This PR proposes to introduce a new subsystem for anomaly detection and notifications of those for corrective behaviors. It showcases a proof-of-concept laying out the design of such a new system with a new heuristic.
Prevention of eclipse-attacks and network partitions is critical for application security and user funds. Beyond fork detection and obvious protocol misbehavior, Bitcoin Core doesn’t implement any active anomalies detection. These vulnerabilities may be even more destructive for time-sensitive protocol with harder security assumptions, such as those requiring real-time block processing with regards to honest majority network. Active detection at the base-layer, where it’s easier to monitor, may be used in two ways: a) With an application, like a payment system or a LN node, cutting its deposit flow or closing its channels in reaction or stopping HTLC processing, and therefore limiting exposure. b) With an internal Bitcoin Core module, triggering rescue header-fetching – see the AltNet subsystem proposal as an example of consumer usage.
Even if notifications must be interpreted according to application requirements, such automatic reactions, well-implemented, would be a positive increase for their security.
Detection may rely on a wide range of cross-layer heuristics, including the local clock, packets RTT, ASN distribution among addrman, abnormal peer rotation, stalling or delayed block issuance, mempool congestion and bandwidth consumption surges. You may combine heuristics to increase confidence, but due to the p2p nature of the network or Poisson block interval false positives must be taken into account. Ideally consumer would be able to fine-tune their false-positives exposure with regards to application security and the cost of their reaction.
This PR introduces a new module (CWatchdog), with low-reliance on other modules beyond synchronous events harvesting (LogHeader). Anomalie detections (ScanAnomalie) is scheduled each SCAN_ANOMALIES_INTERVAL on its own thread. Integration is done with NodeContext, making the module accessible to future RPCs. A subscription interface (CWatchdogInterface) is added, the model of CValidationInterface. This can host the actual fork detection in the future after refactoring CheckForkWarningConditions.
This new module, less intertwined with current code can be disabled by default, and only activated with --enable-watchdog by node operators willingly to use it.
