Blockchain-focused Cyber Security for the Detection and Protection of Denial of Service (DoS) Attacks

Technical Summary: Blockchain-Focused Cyber Security for the Detection and Protection of Denial of Service (DoS) Attacks

Problem Statement
The paper addresses the growing vulnerability of client-server network architectures to Denial of Service (DoS) attacks. Traditional cybersecurity mechanisms, including firewalls, antivirus software, Intrusion Detection Systems (IDS), and existing Artificial Intelligence (AI), Machine Learning (ML), and Deep Learning (DL) models, are identified as insufficient. The authors argue that these conventional systems rely heavily on centralized structures, which create single points of failure and make them attractive targets for malicious actors. Furthermore, while current ML and DL models demonstrate capability in detecting DoS attacks, they often lack the inherent ability to actively protect or prevent the attack from disrupting the network. The study highlights gaps in previous research, including limited dataset usage, narrow attack scopes, misclassification issues (e.g., confusing UDP with NetBIOS), and a lack of integrated prevention mechanisms.

Methodology
The study proposes a hybrid framework that unifies Blockchain technology with standard client-server network layers to create a decentralized defense system. The methodology involves the following key components:

1. Conceptual Framework: A permissioned Blockchain layer is positioned between the client request source and the server. This layer acts as a filter and guard. All incoming requests must be authenticated and validated by the Blockchain network before being passed to the client-server layer.
2. Smart Contract Logic: The core protection mechanism relies on a Smart Contract programmed with a specific threshold (set at 1,000 requests per second per IP address). If a single IP exceeds this threshold, the Smart Contract automatically identifies it as a DoS attack and blocks the IP address.
3. Machine Learning Integration: To optimize detection, the authors trained and evaluated eight different models (ANN, CNN, KNN, LSTM, SVM, Random Forest, and two Hybrid models) using the CIC-DDoS2019 dataset. The dataset was preprocessed using the SMOTE technique to handle class imbalance.
4. Simulation Environment: The prototype was implemented using a combination of tools including Ganache (for local Ethereum blockchain emulation), Truffle, Solidity (for smart contracts), NS-3 (for network simulation), and various IDEs (Google Colab, VSCode, Jupyter). A custom interactive dashboard was developed to visualize real-time traffic, blocked IPs, and system metrics.

Key Contributions

• Decentralized Protection Architecture: The paper introduces a model where the Blockchain layer serves as an immutable, decentralized gatekeeper, preventing malicious traffic from reaching the central server.
• Automated Mitigation: Unlike traditional systems that only detect, this framework utilizes Smart Contracts to automatically execute blocking actions based on pre-programmed rules, thereby minimizing the attack impact in real-time.
• Comprehensive Evaluation: The study expands evaluation metrics beyond simple detection accuracy. It includes parameters for DoS attack minimization, prevention capability, latency, throughput, CPU/memory utilization, and AUC/ROC curves.
• Model Comparison: The research provides a comparative analysis of eight ML/DL models to identify the most effective algorithm for DoS detection within this specific blockchain context.

Results
The experimental results, based on the CIC-DDoS2019 dataset, indicate the following:

• Best Performing Model: The Convolutional Neural Network (CNN) model demonstrated superior performance compared to other models (including Random Forest, XGBoost, and Hybrid models).
• Accuracy and Prevention: The CNN model achieved a DoS attack detection accuracy of 98.3% and a 100% prevention/minimization capability. In contrast, other models, such as Random Forest, showed high detection accuracy (99%) but lower prevention capabilities (83.83%).
• Performance Metrics: The system demonstrated an average latency of approximately 48.48 milliseconds across the tested models. The CNN model showed a perfect Area Under Curve (AUC) value of 1 for all classes, indicating pure categorization.
• Simulation Outcomes: In the simulated environment, when client requests exceeded the 1,000-request threshold, the system successfully identified the attack, blocked the source IP via the Smart Contract, and reduced the traffic load, as visualized in the interactive dashboard.

Significance and Claims
The authors claim that this study offers a robust solution to the limitations of centralized cybersecurity systems. By leveraging the decentralized and immutable nature of Blockchain, the proposed framework not only detects anomalies but actively prevents service disruption. The paper asserts that the integration of Blockchain Smart Contracts with high-accuracy ML models (specifically CNN) provides a "great choice" for securing client-server networks against DoS attacks.

The study concludes that while the proposed model is highly effective in simulation, its full potential lies in real-world implementation. The authors modestly note that the current reliance on the CIC-DDoS2019 dataset presents limitations due to its size and class imbalance, and they recommend the development of a more balanced, lightweight dataset for future research. They also acknowledge that deploying this solution in a real-world environment would require significant hardware and software resources.