Block chain-based two-dimensional code data security detection method and system

Abstract

The invention discloses a two-dimensional code data security detection method and system based on a block chain, relates to the technical field of data security detection, and is used for solving the problems that in the prior art, no fine dynamic management of storage hierarchy and access frequency exists, data compliance and integrity verification generally depends on a single-node or centralized mode, and data security is influenced. The dynamic adaptive capacity to data access frequency and risk is lacked, and anomaly detection and response mechanisms of most systems are passive; through a block chain consensus mechanism and Hash verification, the non-tampering and consistency of data are ensured, the layered storage architecture and the intelligent contract are dynamically adjusted, and the real-time detection and automatic response ability to potential threats is improved by using the combination of an isolated forest algorithm and the intelligent contract. And the system can dynamically adjust the strategy according to the access frequency and risk of the data to adapt to different demand changes.

Description

Technical Field

[0001] The present invention relates to the technical field of data security detection. More specifically, the present invention relates to a method and system for detecting the data security of two-dimensional codes based on blockchain. Background Art

[0002] Compared with traditional barcodes, two-dimensional codes have the advantages of large information capacity and fast scanning speed, so they are widely used in fields such as payment, identity authentication, and product traceability. Blockchain is a decentralized distributed ledger technology with characteristics such as immutability, transparency, and high security. The method and system for detecting the data security of two-dimensional codes based on blockchain can effectively improve the security of two-dimensional codes, prevent problems such as forgery and tampering of two-dimensional codes, and ensure the credibility of data during the transmission and verification of two-dimensional codes by combining the advantages of two-dimensional code technology and blockchain. This technology has important application prospects in fields such as financial payment, logistics traceability, and identity verification.

[0003] The existing technologies have the following deficiencies: In the existing technologies, there is usually no fine-grained dynamic management of storage levels and access frequencies, which easily leads to waste of storage resources or an increase in reading latency. Data compliance and integrity verification usually rely on a single node or a centralized method, which is easily affected by single-point failures or malicious behaviors, and lacks the ability to dynamically adapt to data access frequencies and risks. Once the access pattern changes, the data storage efficiency will drop significantly. The anomaly detection and response mechanisms of most current systems are passive, relying on manual intervention or regular inspections, resulting in a slow response speed to sudden problems.

[0004] In view of the above problems, the present invention proposes a solution. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the existing technologies, the embodiments of the present invention provide a method and system for detecting the data security of two-dimensional codes based on blockchain to solve the problems raised in the above background art.

[0006] To achieve the above object, the present invention provides the following technical solutions: A method and system for detecting the data security of two-dimensional codes based on blockchain, including the steps of: Step S1: Analyze the encoding format to generate a standardized data structure, divide it into data units containing original information and check codes, use the hash algorithm to generate a unique identifier for the data units, record the timestamp to mark the generation time, and verify the compliance of the data units by combining the hash algorithm and the timestamp. The verification result is broadcast to other nodes through the blockchain network to reach a consensus; Step S2: Add a new hierarchical storage architecture, divide the data units into a high-frequency access layer, a medium-frequency access layer, and a low-frequency access layer, use mutual information to measure the contrast dependence between the data units and the important data units, calculate the importance in combination with the access frequency of the data units, and perform storage level stratification; Step S3: Combine the data access frequency mutation, the deviation degree of node behavior, and the throughput deviation of the data units, use the isolation forest for anomaly detection, determine whether to trigger a security alarm, and automatically execute the isolation operation through a smart contract. Combine the consensus mechanism of the blockchain to perform multi-node cross-verification on the abnormal data units; Step S4: Dynamically adjust the storage level of the data units through a smart contract, and migrate the data between the high, medium, and low-frequency access layers in combination with the access frequency mutation and the risk score of the data units.

[0007] In a preferred embodiment, step S1 includes the following contents: Parse the original data, represent the data in the CSV encoding format, standardize it into a unified structure, record the structured data format to represent each data unit, including the original information and the check code. The original data is the information to be actually transmitted or stored, and the check code is usually a digest obtained by performing a certain encryption or hashing process on the original data; The check code is generated using a hashing algorithm, and a unique identifier is generated for each data unit using the hashing algorithm; Attach a timestamp to each data unit to record the specific time of generation; After generating the hash value and timestamp of the data unit, verify whether the data is complete and has not been tampered with by recalculating the hash value and comparing it with the stored hash value. The timestamp checks whether the data is generated within the expected time range, jointly verifying the compliance of the data unit. When the data does not meet the specified time window or its hash value does not match, it means the data has been tampered with; After passing the verification, broadcast the hash value and timestamp of the data unit to other nodes through the blockchain network, ensure that all nodes reach an agreement on the validity of the data through the consensus mechanism. After verifying and agreeing on the legality of the data, permanently record the data in the blockchain.

[0008] In a preferred embodiment, step S2 includes the following contents: Use entropy to measure the certainty of data units X and Y. The entropy of data units X and Y is expressed as: , , where: is the probability that X takes a certain value x, represents the sum over all possible values of x, is the probability that Y takes a certain value y, Denote the summation over all possible values of y. The joint entropy of data units X and Y is expressed as: , where: P(x, y) is the joint probability that X and Y take x and y simultaneously, Denote the summation over all possible joint values of X and Y; Calculate the mutual information between each pair of data units to measure the dependence between two variables, that is, the uncertainty of one data unit with respect to the other data unit through the information of the data unit. The mutual information is calculated by the following formula: , where: is the entropy of data unit X, is the entropy of data unit Y, is the joint entropy of data units X and Y; By tracking the access records of data units, count the specific number of accesses and record them, calculate the access frequency of each data unit, which is obtained by the ratio of the number of accesses to the total number of accesses, and use to represent; Calculate the dependence between each pair of data units according to the mutual information and construct a dependence matrix. The element I( , ) of the matrix represents the mutual information between data units and ; Combine the dependence matrix and the access frequency to calculate the importance of data units, which is defined by the following formula: = Here, is the mutual information between data units and , while is the access frequency of data unit ; According to the importance of data units, divide the data units into three storage levels: high-frequency access layer, medium-frequency access layer, and low-frequency access layer: Obtain the importance data of multiple data units from the access history database and merge them into an importance data set. Set the storage level threshold using the percentile method according to the importance data set. Arrange the data in the importance data set from small to large, and set %, % as the percentile ratio. Take the data value of the data in the importance data set that exceeds % of the data as the high-frequency access layer, the data values between % and % as the medium-frequency access layer, and the data values lower than % of the data as the low-frequency access layer.

[0009] In a preferred embodiment, step S3 includes the following content: Use the Isolation Forest to perform anomaly detection on the data, and construct an Isolation Forest model using three parameters: access frequency, node behavior deviation, and throughput. The steps are as follows: Step A1: Calculate the standard deviations of the access frequency mutation, node behavior deviation, and throughput as eigenvalues to form a multi-dimensional data set; Calculate the moving average and standard deviation of the access frequency, and calculate the deviation between the current time point and the moving average, expressed by the following formula: Access frequency mutation = , where: is the access frequency of the data unit ; Calculate the standard deviation of the node behavior from the behavior of other nodes in the blockchain network, and calculate the mean of all nodes denoted as μ, expressed as: , where, is the standard deviation, is the behavior value of each node, μ is the mean of all node behavior values, and N is the total number of nodes; Analyze the anomaly degree of the path based on the throughput deviation, expressed as the ratio of the successfully transmitted data volume to the time used; The Isolation Forest constructs multiple isolation trees by randomly selecting features and performing random splits on these features. The anomaly of the data point is calculated by analyzing the path length from the root node to the leaf node of the isolation tree, denoted as the anomaly score. By synthesizing the anomaly scores of all isolation trees and setting an anomaly score threshold, data with an anomaly score higher than the threshold is considered abnormal; Step A2: Set dynamic thresholds according to the mean and standard deviation of historical data: Anomaly threshold for access frequency: When the deviation of the access frequency of the current data point from the historical mean exceeds a certain multiple of the standard deviation, it is considered a mutation; Anomaly threshold for node behavior deviation: When the behavior value of a certain node exceeds a multiple of the standard deviation of the mean behavior of all network nodes, it is marked as abnormal; Anomaly threshold for throughput: Set a dynamic threshold using the historical mean and standard deviation of throughput. When the throughput is lower than this dynamic threshold, the path is considered abnormal. The degree of throughput fluctuation also needs to be considered. By calculating the historical mean and standard deviation , set the threshold to a certain multiple of the historical mean ± standard deviation. When the current throughput is lower than this dynamic threshold, the path is considered abnormal. The threshold is expressed as: , , where k is a constant. When it is lower than or higher than , it is marked as abnormal; Step A3: If the parameter deviates from the preset threshold, it is marked as an anomaly, triggering a security alarm. When the anomaly detection is triggered, an intelligent contract is designed to handle the actions after the anomaly detection is triggered, and the contract automatically isolates the data unit; Multiple nodes are introduced for cross-verification. Each node will independently detect the data unit and decide whether to trigger the isolation operation according to the consensus mechanism on the blockchain. Multiple nodes will execute the same isolation forest algorithm on the same data unit to detect whether there are abnormal behaviors. When more than a certain proportion of nodes determine it to be abnormal, the isolation operation is started.

[0010] In a preferred embodiment, step S4 includes the following content: Calculate the risk score for each data unit by combining the detection results of three features. Assume the weights of each feature are 、 、 , corresponding to the mutation of data access frequency, the deviation degree of node behavior, and the throughput deviation of the data unit. The comprehensive risk score R can be expressed as: where: 、 and are the anomaly scores calculated based on the mutation of data access frequency, the deviation degree of node behavior, and the throughput deviation of the data unit respectively, 、 、 are the weights set according to the feature importance; When the mutation of access frequency and the risk score meet specific conditions, the data unit will automatically migrate to an appropriate storage level. The specific migration logic is as follows: High-frequency data migration: When the access frequency of the data unit exceeds the threshold or the risk score exceeds the threshold, the intelligent contract will automatically migrate it to the high-frequency access layer; Low-frequency data migration: When the access frequency of the data unit is lower than the threshold, the intelligent contract can migrate it to the low-frequency storage layer to reduce the storage cost; The intelligent contract triggers a migration check after each data access or regularly. It checks the access frequency during each data access and decides whether migration is needed, and sets to trigger a migration check regularly once.

[0011] The blockchain-based two-dimensional code data security detection method and system include: a parsing and verification module, a storage layering module, a dynamic detection module, and a storage optimization module, and the modules are signal-connected to each other.

[0012] Parsing and Verification Module: Parse the encoding format to generate a standardized data structure, split it into data units containing original information and check codes, use the hash algorithm to generate a unique identifier for the data units, record the timestamp to mark the generation time, and combine the hash algorithm and timestamp to verify the compliance of the data units. The verification results are broadcast to other nodes through the blockchain network to reach a consensus; Storage Hierarchical Module: Add a new hierarchical storage architecture, divide the data units into a high-frequency access layer, a medium-frequency access layer, and a low-frequency access layer, use mutual information to measure the contrast dependence between the data units and the important data units, calculate the importance in combination with the access frequency of the data units, and perform storage level stratification; Dynamic Detection Module: Combine the mutation of data access frequency, the deviation degree of node behavior, and the throughput deviation of data units, use the Isolation Forest for anomaly detection, determine whether to trigger a security alarm, and automatically execute isolation operations through smart contracts. Combine the consensus mechanism of the blockchain to perform multi-node cross-verification on abnormal data units; Storage Optimization Module: Dynamically adjust the storage level of data units through smart contracts, and migrate the data between the high, medium, and low-frequency access layers in combination with the mutation of access frequency and the risk score of data units.

[0013] Technical effects and advantages of the blockchain-based two-dimensional code data security detection method and system of the present invention: The security and integrity of the data are guaranteed. Through the blockchain consensus mechanism and hash verification, the immutability and consistency of the data are ensured. Storage optimization and efficiency improvement are achieved. Through the hierarchical storage architecture and dynamic adjustment of smart contracts, the storage efficiency and data access speed are improved. Intelligent anomaly detection and automatic response are realized. The combination of the Isolation Forest algorithm and smart contracts enhances the real-time detection and automatic response capabilities for potential threats. The flexibility and scalability of the system are demonstrated. The system can dynamically adjust strategies according to the access frequency and risk of data, adapting to different demand changes. Brief Description of the Drawings

[0014] Figure 1 It is a schematic structural diagram of the blockchain-based two-dimensional code data security detection method of the present invention.

[0015] Figure 2 It is a schematic structural diagram of the blockchain-based two-dimensional code data security detection system of the present invention. Detailed Embodiments

[0016] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0017] Example 1. The present invention discloses a method and system for detecting the security of two-dimensional code data based on a blockchain, including the steps of: Step S1: Analyze the encoding format to generate a standardized data structure, divide it into data units containing original information and check codes, use a hash algorithm to generate a unique identifier for the data units, record the time stamp to mark the generation time, combine the hash algorithm and the time stamp to verify the compliance of the data units, and broadcast the verification results to other nodes through the blockchain network to reach a consensus; Step S2: Add a new hierarchical storage architecture, divide the data units into a high-frequency access layer, a medium-frequency access layer, and a low-frequency access layer, use mutual information to measure the comparison dependence between the data units and important data units, calculate the importance in combination with the access frequency of the data units, and perform storage-level stratification; Step S3: Combine the mutation of data access frequency, the deviation of node behavior, and the throughput deviation of data units, use an isolation forest for anomaly detection, determine whether a security alarm is triggered, and automatically execute an isolation operation through a smart contract. Combine the consensus mechanism of the blockchain to perform multi-node cross-verification on abnormal data units; Step S4: Dynamically adjust the storage level of the data units through a smart contract, and migrate the data between the high-frequency, medium-frequency, and low-frequency access layers in combination with the mutation of the access frequency and the risk score of the data units.

[0018] In step S1, analyze the encoding format to generate a standardized data structure, divide it into data units containing original information and check codes, use a hash algorithm to generate a unique identifier for the data units, record the time stamp to mark the generation time, combine the hash algorithm and the time stamp to verify the compliance of the data units, and broadcast the verification results to other nodes through the blockchain network to reach a consensus. The specific content includes: Analyze the original data, represent the data in the CSV encoding format, and standardize it into a unified structure for easy processing and verification. Standardization means that all data has unified fields, formats, and types, making it easy to process and verify. Use a database record to represent each data unit in a structured data format, including original information and a check code. The original information is the core content of the data, and the check code is used to ensure that the data has not been tampered with.

[0019] Divide the data into two parts: the original data and the check code. The original data is the information to be actually transmitted or stored, and the check code is usually a digest obtained by performing some encryption or hashing process on the original data, used to verify the integrity of the data.

[0020] The checksum is generated using a hash algorithm to ensure that the data has not changed during transmission. If the original data is modified during transmission, the checksum will also change. The receiving end can verify the data's validity by recalculating the hash value. By generating a unique identifier for each data unit using the hash algorithm, the hash algorithm can generate a digest of a fixed length. Any minor change in the input will result in a significant change in the output hash value, thus ensuring the uniqueness and non-forgeability of the data. The hash value of each data unit serves as a unique identifier, ensuring the integrity and tamper resistance of the data. Even if the data is modified, the hash value will change and cannot be forged.

[0021] It should be noted that the hash algorithm is an algorithm that maps data of any length to a value of a fixed length. It is widely used in data processing, encryption, information verification and other fields. Especially in technologies such as blockchain, data integrity verification, and digital signatures, the hash algorithm plays a crucial role. Regardless of the size of the input data, the hash algorithm will generate an output of a fixed length. The hash algorithm is one-way, meaning that the original data cannot be deduced from the hash value, making the hash algorithm very suitable for verifying data integrity without revealing the original data. Any minor change in the input data will cause a significant change in the hash value. For different inputs, different hash values can be generated. Although in practice, due to the limited output length, the hash algorithm cannot avoid collisions, a good hash algorithm should minimize this probability. The calculation speed of the hash algorithm should be fast enough, especially in the case of a large amount of data, and still be able to quickly generate hash values.

[0022] Attach a timestamp to each data unit to record the specific time of generation. The timestamp can be obtained from the system time or recorded through the block timestamp in the blockchain. This not only helps to verify the order of the data but also provides an important time basis for subsequent compliance verification. By providing the generation time of the data, it helps to determine whether the data was generated within the specified time range, ensuring that the data meets specific time requirements. The timestamp can also be used as part of the data's validity to prevent replay attacks.

[0023] After generating the hash value and timestamp of the data unit, the receiving party or verification system can verify whether the data is complete and has not been tampered with by recalculating the hash value and comparing it with the stored hash value. The timestamp is used to check whether the data was generated within the expected time range, verify the compliance of the data unit, ensure that the data has not been modified during transmission, and that its generation time meets the compliance requirements. If the data does not meet the specified time window or its hash value does not match, it means the data has been tampered with or illegally generated.

[0024] After verification, the hash value and timestamp of the data unit and its related information are broadcast to other nodes through the blockchain network. As a decentralized distributed ledger technology, the blockchain ensures that data added to the network cannot be tampered with or deleted. In the blockchain network, through the consensus mechanism, all nodes reach an agreement on the validity of the data. After verifying and agreeing on the legality of the data, the data is permanently recorded in the blockchain, and any future modifications will be detected. Through the blockchain, the historical records of all data generation, verification, and broadcasting can be traced and audited, ensuring the transparency and credibility of the entire process.

[0025] In step S2, a new hierarchical storage architecture is added. The data units are divided into a high-frequency access layer, a medium-frequency access layer, and a low-frequency access layer. The mutual information is used to measure the contrast dependence between the data unit and the important data unit. The importance is calculated by combining the access frequency of the data unit, and the storage level is stratified. The specific content includes: Entropy measures the degree of uncertainty of a random variable. Entropy is the expected amount of information of the probability distribution of all possible values of this random variable. The larger the entropy, the more uncertain the value of the variable. For data units X and Y, the entropy of data units X and Y is expressed as: , , where: is the probability that X takes a certain value x, represents the sum over all possible values of x, is the probability that Y takes a certain value y, represents the sum over all possible values of y. The joint entropy of data units X and Y together is expressed as: , where: P(x, y) is the joint probability that X and Y take x and y simultaneously, represents the sum over all possible joint values of X and Y.

[0026] Calculate the mutual information between each pair of data units to measure the dependence between two variables, that is, how much the uncertainty about another data unit can be reduced by the information of one data unit. The mutual information is calculated by the following formula: , where: is the entropy of data unit X, is the entropy of data unit Y, is the joint entropy of data units X and Y together.

[0027] By tracking the access records of the data units, the specific number of accesses is counted and recorded, and the access frequency of each data unit is calculated, which is obtained by the ratio of the number of accesses to the total number of accesses, and is represented by .

[0028] Construct a dependency matrix, calculate the dependency between each pair of data units based on mutual information, and construct a dependency matrix. The element I( , ) in the matrix represents the mutual information between data units and .

[0029] Combine the dependency matrix and access frequency to calculate the importance of data units, which is defined by the following formula: = Here, is the mutual information between data units and , while is the access frequency of data unit . It means that the importance of data unit is proportional to the dependencies with other data units and the access frequencies of these units.

[0030] According to the importance of data units, divide the data units into three storage levels: high-frequency access layer, medium-frequency access layer, and low-frequency access layer: Obtain the importance data of multiple data units from the access history database and merge them into an importance data set. Set the storage level thresholds using the percentile method based on the importance data set. Arrange the data in the importance data set from smallest to largest, and set %, % as the percentile ratios. Take the data values in the importance data set that exceed % of the data as the high-frequency access layer, the data values between % and % as the medium-frequency access layer, and the data values below % of the data as the low-frequency access layer; For example, if the percentile %, % ratios are set to 20% and 60%, then select the data values in the importance data set that exceed 60% of the data values in the importance data set as the high-frequency access layer, the data values between 20% and 60% as the medium-frequency access layer, and the data values below 20% as the medium-frequency access layer. Specifically, it can be specifically set by professionals and will not be elaborated here.

[0031] In step S3, combine the data access frequency mutation, the deviation degree of node behavior, and the throughput deviation of data units, use the Isolation Forest for anomaly detection, determine whether to trigger a security alarm, and automatically execute an isolation operation through a smart contract. Combine the consensus mechanism of the blockchain to perform multi-node cross-verification on abnormal data units. The specific content includes: Use the Isolation Forest to perform anomaly detection on data. The Isolation Forest is an effective anomaly detection method applicable to high-dimensional data and large-scale datasets. It "isolates" anomaly data points by randomly selecting features and randomly splitting the data. Use three parameters, namely access frequency, node behavior deviation degree, and throughput, to construct the Isolation Forest model. The steps are as follows: Step A1: Calculate the standard deviations of the access frequency mutation, the deviation degree of node behavior, and the throughput as feature values to form a multi-dimensional dataset.

[0032] Calculate the moving average and standard deviation of the access frequency, and calculate the deviation between the current time point and the moving average. When the deviation exceeds the threshold, it is considered that a mutation has occurred, which is expressed by the following formula: Access frequency mutation = , where: is the data unit is the access frequency of

[0033] Measure the deviation degree of node behavior by calculating the standard deviation between the node behavior and the behaviors of other nodes in the blockchain network. Calculate the mean of all nodes and denote it as μ. The greater the deviation degree, the higher the standard deviation, indicating that the behavior of the node is less regular, which is expressed as: , where is the standard deviation, is the behavior value of each node, μ is the mean of all node behavior values, and N is the total number of nodes.

[0034] Analyze the anomaly degree of the path based on the throughput. The throughput refers to the amount of data successfully transmitted per unit time. A low throughput usually indicates a problem with the path. It is expressed as the ratio of the amount of data successfully transmitted to the time used. Specifically: The amount of data successfully transmitted refers to the number of bytes or bits successfully transmitted per unit time, and the time used refers to the time consumed for data transmission, usually in seconds.

[0035] When constructing each tree, the isolation forest randomly selects features from the dataset and randomly selects a splitting point on that feature to partition the data. This random selection process ensures a high degree of diversity in the generation of each tree. Each isolation tree recursively splits on the data points until each data point is isolated, that is, it falls to the leaf node of the tree. Each split increases the path length of the data point. Data points with shorter path lengths are usually easier to isolate, indicating that they are more different from the distribution of most data points. The isolation tree evaluates the abnormality of each data point by calculating the path length from the root node to the leaf node. The shorter the path length, the earlier the data point is isolated and the higher the probability of being abnormal. The key to the isolation forest algorithm is to combine the path lengths of all isolation trees and calculate the anomaly score for each data point. Data points with high anomaly scores are usually outliers. According to the anomaly scores of all data points, a threshold is set, and data points exceeding this threshold are considered outliers. Usually, data points with higher anomaly scores have a significantly different distribution from other data points, which may be caused by noise or other special reasons.

[0036] Step A2: Set a dynamic threshold based on the mean and standard deviation of historical data: Anomaly threshold for access frequency: When the deviation of the access frequency of the current data point from the historical mean exceeds a certain multiple of the standard deviation, it is considered that a mutation has occurred.

[0037] Anomaly threshold for node behavior deviation: When the behavior value of a certain node exceeds a multiple of the standard deviation of the behavior means of all nodes in the network, it can also be marked as abnormal.

[0038] Anomaly threshold for throughput: Set a dynamic threshold using the historical mean and standard deviation of throughput. When the throughput is lower than this dynamic threshold, the path is considered abnormal. The degree of throughput fluctuation also needs to be considered. If the throughput is relatively fluctuating, a looser threshold can be set; if the fluctuation is small, a more stringent threshold can be set, and the standard deviation of throughput is calculated. By calculating the historical mean and standard deviation , and then set the threshold to a certain multiple of the historical mean ± standard deviation. When the current throughput is lower than this dynamic threshold, the path is considered abnormal. The threshold is expressed as: , , where k is a constant. When it is lower than or higher than , it can be marked as abnormal.

[0039] Step A3: If a parameter deviation from a preset threshold is detected, it is marked as an anomaly, triggering a security alert. Once the anomaly detection is triggered, certain operations can be automatically executed through a smart contract, enabling an automated isolation and defense mechanism. The smart contract ensures the immutability and consistency of operations through the consensus mechanism in the blockchain. A smart contract is designed to handle the actions after the anomaly detection is triggered. Once an abnormal data unit is found, the contract automatically isolates the data unit.

[0040] Multiple nodes are introduced for cross-verification. Each node will independently detect the data unit and decide whether to trigger the isolation operation according to the consensus mechanism on the blockchain. Multiple nodes will execute the same isolation forest algorithm on the same data unit to detect whether there is abnormal behavior. If more than a certain proportion of nodes determine it to be abnormal, the isolation operation will be initiated.

[0041] In step S4, the storage level of the data unit is dynamically adjusted through a smart contract. Combining the mutation of access frequency and the risk score of the data unit, the data is migrated between high, medium, and low-frequency access layers. The specific content includes: Based on the anomaly score and the threshold, the risk score can be calculated for each data unit by combining the detection results of three features. Assume the weights of each feature are 、 、 , corresponding to the mutation of data access frequency, the deviation of node behavior, and the throughput deviation of the data unit. The comprehensive risk score R can be expressed as: , where: 、 and are the anomaly scores calculated based on the mutation of data access frequency, the deviation of node behavior, and the throughput deviation of the data unit respectively. 、 、 are the weights set according to the feature importance.

[0042] When the mutation of access frequency and the risk score meet specific conditions, the data unit will be automatically migrated to the appropriate storage level. The specific migration logic is as follows: High-frequency data migration: When the access frequency of the data unit exceeds the threshold or the risk score exceeds the threshold, the smart contract will automatically migrate it to the high-frequency access layer. If the change is rapid, a quick migration can be triggered.

[0043] Low-frequency data migration: When the access frequency of the data unit is lower than the threshold, the smart contract can migrate it to the low-frequency storage layer to reduce the storage cost.

[0044] Migration combined with risk scores: When combined with risk scores, high-risk data may need to be stored in a more secure and efficient storage layer, even if its access frequency is low. For example, important contract data or sensitive information should be stored in the high-frequency storage layer to ensure fast access and high security, even if the access frequency is low.

[0045] To ensure that data migration is dynamic and real-time, smart contracts can trigger migration checks after each data access or periodically. At each data access, check the access frequency and decide whether migration is needed, and set to trigger a migration check periodically.

[0046] Embodiment 2, the present invention discloses a method and system for secure detection of two-dimensional code data based on blockchain, including: a parsing and verification module, a storage layering module, a dynamic detection module, and a storage optimization module, which are signal-connected to each other.

[0047] Parsing and verification module: Parse the encoding format to generate a standardized data structure, divide it into data units containing original information and check codes, use the hash algorithm to generate a unique identifier for the data units, record the timestamp to mark the generation time, and verify the compliance of the data units by combining the hash algorithm and the timestamp. The verification result is broadcast to other nodes through the blockchain network to reach a consensus; Storage layering module: Add a new hierarchical storage architecture, divide the data units into a high-frequency access layer, a medium-frequency access layer, and a low-frequency access layer, use mutual information to measure the contrast dependence between the data units and the important data units, calculate the importance in combination with the access frequency of the data units, and perform storage level layering; Dynamic detection module: Combine the mutation of data access frequency, the deviation of node behavior, and the throughput deviation of data units, use the isolation forest for anomaly detection, determine whether to trigger a security alarm, and automatically execute isolation operations through smart contracts. Combine the consensus mechanism of the blockchain to perform multi-node cross-verification on abnormal data units; Storage optimization module: Dynamically adjust the storage level of data units through smart contracts, and migrate data between the high, medium, and low-frequency access layers in combination with the mutation of access frequency and the risk score of data units.

[0048] The above formulas are all dimensionless and take their numerical values for calculation. The formulas are obtained by collecting a large amount of data for software simulation to obtain a formula closest to the actual situation. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0049] The above embodiments can be implemented in whole or in part by software, hardware, firmware, or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product.

[0050] Those of ordinary skill in the art can realize that the modules and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or by a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application of the technical solution and the invention constraints. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0051] In addition, in each embodiment of this application, the functional modules can be integrated into a processing module, or each module can exist physically alone, or two or more modules can be integrated into one module.

[0052] As mentioned above, the above is only the specific implementation manner of this application, but the protection scope of this application is not limited thereto. Any person skilled in the art within the technical scope disclosed in this application can easily think of changes or substitutions, which should all be covered by the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

[0053] Finally: The above is only the preferred embodiment of the present invention and is not used to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A QR code data security detection method based on blockchain, characterized in that: Includes steps: Step S1: Parse the encoding format to generate a standardized data structure, divide it into data units containing original information and check codes, use the hash algorithm to generate a unique identifier for the data unit, record the time when the timestamp is generated, and verify the compliance of the data unit by combining the hash algorithm and timestamp. The verification result is broadcast to other nodes through the blockchain network to reach a consensus; Step S2: Add a new hierarchical storage architecture, divide the data units into a high-frequency access layer, a medium-frequency access layer, and a low-frequency access layer, use mutual information to measure the comparative dependency between the data units and the important data units, calculate the importance in combination with the access frequency of the data units, and perform storage tier stratification; Step S3: Combined with the sudden change of data access frequency, the deviation of node behavior and the throughput deviation of data units, the isolation forest is used to detect anomalies, determine whether to trigger a security alarm, and automatically perform isolation operations through smart contracts. Combined with the consensus mechanism of blockchain, multi-node cross-validation is performed on abnormal data units; Step S4: Dynamically adjust the storage level of the data unit through the smart contract, and migrate the data between high, medium and low frequency access levels based on the access frequency mutation and the risk score of the data unit.

2. The two-dimensional code data security detection method based on blockchain according to claim 1 is characterized in that: Parse the original data, represent the data in CSV encoding format, standardize it into a unified structure, and record the structured data format to represent each data unit, including the original information and checksum; The checksum is generated using a hash algorithm, and a unique identifier is generated for each data unit using the hash algorithm; A timestamp is attached to each data unit to record the specific time of generation; After generating the hash value and timestamp of the data unit, the data is verified to be complete and not tampered with by recalculating the hash value and comparing it with the stored hash value. The timestamp checks whether the data is generated within the expected time range. Together, they verify the compliance of the data unit. When the data does not conform to the specified time window or its hash value does not match, it means that the data has been tampered with. After verification, the hash value and timestamp of the data unit will be broadcast to other nodes through the blockchain network. The consensus mechanism will ensure that all nodes reach an agreement on the validity of the data. After verifying and agreeing on the legitimacy of the data, the data will be permanently recorded in the blockchain.

3. The two-dimensional code data security detection method based on blockchain according to claim 2 is characterized in that: Entropy is used to measure the certainty of data units X and Y. The entropy of data units X and Y is expressed as: , ,in: is the probability that X takes a certain value x, It means to sum all possible values ​​of x. is the probability that Y takes a certain y, It means to sum all possible values ​​of y. The joint entropy of data units X and Y is expressed as: , where: P(x, y) is the joint probability of x and y when X and Y are taken at the same time, It means to sum all the joint values ​​of X and Y; The mutual information between each pair of data units is calculated to measure the dependence between two variables, through the uncertainty of the information of a data unit to another data unit. The mutual information is calculated by the following formula: ,in: is the entropy of data unit X, is the entropy of data unit Y, is the joint entropy of data units X and Y.

4. The two-dimensional code data security detection method based on blockchain according to claim 3 is characterized in that: By tracking the access records of data units, counting the specific number of accesses and recording them, the access frequency of each data unit is calculated by the ratio of the number of accesses to the total number of accesses, and using express; The dependency between each pair of data units is calculated based on the mutual information, and a dependency matrix is ​​constructed. The element I( , ) indicates a data unit and The mutual information between The importance of a data unit is calculated by combining the dependency matrix and the access frequency, which is defined by the following formula: = here, It is a data unit and The mutual information between It is a data unit The frequency of visits.

5. The blockchain-based QR code data security detection method and system according to claim 4 is characterized in that: According to the importance of data units, data units are divided into three storage levels: high-frequency access layer, medium-frequency access layer, and low-frequency access layer: Access the historical database to obtain the importance data of multiple data units and merge them into an importance data set. Use the percentile method to set the storage level threshold based on the importance data set, arrange the data in the importance data set from small to large, and set %, % as the percentile ratio, and the importance data is concentrated in The data value of % data is used as the high-frequency access layer. %and % is used as the medium frequency access layer, and the data value below %Data's data value is used as the underlying access layer.

6. The two-dimensional code data security detection method based on blockchain according to claim 5 is characterized in that ； The access frequency mutation, node behavior deviation and throughput standard deviation are calculated as feature values ​​to form a multidimensional data set; Calculate the moving average and standard deviation of the access frequency, and calculate the deviation between the current time point and the moving average, expressed as the following formula: Access frequency mutation = ,in: is the access frequency of the data unit; By calculating the standard deviation of the node behavior and the behavior of other nodes in the blockchain network, the mean of all nodes is calculated and recorded as μ, which is expressed as: ,in, is the standard deviation, is the behavior value of each node, μ is the mean of the behavior values ​​of all nodes, and N is the total number of nodes; The abnormality of the path is analyzed based on the throughput deviation, which is expressed as the ratio of the amount of data successfully transmitted to the time taken; Isolation forest constructs multiple isolated trees by randomly selecting features and performing random splits on the features. The abnormality of the data point is calculated by analyzing the path length from the root node to the leaf node of the data point of the isolation tree to obtain the split depth, which is recorded as the anomaly score. The anomaly scores of all isolated trees are combined and a threshold is set for the anomaly score. A score above the anomaly score threshold indicates data anomaly.

7. The two-dimensional code data security detection method based on blockchain according to claim 6 is characterized in that: Set dynamic thresholds based on the mean and standard deviation of historical data: Abnormal threshold of access frequency: When the access frequency of the current data point deviates from the historical mean by a certain multiple of the standard deviation, it is considered that a mutation has occurred; Abnormal threshold of node behavior deviation: When the behavior value of a node exceeds the standard deviation of the average behavior value of all nodes in the network by multiple times, it is marked as abnormal; Abnormal threshold of throughput: Use the historical mean and standard deviation of throughput to set a dynamic threshold. When the throughput is lower than the dynamic threshold, the path is considered abnormal. The fluctuation of throughput also needs to be considered. By calculating the historical mean of throughput, and standard deviation , the threshold is set to a multiple of the historical mean ± standard deviation. When the current throughput is lower than the dynamic threshold, the path is considered abnormal. The threshold is expressed as: , , where k is a constant lower than or higher When , they are marked as abnormal; If the parameter deviates from the preset threshold, it is marked as abnormal, triggering a security alarm, anomaly detection trigger, and a smart contract is designed to handle the actions after the anomaly detection is triggered. The contract automatically isolates the data unit; Multiple nodes are introduced for cross-validation. Each node will independently detect the data unit and decide whether to trigger the isolation operation based on the consensus mechanism on the blockchain. The same isolation forest algorithm is executed on the same data unit to detect whether there is abnormal behavior. When more than a certain proportion of nodes are judged to be abnormal, the isolation operation is initiated.

8. The two-dimensional code data security detection method based on blockchain according to claim 7 is characterized in that: The risk score is calculated for each data unit by combining the detection results of the three features. Assuming that the weight of each feature is , , , corresponding to the sudden change of data access frequency, the deviation of node behavior and the throughput deviation of data unit, the comprehensive risk score R can be expressed as: ,in: , and It is the anomaly score calculated based on the sudden change of data access frequency, the deviation of node behavior and the throughput deviation of data unit. , , It is the weight set according to the feature importance.

9. The two-dimensional code data security detection method based on blockchain according to claim 8 is characterized in that: When the access frequency mutation and risk score meet certain conditions, the data unit will be automatically migrated to the appropriate storage tier. The specific migration logic is as follows: High-frequency data migration: When the access frequency of a data unit exceeds a threshold or the risk score exceeds a threshold, the smart contract will automatically migrate it to the high-frequency access layer; Low-frequency data migration: When the access frequency of a data unit is lower than the threshold, the smart contract can migrate it to a low-frequency storage layer to reduce storage costs; The smart contract triggers a migration check after each data access or periodically. It checks the access frequency each time the data is accessed and decides whether migration is needed. It is set to trigger a migration check periodically.

10. A two-dimensional code data security detection system based on blockchain, used to implement the two-dimensional code data security detection method based on blockchain according to any one of claims 1 to 9, characterized in that: Parsing and verification module: Parse the encoding format to generate a standardized data structure, divide it into data units containing original information and checksums, use the hash algorithm to generate a unique identifier for the data unit, record the time when the timestamp is generated, and verify the compliance of the data unit by combining the hash algorithm and timestamp. The verification result is broadcast to other nodes through the blockchain network to reach a consensus; Storage tiering module: Adds a new tiered storage architecture, divides data units into high-frequency access layer, medium-frequency access layer and low-frequency access layer, uses mutual information to measure the comparative dependency between data units and important data units, calculates the importance of data units based on their access frequency, and performs storage tier stratification; Dynamic detection module: Combined with the sudden change of data access frequency, the deviation of node behavior and the throughput deviation of data units, the isolation forest is used for anomaly detection to determine whether a security alarm is triggered, and the isolation operation is automatically executed through smart contracts. Combined with the consensus mechanism of blockchain, multi-node cross-validation is performed on abnormal data units; Storage optimization module: Dynamically adjust the storage level of data units through smart contracts, and migrate data between high, medium and low frequency access levels based on access frequency mutations and data unit risk scores.

Images