java.lang.Object
net.i2p.router.JobImpl
net.i2p.router.sybil.Analysis
All Implemented Interfaces:
Runnable, ClientApp, RouterApp, Job
public class Analysisextends JobImpl implements RouterApp, Runnable
Sybil attack analysis implementation.

  • Field Details

    • _context

      private final RouterContext _context
      The router context.

    • _log

      private final Log _log
      Logger for the sybil analysis.

    • _banLogger

      private BanLogger _banLogger
      Records why routers were banned.

    • _cmgr

      private final ClientAppManager _cmgr
      Manager that starts and stops this analysis.

    • _persister

      private final PersistSybil _persister
      Saves the analysis results to disk.

    • _state

      private volatile ClientAppState _state
      Current state of the analysis client app.

    • fmt

      private final DecimalFormat fmt
      Formatter for the displayed scores.

    • _wasRun

      private boolean _wasRun
      Whether an analysis pass has completed.

    • _familyExemptPoints24

      private final List<String> _familyExemptPoints24
      Family names exempt from the /24 points.

    • APP_NAME

      public static final String APP_NAME
      The name we register with the ClientAppManager.
      See Also:

    • PROP_FREQUENCY

      public static final String PROP_FREQUENCY
      Property to set the scan frequency.
      See Also:

    • PROP_THRESHOLD

      public static final String PROP_THRESHOLD
      Property to set the threshold.
      See Also:

    • PROP_BLOCK

      public static final String PROP_BLOCK
      Property to enable blocking.
      See Also:

    • PROP_NONFF

      public static final String PROP_NONFF
      Property to analyze all peers.
      See Also:

    • PROP_BLOCKTIME

      public static final String PROP_BLOCKTIME
      Property to set the block period.
      See Also:

    • PROP_REMOVETIME

      public static final String PROP_REMOVETIME
      Property to set the delete old period.
      See Also:

    • MIN_FREQUENCY

      private static final long MIN_FREQUENCY
      Shortest interval between analysis runs, one hour.
      See Also:

    • MIN_UPTIME

      private static final long MIN_UPTIME
      Router uptime needed before the first run is 75 minutes.
      See Also:

    • DEFAULT_FREQUENCY

      public static final long DEFAULT_FREQUENCY
      Default scan frequency.
      See Also:

    • PAIRMAX

      public static final int PAIRMAX
      Maximum pairs to analyze.
      See Also:

    • MAX

      public static final int MAX
      Maximum entries to process.
      See Also:

    • POINTS32

      private static final double POINTS32
      Points for a /32 pair, scaled by group size.
      See Also:

    • POINTS24

      private static final double POINTS24
      Points for a /24 pair, scaled by group size.
      See Also:

    • POINTS16

      private static final double POINTS16
      Points for a /16 pair, scaled by group size.
      See Also:

    • POINTS_US32

      private static final double POINTS_US32
      Points for a US /32 pair.
      See Also:

    • POINTS_US24

      private static final double POINTS_US24
      Points for a US /24 pair.
      See Also:

    • POINTS_US16

      private static final double POINTS_US16
      Points for a US /16 pair.
      See Also:

    • POINTS_V6_US64

      private static final double POINTS_V6_US64
      Points for a US IPv6 /64 pair.
      See Also:

    • POINTS_V6_US48

      private static final double POINTS_V6_US48
      Points for a US IPv6 /48 pair.
      See Also:

    • POINTS64

      private static final double POINTS64
      Points for an IPv6 /64 pair.
      See Also:

    • POINTS48

      private static final double POINTS48
      Points for an IPv6 /48 pair.
      See Also:

    • POINTS_FAMILY

      private static final double POINTS_FAMILY
      Points removed for routers in the same family.
      See Also:

    • POINTS_FAMILY_VERIFIED

      private static final double POINTS_FAMILY_VERIFIED
      Points removed for a verified family match.
      See Also:

    • POINTS_NONFF

      private static final double POINTS_NONFF
      Points removed when neither router is a floodfill.
      See Also:

    • POINTS_BAD_FAMILY

      private static final double POINTS_BAD_FAMILY
      Points added for a family mismatch.
      See Also:

    • POINTS_BAD_OUR_FAMILY

      private static final double POINTS_BAD_OUR_FAMILY
      Points added when our family does not match.
      See Also:

    • POINTS_OUR_FAMILY

      private static final double POINTS_OUR_FAMILY
      Points removed when our family matches.
      See Also:

    • POINTS_BAD_VERSION

      private static final double POINTS_BAD_VERSION
      Points added for a different router version.
      See Also:

    • POINTS_UNREACHABLE

      private static final double POINTS_UNREACHABLE
      Points added for an unreachable router.
      See Also:

    • POINTS_NEW

      private static final double POINTS_NEW
      Points added for a recently seen router.
      See Also:

    • POINTS_BANLIST

      private static final double POINTS_BANLIST
      Points added for a banlisted router, below the permanent ban threshold.
      See Also:

    • MIN_CLOSE

      public static final double MIN_CLOSE
      Minimum close value for family detection.
      See Also:

    • PAIR_DISTANCE_FACTOR

      private static final double PAIR_DISTANCE_FACTOR
      Multiplier for the pair distance points.
      See Also:

    • OUR_KEY_FACTOR

      private static final double OUR_KEY_FACTOR
      Multiplier for points against our own key.
      See Also:

    • VERSION_FACTOR

      private static final double VERSION_FACTOR
      Multiplier for the version difference points.
      See Also:

    • DEFAULT_BLOCK

      public static final boolean DEFAULT_BLOCK
      Default is blocking enabled.
      See Also:

    • DEFAULT_BLOCK_THRESHOLD

      public static final double DEFAULT_BLOCK_THRESHOLD
      Default block threshold.
      See Also:

    • DEFAULT_BLOCK_TIME

      public static final long DEFAULT_BLOCK_TIME
      Default block time.
      See Also:

    • DEFAULT_REMOVE_TIME

      public static final long DEFAULT_REMOVE_TIME
      Default remove time.
      See Also:

    • SHORT_REMOVE_TIME

      public static final long SHORT_REMOVE_TIME
      Short remove time.
      See Also:

    • MIN_BLOCK_POINTS

      public static final float MIN_BLOCK_POINTS
      Minimum points to block.
      See Also:

    • IPV6_LOCALHOST

      private static final byte[] IPV6_LOCALHOST
      IPv6 loopback address, never scored.

    • IPV6_NAT64

      private static final byte[] IPV6_NAT64
      NAT64 prefix seen from i2pd routers.

    • BI_MAX

      private static final BigInteger BI_MAX
      One past the largest routing key, for wrap-around math.

    • DAY

      private static final long DAY
      One day in milliseconds.
      See Also:

    • BUNDLE_NAME

      private static final String BUNDLE_NAME
      Bundle holding the translated console strings.
      See Also:

  • Constructor Details

  • Method Details

    • getInstance

      public static Analysis getInstance(RouterContext ctx)
      Singleton Analysis instance, creating it if necessary.
      Parameters:
      ctx - the router context
      Returns:
      non-null, creates new if not already registered

    • getPersister

      public PersistSybil getPersister()
      Persistence handler for storing and retrieving Sybil analysis data.
      Returns:
      the PersistSybil instance used by this analysis

    • runJob

      public void runJob()
      //// begin Job methods
      Specified by:
      runJob in interface Job

    • run

      public void run()
      Executes the background Sybil analysis, stores results, and removes old data.
      Specified by:
      run in interface Runnable

    • startup

      public void startup()
      Initializes and starts the Sybil analysis service. Registers with the ClientAppManager, loads persisted blocklist data, and schedules the first analysis run.
      Specified by:
      startup in interface ClientApp

    • shutdown

      public void shutdown(String[] args)
      Stops the Sybil analysis service and changes state to STOPPED.
      Specified by:
      shutdown in interface ClientApp
      Parameters:
      args - not used, present only to satisfy the Service interface

    • getState

      public ClientAppState getState()
      Current state of this application.
      Specified by:
      getState in interface ClientApp
      Returns:
      the current ClientAppState

    • getName

      public String getName()
      Application name.
      Specified by:
      getName in interface ClientApp
      Specified by:
      getName in interface Job
      Returns:
      the constant APP_NAME

    • getDisplayName

      public String getDisplayName()
      Display name for this application.
      Specified by:
      getDisplayName in interface ClientApp
      Returns:
      the display name "Sybil Analyzer"

    • changeState

      private void changeState(ClientAppState state)
      Records the new app state and notifies the console manager.
      Parameters:
      state - the new state of the client app

    • schedule

      public void schedule()
      Schedules the next Sybil analysis run based on configured frequency, router uptime, and previous run time.

    • addPoints

      private void addPoints(Map<Hash,Points> points, Hash h, double d, String reason)
      Adds scored points for one router.
      Parameters:
      points - the score map
      h - the router hash
      d - the points to add
      reason - the scoring rule that applied

    • getFloodfills

      public List<RouterInfo> getFloodfills(Hash us)
      Returns all floodfill routers, excluding our own router.
      Parameters:
      us - our router hash to exclude from the results
      Returns:
      list of floodfill RouterInfo objects

    • getAllRouters

      public List<RouterInfo> getAllRouters(Hash us)
      Returns all routers in the network DB, excluding our own router.
      Parameters:
      us - our router hash to exclude from the results
      Returns:
      list of all RouterInfo objects

    • getAvgMinDist

      public double getAvgMinDist(List<RouterInfo> ris)
      Calculates the average minimum distance from 200 random routing keys to the closest router in the provided list.
      Parameters:
      ris - the list of router infos to analyze
      Returns:
      the average minimum distance in logarithmic scale (base 2)

    • backgroundAnalysis

      public Map<Hash,Points> backgroundAnalysis(boolean includeAll)
      Analyze threats. No output. Return separate maps for each cause instead?
      Parameters:
      includeAll - false for floodfills only
      Returns:
      map of router hash to Points containing sybil analysis results

    • doBlocking

      private void doBlocking(Map<Hash,Points> points)
      Blocklist and Banlist if configured.
      Parameters:
      points - the per-router scores, those at or over the threshold are banned

    • calculatePairDistance

      public double calculatePairDistance(List<RouterInfo> ris, Map<Hash,Points> points, List<Pair> pairs)
      Calculate average pairwise distance between floodfills and identifies routers that are unusually close to each other.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points
      pairs - out parameter, sorted list of close router pairs
      Returns:
      the mean pairwise XOR distance across the routers analyzed

    • closestDistance

      private static double closestDistance(Hash h, List<RouterInfo> ris)
      Finds the keyspace distance to the nearest listed router.
      Parameters:
      h - the router hash
      ris - routers ordered by distance
      Returns:
      the smallest distance

    • getIP

      private static byte[] getIP(RouterInfo ri)
      IPv4 only.
      Parameters:
      ri - the router whose addresses are scanned
      Returns:
      the first 4-byte address, or null if the router has none

    • getIPv6

      private static byte[] getIPv6(RouterInfo ri)
      IPv6 only.
      Parameters:
      ri - the router whose addresses are scanned
      Returns:
      the IPv6, skipping the localhost and NAT64 forms i2pd gets wrong, or null when there is none

    • calculateIPGroupsUs

      public void calculateIPGroupsUs(List<RouterInfo> ris, Map<Hash,Points> points, List<RouterInfo> ri32, List<RouterInfo> ri24, List<RouterInfo> ri16, List<RouterInfo> ri64, List<RouterInfo> ri48)
      Categorize routers by their proximity to our IP address, grouping them by /32, /24, /16 for IPv4 and /64, /48 for IPv6.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points
      ri32 - out parameter for routers with same IP as us
      ri24 - out parameter for routers in same /24 as us
      ri16 - out parameter for routers in same /16 as us
      ri64 - out parameter for routers in same IPv6 /64 as us
      ri48 - out parameter for routers in same IPv6 /48 as us

    • calculateIPGroups32

      public Map<Integer, List<RouterInfo>> calculateIPGroups32(List<RouterInfo> ris, Map<Hash,Points> points)
      Categorize routers by their IP address to identify routers sharing the same IP.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points
      Returns:
      map of IP address (as Integer) to list of routers with that IP

    • calculateIPGroups24

      public Map<Integer, List<RouterInfo>> calculateIPGroups24(List<RouterInfo> ris, Map<Hash,Points> points)
      Categorize routers by their /24 subnet to identify routers in the same /24 network.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points
      Returns:
      map of /24 network (as Integer) to list of routers in that network

    • calculateIPGroups16

      public Map<Integer, List<RouterInfo>> calculateIPGroups16(List<RouterInfo> ris, Map<Hash,Points> points)
      Categorize routers by their /16 subnet to identify routers in the same /16 network.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points
      Returns:
      map of /16 network (as Integer) to list of routers in that network

    • calculateIPGroups64

      public Map<Long, List<RouterInfo>> calculateIPGroups64(List<RouterInfo> ris, Map<Hash,Points> points)
      Categorize routers by their IPv6 /64 subnet to identify routers in the same /64 network.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points
      Returns:
      map of IPv6 /64 network (as Long) to list of routers in that network

    • calculateIPGroups48

      public Map<Long, List<RouterInfo>> calculateIPGroups48(List<RouterInfo> ris, Map<Hash,Points> points)
      Categorize routers by their IPv6 /48 subnet to identify routers in the same /48 network.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points
      Returns:
      map of IPv6 /48 network (as Long) to list of routers in that network

    • calculateIPGroupsFamily

      public Map<String, List<RouterInfo>> calculateIPGroupsFamily(List<RouterInfo> ris, Map<Hash,Points> points)
      Categorize routers by their router family to identify routers in the same family. Routers in verified families receive fewer points.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points
      Returns:
      map of family name to list of routers in that family

    • addProfilePoints

      public void addProfilePoints(List<RouterInfo> ris, Map<Hash,Points> points)
      Analyzes router profiles and adds Sybil points for banlisted, newly observed, or poorly performing routers.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points

    • addVersionPoints

      public void addVersionPoints(List<RouterInfo> ris, Map<Hash,Points> points)
      Analyzes router versions and adds Sybil points for old, unreachable, or non-floodfill routers.
      Parameters:
      ris - the list of router infos to analyze
      points - map to accumulate sybil points

    • calculateRouterInfo

      public void calculateRouterInfo(Hash us, String usName, List<RouterInfo> ris, Map<Hash,Points> points)
      Build the version comparison report.
      Parameters:
      us - the local router hash
      usName - the local router's display name, already HTML escaped
      ris - will be re-sorted in place
      points - map of points per hash

    • biLog2

      private static double biLog2(BigInteger a)
      For debugging http://forums.sun.com/thread.jspa?threadID=597652
      Parameters:
      a - the value to take the base 2 logarithm of
      Returns:
      the base 2 logarithm of a, as a double

    • _t

      private String _t(String s)
      Translates a console string.
      Parameters:
      s - the string to translate
      Returns:
      the translated text

    • _t

      private String _t(String s, Object o)
      Translate a string with a parameter This is a lot more expensive than _t(s), so use sparingly.
      Parameters:
      s - string to be translated containing {0} The {0} will be replaced by the parameter. Single quotes must be doubled, i.e. ' -> '' in the string.
      o - parameter, not translated. To translate parameter also, use _t("foo {0} bar", _t("baz")) Do not double the single quotes in the parameter. Use autoboxing to call with ints, longs, floats, etc.
      Returns:
      the translated string, with {0} replaced by the parameter