Inference on the Network Evolution in BitTorrent Mainline DHT

Network size is a fundamental statistic for a peer-to-peer system but is generally considered to contain too little information to be useful. However, most existing work only considers the metric by itself and does not explore what features could be extracted from this seemingly trivial metric. In this paper, we show that Fourier transform allows us to extract frequency features from such time series data, which can further be used to characterize user behaviors and detect system anomalies in a peer-to-peer system automatically without needing to resort to visual comparisons. By using the proposed algorithm, our system successfully discovers and clusters countries of similar user behavior and captures the anomalies like Sybil attacks and other real-world events with high accuracy. Our work in this paper highlights the usefulness of more advanced time series processing techniques in analyzing network measurements.