You can do whatever you want, I guess. And the nexus of block chain and AI sounds like some TED talk people would salivate over. The better question is does it improve on the state of the art of already well established, easily understood IT management practice.

In the end, the result would be the administrator patching the software. So cut to the chase and patch the software. Unknown security vulnerabilities will not be known to the AI, and known vulnerabilities would be patched. So a non-AI system, like a script can easily pull a new version and refresh the code in response to a vulnerability.

Its like needing an AI to predict when my car will need gas, or just fill the tank up once a week.

Robert Mahar & Aleksandar S. Sokolovski I would like to thank you for your valuable suggestions.

One thing is clear that using ML, we can only configure known security threats. For unknown security threats can we use any risk based prediction model/technique?

Can we leverage AI into IDS system to remove human element. So based on cases system can auto invoke solution scripts?

We are looking for an Intrusion Detection and Prevention System for Blockchain Platforms in distributed environment.

Hi Mahendra

It depends.

When considering the use of blockchain, you need to think first about the context in which it will be used. Will it be linked to crypto-currency? Will it be used for some other purpose? Will it be running as a public blockchain, a private blockchain, or will there by a hybrid element planned?

The reason to understand this is to try to identify all the right levels of risk you are facing. Anything tied into any form of crypto-currency, or anything valuable, such as intellectual property (IP) will attract an exceptionally high level of interest from attackers. This should influence your decision as to whether you go public blockchain or not.

The fundamental building block of any crypto-currency is the blockchain, and it is incredibly robust when set up as a public blockchain. First, blockchain provides an immutable audit trail of every single transaction. You cannot change any transactions in the blockchain, you can only adjust it by adding a new record to it, thus leaving a full and permanent record of every element of the overall transaction. The other strength of the public blockchain is that there must be a consensus of blockchain nodes to be able to formally agree the chain of events being recorded. This means in order to overcome the blockchain with malicious transactions, you would need to create a series of new transactions on a number of new nodes greater than the total number of blockchain nodes already in existence, which, as a public blockchain could number in the hundreds of thousands or even millions of nodes. This is likely to be well beyond the financial capabilites of most attackers.

However, running a public blockchain also means you need to provide a means of rewarding the miners who create the additional security by the cryptographic tasks they carry out on behalf of the blockchain. This can lead to the idea of running a private blockchain, but then, you need to create all the nodes, finance the update and running of those and to protect them from attack. This becomes a more realistic prospect for a serious attack, so can expose you to much greater risk.

Turning to question 1, in a public blockchain, there will likely be few blockchain related vulnerabilities to consider, unlike in a private blockchain, where you will have to take full responsibility for ensuring the protection of all your blockchain nodes, and this will likely revolve around many of the exiting vulnerabilities that everyone faces with their data systems. What about all the massive successful attacks on crypto-currencies? If you analyse these attacks carefully, you will see that none were successful in breaching the underlying blockchain, all used other weaknesses in the organisation of the systems, or the naivety of the people running the companies to gain access. Did you know that the original bitcoin used as leverage to perpetrate the $460 million Mt Gox attack has never been claimed, since revelation of the user's details would lead to instant arrest.

So your database will be rather light on blockchain vulnerabilities, but full of other weaknesses instead. With a private blockchain, depending on the number of nodes and how they are configured, you may have more weaknesses to contend with. Of course, with the public blockchain, your database will be very small indeed - because you will only be able to scan the blockcahin nodes under your own control. You can certainly put your findings into an ML platform, but it will not have a great deal to do.

As for question 2, neither AI nor any other technology is likely to be able to help you here, because your AI system is unlikely to be able to interrogate all the blockchain nodes involved at precisely the same time to check the consensus of the state of the overall blockchain.

And as for question 3, of course you can alert the admins to whatever you want. You just won't have much that is relevant to their needs.

Finally, any AI/ML or anything else you plan to use will generally only learn from known vulnerabilities, and will only learn from the nodes under your own control. This is the point of blockchain - it is public, yet anonymous at the same time.

On the other hand, if you are building a brand new system, then you will be able to control how new nodes can be spawned, and how these will be rewarded, and will have more ability to understand what is going on with them, and possibly control over them.

But ultimately - it depends!

I hope this helps

Bob

interesting discussion

Please read the following paper : Ferrag, M. A., Derdour, M., Mukherjee, M., Derhab, A., Maglaras, L., & Janicke, H. (2019). Blockchain technologies for the internet of things: Research issues and challenges. IEEE Internet of Things Journal, 6(2), 2188-2204. https://ieeexplore.ieee.org/abstract/document/8543246/