• ETRI Journal
• /
• v.33 no.5
• /
• pp.826-829
• /
• 2011

Distributed systems particularly suffer from Sybil attacks, where a malicious user creates numerous bogus nodes to influence the functions of the system. In this letter, we propose a Bloom filter-based scheme, SybilBF, to fight against Sybil attacks. A Bloom filter presents a set of Sybil nodes according to historical behavior, which can be disseminated to at least n (e-1)/e honest nodes. Our evaluation shows that SybilBF outperforms state of the art mechanisms improving SybilLimit by a factor of (1/e)${\gamma}$ at least.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.05a
• /
• pp.534-537
• /
• 2013

인터넷상에서 다양한 사용자 및 구성요소로 이루어진 분산시스템은 Sybil Attack 에 취약하다. 최근 온라인 소셜 네트워크(Online Social Network)의 그래프 정보를 사용해, Sybil Attack 에 대응하기 위한 Sybil-resistant value 추출 기법들이 제안되었다. 이 논문에서는 이러한 OSN 기반의 Sybil-resistant value 추출 기법들에 대한 성능을 평가한다. 특히 OSN 그래프의 각 노드들의 이웃 노드 개수 정보에 따른 성능과 Sybil 노드들의 Attack Edge 에 따른 성능을 평가한다. Facebook 에서 추출한 샘플 OSN 그래프를 사용한 성능 평가 분석을 통해, 실제 사용자를 위한 Sybil-resistant value 를 정상적으로 추출하기 위해서는 OSN 그래프 상에서 이웃 노드의 개수가 10 개 이상이어야 한다는 점과, Random Route Tail Intersection 기법이 Sybil 사용자 그룹의 Attack Edge 의 영향을 가장 적게 받는 다는점을 확인 하였다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.11a
• /
• pp.1151-1153
• /
• 2007

P2P 및 Mobile Network, Reputations System 등의 분산 시스템은 sybil attack 에 노출되어 있다. sybil attack 은 한 명의 사용자가 다수의 식별자를 가진 것으로 위장하여 시스템 내에서 마치 실제 다수의 사용자인 양 시스템을 악용하는 공격방법이다. sybil attack 을 막기 위한 다양한 노력이 진행되었고, 최근에 SybilGuard 라는 social network 를 이용한 방어 방법이 제시되었다. SybilGuard 는 악의적인 사용자를 막기 위하여, Random Walk 의 변형이면서 결정적인 경로의 특징을 가지는 임의경로(Random Route)를 사용하여 악의적인 사용자의 sybil attack 을 방어한다. SybilGuard 는 sybil node 의 개수를 제한하고, 이들을 하나의 동일한 그룹으로 분류할 수 있도록 하여 시스템 내에서 가짜 식별자의 개수를 제한한다. 이를 위해 각 노드가 시스템에 돌어올 때 Verifier(V)노드가 이들 노드를 확인하게 되는데, 이를 위해 시스템 내의 선한 노드(Honest Node)를 사용하여 이들을 확인한다. 이 때, honest node 들은 verifier 의 요청에 따라 확인요청을 수행하게 되는데, social network 의 특성상 몇몇 노드들은 사회적인 명망으로 매우 큰 링크수를 가지게 될 것이며, 따라서 이들 노드들이 처리해야할 요청의 양이 매우 많아지게 될 것이다. 따라서 이들 honest node 들 간에 로드분포를 균등하게 하는 것이 요구되며, 이 논문에서는 부하 조절을 하기 위한 기법을 제시하고, 이들을 평가한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2012.05a
• /
• pp.467-470
• /
• 2012

This paper proposes a technique of sybil attack detection using an ID-based certificate on sensor network. First, it can solve the broadcast storm problem happening when keys are distributed to sensor nodes. Second, it prevents the replay attack by periodically generating and changing the keys of sensor nodes with Key-chain technique. Third, it authenticates sensor node's ID using hash function. So, it maximizes sensor node's memory usage, reduces communication overhead. Finally it detects Sybil attack through ID-based certificate. Therefore, the proposed technique of Sybil attack detection using ID-based certificate consider simultaneously energy efficiency and stability on sensor network environment, and can trust the provided information through sensor network.

• Journal of information and communication convergence engineering
• /
• v.9 no.6
• /
• pp.676-682
• /
• 2011

Sybil attack can disrupt proper operations of wireless sensor network by forging its sensor node to multiple identities. To protect the sensor network from such an attack, a number of countermeasure methods based on RSSI (Received Signal Strength Indicator) and LQI (Link Quality Indicator) have been proposed. However, previous works on the Sybil attack detection do not consider the fact that Sybil nodes can change their RSSI and LQI strength for their malicious purposes. In this paper, we present a Sybil attack detection method based on a transmission power range. Our proposed method initially measures range of RSSI and LQI from sensor nodes, and then set the minimum, maximum and average RSSI and LQI strength value. After initialization, monitoring nodes request that each sensor node transmits data with different transmission power strengths. If the value measured by monitoring node is out of the range in transmission power strengths, the node is considered as a malicious node.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.4 no.6
• /
• pp.1311-1326
• /
• 2010

Peer-to-peer (P2P) networks consume the most bandwidth in the current Internet and file sharing accounts for the majority of the P2P traffic. Thus it is important for a P2P file sharing application to be efficient in bandwidth consumption. Bandwidth consumption as much as downloaded file sizes is inevitable, but those in file search and bad downloads, e.g. wrong, corrupted, or malicious file downloads, are overheads. In this paper, we target to reduce these overheads even in the presence of high volume of malicious users and their bad files. Sybil attacks are the example of such hostile environment. Sybil attacker creates a large number of identities (Sybil nodes) and unfairly influences the system. When a large portion of the system is subverted, either in terms of the number of users or the number of files shared in the system, the overheads due to the bad downloads rapidly increase. We propose ELiSyR, a file search protocol that can tolerate such a hostile environment. ELiSyR uses social networks for P2P file search and finds benign files in 71% of searches even when more than half of the users are malicious. Furthermore, ELiSyR provides similar success with less bandwidth than other general efforts against Sybil attacks. We compare our algorithm to SybilGuard, SybilLimit and EigenTrust in terms of bandwidth consumption and the likelihood of bad downloads. Our algorithm shows lower bandwidth consumption, similar chances of bad downloads and fairer distribution of computation loads than these general efforts. In return, our algorithm takes more rounds of search than them. However the time required for search is usually much less than the time required for downloads, so the delay in search is justifiable compared to the cost of bad downloads and subsequent re-search and downloads.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.6 no.10
• /
• pp.2731-2749
• /
• 2012

Sybil attack has been proved effective in mitigating the P2P botnet, but the impacts of some important parameters were not studied, and no model to estimate the effectiveness was proposed. In this paper, taking Kademlia-based botnets as the example, the model which has the upper and lower bound to estimate the mitigating performance of the Sybil attack is proposed. Through simulation, how three important factors affect the performance of the Sybil attack is analyzed, which is proved consistent with the model. The simulation results not only confirm that for P2P botnets in large scale, the Sybil attack is an effective countermeasure, but also imply that the model can give suggestions for the deployment of Sybil nodes to get the ideal performance in mitigating the P2P botnet.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.12
• /
• pp.533-540
• /
• 2013

Anonymity is the one of main reasons for substantial improvement of Internet. It encourages various users to express their opinion freely and helps Internet based distributed systems vitalize. But, anonymity can cause unexpected threats because personal information of an online user is hidden. Especially, distributed systems are threatened by Sybil attack, where one malicious user creates and manages multiple fake online identities. To prevent Sybil attack, the traditional solutions include increasing the complexity of identity generation and mapping online identities to real-world identities. But, even though the high complexity of identity generation increases the generation cost of Sybil identities, eventually they are generated and there is no further way to suppress their activity. Also, the mapping between online identities and real identities may cause high possibility of losing anonymity. Recently, some methods using online social network to prevent Sybil attack are researched. In this paper, a new method is proposed for extracting a user's system-wide Sybil-resistant trust value by using the properties embedded in online social network graphs. The proposed method can be categorized into 3 types based on sampling and decision strategies. By using graphs sampled from Facebook, the performance of the 3 types of the proposed method is evaluated. Moreover, the impact of Sybil attack on nodes with different characteristics is evaluated in order to understand the behavior of Sybil attack.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.17 no.6
• /
• pp.1462-1470
• /
• 2013

This paper proposes an SWAD-KNH(Sybil & Wormhole Attack Detection using Key, Neighbor list and Hop count) technique which consists of an SWAD(Sybil & Wormhole Attack Detection) module detecting an Worm attack and a KGDC(Key Generation and Distribution based on Cluster) module generating and an sense node key and a Group key by the cluster and distributing them. The KGDC module generates a group key and an sense node key by using an ECDH algorithm, a hash function, and a key-chain technique and distributes them safely. An SWAD module strengthens the detection of an Sybil attack by accomplishing 2-step key acknowledgement procedure and detects a Wormhole attack by using the number of the common neighbor nodes and hop counts of an source and destination node. As the result of the SWAD-KNH technique shows an Sybil attack detection rate is 91.2% and its average FPR 3.82%, a Wormhole attack detection rate is 90%, and its average FPR 4.64%, Sybil and wormhole attack detection rate and its reliability are improved.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.9 no.9
• /
• pp.3738-3750
• /
• 2015

Sybil attack is a special kind of attack which is difficult to be detected in Wireless Sensor Network (WSN). So a lightweight detection mechanism based on LEACH-RSSI-ID (LRD) is proposed in this paper. Due to the characteristic of Low-Energy Adaptive Clustering Hierarchy (LEACH) protocol, none of nodes can be the cluster head forever.