From: Blockchain abnormal behavior awareness methods: a survey
Network behavior | Behavior consequences | Awareness difficulty | Awareness methods | Technical details | Awareness accuracy | Awareness speed | Awareness availability | Advantage | Disadvantage | Quantitative performance | Data using |
---|---|---|---|---|---|---|---|---|---|---|---|
Eclipse attack | Isolate the target node | Hard | Based on game theory | Enhanced search technology based on dynamic voting mechanism (Ismail et al. 2015) | Low | – | Medium | Using fully decentralized | Need to reconfigure the routing table andrelated protocols | Look up success rate: 90–99% Malicious detection rate: 55–60% (depends on parameters) | Self-made data set by OMNeT++ simulator (Pongor 1993) and OverSim (Baumgart et al. 2007) |
Based on supervised learning | Use random forest classification algorithm to detect traffic packets (Xu et al. 2020) | Medium | Fast | High | Fast speed and high robustness | Rely on the label accuracy of the attack data set | Precision: 71% Recall: 95% F1: 0.81% | Access connection packets in Ethereum network with attacks they made by script | |||
Based on probabilistic model | Suspicious block timestamp warning (Alangot et al. 2020) | High | Slow | High | Easy to deploy, no need to change network configuration and protocols | Too slow | Attack detection time: 3 h Malicious detection rate: 100% Need very long time | Bitcoin block heads information in 2018–2019 | |||
Based on pattern matching | Gossip protocol traffic analysis (Alangot et al. 2020) | High | Fast | Medium | Fast speed, no need to change network configur- ation and protocols | Detection nodes are not easy to deploy | Attack detection time: immediate Malicious detection rate: 97.58% | ||||
Selfish mining | Malicious competition for block rewards | Hard | Based on game theory | Block transaction additional expected confirmation height (Saad et al. 2019) | High | Fast | Low | Does not affect the growth and confirmation rate of the blockchain itself | Loss of a certain transaction fee, need to change the block structure | Success attack needs to reach 50% hash rate | Bitcoin network |
Based on probabilistic model | Fork height simulation statistics (Chicarino et al. 2020) | – | – | – | Analyze the fork probability caused by multiple attackers’ hash rates in a simulated environment | Can only be tested in a small-scale simulation network | Success attack needs to reach 30% hash rate | Bitcoin network with simulation attacks by NS3 (Gervais et al. 2016) | |||
51% Attack | Double spend or malicious competition | Easy | – | Monitor large transa- ctions and the time of block production in the mining pool | High | Fast | High | Fast speed and high robustness | – | – | – |