Network Traffic Forensics and Traceability Technology Based on Blockchain
Zhenhao Lv, Xinyue Yang, Jianxiao Yu, Liancheng Li, Aodi Liu, Chenhao Li · 2023
With the development of network information technology, Cyber attacks keep cropping up and the means are becoming more complex and diverse. Network attacks often use technologies such as network springboards and botnets to resist tracking. The existing single-node forensics traceability method from the perspective of defense has the problem of fragmentation and serious fragmentation of evidence data, making many valuable data become islands of information, which can not form a highly reliable attack chain and is difficult to be used for accountability of network protection. What's more, there are performance bottlenecks and security risks, which also lead to frequent user data leakage incidents. To solve these problems, this paper proposes a network traffic forensics and traceability technology based on blockchain which based on the decentralization and non-tampering characteristics of blockchain and we combined it with the off-chain database to realize the on-chain and off-chain distributed data storage library. At the same time, SM3 encryption algorithm and SM2 digital signature algorithm are used to protect the security and integrity of stored data, and Bloom filter is used to realize efficient retrieval and traceability. On the premise of protecting the security of storage information, the cost of forensics and traceability is reduced, and the efficiency of data utilization is improved. Compared with the existing forensic traceability methods, it is verified that this model has certain advantages and good scalability in some aspects. The effectiveness of the proposed method is verified by comparative experiments, and the performance is evaluated as well.