Time will Tell: Large-scale De-anonymization of Hidden I2P Services via Live Behavior Alignment

Time will Tell: Large-scale De-anonymization of Hidden I2P Services via Live Behavior Alignment

Speakers: Hongze Wang

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=4T0cdM6CMT4

Overview

The Invisible Internet Project (I2P) is an anonymous communication network that protects the identity of both clients and servers through multi-layered encryption and tunnel-based routing. Hidden services hosted on I2P are designed to be unreachable by anyone who does not know their destination address, and even those who access a service should not be able to determine the IP address of the hosting router. This talk presents I2Perception, an attack that shatters this anonymity guarantee by exploiting a fundamental side channel: user behavior patterns. Because I2P routers go online and offline as users start and stop their software, the on/off pattern of a hidden service inherently correlates with the on/off pattern of its hosting router. By deploying just 15 floodfill routers to passively collect router information and actively probing target services, the researchers can uniquely identify the IP address of any hidden I2P service within days. The attack was validated on a live I2P deployment, and the I2P project has adopted the researchers' proposed mitigations.

Background

▶ Watch: How I2P achieves anonymity through garlic routing and tunnels (0:30)

I2P operates as a peer-to-peer overlay network where every participant's computer runs as a router. When a user starts the I2P software, their computer becomes a router in the network; when they stop it, the router goes offline. Hidden services are hosted on these routers and are accessible only through I2P's anonymity layers.

Communication in I2P uses garlic routing -- a variant of onion routing with multiple layers of encryption. A hidden client constructs an outbound tunnel through a chain of routers, while the hidden server maintains an inbound tunnel through a separate chain. Messages traverse these tunnels, encrypted at each hop, ensuring that no single router knows both the source and destination of a message.

The network maintains a distributed database called the NetDB, stored on special nodes called floodfill routers. These floodfill routers serve as public directories: other routers periodically upload their router info messages (containing IP addresses and capabilities), and anyone can configure their I2P software to operate as a floodfill router. Hidden services also publish lease sets to floodfill routers, containing the entry points needed to reach the service.

The key insight exploited by this attack is that I2P's anonymity model protects network-layer identity through tunnel-based routing, but does not address the temporal correlation between a service's availability and its hosting router's online status.

Key Findings

▶ Watch: Using floodfill routers to collect router info from the entire network (4:00)

The attack, called I2Perception, achieves de-anonymization through four key technical contributions:

Passive router behavior collection: By deploying just 15 floodfill routers, the researchers passively receive router info publications from the entire I2P network. These publications occur at regular intervals, enabling reconstruction of each router's online/offline pattern. The small number of floodfill routers means not all publications are captured, but a data recovery mechanism compensates for missing messages.

Fine-grained session boundary detection: Beyond the coarse on/off inference from periodic router info messages, the researchers identified special join and leave messages within the router info publication protocol. When a router comes online, it sends a distinctive router info message; before going offline, it sends another. By analyzing the timing characteristics that distinguish these messages from routine publications, the attack achieves precise session boundary detection.

Data recovery for missing messages: With only 15 floodfill routers in a large peer-to-peer network, some router info publications are inevitably missed. The researchers designed a session complement mechanism: if the gap between two observed online sessions is a multiple of the routine publication interval, it likely represents missed messages rather than a genuine offline period. These gaps are bridged to reconstruct more accurate on/off patterns.

Service probing and correlation: The hidden service's on/off pattern is obtained by periodically probing it through I2P's lease set mechanism. The service's availability pattern is then correlated against all known router on/off patterns. A match uniquely identifies the hosting router -- and since router info includes IP addresses, this reveals the service's real-world location.

Technical Deep Dive

▶ Watch: Join and leave message detection for precise session boundaries (9:30)

The attack exploits the I2P router info publication protocol in detail. Routers periodically upload router info messages to floodfill routers at a regular interval. This interval is deterministic, allowing the researchers to distinguish between routine publications, join events, and leave events based on timing analysis.

Join detection works by identifying router info messages that arrive significantly earlier than expected based on the routine publication interval. When a router first comes online, it immediately publishes its router info, creating a timing anomaly relative to the expected schedule. Leave detection exploits the fact that I2P routers send a final router info message before shutting down, which can be identified by its proximity to a subsequent gap in publications.

The session complement mechanism addresses the fundamental limitation of using only 15 floodfill routers in a network with thousands of nodes. Because I2P's peer-to-peer propagation is somewhat random, a small set of floodfill routers will miss some publications. The key insight is that if the gap between two consecutive observed router info messages is approximately a multiple of the publication interval, the missing messages likely represent a continuous online session with some publications lost in propagation, not a genuine offline period. By complementing these gaps, the researchers reconstruct online sessions more accurately.

For service probing, the attacker uses the hidden service's published lease set (available from floodfill routers) to determine the entry points for the service's inbound tunnel. The attacker then periodically sends messages to the service via these entry points and records whether responses are received, constructing the service's on/off pattern.

The correlation step aligns the service's on/off pattern against all router on/off patterns. The evaluation demonstrated that most I2P routers have unique on/off patterns -- the vast majority have a uniqueness score of one, meaning their temporal behavior is distinguishable from all other routers. This high uniqueness makes correlation-based de-anonymization highly effective.

Demo / Proof of Concept

▶ Watch: Service probing via lease sets to determine availability patterns (11:30)

The evaluation deployed 15 floodfill routers and 10 host routers running hidden services across seven scenarios. Scenarios S1 through S4 emulated services with frequent on/off patterns, while S5 through S7 tested long-lived routers. Results showed that the anonymous set (the number of candidate routers matching a service's pattern) decreases rapidly over time. For scenario S1, the anonymous set dropped to 5 within the first day -- and these 5 corresponded to 5 intentionally identical services the researchers had set up. A single unique service could be uniquely identified with no ambiguity. The analysis of all routers on the live I2P network confirmed that the vast majority have unique on/off patterns, validating the attack's applicability beyond the controlled test environment. The I2P project has acknowledged the findings and adopted the proposed mitigation strategies, which focus on randomizing timing information used in router info publications.

Defensive Implications

▶ Watch: Follow-up work targeting Tor hidden service de-anonymization (15:30)

This research has immediate implications for anyone relying on I2P for anonymity. The fundamental vulnerability is a side channel inherent in user behavior: as long as a hidden service's availability correlates with its hosting router's online status, temporal analysis can de-anonymize it. This is not a protocol implementation bug -- it is a design-level property of how I2P routers and services share lifecycle.

For I2P users hosting hidden services, the most effective mitigation is to run the hosting router continuously (24/7), eliminating the on/off pattern that enables correlation. However, this may not be practical for all users, particularly those running services on personal devices.

For the I2P project, the researchers proposed timing randomization mechanisms to obscure the relationship between router info publications and actual online/offline transitions. The project has adopted these recommendations, though the effectiveness of the randomization against a well-resourced attacker remains to be validated.

For the broader anonymity research community, this work demonstrates that behavioral side channels -- user-controlled actions like turning software on and off -- can be as powerful as traffic analysis or protocol-level attacks for de-anonymization. The researchers note they have a follow-up paper targeting Tor hidden service de-anonymization using similar techniques, suggesting this class of attack has broad applicability across anonymity networks.

For law enforcement and intelligence, this technique provides a passive, low-footprint method for identifying hidden service operators. Deploying 15 floodfill routers is trivial and does not require any active interference with the network, making it difficult for targets to detect.

Key Takeaways

• I2P hidden services can be uniquely de-anonymized by correlating their on/off patterns with router on/off patterns
• Only 15 floodfill routers are needed to passively collect sufficient router behavior data from the entire I2P network
• Join and leave messages in the router info protocol enable precise session boundary detection
• A data recovery mechanism compensates for missing router info publications due to limited floodfill coverage
• Most I2P routers have unique on/off behavioral fingerprints, making correlation-based identification highly effective
• The I2P project has adopted the proposed timing randomization mitigations
• The same behavioral side channel approach is being extended to Tor hidden services

About the Speaker(s)

Hongze Wang is associated with Southeastern University. The presenting speaker, Shan Fu, is a professor at Loughborough University. The research is a collaborative effort with Southeastern University and Fuhua University of Science and Technology. The team has expertise in anonymous communication network analysis and has follow-up work targeting Tor hidden service de-anonymization using similar behavioral alignment techniques.