# Blockchain Behavioral Traffic Model as a Tool to Influence Service IT Security
## 6 Traffic Analysis of Blockchain Technology  
To analyze the traffic behavior on the network, five virtual Linux Ubuntu 18.04 LTS -based clients were created. These clients were connected with each other and also with an external network, and were given minor and transaction initiator roles.  
The generalized experiment design is presented in Figure 4.  
In the course of experiments, virtual clients sent transactions to a similar client with a frequency of four transactions per second. The experiments were carried out at different times of the day with the same sequence of actions.  
The data were obtained within 50 tests and processed by the mathematical tool of statistical analysis.  
The results presented in diagrams of the packet traffic load (Figure 5, Figure 6, and Figure 7) reflect that, regardless of the time of day, traffic is transmitted by similar distributions with slight variation. It is a traffic stream with avalanche-like bursts of intensity.  
In addition, diagrams that determine the distribution dependence of the packet number on the packet size and frequency distribution of time intervals between packets are of special interest.  
The diagrams that determine the dependence of the packet number on the packet length (Figure 8) represent that most of the packets (85%) are between 65 and 250 bytes and include traffic transmitted during data synchronization between nodes. We can determine the traffic type (9%) transmitted within transactions with a length of over 1100 bytes.  
Figure 3: A blockchain traffic flow diagram.  
Figure 4: The generalized experiment design.  
Figure 5: A diagram of the packet traffic load upon initial synchronization with the network.  
Figure 6: A diagram of the packet traffic load when synchronizing a node with neighbors and mining.  
When analyzing the ratio of packet number to the time between packets, it can be noted that there is dependence as shown in Figure 9, but, in turn, the delay for most packets did not exceed 0.2 ms in any experiment.  
Figure 8: A diagram of the dependence of the packet number (%) on the packet length.  
Figure 7: A diagram of the packet traffic load after synchronization and mining.  
Figure 9: A diagram of the ratio of the packet number (%) to the time between packets (ms).  
Subsequently, the study included a statistical analysis of the received data.  
The following are true for both dependencies:  
* As the variation coefficient is over 70%, the totality is getting closer to the verge of heterogeneity.
* The As and Ex values are close to zero. Therefore, it can be assumed that this sample is close to the log-normal distribution.
* Testing the hypothesis by [PERSON]'s test shows that there is no reason to reject the hypothesis of log-normal distribution.
* Thereby, these dependencies can be represented in the context of the mathematical model of a logarithmic normal distribution with different weighting coefficients. The diagrams are presented in Figures 10 and 11.  
Statistical analysis showed that the individual characteristics of blockchain traffic can be modeled by means of the closeness of the distribution to a normal one, allowing the use of analysis model data to identify blockchain traffic with its forecasting.  
Therefore, to hide traffic, the characteristics, presented in the study, need to be dynamically changed. To change the distribution dependence of the number of packets on their size, the length of blocks can be artificially varied.  
Figure 11: Comparison of the obtained results with the values obtained in the log-normal distribution.  
Figure 10: Comparison of the obtained results with the values obtained in the log-normal distribution.  
The main solutions for these kind of changes are software utilities or manual data transmission from the device. To change the dependence of the frequency distribution of time intervals between packets, artificial time shifts between packet transmissions, as well as changes in the packets' size and algorithm of transmission, should be considered.