# Application of Graph Theory for Blockchain Technologies
## 5 Graph Theory Application in Blockchain Systems
### Evaluating Security and Privacy
#### 5.2.2 Threat Modelling  
Blockchain technology is renowned for its security features; however, lots of studies prove that the security mechanism of blockchain exposes its vulnerability especially when the blockchain suffers attacks [72]. Ideal systems do not exist and so blockchain has a number of problems, requiring attention on the security vulnerabilities [73]. Based on [74] we narrowed down threat to (1) Domain Name System (DNS) Attacks, (2) Phishing Attacks, (3) Border Gateway Protocol (BGP), (4) Eclipse Attacks, (5) Distributed Denial of Service Attacks (DDoS), and (6) 51% attack categories under the network context [72; 75]. In the section, we have employed the Erdos-Renyi model, a common model for generating random graphs, which is used to simulate the network topology [76] for simulating the threat model [77]. DNS Attacks. In the realm of blockchain technology, DNS attacks pose a serious threat to the integrity of network communication. The Domain Name System (DNS) acts in translating domain names to IP addresses. However, if compromised, it can lead to the isolation of network participants. Graph theory provides an analytical framework to model and study the repercussions of such attacks. Here, we present a graph theory-based mathematical proof of how DNS attacks can isolate users and miners from the genuine network. **Assumption 6**:  
_Let us consider the following assumptions within our graph model:_  
* _A directed graph_ \(G=(V,E)\)_: A directed graph where_ \(V\) _is the set of nodes representing users, miners, and DNS servers, and_ \(E\) _represents the communication links between these nodes._
* _Node Function_ \(r(v)\)_: Each node_ \(v\in V\) _is assigned a role indicating whether it is a user/miner (U) or a DNS server (D)._
* _DNS Integrity_ \(s(d)\)_: Each DNS server node_ \(d\) _has a status indicating whether it is legitimate (L) or compromised/malicious (M)._  
**Application Statement 6**:  
* _For a blockchain network represented by graph_ \(G\) _with assumptions as stated, DNS attacks can isolate a subset of nodes_ \(U\subseteq V\)_, such that_ \(U\) _consists solely of users and miners from the genuine network by manipulating the resolutions provided by DNS servers._  
**Proof. **  
* Attack Initiation: An attacker manipulates a subset of DNS server nodes \(D_{M}\subseteq V\) such that their status \(s(d)\) for all \(d\in D_{M}\) is changed from \(L\) to \(M\). * Resolution Compromise: As users and miners initiate DNS queries, these requests are intercepted by \(D_{M}\). Thus, the set of edges \(E_{U}\subseteq E\) from \(U\) now points to \(D_{M}\), and their integrity status \(i(e)\) for all \(e\in E_{U}\) changes from \(V\) to \(I\). * Network Isolation: The DNS resolutions from \(D_{M}\) redirect \(U\) to endpoints outside the genuine blockchain network resulting in an isolation set \(I_{S}\subseteq U\). * Isolation Quantification: The isolation metric \(I_{M}\) is defined as the ratio of the number of isolated user/miner nodes to the total number of user/miner nodes, i.e., \(I_{M}=|I_{S}|/|U|\). If \(I_{M}>0\), it implies that the DNS attack was successful in isolating at least a portion of the network's participants. In the Figure 7 Nodes labeled \"User_x\" nodes represent individual users within the network.The nodes labeled \"DNS_Legit\" represent legitimate DNS servers. The nodes labeled \"DNS_Malicious\" represent DNS servers that have been compromised or are malicious. Edges represent communication links or DNS queries made from users to DNS servers. Black edges represent legitimate DNS queries directed towards legitimate DNS servers. Red edges signify DNS queries that have been redirected to the malicious DNS servers due to the DNS attack. Green nodes indicate non-compromised, functioning DNS servers. Blue nodes represent unaffected users or users who are not the current target of the attack. Red nodes indicate DNS servers that have been compromised and are under the control of an attacker.