Ethereum network bandwidth attack-oriented identification method and device

Abstract

The invention discloses an Ethereum network bandwidth attack-oriented identification method and device, and belongs to the field of Ethereum network attack identification, and the method comprises the steps: obtaining a state vector of each node at each time point in an Ethereum network; traversing the nodes, and calculating the anomaly degree according to the state vector; determining a dynamic threshold by using a sliding window mechanism, and screening abnormal state vectors; calculating a node confidence coefficient according to the abnormal feature set; if the confidence exceeds a threshold value, the node is judged to be an abnormal node; and determining a bandwidth attack identification result according to all the abnormal nodes. Therefore, by implementing the method and the device, the problem that the identification efficiency of the bandwidth depletion attack is difficult to improve while the low false alarm rate is ensured in the prior art can be solved.

Description

Technical Field

[0001] This invention relates to the field of Ethereum network attack identification, and more particularly to a method and apparatus for identifying Ethereum network bandwidth attacks. Background Technology

[0002] In the field of Ethereum network attack identification, detecting resource exhaustion attacks targeting the network layer protocol has always been a technical challenge and a key research focus. As the world's largest smart contract platform, the stable operation of Ethereum's network layer directly impacts the security and reliability of the entire ecosystem. The network layer uses a peer-to-peer flood broadcast mechanism to propagate transactions and blocks. While this mechanism ensures the system's decentralized nature, it also exposes it to threats from new attack vectors.

[0003] In existing technologies, mainstream solutions primarily rely on transaction amount thresholds to identify traditional dust attacks. These methods preset a dust threshold, triggering an alarm when the detected transaction amount falls below that threshold. They then employ application-layer wallet isolation mechanisms to isolate the flagged assets, preventing attackers from tracking user addresses through small transactions. However, this approach suffers from three fundamental flaws: First, its detection dimensions are too singular, focusing solely on transaction amount while completely ignoring crucial characteristics such as transaction data volume and gas pricing strategies. Second, its defense mechanism operates at the application layer after transaction reception, failing to mitigate bandwidth resource consumption during the P2P network propagation phase. Finally, detection methods based on static thresholds struggle to adapt to the dynamic adjustment characteristics of Ethereum's BaseFee, easily generating numerous false positives in real-world network environments. Due to these limitations, existing solutions exhibit significant detection blind spots when facing new types of bandwidth exhaustion attacks, failing to accurately identify attack characteristics or effectively protect node network resources. This technical gap leaves the Ethereum network without effective defenses against carefully crafted protocol-layer attacks, potentially causing serious consequences such as block synchronization delays, transaction confirmation obstruction, and even network partitioning, directly threatening the consensus security and operational stability of the blockchain system. Summary of the Invention

[0004] This invention provides a method and apparatus for identifying bandwidth attacks on the Ethereum network, which can solve the problem in the prior art of improving the identification efficiency of bandwidth exhaustion attacks while ensuring a low false positive rate.

[0005] In a first aspect, embodiments of the present invention provide a method for identifying Ethereum network bandwidth attacks, including: Obtain the state vector of each node in the Ethereum network at each point in time; Traverse each node and, based on the state vector of the currently traversed node at each time point, use the anomaly calculation method to obtain the anomaly degree corresponding to each state vector. Iterate through each of the state vectors. If the anomaly degree corresponding to the currently traversed state vector is greater than or equal to the current dynamic threshold, then output the currently traversed state vector. The current dynamic threshold is determined based on the sliding window mechanism. The set of abnormal features corresponding to the currently traversed node is obtained based on all the output state vectors, and the confidence level corresponding to the currently traversed node is obtained by weighted fusion method based on the set of abnormal features. If the confidence threshold corresponding to the currently traversed node is greater than or equal to the preset confidence threshold, then the currently traversed node is determined to be an abnormal node. The identification results of the Ethereum network bandwidth attack were determined based on all the abnormal nodes.

[0006] This application's embodiments achieve accurate detection of network attacks through a multi-stage processing approach. First, by acquiring the state vectors of each node at different time points, the dynamic behavioral characteristics of the nodes can be comprehensively captured, providing a rich data foundation for subsequent analysis. Second, an anomaly calculation method is used to evaluate each state vector, combined with a dynamic threshold mechanism to filter abnormal states, effectively avoiding the problem of poor adaptability of static thresholds in dynamic network environments. Then, the node confidence level is calculated through anomaly feature sets and a weighted fusion method, ensuring that the judgment process considers not only single anomalies but also the synergistic effect of multiple features, improving the comprehensiveness and reliability of detection. Finally, the attack identification result is determined based on all abnormal nodes, enabling the identification of coordinated attacks from a global perspective and reducing false positives and false negatives. This method achieves a balance between low false positive rate and high efficiency in Ethereum network bandwidth attack detection, providing timely warnings in the early stages of attacks, protecting network resources from exhaustion attacks, and improving the consensus security and operational stability of the blockchain system.

[0007] As a preferred example of the first aspect, the step of calculating the anomaly degree corresponding to each state vector based on the state vector of the currently traversed node at each of the aforementioned time points using an anomaly degree calculation method specifically involves: Traverse the state vectors of the currently traversed nodes at each of the stated time points to obtain the anomaly degree corresponding to each state vector; During each traversal, based on the eigenvalues, baseline values, and weight coefficients of each feature dimension in the current traversal state vector, a weighted offset for each feature dimension is obtained. These weighted offsets are then summed to obtain a summation result, which is used as the anomaly degree of the current traversal state vector. The baseline values ​​for each feature dimension are obtained based on a preset dynamic baseline model.

[0008] In this preferred example, the anomaly score is obtained by combining the eigenvalues, baseline values, and weight coefficients of each feature dimension in the state vector, and then summing them. This method integrates information from multiple feature dimensions, more accurately reflecting the abnormal state of a node and avoiding the limitations of single-feature detection. The baseline value is obtained based on a dynamic baseline model, which can adapt to changes in the network environment, thereby reducing false positives caused by normal network fluctuations. The introduction of the weighted offset distinguishes the contributions of different features to the anomaly score, highlighting the role of key features and improving the sensitivity and accuracy of anomaly detection.

[0009] As a preferred example of the first aspect, the current dynamic threshold is determined according to a sliding window mechanism, specifically: Obtain each historical anomaly value within a sliding window of a preset time length, and calculate the mean and standard deviation corresponding to each historical anomaly value; The current dynamic threshold is obtained based on the preset confidence coefficient, the mean and standard deviation of each of the historical anomaly values.

[0010] In this preferred example, a dynamic threshold is determined using a sliding window mechanism. The current threshold is calculated by combining the mean and standard deviation of historical anomaly values ​​with a confidence coefficient, enabling the detection system to adapt to changes in network conditions. This method overcomes the shortcomings of static thresholds, which are prone to becoming outdated or unsuitable in dynamic networks. For example, during sudden increases in Ethereum network transaction volume or BaseFee adjustments, the dynamic threshold can adjust the detection sensitivity in real time, reducing false positives. The sliding window mechanism ensures that the threshold is updated based on recent data, reflecting the latest network behavior patterns and improving the real-time performance and accuracy of detection. The introduction of a confidence coefficient allows for adjusting the detection stringency according to security requirements, capturing as many real attacks as possible while maintaining a low false positive rate.

[0011] As a preferred example of the first aspect, the step of obtaining the confidence level corresponding to the currently traversed node using a weighted fusion method based on the set of abnormal features specifically involves: The offset of each feature in the abnormal feature set is determined by using an offset calculation method. A set of collaborative anomaly feature pairs is determined based on the set of anomaly features; wherein, the set of collaborative anomaly feature pairs includes several feature pairs; The correlation coefficient is calculated using the correlation coefficient calculation method for each feature pair in the collaborative anomaly feature pair set, and the weight coefficients for each feature pair in the collaborative anomaly feature pair set are determined according to the preset deep learning model. Based on the correlation coefficients, weight coefficients, and offsets of each feature pair, a weighted fusion method is used to obtain the confidence level of the currently traversed node.

[0012] In this preferred example, multi-dimensional information fusion is achieved by analyzing the offsets, co-anomaly feature pairs, correlation coefficients, and weight coefficients within the anomalous feature set. This method can capture the synergistic effects between features, identify complex attack patterns, such as coordinated attacks where multiple features are simultaneously anomalous, and improve the comprehensiveness of detection. Offset calculation ensures that the anomalousness of individual features is quantified, while the analysis of co-feature pairs enhances the understanding of associated anomalies. Weight coefficients are determined through correlation coefficients and deep learning models, enabling the method to adaptively learn the relationships between features and optimize the accuracy of confidence calculation. The weighted fusion process integrates the contributions of individual features and feature pairs, generating more reliable confidence indicators and reducing the risk of false positives. The advantage of this method lies in its flexibility and adaptability, enabling it to handle variable attack vectors in the Ethereum network and improve identification efficiency.

[0013] As a preferred example of the first aspect, determining the identification result of the Ethereum network bandwidth attack based on all abnormal nodes specifically involves: Determine the number of abnormal nodes based on all abnormal nodes; If the number of abnormal nodes is greater than or equal to a preset abnormal node threshold, it is determined that the Ethereum network is under a bandwidth attack, and the node identifiers corresponding to all abnormal nodes are output; otherwise, the node identifiers corresponding to each abnormal node are output as the identification result.

[0014] In this preferred example, the bandwidth attack identification result is determined by comparing the number of abnormal nodes with a preset threshold, achieving attack assessment from the node level to the network level. When the number of abnormal nodes exceeds the threshold, the system determines that the network is under a large-scale bandwidth attack and outputs the identifiers of all abnormal nodes for a global response. Otherwise, only the identifiers of abnormal nodes are output as a local detection result to avoid overreacting to isolated events.

[0015] Secondly, the present invention provides an identification device for Ethereum network bandwidth attacks, comprising: a data acquisition module, a first processing module, a second processing module, a third processing module, a fourth processing module, and an identification module; The data acquisition module is used to acquire the state vector of each node in the Ethereum network at each point in time. The first processing module is used to traverse each of the nodes and, based on the state vector of the currently traversed node at each of the time points, use an anomaly calculation method to obtain the anomaly degree corresponding to each state vector. The second processing module is used to traverse each of the state vectors. If the anomaly degree corresponding to the currently traversed state vector is greater than or equal to the current dynamic threshold, the currently traversed state vector is output. The current dynamic threshold is determined according to the sliding window mechanism. The third processing module is used to obtain the set of abnormal features corresponding to the currently traversed node based on all output state vectors, and to obtain the confidence level corresponding to the currently traversed node based on the set of abnormal features using a weighted fusion method. The fourth processing module is used to determine that the currently traversed node is an abnormal node if the confidence threshold corresponding to the currently traversed node is greater than or equal to the preset confidence threshold. The identification module is used to determine the identification result of the Ethereum network bandwidth attack based on all abnormal nodes.

[0016] As a preferred example of the second aspect, the first processing module includes a first processing unit and a second processing unit; The first processing unit is used to traverse the state vectors of the currently traversed nodes at each of the time points to obtain the anomaly degree corresponding to each state vector. The second processing unit is configured to, during each traversal, obtain the weighted offset corresponding to each feature dimension based on the feature values, baseline values, and weight coefficients of each feature dimension in the currently traversed state vector, then sum the weighted offsets of each feature dimension to obtain a summation result, and use the summation result as the anomaly degree corresponding to the currently traversed state vector. The baseline values ​​corresponding to each feature dimension are obtained based on a preset dynamic baseline model.

[0017] As a preferred example of the second aspect, the second processing module includes a third processing unit and a fourth processing unit; The third processing unit is used to obtain each historical anomaly value within a sliding window of a preset time length, and to calculate the mean and standard deviation corresponding to each historical anomaly value. The fourth processing unit is used to obtain the current dynamic threshold based on the preset confidence coefficient, the mean and standard deviation of each of the historical anomaly values.

[0018] As a preferred example of the second aspect, the third processing module includes a fifth processing unit, a sixth processing unit, a seventh processing unit, and an eighth processing unit; The fifth processing unit is used to determine the offset corresponding to each feature in the abnormal feature set using an offset calculation method. The sixth processing unit is used to determine a set of collaborative anomaly feature pairs based on the set of anomaly features; wherein the set of collaborative anomaly feature pairs includes several feature pairs; The seventh processing unit is used to calculate the correlation coefficient of each feature pair in the collaborative anomaly feature pair set using the correlation coefficient calculation method, and to determine the weight coefficient of each feature pair in the collaborative anomaly feature pair set according to the preset deep learning model. The eighth processing unit is used to obtain the confidence level of the currently traversed node by using a weighted fusion method based on the correlation coefficients corresponding to each feature pair, the weight coefficients corresponding to each feature pair, and the offsets corresponding to each feature.

[0019] As a preferred example of the second aspect, the identification module includes a first identification unit and a second identification unit; The first identification unit is used to determine the number of abnormal nodes based on all the abnormal nodes; The second identification unit is used to determine that the Ethereum network is under a bandwidth attack if the number of abnormal nodes is greater than or equal to a preset abnormal node threshold, and output the node identifiers corresponding to all abnormal nodes; otherwise, it outputs the node identifiers corresponding to each abnormal node as the identification result.

[0020] In summary, this application's embodiments achieve accurate detection of network attacks through multi-stage processing. First, by acquiring the state vectors of each node at different time points, the dynamic behavioral characteristics of the nodes can be comprehensively captured, providing a rich data foundation for subsequent analysis. Second, an anomaly calculation method is used to evaluate each state vector, combined with a dynamic threshold mechanism to filter abnormal states, effectively avoiding the problem of poor adaptability of static thresholds in dynamic network environments. Then, the node confidence is calculated through anomaly feature sets and a weighted fusion method, ensuring that the judgment process considers not only single anomalies but also the synergistic effect of multiple features, improving the comprehensiveness and reliability of detection. Finally, the attack identification result is determined based on all abnormal nodes, enabling the identification of coordinated attacks from a global perspective, reducing false negatives and false positives. This method achieves a balance between low false positive rate and high efficiency in Ethereum network bandwidth attack detection, providing timely warnings in the early stages of attacks, protecting network resources from exhaustion attacks, and improving the consensus security and operational stability of the blockchain system.

[0021] Another embodiment of the present invention provides a terminal device, including: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the steps of the identification method for Ethereum network bandwidth attacks of the present invention.

[0022] Another embodiment of the present invention also provides a computer-readable storage medium item, including: a stored computer program, which, when the computer program is running, controls the device where the computer-readable storage medium is located to perform the steps of the identification method for Ethereum network bandwidth attacks of the present invention. Attached Figure Description

[0023] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating an embodiment of a method for identifying Ethereum network bandwidth attacks provided by the present invention. Figure 2 A flowchart of multi-dimensional feature correlation analysis is provided as an embodiment of the identification method for Ethereum network bandwidth attacks provided by the present invention. Figure 3 A learning environment architecture diagram for one embodiment of the method for identifying Ethereum network bandwidth attacks provided by the present invention; Figure 4 This is a flowchart illustrating an embodiment of an identification device for identifying Ethereum network bandwidth attacks provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0027] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0028] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0029] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0030] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0031] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0032] Example 1 See Figure 1To address the problem in existing technologies of simultaneously maintaining a low false positive rate and improving the efficiency of identifying bandwidth exhaustion attacks, an embodiment of the present invention provides a method for identifying bandwidth attacks on the Ethereum network, comprising: S1. Obtain the state vector of each node in the Ethereum network at each point in time; Specifically, obtaining the state vector of each node in the Ethereum network at each point in time can be implemented in the following preferred manner: Monitoring probes are set up at the communication and transaction pool layers of Ethereum nodes to continuously observe and extract features from node behavior. The monitoring content includes not only network layer bandwidth usage and message forwarding, but can also be extended to multiple dimensions such as transaction layer, system resource layer, or latency layer, depending on the actual deployment environment. Examples include transaction propagation rate, gas price distribution, message retransmission rate, node response time, average packet size, and inter-node latency jitter. Therefore, the node's state vector at time t is: in, For state vectors, It is the nth element in the state vector.

[0033] S2. Traverse each node and, based on the state vector of the currently traversed node at each time point, use the anomaly calculation method to obtain the anomaly degree corresponding to each state vector. In some embodiments of this application, the step of calculating the anomaly degree corresponding to each state vector based on the state vector corresponding to the currently traversed node at each of the aforementioned time points using an anomaly degree calculation method specifically involves: Traverse the state vectors of the currently traversed nodes at each of the stated time points to obtain the anomaly degree corresponding to each state vector; During each traversal, based on the eigenvalues, baseline values, and weight coefficients of each feature dimension in the current traversal state vector, a weighted offset for each feature dimension is obtained. These weighted offsets are then summed to obtain a summation result, which is used as the anomaly degree of the current traversal state vector. The baseline values ​​for each feature dimension are obtained based on a preset dynamic baseline model.

[0034] Specifically, the formula for the anomaly calculation method is as follows: in, State vector The corresponding anomaly degree, Let be the dimension of the state vector. This represents the weight coefficient corresponding to the i-th dimension. This represents the baseline value corresponding to the i-th dimension. This represents the standard deviation corresponding to the i-th dimension.

[0035] S3. Traverse each of the state vectors. If the anomaly degree corresponding to the currently traversed state vector is greater than or equal to the current dynamic threshold, then output the currently traversed state vector. The current dynamic threshold is determined according to the sliding window mechanism. In some embodiments of this application, the current dynamic threshold is determined according to a sliding window mechanism, specifically: Obtain each historical anomaly value within a sliding window of a preset time length, and calculate the mean and standard deviation corresponding to each historical anomaly value; The current dynamic threshold is obtained based on the preset confidence coefficient, the mean and standard deviation of each of the historical anomaly values.

[0036] Specifically, the preferred method for updating the current dynamic threshold is as follows: in, and These represent the mean and standard deviation of the anomaly function within the window, respectively. This represents the confidence coefficient, which is typically between 2 and 3.

[0037] S4. Obtain the set of abnormal features corresponding to the currently traversed node based on all output state vectors, and obtain the confidence level corresponding to the currently traversed node using a weighted fusion method based on the set of abnormal features. In some embodiments of this application, the step of obtaining the confidence level corresponding to the currently traversed node using a weighted fusion method based on the abnormal feature set specifically involves: The offset of each feature in the abnormal feature set is determined by using an offset calculation method. A set of collaborative anomaly feature pairs is determined based on the set of anomaly features; wherein, the set of collaborative anomaly feature pairs includes several feature pairs; The correlation coefficient is calculated using the correlation coefficient calculation method for each feature pair in the collaborative anomaly feature pair set, and the weight coefficients for each feature pair in the collaborative anomaly feature pair set are determined according to the preset deep learning model. Based on the correlation coefficients, weight coefficients, and offsets of each feature pair, a weighted fusion method is used to obtain the confidence level of the currently traversed node.

[0038] S5. If the confidence threshold corresponding to the currently traversed node is greater than or equal to the preset confidence threshold, then the currently traversed node is determined to be an abnormal node. Specifically, to fully explain the content of steps S4 and S5, the following scheme will be used as an example: Steps S4 and S5 can be considered as the second stage of identification, such as Figure 2 The following are the sub-steps of the second stage: First, calculate the offset of each feature using the following formula: in, Let be the offset of the i-th feature. Let i be the feature value of the i-th feature dimension. This is the baseline value corresponding to the i-th feature dimension.

[0039] Next, the feature correlation matrix is ​​constructed, and the specific construction formula is shown below: in, The correlation function can be Pearson correlation coefficient or time-delayed cross-correlation. When a strong correlation exists (|Rᵢⱼ|>0.8) and the duration exceeds the threshold, it indicates that there is a cooperative anomaly among the feature groups.

[0040] Typical patterns in the Ethereum network include: bandwidth utilization increasing in tandem with the proportion of low-gas transactions; transaction volume showing a positive correlation with broadcast rate; and network latency continuously increasing in tandem with the proportion of low-gas transactions. These patterns all correspond to typical "low-gas dust broadcast attack" behavioral characteristics. The system categorizes highly correlated features that meet the above conditions as an anomaly set. And pass it as input to the next stage.

[0041] Then, to further improve the accuracy of judgment, this invention constructs a time-series fusion model based on the correlation matrix to comprehensively analyze the dynamic trends of multi-dimensional indicators. Finally, the confidence score is calculated using a weighted fusion method. The specific formula is shown below: in, This represents the observation data at a given time t. Under the given conditions, the posterior probability that the node is under attack. For a set of collaborative anomaly feature pairs, These are the weight coefficients corresponding to feature pair (i, j). Let i be the correlation coefficient between feature i and feature j. and These are the offsets of feature i and feature j, respectively.

[0042] when When the confidence threshold is reached, the system determines that the node is in a low-gas dust transaction bandwidth exhaustion attack state and outputs a warning signal. The system determines that the current node is in a low-gas dust bandwidth exhaustion attack state. The detection results will be written to the log and fed back to adjust the weight parameters, making the model more accurate in subsequent iterations, forming a self-learning closed loop of detection, feedback and optimization.

[0043] S6. Determine the identification result of the Ethereum network bandwidth attack based on all abnormal nodes.

[0044] In some embodiments of this application, determining the identification result of the Ethereum network bandwidth attack based on all abnormal nodes specifically involves: Determine the number of abnormal nodes based on all abnormal nodes; If the number of abnormal nodes is greater than or equal to a preset abnormal node threshold, it is determined that the Ethereum network is under a bandwidth attack, and the node identifiers corresponding to all abnormal nodes are output; otherwise, the node identifiers corresponding to each abnormal node are output as the identification result.

[0045] Specifically, to fully explain the above steps, the following scheme will be used as an example: like Figure 3 As shown, the entire identification process follows this logic: First, the data acquisition module monitors node communication behavior in real time and sends feature data into the dynamic baseline model for preliminary judgment; if a deviation from the baseline is detected, the model outputs a set of suspicious features; then, the multi-dimensional analysis module performs joint judgment based on the correlation matrix and time series function to calculate the attack confidence; when the confidence exceeds the threshold, the system outputs abnormal nodes; finally, the identification result of the Ethereum network bandwidth attack is determined based on all abnormal nodes.

[0046] In summary, this application's embodiments achieve accurate detection of network attacks through multi-stage processing. First, by acquiring the state vectors of each node at different time points, the dynamic behavioral characteristics of the nodes can be comprehensively captured, providing a rich data foundation for subsequent analysis. Second, an anomaly calculation method is used to evaluate each state vector, combined with a dynamic threshold mechanism to filter abnormal states, effectively avoiding the problem of poor adaptability of static thresholds in dynamic network environments. Then, the node confidence is calculated through anomaly feature sets and a weighted fusion method, ensuring that the judgment process considers not only single anomalies but also the synergistic effect of multiple features, improving the comprehensiveness and reliability of detection. Finally, the attack identification result is determined based on all abnormal nodes, enabling the identification of coordinated attacks from a global perspective, reducing false negatives and false positives. This method achieves a balance between low false positive rate and high efficiency in Ethereum network bandwidth attack detection, providing timely warnings in the early stages of attacks, protecting network resources from exhaustion attacks, and improving the consensus security and operational stability of the blockchain system.

[0047] Example 2 like Figure 4 As shown, based on the above method embodiments, corresponding device embodiments are provided; An embodiment of the present invention provides an identification device for Ethereum network bandwidth attacks, comprising: a data acquisition module 41, a first processing module 42, a second processing module 43, a third processing module 44, a fourth processing module 45, and an identification module 46. Data acquisition module 41 is used to acquire the state vector of each node in the Ethereum network at each point in time; The first processing module 42 is used to traverse each of the nodes and, based on the state vectors of the currently traversed nodes at each of the time points, use an anomaly calculation method to obtain the anomaly degree corresponding to each state vector. The second processing module 43 is used to traverse each of the state vectors. If the anomaly degree corresponding to the currently traversed state vector is greater than or equal to the current dynamic threshold, the currently traversed state vector is output. The current dynamic threshold is determined according to the sliding window mechanism. The third processing module 44 is used to obtain the set of abnormal features corresponding to the currently traversed node based on all output state vectors, and to obtain the confidence level corresponding to the currently traversed node using a weighted fusion method based on the set of abnormal features. The fourth processing module 45 is used to determine that the currently traversed node is an abnormal node if the confidence threshold corresponding to the currently traversed node is greater than or equal to the preset confidence threshold. The identification module 46 is used to determine the identification result of the Ethereum network bandwidth attack based on all abnormal nodes.

[0048] In some embodiments of this application, the first processing module 42 includes a first processing unit and a second processing unit; The first processing unit is used to traverse the state vectors of the currently traversed nodes at each of the time points to obtain the anomaly degree corresponding to each state vector. The second processing unit is configured to, during each traversal, obtain the weighted offset corresponding to each feature dimension based on the feature values, baseline values, and weight coefficients of each feature dimension in the currently traversed state vector, then sum the weighted offsets of each feature dimension to obtain a summation result, and use the summation result as the anomaly degree corresponding to the currently traversed state vector. The baseline values ​​corresponding to each feature dimension are obtained based on a preset dynamic baseline model.

[0049] In some embodiments of this application, the second processing module 43 includes a third processing unit and a fourth processing unit; The third processing unit is used to obtain each historical anomaly value within a sliding window of a preset time length, and to calculate the mean and standard deviation corresponding to each historical anomaly value. The fourth processing unit is used to obtain the current dynamic threshold based on the preset confidence coefficient, the mean and standard deviation of each of the historical anomaly values.

[0050] In some embodiments of this application, the third processing module 44 includes a fifth processing unit, a sixth processing unit, a seventh processing unit, and an eighth processing unit; The fifth processing unit is used to determine the offset corresponding to each feature in the abnormal feature set using an offset calculation method. The sixth processing unit is used to determine a set of collaborative anomaly feature pairs based on the set of anomaly features; wherein the set of collaborative anomaly feature pairs includes several feature pairs; The seventh processing unit is used to calculate the correlation coefficient of each feature pair in the collaborative anomaly feature pair set using the correlation coefficient calculation method, and to determine the weight coefficient of each feature pair in the collaborative anomaly feature pair set according to the preset deep learning model. The eighth processing unit is used to obtain the confidence level of the currently traversed node by using a weighted fusion method based on the correlation coefficients corresponding to each feature pair, the weight coefficients corresponding to each feature pair, and the offsets corresponding to each feature.

[0051] In some embodiments of this application, the identification module 46 includes a first identification unit and a second identification unit; The first identification unit is used to determine the number of abnormal nodes based on all the abnormal nodes; The second identification unit is used to determine that the Ethereum network is under a bandwidth attack if the number of abnormal nodes is greater than or equal to a preset abnormal node threshold, and output the node identifiers corresponding to all abnormal nodes; otherwise, it outputs the node identifiers corresponding to each abnormal node as the identification result.

[0052] For more detailed steps and working principles of this embodiment, please refer to the relevant description in Embodiment 1, but not limited to these descriptions.

[0053] In summary, this application's embodiments achieve accurate detection of network attacks through multi-stage processing. First, by acquiring the state vectors of each node at different time points, the dynamic behavioral characteristics of the nodes can be comprehensively captured, providing a rich data foundation for subsequent analysis. Second, an anomaly calculation method is used to evaluate each state vector, combined with a dynamic threshold mechanism to filter abnormal states, effectively avoiding the problem of poor adaptability of static thresholds in dynamic network environments. Then, the node confidence is calculated through anomaly feature sets and a weighted fusion method, ensuring that the judgment process considers not only single anomalies but also the synergistic effect of multiple features, improving the comprehensiveness and reliability of detection. Finally, the attack identification result is determined based on all abnormal nodes, enabling the identification of coordinated attacks from a global perspective, reducing false negatives and false positives. This method achieves a balance between low false positive rate and high efficiency in Ethereum network bandwidth attack detection, providing timely warnings in the early stages of attacks, protecting network resources from exhaustion attacks, and improving the consensus security and operational stability of the blockchain system.

[0054] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention, and can implement the identification method for Ethereum network bandwidth attacks provided by any of the above-described method embodiments of the present invention.

[0055] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can specifically be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0056] Example 3 Based on the above embodiments of the method for identifying Ethereum network bandwidth attacks, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the method for identifying Ethereum network bandwidth attacks according to any embodiment of the present invention.

[0057] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0058] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0059] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0060] Example 4 Based on the above-described method embodiments, another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the identification method for Ethereum network bandwidth attacks described in any of the above-described method embodiments of the present invention.

[0061] The modules / units integrated in the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0062] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying bandwidth attacks on the Ethereum network, characterized in that, include: Obtain the state vector of each node in the Ethereum network at each point in time; Traverse each node and, based on the state vector of the currently traversed node at each time point, use the anomaly calculation method to obtain the anomaly degree corresponding to each state vector. Iterate through each of the state vectors. If the anomaly degree corresponding to the currently traversed state vector is greater than or equal to the current dynamic threshold, then output the currently traversed state vector. The current dynamic threshold is determined based on the sliding window mechanism. The set of abnormal features corresponding to the currently traversed node is obtained based on all the output state vectors, and the confidence level corresponding to the currently traversed node is obtained by weighted fusion method based on the set of abnormal features. If the confidence threshold corresponding to the currently traversed node is greater than or equal to the preset confidence threshold, then the currently traversed node is determined to be an abnormal node. The identification results of the Ethereum network bandwidth attack were determined based on all the abnormal nodes.

2. The method for identifying Ethereum network bandwidth attacks as described in claim 1, characterized in that, The step of calculating the anomaly degree corresponding to each state vector based on the state vector of the currently traversed node at each of the aforementioned time points, using an anomaly degree calculation method, specifically involves: Traverse the state vectors of the currently traversed nodes at each of the stated time points to obtain the anomaly degree corresponding to each state vector; During each traversal, the weighted offset corresponding to each feature dimension is obtained based on the feature value, the baseline value, and the weight coefficient of each feature dimension in the current traversal state vector. Then, the weighted offsets corresponding to each feature dimension are summed to obtain the summation result, and the summation result is used as the anomaly degree corresponding to the current traversal state vector. The baseline value corresponding to each feature dimension is obtained based on a preset dynamic baseline model.

3. The method for identifying Ethereum network bandwidth attacks as described in claim 1, characterized in that, The current dynamic threshold is determined based on a sliding window mechanism, specifically: Obtain each historical anomaly value within a sliding window of a preset time length, and calculate the mean and standard deviation corresponding to each historical anomaly value; The current dynamic threshold is obtained based on the preset confidence coefficient, the mean and standard deviation of each of the historical anomaly values.

4. The method for identifying Ethereum network bandwidth attacks as described in claim 1, characterized in that, The confidence level of the currently traversed node is obtained by using a weighted fusion method based on the set of abnormal features, specifically as follows: The offset of each feature in the abnormal feature set is determined by using an offset calculation method. A set of collaborative anomaly feature pairs is determined based on the set of anomaly features; wherein, the set of collaborative anomaly feature pairs includes several feature pairs; The correlation coefficient is calculated using the correlation coefficient calculation method for each feature pair in the collaborative anomaly feature pair set, and the weight coefficients for each feature pair in the collaborative anomaly feature pair set are determined according to the preset deep learning model. Based on the correlation coefficients, weight coefficients, and offsets of each feature pair, a weighted fusion method is used to obtain the confidence level of the currently traversed node.

5. A method for identifying Ethereum network bandwidth attacks as described in any one of claims 1-4, characterized in that, The process of determining the identification result of the Ethereum network bandwidth attack based on all abnormal nodes specifically involves: Determine the number of abnormal nodes based on all abnormal nodes; If the number of abnormal nodes is greater than or equal to a preset abnormal node threshold, it is determined that the Ethereum network is under a bandwidth attack, and the node identifiers corresponding to all abnormal nodes are output; otherwise, the node identifiers corresponding to each abnormal node are output as the identification result.

6. A device for identifying bandwidth attacks on the Ethereum network, characterized in that, include: The system includes a data acquisition module, a first processing module, a second processing module, a third processing module, a fourth processing module, and a recognition module. The data acquisition module is used to acquire the state vector of each node in the Ethereum network at each point in time. The first processing module is used to traverse each of the nodes and, based on the state vector of the currently traversed node at each of the time points, use an anomaly calculation method to obtain the anomaly degree corresponding to each state vector. The second processing module is used to traverse each of the state vectors. If the anomaly degree corresponding to the currently traversed state vector is greater than or equal to the current dynamic threshold, the currently traversed state vector is output. The current dynamic threshold is determined according to the sliding window mechanism. The third processing module is used to obtain the set of abnormal features corresponding to the currently traversed node based on all output state vectors, and to obtain the confidence level corresponding to the currently traversed node based on the set of abnormal features using a weighted fusion method. The fourth processing module is used to determine that the currently traversed node is an abnormal node if the confidence threshold corresponding to the currently traversed node is greater than or equal to the preset confidence threshold. The identification module is used to determine the identification result of the Ethereum network bandwidth attack based on all abnormal nodes.

7. The identification device for Ethereum network bandwidth attacks as described in claim 6, characterized in that, The first processing module includes a first processing unit and a second processing unit; The first processing unit is used to traverse the state vectors of the currently traversed nodes at each of the time points to obtain the anomaly degree corresponding to each state vector. The second processing unit is used to obtain the weighted offset corresponding to each feature dimension in each traversal based on the feature value corresponding to each feature dimension, the baseline value corresponding to each feature dimension, and the weight coefficient corresponding to each feature dimension in the current traversal state vector during each traversal, and then sum the weighted offsets corresponding to each feature dimension to obtain the summation result, and use the summation result as the anomaly degree corresponding to the current traversal state vector; wherein, the baseline value corresponding to each feature dimension is obtained according to a preset dynamic baseline model.

8. The identification device for Ethereum network bandwidth attacks as described in claim 6, characterized in that, The second processing module includes a third processing unit and a fourth processing unit; The third processing unit is used to obtain each historical anomaly value within a sliding window of a preset time length, and to calculate the mean and standard deviation corresponding to each historical anomaly value. The fourth processing unit is used to obtain the current dynamic threshold based on the preset confidence coefficient, the mean and standard deviation of each of the historical anomaly values.

9. The identification device for Ethereum network bandwidth attacks as described in claim 6, characterized in that, The third processing module includes a fifth processing unit, a sixth processing unit, a seventh processing unit, and an eighth processing unit; The fifth processing unit is used to determine the offset corresponding to each feature in the abnormal feature set using an offset calculation method. The sixth processing unit is used to determine a set of collaborative anomaly feature pairs based on the set of anomaly features; wherein the set of collaborative anomaly feature pairs includes several feature pairs; The seventh processing unit is used to calculate the correlation coefficient of each feature pair in the collaborative anomaly feature pair set using the correlation coefficient calculation method, and to determine the weight coefficient of each feature pair in the collaborative anomaly feature pair set according to the preset deep learning model. The eighth processing unit is used to obtain the confidence level of the currently traversed node by using a weighted fusion method based on the correlation coefficients corresponding to each feature pair, the weight coefficients corresponding to each feature pair, and the offsets corresponding to each feature.

10. A device for identifying Ethereum network bandwidth attacks as described in any one of claims 6-9, characterized in that, The identification module includes a first identification unit and a second identification unit; The first identification unit is used to determine the number of abnormal nodes based on all the abnormal nodes; The second identification unit is used to determine that the Ethereum network is under a bandwidth attack if the number of abnormal nodes is greater than or equal to a preset abnormal node threshold, and output the node identifiers corresponding to all abnormal nodes; otherwise, it outputs the node identifiers corresponding to each abnormal node as the identification result.

Images