Blockchain-based Verifiable DDoS Detection Framework
Distributed Denial of Service (DDoS) attacks are one of the major threats to current network security. Although the existing DDoS detection methods based on machine learning have achieved high accuracy, there are still “black box” problems, such as the detection results cannot be verified, the model version cannot be traced, and accountability cannot be held after misjudgment. This paper proposes a verifiable DDoS detection framework based on blockchain. The framework extracts the multi-dimensional characteristics of network traffic (packet rate, SYN ratio, IP diversity, traffic sudden increase), and then fuses rule detection with XGBoost + Random Forest ensemble model for DDoS recognition, with a detection accuracy of 80.40%. After that, the input features, model versions and output decisions in the detection are packaged into evidence packages, and the SHA-256 hash is calculated to be deposited into the FISCO BCOS alliance chain. The experimental results indicate that compared with the traditional Isolation Forest scheme, the accuracy of this framework on the KDD99 dataset is improved by 20.30%, the F1 score is increased by 36.16%, a single evidence verification only takes 0.04 ms, the average uplink delay is 291.5 ms, and the storage overhead is reduced by 83.1%. The framework provides an effective solution for the trustworthiness, verifiability and traceability of DDoS detection.