Device, equipment and method for node of block chain network and non-transient machine readable storage medium

Abstract

Apparatuses, devices, methods, and non-transitory machine-readable storage media for nodes of a blockchain network are described herein. Various examples of the present invention relate to apparatuses, devices, methods, and non-transitory machine-readable storage media for nodes of a blockchain network. The apparatus includes interface circuitry, machine-readable instructions, and processor circuitry to execute the machine-readable instructions to compare a traffic pattern of a request associated with one or more smart contracts hosted by a node of a blockchain network to a reference traffic pattern, an estimated denial of service for at least one of the one or more smart contracts is determined based on a comparison between the traffic pattern and a reference traffic pattern, one or more potential mitigation measures are determined for the estimated denial of service, and at least one of the one or more potential mitigation measures is applied.

Description

Background Art

[0001] The term Web3 refers to the architecture of the third generation of the Internet, a decentralized, open source, blockchain-based version of the web that enables peer-to-peer interactions without the need for middleware. Web3 aims to create a more secure, transparent and decentralized Internet where users can fully own and control their data without the need for centralized institutions or third-party platforms. Web3 is based on a variety of technologies such as blockchain networks, smart contracts and decentralized applications (dApps).

[0002] Detecting coordinated and distributed attacks (e.g., Distributed Denial of Service - DDoS) in heterogeneous Web3 environments like edge computing is challenging because requests may come from multiple sources (and may therefore not be detected as a denial of service). This is a challenge in distributed systems that provide edge services. Such services can be based on rules that govern service provision, responsibility, and scope through service level agreements (SLAs). System components can share and coordinate with each other, forming communication economies.

[0003] Many popular blockchain networks partially address the challenge of DDoS attacks by requesting transaction fees (e.g., gas in some networks). However, this approach may not be sufficient to handle denial of service attacks. Furthermore, this challenge may not be addressed in layer 2 networks (which are not well protected since they require mechanisms such as custom consensus mechanisms) or private blockchain networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Some examples of apparatus and / or methods will be described below by way of example only and with reference to the accompanying drawings, in which:

[0005] Figure 1a A schematic diagram showing an example of an apparatus or device for a node of a blockchain network, and a schematic diagram showing an example of a node including such an apparatus or device;

[0006] Figure 1b A flow chart illustrating an example of a method for a node of a blockchain network;

[0007] Figure 2 a schematic diagram showing an example of the proposed architecture; and

[0008] Figure 3 A schematic diagram showing the flow of operations. DETAILED DESCRIPTION

[0009] Some examples are now described in more detail with reference to the accompanying drawings. However, other possible examples are not limited to the features of these embodiments described in detail. Other examples may include modifications of features and equivalents and substitutes of features. In addition, the terms used to describe certain examples herein should not limit other possible examples.

[0010] Throughout the description of the drawings, the same or similar reference numerals refer to the same or similar elements and / or features, which may be the same or implemented in a modified form while providing the same or similar functions. For clarity, the thickness of lines, layers and / or regions in the drawings may also be exaggerated.

[0011] When two elements A and B are combined using "or", this is to be understood as disclosing all possible combinations, i.e., only A, only B, and A and B, unless otherwise explicitly defined in individual cases. As an alternative wording for the same combination, "at least one of A and B" or "A and / or B" may be used. This applies equally to combinations of more than two elements.

[0012] If singular forms such as "a / an" and "the" are used and the use of only a single element is neither explicitly nor implicitly defined as mandatory, further examples may also use several elements to achieve the same function. If a function is described below as being implemented using multiple elements, further examples may use a single element or a single processing entity to achieve the same function. It is further understood that when the term "include", "including", "comprise" and / or "comprising" is used, it describes the presence of specified features, integers, steps, operations, processes, elements, components and / or groups thereof, but does not exclude the presence or addition of one or more other features, integers, steps, operations, processes, elements, components and / or groups thereof.

[0013] In the following description, specific details are set forth, but examples of the techniques described herein may be implemented without these specific details. Well-known circuits, structures, and techniques are not shown in detail to avoid obscuring the understanding of this description. "An example / example", "various examples / examples", "some examples / examples", etc. may include features, structures, or characteristics, but not every example necessarily includes these specific features, structures, or characteristics.

[0014] Some examples may have some or all of the features described for other examples, or none of them at all. "First," "second," "third," and the like describe common elements and indicate different instances of similar elements being referenced. Such adjectives do not imply that the elements so described must be in a given order in time or space, in ranking, or in any other way. "Connected" may indicate that elements are in direct physical or electrical contact with each other, and "coupled" may indicate that elements cooperate or interact with each other, but these elements may or may not be in direct physical or electrical contact.

[0015] As used herein, the terms "operate," "execute," or "run" are used interchangeably when referring to software or firmware associated with a system, device, platform, or resource, and may refer to software or firmware stored in one or more computer-readable storage media accessible by a system, device, platform, or resource, even if the instructions contained in the software or firmware are not being actively executed by the system, device, platform, or resource.

[0016] The specification may use the phrases "in an example / example", "in various examples", "in some examples / examples", and / or "in various examples / examples", each of which may refer to one or more of the same or different examples. In addition, the terms "comprising", "including", "having", etc. as used with respect to the examples of the present disclosure are synonymous.

[0017] Figure 1a A schematic diagram of an example of an apparatus 10 or device 10 for a node 100 (e.g., 100-1, 100-2, ..., 100-N) of a blockchain network 1000 is shown. The apparatus 10 includes a circuit system for providing the functions of the apparatus 10. For example, the circuit system of the apparatus 10 may be configured to provide the functions of the apparatus 10. For example, Figure 1aThe device 10 includes an interface circuit system 12, a processor circuit system 14, and (optionally) a memory / storage circuit system 16. For example, the processor circuit system 14 may be coupled to the interface circuit system 12 and to the memory / storage circuit system 16. For example, the processor circuit system 14 may be combined with the interface circuit system 12 (for communicating with other nodes of the blockchain network or other components of the node 100 including the device 10) and the memory / storage circuit system 16 (for storing information, such as machine-readable instructions) to provide the functionality of the device. Similarly, the device 10 may include a device for providing the functionality of the device 10. For example, the device may be configured to provide the functionality of the device 10. The components of the device 10 are defined as component devices that may correspond to corresponding structural components of the device 10 or be implemented by corresponding structural components of the device 10. For example, Figure 1b The device 10 includes: a means 14 for processing, which may correspond to the processor circuit system 14 or be implemented by the processor circuit system 14; a means 12 for communicating, which may correspond to the interface circuit system 12 or be implemented by the interface circuit system 12; and (optionally) a means 16 for storing information, which may correspond to the memory or storage circuit system 16 or be implemented by the memory or storage circuit system 16. In general, the functions of the processor circuit system 14 or the means for processing 14 can be implemented by the processor circuit system 14 or the means for processing 14 executing machine-readable instructions. Therefore, any features attributed to the processor circuit system 14 or the means for processing 14 can be defined by one or more instructions of a plurality of machine-readable instructions. The device 10 or apparatus 10 may include machine-readable instructions (e.g., within the memory or storage circuit system 16 or the means for storing information 16).

[0018] The processor circuit system 14 or the device for processing 14 is used to compare the traffic pattern of requests associated with one or more smart contracts hosted by the nodes of the blockchain network with the reference traffic pattern. The processor circuit system 14 or the device for processing 14 is used to determine the estimated denial of service of at least one of the one or more smart contracts based on the comparison between the traffic pattern and the reference traffic pattern. The processor circuit system 14 or the device for processing 14 is used to determine one or more potential mitigation measures for the estimated denial of service based on a set of mitigation measures (mitigation) jointly maintained by the nodes of the blockchain network. The processor circuit system 14 or the device for processing 14 is used to apply at least one of the one or more potential mitigation measures.

[0019] Figure 1aAlso shown is at least one node 100-1 (100-2, . . . , 100-N) including an apparatus 10 or device 10. For example, the node 100-1 may be a computer system, such as a computer system configured to participate in the blockchain network 1000. Figure 1a Also shown is a system including a plurality of nodes 100 - 1 , . . . , 100 -N of a blockchain network 1000 .

[0020] Figure 1b A node for a blockchain network (e.g., Figure 1a 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 110, 111, 112, 113, 114

[0021] In the following, further details about the apparatus 10, devices 10, nodes 100 (100-1, ..., 100-N), methods and corresponding computer programs will be introduced with reference to the apparatus 10 and the node 100. Features introduced with reference to the apparatus 10 and / or the node 100 may also be included in the corresponding apparatus 10, methods and computer programs.

[0022] Various examples of the present disclosure relate to mitigation measures for denial of service (DoS) attacks, particularly distributed denial of service (DDoS) attacks against smart contracts hosted on blockchain networks. A smart contract is an automatically executed contract encoded on a blockchain platform such as Ethereum. In essence, it is a computer program stored on a blockchain and executed by the nodes of the blockchain hosting the smart contract, and can be used via an application programming interface (API). In many cases, a smart contract is a program that automatically executes the rules and regulations of an agreement between two parties according to the terms of the contract. Smart contracts are designed to be secure, transparent, and immutable, meaning that they cannot be tampered with after deployment. They are often used to facilitate the exchange of digital assets such as cryptocurrencies, or to regulate the transfer of ownership of physical assets.

[0023] However, because smart contracts are computer programs that are publicly accessible via their APIs, they present a potential attack surface for attackers (e.g., attackers who want to compromise a node of a blockchain network). For example, by repeatedly calling functions via a smart contract's API, a computational load is generated on the node executing the smart contract, which may hinder other workloads of the node and may even cause the node to fall behind other nodes of the distributed ledger implemented by the blockchain. Furthermore, in extreme cases, a high workload may crash the node or the smart contract, resulting in memory corruption, thereby providing another attack surface. Therefore, for nodes of a blockchain network, denial of service attacks run by attackers seeking to compromise the node may be a concern.

[0024] However, blockchains are often used to host a wide variety of smart contracts, whose behavior is often unknown. While the vast majority of smart contracts (e.g., smart contracts regarding the transfer of digital asset ownership) are created from popular templates, it cannot be assumed that all smart contracts hosted on a blockchain are known or derived from these templates. As a result, mitigation of DoS (e.g., DDoS) attacks is more difficult than, for example, a web server that hosts only one type of service with known properties.

[0025] In the present disclosure, the mitigation of DoS attacks revolves around the traffic pattern of a single smart contract. In the proposed concept, the traffic pattern of requests associated with one or more smart contracts hosted by a node of a blockchain network is compared with a reference traffic pattern. The traffic pattern involves the traffic associated with at least one smart contract-for example, incoming traffic and outgoing traffic (because calling the API of a smart contract may cause the smart contract to make an outgoing request to another web server or smart contract). Therefore, the traffic pattern (and the reference traffic pattern) can involve at least one of the incoming request and the outgoing request (for example, if it is a smart contract, the incoming request obtained via the API, and the outgoing request / response issued by the smart contract). For example, the traffic pattern can be an abstraction of the traffic, and can represent, for example, multiple overall requests, multiple incoming requests, multiple incoming requests for each API endpoint, multiple outgoing requests, and one or more items in the time pattern of the request (for example, requests transmitted at regular or random intervals vs. requests transmitted at one time).

[0026] To establish a baseline, each node may monitor the "normal" traffic of the corresponding smart contract. For example, the reference traffic pattern may be a reference traffic pattern determined locally at the node. This may be accomplished by monitoring the incoming and / or outgoing traffic of at least one smart contract over time and determining a reference pattern based on the monitored traffic. In other words, the processor circuitry may monitor requests associated with one or more smart contracts and determine a reference traffic pattern based on the monitored requests. Thus, if Figure 1b As further shown in , the method may include monitoring 110 requests associated with one or more smart contracts and determining 120 a reference traffic pattern based on the monitored requests. Monitoring of incoming requests may be accomplished by using a reverse proxy placed between the requester and at least one smart contract, and monitoring of outgoing requests may be accomplished by using a proxy placed between the smart contract and any other entity to which the request is transmitted. Alternatively, packet sniffing may be used to monitor requests, or a framework for hosting smart contracts may log the activity of smart contracts, which may also be used to monitor requests. Finally, in some cases, all requests may be logged via a blockchain, which may also be used to monitor requests.

[0027] In addition, or as an alternative to using monitoring of requests to determine a reference traffic pattern, monitoring of requests can also be used as a precursor to comparing a traffic pattern to a reference traffic pattern, for example, by first determining the traffic pattern based on the monitored requests and then comparing the traffic pattern to the reference traffic pattern.

[0028] In some cases, in addition to or in lieu of the local determination of the reference traffic pattern, the reference traffic pattern may be a reference traffic pattern commonly maintained by nodes of the blockchain network. For example, the processing circuit system may provide the locally determined reference traffic pattern of the smart contract to other nodes via, for example, the blockchain, or the processing circuit system may use monitoring of requests to adjust the commonly maintained reference traffic pattern and provide the adjusted reference traffic pattern to other nodes via the blockchain.

[0029] In the proposed concept, the traffic pattern is compared with / with a reference traffic pattern. This can be done by using a traffic pattern evaluation mechanism. In other words, the comparison between the traffic pattern and the reference traffic pattern can be performed by using a traffic pattern evaluation mechanism. The traffic pattern evaluation mechanism can be jointly maintained by the nodes of the blockchain network.

[0030] In simple implementation, the traffic pattern evaluation mechanism can be based on one or more threshold values, for example, defines one or more threshold values ​​of the maximum allowed difference between the traffic pattern of reference traffic pattern and the traffic pattern compared with the reference traffic pattern.For example, the traffic pattern evaluation mechanism can be each project definition threshold value for (reference) traffic pattern.If violated the threshold value of at least a predetermined number of projects, then can determine that denial of service.

[0031] In another implementation, the traffic pattern evaluation mechanism can be based on machine learning. For example, the traffic pattern evaluation mechanism can be implemented by a machine learning model, such as a classification machine learning model that outputs a classification ("denial of service", "no denial of service" or "denial of service", "no denial of service", "uncertain"), or a regression machine learning model that outputs a numerical value representing the likelihood of a denial of service attack occurring (e.g., a 0.12 likelihood of the current traffic pattern indicating a denial of service attack).

[0032] During the operation of a smart contract, usage spikes often occur, which may be malicious, i.e., denial of service, or just random spikes. These random spikes are difficult to distinguish from denial of service attacks, and may require learning methods to handle them by continuously improving the traffic pattern evaluation mechanism. In other words, the processor circuit system can adjust the traffic pattern evaluation mechanism over time based on multiple comparisons between the traffic pattern at multiple time points and the reference traffic pattern. Therefore, if Figure 1b As further shown in , the method may include adjusting 140 traffic pattern evaluation mechanisms over time based on multiple comparisons between the traffic pattern and the reference traffic pattern at multiple time points. This can be accomplished based on the determination of the estimated denial of service. Usually, the denial of service can affect the performance of the node. Even if it is determined that the traffic pattern is a denial of service according to the traffic pattern evaluation mechanism, if the performance impact produced by the traffic pattern is low enough or can be ignored (for example, if the service level agreement SLA of the node is not violated), then the traffic pattern can be considered to be not an indication of denial of service in turn. Therefore, the previous comparison (in multiple comparisons between the traffic pattern and the reference traffic pattern at multiple time points) can be re-examined, and is used for, for example, by retraining the machine learning model or by adjusting one or more thresholds to adjust the traffic pattern evaluation mechanism.

[0033] As described above, in some implementations, the traffic pattern evaluation mechanism may be based on a machine learning model, such as a classifier. If the traffic pattern evaluation mechanism is adjusted, this is accomplished by retraining the machine learning model. In other words, the processor circuit system may adjust the traffic pattern evaluation mechanism by training the machine learning model used by the traffic pattern evaluation mechanism. Thus, if Figure 1bAs further shown in , the method may include adjusting 140 the traffic pattern evaluation mechanism by training 142 a machine learning model used by the traffic pattern evaluation mechanism.

[0034] In order to illustrate the use of machine learning models and the training of machine learning models as part of the traffic pattern evaluation mechanism, a brief introduction to machine learning is given. Machine learning refers to algorithms and statistical models that computer systems can use to perform specific tasks without explicit instructions but relying on models and inferences. For example, in machine learning, data transformations inferred from analysis of historical and / or training data can be used instead of rule-based data transformations. For example, the content of an image can be analyzed using a machine learning model or a machine learning algorithm. In order for a machine learning model to analyze the content of an image, the machine learning model can be trained using training images as input and training content information as output. By training the machine learning model using a large number of training images and associated training content information, the machine learning model "learns" to recognize the content of the image, so the machine learning model can be used to recognize image content that is not contained in the training image. The same principle can also be used for other types of sensor data: by training a machine learning model using training sensor data and expected outputs, the machine learning model "learns" the transformation between sensor data and output, which can be used to provide output based on non-training sensor data provided to the machine learning model.

[0035] The machine learning model is trained using training input data. The example specified above uses a training method called "supervised learning". In supervised learning, the machine learning model is trained using multiple training samples, each of which may include multiple input data values ​​and multiple expected output values, that is, each training sample is associated with an expected output value. By specifying both the training samples and the expected output values, the machine learning model "learns" the output values ​​to be provided based on input samples similar to the samples provided during training. In addition to supervised learning, semi-supervised learning can also be used. In semi-supervised learning, some of the training samples lack corresponding expected output values. Supervised learning can be based on supervised learning algorithms, such as classification algorithms, regression algorithms, or similarity learning algorithms. When the output is restricted to a limited set of values, that is, the input is classified into a value in a limited set of values, a classification algorithm can be used. When the output can have any numerical value (within a range), a regression algorithm can be used. Similarity learning algorithms are similar to both classification algorithms and regression algorithms, but are based on learning from examples using a similarity function that measures the similarity or correlation between two objects.

[0036] In the present case, the machine learning model used as part of the traffic pattern evaluation mechanism can be implemented as a classifier or a regressor, that is, a classification of the output traffic pattern ("denial of service", "no denial of service" or "denial of service", "no denial of service", "uncertain") or a numerical value indicating the possibility of denial of service occurring. Both types of machine learning models are trained using supervised learning. As described above, in supervised learning, the machine learning model is trained in the following manner, namely: defining training input samples (i.e., traffic patterns, and optional reference traffic patterns) and expected outputs (e.g., classification results, or traffic patterns indicating the possibility of denial of service) and adjusting the machine learning model so that the machine learning model learns to provide a transformation between the training input samples and the expected output. In some examples, a reference traffic pattern is used as an additional input, or a reference traffic pattern can be implicitly included in the machine learning model, and the machine learning model represents the reference traffic pattern.

[0037] In various examples, other nodes may also benefit from adjustments to the traffic pattern evaluation mechanism. Thus, the adjusted traffic pattern evaluation mechanism may be shared with other nodes of the blockchain network. Where the traffic pattern evaluation mechanism is based on a threshold, the updated threshold may be shared with other nodes. Where the traffic pattern evaluation mechanism is based on a machine learning model, adjustments to the machine learning model may be shared using a technique known as federated learning (or similar techniques). In other words, the processor circuit system may use federated learning to propagate the training of the machine learning model to one or more further nodes of the blockchain network. Thus, if Figure 1b As further shown in , the method may include propagating 144 the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

[0038] Federated learning is a machine learning technique that involves training models on decentralized data sources without exchanging the data itself. Instead of sending data to a central server, the data is kept on the corresponding devices, i.e., the nodes of the blockchain model. The model is sent to the node, where it is trained based on the node's data, and the updated model parameters are sent back to the central server, or in the current case, shared via the blockchain. This process occurs on multiple devices, allowing the model to learn from a different set of user experiences. Before training the machine learning model, the latest version can be obtained from the central server, or in this case, from the blockchain, and trained at the corresponding node using the new data.

[0039] The processor circuit system determines an estimated denial of service for at least one of the one or more smart contracts based on a comparison between the traffic pattern and a reference traffic pattern (e.g., based on a traffic pattern evaluation mechanism). Information about the denial of service attack can then be shared with other nodes so that, for example, the nodes can also apply mitigation measures. In other words, the processor circuit system can provide information about the estimated denial of service to at least one other node of the blockchain network. Thus, if Figure 1b As further shown in , the method may include providing 152 , 156 information about the estimated denial of service to at least one other node of the blockchain network.

[0040] In some cases, it may be possible to pinpoint the mechanism behind a denial of service attack. For example, if a smart contract exhibits erroneous behavior that results in a large use of computing resources for manipulative or meaningless requests, or if a smart contract can be used to amplify an attack (e.g., by causing a large number of outgoing requests for each incoming request), that behavior may be detected based on traffic patterns and / or by determining the performance impact of the traffic patterns. Such information may be used to conclude that the smart contract is potentially vulnerable, which may be shared with other nodes. For example, a processor circuit system may identify a potential vulnerability associated with an estimated denial of service (e.g., based on traffic patterns and / or the performance impact of traffic patterns) and provide information about the potential vulnerability to at least one other node of the blockchain network. Thus, if Figure 1b As further shown in , the method may include identifying 154 a potential vulnerability associated with the estimated denial of service and providing 156 information about the potential vulnerability to at least one other node of the blockchain network.

[0041] After determining the occurrence of a denial of service attack, the node seeks to mitigate the attack. To this end, the node selects one or more potential mitigation measures for the estimated denial of service, such as a set of mitigation measures jointly maintained by the nodes of the blockchain network. For example, mitigation measures may include blocking incoming requests to a specific API endpoint, blocking incoming requests to a specific host, Internet Protocol address, or Internet Protocol address range, delaying or throttling requests to a specific API endpoint, delaying or limiting incoming requests to a specific host, Internet Protocol address, or Internet Protocol address range, etc. The set of mitigation measures can be stored in a database hosted on the blockchain. For example, the processor circuit system can select one or more potential mitigation measures based on a smart contract (e.g., based on a known template of a smart contract or the identity of a smart contract) and / or based on a traffic pattern. For example, the processor circuit system can query a database based on a smart contract and / or based on a traffic pattern. More generally, a mitigation selection mechanism can be used to perform the selection of one or more potential mitigation measures, which can be based on a smart contract and / or based on a traffic pattern. Similar to the traffic pattern evaluation mechanism, the mechanism can be jointly maintained by the nodes of the blockchain network. In other words, the mitigation selection mechanism may be jointly maintained by the nodes of the blockchain network. Furthermore, not only the selection mechanism, but also the actual mitigation measures are jointly maintained by the nodes of the blockchain network. To avoid manipulation, a consensus mechanism may be used to maintain this jointly maintained set so that a single node does not manipulate the set in a way that exposes other nodes to a denial of service attack. In other words, the processor circuit system may determine one or more potential mitigations based on a set of mitigations jointly maintained by the nodes of the blockchain network using a consensus-based management scheme.

[0042] At least one of the one or more mitigation measures is then applied by the node. In some cases, if the mitigation measure is appropriate to remediate the denial of service attack, then applying one of the mitigation measures may be sufficient. However, in many cases, the node may have to try different mitigation measures or change one of the determined mitigation measures until the denial of service attack is remedied. In order to determine whether the mitigation measures are effective, the efficacy of the mitigation measures can be measured and used to improve the selection process. In other words, the processor circuit system can determine the efficacy of at least one applied mitigation measure (e.g., based on changes in performance, traffic patterns, and / or capabilities of the node to achieve the SLA). Thus, if Figure 1bAs further shown in , the method may include determining 180 the efficacy of at least one applied mitigation measure. In order to improve the selection of mitigation measures across all nodes of the blockchain network, data obtained by determining the efficacy may be shared with other nodes so that other nodes can adjust their mitigation measures selection accordingly. In other words, the processor circuit system may provide information about the efficacy of at least one potential mitigation measure to at least one other node of the blockchain network. Thus, as Figure 1b As further shown in , the method may include providing 182 information about the efficacy of at least one potential mitigation measure to at least one other node of the blockchain network. The information about the efficacy may indicate whether the mitigation measure in the set of mitigation measures was successful in containing / remediating the ongoing denial of service attack. Additionally or alternatively, if the node has changed the mitigation measure, the information about the efficacy may indicate the change in the mitigation measure in the set of mitigation measures that successfully contained / remediated the ongoing denial of service attack.

[0043] The determined efficacy may be used locally at the node for a variety of purposes. For example, determining efficacy may be used to determine whether the mitigation currently being applied is successful in containing / remediating an ongoing denial of service attack, and to determine if another mitigation is to be applied or if the mitigation currently being applied is to be changed if it is not successful. Additionally or alternatively, the determined efficacy may be used to improve the selection process. For example, the processor circuitry may adjust the mitigation selection mechanism over time based on the determined efficacy. Thus, if Figure 1b As further shown in , the method may include adjusting 190 the mitigation selection mechanism over time based on the determined efficacy. This may include providing additional information to the database to indicate that a particular mitigation (or variant thereof) has been successful or unsuccessful in containing / remediating a particular denial of service attack. Additionally or alternatively, in some cases, for example, if the mitigation selection mechanism is based on a machine learning model for selecting one or more mitigations, the machine learning model may be retrained to adjust the mitigation selection mechanism.

[0044] As described above, the mitigation selection mechanism selects mitigations based on available information (e.g., the traffic patterns and smart contracts involved). Thus, when traffic patterns (and optionally identifiers or attributes of smart contracts) are input into a machine learning model, the machine learning model can be trained to output a selection of one or more mitigations (or variations of one of the mitigations). This selection can be implemented as a classifier or regressor that is trained to output, for each mitigation in a set of mitigations, whether the mitigation is likely to successfully contain or remedy a denial of service attack. Similar to the above example, in this case, supervised learning can be used to train the machine learning model, while traffic patterns (and optionally identifiers or attributes of smart contracts) are used as training inputs, and classifications or numerical values ​​representing the applicability of the corresponding mitigation are used as desired outputs.

[0045] Alternatively, the machine learning model can be trained to directly output choices. For example, this can be achieved by training the machine learning model using reinforcement learning. Reinforcement learning is another machine learning algorithm. In other words, reinforcement learning can be used to train a machine learning model. In reinforcement learning, one or more software actors (called "software agents") are trained to take actions in an environment. Based on the actions taken, rewards are calculated. Reinforcement learning is based on training one or more software agents to select actions that increase the cumulative reward, thereby causing the software agents to become better at the tasks they are given (as evidenced by the increased rewards). In this example, the action can be a selection of one or more mitigation measures and / or a selection of variations of existing mitigation measures, and the reward can be calculated based on whether the corresponding mitigation measures successfully contain or remedy the denial of service.

[0046] Regardless of which of the above methods is selected, the results of the training can be used to train other nodes. For example, the processor circuit system can adjust the mitigation selection mechanism by training the machine learning model used by the mitigation selection mechanism, and use federated learning to propagate the training of the machine learning model to one or more further nodes of the blockchain network. Therefore, if Figure 1b As further shown in , the method may include adjusting 190 the mitigation selection mechanism by training 192 a machine learning model used by the mitigation selection mechanism, and propagating 194 the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

[0047] In summary, in the proposed concept, at least one mitigation is applied. Nodes can propose variations of the original mitigation recipe based on online AI (artificial intelligence) models, such as the aforementioned reference machine learning model used by the mitigation selection mechanism. The efficacy of the containment attack can be measured in terms of the applied variations and can be used for various purposes, such as sharing with other nodes or improving the selection process.

[0048] One of the main motivations behind blockchain networks is a mechanism that allows nodes from different parties to cooperate with each other without having to trust each other, because trust is established via the transparency provided by blockchain. In the present disclosure, various mechanisms, mitigation measures, etc. are shared and managed collectively within the blockchain network. In order to avoid sabotage by malicious actors, measures can be taken to ensure that the shared information is not compromised. This can be achieved by using a reputation-based mechanism, in which changes to the shared information are approved based on the reputation of the corresponding node proposing the change (e.g., based on the reputation earned over time by the quality of the changes proposed by the corresponding node). For example, at least one of the joint maintenance of a set of mitigation measures, the joint maintenance of a traffic pattern evaluation mechanism, and the joint maintenance of a mitigation measure selection mechanism can be based on a reputation-based mechanism, which can be based on the reputation of the nodes of the blockchain network.

[0049] In order to perform management communications between nodes, for example, sharing information about potential vulnerabilities, mitigation selection techniques, variants of existing mechanisms, etc., a gossip protocol can be used. For example, the processor circuit system can use the gossip protocol to share at least one of information about the efficacy of at least one potential mitigation measure, information about potential vulnerabilities, and information about estimated denial of service to at least one other node of the blockchain network. The gossip protocol is a decentralized communication protocol for disseminating information across a network of nodes. Such a gossip protocol can be used to distribute data and transactions across a network, allowing all nodes to have the latest information about the state of the blockchain. In the gossip protocol, nodes communicate with each other by randomly selecting other nodes to send information to them. Each node that receives the information then propagates it to its own randomly selected nodes in the network until the information is spread to all nodes in the network.

[0050] In the proposed concept, various information related to the detection and mitigation of denial of service attacks is shared between the nodes of a blockchain network. While such information can be shared between nodes via the blockchain hosting the smart contract (e.g. Ethereum, a trademark of Stiftung Ethereum / Ethereum Foundation or Solana, a trademark of the Solana Foundation), this can result in a lot of noise on the blockchain and may incur, for example, gas fees. Therefore, in some examples, this activity may be moved to a layer 2 blockchain, which may be specific to a set of nodes of the blockchain network. In other words, the smart contract may be hosted on a layer 1 blockchain (e.g. Ethereum or Solana), and the communication between nodes regarding the detection and mitigation of denial of service attacks may be conducted via a separate layer 2 blockchain, which may be private to the set of nodes. For example, Figure 3 Such an approach is shown in FIG. 3 , where nodes are organized into groups 310, 320, and communications between nodes regarding detection and mitigation measures for denial of service attacks are shared between the nodes of the group. This information can be communicated via a bridge (e.g. Figure 3 The bridge 330 shown is shared with other groups.

[0051] Machine learning algorithms are typically based on machine learning models. In other words, the term "machine learning algorithm" may refer to an instruction set that can be used to create, train, or use a machine learning model. The term "machine learning model" may refer to a data structure and / or rule set that represents learned knowledge (e.g., based on training performed by a machine learning algorithm). In an embodiment, the use of a machine learning algorithm may mean the use of an underlying machine learning model (or multiple underlying machine learning models). The use of a machine learning model may mean that the machine learning model and / or the data structure / rule set that is the machine learning model is trained by a machine learning algorithm.

[0052] For example, the machine learning model may be an artificial neural network (ANN). ANN is a system inspired by biological neural networks (such as those found in the brain). ANN includes multiple interconnected nodes and multiple connections between nodes, i.e., so-called edges. There are usually three types of nodes, namely input nodes that receive input values, hidden nodes that are (only) connected to other nodes, and output nodes that provide output values. Each node may represent an artificial neuron. Each edge can transmit information from one node to another. The output of a node may be defined as a (nonlinear) function of the sum of its inputs. The input of a node may be used in a function based on the "weight" of the edge or the "weight" of the node providing the input. The weights of nodes and / or edges may be adjusted during the learning process. In other words, the training of an artificial neural network may include adjusting the weights of nodes and / or edges of the artificial neural network, i.e., achieving the desired output for a given input. At least in some embodiments, the machine learning model may be a deep neural network, for example, a neural network including one or more hidden node layers (i.e., hidden layers) (preferably, multiple hidden node layers).

[0053] Alternatively, the machine learning model may be a support vector machine. A support vector machine (i.e., a support vector network) is a supervised learning model with an associated learning algorithm that can be used to analyze data, for example, in classification or regression analysis. A support vector machine can be trained by providing an input with multiple training input values ​​belonging to one of two categories. A support vector machine can be trained to assign new input values ​​to one of two categories. Alternatively, the machine learning model may be a Bayesian network, which is a probabilistic directed acyclic graph model. A Bayesian network can use a directed acyclic graph to represent a set of random variables and their conditional dependencies. Alternatively, the machine learning model may be based on a genetic algorithm, which is a search algorithm and heuristic technique that simulates a natural selection process.

[0054] The interface circuit system 12 or the means for communicating 12 may correspond to one or more inputs and / or outputs for receiving and / or transmitting information within a module, between modules, or between modules of different entities, which information may be in the form of digital (bit) values ​​according to a specified code. For example, the interface circuit system 12 or the means for communicating 12 may include a circuit system configured to receive and / or transmit information.

[0055] For example, the processor circuit system 14 or the means for processing 14 may be implemented using one or more processing units, one or more processing devices, any means for processing (such as a processor, a computer, or a programmable hardware component that can operate with correspondingly adapted software). In other words, the functions of the described processor circuit system 14 or the means for processing may also be implemented using software, which is then executed on one or more programmable hardware components. Such hardware components may include general-purpose processors, digital signal processors (DSPs), microcontrollers, etc.

[0056] For example, the memory or storage circuit system 16 or device 16 for storing information can be a volatile memory, such as a random access memory (such as a dynamic random access memory (DRAM)), and / or include at least one element from the group of computer-readable storage media, which computer-readable storage media is such as a magnetic or optical storage medium, for example, a hard drive, a flash memory, a floppy disk, a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a network storage device.

[0057] related to the concept proposed or the context above or below (e.g. Figures 2 to 3 ) In combination with one or more examples described above, more details and aspects of the apparatus 10, device 10, method, computer program, node 100, and blockchain network 1000 are mentioned. The apparatus 10, device 10, method, computer program, node 100, and blockchain network 1000 may include one or more additional optional features corresponding to one or more aspects of the proposed concept or one or more examples described above or below.

[0058] Various examples of the present disclosure relate to adaptive mechanisms for detecting distributed attacks on web3 networks. Various examples of the present disclosure relate to so-called Web3 and / or security.

[0059] Various examples of the present disclosure include a data shift detector based on federated learning to iteratively learn from (each) system component condition and converge to detect DDoS attacks and identify affected areas across heterogeneous Web3 edge nodes. The detector can identify mutations / spikes in send / receive data caused by smart contract API (application programming interface) calls. System components can exchange parameters (model weights) and learn from each other (e.g., using federated learning), thereby maintaining data ownership and sovereignty. This may involve an AI-based distributed data shift detector for monitoring service level agreements (SLAs).

[0060] Each individual node can share a local measurement of whether its mitigation techniques are working based on the current state. This information can be shared between nodes along with the node state to provide a measure of node reputation and technique efficacy. When a node detects a possible DDoS, a gossip protocol can be used to share potential vulnerabilities and how to mitigate them before all nodes are affected.

[0061] Figure 2 Schematic diagram showing an example of the proposed architecture. Figure 2 Five nodes 210, 220, 230, 240, 2N0 are shown (nodes 1-3, N, where N is an arbitrary number - i.e., any number of nodes are supported). As shown with respect to node-1 210, each node may include a network interface card (NIC) / infrastructure processing unit (IPU) 211 for communicating with other nodes / blockchains, a shift detector 212, an AI (artificial intelligence) model manager 213, a seed-aware blockchain manager 214, an action manager 215, a state manager 216, and a reliability manager 217. For example, components 211-217 may be used to implement a combination of Figure 1a An apparatus 10 or device 10 is shown.

[0062] The shift detector 212 monitors data exchanged through the network interface card (NIC) / infrastructure processing unit (IPU) to detect any atypical changes that may represent potential DDoS, for example, through a model obtained from collaborative training (i.e., federated learning) between nodes. The shift detector can observe the exchanged data through the interface and can calculate statistics based on a logical window (e.g., a time window or a request number window) to dynamically estimate recent behavior (e.g., the last 24 hours). Therefore, the logical window can be compared with new situations that may represent meaningful deviations to derive the magnitude of multi-dimensional deviations. The AI ​​model manager 213 can exchange parameters and states between nodes to iteratively learn from each other based on new scenarios detected by the shift detector. The state manager 216 can perform statistical analysis and evolution associated with the node state, thereby keeping the same information updated for neighboring nodes. This information can be compared with a blockchain-based distributed database 200, where the last known details (and state) of the seed node are available. For example, the only way to update the database may be through proof of work / proof of stake consensus. The seed-aware blockchain manager 214 can maintain updated node states and information about seed nodes, and participate in voting to update the blockchain database 200. When DDoS is detected based on the information provided by the state and blockchain manager, the action manager 215 can implement mitigation actions, rumor protocols, and data exchanges between nodes. The action manager 215 can focus on implementing an instant contention strategy. The rumor protocol can be combined with blockchain technology to consume multiple seeds simultaneously (without central dependencies), increase the reachability range to curb DDoS attacks, and promote scalability. The reliability manager 217 can locally measure the efficacy of mitigation methods (by analyzing service availability) and track local component availability to update the participation level of the blockchain database. It can allow the number of seeds to be scaled and avoid central dependencies, making it easier to implement the rumor protocol.

[0063] Figure 3 A schematic diagram showing the operation flow. Figure 3 Two blockchain networks 310 and 320 are shown, each of which includes multiple nodes (devices 1-N, 311-31N, 321-32N). Each node includes a DDoS blockchain agent (DDoS BCA), which can be Figure 1a The apparatus 10 or device 10 implements and / or executes according to Figure 1b A single blockchain network can use EPID groups (Enhanced Privacy Identifier Groups, Intel The blockchain network 310 and 320 communicate with the Web3 bridge aggregator and publisher 330 via the network 300.

[0064] When the shift detector identifies a DoS attack, the action manager can apply a mitigation plan based on the AI ​​joint model, and the reliability manager can analyze its efficacy. In parallel, the blockchain and state managers can plan communication strategies based on known nodes to contain the situation as quickly as possible. Once the reliability manager draws a conclusion on the mitigation efficacy, the information can be shared with the rest of the nodes (e.g., nodes of the same blockchain network) through the action manager using a gossip protocol. It can iteratively train a joint AI model for smart attack contention. The reliability manager can analyze the efficacy of mitigation actions before propagating them as recipes.

[0065] The proposed concept allows Infrastructure as a Service (IaaS) - NUCaaS / IPUs to limit DDoS attacks and propagate actions based on a blockchain database where states and seeds (e.g., without central control and keeping traceability of changes) are updated by consensus.

[0066] Various examples can be used to detect DDoS attacks using a blockchain / Web3 consensus based shift detector that can be based on federated learning. Layer 2 enhancements can be used for geographically / temporally isolated web3 use cases to dynamically agree and set / manage thresholds for shift detectors based on workload characteristics. A blockchain consensus based gossip protocol can be used for fast feed-forward DDoS attack learning across participating Web3 nodes with self-healing capabilities based on past learning (blocking, throttling, reservations, etc.).

[0067] Combined with the proposed concept or the previous or following context (e.g. Figure 1a to Figure 1b ) One or more examples described herein mention more details and aspects of an adaptive mechanism for detecting distributed attacks on a web3 network. The adaptive mechanism for detecting distributed attacks on a web3 network may include one or more additional optional features corresponding to one or more aspects of the proposed concept or one or more examples described above or below.

[0068] In the following, some examples of the proposed concept are presented:

[0069] One example (e.g., Example 1) relates to an apparatus (10) for a node (100) of a blockchain network (1000), the apparatus comprising an interface circuit system (12), machine-readable instructions, and a processor circuit system (14), the processor circuit system (14) being used to execute the machine-readable instructions to compare a traffic pattern of requests associated with one or more smart contracts hosted by the node of the blockchain network with a reference traffic pattern. The processor circuit system is used to execute the machine-readable instructions to determine an estimated denial of service for at least one of the one or more smart contracts based on the comparison between the traffic pattern and the reference traffic pattern. The processor circuit system is used to execute the machine-readable instructions to determine one or more potential mitigations for the estimated denial of service based on a set of mitigation measures commonly maintained by the nodes of the blockchain network. The processor circuit system is used to execute the machine-readable instructions to apply at least one of the one or more potential mitigations.

[0070] Another example (e.g., Example 2) relates to a previously described example (e.g., Example 1) or to any of the examples described herein, further including a processor circuit system for executing machine-readable instructions to determine one or more potential mitigation measures based on a set of mitigation measures jointly maintained by nodes of the blockchain network using a consensus-based management scheme.

[0071] Another example (e.g., Example 3) relates to a previously described example (e.g., one of Examples 1 to 2) or to any of the examples described herein, further including that the traffic pattern relates to at least one of incoming requests and outgoing requests.

[0072] Another example (e.g., Example 4) relates to a previously described example (e.g., one of Examples 1 to 3) or to any of the examples described herein, further including that the reference traffic pattern is a reference traffic pattern determined locally at the node.

[0073] Another example (e.g., Example 5) relates to a previously described example (e.g., Example 4) or to any of the examples described herein, further including a processor circuit system for executing machine-readable instructions to monitor requests associated with one or more smart contracts and determine a reference traffic pattern based on the monitored requests.

[0074] Another example (e.g., Example 6) relates to a previously described example (e.g., one of Examples 1 to 3) or to any of the examples described herein, further including that the reference traffic pattern is a reference traffic pattern jointly maintained by nodes of the blockchain network.

[0075] Another example (e.g., Example 7) relates to a previously described example (e.g., one of Examples 1 to 6) or to any of the examples described herein, further including that the comparison between the traffic pattern and the reference traffic pattern is performed using a traffic pattern evaluation mechanism.

[0076] Another example (e.g., Example 8) relates to a previously described example (e.g., Example 7) or to any of the examples described herein, further including that the traffic pattern evaluation mechanism is jointly maintained by nodes of the blockchain network.

[0077] Another example (e.g., Example 9) relates to a previously described example (e.g., one of Examples 7 to 8) or to any of the examples described herein, further including a processor circuit system for executing machine-readable instructions to adjust a traffic pattern evaluation mechanism over time based on multiple comparisons between the traffic pattern at multiple time points and a reference traffic pattern.

[0078] Another example (e.g., Example 10) relates to a previously described example (e.g., Example 9) or to any of the examples described herein, further including a processor circuit system for executing machine-readable instructions to adjust the traffic pattern evaluation mechanism by training a machine learning model used by the traffic pattern evaluation mechanism, and propagating the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

[0079] Another example (e.g., Example 11) involves any of the previously described examples (e.g., one of Examples 1 to 10) or the examples described herein, further including that selection of one or more potential mitigations is performed using a mitigation selection mechanism.

[0080] Another example (e.g., Example 12) relates to a previously described example (e.g., Example 11) or to any of the examples described herein, further including that the mitigation selection mechanism is jointly maintained by nodes of the blockchain network.

[0081] Another example (e.g., Example 13) relates to any of the previously described examples (e.g., one of Examples 11 to 12) or the examples described herein, further including a processor circuit system for executing machine-readable instructions to determine the effectiveness of at least one applied mitigation measure, and adjusting the mitigation measure selection mechanism over time based on the determined effectiveness.

[0082] Another example (e.g., Example 14) relates to a previously described example (e.g., Example 13) or to any of the examples described herein, further including a processor circuit system for executing machine-readable instructions to adjust the mitigation selection mechanism by training a machine learning model used by the mitigation selection mechanism, and propagating the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

[0083] Another example (e.g., Example 15) relates to a previously described example (e.g., one of Examples 1 to 14) or to any of the examples described herein, further including that at least one of the joint maintenance of the set of mitigation measures, the joint maintenance of the traffic pattern evaluation mechanism, and the joint maintenance of the mitigation measure selection mechanism is based on a reputation-based mechanism based on the reputation of the nodes of the blockchain network.

[0084] Another example (e.g., Example 16) relates to any of the previously described examples (e.g., one of Examples 1 to 15) or the examples described herein, further including, the processor circuit system being used to execute machine-readable instructions to determine the efficacy of at least one applied mitigation measure, and to provide information about the efficacy of at least one potential mitigation measure to at least one other node of the blockchain network.

[0085] Another example (e.g., Example 17) relates to any of the previously described examples (e.g., one of Examples 1 to 16) or the examples described herein, further including a processor circuit system for executing machine-readable instructions to identify a potential vulnerability associated with the estimated denial of service, and providing information about the potential vulnerability to at least one other node of the blockchain network.

[0086] Another example (e.g., Example 18) relates to any of the previously described examples (e.g., one of Examples 1 to 17) or the examples described herein, further including, the processor circuit system being used to execute machine-readable instructions to provide information about the estimated denial of service to at least one other node of the blockchain network.

[0087] Another example (e.g., Example 19) relates to any of the previously described examples (e.g., one of Examples 1 to 18) or the examples described herein, further including, the processor circuit system being used to execute machine-readable instructions to share at least one of information about the efficacy of at least one potential mitigation measure, information about potential vulnerabilities, and information about estimated denial of service to at least one other node of the blockchain network using a gossip protocol.

[0088] One example (e.g., Example 20) relates to an apparatus (10) for a node (100) of a blockchain network (1000), the apparatus comprising a processor circuit system (14) configured to compare a traffic pattern of requests associated with one or more smart contracts hosted by the node of the blockchain network with a reference traffic pattern. The processor circuit system is configured to determine an estimated denial of service for at least one of the one or more smart contracts based on the comparison between the traffic pattern and the reference traffic pattern. The processor circuit system is configured to determine one or more potential mitigation measures for the estimated denial of service. The processor circuit system is configured to apply at least one of the one or more potential mitigation measures.

[0089] One example (e.g., Example 21) relates to a device (10) for a node (100) of a blockchain network (1000), the device comprising means (14) for processing, for comparing a traffic pattern of requests associated with one or more smart contracts hosted by the node of the blockchain network with a reference traffic pattern. The means (14) for processing is used to determine an estimated denial of service for at least one of the one or more smart contracts based on the comparison between the traffic pattern and the reference traffic pattern. The means for processing is used to determine one or more potential mitigation measures for the estimated denial of service. The means for processing is used to apply at least one of the one or more potential mitigation measures.

[0090] One example (e.g., Example 22) relates to a method for a node (100) of a blockchain network (1000), the method comprising comparing (130) a traffic pattern of requests associated with one or more smart contracts hosted by the node of the blockchain network with a reference traffic pattern. The method comprises determining (150) an estimated denial of service for at least one of the one or more smart contracts based on the comparison between the traffic pattern and the reference traffic pattern. The method comprises determining (160) one or more potential mitigation measures for the estimated denial of service. The method comprises applying (170) at least one of the one or more potential mitigation measures.

[0091] Another example (e.g., Example 23) relates to a previously described example (e.g., Example 22) or to any of the examples described herein, further including that the method includes determining (160) one or more potential mitigation measures based on a set of mitigation measures jointly maintained by nodes of the blockchain network, for example using a consensus-based management scheme.

[0092] Another example (e.g., Example 24) relates to a previously described example (e.g., one of Examples 22 to 23) or to any of the examples described herein, further including that the reference traffic pattern is a reference traffic pattern determined locally at a node, wherein the method includes monitoring (110) requests associated with one or more smart contracts, and determining (120) the reference traffic pattern based on the monitored requests.

[0093] Another example (e.g., Example 25) relates to a previously described example (e.g., one of Examples 22 to 24) or to any of the examples described herein, further including that the comparison between the traffic pattern and the reference traffic pattern is performed using a traffic pattern evaluation mechanism, wherein the method includes adjusting (140) the traffic pattern evaluation mechanism over time based on multiple comparisons between the traffic pattern and the reference traffic pattern at multiple time points.

[0094] Another example (e.g., Example 26) relates to a previously described example (e.g., Example 25) or to any of the examples described herein, further including that the method includes adjusting (140) the traffic pattern evaluation mechanism by training (142) a machine learning model used by the traffic pattern evaluation mechanism, and propagating (144) the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

[0095] Another example (e.g., Example 27) relates to any of the previously described examples (e.g., one of Examples 22 to 26) or the examples described herein, further including that selection of one or more potential mitigation measures is performed using a mitigation measure selection mechanism, wherein the method includes determining (180) the efficacy of at least one applied mitigation measure, and adjusting the mitigation measure selection mechanism over time based on the determined efficacy.

[0096] Another example (e.g., Example 28) relates to a previously described example (e.g., Example 27) or to any of the examples described herein, further including that the method includes adjusting (190) the mitigation selection mechanism by training (192) a machine learning model used by the mitigation selection mechanism, and propagating (194) the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

[0097] Another example (e.g., Example 29) relates to any of the previously described examples (e.g., one of Examples 22 to 28) or the examples described herein, further including that the method includes determining (180) an efficacy of at least one applied mitigation measure, and providing (182) information about the efficacy of at least one potential mitigation measure to at least one other node of the blockchain network.

[0098] Another example (e.g., Example 30) relates to any of the previously described examples (e.g., one of Examples 22 to 29) or the examples described herein, further including that the method includes identifying (154) a potential vulnerability associated with the estimated denial of service, and providing (156) information about the potential vulnerability to at least one other node of the blockchain network.

[0099] Another example (e.g., Example 31) relates to any of the previously described examples (e.g., one of Examples 22 to 30) or the examples described herein, further including that the method includes providing (152, 156) information about the estimated denial of service to at least one other node of the blockchain network.

[0100] Another example (e.g., Example 32) relates to any of the previously described examples (e.g., one of Examples 22 to 31) or the examples described herein, further including that the method includes sharing (152, 156, 182) at least one of information about the efficacy of at least one potential mitigation measure, information about potential vulnerabilities, and information about estimated denial of service to at least one other node of the blockchain network using a gossip protocol.

[0101] An example (e.g., Example 33) relates to a computer system (100), which includes an apparatus (10) or a device (10) according to one of Examples 1 to 21 (or according to any other example), wherein the computer system (100) is a node of a blockchain network.

[0102] An example (e.g., Example 34) relates to a computer system (100) configured to perform a method according to one of Examples 22 to 32 (or according to any other example), wherein the computer system (100) is a node of a blockchain network.

[0103] One example (eg, Example 35) involves a non-transitory machine-readable storage medium comprising program code that, when executed, causes a machine to perform a method of one of Examples 22 to 32 (or according to any other example).

[0104] An example (e.g., Example 36) relates to a computer program having program code for executing a method of one of Examples 22 to 32 (or according to any other example) when the computer program is executed on a computer, a processor, or a programmable hardware component.

[0105] One example (e.g., Example 37) relates to a machine-readable storage device comprising machine-readable instructions that, when executed, implement a method as claimed in the appended claims or shown in any example, or implement an apparatus as claimed in the appended claims or shown in any example.

[0106] The aspects and features described in relation to a particular example among the foregoing examples may be combined with one or more of the other examples to replace the same or similar features of the other examples or to additionally introduce these features into the other examples.

[0107] Examples may further be or relate to (computer) programs, including program codes for executing one or more of the above methods when the program is executed on a computer, a processor, or other programmable hardware component. Thus, the steps, operations, or processes of the different methods in the methods described above may also be performed by a programmed computer, a processor, or other programmable hardware component. Examples may also encompass program storage devices, such as digital data storage media, which are machine-readable, processor-readable, or computer-readable and encode and / or contain machine-executable, processor-executable, or computer-executable programs and instructions. For example, a program storage device may include or may be a digital storage device, a magnetic storage medium (such as a disk and a tape), a hard drive, or an optically readable digital data storage medium. Other examples may also include a computer, a processor, a control unit, a (field) programmable logic array ((field) programmable logic array, (F) PLA), a (field) programmable gate array ((field) programmable gate array, (F) PGA), a graphics processor unit (GPU), an application-specific integrated circuit (ASIC), an integrated circuit (IC), or a system-on-a-chip (SoC) system programmed to perform the steps of the method described above.

[0108] It will also be understood that the disclosure of several steps, processes, operations or functions disclosed in the specification or claims should not be interpreted as implying that these operations must be performed in the described order, unless explicitly stated in a separate use case or necessary for technical reasons. Therefore, the previous description does not limit the performance of several steps or functions to a certain order. In addition, in other examples, a single step, function, process or operation may include and / or be decomposed into sub-steps, sub-functions, sub-processes or sub-operations.

[0109] If some aspects have been described in conjunction with a device or system, these aspects should also be understood as descriptions of corresponding methods. For example, a block, a device, or a functional aspect of a device or system may correspond to a feature (such as a method step) of a corresponding method. Accordingly, aspects described in conjunction with a method should also be understood as descriptions of properties or functional features of the corresponding block, corresponding element, corresponding device, or corresponding system.

[0110] As used herein, the term "module" refers to a logic for performing one or more operations in accordance with the present disclosure that can be implemented using hardware components or devices, software or firmware running on a processing unit, or a combination thereof. Software and firmware can be embodied as instructions and / or data stored on a non-transient computer-readable storage medium. As used herein, the term "circuitry" can include, individually or in any combination, non-programmable (hard-wired) circuitry, programmable circuitry (such as a processing unit), state machine circuitry, and / or firmware that stores instructions that can be executed by a programmable circuitry. The modules described herein can be embodied collectively or individually as circuits that form part of a computing system. Thus, any one of the modules can be implemented as a circuit system. A computing system that is referred to as being programmed to perform a method can be programmed to perform the method via software, hardware, firmware, or a combination thereof.

[0111] Any disclosed method (or part thereof) can be implemented as computer-executable instructions or computer program products. Such instructions can enable a computing system or one or more processing units capable of executing computer-executable instructions to perform any of the disclosed methods. As used herein, the term "computer" refers to any computing system or device described or mentioned herein. Thus, the term "computer-executable instructions" refers to instructions that can be executed by any computing system or device described or mentioned herein.

[0112] Computer executable instructions may be, for example, part of an operating system of a computing system, an application stored locally on the computing system, or a remote application accessible to the computing system (e.g., via a web browser). Any of the methods described herein may be performed by computer executable instructions, which are executed by a single computing system or by one or more networked computing systems operating in a network environment. Computer executable instructions and updates to computer executable instructions may be downloaded from a remote server to a computing system.

[0113] Further, it should be understood that implementation of the disclosed techniques is not limited to any particular computer language or program. For example, the disclosed techniques may be implemented by software written in C++, C#, Java, Perl, Python, JavaScript, Adobe Flash, C#, assembly language, or any other programming language. Likewise, the disclosed techniques are not limited to any particular computer system or any particular type of hardware.

[0114] In addition, any software-based examples (including, for example, computer-executable instructions for causing a computer to perform any of the disclosed methods) can be uploaded, downloaded, or remotely accessed via suitable communication means. Such suitable communication means include, for example, the Internet, the World Wide Web, an intranet, cables (including fiber optic cables), magnetic communications, electromagnetic communications (including RF, microwave, ultrasonic, and infrared communications), electronic communications, or other such communication means.

[0115] The disclosed methods, apparatuses, and systems should not be interpreted as limiting in any way. Instead, the present disclosure is directed to all novel and non-obvious features and aspects of each disclosed example, individually and in various combinations and sub-combinations with each other. The disclosed methods, apparatuses, and systems are not limited to any specific aspect or feature or combination thereof, nor do the disclosed examples require the existence of any one or more specific advantages or the resolution of any one or more specific problems.

[0116] The theories of operation, scientific principles, or other theoretical descriptions presented herein with reference to the devices or methods of the present disclosure are provided for the purpose of better understanding and are not intended to limit the scope. The devices and methods in the appended claims are not limited to those devices and methods that function in the manner described by such theories of operation.

[0117] The attached claims are hereby included in the detailed description, wherein each claim itself can serve as a separate example. It should be noted that although a dependent claim refers to a specific combination with one or more other claims in the claims, other examples may also include a combination of the dependent claim with the subject matter of any other dependent or independent claim. Such combinations are expressly proposed here, unless it is stated in individual cases that a specific combination is not intended. In addition, even if a claim is not directly limited to refer to any other independent claim, the features of the claim should also be included for any other independent claim.

Claims

1. A device for a node of a blockchain network, the device comprising an interface circuit system, a machine-readable instruction, and a processor circuit system, the processor circuit system being configured to execute the machine-readable instruction to: comparing a traffic pattern of requests associated with one or more smart contracts hosted by the node of the blockchain network to a reference traffic pattern; determining an estimated denial of service for at least one of the one or more smart contracts based on the comparison between the traffic pattern and the reference traffic pattern; identifying one or more potential mitigations for the estimated denial of service; as well as At least one of the one or more potential mitigation measures is applied.

2. The device according to claim 1, wherein: The processor circuitry is configured to execute the machine-readable instructions to determine the one or more potential mitigation measures based on a set of mitigation measures collectively maintained by the nodes of the blockchain network.

3. The device according to claim 1, wherein: The traffic pattern relates to at least one of incoming requests and outgoing requests.

4. The apparatus of claim 1, wherein the reference traffic pattern is a reference traffic pattern determined locally at the node.

5. An apparatus as described in claim 4, wherein the processor circuit system is used to execute the machine-readable instructions to monitor requests associated with the one or more smart contracts and determine the reference traffic pattern based on the monitored requests.

6. The apparatus of claim 1, wherein the reference traffic pattern is a reference traffic pattern jointly maintained by the nodes of the blockchain network.

7. The apparatus of claim 1, wherein the comparison between the traffic pattern and the reference traffic pattern is performed using a traffic pattern evaluation mechanism.

8. The apparatus of claim 7, wherein the traffic pattern evaluation mechanism is jointly maintained by the nodes of the blockchain network.

9. The apparatus of claim 7, wherein the processor circuitry is configured to execute the machine-readable instructions to adjust the traffic pattern evaluation mechanism over time based on multiple comparisons between the traffic pattern and the reference traffic pattern at multiple points in time.

10. The apparatus of claim 9, wherein the processor circuitry is to execute the machine-readable instructions to tune the traffic pattern evaluation mechanism by training a machine learning model used by the traffic pattern evaluation mechanism, and propagate the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

11. The apparatus of claim 1 , wherein the selection of the one or more potential mitigation measures is performed using a mitigation measure selection mechanism.

12. The apparatus of claim 11, wherein the mitigation measure selection mechanism is jointly maintained by the nodes of the blockchain network.

13. The apparatus of claim 11, wherein the processor circuitry is to execute the machine-readable instructions to determine an efficacy of at least one applied mitigation and to adjust the mitigation selection mechanism over time based on the determined efficacy.

14. The apparatus of claim 13, wherein the processor circuitry is to execute the machine-readable instructions to adjust the mitigation selection mechanism by training a machine learning model used by the mitigation selection mechanism, and propagate the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

15. The apparatus of claim 1, wherein at least one of the joint maintenance of a set of mitigation measures, the joint maintenance of a traffic pattern assessment mechanism, and the joint maintenance of a mitigation measure selection mechanism is based on a reputation-based mechanism, wherein the reputation-based mechanism is based on the reputation of the node of the blockchain network.

16. The apparatus of claim 1, wherein the processor circuitry is to execute the machine-readable instructions to determine the efficacy of at least one applied mitigation measure and to provide information about the efficacy of at least one potential mitigation measure to at least one other node of the blockchain network.

17. The apparatus of claim 1, wherein the processor circuitry is to execute the machine-readable instructions to identify a potential vulnerability associated with the estimated denial of service and to provide information about the potential vulnerability to at least one other node of the blockchain network.

18. The apparatus of claim 1, wherein the processor circuitry is to execute the machine-readable instructions to provide information about the estimated denial of service to at least one other node of the blockchain network.

19. The apparatus of claim 1, wherein the processor circuitry is to execute machine-readable instructions to share at least one of information about the efficacy of the at least one potential mitigation measure, information about potential vulnerabilities, and information about the estimated denial of service to at least one other node of the blockchain network using a gossip protocol.

20. A method for a node of a blockchain network, the method comprising: comparing a traffic pattern of requests associated with one or more smart contracts hosted by a node of the blockchain network to a reference traffic pattern; determining an estimated denial of service for at least one of the one or more smart contracts based on the comparison between the traffic pattern and the reference traffic pattern; identifying one or more potential mitigations for the estimated denial of service; as well as At least one of the one or more potential mitigation measures is applied.

21. The method of claim 20, wherein the method comprises determining the one or more potential mitigation measures based on a set of mitigation measures collectively maintained by the nodes of the blockchain network.

22. A method as claimed in claim 20, wherein the reference traffic pattern is a reference traffic pattern determined locally at the node, wherein the method includes monitoring requests associated with the one or more smart contracts, and determining the reference traffic pattern based on the monitored requests.

23. method as claimed in claim 20, wherein the comparison between the traffic pattern and the reference traffic pattern is performed by using a traffic pattern evaluation mechanism, wherein the method includes adjusting the traffic pattern evaluation mechanism over time based on multiple comparisons between the traffic pattern and the reference traffic pattern at multiple time points.

24. A method as claimed in claim 23, wherein the method includes adjusting the traffic pattern evaluation mechanism by training a machine learning model used by the traffic pattern evaluation mechanism, and propagating the training of the machine learning model to one or more further nodes of the blockchain network using federated learning.

25. A non-transitory machine-readable storage medium comprising a program code which, when executed, causes a machine to perform the method of one of claims 20 to 24.

Images