KR102221736B1 - Blockchain based device and method for endpoint detection and response - Google Patents

Abstract

The present invention relates to a blockchain-based EDR device and method. The device comprises: at least one virtual blockchain container consisting of a logically distributed blockchain storage, respectively; a file block configuration unit configuring a file block with a file fingerprint generated based on at least file metadata; and a blockchain management unit distributedly storing the file blocks in the at least one virtual blockchain container. Accordingly, the present invention may configure a private blockchain network to safely store and manage information collected from endpoints.

Description

Blockchain-based EDR device and method {BLOCKCHAIN BASED DEVICE AND METHOD FOR ENDPOINT DETECTION AND RESPONSE}

The present invention relates to EDR technology, and more particularly, to a block chain-based EDR device and method capable of safely storing and managing information collected from an endpoint by configuring a private blockchain network.

EDR (Endpoint Detection and Response) technology was first introduced in 2013 by Gartner. Here, EDR is defined as a solution that records the behavior and events of an endpoint, and detects and responds to attacks based on the collected behavior and events. In other words, EDR defines the target and starting point of many cyber attacks as endpoints, and starts with the question of what is happening at the endpoints.

EDR collects various information (e.g. process, network traffic, registry, file, user) from the endpoint to ensure the visibility of the endpoint, and then based on the collected various information, behavior analysis, machine learning, IOC (Indicator of Compromise) can detect known and unknown threats with the technology of detection. EDR can detect attacks not only against file-based malicious code but also against malicious code that runs without a file. In addition, EDR can quarantine endpoints where threats are found and enable responses to eliminate threats.

EDR has evolved the attack method and technology of malicious code much faster than the defense technology of the traditional Endpoint Protection Platform.

Korean Patent Registration No. 10-1814368 (2018.01.04)

An embodiment of the present invention is to provide a block chain-based EDR device and method capable of safely storing and managing information collected from an endpoint by configuring a private blockchain network.

An embodiment of the present invention is a block chain-based EDR device and method capable of creating a tracking user session through identification authentication of UIA and generating a block for a block chain based on information on user behavior collected from an endpoint terminal. I want to provide.

An embodiment of the present invention is to provide a block-chain-based EDR device and method capable of safely storing trace target file data by building a multi-blockchain network based on a virtualized block chain container.

Among the embodiments, each of the blockchain-based EDR (Endpoint Detection & Response) devices uses at least one virtual blockchain container composed of logically distributed blockchain storage, and at least a file fingerprint generated based on file metadata. A file block configuration unit constituting a file block and a block chain management unit distributedly storing the file block in the at least one virtual block chain container.

The EDR device may further include an endpoint management unit that generates a user identity-based session according to the generation request received from the EDR terminal device and processes data exchange with the EDR terminal device through the user identity-based session.

Each of the at least one virtual block chain container is independently operated and is uniquely assigned to each block chain forming a private network to form a multi-blockchain network.

The file block configuration unit generates the file fingerprint as a hash code calculated by applying a hash function to file metadata, and uses the file fingerprint, the SYSCALL graph received from the EDR terminal device, and the location information of the previous file block. You can construct blocks.

The file block configuration unit further determines a file safety level based on the at least file metadata and adds it to the file block, and the block chain management unit comprises a plurality of blocks constituting the multi-blockchain network based on the file safety level. You can store the fileblock by specifying any one of the chains.

The blockchain management unit configures each of a plurality of physically distributed blockchain storages as independent real blockchain nodes, uniquely allocates them to each blockchain of the multi-blockchain network, and is a separate private network consisting only of the real blockchain nodes. Can be configured.

The block chain management unit can spread the file block to the multi-blockchain network by storing the block in a distributed manner in the actual block chain node.

Among the embodiments, the blockchain-based EDR method includes the steps of creating at least one virtual blockchain container consisting of logically distributed blockchain storage, at least a file block with a file fingerprint generated based on the file metadata. And storing the file block distributedly in the at least one virtual block chain container.

The disclosed technology can have the following effects. However, since it does not mean that a specific embodiment should include all of the following effects or only the following effects, it should not be understood that the scope of the rights of the disclosed technology is limited thereby.

The block chain-based EDR device and method according to an embodiment of the present invention creates a tracking user session through identification authentication of UIA and generates a block for a block chain based on information on user behavior collected from an endpoint terminal. I can.

The block chain-based EDR device and method according to an embodiment of the present invention may securely store track target file data by building a multi-blockchain network based on a virtualized block chain container.

1 is a diagram illustrating the configuration of a block chain-based EDR system according to the present invention.
FIG. 2 is a block diagram illustrating a physical configuration of the EDR device in FIG. 1.
3 is a block diagram illustrating a functional configuration of the EDR device in FIG. 1.
4 is a flowchart illustrating a block chain-based EDR process performed in the EDR device of FIG. 1.
5 and 6 are conceptual diagrams illustrating a block chain-based EDR system according to an embodiment of the present invention.

Since the description of the present invention is merely an embodiment for structural or functional description, the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, since the embodiments can be variously changed and have various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical idea. In addition, since the object or effect presented in the present invention does not mean that a specific embodiment should include all or only such effects, the scope of the present invention should not be understood as being limited thereto.

Meanwhile, the meaning of terms described in the present application should be understood as follows.

Terms such as "first" and "second" are used to distinguish one component from other components, and the scope of rights is not limited by these terms. For example, a first component may be referred to as a second component, and similarly, a second component may be referred to as a first component.

When a component is referred to as being "connected" to another component, it should be understood that although it may be directly connected to the other component, another component may exist in the middle. On the other hand, when it is mentioned that a component is "directly connected" to another component, it should be understood that there is no other component in the middle. On the other hand, other expressions describing the relationship between components, that is, "between" and "just between" or "neighboring to" and "directly neighboring to" should be interpreted as well.

Singular expressions are to be understood as including plural expressions unless the context clearly indicates otherwise, and terms such as "comprises" or "have" refer to implemented features, numbers, steps, actions, components, parts, or It is to be understood that it is intended to designate that a combination exists and does not preclude the presence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

In each step, the identification code (for example, a, b, c, etc.) is used for convenience of explanation, and the identification code does not describe the order of each step, and each step has a specific sequence clearly in context. Unless otherwise stated, it may occur differently from the stated order. That is, each of the steps may occur in the same order as the specified order, may be performed substantially simultaneously, or may be performed in the reverse order.

The present invention can be implemented as computer-readable code on a computer-readable recording medium, and the computer-readable recording medium includes all types of recording devices storing data that can be read by a computer system. . Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage devices. Further, the computer-readable recording medium is distributed over a computer system connected by a network, so that the computer-readable code can be stored and executed in a distributed manner.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the field to which the present invention belongs, unless otherwise defined. Terms defined in commonly used dictionaries should be construed as having meanings in the context of related technologies, and cannot be construed as having an ideal or excessively formal meaning unless explicitly defined in the present application.

1 is a diagram illustrating the configuration of a block chain-based EDR system according to the present invention.

Referring to FIG. 1, a block chain-based EDR system 100 may include an EDR terminal device 110, an EDR device 130, and a database 150.

The EDR terminal device 110 may correspond to a computing device capable of detecting an act that threatens the system by authenticating the identity of a user accessing the network and tracking the user's behavior, and implemented as a smartphone, laptop, or computer. It may be, but is not limited thereto, and may be implemented in various devices such as a tablet PC. The EDR terminal device 110 may be connected to the EDR device 130 through a network, and a plurality of EDR terminal devices 110 may be connected to the EDR device 130 at the same time.

In one embodiment, the EDR terminal device 110 may correspond to a user or a work PC as an endpoint terminal, and collects information on user actions and transmits it to a front-end server. You can control the behavior of the endpoint agent. In addition, the EDR terminal device 110 may authenticate the user's identity, and may restrict the user's access and use by interworking with the endpoint agent.

Here, the endpoint agent may correspond to a program running on the endpoint terminal and may perform a role of monitoring user behavior. The endpoint agent may include a user tracker, a network data tracker, a file metadata handler, and a security policy enforcer.

User tracker can perform actions to track user behavior, network data tracker can perform actions to collect and analyze network traffic data, and file metadata handler actions to extract and analyze metadata from files. May be performed, and the security policy executor may perform an operation of determining whether to allow the user's behavior according to the security policy received from the EDR device 130.

In one embodiment, when the file data associated with the user's behavior is a tracking target file, the EDR terminal device 110 transmits the metadata of the tracking target file to the EDR device 130 and transmits the corresponding metadata from the EDR device 130. When a change notification of is received, a SYSCALL graph may be generated and provided to the EDR device 130.

The EDR device 130 may be implemented as a server corresponding to a computer or program that stores and manages information on a user's behavior collected from the EDR terminal device 110 in a block chain. In addition, the EDR device 130 may perform operations such as learning, analysis, and detection of a user's behavior through interworking with the analysis server.

At this time, the analysis server may detect SIEM (Security Information and Event Management) based threat behavior, analyze artificial intelligence based threat behavior, and perform operations related to security policy creation and update. For this operation, the analysis server can be implemented including a SIEM-based threat behavior detector, an unsupervised learning-based threat behavior analyzer, a hybrid AI-based threat behavior analyzer, and a security policy updater.

In addition, the EDR device 130 may be wirelessly connected to the EDR terminal device 110 through Bluetooth, WiFi, a communication network, and the like, and may exchange data with the EDR terminal device 110 through a network.

In one embodiment, the EDR device 130 may interwork with the database 150 to store and manage information collected from the endpoint terminal. Meanwhile, unlike FIG. 1, the EDR device 130 may be implemented by including the database 150 therein. The EDR device 130 may be implemented including a processor, a memory, a user input/output unit, and a network input/output unit, which will be described in more detail with reference to FIG. 2.

The database 150 may correspond to a storage device that stores various pieces of information required during the operation of the EDR device 130. The database 150 may store information on user behavior collected from the EDR terminal device 110, but is not necessarily limited thereto, and is collected or processed in various forms in the process of interworking with the EDR terminal device 110 and the analysis server. Stored information.

In one embodiment, the database 150 may operate in conjunction with a private blockchain network. Meanwhile, the private blockchain network may be implemented as a virtual blockchain container, and in this case, the private blockchain network may operate as a component of the EDR device 130.

FIG. 2 is a block diagram illustrating a physical configuration of the EDR device in FIG. 1.

Referring to FIG. 2, the EDR device 130 may include a processor 210, a memory 230, a user input/output unit 250, and a network input/output unit 270.

The processor 210 may execute a procedure for processing each operation of the EDR device 130 and manage the memory 230 that is read or written throughout the process, and the volatile memory in the memory 230 and Synchronization time between non-volatile memories can be scheduled. The processor 210 can control the overall operation of the EDR device 130, and is electrically connected to the memory 230, the user input/output unit 250, and the network input/output unit 270 to control data flow between them. have. The processor 210 may be implemented as a central processing unit (CPU) of the EDR device 130.

The memory 230 may include an auxiliary memory device that is implemented as a nonvolatile memory such as a solid state drive (SSD) or a hard disk drive (HDD), and is used to store all data required for the EDR device 130, and RAM A main memory device implemented as a volatile memory such as (Random Access Memory) may be included.

The user input/output unit 250 may include an environment for receiving a user input and an environment for outputting specific information to a user. For example, the user input/output unit 250 may include an input device including an adapter such as a touch pad, a touch screen, an on-screen keyboard, or a pointing device, and an output device including an adapter such as a monitor or a touch screen. In one embodiment, the user input/output unit 250 may correspond to a computing device connected through a remote connection, and in that case, the EDR device 130 may be performed as a server.

The network input/output unit 270 includes an environment for connecting to an external device or system through a network, for example, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), and a VAN ( Value Added Network) may include an adapter for communication.

3 is a block diagram illustrating a functional configuration of the EDR device in FIG. 1.

3, the EDR device 130 may include a virtual block chain container 310, a file block configuration unit 330, a block chain management unit 350, an endpoint management unit 370, and a control unit 390. have.

The virtual blockchain container 310 may be composed of a block chain storage, each of which is logically distributed. That is, the virtual blockchain container 310 may correspond to a virtual container that is created independently of a physical computing element, and may operate in correspondence with one node forming a blockchain network. have. Accordingly, the virtual block chain container 310 may perform a role of distributedly storing blocks generated based on information collected from the EDR terminal device 110.

Meanwhile, the virtual blockchain container 310 may be created and managed by the EDR device 130, and more specifically, may be processed through a virtual blockchain container processor included in the EDR device 130.

In one embodiment, each of the virtual blockchain containers 310 is independently operated and is uniquely assigned to each block chain forming a private network to form a multi-blockchain network. The EDR device 130 may store and manage user behavior tracking information on an endpoint in a block chain. In particular, the block chain may be configured as a private network to ensure security and safety.

Here, the private blockchain network is a blockchain in which only authorized persons with legal responsibility can participate in the blockchain network, and only the transaction party and the authorized participant can view it, and use rights can be specified according to the subject. It uses a BFT series consensus algorithm that does not allow branching, and can have high determinism.

In addition, the EDR device 130 may operate a single private blockchain network, but may be configured as a plurality of data according to necessity to perform data management. In this case, the virtual blockchain container 310 may be uniquely allocated for each block chain, and the EDR device 130 may create, allocate, and delete each container through the virtual blockchain container handler.

The file block configuration unit 330 may configure a file block with a file fingerprint generated based on at least file metadata. The file fingerprint may correspond to a compression and expression of unique characteristic information of a file, and may be generated based on metadata of the file. For example, metadata of a file may include a file name, a file size, an author, and a time stamp.

The EDR device 130 may configure a file block stored in the blockchain based on a file fingerprint of a file to be tracked among data collected from the EDR terminal device 110. Accordingly, the EDR device 130 may identify a file to be tracked based on the file fingerprint. On the other hand, the tracking target file may correspond to a file that can have a significant influence on the operation of the system, and it is necessary to strictly manage it so that it is not exposed to unauthorized outsiders.

In one embodiment, the file block configuration unit 330 generates a file fingerprint as a hash code calculated by applying a hash function to file metadata, and generates a file fingerprint, a SYSCALL graph received from the EDR terminal device 110, and A file block can be configured with the location information of the previous file block.

The SYSCALL graph may correspond to a control flow graph indicating a call relationship between system calls (SYSCALL) generated in connection with a user's behavior in the EDR terminal device 110. The SYSCALL graph may be generated by the EDR terminal device 110 and transmitted to the EDR device 130, and the file block configuration unit 330 may configure a file block based on this.

The file block generated by the file block configuration unit 330 may include a file fingerprint, a SYSCALL graph, and location information of a previous file block. Therefore, each file block is a file unit when the contents of the file to be tracked are changed. Can be created and linked with the file block for the previous trace target file. If a file block is stored in a multi-blockchain network, the file block configuration unit 330 can allocate the block chain for each EDR terminal device 110, and as a result, the file data collected on the same EDR terminal device 110 File blocks created on the basis of can be allocated and stored in the same blockchain.

In an embodiment, the file block configuration unit 330 may further add to the file block by determining a file safety level based on at least file metadata. The file safety level may be determined based on the importance of the file, and more specifically, it may be determined by dividing the importance of the numerical file by range section and assigning a grade to each range section. For example, the higher the importance of a file, the higher the file safety level.

The block chain management unit 350 may store file blocks distributedly in at least one virtual block chain container 310. The virtual blockchain container 310 may provide physical decentralization in correspondence with a physical configuration, or may provide virtual decentralization regardless of a physical configuration. Therefore, the block chain management unit 350 can store the file block in the virtual block chain container 310, and the virtual block chain container 310 configures a block chain network to provide the file block to other nodes participating in the block chain. Can spread.

In an embodiment, the block chain management unit 350 may store a file block by designating any one of a plurality of block chains constituting a multi-block chain network based on the file safety level. That is, the block chain management unit 350 may uniquely allocate the block chain in which the file block will be stored according to the file safety level related to the importance of the file when building data with a multi-block chain. When configuring a multi-blockchain, the EDR device 130 can designate a level for each block chain, and can independently define and apply security rules for storage, update, and deletion of the block chain according to each level.

In one embodiment, the block chain management unit 350 configures each of a plurality of physically distributed block chain storages as independent real block chain nodes, uniquely allocates them to each block chain of a multi-block chain network, and uses only real block chain nodes. A separate private network can be configured. In other words, each block chain of a multi-blockchain can be implemented by including a node corresponding to a block chain storage that is actually physically implemented on the network, and a private network consisting only of real block chain nodes that are uniquely assigned to each block chain. Can be interconnected through.

Through this multi-blockchain structure, the block chain management unit 350 can not only perform independent data management for each block chain, but also provide data sharing between each block chain as needed. In this case, the actual blockchain node can play a role as an intermediary for data sharing between each blockchain.

In one embodiment, the block chain management unit 350 may spread the file block to the multi-blockchain network by storing the file block distributedly in the actual block chain node. That is, if the block chain management unit 350 wants to store only a specific block chain among multi-block chains, it can be stored in a node corresponding to the virtual block chain container 310, not in an actual block chain node, and to propagate to the entire multi block chain. If so, it can be stored in an actual blockchain node. Since the actual blockchain nodes form a separate and independent private network, when a file block is stored in an actual blockchain node, the file block can be primarily propagated to the network between the actual blockchain nodes, and secondarily. Each real blockchain node can be propagated to the participating blockchain network.

The endpoint management unit 370 may generate a user identity-based session according to the generation request received from the EDR terminal device 110 and process data exchange with the EDR terminal device 110 through the user identity-based session. The EDR terminal device 110 needs to create a session unique to the user in order to track the behavior of the user in the process of being used by the user. The EDR terminal device 110 may request creation of a user identity-based session through the EDR device 130, and the EDR device 130 may process the request through the endpoint management unit 370.

The user identity-based session may be created and maintained for each user through the EDR device 130, and may be created at the time when the user logs in to the EDR terminal device 110 and maintained until the time at which the user logs out. The EDR terminal device 110 may track and collect related information as a user's actions on files and other actions, and provide them to the EDR device 130 through a user identity-based session.

On the other hand, the EDR terminal device 110 classifies data related to the user's behavior into non-file data and file data, and transmits the non-track target file data among the file data to the EDR device 130 together with the non-file data. have.

That is, the EDR terminal device 110 can classify file data and non-file data into file data and non-file data based on whether the user's actions occurring in the user identity-based session are associated with a file, and separate the file data into a track target file and a non-track target It can be divided into files and provided to the EDR device 130. The EDR device 130 may generate a file block and store it in the blockchain when the contents of the file among the files to be tracked are changed.

The control unit 390 controls the overall operation of the EDR device 130, and the control flow between the virtual block chain container 310, the file block configuration unit 330, the block chain management unit 350, and the endpoint management unit 370 or You can manage the data flow.

4 is a flowchart illustrating a block chain-based EDR process performed in the EDR device of FIG. 1.

Referring to FIG. 4, each of the EDR devices 130 may generate at least one virtual blockchain container composed of logically distributed blockchain storage (step S410). The EDR device 130 may configure a file block with a file fingerprint generated based on at least file metadata through the file block configuration unit 330 (step S430). The EDR device 130 may store the file block distributedly in at least one virtual block chain container through the block chain management unit 350 (step S450).

5 and 6 are conceptual diagrams illustrating a block chain-based EDR system according to an embodiment of the present invention.

Referring to FIG. 5, the blockchain-based EDR system 100 may include an endpoint agent, a front-end server 530 and an analysis server 550 operating in the endpoint terminal 510. The endpoint terminal 510 may correspond to the EDR terminal device 110, and the front-end server 530 may correspond to the EDR device 130.

The front-end server 530 may perform an operation of providing visibility of an endpoint to the analysis server 550 based on information collected from the endpoint agent. The analysis server 550 may play a role of creating and distributing a security policy for use by an endpoint agent.

In particular, the analysis server 550 may periodically provide a security policy to the endpoint agent to induce a certain level of security or higher even when the endpoint agent operates offline. The analysis server 550 may be connected to an independent SIEM (Security Information and Event Management) module for related operations, and may visualize analysis (statistics or alarm) results through various interfaces and provide them to an administrator.

Here, the SIEM module may correspond to an early warning monitoring system for intelligent threats that provides correlation analysis and forensic functions to enable post-mortem tracking, etc., rather than simple log collection and analysis in the vast information of big data. That is, the SIEM module can perform a function to prevent external attacks as well as internal information leakage by monitoring internal and external threats through the security information and event management of the information system.

In FIG. 5, the endpoint terminal 510 may be connected to the front-end server 530 to maintain and update a user identity-based session, and track a user's behavior based on this. To this end, the EDR device 130 may provide a user identifier used to create and maintain a user identity-based session according to a request from the endpoint terminal 510 through the endpoint management unit 570, and the user identity-based session Through this, data exchange with the endpoint terminal 510 may be processed.

6, the blockchain-based EDR system 100 analyzes, detects, and responds to user behavior through interworking between the endpoint terminal 610, the front-end server 630, and the analysis server 650. You can do it.

In particular, the front-end server 630 may be implemented including an endpoint agent processor, a virtual block chain container processor, a block generator for a block chain, and a block query unit.

The endpoint agent processor may perform an operation of tracking and collecting information on user behavior by managing access and user tracking sessions of the endpoint terminal 610. The virtual blockchain container handler is a logical container, not a physical device, and creates a virtual blockchain container 670 to virtualize a distributed DB and perform an operation of managing the blockchain.

In addition, the block generator for blockchain may perform an operation of generating a file block including a fingerprint compressed file metadata, a SYSCALL graph, and a block location of a previous tracked file. The block inquiry machine can perform an operation of inquiring a previous trace target file.

Although the above has been described with reference to preferred embodiments of the present invention, those skilled in the art will variously modify and change the present invention within the scope not departing from the spirit and scope of the present invention described in the following claims. You will understand that you can do it

100: Blockchain-based EDR system
110: EDR terminal device 130: EDR device
150: database
210: processor 230: memory
250: user input/output unit 270: network input/output unit
310: Virtual Blockchain Container 330: File Block Configuration Unit
350: Blockchain Management Department 370: Endpoint Management Department
390: control unit
510, 610: endpoint terminal 530, 630: front-end server
550, 650: Analysis Server 670: Virtual Blockchain Container

Claims (8)

At least one virtual blockchain container each consisting of logically distributed blockchain storage;
A file block configuration unit for configuring a file block with a file fingerprint generated based on at least file metadata; And
Including a block chain management unit for distributedly storing the file block in the at least one virtual block chain container,
Each of the at least one virtual blockchain container is independently operated and is uniquely assigned to each blockchain forming a private network to form a multi-blockchain network,
The blockchain management unit configures each of a plurality of physically distributed blockchain storages as independent real blockchain nodes, uniquely allocates them to each blockchain of the multi-blockchain network, and is a separate private network consisting only of the real blockchain nodes. The multi-blockchain network by distributing the file block to the entire multi-blockchain network by storing the file block distributedly in the real block-chain node, or storing the file block to be distributed to only nodes associated with a specific virtual block chain container. Blockchain-based EDR (Endpoint Detection & Response) device characterized by propagating to only a part.
The method of claim 1,
Blockchain-based, characterized in that it further comprises an endpoint management unit that generates a user identity-based session according to the creation request received from the EDR terminal device and processes data exchange with the EDR terminal device through the user identity-based session. EDR device.
delete The method of claim 1, wherein the file block configuration unit
Generate the file fingerprint as a hash code calculated by applying a hash function to file metadata,
The EDR device based on a block chain, characterized in that the file block is configured with the file fingerprint, a SYSCALL graph received from an EDR terminal device, and location information of a previous file block.
The method of claim 1,
The file block configuration unit further adds to the file block by determining a file safety level based on the at least file metadata,
The block chain management unit stores the file block by designating any one of a plurality of block chains constituting the multi-block chain network based on the file safety level.
delete delete In a method performed in an EDR (Endpoint Detection & Response) device,
Creating at least one virtual blockchain container each consisting of logically distributed blockchain storage;
Configuring a file block with a file fingerprint generated based on at least the file metadata; And
Including the step of storing the file block distributedly in the at least one virtual block chain container,
Each of the at least one virtual blockchain container is independently operated and is uniquely assigned to each blockchain forming a private network to form a multi-blockchain network,
In the step of storing the file block distributedly, each of a plurality of physically distributed block chain storages is configured as an independent real block chain node, uniquely assigned to each block chain of the multi-block chain network, and only to the real block chain node. The step of configuring a separate private network configured, and distributing the file block to the entire multi-blockchain network by storing the file block distributed in the real block chain node, or distributing the file block to only nodes associated with a specific virtual block chain container. Blockchain-based EDR method comprising the step of propagating only a part of the multi-blockchain network by storing.

Images