gShock: A GNN-Based Fingerprinting System for Permissioned Blockchain Networks Over Encrypted Channels

Blockchain technology has ushered in a transformative paradigm of decentralized and transparent systems, offering innovative solutions across diverse sectors. While these systems strive for unparalleled transparency and trustlessness in a fully distributed framework, permissionless blockchains, such as Bitcoin and Ethereum, encounter vulnerabilities due to their intrinsically public nature. Addressing these vulnerabilities, the emergence of permissioned blockchains presents a fortified alternative, incorporating rigorous access controls and authentication protocols to ensure participation exclusivity and transaction confidentiality. Nevertheless, a keen observation reveals that, despite encryption, the operational traffic within these blockchains manifests distinct time-series patterns and operational relations during sensitive data exchanges. Such patterns hold the potential to inadvertently expose critical details about the network, encompassing its topology and the operational dependencies among nodes. In light of this revelation, we introduce a pioneering blockchain fingerprinting mechanism, denoted as gShock. This system meticulously analyzes periodic patterns and the context of operational relations from the collected blockchain network traffic. It employs a Graph Neural Network (GNN)-based model, adept at capturing the intricate characteristics innate to specialized blockchain operations. Through empirical experiments conducted in a realistic permissioned blockchain environment, comprising various nodes, we ascertain that gShock demonstrates a remarkable proficiency in classifying blockchain operational traffic with an F1-score of ≥ 96% and identifying individual dependencies with a macro F1-score of ≥ 93%.