Topology inference in GossipSub: Passive and active reconstruction via peer exchange exploitation

Details

Supervisors

Riviere, Etienne

Faculty

Ecole polytechnique de Louvain

Degree label

Master [120] en cybersécurité, à finalité spécialisée: conception et analyse de systèmes

Abstract

enPeer-to-peer networks form the foundation of critical decentralized infrastructures such as Ethereum and IPFS, whose operation relies on the efficient propagation of information via GossipSub, a popular publish-subscribe protocol. The topology of GossipSub, the logical network between machines that guides message transmission, has a direct impact on the network’s performance and, above all, its security. This thesis investigates the extent to which it is possible to reconstruct the GossipSub topology through passive and active observation, considering adversarial models ranging from a single passive node to a coordinated coalition. Three inference methods are implemented in an extended Java simulator, whose topological fidelity is validated against a real libp2p/GossipSub deployment on Grid5000: passive inference of the local neighborhood, passive coalition inference, and active inference exploiting the peer exchange mechanism. Experiments on networks of 1,000 nodes show that a single passive observer reconstructs its local neighborhood with perfect precision in fewer than three heartbeats, and a coalition of eight nodes achieves up to 6% global node coverage, with coverage scaling linearly in the coalition size. Inference leveraging peer exchange extends this reach significantly: eight nodes discover up to 31% of the network in a vulnerable scenario, and up to 93% with deeper inference. In every case, however, the nodes themselves are identified but the links between them are reconstructed with low precision: the inference reveals who is in the network, not the exact shape of the topology. Discovered nodes are recovered with 100% precision, though at the cost of up to 33% topology drift at depth two. These figures, however, assume that peer exchange is enabled network-wide, a deliberately permissive setting: in realistic deployments PX is restricted to a few bootstrap or trusted nodes, which substantially narrows the attack surface. Appropriate degree tuning and PX-side defenses such as extended backoff or suspicious GRAFT detection greatly limit inference effectiveness. These results show that GossipSub’s protocol signals constitute an information channel about network structure, and that partial topological knowledge is sufficient to prepare targeted attacks such as eclipse or de-anonymization attacks.