BITSTALKER: Accurately and effectively monitoring BitTorrent traffic

BitTorrent is currently the most popular peer-to-peer network for file sharing. However, experience has shown that Bit- Torrent is often used to distribute copyright protected movie and music files illegally. Consequently, copyright enforce- ment agencies currently monitor BitTorrent swarms to iden- tify users participating in the illegal distribution of copyright- protected files. These investigations rely on passive methods that are prone to a variety of errors, particularly false positive identification.

To mitigate the potential for false positive peer identifi- cation, we investigate the feasibility of using active methods to monitor extremely large BitTorrent swarms. We develop an active probing framework called BitStalker that identifies active peers and collects concrete forensic evidence that they were involved in sharing a particular file. We evaluate the effectiveness of this approach through a measurement study with real, large torrents consisting of over 186,000 peers. We find that the current investigative methods produce at least 11% false positives, while we show that false positives are rare with our active approach.