Ethereum behavior traffic fine classification method

Abstract

The invention discloses an Ethereum behavior traffic fine classification method. The method comprises two stages of Ethereum behavior traffic segmentation and Ethereum behavior traffic classification. In the Ethereum behavior traffic segmentation stage, the Ethereum behavior traffic segmentation position is determined by identifying the Ethereum RLPx frame header message position and judging the Ethereum behavior traffic Burst range, and the segmentation of the behavior traffic in the single Ethereum TCP stream is realized. In the Ethereum behavior traffic classification stage, firstly, a plurality of similar Get type behaviors are combined, rough classification is performed by using a machine learning method, and the accurate category of the Get type behaviors is further judged by using the relevance relation between the Get type behaviors and the corresponding Send type behaviors according to a rough classification result, so that fine classification of Ethereum behavior traffic is realized.

Description

technical field [0001] The invention belongs to the technical field of cyberspace security, and relates to a refined classification method for Ethereum behavior traffic. Background technique [0002] With the frequent occurrence of blockchain security incidents in recent years, the security situation of blockchain networks has become increasingly severe, and the demand for blockchain traffic measurement and analysis methods has become increasingly urgent. Compared with Bitcoin, Ethereum's support for smart contracts makes Ethereum have higher application prospects, and Ethereum traffic has higher research value. The classification of Ethereum behavioral traffic contained in Ethereum traffic is the basis for further analysis and supervision of Ethereum traffic. However, there is still a lack of an effective classification method for Ethereum behavior traffic in the industry at present. In response to this demand, the present invention further studies the behavior classificat...

AI Technical Summary

Problems solved by technology

In addition, the behaviors will be serialized, framed and encrypted before transmission. The similarity of the data structure and the serialization and encryption processing make these four kinds of Get behavior traffic show the same in both the data packet payload and the flow statistical characteristics. The extremely high similarity makes it difficult for traditional traffic classification methods to accurately distinguish these four types of traffic. It is necessary to design a new identification method for traffic with similar behaviors.

Get behavior data will obtain corresponding Send behavior data from peer nodes, such as image 3 As shown, the different attributes of the data structure of the Send behavior are different. Although the available information in the data packet payload will be hidden after encryption, the Send behavior traffic can be distinguished from the behavior traffic statistics characteristics, and further can be passed through the Send The behavior determines the exact category of the corresponding Get behavior. However, there is no research on the classification of Ethereum behavior traffic through this method.

Images