Abstract
This paper studies the detection model of network access data tampering attack based on blockchain technology to solve the problem of over-dependence on central server and easy data tampering in traditional network environment. The model uses decentralization and encryption technology to monitor user behavior in real time through smart contracts, enhances data protection with SHA-256 hash algorithm, and combines consensus algorithm to ensure data consistency and security. The experimental results show that the model performs well in detecting multiple attack types with an accuracy of 99.51% and an F1 score of 0.98, far exceeding traditional methods and other deep learning techniques. The model shows good robustness under multi-node attacks, even with 200 attack nodes, the recognition accuracy is still close to 90%, and the response time is less than 3 seconds. Cross-platform testing showed that the model quickly and consistently detected tampering on both Ethereum and Hyperledger, with an average detection time between 0.33 and 0.47 seconds.The hardware acceleration test further shows that the processing speed and hardware utilization of TPU and GPU have been improved, with TPU processing speed reaching 135 MB/s and GPU 122 MB/s. This study will provide a theoretical basis for improving the security, effectiveness and reliability of current network systems, and also lay a solid theoretical and technical foundation for network applications in future network environments.
Keywords
Introduction
In the context of digital economy, information security issues are particularly prominent, and the issue of protecting information security for individuals, enterprises and countries is particularly prominent. Over-reliance on distributed servers will lead to a large amount of data being tampered with once attacked. Cyber violence not only causes serious damage to the legitimate rights of network users, but also has a profound impact on public order and national security. Although a variety of security measures have been proposed, there are still major scientific problems in the process of effectively detecting and defending access to data.
In response to the current problems of excessive reliance on central servers for Internet access data and the easy tampering of Internet access data, this paper applies a network access data tampering attack detection technology based on blockchain technology. A new distributed encryption algorithm is studied to ensure the security and stability of data.
The study proves that the applied method can effectively distinguish multiple types of attacks, such as single point failure attack, multi-point collaborative attack, attack sample generation and attack avoidance, and has a good application prospect in practical applications. Progress in this area is a necessary condition for ensuring the security of important information assets and networks. This model combines improvements in distributed architecture, consistency mechanism, smart contract management, and data cryptography. The research results of this project will provide an effective solution to the problem of illegal information processing in Internet access, further improve existing research results, and lay a good foundation for further improving the security and reliability of the network, lay a theoretical foundation for the development of new security protection technologies, and provide strong technical support for coping with increasingly complex network security issues and protecting user privacy. This project designs a new theory and new method based on multidisciplinary intersection to provide new ideas for improving the security and credibility of information systems. The major contributions of this article are:
Distributed computing method based on distributed structure solves the problem of excessive dependence of existing architecture on a single central server, and performs distributed authorization on multiple nodes to reduce the loss caused by centralized failure to the system and ensure the overall security of the system. Research on issues such as data access permissions, access frequency, and data anomaly detection in network environments, and provide solutions that are suitable for them. The distributed nature of blockchain has significant advantages in enhancing transparency, anti-tampering, and anti-tampering capabilities. Adopting a decentralized configuration mode reduces dependence on a single server and improves the security and robustness of the server. The multi-node structure proposed in this project can effectively reduce attacks on the network, improve the reliability and availability of the system, and provide a more secure environment for information transmission and processing. Research cryptography methods based on 256-bit hash (SHA-256), and carry out related theoretical and experimental research. On the basis of ensuring data security, effective defense against data theft and tampering is carried out. Experimental results show that this method can better protect users’ privacy and improve the overall security performance of the system.
To maintain the security of network access data, many scholars have made a series of explorations. Some scholars have chosen to study firewall technology [1, 2] to resist attacks and protect network security. Stergiou C L [3] and others combined the Internet of Things, cloud computing and edge computing to build a decision-making system, providing users with a more secure and efficient environment for browsing the Internet, sharing and managing large data. Wang F et al. [4] explored the design issues of data security and privacy in future intelligent networks and emphasized the reasons why data protection technologies in the Internet of Things and cloud computing could not be directly applied in future intelligent networks. Bandari V [5] conducted a survey on commonly used data security measures for protecting sensitive data in enterprises, and conducted an in-depth analysis of the effectiveness of different data security measures, as well as the differences in data security practices across different industries and organizational types. Ravi N et al. [6] proposed a machine learning algorithm to supervise network nodes for intrusion detection, and their results showed an accuracy of 99.78% in attack detection. Kim H [7] analyzed five new security issues for each 5G component and classified network attacks on nine network protocols. His research results are expected to serve as the foundational data for modeling the 5th-generation mobile communication technology (5G) security threats. Although the above studies have proposed some methods for maintaining the security of network access data, they still have not solved the problem of centralized servers being prone to single points of failure and data tampering being difficult to detect in a timely manner.
Blockchain technology is a decentralized distributed database technology [8]. It allows users to synchronize data in the network through consensus mechanisms, and the entire synchronization process is encrypted to ensure the security of data from all parties [9, 10]. Attaran M [11] identified the challenges and opportunities of implementing blockchain technology in the healthcare sector, and summarized blockchain products related to health as well as major enterprises providing solutions in different application areas. Alsharari N [12] combined blockchain technology with the Internet of Things to propose a new model to improve the efficiency and accuracy of cryptocurrency transactions. Sekar S et al. [13] used blockchain technology to establish an autonomous transaction model for e-commerce management, which can capture user data, process it, and provide a visual representation of the processed data. Lee S B et al. [14] introduced 5 types of blockchain architectures and core technologies, discussed the application services utilizing blockchain, and provided reference for future blockchain research and service development. Gad A G et al. [15] conducted a rigorous discussion on the application of blockchain in various fields and different common cases, and introduced the public challenges and potential future developments in the field of blockchain.
In recent years, several high-profile incidents have highlighted the urgent need for robust data integrity measures. In 2017, the Equifax data breach exposed the personal information of 147 million people due to tampered access logs that went undetected for months. In 2018, hackers modified some information on the Ticketmaster website, causing ticket fraud and huge financial losses. This incident exposed the vulnerability of traditional central control systems when attacked, including privacy leakage, financial losses, and reputation damage. The above situation highlights the need for distributed methods, such as blockchain technology, to ensure the integrity of data and improve the security of the network.
Detection model
Architecture design of model
The research designs the framework of this model, as shown in Fig. 1.
Architecture diagram of the detection model.
The architecture of the model is shown in Fig. 1. When the network is connected, the information is transmitted to the blockchain, and then a new block is generated according to a certain consensus algorithm. This process allows each node to store and access data, thereby ensuring the security and integrity of the data.
When generating new blocks, smart contracts are used to monitor the behavior of users. Smart contracts are an automated protocol based on blockchain technology that is used to implement, verify or implement terms. Generally speaking, if no abnormal behavior is found, the user can proceed to the next step. However, once an abnormal situation is detected, the system will immediately take appropriate security measures. The security response mechanism is to defend against various possible attacks to ensure the security of information in the network.
All data contained in the newly generated data block needs to be distributed verified. Distributed verification technology can effectively prevent errors or malicious attacks on a single node through independent verification between nodes. If the data cannot be verified, the system will trigger a security response and the data will be stored in the blockchain. This mechanism effectively prevents the tampering and dissemination of data.
The verified data will be stored in the blockchain and a unique hash value will be generated using a hash algorithm. A hash algorithm is an algorithm that converts an input of arbitrary length into a fixed-length output, and the resulting hash ensures that the data cannot be tampered with after storage, as even small changes can result in significant changes in the hash value. The application of hashing algorithm effectively guarantees the integrity and invariance of data.
This model has a wide prospect in practical application. Through blockchain technology, many problems existing in traditional network data management can be effectively solved. For example, in the financial sector, blockchain-based models can ensure the immutability of transaction records and prevent fraud. In the medical field, patients’ medical data can be securely stored and accessed through blockchain technology, guaranteeing data privacy and integrity. In the field of iot, data interaction between devices is protected by blockchain technology, preventing data from being tampered with and attacked.
Consensus algorithm is the core means to achieve consistency algorithm, common consensus algorithms include Proof of Work (PoW), Proof of Stake (PoS) and Proof of Space (PoSpace). The network access data tampering attack detection model based on blockchain technology chooses proof-of-work (PoW) as the consensus algorithm because PoW has significant advantages in a decentralized environment.
The proof-of-work consensus algorithm ensures the security and immutability of data by requiring nodes to complete complex computing tasks. In order to build a new data set, a node must first solve a difficult problem, which is called “mining”. In a distributed network, in order to ensure the integrity and consistency of information in the network, this paper designs a reward mechanism to motivate nodes in the network.
The load confirmation algorithm was selected as the consistency algorithm for the following reasons: A load confirmation mechanism is adopted to enable each node to complete certain relatively complex operations to ensure the security of the data and resist tampering. If a malicious person tries to falsify a data packet, he must accumulate the data and other data. This algorithm is complex to calculate, takes a long time, is complex to calculate, and has high costs. By rewarding nodes, nodes can actively participate in the network. Nodes participating in mining must not only pay a certain fee, but also ensure the normal operation of the blockchain. This method can ensure the consistency and integrity of data in a decentralized network environment, so that it can operate effectively without central authority. In terms of ensuring data security, the use of load authentication can effectively reduce the cost and difficulty of being attacked, thereby ensuring the reliability and tamper resistance of the system. This method requires a lot of computing power, so even if you have more than half of the computing resources, it is quite difficult to change it. The use of load confirmation technology is an important means to improve the overall network security. The applied method is used in mainstream blockchains such as Bitcoin and Ethereum. These cases fully demonstrate the effectiveness and reliability of the proof-of-work algorithm in ensuring data consistency, security and immutability.
Monitoring of smart contracts
This is a protocol that can automate computers and restrict the access behavior of Internet users to a certain extent. The preset internal specifications are used to control the user’s usage rights, access data, monitor the number of uses, and detect abnormal behaviors to ensure the normal operation of this system. By restricting the access behavior of nodes, the control of the number of accesses is achieved, ensuring the normal access of the network. Once anything abnormal is detected, it will immediately block or sound an alarm, enhancing the security of the network.
In order to solve this problem, we designed a new security protocol, namely smart contracts. By monitoring and responding to the data in the protocol, it can effectively prevent the tampering and access of unauthorized documents. Then, a smart contract model with independent intellectual property rights is given. Then, according to the predetermined principles, which people and which nodes have the corresponding rights are efficiently managed. Then, a new, easy-to-operate, scalable, object-oriented, and extensible is given. Only approved users can access confidential files, and ordinary users can only access public files. By managing permissions, hacker attacks can be prevented and data security can be ensured.
At the same time, by setting the upper limit of the number of accesses, multiple types of data can be accessed multiple times in multiple types of networks, thereby improving the operation speed of the entire system and avoiding security risks caused by excessive access. For the same data, if the same user repeatedly accesses it for a long time, there is a higher risk, and this threat can be detected by smart contracts and blocked or security warnings can be issued. By constantly monitoring the dynamic changes of users and timely monitoring their network activities, abnormal conditions of users can be detected in time and corresponding measures can be taken in time. When a node sends requests multiple times in a long period of time, it will be regarded as a potential attack, and corresponding measures will be taken immediately, such as prohibiting the access request of a certain node or triggering a security alarm. Through the implementation of this project, timely detection and response to abnormal events in the network are achieved, and the security and stability of the network are improved.
Taking advantage of the distributed and unforgeable characteristics of blockchain, all transaction activities and activities are recorded on the blockchain, ensuring the transparency and non-tamperability of data. This method not only enhances the credibility of smart contracts, but also tracks each transaction, thereby improving the security of the system. It also has the characteristics of automated control, reduces the requirement for manual intervention, and can effectively improve the efficiency of the overall work. Traditional network security management mainly relies on manual completion of a large amount of monitoring and response work, which is not only inefficient, but also prone to human errors. By automating these operations, smart contracts increase response speed and reduce the likelihood of errors, thereby enhancing the overall security and reliability of the system.
Decentralized structure
Blockchain technology has a decentralized structure that allows data storage to no longer rely on a central server, but is divided into multiple nodes, each containing a copy of the entire blockchain’s data. During data validation, each node validates the newly generated block data. If a node is invaded, other nodes can still function normally and the integrity of data can be preserved.
Flowchart of blockchain decentralized data verification algorithm.
Figure 2 shows how blockchain technology uses its decentralized architecture to confirm and maintain data integrity. The data entry software first distributes the data to many nodes on the network, which are fully copied by the blockchain. By performing different verifications on the newly generated information, it ensures that when a node is attacked or fails, other nodes can still work normally, ensuring the security of the entire network. Multi-point authentication can reduce the risk of errors or tampering at a single node, and enhance the credibility of the entire network.
By distributing data on multiple nodes, the distributed architecture reduces the reliance on a single central server. In this way, when a node is attacked or fails, it can continue to execute because it has been stored. This architecture improves the stability of the system, making it difficult to be completely destroyed in a large-scale network attack. At the same time, this architecture also has strong scalability: when the number of users in the network continues to increase, only one node can be added to increase the capacity and capability of the network, without additional expansion and maintenance costs.
Hash technology is a cryptographic method that converts hash codes into fixed lengths. It can forge and modify access data and has strong security. This scheme is unilateral, irreversible, and guarantees user privacy. On this basis, each block contains both its own hash value and the hash value of the previous block, thus forming an unchangeable chain, thereby ensuring the integrity and continuity of the block. During the acquisition process, hash operations are performed on each component, and the relationship between each component is connected to ensure the association between each component. In this scheme, the hash value of the key will change with the key, making it difficult to escape the attack of the key, thereby ensuring the safety and reliability of the blockchain system. SHA-256 is an efficient and secure encryption algorithm. SHA-256 not only has a fast calculation speed, but also has good anti-collapse capabilities, ensuring that the generated hash value is unique and unpredictable. The hash algorithm can effectively ensure the integrity and security of the data, and plays a very important role in improving the anti-counterfeiting ability of network data.
Its expression is:
In Eq. (1),
The SHA-256 algorithm ensures data integrity and immutability by generating a fixed length hash value. First, SHA-256 is highly collision resistant, making it extremely unlikely that two different inputs will produce the same output. Second, the hashes generated by SHA-256 cannot be reverse-engineered to restore the original data, thus protecting data privacy. Finally, SHA-256 algorithm processing speed, suitable for large-scale data environment, effectively resist common brute force and man-in-the-middle attacks, to ensure the security and integrity of data transmission.
In the proof-of-work consensus algorithm used in this article, each node needs to calculate the hash value of all blocks it links until a block that meets the condition is found. The way to set the conditions is to set a target hash value. The node filters all blocks by calculating the hash value of the new block and comparing it to the set target hash, trying until it finds a valid block with a lower hash value, and then broadcasting it to the network to reach a consensus and add it to the blockchain, a process that ensures the security of the blockchain and the immutability of the data.
In this method, after each node performs the corresponding operation, it exchanges the hash value with each other until all operations are completed, thereby generating a new block required for the new blockchain access. The integration of blockchain technology, hash technology and consistency technology ensures the integrity of information under the premise of ensuring information security. As a decentralized ledger, blockchain records transactions with unchangeable data. The SHA-256 hash algorithm generates a unique hash value for each block. When the hash value changes, the algorithm can quickly detect and respond. Proof of Work (PoW) consistency ensures that the nodes in the entire network are consistent with their current state and can effectively prevent malicious tampering. On this basis, a protocol-based method is designed to perform efficient data processing and data encryption on data to enhance data security. All of this is a transparent and strong security architecture. The use of multi-node authentication technology, hash technology and load verification technology ensures the security and integrity of data in the entire system. On this basis, a method is given to encrypt information in the network based on this protocol, thereby improving the security performance of the network.
Performance evaluation indicators
In general, the confusion matrix is used as a reference standard to evaluate the performance of the detection model. Table 1 shows the classification of these matrices.
Classification of confusion matrices
Classification of confusion matrices
The evaluation parameters derived from the confusion matrix include accuracy (Acc), precision (P), recall (R), and F1 score.
For the detection of network access data tampering attacks, the method of attack in this experiment is to use adversarial networks to generate adversarial examples for attack. Adversarial networks can generate adversarial examples similar to normal access data, simulating normal access to test the performance of the model. The generator for generating advertising examples consists of multiple layers of perceptrons with a learning rate set to 0.001. The learning rate of the discriminator for adversarial training is also set to 0.001, and the number of training rounds is set to 500. The number of generated adversarial examples is 1000, with a disturbance intensity of 0.1. The target of the attack is to maximize the classification error of the detection model, and the attack method is online real-time attack. The standard for successful attack is set to an error greater than 3% (that is, model accuracy less than 97%) indicating successful attack.
Experimental results
To evaluate the comprehensive performance of the model, improve its practicality, and determine the direction of improvement, the experiment introduces network access data tampering detection models constructed by conventional rule-based intrusion detection, support vector machine (SVM) algorithm in machine learning, and convolutional neural network (CNN) in deep learning for comparative experiments. The results obtained from testing the four evaluation indicators mentioned in Section 3.1 are shown in Table 2.
Results of test performance indicators for each model
Results of test performance indicators for each model
According to Table 2, during the attack test, only the detection model constructed by the CNN and the model proposed in this paper are not successfully attacked, with accuracy rates of 97.67% and 99.51%, respectively. Conventional intrusion detection performs the worst in detecting adversarial examples attacks, with an accuracy rate of only 82.34%. The precision, recall, and F1 performances are also the worst among the four algorithms. SVM and CNN have their own advantages in terms of precision and recall. The model of this article performs the best in all parameters, with an accuracy rate of 99.51% for attack detection, indicating that the model plays a good role in identifying data tampering attacks.
To test the recognition time and response time of the model, the NSL-KDD99 dataset is used for testing in the experiment. NSL-KDD99 is a widely used dataset for intrusion detection, which includes data from normal access and tampering attack samples. 100 sets of tampering attack samples are selected for the experiment, and the four models mentioned above are tested separately. The recognition time and response time for tampering attacks are recorded, and the results are an average of 100 groups. The obtained results are shown in Fig. 3.
Recognition time and response time of each model.
The test results of recognition time and response time for each model are shown in Fig. 3. The recognition time represents the time from the start of the attack to the discovery of the model, and the response time represents the time from detecting tampering attacks to taking measures. As shown in Fig. 3, traditional intrusion detection has relatively long recognition and response times, with 167.39 ms and 216.44 ms respectively. The recognition time and response time of the model in this article are the best, with 21.35 ms and 30.97 ms respectively. CNN, due to the complex structure and high computational power, has a recognition time closest to the model of this paper, reaching 34.91 ms, and its response time is relatively long, which is close to the response time of SVM. Overall, in terms of processing speed, this model has better performance than the other three models, mainly because the decentralized structure reduces the burden of validation and helps to reduce processing time.
In order to test the robustness of the model, collaborative attacks are conducted on multiple nodes in the experiment, simulating the behavior of multiple nodes being invaded simultaneously attempting to forge consensus. A portion of the blockchain network is simulated using a combination of Ganache and Truffle Suit tools. There are 1000 nodes, and the number of attack nodes gradually increases. The recognition accuracy and response time of the models are tested, and the results are shown in Fig. 4.
Recognition accuracy and response time when attacking different numbers of nodes.
As shown in Fig. 4, as the number of attack nodes increases, the accuracy of model recognition decreases while the response time increases. When the number of attacking nodes is 200, the recognition accuracy decreases to below 90%, reaching 89.34, and the response time reaches 2310.89 ms. In general, the number of attack nodes reaching 200 is considered an extreme number in testing experiments, and the recognition accuracy may drop to a range of 70% to 80%, with corresponding times ranging from a few seconds to ten seconds. The accuracy of the model of this article is close to 90%, and the response time is less than 3 seconds, indicating that the robustness of this model is good.
In the face of a multi-node attack, even if some nodes are attacked, the other nodes are still able to maintain the integrity and consistency of the data, because each node keeps a copy of the entire blockchain, and the data is only changed or accepted when the majority nodes reach a consensus. For evading attacks, the model leverages advanced machine learning algorithms to identify and adapt to new attack patterns, which are able to learn from historical data and predict abnormal behavior. In addition, the dynamic network adaptability of the model is reflected in the ability to adjust its parameters and policies as network conditions change, such as when network traffic increases or new threats emerge, the smart contract can update its rules to meet new challenges.
Figure 5 shows the variation of robustness index with training times.
Changes in robustness index.
The robustness index is a non-unit relative indicator that measures the performance of a model in facing different challenges. The model is trained 20 times using evasion attacks. It can be observed that the robustness index rapidly improves with fewer training iterations, reaching the optimal robustness index of 0.95 in the 16th training session. The experimental results demonstrate that this model has the ability to quickly adapt to different challenges.
Evaluate the interoperability and data consistency of a network access data tampering attack detection model based on blockchain technology across different blockchain networks. Choose Ethereum and Hyperledger, deploy smart contracts and chain codes, and ensure that the model functions consistently. Generate 20 pieces of normal network access data using predefined scripts. The data is randomly selected for tampering, simulating tampering attack. Monitor data synchronization to ensure data consistency between the two platforms and record whether tampering is detected and the detection time. The results obtained are shown in Table 3.
Results of conformance test
The data type “0” in Table 3 indicates normal data and “1” indicates tampered data. Tampering result 0 indicates no tampering. 1 indicates that tampering is detected. In tests, both Ethereum and Hyperledger platforms accurately detected tampered data, showing good consistency. In terms of detection time, the performance of Ethereum and Hyperledger is also basically the same, with the average detection time between 0.33 seconds and 0.47 seconds, which indicates that the model in this paper can effectively cope with data tampering attacks and maintain high efficiency on the two blockchain platforms.
To evaluate the impact of using specific hardware acceleration on the performance of a blockchain-based network access data tampering attack detection model, prepare two test systems, one equipped with a GPU and the other equipped with a TPU, to ensure that the system configuration and environment are consistent. Deploy the same version of the tamper attack detection model on every system, using the same smart contract. Record performance metrics and compare GPU and TPU performance differences in processing speed and resource consumption. The results obtained are shown in Table 4.
Effects of different hardware acceleration on the model
Table 4 shows the impact of different hardware accelerators on the performance of a blockchain-based network access data tampering attack detection model. Data numbers 1 to 10 represent performance metrics when the same version of the detection model is deployed on both test systems. It can be observed from the data that TPU performs better than GPU in terms of processing speed and hardware utilization, and the highest processing speed is 135 PCS/SEC, while the GPU is 122 PCS/SEC. At the same time, the average hardware utilization of Tpus is generally higher than that of Gpus. This result shows that when dealing with blockchain network access data tampering detection, TPU can provide more efficient performance and resource utilization, which is suitable for application scenarios requiring high-speed processing and lower resource consumption.
Through a series of experiments, this paper comprehensively evaluates our proposed network access data tampering attack detection model based on blockchain technology. The experimental results show that the model has demonstrated high accuracy and rapid response ability under various attack scenarios, especially in adversarial example attacks, the accuracy of the model reaches 99.51%, and the F1 value is as high as 0.98, which is significantly better than the traditional intrusion detection system and other deep learning methods. These results not only demonstrate the potential of the model in practical applications, but also provide valuable data support for future research.
However, this study recognizes the challenges that the model may face in actual deployment, such as how to further improve the scalability and adaptability of the model, and how to improve the transparency and efficiency of detection while protecting user privacy. Optimize algorithm structure, explore efficient data processing technology, and integrate other network security tools and strategies to build a comprehensive and robust network security protection system [18].
Conclusion
Network data security concerns everyone, and the detection of network access data tampering attacks is crucial for maintaining network data security. This article addresses the drawbacks of excessive reliance on central servers in traditional network environments and designs a network access data tampering attack detection model based on blockchain technology. Through experiments, it is known that this model performs the best in detecting attacks compared with other models, and has played a good role in identifying data tampering attacks. It can maintain good accuracy and response time even when multiple nodes are attacked simultaneously. The model exhibits good robustness in both adversarial examples and evasion attacks. It is unfortunate that the experiment did not test the proportion of computing system resource usage, and if the usage rate is too high, it may affect the performance of the model. It is hoped that this research can be improved in the future based on more expert suggestions.
