Blockchain network intrusion detection method based on deep learning

Abstract

A deep learning-based blockchain network intrusion detection method includes a user login and wallet account linking module, a data packet capture processing and detection module, an IP blacklist smart contract operation module, and an IP blacklist list module. The proposed IRLG model is an improvement on the original CNN-LSTM model. Based on the original CNN-LSTM structure, the sequential connection structure of CNN and LSTM is changed to a parallel structure. A merging layer is added to merge the outputs of CNN and LSTM and feed them into a fully connected layer for classification. Further improvements are made to CNN, using the Inception-ResNet structure to replace the original CNN structure. Furthermore, the LSTM is replaced with a sequential connection structure of a two-layer LSTM and a two-layer GRU, which increases the model's network depth and accuracy. IP blacklist data is stored via smart contracts, and the IP blacklist list is stored on-chain. This invention can effectively detect intrusion traffic and enable users around the world to access the IP blacklist list through smart contracts, achieving a good defensive effect.

Description

Technical Field

[0001] The present invention relates to a network intrusion detection method, and more particularly to a blockchain network intrusion detection method based on deep learning, belonging to the field of blockchain network security technology. Background Art

[0002] With the advent of the Web 3.0 concept, new technologies such as the Metaverse, DAOs, and NFTs have been proposed, all of which rely on blockchain technology for their implementation. Blockchain is a decentralized, distributed technology originally used to record transactions. Its decentralization, durability, anonymity, and auditability have led to its rapid development in various fields, expanding its application scenarios from its initial focus on virtual currency transactions to finance, medicine, the Internet of Things, and software engineering. The blockchain system can be broadly summarized as consisting of six components: the data layer, the network layer, the consensus layer, the smart contract layer, the application layer, and the incentive mechanism. The network layer is the source of blockchain decentralization, primarily defining the networking process between blockchain nodes and how data is transmitted between them. Currently, blockchains primarily utilize peer-to-peer (P2P) networks to build their network layer. Upon joining a P2P network, each blockchain node attempts to obtain the address information of other nodes and establish neighbor relationships with multiple nodes. Common public blockchains such as Ethereum, EOS, and Solana utilize consensus mechanisms to verify and confirm transactions. Typical consensus algorithms can be categorized as PoW (proof of work), PoA (proof of authority), and PoS (proof of stake). The DPoS consensus algorithm used by platforms like Solana and Velas divides nodes into regular nodes and trusted nodes. Trusted nodes rotate as master nodes to produce blocks within a fixed timeframe—for example, two seconds in Solana. Therefore, attackers can attack trusted nodes through methods like DDoS attacks, preventing them from producing blocks within the specified timeframe. Therefore, network intrusion detection for blockchain nodes is crucial.

[0003] To combat network intrusions like DoS attacks, machine learning and deep learning technologies have been widely used to monitor network traffic. Traditional machine learning methods are mostly shallow learning approaches, primarily using feature engineering to extract network traffic features and train models. While machine learning has been widely used in network intrusion traffic detection, it relies on feature screening and dimensionality reduction, resulting in poor generalization. In recent years, with the continuous development of artificial intelligence and the improvement of computer computing power, deep learning technology has garnered widespread attention. Deep learning, through the combined application of nonlinear modules, can learn complex structures in high-dimensional data. Therefore, it has the ability to process raw data sets without the need for other algorithms to construct feature processors, and has shown promising results in the field of intrusion detection. Summary of the Invention

[0004] The present invention provides an intrusion detection method based on blockchain and deep learning technology. The method intercepts and packages network data using the CICFlowMeter tool, detects and classifies network data using a deep learning model, and ultimately uploads the IP addresses of detected malicious attackers to the blockchain using Ethereum smart contract technology. This allows all blockchain network users to obtain the IP blacklist stored in the smart contract and configure local firewall configurations to achieve a defensive effect against malicious attackers.

[0005] The technical solution of the present invention is achieved as follows:

[0006] A blockchain network intrusion detection method based on deep learning, characterized by comprising the following steps:

[0007] Step 1: The user first registers or logs in to an account and connects to an Ethereum wallet account. This is a prerequisite for users to use the IP blacklist smart contract. All users need to connect to an Ethereum wallet to use Ethereum functions.

[0008] Step 2: Call the smart contract that has been deployed on the Ethereum blockchain and send a request to the blockchain to obtain the blacklist IP list stored on the chain. After receiving the request, the blockchain node returns the blacklist IP list stored on the chain to the local computer and updates the local firewall software configuration. The IP addresses in the blacklist are added to the deny access list in the firewall configuration to deny access to the blacklisted IP addresses.

[0009] Step 3. Users use smart contract related functions through the smart contract operation module. The contract functions are mainly divided into authorized user management and IP blacklist operations. Administrators can add, delete, and view the authorized user list, add, delete, and view the IP blacklist list; authorized users can add and view the authorized user list, add, delete, and view the IP blacklist list; ordinary users can view the authorized user list, add, delete, and view the IP blacklist list;

[0010] Step 4. Call the CICFlowMeter tool to intercept and package the network traffic data, obtain the network traffic data packet, and process it into 76-dimensional data that meets the model input. Then, after the data is normalized by Min-Max, it is sent to the IRLG model for detection and classification. The IRLG model consists of three modules: Inception-ResNet module, LSTM-GRU module, and MLP module. The IRLG model is improved from the original CNN-LSTM model. First, based on the original CNN-LSTM structure, the sequential connection structure of CNN and LSTM is changed to a parallel structure, and a merging layer is added to merge the outputs of CNN and LSTM and send them to the fully connected layer for classification. After that, it continues to improve on the basis of CNN. In the original Inception-ResNet Based on V1, appropriate adjustments and simplifications were made to meet the needs of the network intrusion detection environment, resulting in the Inception-ResNet module, which replaced the original CNN structure. Furthermore, a LSTM-GRU module was generated using a sequential connection structure of a two-layer LSTM and a two-layer GRU, replacing the original single-layer LSTM network model structure. The addition of a GRU layer resulted in a deeper network and higher accuracy. The Inception-ResNet module extracts spatial features from the data, while the LSTM-GRU module extracts temporal features. Finally, the outputs of the Inception-ResNet and LSTM-GRU modules are combined and fed into an MLP for classification. The model then outputs the classification results and displays them to the user.

[0011] Step 5: The user calls the smart contract to add the newly detected attacker's IP address to the chain to continuously update and improve the blacklist.

[0012] It is also characterized in that the smart contract operation module in step 3 includes the following functions:

[0013] 1. Add the current user address as an authorized user. This is the method used by administrators to add their own wallet account addresses. It is used to upload the first authorized user to the chain after the smart contract is released.

[0014] All users can see it. Therefore, using this method to add authorized users to the chain requires entering the administrator password. The administrator password is directly written into the smart contract and uploaded to the chain when the smart contract is published. Therefore, only the administrator, the publisher of the contract, knows the administrator password and can use this method.

[0015] 2. Add the specified user address as an authorized user. Only authorized users can use it. If the user is an unauthorized user,

[0016] The user's request will be rejected;

[0017] 3. Delete the authorization for the specified user address. This is used to delete the authorization for the specified wallet address account. It is visible to all users, but deleting the specified user address should be done by the administrator. Therefore, it is set to require the administrator password when sending the request.

[0018] 4. View the authorized user address list, which is used to view the authorized users on the current chain. Since it does not involve security issues, all users can request to view the authorized user list;

[0019] 5. Add IP blacklist to authorize users to add newly discovered attacker IP addresses to the chain. By putting the attacker's IP address on the chain, all users around the world can set up firewalls to defend against attacks from these IP addresses, making them available to all users;

[0020] 6. Delete IP blacklist: This is used by administrators to delete specified addresses from the IP blacklist. To prevent this method from being abused by attackers, when a request is received, it will check whether the requesting user is an administrator or an authorized user, so that only administrators and authorized users can delete blacklisted IPs.

[0021] 7. View the IP blacklist, which is used to request to view all blacklisted IPs saved on the chain. Since it does not involve security issues, all users can request to view the IP list.

[0022] Compared with the prior art, the advantages of the present invention are obvious, mainly manifested in:

[0023] 1. The present invention uses a deep learning model algorithm to detect traffic data, which has high accuracy and versatility.

[0024] 2. Blockchain smart contract technology is used to store the IP blacklist on the chain, which is transparent, tamper-proof and highly secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The present invention has the following Figure 2 width.

[0026] Figure 1 This is a flowchart of the blockchain network intrusion detection method based on deep learning of the present invention;

[0027] Figure 2 It is a structural diagram of the IRLG model of the present invention. DETAILED DESCRIPTION

[0028] like Figure 1 、 2 The blockchain network intrusion detection method shown in the figure based on deep learning includes the following steps:

[0029] Step 1: The user first registers or logs in to an account and connects to an Ethereum wallet account. This is a prerequisite for users to use the IP blacklist smart contract. All users need to connect to an Ethereum wallet to use Ethereum functions.

[0030] Step 2: Call the smart contract that has been deployed on the Ethereum blockchain and send a request to the blockchain to obtain the blacklist IP list stored on the chain. After receiving the request, the blockchain node returns the blacklist IP list stored on the chain to the local computer and updates the local firewall software configuration. The IP addresses in the blacklist are added to the deny access list in the firewall configuration to deny access to the blacklisted IP addresses.

[0031] Step 3. Users use smart contract related functions through the smart contract operation module. The contract functions are mainly divided into authorized user management and IP blacklist operations. Administrators can add, delete, and view the authorized user list, add, delete, and view the IP blacklist list; authorized users can add and view the authorized user list, add, delete, and view the IP blacklist list; ordinary users can view the authorized user list, add, delete, and view the IP blacklist list;

[0032] Step 4: Call the CICFlowMeter tool to intercept and package the network traffic data, obtain the network traffic data packets, and process them into 76-dimensional data that meets the model input. Then, after the data is normalized by Min-Max, it is sent to the IRLG model for detection and classification. The IRLG model consists of three modules: Inception-ResNet module, LSTM-GRU module, and MLP module. The IRLG model is improved from the original CNN-LSTM model. First, based on the original CNN-LSTM structure, the CNN and LSTM are sequentially connected.

[0033] The connection structure was changed to a parallel structure, and a merging layer was added to merge the outputs of CNN and LSTM and send them to the fully connected layer for classification. After that, improvements were continued on the basis of CNN. Based on the original Inception-ResNet V1, appropriate adjustments and simplifications were made according to the needs of the network intrusion detection environment to obtain the Inception-ResNet module, and the Inception-ResNet structure replaced the original CNN structure. At the same time, the LSTM-GRU module was generated using the sequential connection structure of the double-layer LSTM and the double-layer GRU to replace the original single-layer LSTM network model structure, and the GRU layer was added to make the network depth of the model deeper and the accuracy higher. Inception-ResNet

[0034] The module extracts the spatial features of the data, and the LSTM-GRU module extracts the temporal features of the data. Finally, the outputs of the Inception-ResNet module and the LSTM-GRU module are combined and sent to the MLP for classification. Finally, the model outputs the classification results and displays them to the user.

[0035] Step 5: The user calls the smart contract to add the newly detected attacker's IP address to the chain to continuously update and improve the blacklist.

[0036] The smart contract operation module in step 3 includes the following functions:

[0037] 1. Add the current user address as an authorized user. This is the method used by administrators to add their own wallet account addresses. It is used to upload the first authorized user to the chain after the smart contract is released.

[0038] All users can see it. Therefore, using this method to add authorized users to the chain requires entering the administrator password. The administrator password is directly written into the smart contract and uploaded to the chain when the smart contract is published. Therefore, only the administrator, the publisher of the contract, knows the administrator password and can use this method.

[0039] 2. Add the specified user address as an authorized user. Only authorized users can use it. If the user is an unauthorized user,

[0040] The user's request will be rejected;

[0041] 3. Delete the authorization for the specified user address. This is used to delete the authorization for the specified wallet address account. It is visible to all users, but deleting the specified user address should be done by the administrator. Therefore, it is set to require the administrator password when sending the request.

[0042] 4. View the authorized user address list, which is used to view the authorized users on the current chain. Since it does not involve security issues, all users can request to view the authorized user list;

[0043] 5. Add IP blacklist to authorize users to add newly discovered attacker IP addresses to the chain. By putting the attacker's IP address on the chain, all users around the world can set up firewalls to defend against attacks from these IP addresses, making them available to all users;

[0044] 6. Delete IP blacklist, which is used by administrators to delete the specified address in the IP blacklist. In order to prevent this method from being abused by attackers, the requesting user will be checked when receiving the request.

[0045] For administrators or authorized users, so that only administrators and authorized users can delete blacklisted IPs;

[0046] 7. View the IP blacklist, which is used to request to view all blacklisted IPs saved on the chain. Since it does not involve security issues, all users can request to view the IP list.

Claims

1. A blockchain network intrusion detection method based on deep learning, characterized in that: The steps include: Step 1: The user first registers or logs in to an account and connects to an Ethereum wallet account. This is a prerequisite for users to use the IP blacklist smart contract. All users need to connect to an Ethereum wallet to use Ethereum functions. Step 2: Call the smart contract that has been deployed on the Ethereum blockchain and send a request to the blockchain to obtain the blacklist IP list stored on the chain. After receiving the request, the blockchain node returns the blacklist IP list stored on the chain to the local computer and updates the local firewall software configuration. The IP addresses in the blacklist are added to the deny access list in the firewall configuration to deny access to the blacklisted IP addresses. Step 3. Users use smart contract related functions through the smart contract operation module. The contract functions are mainly divided into authorized user management and IP blacklist operations. Administrators can add, delete, and view authorized user lists, and add, delete, and view IP blacklists; Authorized users can add and view the authorized user list, add, delete and view the IP blacklist; Ordinary users can view the authorized user list, add and view the IP blacklist list; Step 4. Call the CICFlowMeter tool to intercept and package the network traffic data, obtain the network traffic data packet, and process it into 76-dimensional data that meets the model input. Then, after the data is normalized by Min-Max, it is sent to the IRLG model for detection and classification. The IRLG model consists of three modules: Inception-ResNet module, LSTM-GRU module, and MLP module. The IRLG model is improved from the original CNN-LSTM model. First, based on the original CNN-LSTM structure, the sequential connection structure of CNN and LSTM is changed to a parallel structure, and a merging layer is added to merge the outputs of CNN and LSTM and send them to the fully connected layer for classification. After that, it continues to improve on the basis of CNN. In the original Inception-ResNet Based on V1, appropriate adjustments and simplifications were made to meet the needs of the network intrusion detection environment, resulting in the Inception-ResNet module, which replaced the original CNN structure. Furthermore, a LSTM-GRU module was generated using a sequential connection structure of a two-layer LSTM and a two-layer GRU, replacing the original single-layer LSTM network model structure. The addition of a GRU layer resulted in a deeper network and higher accuracy. The Inception-ResNet module extracts spatial features from the data, while the LSTM-GRU module extracts temporal features. Finally, the outputs of the Inception-ResNet and LSTM-GRU modules are combined and fed into an MLP for classification. The model then outputs the classification results and displays them to the user. Step 5: The user calls the smart contract to add the newly detected attacker's IP address to the chain to continuously update and improve the blacklist.

2. According to the blockchain network intrusion detection method based on deep learning according to claim 1, it is also characterized by The smart contract operation module in step 3 includes the following functions:

1. Add the current user address as an authorized user. This is the method used by administrators to add their own wallet account addresses. It is used to upload the first authorized user to the chain after the smart contract is released. All users can see it. Therefore, using this method to add authorized users to the chain requires entering the administrator password. The administrator password is directly written into the smart contract and uploaded to the chain when the smart contract is published. Therefore, only the administrator, the publisher of the contract, knows the administrator password and can use this method.

2. Add the specified user address as an authorized user. Only authorized users can use it. If the user is an unauthorized user, The user's request will be rejected; 3. Delete the authorization for the specified user address. This is used to delete the authorization for the specified wallet address account. It is visible to all users, but deleting the specified user address should be done by the administrator. Therefore, it is set to require the administrator password when sending the request.

4. View the authorized user address list, which is used to view the authorized users on the current chain. Since it does not involve security issues, all users can request to view the authorized user list; 5. Add IP blacklist to authorize users to add newly discovered attacker IP addresses to the chain. By putting the attacker's IP address on the chain, all users around the world can set up firewalls to defend against attacks from these IP addresses, making them available to all users; 6. Delete IP blacklist: This is used by administrators to delete specified addresses from the IP blacklist. To prevent this method from being abused by attackers, when a request is received, it will check whether the requesting user is an administrator or an authorized user, so that only administrators and authorized users can delete blacklisted IPs.

7. View the IP blacklist, which is used to request to view all blacklisted IPs saved on the chain. Since it does not involve security issues, all users can request to view the IP list.

Images