# Study of Peer-to-Peer Network Based Cybercrime Investigation: Application on Botnet Technologies

Canonical URL: https://markscanlon.co/publications/StudyOfPeer-to-PeerNetworkBasedCybercrimeInvestigation

CSL-JSON: https://markscanlon.co/publications/StudyOfPeer-to-PeerNetworkBasedCybercrimeInvestigation.csl.json
BibTeX: https://markscanlon.co/publications/StudyOfPeer-to-PeerNetworkBasedCybercrimeInvestigation.bib
RIS: https://markscanlon.co/publications/StudyOfPeer-to-PeerNetworkBasedCybercrimeInvestigation.ris

Authors: Mark Scanlon
Venue: PhD Thesis
Year: 2013
PDF: https://markscanlon.co/publications/StudyOfPeer-to-PeerNetworkBasedCybercrimeInvestigation.pdf
Full text: https://markscanlon.co/publications/StudyOfPeer-to-PeerNetworkBasedCybercrimeInvestigation.full.md

## Contribution Summary

This PhD thesis addresses the challenge of investigating Peer-to-Peer (P2P) networks, which are exploited by cybercriminals for various crimes, including botnet propagation and malware distribution. The study focuses on the analysis of active P2P nodes and undocumented communication methods in large unstructured networks. To facilitate investigations, the Universal P2P Network Investigation Framework (UP2PNIF) is proposed, which leverages commonalities in P2P network functionality to expedite evidence gathering. A proof-of-concept tool is developed for investigating the BitTorrent network, demonstrating the framework's potential in conducting efficient and effective investigations.

## Abstract

The scalable, low overhead attributes of Peer-to-Peer (P2P) Internet protocols and networks lend themselves well to being exploited by criminals to execute a large range of cybercrimes. The types of crimes aided by P2P technology include copyright infringement, sharing of illicit images of children, fraud, hacking/cracking, denial of service attacks and virus/malware propagation through the use of a variety of worms, botnets, malware, viruses and P2P file sharing. This project is focused on study of active P2P nodes along with the analysis of the undocumented communication methods employed in many of these large unstructured networks. This is achieved through the design and implementation of an efficient P2P monitoring and crawling toolset. The requirement for investigating P2P based systems is not limited to the more obvious cybercrimes listed above, as many legitimate P2P based applications may also be pertinent to a digital forensic investigation, e.g, voice over IP, instant messaging, etc. Investigating these networks has become increasingly difficult due to the broad range of network topologies and the ever increasing and evolving range of P2P based applications. In this work we introduce the Universal P2P Network Investigation Framework (UP2PNIF), a framework which enables significantly faster and less labour intensive investigation of newly discovered P2P networks through the exploitation of the commonalities in P2P network functionality. In combination with a reference database of known network characteristics, it is envisioned that any known P2P network can be instantly investigated using the framework, which can intelligently determine the best investigation methodology and greatly expedite the evidence gathering process. A proof of concept tool was developed for conducting investigations on the BitTorrent network. A number of investigations conducted using this tool are outlined in Chapter 6.