Decision Tree Based Inference of Lightning Network Client Implementations

The Lightning Network (LN) is a second layer payment protocol on top of Bitcoin. It creates a peer-to-peer (P2P) network of payment channels that enable instant payments. The LN can be accessed through different implementations or clients, the most popular being Lightning Network Daemon (LND), Core Lightning Network (CLN), and Eclair. The first step in many known attacks to the LN is to infer the software client the node is running. This paper presents two classification models based on decision trees to infer the implementation of LN clients from either the traffic of the gossip protocol or the announced BOLT #9 features, offering a cost-free means of identification. The accuracy presented by both models in our experiments is high, ranging from 87% to 100% depending on the model and the environment where it is deployed. The application of our inference models on the LN shows a prevalence of LND clients.