# Blockchain Behavioral Traffic Model as a Tool to Influence Service IT Security
## 5 Network Characteristics of Blockchain Technology  
The network interaction process and traffic technical characteristics need to be identified to analyze the behavioral model [13, 19]. It is also necessary to review the impact on the network due to the large number of transactions, because during the exchange process, the blockchain generates additional traffic to update the registries on all involved nodes, and there is an increased volume of service traffic that occurs when data is encrypted, which significantly reduces the proportion of useful traffic [20]. There are technologies that allow the capturing and analysis of traffic for subsequent attacks. Deep Packet Inspection (DPI) technology is one of them. Deep Packet Inspection is intended for deep packet analysis, which inspects not only headers of packets at different levels but also the data content. DPI analysis depends on the following traffic identification instruments [3]:  
* Clearly defined rules. The system administrator sets rules and policies by means of a full or partial activation of desired rulers and policies from kits provided by the software developer. * Signature analysis. Signature analysis is an analysis where the system searches the packet structure and compares it with known cases. Simply put, this is a set of packet bytes intended for clearly defining which application or protocol the traffic belongs to and classifying it. DPI systems use scanning instruments based on the fact that all known protocols have their exact signatures. If a match is detected, the package is regarded as recognized and becomes available to other programs. * Heuristic analysis. Heuristic analysis is a technology designed to detect traffic by concrete features (without guaranteed accuracy). This method is responsible for the incomplete but very close matching of packets with known signatures. The main advantage of this method is that it allows the detection of the desired traffic even before the signature is updated for it. * Traffic behavior analysis. Traffic behavior analysis is regarded as one of the most promising analysis techniques in DPI traffic control systems, as it can define almost any traffic behavior model with high processing speed and a high accuracy of traffic identification. This technique increases the ability to identify applications with encrypted payloads. To identify traffic by means of a behavioral analysis, a certain interval of time is tracked, during which traffic is transmitted. On the basis of the traffic behavior analysis performed during this interval and by comparison with the database, a decision is made. The main characteristics for identifying a stream are the sequence of the sizes of transport layer segments, the sequence of the data chunk sizes, and size. Deep Packet Inspection is designed to determine which application has generated or received data and take some action based on this data. General traffic identification can be reached by means of sharing with other analysis techniques. What happened earlier on one device is now duplicated among all nodes, so the number of transmitted messages is higher (Figure 3). These data are transmitted in small portions but in a short period of time, which leads to an unexpected burst of transmitted messages. Network load (\(\rho\)) will depend on:  
\[\rho\sim F(n,\alpha_{n},d,\lambda_{n},\mu,k_{i}) \tag{1}\]  
where:  
n stands for the number of nodes in the blockchain network (units);  
\(\alpha_{n}\) stands for the intensity of formatted transactions (transactions per second);  
k\({}_{i}\) stands for the number of routers involved (units);  
\(\mu\) stands for the packet processing intensity of routers (packets per second);  
\(\lambda_{n}\) stands for the intensity of packet formation (packets per second);  
d stands for the block size (bytes). Consequently, when forming and confirming a transaction, the blockchain provokes an avalanche of network load.