0

Currently, I have the following architecture:

Multiple honeypots for VoIP which detects voice attackers. These honeypots collect IP and SIP information. Using a Publisher/Subscribe model (Observer pattern), Publisher notifies clients or subscribers, about attackers in order to update their infrastructure firewalls or by adding VoIP rules blocking attackers dialed number. Example:

I detect an IP from France is scanning my network trying to place calls to a number in Dubai. I notify agent which in turn will update firewall access list and my VoIP software to create a block rule to that destination.

As I want to partner with other companies, my goal is to have a shared database where we can access the information we are collecting, the risk is that as it grows, attacker can insert valid IP addresses or valid numbers, (Example block IPs from our major ITSP, or block the number to our most important customer) While a whitelist can easily solve this issue.

What I would like to know is if Blockchain will be a valid use case where information containing only suspicious IPs and dialed Telephone numbers/SIP URIs are validated by all parties and shared. I started a prototype based on this Blockchain.

The idea is that each Honeypot submits a transaction with IP/SIP attacker data. The transaction is mined and added to blockchain. But how can I remove an IP which is no longer valid? Any suggestions?

Flow:

1) Honeypot detects attacker

2) Honeypot submit new transaction to Blockchain:

curl "localhost:5002/transactions/new" -H "Content-Type: application/json" -d '{"sender": "honeypot-2", "recipient":"twilio", "amount": 111, "hosts": ["192.99.38.121"]}'

3) Transaction is mined.

curl "localhost:5002/mine"

4) It is detected that 192.99.38.121 is no longer a threat, how to remove it from blockchain securely?

Improve this question

1 Answer 1

Reset to default
1

A transaction cannot be removed from a blockchain without recomputing the block that contains that transaction and all blocks that came after it. The best you could do is to have a transaction that nullifies the transaction that inserted the data.

Improve this answer
2
  • Thanks, do you have any suggestions in how the format or flow may look like? Since I will be adding a host (by IPv4) and possibly keep adding it, if it is reported as an attacker. Let's say this host got infected but now is fine, hence we need to remove it from "blacklist" or nullify it as you suggested. In the blockchain that hosts exists many times, can you point me to out to an example? Maybe using credits and associate that money(credits) with this data may be an option?
    – gogasca
    Commented Feb 22, 2018 at 4:51
  • 1
    Bitcoin has something called the UTXO set, and it might be better for you to use something like that. In Bitcoin, each transaction consumes Unspent Transaction Outputs (thus removing them from the UTXO set) and then creates different Unspent Transaction Outputs (thus adding them to the UTXO set). You could do something where you do something like creating outputs where IP addresses are added to the blacklist. Removing IP addresses would be analogous to spending a UTXO. The full blacklist would be like the UTXO set.
    – Ava Chow ♦
    Commented Feb 22, 2018 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.