iPersea: Defeating Massive Sybil Attacks in Social DHTs Through Active Inspection

TL;DR

iPersea is an evolution of the Persea DHT designed to survive "Active Sybil Attacks" where malicious nodes actively return incorrect data. By introducing inspection lookups and collaborative node filtering, iPersea achieves nearly 100% lookup reliability in real-world social graphs, even when the number of attacker-controlled links scales to the size of the honest network itself.

The Problem: The "Fast-Mixing" Myth and Poisoned Replies

The Sybil attack—where one attacker creates thousands of fake identities—is the bane of P2P systems. Early social-network-based defenses (like SybilLimit or Whānau) relied on two shaky pillars:

1. Fast-Mixing Graphs: The assumption that a random walk quickly reaches a uniform distribution.
2. Low Attack Edges: The belief that attackers can only trick a few honest users into connecting.

Real-world data shows these assumptions are often false. While the original Persea addressed these by using a hierarchical ID space (bootstrap tree) to confine attackers to small ID "pockets," it had a fatal flaw: it assumed attackers would just "ignore" requests. In reality, a sophisticated adversary will return incorrect data to poison the DHT.

Methodology: The "Secret Shopper" of DHTs

iPersea transforms the passive defense of Persea into an active hunt. The core innovation is the Inspection Lookup.

1. Collaborative Friends

Each node identifies "collaborative friends"—trusted ancestors (parents, grandparents) in the bootstrap tree—who help run security checks. Because these friends are spread across different layers of the ID space, attackers cannot easily predict where an inspection query is coming from.

2. Stealthy Inspection Lookups

To prevent attackers from "playing nice" only when they know they are being watched, iPersea makes inspection lookups look exactly like regular DHT traffic:

• Intermediate Check: A friend initiates a lookup through a child node. If the child fails to route it toward the target, it is flagged as malicious (status ✗).
• Target Check: A friend stores a value on the child and later retrieves it. If the child returns incorrect data, it is permanently blacklisted.

3. Recursive Filtering

During a regular lookup, the initiator recursively checks the "parental chain" of every potential hop. If any ancestor is marked as a Sybil, the entire branch is bypassed.

Note: The hierarchical ID allocation restricts Sybil nodes to specific sub-trees, while the inspection mechanism prunes these sub-trees from the routing table.

Experiments: Performance Under Siege

The authors tested iPersea against six major datasets, including Facebook, Flickr, and Catster.

Success Rates

The most striking result is found in the Catster dataset (the largest in the study). While the original Persea’s success dropped sharply as attack edges increased, iPersea maintained a 100% success rate even when attack edges equaled honest nodes ($g/n=1.0$).

Figure: The "iPersea" lines remain flat at the top of the graph, showing resilience compared to the sharp decline in baseline Persea (Majority Voting).

False Positives & Overhead

• False Positives: Around 5-9%—meaning some honest nodes are mistakenly flagged. This is a trade-off for the extreme security gain.
• Hop Count: Interestingly, iPersea often has lower latency than Persea. By filtering out malicious nodes early, the system avoids "dead-end" paths and poisoned routing loops.

Critical Insight: Why This Matters

iPersea demonstrates that Hierarchy is Security. By linking DHT identities to an invitation-based bootstrap tree, the system creates a "Chain of Trust" that is much harder to subvert than flat random-walk models.

However, the system does have a potential bottleneck: the reliance on ancestors for status checks. If a high-level bootstrap node or a root ancestor is compromised (an "Oscillation Attack"), the filtering mechanism could be momentarily blinded. The authors' plan for future work—incorporating permanent seals for nodes that fail checks—is a necessary step toward total Byzantine fault tolerance.

Conclusion

iPersea represents a significant shift in P2P security. It moves away from theoretical graph properties (like mixing times) and toward behavioral verification. By forcing nodes to "prove" their honesty through undercover inspection lookups, it creates a DHT that can survive even the most aggressive Sybil campaigns.