Mitigating blockchain attack

Patent metadata

Field	Value
Publication number	US-9807106-B2
Application number	US-201615223261-A
Country	US
Kind code	B2
Filing date	Jul 29, 2016
Priority date	Jul 31, 2015
Publication date	Oct 31, 2017
Grant date	Oct 31, 2017

Abstract

A computer implemented method for detecting malicious events occurring with respect to a blockchain data structure comprising: defining a transaction creation profile according to which transactions can be generated and submitted to the blockchain; submitting a transaction to the blockchain, the transaction causing the generation of a profiler data structure in the blockchain including executable code to generate profile transactions to be submitted to the blockchain according to the transaction creation profile; monitoring the blockchain to identify profile transactions; and comparing identified profile transactions with the transaction creation profile to detect a deviation from the transaction creation profile, such detection corresponding to a malicious event occurring with respect to the blockchain.

First claim

The invention claimed is:

1. A computer implemented method for detecting malicious attacks presenting a threat to a blockchain associated with a blockchain data structure of a computing device comprising:
defining by the computing device a transaction creation profile according to which transactions can be generated and submitted to the blockchain;
submitting a transaction to the blockchain, the transaction causing the generation of a profiler data structure in the blockchain including executable code to generate profile transactions to be submitted to the blockchain according to the transaction creation profile;
monitoring by the computing device the blockchain to identify profile transactions based on profile transactions submitted by the profile data structure generated in the blockchain; and
comparing identified profile transactions with the transaction creation profile to detect a deviation from the transaction creation profile, such detection corresponding to a malicious attack occurring with respect to the blockchain.

2. A method according to claim 1 , wherein the profile transactions include an address of the profiler data structure, and wherein monitoring the blockchain includes monitoring transactions including the address of the profiler data structure.

3. A method according to claim 1 , further comprising repeatedly generating transactions directed to the profiler data structure and submitted to the blockchain so as to trigger execution of the executable code of the profiler data structure.

4. A method according to claim 1 , wherein transactions submitted to the blockchain are processed by miner software components to validate the transactions and commit the transactions to a block for addition to the blockchain.

5. A method according to claim 1 , further comprising, in response to the detection of a deviation from the transaction creation profile, generating a notification signal for communication to one or more entities operating with the blockchain to flag the malicious event.

6. A method according to claim 1 , further comprising, in response to the detection of a deviation from the transaction creation profile, ceasing operation with the blockchain.

7. A computer program product embodied in a non-transitory computer-readable storage medium having computer program code to, when loaded into a computer system and executed thereon, cause the computer to perform the method as claimed in claim 1 .

8. A computer system to detect malicious attacks presenting a threat to a blockchain associated with a blockchain data structure, the computer system comprising:
a processor device and a data store, wherein the processor device is configured to:
define a transaction creation profile according to which transactions can be generated and submitted to the blockchain;
submit a transaction to the blockchain, the transaction causing the generation of a profiler data structure in the blockchain including executable code to generate profile transactions to be submitted to the blockchain according to the transaction creation profile;
monitor the blockchain to identify profile transactions based on profile transactions submitted by the profile data structure generated in the blockchain; and
compare identified profile transactions with the transaction creation profile to detect a deviation from the transaction creation profile, such detection corresponding to a malicious attack occurring with respect to the blockchain.

9. The computer system of claim 8 , wherein the profile transactions include an address of the profiler data structure, and wherein monitoring the blockchain includes monitoring transactions including the address of the profiler data structure.

10. The computer system of claim 8 , wherein the processor device is further adapted to repeatedly generate transactions directed to the profiler data structure and submitted to the blockchain so as to trigger execution of the executable code of the profiler data structure.

11. The computer system of claim 8 , wherein transactions submitted to the blockchain are processed by miner software components to validate the transactions and commit the transactions to a block for addition to the blockchain.

12. The computer system of claim 8 , wherein the processor device is further adapted to, in response to the detection of a deviation from the transaction creation profile, generate a notification signal for communication to one or more entities operating with the blockchain to flag the malicious event.

13. The computer system of claim 8 , wherein the processor device is further adapted to, in response to the detection of a deviation from the transaction creation profile, cease operation with the blockchain.

Assignees

• British Telecomm

Inventors

• Daniel Joshua
• Ducatel Gery
• Dimitrakos Theo

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06Q2220/00

  Business processing using cryptography · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06Q20/065

  using e-cash · CPC title