Blockchain Host Security Monitoring for Tamper-Proof Intrusion Tracing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current host security monitoring technologies suffer from poor accuracy and detection blind spots due to complex network topologies, lack of unified log synchronization, and vulnerability to log tampering, making it difficult to detect and trace sophisticated cyber attacks effectively.
Innovation Solution
A blockchain-based host security monitoring method that utilizes traffic analysis and local scanning, combined with pre-trained machine learning models (SVM and random forest) to identify malicious traffic, and decentralized log storage to ensure accurate and credible monitoring, enabling timely sharing of security state information and intrusion logs across a blockchain network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Area of stationary object
If security intrusion detection devices are distributed at various network nodes and edges, then the coverage of detection is improved, but the ability to determine successful host compromise and trace attack paths deteriorates due to detection blind spots
Solution Approach 1:
The patent divides the security monitoring system into two independent blockchain chains: a security state blockchain for recording host security states, and a log storage blockchain for storing intrusion logs. This segmentation allows each chain to specialize in specific functions, improving both detection coverage and precision without the blind spots of unified centralized monitoring.
Solution Approach 2:
The patent introduces blockchain technology as an intermediary between distributed detection devices and central analysis systems. The blockchain network acts as a trusted mediator that collects, verifies, and stores security data from multiple sources, enabling accurate host compromise determination and attack path tracing while maintaining broad detection coverage.
2Ease of operation
If log records are stored in centralized systems, then the ease of access and analysis is improved, but the reliability and integrity of logs deteriorates due to vulnerability to tampering and deletion by attackers
Solution Approach 1:
The patent applies preliminary hashing to log data before storage, creating cryptographic fingerprints of the original logs. This preliminary action ensures that any subsequent tampering can be detected by comparing the stored hash with the hash of the retrieved data, maintaining log integrity while preserving easy access through the blockchain's query capabilities.
Solution Approach 2:
The blockchain network serves as an intermediary storage layer between log generation systems and analysis systems. It provides both the ease of access needed for analysis and the reliability needed for integrity, as the distributed ledger structure prevents tampering while allowing efficient querying through blockchain nodes.
3Device complexity
If traditional intrusion detection methods are used, then the device complexity is kept low, but the monitoring accuracy and ability to detect sophisticated attacks deteriorates due to detection blind spots in complex network topologies
Solution Approach 1:
The patent creates a universal blockchain-based monitoring framework that can detect multiple types of attacks across complex network topologies through a unified architecture. The system handles various intrusion scenarios (network attacks, host compromises, data theft) using the same blockchain infrastructure, improving detection accuracy without proportionally increasing device complexity.
Solution Approach 2:
The patent uses cryptographic hashing to create copies of log data and security state information that are stored immutably on the blockchain. These cryptographic copies serve as verified replicas of the original data, enabling accurate attack detection and forensics without requiring complex verification mechanisms at each detection node.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The present disclosure relates to the technical field of computers, and in particular to a blockchain-based host security monitoring method and apparatus, a computer readable medium and an electronic device. The host security monitoring method in the embodiments of the present disclosure comprises: monitoring traffic data of a host in network communication, and determining whether the traffic data is malicious traffic; if the traffic data is malicious traffic, obtaining security state information of the host, and saving the security state information to a security state blockchain; generating an invasion log corresponding to the malicious traffic, and saving the invasion log and the security state information to a log storage blockchain. The method has the advantages of high monitoring accuracy and good reliability.