Proceedings [PDF] - Measurement and Analysis of P2P Activity ...

International Conference Advances in the Analysis of Online Paedophile Activity Paris, France; 2-3 June, 2009
Measurement of paedophile activity in eDonkey
using a client sending queries
Firas Bessadok, Karim Bessaoud, Matthieu Latapy and Clémence Magnien
LIP6 - CNRS and University Pierre & Marie Curie
firas.bess@gmail.com, karim.bessaoud@complexnetworks.lip6.fr, matthieu.latapy@lip6.fr,
clemence.magnien@lip6.fr
1. INTRODUCTION
The observation of peer-to-peer (P2P) file exchange
systems is a hot topic covered by several works [1][2].
In our proposal, we mainly focus on observing and analyzing
paedophile activity in P2P networks. Our goal
is to provide different indicators related to paedophile
files found in the eDonkey network. To this end, we
used a modified client which automatically sends queries
to eDonkey servers and collects information about files
sent back by the servers (file-id, name of file, size of
file, or users who possess it). The obtained data is then
analyzed to gain insight on paedophile activity in the
system.
2. MEASUREMENT
Our system is composed of a unique client which connects
itself to several servers belonging to the eDonkey
P2P network. The client restarts after each session of 12
hours. A session is defined by the execution of the client
during 12 hours. In each session, the client sends 15 different
queries (8 of them are well-known paedophile keywords)
one by one every 6 minutes. Once the answers
(file-id, filenames or file sizes) are received, the client
formats them into XML files. We run this measurement
during 140 days from October 2008 to February
2009.
3. OBSERVATIONS
We collected 2 784 583 distinct files during this experiment.
Later on, we computed many statistics on these
files. For instance, the number of files found in each session,
the distribution of ages in filenames, and also the
number of paedophile files and other non-paedophile.
We present some of the obtained results below.
3.1 Number of file-id
Figure 1 shows the evolution of the number of distinct
file-id (vertical axis) observed during our measurement
as function of the number of sessions executed : similar
to the time elapsed since the beginning of this measurement
(horizontal axis).
Figure 1: Evolution of the number of file-id observed
during the measurement.
We note that the plot is growing, as expected, but in
a non-linear way. In the first twenty sessions, the curve
has a large slope because most file-id have not yet been
seen. But after that, the slope decreases gradually due
to the fact that most file-id have already been seen.
On the other hand, this slope remains significant. We
therefore conclude that the number of file-id present in
the eDonkey network is so great that we can’t see all
of them with our measurements, even if conducted for
long period of time (140 days here).
1
91