LogBlock: An Anomaly Detection Method on Permissioned Blockchain based on Log-Block Sequence

As a popular trust infrastructure, the blockchain is applied in many fields. However, it faces many security problems. Anomaly detection can find operation anomalies including attacks in blockchain. However, existing methods merely cover limited attack types where a critical and harmful type which affects the generation of blocks is still out of consideration. To expand the detect ability for more attacks, we propose LogBlock, a log-based anomaly detection method, aiming at securing permissioned blockchain by using Fabric as an example. First, we construct a specialized dataset containing normal logs, fault logs and attack logs by implementing various real attacks. Second, in order to mitigate the impact on log sequence pattern caused by transaction concurrency, LogBlock designs an analysis method with the log-block sequence. Specifically, logs are divided into log-blocks, whose sequence pattern will be learned by CNN with Transformer to train particular model. Based on the model, anomaly detection is performed to locate the anomalous logs. Experimental evaluations show that LogBlock is more suitable for anomaly detection on the blockchain compared with existing log-based anomaly detection methods.