Fine-grained Ethereum behavior identification via encrypted traffic analysis with serialized backward inference

Abstract

Blockchain has developed rapidly in recent years. Asymmetric to the rapid development of the blockchain industry is the backwardness of blockchain regulatory technology. The existing research on blockchain security mainly explores blockchain technology and focuses on analyzing on-chain data. We argue that analyzing blockchain network traffic can provide a new perspective on building behavior patterns and blockchain regulation. Ethereum, as the most applied blockchain platform, has flourished with the maturity of blockchain technology. Monitoring fine-grained Ethereum behaviors is essential for the healthy development of Ethereum. However, different Ethereum behaviors are transmitted in an encrypted and persistent connection and are difficult to segment. Besides, the four Get class behaviors, including getBlockHeaders, getNodeData, getReceipts, and getBlockBodies, are indistinguishable from Ethereum traffic. This work proposes a Fine-grained Ethereum Behavior Identification system via encrypted traffic analysis with Serialized Backward Inference, dubbed FEBI-SBI. FEBI-SBI first performs Ethereum behavior traffic segmentation using packets with a load length of 32 Bytes and ACK values larger than their preceding packets in the same direction as the segmenting points. Then, the flow segments for Ethereum behaviors are fed to machine learning classifiers to perform coarse-grained Ethereum behavior identification. Finally, for the Get class behaviors indistinguishable by the machine learning classifiers, FEBI-SBI applies behavior serialized backward inference to identify them from their corresponding fine-grained Send class behaviors identified by the machine learning classifiers. Our experimental results demonstrate the effectiveness and efficiency of FEBI-SBI in identifying fine-grained Ethereum behaviors. FEBI-SBI can be applied to effectively identify anomaly behaviors on the Ethereum network and thus enable the regulation of Ethereum users.