Profiling of Malicious Users Targeting Ethereum’s RPC Port Using Simple Honeypots

Blockchain is a service operated by a peer-to-peer type distributed network, and protocol control such as JSON-RPC is implemented as the interface for flexibility and operability. However, attacks that use protocol control against vulnerable and unmanaged interfaces have been reported. One of the methods to track cyber attacks on such a malicious user's network service is a honeypot that imitates the service and acquires attacker's behavior information. In this research, focusing on the Ethereum network, the behavior of malicious users is clarified using malicious communication history sent to simple honeypots installed in nine countries, Ethereum network information and darknet arrival packets. By analyzing these, the behavior of attackers and the tendency of requests were elucidated, and primary safety measures were established.