[tor-dev] Visualization of the lizard Sybil attack

[David Fifield]

Check out these pictures of relays in the consensus during November and
December. (Warning, the linked images are huge, just look at the
downscaled attachments if you want.)

November
https://people.torproject.org/~dcf/graphs/microdescs/microdescs-2014-11.png (720×13242 pixels)

December (spot the anomaly)
https://people.torproject.org/~dcf/graphs/microdescs/microdescs-2014-12.png (744×18136 pixels)

Each row is one descriptor, and each column is one hour. The rows are
sorted so that descriptors with similar uptimes are nearby. The
conspicuous narrow vertical stripe in the lower right of the December
graph is a few thousand descriptors entering the consensus all at once
and then leaving it again.

If you want to dig into any patterns you see, the lines of these text
files correspond 1:1 to the rows of the images.
https://people.torproject.org/~dcf/graphs/microdescs/microdescs-2014-11.txt
https://people.torproject.org/~dcf/graphs/microdescs/microdescs-2014-12.txt

Source code is in https://people.torproject.org/~dcf/graphs/microdescs/.
wget https://collector.torproject.org/archive/relay-descriptors/microdescs/microdescs-2014-{11,12}.tar.xz
tar xJf microdescs-2014-11.tar.xz
tar xJf microdescs-2014-12.tar.xz
./microdescs --output microdescs-2014-11 microdescs-2014-11
./microdescs --output microdescs-2014-12 microdescs-2014-12

David Fifield
-------------- next part --------------
A non-text attachment was scrubbed...
Name: microdescs-2014-11-short.jpg
Type: image/jpeg
Size: 129240 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20150106/64323d20/attachment-0002.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: microdescs-2014-12-short.jpg
Type: image/jpeg
Size: 137007 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20150106/64323d20/attachment-0003.jpg>