Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Friend or Foe? Identifying Anomalous Peers in Moneros P2P Network

T0 review · 4 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read About 14.7% of directly connected Monero peers exhibit non-standard behavior, with most anomalies clustering in a single autonomous system, suggesting coordinated monitoring infrastructure.

desk verdict A reproducible empirical study of Monero's P2P anomalies, whose headline '1,582 nodes from one entity' claim is undercut by the paper's own premises. read the letter →

arxiv 2509.10214 v1 pith:FJ7U5CIY submitted 2025-09-12 cs.NI

Yannik Kopyciok , Stefan Schmid , Friedhelm Victor This is my paper · ORCID
classification cs.NI
keywords MoneroP2PnetworkanomalydetectionpeerlistpoisoningprivacyDandelion++measurementdecentralization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that Monero's peer-to-peer network is heavily infiltrated by non-standard nodes that deviate from the reference protocol in detectable, structured ways. From 240 hours of traffic captured at five worldwide vantage points, roughly 14.74% of directly connected peers show at least one anomaly, and 1,582 of them sit in seven /24 subnets belonging to one network operator. The authors argue these patterns look like coordinated peer-list poisoning, topology probing, and connection saturation, which would undermine Monero's privacy guarantees. Their contribution is a formal anomaly-classification framework—syntactic, content, and behavioral—plus an open pipeline that any node operator can run to spot and block suspicious peers.

What carries the argument

The framework classifies anomalies in three protocol-level layers—syntactic violations (field-level deviations from the Levin protocol), content anomalies (logically inconsistent peer-list data flagged by diversity and similarity metrics), and behavioral pattern deviations (timing, frequency, and sequence of handshakes, Pings, and Timed Syncs)—then adds network-structure and node-attribute analysis (subnet saturation, AS concentration, peer-ID clusters). This taxonomy lets the authors separate deviations that are protocol violations from those that stay within protocol bounds but still look coordinated, and it is what turns raw packet captures into the 14.74% estimate.

What would settle it

A concrete test: run an unmodified, current Monero client from several IPs inside the seven flagged /24 subnets and check whether the same anomalies (signature-only TCP fragments, low-diversity peer lists, ping floods) reproduce; if standard client behavior produces these patterns, the coordinated-entity interpretation is wrong. Alternatively, obtain ground-truth labels by operating known-malicious and known-benign nodes in a controlled testbed and measuring whether the paper's thresholds separate them without overlap.

Watch

Extended reading notes

Core claim

The paper reports that in a measurement of Monero's P2P network, 1,924 of 13,050 reached IP addresses (14.74%) exhibit at least one non-standard behavior defined by their taxonomy. Seven /24 subnets within a single autonomous system account for 1,582 of these peers, suggesting one entity runs a large coordinated deployment. Anomalies include peers omitting support flags, sending deprecated last_seen timestamps, fragmenting TCP packets with a signature-only first segment, sending peer lists with extremely low subnet diversity or near-identical content, flooding short-lived handshake connections, throttling Timed Sync, and flooding Ping messages. The authors treat these as evidence of peer-lis

Load-bearing premise

The load-bearing premise is that the heuristic thresholds cleanly separate coordinated non-standard peers from benign deviations such as old client software, shared VPN endpoints, peering agreements, or transient network glitches; if that separation fails, the headline percentages and the single-entity estimate collapse.

Editorial extensions

If this is right

  • Monero's privacy guarantees are practically weaker than protocol-level analysis suggests: a node's connection pool is on average 15–20% occupied by non-standard peers.
  • The community ban list reduces outgoing saturation to about 7.13% but does not remove anomalous behavior, so static banning is insufficient.
  • Peer-list poisoning undermines the randomness assumption of peer discovery, letting adversaries become overrepresented in other nodes' peer lists.
  • The released detection pipeline can be used by node operators for real-time monitoring and blocking of suspicious peers.
  • The observed scale implies an adversary with substantial resources, consistent with topology-learning attacks that deflate Dandelion++ anonymity.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same taxonomy could likely be applied to other cryptocurrency P2P networks, where similar non-standard peer populations may be present but unmeasured.
  • Since the measurement only considers peers that connected to the five vantage points, the true fraction of anomalous peers across the whole network could be higher or lower; a broader vantage-point study could tighten the estimate.
  • If a single entity indeed controls 1,582 peers, the 20% network-control threshold discussed in prior Dandelion++ work may be closer than the raw peer count suggests, because those peers share infrastructure and can act in concert.
  • A testable extension: track whether the identified IPs remain anomalous over months or whether new subnets rotate in, to distinguish a persistent operator from transient network effects.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents an empirical study of anomalous peers in Monero's P2P network. The authors deployed five measurement nodes, captured 240 hours of traffic, and propose a three-tier anomaly framework (syntactic, content, behavioral) augmented with structural and attribute analysis. Applying this framework, they report that 1,924 of 13,050 directly connected IPs (14.74%) exhibit at least one non-standard behavior, and they single out seven /24 subnets in one AS as hosting 1,582 peers that they interpret as a coordinated adversarial deployment. They also evaluate the community ban list, reporting that it reduces outgoing connection saturation from 15.26% to 7.13%. The data and analysis pipeline are released for reproducibility.

Significance. If the headline claims are correct, this is a valuable and timely measurement contribution: it provides the first systematic, multi-vantage-point account of non-standard peers in Monero, with public artifacts that enable replication and follow-up work. The authors are careful to anchor several anomaly definitions in the Monero protocol specification and to acknowledge the absence of ground truth in Section 6. However, the central quantitative claims—especially the 14.74% prevalence and the 'one entity controls 1,582 nodes' inference—depend on post-hoc thresholds and assumptions that are not yet validated. The paper's strength is in the data collection and the anomaly taxonomy; its weakness is the leap from observed deviations to adversarial infrastructure. The limitations are partly acknowledged in the text, but the abstract and conclusions state the stronger interpretation without the necessary caveats.

major comments (4)
  1. [Sections 4.3 and 4.4, Eqs. (2) and (3)] The thresholds that define anomalies (diversity < 0.04, Jaccard > 0.3 repeated twice, Timed Sync > 90 s) are calibrated from the same captured distributions that are then classified. The paper does not report confidence intervals, per-vantage-point variability, or a sensitivity analysis. Consequently, the prevalence figure 14.74% is not an independently grounded estimate but a function of the chosen cutoffs. I ask the authors to report how the prevalence changes over a range of thresholds and to provide per-vantage-point breakdowns; ideally, the thresholds should be justified from the protocol specification or from a separate validation set.
  2. [Sections 4.3, 4.7, and 4.8] The assertion that one entity controls at least 1,582 peers rests on two insecure premises. First, Section 4.3 states that 'nodes within the same /24 subnet likely are controlled by a single entity'; for hosting ASes this is exactly the case where a /24 can be a shared allocation with many independent customers. Second, the 1,582 count includes IPs 'retrieved either through direct connections or from peer list entries' (Section 4.8), and Section 4.7 admits that peer lists may contain stale entries from disconnected nodes. Counting advertised historical IPs as active adversarial nodes inflates the estimate. The authors should separate confirmed direct connections from peer-list-advertised addresses and provide node-ID or behavioral evidence of common control beyond subnet/AS affiliation.
  3. [Section 4.8, Figure 9, Section 5.2] The union classifier 'at least one anomalous behavior' is the basis for the 14.74% headline percentage. Some anomalies, such as support-flags omission, may be explained by old but legitimate clients, and the paper does not report how many of the 1,924 IPs are flagged by only a weak anomaly. The overlap matrix in Figure 9 is informative but does not give the distribution of the number of anomalies per IP. I request a per-anomaly and intersection analysis, and an additional stricter composite criterion, so that the reader can see what fraction of the 1,924 IPs exhibit multiple independent deviations.
  4. [Section 6, 'Anomalous vs. Malicious'] The paper itself acknowledges the absence of ground truth and lists benign explanations (shared VPN endpoints, persistent network issues, peering agreements). Since the abstract and conclusion assert 'substantial shortcomings in Monero's privacy guarantees' and coordinated attacks, these benign explanations need to be quantitatively addressed or explicitly tested. For example, the authors could analyze whether the anomalous peers persist across the two 24-hour windows, whether throttled Timed Sync correlates with latency, and whether node-ID clusters are consistent with VPN port-forwarding rather than a single operator. Without such evidence, the adversarial interpretation remains a hypothesis.
minor comments (5)
  1. [Section 4.1] The date range '02/28/2025 and 02/30/2025' is invalid; February 2025 has 28 days. The figures in Section 5.1 show dates in June 2025, so the text and figures should be reconciled.
  2. [Section 4.4] The statement 'median only at 0.54' should state the unit explicitly (seconds). Also, the threshold for 'connections lasting less than 1 second' should be justified relative to network RTT and the measurement environment.
  3. [Figure 9] The overlap matrix is dense and the abbreviated labels (SFO, LST, PLD, PLS, ID, SlC, Ping, TS, Sig, Sub, Ban) are hard to map to the prose. A table of anomaly names and a clearer visual encoding would improve readability.
  4. [Section 3.1, Eqs. (1)-(3)] The formal definitions are not instantiated in Section 4; for example, Eq. (2) uses τ_t and correlation ranges that are never defined for the Monero case, and Eq. (3) refers to baselines B_conn and timings that are not linked to the empirical thresholds. Connecting the formalism to the implemented pipeline would strengthen the framework's contribution.
  5. [References] Reference [18] contains a typo: 'Eclipse attack on menero's peer to peer network' should be 'Monero's'. Please proofread the reference entries.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: anomaly definitions are anchored to the external Monero protocol specification; headline counts are direct measurements under stated heuristics, not predictions from fitted inputs.

full rationale

The paper's central empirical claims—14.74% of peers exhibiting non-standard behavior, and an estimated 1,582 nodes controlled by one entity—are not derived from equations whose inputs already contain those outputs. Syntactic anomalies (support flags omission, deprecated last_seen, signature-only TCP fragments) are checked against the public Monero protocol specification, an external standard. Behavioral anomalies are likewise anchored to the protocol's prescribed 60-second Timed Sync interval; the empirical median of 61.02 seconds is used only to confirm the protocol baseline, and the >90-second threshold is a stated heuristic tolerance, not a fitted parameter whose output is then reported as a prediction. Peer-list diversity and similarity thresholds are heuristic and partly data-informed, but the counts are reported as measurements under those explicit definitions rather than as predictions from a fitted model. The centralized-deployment inference (1,582 peers in seven /24 subnets of one AS) depends on the unproven assumption that same-/24/same-AS implies common control and on including stale peer-list IPs; this is an evidentiary or inference limitation, not a circular reduction—the claim remains an interpretation even if all inputs are accepted. Section 6 explicitly concedes the absence of ground truth for classifying anomalies as malicious versus benign, which is a validity limitation rather than a circularity. Self-citations ([8], [20]) are background material and are not load-bearing for the main derivation. Hence no step reduces to its own input by construction.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim depends on several hand-picked thresholds and domain assumptions rather than on a formal model. The 'formal framework' in Section 3 defines anomaly classes but leaves all thresholds (tau_t, epsilon_t, tau_conn) uninstantiated; the empirical sections set them by visual inspection of the same data. No new physical or computational entities are postulated.

free parameters (5)
  • Peer list diversity threshold = 0.04 (fewer than 10 /24 subnets per 250-peer list)
    Set in Section 4.3 from visual inspection of Figure 2; determines classification of 554 IPs as anomalous.
  • Peer list similarity threshold = Jaccard > 0.3, plus persistence in at least two lists
    Set in Section 4.3 from distribution in Figure 3; classifies 562 IPs.
  • Timed Sync frequency threshold = interval > 90 seconds, connections lasting > 10 minutes
    Set in Section 4.4 to accommodate network latency; classifies 536 connections / 88 IPs.
  • Short-lived connection cutoff = duration < 1 second
    Defined in Section 4.4; 85,288 connections fall in this class, one IP responsible for 65,340.
  • Combined anomaly union = 1,924 IPs (14.74%)
    The headline percentage is the union over all anomaly classes; changing any threshold changes this number, and no sensitivity analysis is given.
assumptions (4)
  • domain assumption The Monero Levin protocol specification describes correct behavior.
    Used throughout as ground truth for syntactic and semantic anomalies (Section 3.1).
  • domain assumption Nodes within the same /24 subnet assigned to one AS are likely controlled by a single entity.
    Sections 4.3 and 4.8; load-bearing for the 1,582-node single-entity estimate.
  • domain assumption The current network population is mostly honest, so the observed majority behavior defines the standard baseline.
    Implicit in setting the Timed Sync baseline as the network-wide median (Section 4.4) and in treating deviations as anomalies rather than the new normal.
  • ad hoc to paper Legacy protocol versions or benign network conditions do not account for the observed anomalies at scale.
    Section 6 acknowledges exceptions, but the abstract and conclusions treat the anomalies as likely adversarial; this is an unproven assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Friend or Foe? Identifying Anomalous Peers in Moneros P2P Network." pith.science (2026). https://pith.science/paper/FJ7U5CIY

@misc{pith2026250910214,
  author       = {Pith},
  title        = {Pith review of: Friend or Foe? Identifying Anomalous Peers in Moneros P2P Network},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FJ7U5CIY}},
  note         = {Machine review of arXiv:2509.10214}
}
read the original abstract

Monero, the leading privacy-focused cryptocurrency, relies on a peer-to-peer (P2P) network to propagate transactions and blocks. Growing evidence suggests that non-standard nodes exist in the network, posing as honest nodes but are perhaps intended for monitoring the network and spying on other nodes. However, our understanding of the detection and analysis of anomalous peer behavior remains limited. This paper presents a first comprehensive study of anomalous behavior in Monero's P2P network. To this end, we collected and analyzed over 240 hours of network traffic captured from five distinct vantage points worldwide. We further present a formal framework which allows us to analytically define and classify anomalous patterns in P2P cryptocurrency networks. Our detection methodology, implemented as an offline analysis, provides a foundation for real-time monitoring systems. Our analysis reveals the presence of non-standard peers in the network where approximately 14.74% (13.19%) of (reachable) peers in the network exhibit non-standard behavior. These peers exhibit distinct behavioral patterns that might suggest multiple concurrent attacks, pointing to substantial shortcomings in Monero's privacy guarantees and network decentralization. To support reproducibility and enable network operators to protect themselves, we release our examination pipeline to identify and block suspicious peers based on newly captured network traffic.

Figures

Figures reproduced from arXiv: 2509.10214 by the authors.

Figure 1
Figure 1. Monero’s Default Message Sequence The figure shows a standard Monero message sequence where node A opens an outgoing connection to node B. The handshake request initiates the connection. The Ping/Pong sequence verifies that A allows incoming connections and adds A to B’s white list. The Timed Sync commands are individual loops to retrieve updated information about the network’s topology. management and peer list exc… view at source ↗
Figure 2
Figure 2. Peer List Diversity. Distribution of peer list diver￾sity scores of individual peer lists containing the full amount of 250 peer entries. Diversity is the ratio of unique /24 subnets to total peers. A group of lists accumulates at a score below 0.028, representing less than seven subnets among 250 peers. The distribution in [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. shows the distribution of pairwise similarities. We compared all peer lists from distinct peers in the network. The lower graph’s peer lists have their IP addresses reduced to their /24 subnet. Further reductions to an AS level yield similar results. 99% of peer lists show a Jaccard similarity below 0.2. We set our threshold to 0.3 and only included IPs that show similarities above this threshold twice to include on… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Standard Connection. The graph displays a stan￾dard incoming connection with each peer sending Timed Sync requests approximately every 60 seconds. tiated by both peers in parallel [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Throttled Timed Sync. Sample peers throttling their Timed Sync request messages. Contrasting to the mea￾surement node using the fixed 60-second frequency for send￾ing out requests, the peer follows a non-standard frequency. The top graph represents an extreme case wher…
Figure 6
Figure 6. Figure 6: Ping Flooding. A peer spamming Ping messages to our measurment node. After a successful handshake, the adversarial peer spams Ping messages. The measurement node does not crash, treats the connection as usual, and starts at around 60 seconds with the first Timed Sync r…
Figure 7
Figure 7. Figure 7: Peer ID Anomalies. Monero’s unique peer identifier is randomly generated during the start of a node, keeps static during the runtime, and newly generated again between every reboot. As the ID is not stored or loaded, after a node rebooted and identifies with a new ID, …
Figure 9
Figure 9. Figure 9: Anomaly Overlap Matrix. The matrix presents the overlap of IPs (ASs) showing anomalous behavior in the respective anomaly. Whereas many IPs are often affiliated with just a few ASs, some anomalies show higher AS overlap than IP overlap, suggesting coordinated deploymen…
Figure 10
Figure 10. Figure 10: Proportion of Active Connection Saturation. The graph visualizes the proportion of active connections with peers that have been identified with anomalous behavior. Outgoing and incoming connections show on average around 20.37% and 15.26% are occupied by non-standard …

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Deanonymizing Monero Transactions in Tor Network

    cs.CR 2026-07 conditional novelty 6.0 of 10

    Monero Tor nodes forward originated transactions exclusively through two hidden-service proxy nodes, enabling an attacker who occupies those connections and runs a malicious Tor guard relay to link transactions to sou...

Reference graph

Works this paper leans on

20 extracted references · 1 linked inside Pith · cited by 1 Pith paper

  1. [1]

    Hijacking bitcoin: Routing attacks on cryptocurrencies

    Maria Apostolaki, Aviv Zohar, and Laurent Vanbever. Hijacking bitcoin: Routing attacks on cryptocurrencies. In2017 IEEE symposium on security and privacy (SP), pages 375–392. IEEE, 2017

    2017

  2. [2]

    Katsiaryna Bahamazava and Rohan Nanda. The shift of darknet illegal drug trade preferences in cryptocurrency: The question of traceability and deterrence.Forensic Science International: Digital Investigation, 40:301377, 2022

    2022

  3. [3]

    Trend of cen- tralization in bitcoin’s distributed network

    Alireza Beikverdi and JooSeok Song. Trend of cen- tralization in bitcoin’s distributed network. In2015 IEEE/ACIS 16th International Conference on Software Engineering, Artificial Intelligence, Networking and Par- allel/Distributed Computing (SNPD), pages 1–6, 2015

    2015

  4. [4]

    Deanonymiza- tion and linkability of cryptocurrency transactions based on network analysis

    Alex Biryukov and Sergei Tikhomirov. Deanonymiza- tion and linkability of cryptocurrency transactions based on network analysis. In2019 IEEE European sympo- sium on security and privacy (EuroS&P), pages 172–

  5. [5]

    Exploring the monero peer- to-peer network

    Tong Cao, Jiangshan Yu, Jérémie Decouchant, Xiapu Luo, and Paulo Verissimo. Exploring the monero peer- to-peer network. InFinancial Cryptography and Data Security: 24th International Conference, FC 2020, Kota Kinabalu, Malaysia, February 10–14, 2020 Revised Se- lected Papers 24, pages 578–594. Springer, 2020

    2020

  6. [6]

    Lightweight and identifier-oblivious engine for cryptocurrency network- ing anomaly detection.IEEE Transactions on Depend- able and Secure Computing, 20(2):1302–1318, 2022

    Wenjun Fan, Hsiang-Jen Hong, Jinoh Kim, Simeon Wuthier, Makiya Nakashima, Xiaobo Zhou, Ching- Hua Chow, and Sang-Yoon Chang. Lightweight and identifier-oblivious engine for cryptocurrency network- ing anomaly detection.IEEE Transactions on Depend- able and Secure Computing, 20(2):1302–1318, 2022

    2022

  7. [7]

    Dandelion++: Lightweight cryptocurrency networking with formal anonymity guar- antees.Proc

    Giulia Fanti, Shaileshh Bojja Venkatakrishnan, Surya Bakshi, Bradley Denby, Shruti Bhargava, Andrew Miller, and Pramod Viswanath. Dandelion++: Lightweight cryptocurrency networking with formal anonymity guar- antees.Proc. ACM Meas. Anal. Comput. Syst., 2(2), June 2018

    2018

  8. [8]

    Monero traceabil- ity heuristics: Wallet application bugs and the mordinal- p2pool perspective, 2024

    Nada Hammad and Friedhelm Victor. Monero traceabil- ity heuristics: Wallet application bugs and the mordinal- p2pool perspective, 2024

    2024

Show all 20 references
  1. [9]

    Eclipse attacks on {Bitcoin’s}{peer-to-peer} network

    Ethan Heilman, Alison Kendler, Aviv Zohar, and Sharon Goldberg. Eclipse attacks on {Bitcoin’s}{peer-to-peer} network. In24th USENIX security symposium (USENIX security 15), pages 129–144, 2015

    2015

  2. [10]

    Applicability of intrusion detection sys- tem on ethereum attacks: a comprehensive review.IEEE Access, 10:71632–71655, 2022

    Arkan Hammoodi Hasan Kabla, Mohammed Anbar, Selvakumar Manickam, Taief Alaa Al-Amiedy, Peter- son Bernabe Cruspe, Ahmed K Al-Ani, and Shankar Karuppayah. Applicability of intrusion detection sys- tem on ethereum attacks: a comprehensive review.IEEE Access, 10:71632–71655, 2022

    2022

  3. [11]

    Intrusion detection system: A comprehensive review.Journal of Network and Com- puter Applications, 36(1):16–24, 2013

    Hung-Jen Liao, Chun-Hung Richard Lin, Ying-Chih Lin, and Kuang-Yuan Tung. Intrusion detection system: A comprehensive review.Journal of Network and Com- puter Applications, 36(1):16–24, 2013

    2013

  4. [12]

    An empirical analysis of traceability in the monero blockchain, 2018

    Malte Möser, Kyle Soska, Ethan Heilman, Kevin Lee, Henry Heffan, Shashvat Srivastava, Kyle Hogan, Ja- son Hennessey, Andrew Miller, Arvind Narayanan, and Nicolas Christin. An empirical analysis of traceability in the monero blockchain, 2018. 14

    2018

  5. [13]

    Monero Project. Monero. https:// github.com/monero-project/monero, 2024. offense tracker: src/cryptonote_protocol/ cryptonote_protocol_handler.inl:2792, levin pro- tocol: docs/LEVIN_PROTOCOL.md., peer_id: src/p2p/net_node.inl:143 Accessed: May 06, 2025

    2024

  6. [14]

    A systematic literature review on host-based intrusion detection systems.Ieee Access, 12:27237–27266, 2024

    Hami Satilmi¸ s, Sedat Akleylek, and Zaliha Yüce Tok. A systematic literature review on host-based intrusion detection systems.Ieee Access, 12:27237–27266, 2024

    2024

  7. [15]

    Guide to intrusion detection and prevention systems (idps), 2007-02-20 2007

    Karen Scarfone and Peter Mell. Guide to intrusion detection and prevention systems (idps), 2007-02-20 2007

    2007

  8. [16]

    On the anonymity of peer-to-peer network anonymity schemes used by cryptocurrencies.arXiv preprint arXiv:2201.11860, 2022

    Piyush Kumar Sharma, Devashish Gosain, and Clau- dia Diaz. On the anonymity of peer-to-peer network anonymity schemes used by cryptocurrencies.arXiv preprint arXiv:2201.11860, 2022

    2022 arXiv

  9. [17]

    Deanonymizing transactions origi- nating from monero tor hidden service nodes

    Ruisheng Shi, Yulian Ge, Lina Lan, Zhiyuan Peng, Shen- wen Lin, and Lin Li. Deanonymizing transactions origi- nating from monero tor hidden service nodes. InCom- panion Proceedings of the ACM Web Conference 2024, pages 678–681, 2024

    2024

  10. [18]

    Eclipse attack on men- ero’s peer to peer network

    Ruisheng Shi, Zhiyuan Peng, Lina Lan, Yulian Ge, Peng Liu, Qin Wang, and Juan Wang. Eclipse attack on men- ero’s peer to peer network. InProceedings of Network and Distributed System Security Symposium (NDSS), 2025

    2025

  11. [19]

    Wireshark 4.4.7

    Wireshark Foundation. Wireshark 4.4.7. Network pro- tocol analyzer

  12. [20]

    Förster, Christian Decker, and Stefan Schmid

    Philipp Zabka, Klaus-T. Förster, Christian Decker, and Stefan Schmid. A centrality analysis of the lightning network.Telecommunications Policy, 48(2):102696, 2024. 15

    2024

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.