The Evaluation of Extracted Features for Detecting Eclipse Attacks on Ethereum Network Layers

An eclipse attack is a strategy where attackers control communication between nodes in peer-to-peer networks, such as Ethereum, using compromised nodes to escalate further attacks. Given the vast and complex nature of big data in Ethereum networks, detecting these attacks is challenging. This paper aims to identify effective features for eclipse attack detection by analyzing large volumes of network traffic data. We simulate an Ethereum network, conducting eclipse attacks to generate datasets where 28% of the traffic consists of malicious packets. We apply five feature extraction methods—common network traffic, Entropy, φ-Divergence, packet communication statistics, and packet characteristics statistics—leveraging big data analysis techniques to process and refine extensive traffic data. To address the challenges posed by imbalanced and overlapping data, SMOTE and Tomek link algorithms are used, and Mutual Information selects the most significant features to enhance classifier performance. We evaluate five machine learning models, including XGBoost, kNN, and Random Forest, finding that XGBoost achieves the highest performance, with 99.25% accuracy and a computational time of 184 ms when processing the top 25 features, which indicates real-time detection could be possible.