Detecting Blockchain Security Threats

Abstract

In many organizations, permissioned blockchain networks are currently transitioning from a proof-of-concept stage to production use. A crucial part of this transition is ensuring awareness of potential threats to network operations. Due to the plethora of software components involved in distributed ledgers, threats may be difficult or impossible to detect without a structured monitoring approach. To this end, we conduct a survey of attacks on permissioned blockchains and develop a set of threat indicators. To gather these indicators, a data processing pipeline is proposed to aggregate log information from relevant blockchain components, enriched with data from external sources. To evaluate the feasibility of monitoring current blockchain frameworks, we determine relevant data sources in Hyperledger Fabric. Our results show that the required data is mostly available, but also highlight significant improvement potential with regard to threat intelligence, chaincode scanners and built-in metrics.

HyperSec: Visual Analytics for Blockchain Security Monitoring

“…They introduce some respective metrics while using both node logs and Remote Procedure Calls (RPC) to gather data. Threat indicators to detect malicious activities in a blockchain network have recently been introduced by Putz et al [17]. Based on this limited body of work from academia, blockchain metrics and threat indicators need to be made available to security experts for effective monitoring.…”

“…The Identify function serves to identify relevant assets and risks. This problem has been already addressed in prior work [17]. Protect involves a variety of protection measures applied to the system: identity management and access control, data security, secure configuration, and backups/log files, among others.…”

“…To illustrate the monitoring task's complexity, we show an overview of possible attacks in an attack tree notation in Figure 2. The listed attacks are based on prior work [17,16] and related literature surveys [6,8]. For each leaf on the tree, there are various ways to successfully deploy the attack, which we did not include for conciseness.…”

“…The first two authors have contributed equally to this manuscript. arXiv:2103.14414v1 [cs.CR] 26 Mar 2021 sources from its components, making it difficult to obtain an overview of the network's state [17]. Since blockchain is a networked database, it also requires monitoring both the host and the network, which results in a large volume and velocity of observable data.…”

Standalone Behaviour-Based Attack Detection Techniques for Distributed Software Systems via Blockchain

“…By comparative screening and looking up related studies, we find that the relationship between detection and blockchain in terms of dependency is a reciprocal relationship; hence, the studies in this field can be divided into two main categories. The first category is the blockchain-based systems or blockchain technology itself, which need to enhance their own detection techniques [24]; thus, the work in these studies is to propose and develop appropriate detection techniques for these blockchain systems [25,26]. The second category is the detection techniques, which still need to overcome some of the challenges facing them, especially in a distributed environment in which integrating blockchain with these detection techniques could result in a promising solution for them and their target domains [27].…”