Blockchain-based secure network traffic monitoring and protection method

Abstract

The present application belongs to the technical field of blockchain network flow monitoring, and is especially a security network flow monitoring and protection method based on blockchain, comprising the following steps: mirroring and bypassing collection of all data packets entering and exiting the network; deduplication, outlier filtering and normalization processing of the collected original flow data; encapsulating the pre-processed flow records into blockchain transactions; pre-deploying a monitoring contract on the blockchain, which can subscribe to the blockchain event stream and perform real-time analysis on the newly-chained flow records; and generating a protection instruction after detecting an anomaly by calling the contract. The present application encapsulates the pre-processed flow records into transactions and permanently writes them into a distributed ledger by using the practical Byzantine fault tolerance, proof of stake and delegated proof of stake consensus mechanisms. Any historical flow data can be subjected to range query, aggregate statistics and on-chain playback simulation through a blockchain browser or a query contract, and a one-key export audit report is supported, so that the whole process is transparent and auditable.

Description

Technical Field

[0001] This invention relates to the field of blockchain network traffic monitoring technology, specifically a method for secure network traffic monitoring and protection based on blockchain. Background Technology

[0002] With the rapid development of information technology and the widespread adoption of the internet, networks have become a core component of modern social infrastructure. Network traffic, as the lifeblood of network operation, is directly related to the security of critical national information infrastructure, business continuity for enterprises, and the protection of personal privacy through its monitoring and protection. According to annual cybersecurity reports released by the China National Computer Network Emergency Response Technical Team / Coordination Center of China (CNCERT / CC), cyberattacks have seen explosive growth in recent years. In 2023, more than 100,000 cybersecurity incidents were detected nationwide, with DDoS attacks, traffic hijacking, and data breaches accounting for over 60% of these threats. Traditional network traffic monitoring and protection technologies, primarily relying on centralized architectures, are no longer sufficient to meet the security needs of today's complex, diverse, and distributed network environment. In recent years, blockchain technology, due to its decentralized, immutable, transparent, traceable, and smart contract-automatic execution characteristics, has gradually penetrated the field of cybersecurity. Existing blockchain-related applications mainly include: First, log management systems based on Hyperledger Fabric or Ethereum, which record traffic events as transactions on the chain to achieve distributed ledger storage. However, these systems are mostly general-purpose log records and are not optimized for the high-frequency, high-throughput characteristics of network traffic. Their consensus mechanisms (such as PBFT or PoW) have huge overhead, making it difficult to meet real-time monitoring needs (traditional traffic monitoring requires millions of PPS). Second, blockchain-driven identity authentication and access control solutions (such as DID-based zero-trust architectures) can achieve trusted verification of traffic sources. However, there is a lack of dynamic analysis and coordinated protection of traffic behavior patterns, and the protection response still relies on external centralized engines; thirdly, some patented technologies (such as CN113542214A "A Blockchain-based Network Security Protection Method") propose to share attack events on the chain, but do not incorporate the entire traffic monitoring process (collection, analysis, decision-making, and execution) into the blockchain consensus. The smart contract logic is simple, only supports static rules, and cannot integrate machine learning models or adaptive protection strategies; in addition, patents such as CN112968910A involve traffic scheduling of blockchain + SDN, but are limited to routing optimization and do not solve the problems of tamper-proof and global audit of monitoring data.

[0003] The existing technology has the following defects or problems: 1. Traditional system logs are stored in a central database or SIEM server, which can be deleted or modified by administrators / attackers, resulting in weak audit traceability; 2. Traditional methods collect and transmit raw payloads, IP addresses, ports, etc. in plaintext, which can easily lead to data leaks or violations. 3. Traditional IDS / IPS rely heavily on manual rules or offline analysis. After an anomaly is detected, manual configuration and blocking are required, resulting in long response times and a high risk of missed or false alarms. 4. Under high-frequency traffic, traditional centralized systems are prone to overload and high log processing latency. At the same time, traditional machine learning model updates rely on the central server and are easily polluted.

[0004] It should be noted that the above content falls within the inventor's technical knowledge and does not necessarily constitute prior art. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a blockchain-based method for secure network traffic monitoring and protection, solving the current problems.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a blockchain-based secure network traffic monitoring and protection method, comprising the following steps: Step 1: Mirror and bypass all data packets entering and leaving the network by using sensors and agent software deployed on edge network nodes, core routers, firewalls, and virtualized environments; Step 2: The collected raw traffic data is deduplicated, outlier filtered, and normalized. Sensitive fields are protected using symmetric encryption and a combination of asymmetric encryption and homomorphic encryption. At the same time, data fingerprints are generated. Step 3: Encapsulate the preprocessed traffic records into blockchain transactions. The transaction structure includes data fingerprint, timestamp, node ID, encrypted metadata, and digital signature. At the same time, broadcast the transaction to the blockchain network and use the practical Byzantine fault tolerance, proof-of-stake, and proof-of-authority consensus mechanism to package the transaction into a block and permanently write it into the distributed ledger to ensure that the data is not tampered with, is traceable, and is globally consistent. Step 4: Deploy a monitoring contract on the blockchain in advance. This contract can subscribe to the blockchain event stream and analyze newly added traffic records in real time. The monitoring contract has a built-in lightweight anomaly detection engine that calculates anomaly scores using multi-dimensional feature vectors. When the score exceeds a preset threshold and matches a known attack signature, an alarm is triggered. Step 5: After detecting an anomaly, the protection sub-contract is invoked to generate protection instructions, and the instructions are pushed to network devices through the blockchain's built-in oracle and side link interface. At the same time, the protection action itself is recorded on the chain as a new transaction record, thus forming a closed loop of detection-response-existence. Step Six: Authorize users to call query contracts to perform range queries, aggregate statistics, and on-chain revisit simulations on any historical block on the blockchain, achieving full-process transparent auditing, and the query process itself does not leak the original payload; Step 7: The entire process uses zero-knowledge proof technology to verify the legality of traffic data and anomaly detection structure without exposing the original data. At the same time, the contract implements an attribute-based access control policy, allowing only nodes holding special NFT credentials and meeting KYC conditions to read sensitive subset data.

[0007] In some embodiments, the blockchain adopts one of the consortium blockchain and private blockchain architectures, which limits consensus and verification to nodes of network operators, security service providers and regulatory agencies that have undergone KYC certification. The number of consensus nodes is no less than four and no more than thirty-two, so as to balance performance and security.

[0008] In some embodiments, the execution logs of all the steps are permanently stored on the blockchain in structured JSON format and can be visualized and monitored in real time and exported as audit reports with one click through a public browser and API. The privacy protection adopts verifiable computing technology. The contract only verifies whether the traffic data meets the anomaly detection conditions, without exposing the specific IP, port and payload content. At the same time, all on-chain data only stores hashes and encrypted ciphertexts by default. The original data is only encrypted and stored on the local node, and only the relevant proofs are stored on the chain. The method supports cross-chain interoperability, which interacts with other secure blockchains through standard cross-chain protocols, thereby enabling global threat intelligence sharing and synchronization of joint protection strategies. The deployment environment of the method supports a hybrid cloud-edge architecture, where the edge nodes are responsible for data collection and initial on-chain processing, while the central cloud nodes are responsible for complex contract execution and model training. This forms a layered architecture of edge data collection, blockchain presence, and cloud analytics, ensuring low latency and high availability.

[0009] In some embodiments, the method further includes an abnormal event graded response mechanism: the smart contract classifies events into four levels: low, medium, high, and emergency, based on the abnormality score; the low level only logs events, the medium level triggers a local blockage, the high level triggers a global broadcast alarm, and the emergency level automatically calls the emergency governance contract to suspend some network functions and notify the regulatory node.

[0010] In some embodiments, the network data collection content includes source IP address, destination IP address, source port, destination port, transport layer protocol type, application layer protocol identifier, packet length, arrival timestamp, session duration, payload hash, and optional deep packet inspection metadata.

[0011] In some embodiments, the transaction packaging also includes a sidechain and Layer-2 channel mechanism, which first aggregates high-frequency, low-volume records in batches on the sidechain, generates Merkle root hashes at fixed time windows, and then submits them to the main chain, thereby reducing the main chain's gas consumption and increasing throughput to more than 5,000 transactions per second.

[0012] In some embodiments, the anomaly detection engine includes an on-chain lightweight machine learning model that periodically updates parameters across multiple nodes using federated learning. The model's input features contain at least ten dimensions, and the output is an anomaly probability value of 0-1. This threshold can be dynamically adjusted by voting through the governance contract. The specific model input features are as follows: Feature vector Example dimensions are as follows: For the flow rate, packets / sec and bytes / sec are selected and normalized to [0,1]. For the number of concurrent connections; The source IP diversity entropy is given by the following formula: ; in The probability of each IP address appearing; The deviation value of the protocol distribution is given by the following formula: ; in The proportion of protocols such as TCP / UDP / ICMP; For payload hash collision rate; This represents the average connection duration. For byte rate variance; To achieve diversity of target ports; The SYN / ACK ratio deviates; The skewness of the session duration distribution; Optional extension content; All features are calculated and normalized on-chain in real time using lightweight statistics.

[0013] In some embodiments, the anomaly probability output formula is as follows: ; in, The activation function is sigmoid, and its chain can be implemented using Taylor approximation and pre-computation tables, avoiding the overhead of direct exp. It is a dot product, which is implemented in Solidity using fixed-point multiplication; like If the threshold is reached, it will be judged as abnormal and trigger an alarm and isolation. The dynamic threshold adjustment formula is as follows: ; in, Stored in the contract, updated via DAO voting proposals, with voting weight proportional to staked tokens, thus preventing malicious adjustments.

[0014] In some embodiments, the protection instructions include, but are not limited to, IP blacklist updates, port blocking, rate limiting policies, traffic redirection to honeypots, and session resets; The protection command adopts a standardized format and is pushed to the controlled device only after being confirmed by a multi-signature mechanism. At the same time, the execution structure of the protection command is immediately recorded on the blockchain as a new transaction. The contract can automatically trigger a traffic scrubbing process. The triggering condition is: when a distributed denial-of-service (DDoS) advanced persistent threat is detected, the specific steps are as follows: redirect suspicious traffic to a blockchain-driven distributed scrubbing node cluster, allow only legitimate traffic after scrubbing, and upload the comparison results of traffic before and after scrubbing to the blockchain as undeniable evidence.

[0015] Compared with existing technologies, this invention provides a secure network traffic monitoring and protection method based on blockchain, which has the following beneficial effects: This blockchain-based secure network traffic monitoring and protection method utilizes Practical Byzantine Fault Tolerance (PBFT), Proof-of-Stake (PoS), and Proof-of-Authorization (PoA) consensus mechanisms to encapsulate pre-processed traffic records into transactions and permanently write them to a distributed ledger. Any historical traffic data can be queried, aggregated, statistically analyzed, and simulated on-chain replays via a blockchain explorer or query contract. Furthermore, all execution logs are uploaded to the blockchain in structured JSON format, supporting one-click export of audit reports, achieving full transparency and auditability throughout the entire process. It employs symmetric encryption, asymmetric encryption, and homomorphic encryption to protect sensitive fields, only storing data fingerprints, hashes, and encrypted metadata on-chain. Zero-knowledge proofs are used to verify traffic legitimacy and anomaly detection results, eliminating the need to expose the original payload, IP address, port, etc. Original data is stored encrypted locally, with only proofs stored on-chain. Access control is based on attributes (ABAC), special NFT credentials, and KYC, ensuring only authorized nodes can read sensitive subsets. It also supports verifiable computation; contracts only verify conditions without revealing plaintext, naturally complying with privacy regulations such as GDPR and CCPA. The monitoring contract subscribes to blockchain event streams and incorporates a lightweight anomaly detection engine (multi-dimensional feature vectors + known attack signature matching) and a federated learning-updated on-chain machine learning model (input ≥10-dimensional features, output 0-1 anomaly probability). Upon detecting an anomaly, it immediately invokes the protection sub-contract to generate instructions (IP blacklist, port blocking, rate limiting, traffic redirection to honeypot, session reset, etc.), which are pushed to network devices via an oracle and side-link interface. The protection action itself is recorded on the blockchain as a new transaction, forming a non-repudiable closed loop of "detection-response-proof". Simultaneously, anomaly events also implement a four-level tiered response (low-level logging, medium-level local blocking, high-level global broadcasting, and emergency-level suspension of network functions and notification to regulators), significantly reducing manual intervention. This method uses a sidechain + Layer-2 channel mechanism to aggregate high-frequency, low-volume traffic in batches, generate Merkle tree roots, and then submit them to the main chain, achieving a throughput of over 5,000 transactions per second. Edge nodes are responsible for data collection and initial on-chain processing, while the cloud handles complex contracts and model training, forming a hybrid cloud-edge layered architecture of "edge data collection—blockchain notarization—cloud analysis," ensuring low latency and high availability. The number of consensus nodes is controlled between 4 and 32 to balance security and performance. It also supports standard cross-chain protocols to interact with other secure blockchains, enabling global threat intelligence sharing and joint protection strategy synchronization; in the event of distributed denial-of-service (DDoS) or advanced persistent threats (APT), it can automatically trigger a traffic scrubbing process, and the comparison results before and after scrubbing are recorded on the blockchain as undeniable evidence. Attached Figure Description

[0016] Figure 1 This is a schematic diagram illustrating the implementation process of the blockchain-based secure network traffic monitoring and protection method of the present invention. Detailed Implementation

[0017] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments and accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] It should be understood that the step numbers used in the text are for ease of description only and are not intended to limit the order in which the steps are performed.

[0019] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0020] The terms “comprising” and “including” indicate the presence of the described feature, whole, step, operation, element and / or component, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0021] The term “and / or” refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes these combinations.

[0022] Please see Figure 1 This implementation plan includes a blockchain-based secure network traffic monitoring and protection method, comprising the following steps: Step 1: Mirror and bypass all data packets entering and leaving the network by using sensors and agent software deployed on edge network nodes, core routers, firewalls, and virtualized environments; The network data collection content includes source IP address, destination IP address, source port, destination port, transport layer protocol type, application layer protocol identifier, packet length, arrival timestamp, session duration, payload hash, and optional deep packet inspection metadata; Step 2: The collected raw traffic data is deduplicated, outlier filtered, and normalized. Sensitive fields are protected using symmetric encryption and a combination of asymmetric encryption and homomorphic encryption. At the same time, data fingerprints are generated. Step 3: Encapsulate the preprocessed traffic records into blockchain transactions. The transaction structure includes data fingerprint, timestamp, node ID, encrypted metadata, and digital signature. At the same time, broadcast the transaction to the blockchain network and use the practical Byzantine fault tolerance, proof-of-stake, and proof-of-authority consensus mechanism to package the transaction into a block and permanently write it into the distributed ledger to ensure that the data is not tampered with, is traceable, and is globally consistent. The transaction packaging also includes a sidechain and Layer-2 channel mechanism, which first aggregates high-frequency, small-volume records in batches on the sidechain, generates Merkle root hashes at fixed time windows, and then submits them to the main chain, thereby reducing the main chain's gas consumption and increasing throughput to more than 5,000 transactions per second. Step 4: Deploy a monitoring contract on the blockchain in advance. This contract can subscribe to the blockchain event stream and analyze newly added traffic records in real time. The monitoring contract has a built-in lightweight anomaly detection engine that calculates anomaly scores using multi-dimensional feature vectors. When the score exceeds a preset threshold and matches a known attack signature, an alarm is triggered. The anomaly detection engine includes a lightweight on-chain machine learning model. This model updates its parameters periodically across multiple nodes using a federated learning approach. The model's input features contain at least ten dimensions, and the output is an anomaly probability value of 0-1. This threshold can be dynamically adjusted by voting through the governance contract. The specific input features of the model are as follows: Feature vector Example dimensions are as follows: For the flow rate, packets / sec and bytes / sec are selected and normalized to [0,1]. For the number of concurrent connections; The source IP diversity entropy is given by the following formula: ; in The probability of each IP address appearing; The deviation value of the protocol distribution is given by the following formula: ; in The proportion of protocols such as TCP / UDP / ICMP; For payload hash collision rate; This represents the average connection duration. For byte rate variance; To achieve diversity of target ports; The SYN / ACK ratio deviates; The skewness of the session duration distribution; Optional extension content; All features are calculated and normalized in real time on-chain using lightweight statistics; The formula for outputting the anomaly probability is as follows: ; in, The activation function is sigmoid, and its chain can be implemented using Taylor approximation and pre-computation tables, avoiding the overhead of direct exp. It is a dot product, which is implemented in Solidity using fixed-point multiplication; like If the threshold is reached, it will be judged as abnormal and trigger an alarm and isolation. The dynamic threshold adjustment formula is as follows: ; in, Stored in the contract, updated through DAO voting proposals, with voting weight proportional to staked tokens, thus preventing malicious adjustments; Step 5: After detecting an anomaly, the protection sub-contract is invoked to generate protection instructions, and the instructions are pushed to network devices through the blockchain's built-in oracle and side link interface. At the same time, the protection action itself is recorded on the chain as a new transaction record, thus forming a closed loop of detection-response-existence. Protection commands include, but are not limited to, IP blacklist updates, port blocking, rate limiting policies, traffic redirection to honeypots, and session resets; The protection command adopts a standardized format and is pushed to the controlled device only after being confirmed by a multi-signature mechanism. At the same time, the execution structure of the protection command is immediately recorded on the blockchain as a new transaction. The contract can automatically trigger a traffic scrubbing process. The triggering condition is: when a distributed denial-of-service machine advanced persistent threat is detected, the specific steps are as follows: redirect suspicious traffic to a blockchain-driven distributed scrubbing node cluster, and after scrubbing, only legitimate traffic is allowed to pass. At the same time, the comparison results of traffic before and after scrubbing are uploaded to the chain as undeniable evidence. Step Six: Authorize users to call query contracts to perform range queries, aggregate statistics, and on-chain revisit simulations on any historical block on the blockchain, achieving full-process transparent auditing, and the query process itself does not leak the original payload; Step 7: The entire process uses zero-knowledge proof technology to verify the legality of traffic data and anomaly detection structure without exposing the original data. At the same time, the contract implements an attribute-based access control policy, allowing only nodes holding special NFT credentials and meeting KYC conditions to read sensitive subset data.

[0023] The following should be noted in this embodiment: The blockchain adopts one of the consortium blockchain and private blockchain architectures. Only network operators, security service providers and regulatory agencies that have been KYC certified can participate in consensus and verification. The number of consensus nodes is no less than four and no more than thirty-two, so as to balance performance and security. The execution logs for all the above steps are permanently stored on the blockchain in structured JSON format and can be visualized and monitored in real time and exported as audit reports with one click through a public browser and API. Privacy protection employs verifiable computation technology. Contracts only verify whether traffic data meets anomaly detection conditions without exposing specific IPs, ports, or payload content. Meanwhile, all on-chain data is stored by default only in hashes and encrypted ciphertexts, and raw data is only stored encrypted on local nodes. Only relevant proofs are stored on the chain. This embodiment supports cross-chain interoperability, which interacts with other secure blockchains through standard cross-chain protocols to achieve global threat intelligence sharing and synchronization of joint protection strategies; The deployment environment of this embodiment supports a hybrid cloud-edge architecture. Edge nodes are responsible for data collection and initial on-chain processing, while central cloud nodes are responsible for complex contract execution and model training. This forms a layered architecture of edge data collection, blockchain presence, and cloud analytics, ensuring low latency and high availability.

[0024] This embodiment further includes an abnormal event graded response mechanism: the smart contract classifies events into four levels: low, medium, high, and emergency, based on the abnormality score; the low level only records logs, the medium level triggers local blocking, the high level triggers a global broadcast alarm, and the emergency level automatically calls the emergency governance contract to suspend some network functions and notify the regulatory node.

[0025] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0026] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure network traffic monitoring and protection method based on blockchain, characterized in that, Includes the following steps: Step 1: Mirror and bypass all data packets entering and leaving the network by using sensors and agent software deployed on edge network nodes, core routers, firewalls, and virtualized environments; Step 2: The collected raw traffic data is deduplicated, outlier filtered, and normalized. Sensitive fields are protected using symmetric encryption and a combination of asymmetric encryption and homomorphic encryption. At the same time, data fingerprints are generated. Step 3: Encapsulate the preprocessed traffic records into blockchain transactions. The transaction structure includes data fingerprint, timestamp, node ID, encrypted metadata, and digital signature. At the same time, broadcast the transaction to the blockchain network and use the practical Byzantine fault tolerance, proof-of-stake, and proof-of-authority consensus mechanism to package the transaction into a block and permanently write it into the distributed ledger to ensure that the data is not tampered with, is traceable, and is globally consistent. Step 4: Deploy a monitoring contract on the blockchain in advance. This contract can subscribe to the blockchain event stream and analyze newly added traffic records in real time. The monitoring contract has a built-in lightweight anomaly detection engine that calculates anomaly scores using multi-dimensional feature vectors. When the score exceeds a preset threshold and matches a known attack signature, an alarm is triggered. Step 5: After detecting an anomaly, the protection sub-contract is invoked to generate protection instructions, and the instructions are pushed to network devices through the blockchain's built-in oracle and side link interface. At the same time, the protection action itself is recorded on the chain as a new transaction record, thus forming a closed loop of detection-response-existence. Step Six: Authorize users to call query contracts to perform range queries, aggregate statistics, and on-chain revisit simulations on any historical block on the blockchain, achieving full-process transparent auditing, and the query process itself does not leak the original payload; Step 7: The entire process uses zero-knowledge proof technology to verify the legality of traffic data and anomaly detection structure without exposing the original data. At the same time, the contract implements an attribute-based access control policy, allowing only nodes holding special NFT credentials and meeting KYC conditions to read sensitive subset data.

2. The blockchain-based secure network traffic monitoring and protection method according to claim 1, characterized in that: The blockchain adopts one of the consortium blockchain and private blockchain architectures, and only KYC-certified network operators, security service providers and regulatory agencies are allowed to participate in consensus and verification. The number of consensus nodes is no less than four and no more than thirty-two, so as to balance performance and security.

3. The blockchain-based secure network traffic monitoring and protection method according to claim 1, characterized in that: The execution logs of all the steps are permanently stored on the blockchain in structured JSON format and can be monitored in real time and exported as audit reports with one click through a public browser and API. The privacy protection adopts verifiable computing technology. The contract only verifies whether the traffic data meets the anomaly detection conditions, without exposing the specific IP, port and payload content. At the same time, all on-chain data only stores hashes and encrypted ciphertexts by default. The original data is only encrypted and stored on the local node, and only the relevant proofs are stored on the chain. The method supports cross-chain interoperability, which interacts with other secure blockchains through standard cross-chain protocols, thereby enabling global threat intelligence sharing and synchronization of joint protection strategies. The deployment environment of the method supports a hybrid cloud-edge architecture, where the edge nodes are responsible for data collection and initial on-chain processing, while the central cloud nodes are responsible for complex contract execution and model training. This forms a layered architecture of edge data collection, blockchain presence, and cloud analytics, ensuring low latency and high availability.

4. The blockchain-based secure network traffic monitoring and protection method according to claim 1, characterized in that: The method further includes an abnormal event graded response mechanism: the smart contract classifies events into four levels: low, medium, high, and emergency, based on the abnormality score; the low level only records logs, the medium level triggers local blocking, the high level triggers a global broadcast alarm, and the emergency level automatically calls the emergency governance contract to suspend some network functions and notify the regulatory node.

5. The blockchain-based secure network traffic monitoring and protection method according to claim 1, characterized in that: The network data collection content mentioned in step one includes source IP address, destination IP address, source port, destination port, transport layer protocol type, application layer protocol identifier, packet length, arrival timestamp, session duration, payload hash, and optional deep packet inspection metadata.

6. The blockchain-based secure network traffic monitoring and protection method according to claim 1, characterized in that: The transaction packaging described in step three also includes a sidechain and Layer-2 channel mechanism, which first aggregates high-frequency, low-volume records in batches on the sidechain, generates Merkle root hashes at fixed time windows, and then submits them to the main chain, thereby reducing the main chain's gas consumption and increasing throughput to more than 5,000 transactions per second.

7. The blockchain-based secure network traffic monitoring and protection method according to claim 1, characterized in that: The anomaly detection engine described in step four includes an on-chain lightweight machine learning model. This model periodically updates its parameters across multiple nodes using a federated learning approach. The model's input features contain at least ten dimensions, and its output is an anomaly probability value of 0-1. This threshold can be dynamically adjusted by voting through the governance contract. The specific input features of the model are as follows: Feature vector Example dimensions are as follows: For the flow rate, packets / sec and bytes / sec are selected and normalized to [0,1]. For the number of concurrent connections; The source IP diversity entropy is given by the following formula: ; in The probability of each IP address appearing; The deviation value of the protocol distribution is given by the following formula: ; in The proportion of protocols such as TCP / UDP / ICMP; For payload hash collision rate; This represents the average connection duration. For byte rate variance; To achieve diversity of target ports; The SYN / ACK ratio deviates; The skewness of the session duration distribution; Optional extension content; All features are calculated and normalized on-chain in real time using lightweight statistics.

8. The method for monitoring and protecting secure network traffic based on blockchain according to claim 7, characterized in that: The formula for outputting the anomaly probability is as follows: ； in, The activation function is sigmoid, and its chain can be implemented using Taylor approximation and pre-computation tables, avoiding the overhead of direct exp. It is a dot product, which is implemented in Solidity using fixed-point multiplication; like If the threshold is reached, it will be judged as abnormal and trigger an alarm and isolation. The dynamic threshold adjustment formula is as follows: ； in, Stored in the contract, updated via DAO voting proposals, with voting weight proportional to staked tokens, thus preventing malicious adjustments.

9. The method for monitoring and protecting secure network traffic based on blockchain according to claim 1, characterized in that: The protection commands mentioned in step five include, but are not limited to, updating the IP blacklist, blocking ports, rate limiting policies, redirecting traffic to honeypots, and resetting sessions; The protection command adopts a standardized format and is pushed to the controlled device only after being confirmed by a multi-signature mechanism. At the same time, the execution structure of the protection command is immediately recorded on the blockchain as a new transaction. The contract can automatically trigger a traffic scrubbing process. The triggering condition is: when a distributed denial-of-service (DDoS) advanced persistent threat is detected, the specific steps are as follows: redirect suspicious traffic to a blockchain-driven distributed scrubbing node cluster, allow only legitimate traffic after scrubbing, and upload the comparison results of traffic before and after scrubbing to the blockchain as undeniable evidence.

Images