neighbors by a node i waiting for response in a timeout if neighbor is aliveresponse in a timeout if neighbor is alive



Number of neighbors before node maintenance is Number of neighbors before node maintenance is where dwhere drr

ii(t(tnn), ), ddpp

ii(t(tnn), d), dbbii(t(tnn) are the number of random, preferential and ) are the number of random, preferential and

backward neighbors lost since the last node maintenancebackward neighbors lost since the last node maintenance After the node maintenance we will haveAfter the node maintenance we will have

where uwhere urrii(t(tnn), u), upp

ii(t(tnn) are the numbers of new nodes added ) are the numbers of new nodes added randomly and preferentiallyrandomly and preferentially

Ratio of preferential and random neighbors for a node i:Ratio of preferential and random neighbors for a node i: where a where aii(t(t00)=1)=1



The updates on neighbors is performed as below:The updates on neighbors is performed as below:

where where is the average number is the average number of preferential nodes dropped out over the last l of preferential nodes dropped out over the last l cycles and cycles and μμpp is the expected value of neighbors is the expected value of neighbors disappeared in 1 cycledisappeared in 1 cycle

The final number of neighbors is:The final number of neighbors is:


Preferential Nodes (1/2)Preferential Nodes (1/2)

Phenix encourages the use of nodes with higher Phenix encourages the use of nodes with higher degree than the average (preferred nodes)degree than the average (preferred nodes)

If If μ μ is the average number of neighbors a new node is the average number of neighbors a new node will connect to will connect to μμ/2 nodes from /2 nodes from GGrandom,irandom,i and to and to μμ/2/2 nodes from nodes from GGcandidates,icandidates,i that appears most ( that appears most (GGpreferred,ipreferred,i) ) since asince aii(t(t00)=1 )=1

The probability that a node appears at least twice The probability that a node appears at least twice (preferred node) is:(preferred node) is:

where m=where m=μμ/2 and N the number of nodes in the /2 and N the number of nodes in the network.network.

Since Since μ/μ/N<1 it followsN<1 it follows


Preferential Nodes (2/2)Preferential Nodes (2/2)

Probability that a preferred node appears (a node Probability that a preferred node appears (a node that appears at least twice in candidates list) that appears at least twice in candidates list) versus the average number of neighbors for versus the average number of neighbors for different values of N (number of nodes in the different values of N (number of nodes in the initial network)initial network)


Simulation and EvaluationSimulation and Evaluation

Results from implementation of Phenix algorithm in Results from implementation of Phenix algorithm in a simulation environment based on Java softwarea simulation environment based on Java software

Power-Law AnalysisPower-Law Analysis Attack AnalysisAttack Analysis


Power-Law AnalysisPower-Law Analysis

Degree distribution for a network with 1,000 Degree distribution for a network with 1,000 nodes and for a network with 100,000 nodes on a nodes and for a network with 100,000 nodes on a log-log scale shows the emerging of power-law in log-log scale shows the emerging of power-law in Phenix systemPhenix system


Attack Analysis (1/2)Attack Analysis (1/2)

Three different types of attacks:Three different types of attacks:– Modest attack: a user that acquires host cache information Modest attack: a user that acquires host cache information

and candidate’s list like a normal user and then attacks to the and candidate’s list like a normal user and then attacks to the nodes that appears most, removing them from the networknodes that appears most, removing them from the network

– ‘‘Group Type I’ attack: add a number of nodes to network that Group Type I’ attack: add a number of nodes to network that only point to each other for increasing the possibility to only point to each other for increasing the possibility to emerge as preferred nodes and then create anomalies and emerge as preferred nodes and then create anomalies and suddenly disconnect all at the same time for partitioning the suddenly disconnect all at the same time for partitioning the networknetwork

– ‘‘Group Type II’ attack: add a number of nodes to network that Group Type II’ attack: add a number of nodes to network that behaves like normal nodes and then create anomalies and behaves like normal nodes and then create anomalies and suddenly disconnect all at the same time for partitioning the suddenly disconnect all at the same time for partitioning the networknetwork

Last two attacks are possible as network is open Last two attacks are possible as network is open without any authentication or authorizationwithout any authentication or authorization


Attack Analysis (2/2)Attack Analysis (2/2)

Simulations in network with 2000 nodes (starting Simulations in network with 2000 nodes (starting with 20), each node chooses a number of with 20), each node chooses a number of neighbors between 5 and 8neighbors between 5 and 8

Metric: percentage of unique reachable nodes in Metric: percentage of unique reachable nodes in the network vs. the number of hops (TTL)the network vs. the number of hops (TTL)

Comparison between a random network (Gnutella Comparison between a random network (Gnutella v0.6) and Phenix network under attackv0.6) and Phenix network under attack


Modest Attach AnalysisModest Attach Analysis


Group Attack AnalysisGroup Attack Analysis


Type I Attack AnalysisType I Attack Analysis


Type II Attack AnalysisType II Attack Analysis


Attack Analysis in Different Attack Analysis in Different NetworksNetworks

Same simulations for hybrid attacks in network of 20,000 Same simulations for hybrid attacks in network of 20,000 nodes and 2,000 nodesnodes and 2,000 nodes

TTL increment does not improve reachability after a valueTTL increment does not improve reachability after a value


Giant ComponentGiant Component

Giant component: the largest portion of network Giant component: the largest portion of network that remains strongly connected under attacksthat remains strongly connected under attacks

Metric: percentage of nodes in giant component Metric: percentage of nodes in giant component vs. percentage of malicious users (group attack)vs. percentage of malicious users (group attack)


Alpha behaviorAlpha behavior

α α parameter contributes in creating highly connected parameter contributes in creating highly connected nodes when it decreases, so it helps for fast recoverynodes when it decreases, so it helps for fast recovery

Simulation with hybrid attack 10% Group Type I and Simulation with hybrid attack 10% Group Type I and 20% Group Type II, 20% Group Type II, α α behavior studiedbehavior studied


Experimental ResultsExperimental Results Phenix implementation in a real Internet-wide Phenix implementation in a real Internet-wide

environment on the PlanetLab testbedenvironment on the PlanetLab testbed Experiments in 81 PlanetLab nodesExperiments in 81 PlanetLab nodes

ImplementationImplementation Degree Distribution ExperimentsDegree Distribution Experiments Targeted Attacks ExperimentsTargeted Attacks Experiments


ImplementationImplementation

Modifying the JTella API, based on Gnutella v0.6, Modifying the JTella API, based on Gnutella v0.6, for Phenix needs (instead of Gnutella’s random for Phenix needs (instead of Gnutella’s random topology)topology)

Each node consists of two layersEach node consists of two layers First layer implements Phenix algorithm and First layer implements Phenix algorithm and

consists of two types of connections, one that waits consists of two types of connections, one that waits incoming connections from other nodes and incoming connections from other nodes and sends/receives ping messages and an other for sends/receives ping messages and an other for Phenix outgoing connectionsPhenix outgoing connections

Second layer is used for experimental purposes, for Second layer is used for experimental purposes, for monitoring connections and controls the node monitoring connections and controls the node (join/remove to the network)(join/remove to the network)


Degree Distribution ExperimentsDegree Distribution Experiments

Network started with 10 nodes connected randomly and Network started with 10 nodes connected randomly and every new node get a list of 4 nodes. min=3 and max=4 every new node get a list of 4 nodes. min=3 and max=4 as bounds for neighbors (out-degree)as bounds for neighbors (out-degree)

Out-degree (number of neighbors) distribution examinedOut-degree (number of neighbors) distribution examined


Targeted Attacks ExperimentsTargeted Attacks Experiments

Three of the nodes with high degree (with 5, 10 and 18 Three of the nodes with high degree (with 5, 10 and 18 connections) removed from the system, and the time for connections) removed from the system, and the time for recovery using node maintenance was examinedrecovery using node maintenance was examined

Results gives a fast recovery (for most nodes less than a Results gives a fast recovery (for most nodes less than a sec) and new (final) network consists of four new highly sec) and new (final) network consists of four new highly connected nodes ensuring low-diameterconnected nodes ensuring low-diameter


Conclusion (1/2)Conclusion (1/2) Phenix designed fully distributed in order to create low-Phenix designed fully distributed in order to create low-

diameter and resilient P2P topologiesdiameter and resilient P2P topologies Phenix supports high performance in terms of low-diameter Phenix supports high performance in terms of low-diameter

and fast response times, is robust to attacks and resilient to and fast response times, is robust to attacks and resilient to network dynamics (joins/leaves, failures, attacks)network dynamics (joins/leaves, failures, attacks)

Rise in number of security attacks makes the need for Rise in number of security attacks makes the need for resilient networks (with also good performance) necessaryresilient networks (with also good performance) necessary

In simulations section node maintenance didn’t consider. In simulations section node maintenance didn’t consider. Using the mechanism of node maintenance the network can Using the mechanism of node maintenance the network can recover from group attacks with 90% malicious nodesrecover from group attacks with 90% malicious nodes

Phenix seems to have very good response to attacks that Phenix seems to have very good response to attacks that assumed in this paperassumed in this paper

Sophisticated attacks used in the paper for simulations, but Sophisticated attacks used in the paper for simulations, but there are also many other attacksthere are also many other attacks


Conclusion (2/2)Conclusion (2/2) Much future work:Much future work:

– Authentication or authorization for extra securityAuthentication or authorization for extra security– Sharing the “black lists” with higher layer protocolsSharing the “black lists” with higher layer protocols– It is not possible for any node to handle any traffic, so many It is not possible for any node to handle any traffic, so many

nodes would refuse to be highly connectednodes would refuse to be highly connected– Choosing the neighbors geographically, using response times Choosing the neighbors geographically, using response times – More extensive experiments in larger scaleMore extensive experiments in larger scale

Phenix only constructs effective topologies for P2P Phenix only constructs effective topologies for P2P networks. There is no proposal for other operations of networks. There is no proposal for other operations of Phenix P2P system, e.g. any smart query technique for Phenix P2P system, e.g. any smart query technique for searching in these topologiessearching in these topologies

The experiments done in this work (using 81 nodes) was The experiments done in this work (using 81 nodes) was in a small scale for real P2P systems (with thousands in a small scale for real P2P systems (with thousands nodes)nodes)


Thanks!Thanks!

Thanks for listening……Thanks for listening……

Merry Christmas and happy 2005!Merry Christmas and happy 2005!

Phenix Peer-to-Peer System 1 Phenix: Supporting Resilient Low-Diameter Peer-to-Peer Topologies Rita...

Documents

Transcript of Phenix Peer-to-Peer System 1 Phenix: Supporting Resilient Low-Diameter Peer-to-Peer Topologies Rita...