Garlic in a Box: I2P Network Emulator

Advertising a 16 MB/s bandwidth class did not raise attackers' measured peak throughput above controls under light testbed load (0.127 ± 0.000 KBps vs 0.210 ± 0.072 KBps, ρ = 0.60), showing that the behavioral lever (earned performance) is ineffective at low traffic volumes and that direct bonus injection is the operative attack component in I2P reputation manipulation.

§5.3, Fig. 11, Fig. 12 evaluation ml-classifiertraffic-shape generic

The paper identifies a statistical anomaly defense against I2P reputation injection: an injected bonus value (e.g., 9999) sits orders of magnitude above any legitimate measured value for the same peer, so a router comparing stored bonus fields against the distribution of its own observed measurements for that peer could flag and discard outlier values while leaving legitimately earned reputations intact.

§8 defense ml-classifier generic

A 50-router I2P deployment spanning five geographic locations stabilizes in approximately 25 minutes and consumes roughly 21 GB RAM (417 MB per router, measured via live systemd cgroups), with a single-host ceiling of approximately 90 routers and a static-profiling estimate (257 MB) that was 62% lower than the live measurement.

§3, §4, Table 2, §7 evaluation measurement-platform generic

Across five independent trials, injecting speedBonus and capacityBonus values of 9999 into I2P peer profiles deterministically promoted adversary nodes into the victim's eligible selection set (Fv) with perfect consistency (σ = 0), and the adversary was chosen for 1.38× more tunnel build requests than matched controls (10.76 ± 0.20 vs 7.80 ± 1.84 lifetime agreed-to tunnels).

§5.3, Table 3 evaluation ml-classifier generic

Selection stage success does not imply delivery stage success: adversary nodes selected 1.38× more often were also rejected 3.45× more often than controls (265.8 ± 21.2 vs 77.0 ± 16.5 lifetime rejections), demonstrating that compromising the selection criterion is a necessary but not sufficient condition for traffic interception.

§5.3, Fig. 10, Fig. 12 evaluation ml-classifier generic