METHOD FOR ENHANCING THE SECURITY OF DECENTRALIZED SYSTEMS THROUGH ADAPTIVE ANOMALY DETECTION IN BLOCKCHAIN NETWORKS USING MACHINE LEARNING

Abstract

The article addresses the problem of ensuring the security of decentralized information systems, particularly blockchain networks, which are becoming widely adopted in modern information technologies. It is determined that the characteristic features of such systems include the absence of centralized control, the distributed nature of data processing, and network openness. On the one hand, these features increase fault tolerance, but on the other hand, they create new attack vectors and complicate the threat detection process. The main types of attacks inherent to blockchain environments are analyzed, including Sybil attacks, double-spending attacks, and anomalous node behavior. The necessity of developing proactive threat detection methods based on analyzing the behavioral characteristics of network participants is substantiated. A method for enhancing the security of blockchain networks is proposed, which combines a graph-based representation of the transactional structure, extraction of informative features, and the application of machine learning algorithms. The blockchain network is formalized as a directed graph, allowing for the consideration of topological and temporal aspects of node interactions. A feature space is formed, including transactional, temporal, structural, and behavioral characteristics.To detect anomalies, the Isolation Forest algorithm is used, which effectively identifies nodes with atypical behavior without the need for labeled data. Additionally, an adaptive node trust metric is introduced, which takes into account both the anomaly level and the deviation of behavioral characteristics from the normal state, thereby improving the accuracy and stability of the assessment. Conducted simulations confirm the effectiveness of the proposed approach. The obtained results demonstrate an increase in anomaly detection accuracy by 7-13% compared to traditional methods, as well as a reduction in the number of false positives. The proposed method is characterized by adaptability, scalability, and the ability to be integrated into real blockchain platforms. The practical value of the work lies in the possibility of using the obtained results to create security monitoring systems for decentralized environments, as well as to enhance the reliability of information systems in the fields of financial technology, cybersecurity, and distributed computing.