CN111988286A - DDoS attack analysis and decision method for bitcoin mine pool based on evolutionary game - Google Patents
DDoS attack analysis and decision method for bitcoin mine pool based on evolutionary game Download PDFInfo
- Publication number
- CN111988286A CN111988286A CN202010767227.4A CN202010767227A CN111988286A CN 111988286 A CN111988286 A CN 111988286A CN 202010767227 A CN202010767227 A CN 202010767227A CN 111988286 A CN111988286 A CN 111988286A
- Authority
- CN
- China
- Prior art keywords
- strategy
- pool
- ore
- mine
- ddos attack
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 25
- 238000004458 analytical method Methods 0.000 title claims abstract description 17
- 230000000977 initiatory effect Effects 0.000 claims abstract description 29
- 230000008859 change Effects 0.000 claims abstract description 12
- 230000008569 process Effects 0.000 claims abstract description 9
- 238000009412 basement excavation Methods 0.000 claims description 25
- 230000008901 benefit Effects 0.000 claims description 7
- 230000010485 coping Effects 0.000 claims description 5
- 238000002474 experimental method Methods 0.000 claims description 4
- 238000012546 transfer Methods 0.000 claims description 3
- 238000005065 mining Methods 0.000 description 13
- 238000004364 calculation method Methods 0.000 description 5
- 230000006399 behavior Effects 0.000 description 4
- 230000007246 mechanism Effects 0.000 description 3
- 230000007123 defense Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 230000007774 longterm Effects 0.000 description 2
- 230000008450 motivation Effects 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- 238000004088 simulation Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 241000287219 Serinus canaria Species 0.000 description 1
- 230000009471 action Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000003306 harvesting Methods 0.000 description 1
- 230000010365 information processing Effects 0.000 description 1
- 230000005012 migration Effects 0.000 description 1
- 238000013508 migration Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000006641 stabilisation Effects 0.000 description 1
- 238000011105 stabilization Methods 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a DDoS attack analysis and decision method for a bitcoin mine pool based on an evolutionary game. The method firstly determines the participants, determines a strategy set according to the characteristics of the participants, selects parameters influencing DDoS attack and income, defines the meaning of the parameters and calculates the income of the participants. And then, constructing a DDoS attack evolution game model of the ore pool based on the above steps, and analyzing the change of the proportion of the ore pool initiating the DDoS attack strategy in all the ore pools. And finally, solving the equilibrium of the evolutionary game, and selecting a counterattack strategy of the next round from the mine pool under attack in the current round. The invention takes the repeated operation characteristic of the ore digging game into consideration, so that the analysis of the ore digging game of multiple rounds is more practical. Meanwhile, the invention introduces the probability of DDoS attack failure and uses the parameter when calculating the income of participants, thereby being capable of more perfectly analyzing the situation of strategy change in the pool game process.
Description
Technical Field
The invention belongs to the field of DDoS (distributed denial of service) attacks between a bit currency mine pool game and a mine pool, and relates to an analysis and decision method based on an evolutionary game.
Background
The incentive mechanism of the bitcoin prompts miners to dig mines and spread new blocks constructed by the miners to obtain benefits. At present, miners mostly add to an ore pond to dig ores. The mine pond becomes the main body of digging. From a rational point of view, if a deviation from the normal mining strategy can bring greater profit to the mine, the mine is motivated not to act according to the rules of the bitcoin system. Such deviating policies may be illegal activities, such as proactively launching DDoS attacks on other mine pools. As early as 2011, bitcoin mines have been reported to be attacked by DDoS. Thereafter, DDoS attacks on the mine are frequent. Even AntPool has issued a notification that it is being attacked by large DDoS. Up to now, DDoS attackers still attack mine pools.
The game theory is a tool for researching interdependence and competition of decision subjects. The game theory method is widely applied in the aspects of motivation and decision. Clark and Konrad[1]A theoretical model is provided, in the model, defenders need to protect a plurality of nodes, and attackers only need to break through one node to succeed. Fultz and Grossklas[2]The strategy selection problem of an attacker under different decision scenes is solved. Grossklags et al[3]The impact of different security decisions under limited rational conditions was investigated. Cremonini and Nizovtsev[4]The decisions of the attackers are compared when the attackers have different degrees of knowledge about the security defense measures of the targets. Cavusglu et al[5]The enterprise's decisions given the attack probabilities are analyzed. The above studies are all concerned with attacks and use the game theory approach. However, none of these content and analysis relate to attacks and decisions in the bitcoin environment.
In the bitcoin environment, gaming theory is often used to analyze content related to a mine attack. The research of mine pool attack modeling analysis is developed based on the classical game theory, and the method can be divided into four types of complete information static game, complete information dynamic game, incomplete information static game and incomplete information dynamic game according to a game information set and action time sequence. For example, game theory is used to analyze block withholding attacks between mine pools[6]. Other attack-related studies have focused on the bitcoin system itself. Barber et al[7]The characteristics of a last-day attack were studied, which can invalidate the entire transaction history with great effort. Kroll et al[8]The stability of the bitcoin digging when an outsider destroys the bitcoin is studied. Tang et al[9]A reward mode that considers "either win or no harvest" may result in misbehavior by miners. The above research is closely related to the BimingNote system, but none of them has taken into considerationAnd (4) considering DDoS attack behaviors aiming at the mine pool.
About the game among the mines and the DDoS attack behavior of the mines, Vasek et al[10]Empirical evidence of frequent DDoS attacks in bitcoin environments is presented. Their view is that the probability of a mine being attacked is related to the amount of effort that the mine is doing. Based on these findings, Johnson et al[11]A round of game model between two mine pools is established. In their model, an alternative strategy for both mines is to launch a DDoS attack or invest in effort. One limitation of their model is that only one round of gaming is considered, and there is a lack of analysis of long-term effects. Laszka et al[12]A model of mutual attack of two ore pools is established, migration of miners is considered, and long-term influence of DDoS attack is analyzed, but the model does not consider coping strategies of the attacked ore pools in multiple rounds of games.
In practical situations, the mining pools are dug all the time, and the game among the mining pools is multi-turn. In the repeated game, the attacked ore pool can take corresponding countermeasures in the next round of game according to the condition of the current round of game, so that the situation is influenced, and the expected income of the user is maximized. In addition, classical game theory assumes that the participants are fully rational, have unlimited information processing and computing power, and are not subject to errors and other influences during the decision-making process. However, in reality this assumption is difficult to satisfy, and the rationality of the mine is limited rather than complete. Therefore, an analysis and decision method for DDoS attack of the bitcoin ore pool is required to be provided based on an evolutionary game aiming at the characteristics that the bitcoin ore pool is continuously excavated and the game is repeatedly performed among the ore pools.
Reference to the literature
[1]Clark，D.，Konrad，K.Asymmetric conflict：Weakest link against best shot[J].Journal of Conflict Resolution.2007：457-469.
[2]Fultz N，Grossklags J.Blue versus Red：Towards a Model of Distributed Security Attacks[J].2009.
[3]Grossklags J，Johnson B，Christin N.When Information Improves Information Security[C].Financial Cryptography&Data Security，International Conference，Fc，Tenerife，Canary Islands，January，Revised Selected Papers.DBLP，2010.
[4]Cremonini M，Nizovtsev D.Understanding and Influencing Attackers’Decisions：Implications for Security Investment Strategies[J].2006.
[5]Cavusoglu H，Yue R W T.Decision-Theoretic and Game-Theoretic Approaches to IT Security Investment[J].Journal of Management Information Systems，2008，25(2)：281-304.
[6]Eyal I.The Miner’s Dilemma[J].Computer Science，2014：89-103.
[7]Barber S，Boyen X，Shi E，et al.Bitter to Better-How to Make Bitcoin a Better Currency[C].International Conference on Financial Cryptography and Data Security.Springer Berlin Heidelberg，2012.
[8]Kroll，J A，Davey，IC，Felten，E W.The economics of bitcoin mining，or bitcoin in the presence of adversaries[J].Proceedings of WEIS，2013：11.
[9]Tang C，Wu L，Wen G，et al.Incentivizing Honest Mining in Blockchain Networks：A Reputation Approach[J].Circuits and Systems II：Express Briefs，IEEE Transactions on，2019：1-1.
[10]Vasek M，Thornton M，Moore T.Empirical Analysis of Denial-of-Service Attacks in the Bitcoin Ecosystem[C].International Conference on Financial Cryptography and Data Security.Springer Berlin Heidelberg，2014.
[11]Johnson B，Laszka A，Grossklags J，et al.Game-Theoretic Analysis of DDoS Attacks Against Bitcoin Mining Pools[J].2014.
[12]Laszka A，Johnson B，Grossklags J.When Bitcoin Mining Pools Run Dry：A Game-Theoretic Analysis of the Long-Term Impact of Attacks Between Mining Pools[C].2nd Workshop on Bitcoin Research，in association with Financial Crypto 2015.2015.
Disclosure of Invention
The mine has become the main output of the bitcoin and has become the focus of attention. The mine pool is continuously attacked by DDoS, and computing resources are wasted. There is a statement that mine pools can overwhelm competitor mine pools by launching DDoS attacks on other mine pools. DDoS attacks cause the calculation resources of the attacked mine pools to be wasted, and meanwhile, the market of the bit coins digging is disturbed. Aiming at the problem, the invention provides a method for analyzing DDoS (distributed denial of service) attack behaviors of a bitcoin ore pool based on an evolutionary game theory, and helps the attacked ore pool to make an optimal decision in multiple rounds of ore digging games.
The invention comprises the following steps:
A. determining participants, determining a strategy set according to the characteristics of the participants, selecting parameters influencing DDoS attack and income, defining the meaning of the parameters, and calculating the income of the participants;
the determining participants specifically are:
the mine pools jointly form a mine pool group, and two mine pools are extracted from the mine pool group to serve as participants.
The determining the policy set according to the characteristics of the participants specifically comprises:
the characteristics of the participants mean that the mine pool has computing resources, different strategies can be selected by the mine pool, and the mine pool can carry out strategy transfer within the capacity range.
Determining the strategy set means that the strategy that the mine pool can select is to initiate DDoS attack or conservative mine excavation. When the strategy adopted by one ore pool is to initiate DDoS attack, the ore pool is called as an initiating DDoS attack side ore pool, and when the strategy adopted by one ore pool is to conservatively dig ore, the ore pool is called as a conservative digging side ore pool.
The parameters influencing DDoS attack and income are selected, the meaning of the parameters is determined, and the income of the participants is calculated specifically as follows:
m: the mine pools in the mine pool group are regarded as possessing the same computational power, and m represents the proportion of the computational power of a single mine pool to the total computational power of the bitcoin network.
σ: the probability of DDoS attack failure is assumed to be σ.
λ: let the cost factor for launching a DDoS attack be λ.
The income of the calculation participants is specifically as follows:
when two ore ponds adopt a conservative ore digging strategy, the respective benefits are UMM＝BmM(ii) a When one ore pool adopts a conservative excavation strategy and the other ore pool adopts a DDoS attack launching strategy, the profit U of the ore pool of the conservative excavation side is obtainedMD＝BmDAnd the income U of the DDoS attack side mine pool is launchedDM＝BmM+Be-CD(ii) a When two ore ponds are both the ore ponds of the attack side initiating the DDoS, the earnings of the two ore ponds are both UDD＝BmD-CD；
Wherein, BmMRepresenting the basic gain of the mine pit through excavation, BeRepresenting the additional benefit of initiating a DDoS attack, CDRepresenting the cost of initiating a DDoS attack, BmDRepresenting the revenue from pool excavation when subjected to DDoS attacks, BmD＝σBmM。
B. On the basis, an ore pool DDoS attack evolution game model is constructed, and the change of the proportion of the ore pool initiating the DDoS attack strategy in all ore pools is analyzed;
the establishment of the mine pool DDoS attack evolution game model specifically comprises the following steps:
the game model consists of four elements, namely a participant, a strategy set, the income of the participant and the strategy frequency for launching a DDoS attack strategy.
The participants are two mine ponds;
the strategy set is used for initiating a DDoS attack strategy and a conservative mining strategy by using sDRepresenting the launching of DDoS attack strategy by sMRepresenting a conservative mining strategy, the strategy set may be represented as sD，sM}；
The participant's profit is UMM，UMD，UDMAnd UDD；
Two strategy frequencies are provided for launching the DDoS attack strategy, one is s in the current round mine pool groupDAnother is s in the next round of mine pool populationDFrequency of strategy (2)p′。
the analysis adopts the change of the proportion of the ore pool initiating the DDoS attack strategy to all the ore pools, which is specifically as follows:
the proportion of the ore pool initiating the DDoS attack strategy to all the ore pools is sDThe strategy frequency of (1), the pool population evolution state is used as the next round of sDThe strategy frequency p' is expressed. And (3) moving the strategy of the participant mine pool to the dominant strategy after the participant mine pool compares the income along with the advance of time, wherein the value of p' changes in the process to obtain a mine pool group strategy evolution dynamic equation:
wherein, UdRepresenting the profit of a mine pool from which a DDoS attacker originates,
representing the overall expected revenue for a participant mine. And p ' represents the general trend and direction of the evolution of the mine pool group strategy, when the p ' → 0 shows that the mine pools are mutually consistent, the mine pools tend to dug conservatively instead of initiating DDoS attacks on other mine pools, and when the p ' → 1 shows that the mine pools tend to initiate DDoS attacks on other mine pools.
Further, the solving process of p' is as follows:
calculating profit U of participant mine pool of DDoS attack initiating partyd；
Calculating the profit U of conservative excavation square participant mine poolm；
Calculating expected profit of participant mine pools according to DDoS attack initiating strategy frequency and conservative mine digging strategy frequency
And calculating the strategy frequency p' for launching the DDoS attack strategy and summarizing the convergence result.
Further, the profit U of the participant mine pool of the attack party initiating DDoSd＝(1-p)UDM+xUDD(ii) a Profit U of conservative excavation square root participant mine poolm＝(1-p)UMM+pUMD(ii) a Expected revenue for participant mine
Mine pool group strategy evolution dynamic equation:
when in the pool group sDWhen the strategy frequency is 0, the mine evolution game process reaches an evolution stable state, and at the moment, the equation satisfies the following conditions:
p′→0
simulation experiment to obtain sDThe dynamic variation of the strategy frequency p' as time advances.
C. And (5) solving the equilibrium of the evolutionary game, and selecting a counterattack strategy of the next round from the mine pool under attack in the current round.
The solving of the evolutionary game equilibrium specifically comprises the following steps:
a strategy is designed, when the attacked ore pool adopts the strategy, both ore pools tend to dug conservatively, and the evolutionary game reaches equilibrium.
The counterattack strategy of the next round selected by the current round attacked ore pool is specifically as follows:
according to an evolution game classic Axelrod experiment, a coping strategy of an attacked ore pool is designed, named as an 'excavation-repetition, DDoS attack-change' strategy, and described as follows:
if the strategy selected by the previous wheel is conservative excavation, the wheel repeats the strategy selected by the previous wheel; if the strategy of the opposite party in the previous round is to initiate DDoS attack, the round selects the opposite strategy to the strategy in the previous round.
The attacked ore pool adopts the designed 'digging-repeating, DDoS attacking-changing' strategy, and the situation that the two ore pools cooperate in the subsequent rounds of games is discussed in a classification mode.
The invention has the following effects: the invention provides an analysis method of a DDoS attack motivation between two ore ponds based on an evolutionary game, which is different from a round of game used in most of the current methods. Meanwhile, a coping strategy of the mine pool attacked by DDoS is designed by using a classical Axelrod experiment in an evolution game. Thus, the two mine pools adopt a conservative mining strategy in repeated games, and cooperation is achieved. On the basis, the attacked ore pool can be counterattacked to influence the situation of the next round of game, so that the computational resources of the attacked ore pool can be normally operated, and the waste is avoided. The invention introduces the probability of DDoS attack failure and uses the parameter when calculating the income of the participants, which is different from the problem that the traditional attack and defense game does not consider the attack success probability. The invention does not need to modify the bit currency network protocol and does not need to be based on intelligent contracts or modify the existing consensus mechanism. Assuming that the participants are benefit-driven, the security of the original bitcoin mine pool is not reduced by the invention under the condition of introducing a new analysis and decision mechanism.
Drawings
FIG. 1 is a flow chart of the present invention.
FIG. 2 is sDAnd (3) dynamic change graph of strategy frequency when time advances.
Fig. 3 is a schematic diagram of a strategy variation for achieving cooperation between two mine pools.
Detailed Description
The invention is described in further detail below with reference to the figures and specific examples.
As shown in fig. 1, the method for analyzing and deciding DDoS attack of a bitcoin mine pool based on an evolutionary game includes the following steps:
step 1, determining a decision-making body, determining a strategy set according to the characteristics of participants, selecting parameters influencing DDoS attack and income, defining the meanings of the parameters, and calculating the income of the participants according to the probability characteristics of the bit currency mining.
The mine pools jointly form a mine pool group, and the mine pools in the mine pool group can carry out strategy transfer according to specific probability within the capacity range. Two ore pools are abstracted from the ore pool group as participants and are respectively represented by an ore pool A and an ore pool B, the ore pools in the ore pool group are regarded as having the same calculation power, and m represents the proportion of the calculation power of a single ore pool to the total calculation power of the bitcoin network.
The probability of failure of a DDoS attacker attack is assumed to be sigma (sigma < 1), and the cost coefficient of the DDoS attack is assumed to be lambda (lambda < 1).
And 2, constructing a DDoS attack evolution game model of the ore pool based on the DDoS attack evolution game model, and analyzing the change of the proportion of the ore pool initiating the DDoS attack strategy in all the ore pools. And carrying out normalization processing on the basic income of the ore digging of the ore pool. Solving an ore pool group strategy evolution equation of a DDoS attack initiating party and a conservative ore excavation party to obtain strategy frequency change of the DDoS attack initiating strategy in the ore pool game evolution process, and summarizing convergence results;
the two ore ponds have the benefits of U when the two ore ponds are conservative excavation square ore pondsMM＝BmM＝m；
When the other side is a conservative excavation side mine pool, the yield of the DDoS attack side mine pool is initiated
When the other side is the side which initiates DDoS attack, the yield U of the side mine pool of conservative excavation is obtainedMD＝BmD＝σm；
When two ore ponds are both the ore ponds of the attack side initiating DDoS, the earnings of the two ore ponds are both UDD＝BmD-CDσ m- λ m; wherein, BmMRepresenting the basic gain of the mine pit through excavation, BeIndicating the additional revenue brought by initiating the DDoS attack, if the DDoS attack is successful,
CDrepresenting the cost of initiating a DDoS attack, BmDRepresenting the revenue from pool excavation when subjected to DDoS attacks, BmD＝σBmM＝σm。
By sDRepresenting the launching of DDoS attack strategy by sMRepresenting a conservative ore excavation strategy; let sDThe frequency of the strategy is x,
wherein n isDFor selecting the number of mine pools for launching the DDoS attack strategy, if N is the participant space, i.e. the total number of mine pools, sMThe strategy frequency is 1-x.
For a pool with conservative excavation, the expected yield is Um＝(1-x)UMM+xUMD(1-x) m + x σ m; for a mine pool of a DDoS attacker, the expected yield is
Expected profit for mine:
the learning behaviors of the participants cause the frequency of the group strategy to dynamically change along with time, and the group evolution state is used as s in the next roundDExpressing strategy frequency to obtain ore pool group strategyEvolution dynamic equation:
the meaning of x' is the next round sDAnd the strategy frequency represents the general trend and direction of the mine pool group evolution of the DDoS attacking party and the conservative mining party.
The comparison of the gains of different strategies by the participants can lead to the adjustment of strategy selection, thereby leading to the evolution of the state of the mine pool population. Due to the incomplete rational characteristics of the participants, the system evolves gradually, through multiple rounds of state changes, until the evolution stabilization strategy is converged.
When in the pool group sDWhen the strategy frequency is 0, the mine evolution game process reaches an evolution stable state, and at the moment, the equation satisfies the following conditions:
x′→0
simulation experiment to obtain sDDynamic changes in the strategy frequency as time advances.
FIG. 2 is sDAnd (3) dynamic change graph of strategy frequency when time advances. Where m is 0.02, λ is 0.02, σ is 0.3, and s is initiallyDStrategic frequency x0＝0.1。
The horizontal axis represents game rounds and represents the advance of time, and the vertical axis represents s corresponding to each roundDThe policy frequency value. It can be seen that as time progresses, sDThe policy frequency value tends to 0, which means that the proportion of the mine pool initiating the DDoS attack to the total mine pool tends to 0. Mining ponds tend to select conservative excavation strategies.
And 3, solving the equilibrium of the evolutionary game, and selecting a counterattack strategy of the next round from the mine pool under attack in the current round.
According to an evolution game classic Axelrod experiment, a coping strategy of an attacked ore pool is designed, defined as an 'excavation-repetition, DDoS attack-change' strategy, and described as follows:
if the strategy selected by the previous wheel is conservative excavation, the wheel repeats the strategy selected by the previous wheel; if the strategy of the opposite party in the previous round is to initiate DDoS attack, the round selects the opposite strategy to the strategy in the previous round.
Fig. 3 is a schematic diagram of policy change of cooperation between two mine pools, and the classification discusses the change process of the policy selected by the mine pools under different initial conditions. With (A)s，Bs) A policy pair representing pool A and pool B, wherein AsStrategy for representing the selection of a mine pool, BsRepresenting the strategy of pool B selection. For example, (D, M) represents a case where mine a chooses to launch a DDoS attack strategy and mine B chooses a conservative excavation strategy.
As shown in fig. 3, the dashed box labeled "round 1 game" is the initial state, and there are four kinds of strategy combination cases; the arrows connect the corresponding states of the four cases in the "game of round 1" in the "game of round 2"; the four cases in the "round 2 game" are then linked by arrows to the corresponding states in the subsequent round.
Taking the case 2 as an example, in the 1 st round of game, the mining pool a selects a conservative mining strategy, and the mining pool B selects a DDoS attack initiating strategy, and in the round of game, the mining pool a is attacked by DDoS; subsequently, in the 2 nd round of game, the ore pool A adopts a 'digging-repeating and DDoS attack-changing' strategy, and the decision is made according to the strategy of the opposite ore pool in the 1 st round of game, because the ore pool B selects to initiate DDoS attack in the 1 st round, the ore pool A in the round is changed into the own strategy, and the different strategy from the previous round is selected, namely the DDoS attack is initiated. And the subsequent rounds of games are analogized.
Under the guidance of the 'digging-repeating, DDoS attack-change' strategy, from the 3 rd round, the ore pool selects a conservative digging strategy, which is the optimal choice for both parties.
Claims (5)
1. A DDoS attack analysis and decision method for a bitcoin mine pool based on an evolutionary game is characterized by comprising the following steps:
A. determining participants, determining a strategy set according to the characteristics of the participants, selecting parameters influencing DDoS attack and income, defining the meaning of the parameters, and calculating the income of the participants;
B. constructing a DDoS attack evolution game model of the ore pool, and analyzing the change of the proportion of the ore pool initiating a DDoS attack strategy to all the ore pools;
the game model consists of four elements, namely a participant, a strategy set, the income of the participant and the strategy frequency for launching a DDoS attack strategy;
the proportion of the mine pools which adopt the DDoS attack initiating strategy to all the mine pools is the DDoS attack initiating strategy sDThe strategy frequency of (1), the pool population evolution state is used as the next round of sDStrategy frequency p' is expressed;
and (3) moving the strategy of the participant mine pool to the dominant strategy after the participant mine pool compares the income along with the advance of time, wherein the value of p' changes in the process to obtain a mine pool group strategy evolution dynamic equation:
wherein p represents s in the current round mine pool populationDStrategy frequency of (U)dRepresenting the profit of a mine pool from which a DDoS attacker originates,
representing an overall expected return for a participant mine; p ' represents the general trend and direction of the evolution of the mine pool group strategy, when p ' → 0 indicates that the mine pools are mutually consistent, the mine pools tend to dug conservatively instead of initiating DDoS attacks on other mine pools, and when p ' → 1 indicates that the mine pools tend to initiate DDoS attacks on other mine pools;
C. and (5) solving the equilibrium of the evolutionary game, and selecting a counterattack strategy of the next round from the mine pool under attack in the current round.
2. The DDoS attack analysis and decision method for the Bingxin mine based on the evolutionary game as claimed in claim 1, characterized in that: the characteristics of the participants in the step A mean that the ore pool has computing resources, different strategies can be selected for the ore pool, and the ore pool can carry out strategy transfer within the capacity range;
determining a strategy set refers to that a strategy which can be selected by a mine pool is to initiate DDoS attack or conservative mine excavation; when the strategy adopted by one ore pool is to initiate DDoS attack, the ore pool is called as an initiating DDoS attack side ore pool, and when the strategy adopted by one ore pool is to conservatively dig ore, the ore pool is called as a conservative digging side ore pool.
3. The DDoS attack analysis and decision method for the Bingxin mine based on the evolutionary game as claimed in claim 1, characterized in that: the parameters determined in the step A comprise a ratio m of the computing power of a single ore pool to the total computing power of the bitcoin network, a probability sigma of DDoS attack failure and a cost coefficient lambda for launching the DDoS attack.
4. The DDoS attack analysis and decision method for the Bingxin mine based on the evolutionary game as claimed in claim 3, characterized in that: when two ore ponds adopt a conservative ore digging strategy, the respective benefits are BmM(ii) a When one ore pool adopts a conservative excavation strategy and the other ore pool adopts a DDoS attack launching strategy, the yield of the conservative excavation square ore pool is BmDAnd the income U of the DDoS attack side mine pool is launchedDM＝BmM+Be-CD(ii) a When two ore ponds are both the ore ponds of the attack side initiating the DDoS, the earnings of the two ore ponds are both UDD＝BmD-CD；
Wherein, BmMRepresenting the basic gain of the mine pit through excavation, BeRepresenting the additional benefit of initiating a DDoS attack, CDRepresenting the cost of initiating a DDoS attack, BmDRepresenting the revenue from pool excavation when subjected to DDoS attacks, BmD＝σBmM。
5. The DDoS attack analysis and decision method for the Bingxin mine based on the evolutionary game as claimed in claim 1, characterized in that: the solving of the evolutionary game balance in the step C specifically comprises the following steps:
designing a strategy, wherein when the attacked ore pool adopts the strategy, both the two ore pools tend to conservatively dig the ore, and the evolutionary game reaches balance;
the counterattack strategy of the next round selected by the mine pool attacked in the current round in the step C is specifically as follows:
according to an evolution game classic Axelrod experiment, a coping strategy of an attacked ore pool is designed, named as an 'excavation-repetition, DDoS attack-change' strategy, and described as follows:
if the strategy selected by the previous wheel is conservative excavation, the wheel repeats the strategy selected by the previous wheel; if the strategy of the opposite party in the previous round is to initiate DDoS attack, the round selects the strategy opposite to the strategy in the previous round;
the attacked ore pool adopts the designed 'digging-repeating, DDoS attacking-changing' strategy, and the situation that the two ore pools cooperate in the subsequent rounds of games is discussed in a classification mode.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010767227.4A CN111988286A (en) | 2020-08-03 | 2020-08-03 | DDoS attack analysis and decision method for bitcoin mine pool based on evolutionary game |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010767227.4A CN111988286A (en) | 2020-08-03 | 2020-08-03 | DDoS attack analysis and decision method for bitcoin mine pool based on evolutionary game |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111988286A true CN111988286A (en) | 2020-11-24 |
Family
ID=73445267
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010767227.4A Pending CN111988286A (en) | 2020-08-03 | 2020-08-03 | DDoS attack analysis and decision method for bitcoin mine pool based on evolutionary game |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111988286A (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108833402A (en) * | 2018-06-11 | 2018-11-16 | 中国人民解放军战略支援部队信息工程大学 | A kind of optimal defence policies choosing method of network based on game of bounded rationality theory and device |
| CN110460564A (en) * | 2019-03-29 | 2019-11-15 | 武汉大学 | Bit coin mine pond attack strategies learning algorithm based on Stochastic Game enhancing study |
| CN110580617A (en) * | 2019-07-25 | 2019-12-17 | 南京邮电大学 | bit currency packet network system based on Starkeberg game and excitation method thereof |
| US20200052996A1 (en) * | 2018-08-09 | 2020-02-13 | Spacebook Technology Co. Limited | Consensus incentive method for blockchain |
| CN111245857A (en) * | 2020-01-17 | 2020-06-05 | 安徽师范大学 | Channel network steady state evolution game method in block link environment |
-
2020
- 2020-08-03 CN CN202010767227.4A patent/CN111988286A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108833402A (en) * | 2018-06-11 | 2018-11-16 | 中国人民解放军战略支援部队信息工程大学 | A kind of optimal defence policies choosing method of network based on game of bounded rationality theory and device |
| US20200052996A1 (en) * | 2018-08-09 | 2020-02-13 | Spacebook Technology Co. Limited | Consensus incentive method for blockchain |
| CN110460564A (en) * | 2019-03-29 | 2019-11-15 | 武汉大学 | Bit coin mine pond attack strategies learning algorithm based on Stochastic Game enhancing study |
| CN110580617A (en) * | 2019-07-25 | 2019-12-17 | 南京邮电大学 | bit currency packet network system based on Starkeberg game and excitation method thereof |
| CN111245857A (en) * | 2020-01-17 | 2020-06-05 | 安徽师范大学 | Channel network steady state evolution game method in block link environment |
Non-Patent Citations (3)
| Title |
|---|
| 唐长兵等: "PoW共识算法中的博弈困境分析与优化", 《自动化学报》 * |
| 杨天等: "区块链***中矿池间的博弈问题及优化", 《通信技术》 * |
| 郑荣欣: "基于博弈论的比特币矿池行为的研究与分析", 《中国优秀博硕士学位论文全文数据库(硕士)基础科学辑》 * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Wang et al. | When blockchain meets AI: Optimal mining strategy achieved by machine learning | |
| CN107135224B (en) | Network defense strategy selection method and device based on Markov evolution game | |
| Chaoqi et al. | Attack-defense game for critical infrastructure considering the cascade effect | |
| CN107566387A (en) | Cyber-defence action decision method based on attacking and defending evolutionary Game Analysis | |
| CN111064702B (en) | Active defense strategy selection method and device based on bidirectional signal game | |
| CN108696534B (en) | Real-time network security threat early warning analysis method and device | |
| CN115348064B (en) | Dynamic game-based power distribution network defense strategy design method under network attack | |
| CN111245857B (en) | Channel network steady state evolution game method in block link environment | |
| Li et al. | Proof-of-work cryptocurrency mining: a statistical approach to fairness | |
| Lin et al. | Optimal defense-attack strategies between M defenders and N attackers: A method based on cumulative prospect theory | |
| CN117272306A (en) | Federal learning half-target poisoning attack method and system based on alternate minimization | |
| CN114998005A (en) | Bit currency abnormal transaction identification method based on federal graph neural network technology | |
| CN113992375B (en) | Heterogeneous complex network defense method based on genetic algorithm | |
| Ebrahimpour et al. | Can blockchain be trusted in industry 4.0? study of a novel misleading attack on bitcoin | |
| CN113194059B (en) | Method for selecting defense strategy of moving target | |
| Sun et al. | Trustgcn: Enabling graph convolutional network for robust sybil detection in osns | |
| Khan et al. | Offensive ai: unification of email generation through GPT-2 model with a game-theoretic approach for spear-phishing attacks | |
| Meng et al. | A cluster UAV inspired honeycomb defense system to confront military IoT: A dynamic game approach | |
| CN113114492A (en) | Security situation perception algorithm based on Markov differential game block chain model | |
| CN111988286A (en) | DDoS attack analysis and decision method for bitcoin mine pool based on evolutionary game | |
| Zheng et al. | Revisiting double-spending attacks on the bitcoin blockchain: New findings | |
| Guntur | Modeling an intrusion detection system using data mining and genetic algorithms based on fuzzy logic | |
| Benaddi et al. | Securing IoT Transactions Against Double-Spending Attacks based on Signaling Game Approach | |
| Feng et al. | Security analysis of block withholding attacks in blockchain | |
| Atia et al. | EMDG-FL: Enhanced Malicious Model Detection based on Genetic Algorithm for Federated Learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20201124 |
|
| RJ01 | Rejection of invention patent application after publication |