Radio spectrum anomaly monitoring device based on CNN and block chain

Abstract

The invention relates to the field of network security, in particular to a radio spectrum anomaly monitoring device based on CNN and blockchain, the system comprises five modules of spectrum sensing, feature processing, anomaly detection, lightweight reasoning and blockchain storage, firstly, the spectrum sensing module collects multi-band signals and generates an energy density matrix; then, the feature processing module applies adaptive wavelet transform to reduce noise, and constructs a two-dimensional feature topological graph; the anomaly detection module deeply extracts features by using a dynamic convolution kernel and a frequency domain attention mechanism, and generates an anomaly probability distribution diagram; the lightweight reasoning module fuses expert knowledge and a deep learning result, and accurately judges an attack type and confidence; and finally, a block chain storage module records a judgment result, data security is ensured and updated parameters are stored through distributed consensus verification, and the device adopts multi-mode sensing and combines network traffic and spectrum features to improve attack detection difficulty.

Description

Technical Field

[0001] The present invention relates to the field of network security, and particularly to a radio spectrum anomaly monitoring device based on CNN and blockchain. Background Art

[0002] As a decentralized trust system construction technology, blockchain has rapidly expanded from the financial field to various industries. However, the security challenges faced by blockchain technology are also increasing. Among them, the eclipse attack is a serious attack method that threatens the security of the blockchain network. The eclipse attack can enable the attacking node to occupy all the external network connections of the victim node, resulting in the victim node being unable to receive correct block and transaction information. Whether the eclipse attack in the blockchain can be detected and defended in a timely manner has become an important indicator of the reliability of the blockchain.

[0003] In the prior art, for example, CN 115065502B discloses a method for detecting and defending blockchain eclipse attacks based on CNN. This method collects traffic data, converts one-dimensional traffic features into two-dimensional feature images, and uses the CNN model to detect blockchain eclipse attacks. However, this technology has the following deficiencies: First, the feature extraction lacks adaptability. Using a fixed feature extraction method, it is difficult to cope with changes in attack patterns and new attacks; Second, the computational resource requirements are high. The CNN model requires a large amount of computational resources and is not suitable for nodes with limited resources; Third, the defense measures are too radical. Measures such as cutting off all connections and restarting nodes cause the nodes to be temporarily offline; Fourth, the size of the two-dimensional feature map is fixed, which may lead to information loss; Fifth, there is a lack of a distributed cooperation mechanism, and the distributed characteristics of the blockchain network are not utilized for collaborative defense.

[0004] In addition, the prior art mainly focuses on the attack characteristics at the network logic level and ignores the additional security information that the physical layer signal characteristics may provide. In a wireless network environment, attack behaviors often appear in both the network traffic and radio spectrum levels. It is difficult to comprehensively identify complex attack behaviors relying solely on single-dimensional detection. Summary of the Invention

[0005] In view of the deficiencies of the above prior art, the present invention provides a radio spectrum anomaly monitoring device based on CNN and blockchain. By integrating physical layer spectrum sensing and network layer deep learning analysis, and combining blockchain distributed storage and consensus mechanisms, a high-precision, low-resource consumption, and adaptive anomaly monitoring system is realized.

[0006] The present invention proposes a radio spectrum anomaly monitoring device based on CNN and blockchain, including:

[0007] A spectrum sensing module, configured to collect multi-band radio signals and generate a spectrum energy density matrix;

[0008] A feature processing module, communicatively connected to the spectrum sensing module, for receiving the spectrum energy density matrix, applying adaptive wavelet transform for signal denoising, and generating a two-dimensional feature topology map;

[0009] An anomaly detection module, communicatively connected to the feature processing module, for receiving the two-dimensional feature topology map, performing deep feature extraction based on a dynamic convolution kernel structure and a frequency domain attention mechanism, and generating a regional anomaly probability distribution map;

[0010] A lightweight inference module, communicatively connected to the anomaly detection module, for receiving the regional anomaly probability distribution map, fusing expert knowledge residuals and deep learning results, and determining the attack type and confidence score;

[0011] A blockchain storage module, communicatively connected to the lightweight inference module, for recording the attack type and confidence score, and storing the verified model update parameters based on distributed consensus verification of the attack determination result.

[0012] Preferably, the spectrum sensing module includes:

[0013] A multi-band sampling unit for parallelly collecting radio signals in the 2.4 GHz, 5 GHz, and custom frequency bands;

[0014] A signal preprocessing unit for denoising and normalizing the collected signals;

[0015] A differential spectrum analysis unit for calculating the deviation value between the current spectrum and the historical baseline.

[0016] Preferably, the feature processing module includes:

[0017] A wavelet basis function selection unit for dynamically selecting the best wavelet basis function from the Haar, Daubechies, Symlets, and Coiflets wavelet function sets;

[0018] A self-organizing mapping network unit for reducing the high-dimensional spectrum features to a two-dimensional topology map;

[0019] An adaptive threshold noise suppression unit for dynamically adjusting the noise suppression threshold based on the signal characteristics.

[0020] Preferably, the anomaly detection module includes:

[0021] A dynamic convolution kernel generation unit for adaptively adjusting the convolution kernel size according to the spectrum complexity;

[0022] A frequency domain attention unit for automatically focusing on the frequency bands with high anomaly probabilities;

[0023] The multi-scale convolutional branch network unit includes small, medium, and large convolutional branches, which are respectively used to detect abnormal features of different scales.

[0024] Preferably, the small branch of the multi-scale convolutional branch network unit adopts a parameter configuration with a 3×3 convolutional kernel and a stride of 1, the medium branch adopts a parameter configuration with a 5×5 convolutional kernel and a stride of 2, and the large branch adopts a parameter configuration with a 7×7 convolutional kernel and a stride of 3.

[0025] Preferably, the lightweight inference module includes:

[0026] A residual knowledge injection unit, which is used to fuse expert experience and learning results;

[0027] A depthwise separable convolution unit, which is used to reduce the computational complexity;

[0028] A quantization-aware training unit, which is used to quantize the model parameters into 4-bit integer representation.

[0029] Preferably, the blockchain storage module includes:

[0030] A distributed verification unit, which is used to determine the result of attack determination based on multi-node signature verification;

[0031] A federated reinforcement learning unit, which is used to aggregate the model gradient updates of multiple nodes;

[0032] An adaptive retraining trigger unit, which is used to initiate model retraining when new attack features are detected.

[0033] Preferably, it further includes a defense execution module, which is communicatively connected to the lightweight inference module and is used to execute a hierarchical defense strategy based on the attack type and confidence score.

[0034] Preferably, the defense execution module includes:

[0035] An early warning unit, which is used to increase the monitoring intensity in case of low-confidence anomalies;

[0036] A mild defense unit, which is used to limit the bandwidth of suspicious connections in case of medium-confidence anomalies;

[0037] A strong defense unit, which is used to suspend suspicious connections in case of high-confidence anomalies.

[0038] Preferably, it further includes a multi-level cache module, which is communicatively connected to the spectrum sensing module and the feature processing module and is used to hierarchically store the original spectrum data, feature map data, and detection results, optimizing the data flow efficiency.

[0039] The beneficial effects of the present invention are:

[0040] 1. Multi-modal perception mechanism: Integrate network traffic and radio spectrum features to build a multi-dimensional perception system, significantly increasing the difficulty of attack detection;

[0041] 2. Adaptive feature extraction: Dynamically select the optimal wavelet basis function and parameters based on signal characteristics, reducing the dependence on prior knowledge;

[0042] 3. Resource efficiency optimization: Through the frequency domain attention mechanism and lightweight model design, the computing resource requirement is reduced by 78%, and the memory occupancy is reduced by 65%;

[0043] 4. Progressive defense strategy: Execute defense measures with different intensities according to the threat level, minimizing the impact on normal services;

[0044] 5. Distributed evolutionary learning: Combine blockchain and federated learning to form a self-organizing security knowledge network, improving the overall robustness of the system;

[0045] 6. Significant performance improvement: The detection accuracy for known attacks is increased by 15%, for unknown attacks by 23%, and the adaptation period for new attacks is shortened from an average of 72 hours to 4 hours. Description of the Drawings

[0046] Figure 1 It is the overall system architecture diagram of the embodiment of the present invention;

[0047] Figure 2 It is the structural schematic diagram of the spectrum sensing module in the embodiment of the present invention;

[0048] Figure 3 It is the processing flow chart of the feature processing module in the embodiment of the present invention;

[0049] Figure 4 It is the structural schematic diagram of the anomaly detection module in the embodiment of the present invention;

[0050] Figure 5 It is the schematic diagram of the dynamic convolution kernel structure in the embodiment of the present invention;

[0051] Figure 6 It is the structural schematic diagram of the lightweight inference module in the embodiment of the present invention;

[0052] Figure 7 It is the data structure schematic diagram of the blockchain storage module in the embodiment of the present invention;

[0053] Figure 8 It is the hierarchical defense strategy flow chart of the defense execution module in the embodiment of the present invention;

[0054] Figure 9 It is the cache level schematic diagram of the multi-level cache module in the embodiment of the present invention. Detailed Embodiment

[0055] Please refer to the attached Figures 1-9 . The specific implementation manners of the present invention will be further described in detail below with reference to the accompanying drawings.

[0056] Embodiment 1

[0057] As Figure 1 shown, the radio spectrum anomaly monitoring device based on CNN and blockchain provided by the present invention includes a spectrum sensing module 1, a feature processing module 2, an anomaly detection module 3, a lightweight inference module 4, a blockchain storage module 5, a defense execution module 6, and a multi-level cache module 7.

[0058] The spectrum sensing module 1 collects multi-band radio signals through a radio frequency interface and converts them into a standardized spectrum energy density matrix. This module is connected to the feature processing module 2 through a data bus and transmits the generated spectrum energy density matrix to the feature processing module 2.

[0059] The feature processing module 2 receives the spectrum energy density matrix transmitted from the spectrum sensing module 1, applies adaptive wavelet transform for signal denoising and feature extraction, and generates a two-dimensional feature topology map. The processed feature map is transmitted to the anomaly detection module 3 through a high-speed data channel.

[0060] The anomaly detection module 3 receives the two-dimensional feature topology map generated by the feature processing module 2, performs deep feature extraction based on a dynamic convolution kernel structure and a frequency domain attention mechanism, and generates a regional anomaly probability distribution map. This module is connected to the lightweight inference module 4 through a secure communication channel.

[0061] The lightweight inference module 4 receives the regional anomaly probability distribution map generated by the anomaly detection module 3, fuses expert knowledge residuals and deep learning results, and determines the attack type and confidence score. This module is connected to the blockchain storage module 5 and the defense execution module 6 through a secure encryption link.

[0062] The blockchain storage module 5 receives the attack type and confidence score output by the lightweight inference module 4, verifies the attack determination result through distributed consensus, and stores the verified model update parameters. This module adopts a distributed storage architecture and forms a secure and trustworthy blockchain network with corresponding modules of other nodes in the network.

[0063] The defense execution module 6 executes a hierarchical defense strategy based on the attack type and confidence score output by the lightweight inference module 4, and takes defense measures from light to heavy according to the threat level, ensuring system security while minimizing the impact on normal services.

[0064] The multi - level cache module 7 is communicatively connected to the spectrum sensing module 1 and the feature processing module 2, hierarchically stores the original spectrum data, feature map data, and detection results, and optimizes the data flow efficiency. This module adopts a hierarchical storage strategy to accelerate the system response speed.

[0065] Data interaction between each module is carried out through a standardized interface, forming a complete data flow closed - loop. The entire system adopts a modular design, and each functional module can be independently upgraded or replaced, having good scalability and compatibility.

[0066] Embodiment 2

[0067] As Figure 2 shown, the spectrum sensing module 1 includes a multi - band sampling unit 11, a signal pre - processing unit 12, and a differential spectrum analysis unit 13.

[0068] The multi - band sampling unit 11 uses software - defined radio technology to parallelly collect radio signals in the 2.4 GHz, 5 GHz, and custom frequency bands. Preferably, this unit uses a sampling interval of 10 ms and a frequency resolution of 50 kHz to ensure that it can capture the characteristics of rapidly changing abnormal signals.

[0069] The signal pre - processing unit 12 performs noise reduction and normalization processing on the collected original signals, including operations such as signal amplification, filtering, digitization, and normalization. Preferably, this unit uses a band - pass filter to remove out - of - band noise and uses adaptive gain control to keep the signal within an appropriate dynamic range.

[0070] The differential spectrum analysis unit 13 calculates the deviation value between the current spectrum and the historical baseline, and constructs a spectrum energy density matrix (SEDM). SEDM is a three - dimensional data structure containing information on three dimensions: time, frequency, and energy. The differential spectrum calculation uses the following formula:

[0071] DiffSEDM[t,f]=SEDM current , baseline , current , , baseline , ,

[0073] ,

[0072] , ,

[0071] , ,

[0070] [t,f]-SEDM baseline [t,f],

[0072] where DiffSEDM[t,f] represents the differential spectrum value corresponding to time t and frequency f, SEDM current [t,f] represents the current spectrum energy density value, and SEDM baseline [t,f] represents the historical baseline spectrum energy density value. The historical baseline is dynamically updated by the exponential moving average method to ensure that the system can adapt to the slow changes in normal network behavior.

[0073] The output of the spectrum sensing module 1 is a standardized spectrum energy density matrix, which contains both the original spectrum information and the deviation information from the historical baseline, providing a rich multi - dimensional data basis for subsequent feature processing.

[0074] Example 3

[0075] As Figure 3 shown, the feature processing module 2 includes a wavelet basis function selection unit 21, a self-organizing mapping network unit 22, and an adaptive threshold noise suppression unit 23.

[0076] The wavelet basis function selection unit 21 dynamically selects the optimal wavelet basis function from the Haar, Daubechies, Symlets, and Coiflets wavelet function sets for time-frequency analysis of the spectral signal. The selection of the optimal wavelet is based on the following optimization criterion:

[0077]

[0078] where OptimalWavelet represents the selected optimal wavelet basis function, W j represents the j-th wavelet function in the candidate wavelet function set, and SEDM represents the spectral energy density matrix. This unit selects the wavelet basis function most suitable for the current signal characteristics by evaluating the reconstruction error of different wavelet basis functions for the signal, improving the accuracy of subsequent processing.

[0079] The self-organizing mapping network unit 22 uses the self-organizing mapping (SOM) algorithm to reduce the dimensionality of the high-dimensional spectral features to a two-dimensional topological map. This unit realizes the non-linear mapping from high-dimensional spectral data to a two-dimensional feature space, such that similar patterns in the spectrum also maintain a close relationship in the two-dimensional space. Preferably, the SOM network uses a 32×32 two-dimensional grid, and trains the network weights through competitive learning to form a topology-preserving mapping of the spectral features.

[0080] The adaptive threshold noise suppression unit 23 dynamically adjusts the noise suppression threshold based on the signal characteristics to filter out the random noise in the spectrum. This unit uses a wavelet threshold-based denoising method, and the adaptive threshold is calculated as follows:

[0081]

[0082] where λ adaptive represents the adaptive threshold, σ represents the noise standard deviation, which is estimated by the median absolute deviation of the wavelet coefficients, and N represents the number of sampling points. In this way, the system can automatically adjust the threshold parameters according to the current noise level of the signal, effectively suppressing noise interference while retaining useful information.

[0083] The output of the feature processing module 2 is a denoised two-dimensional feature topological map, which contains the key features of the original spectral data but greatly reduces the dimensionality and noise level, providing high-quality input data for the anomaly detection module.

[0084] Example 4

[0085] As shown Figure 4 in the figure, the anomaly detection module 3 includes a dynamic convolution kernel generation unit 31, a frequency domain attention unit 32, and a multi-scale convolution branch network unit 33.

[0086] The dynamic convolution kernel generation unit 31 adaptively adjusts the convolution kernel size according to the spectral complexity. This unit first calculates the complexity score of the input feature map, and then dynamically determines the size of the convolution kernel according to the complexity. The specific calculation method is:

[0087] KernelSize = base_size + α · ComplexityScore,

[0088] where KernelSize represents the dynamically generated convolution kernel size, base_size represents the basic convolution kernel size (usually 3), α represents the adjustment coefficient (usually 0.5 - 2), and ComplexityScore represents the complexity score calculated based on spectral entropy. In this way, the system can automatically select the most appropriate receptive field size for spectral features of different complexities, improving the adaptability of feature extraction.

[0089] The frequency domain attention unit 32 uses the attention mechanism to automatically focus on the frequency bands with high anomaly probabilities. This unit calculates the anomaly possibility of each frequency band, generates an attention weight map, and uses it to enhance the feature representation of the suspicious frequency bands. The attention weight calculation formula is:

[0090] AttentionMap[f] = softmax(W · F abnormal [f]),

[0091] where AttentionMap[f] represents the attention weight at frequency f, softmax represents the softmax normalization function, W represents the learnable weight matrix, and F abnormal [f] represents the anomaly feature at frequency 6. The feature enhancement process is element-wise multiplication: F enhanced = F original ⊙ AttentionMap, where ⊙ represents the Hadamard product (element-wise multiplication). This mechanism enables the model to concentrate limited computational resources on the frequency bands most likely to contain anomalies, improving the detection efficiency and accuracy.

[0092] The multi-scale convolutional branch network unit 33 includes three convolutional branches: small, medium, and large, which are respectively used to detect abnormal features of different scales. The small branch adopts a parameter configuration with a 3×3 convolutional kernel and a stride of 1, focusing on detecting fine-grained local anomalies; the medium branch adopts a parameter configuration with a 5×5 convolutional kernel and a stride of 2, paying attention to medium-scale feature patterns; the large branch adopts a parameter configuration with a 7×7 convolutional kernel and a stride of 3, capturing large-scale global features. The outputs of the three branches are comprehensively processed through a feature fusion layer to form a multi-scale feature representation. This multi-scale architecture enables the system to simultaneously focus on abnormal features of different spatio-temporal scales, improving the comprehensiveness of detection.

[0093] The output of the anomaly detection module 3 is a regional anomaly probability distribution map, which identifies the anomaly probabilities of each frequency band and time window, providing basic information for subsequent reasoning.

[0094] Example 5

[0095] As Figure 5 shown, the multi-scale convolutional branch network unit 33 adopts three parallel convolutional branches, each branch configured with different convolutional parameters, focusing on feature extraction of different scales.

[0096] The small branch 331 adopts a parameter configuration with a 3×3 convolutional kernel and a stride of 1, and includes three convolutional layers, each followed by batch normalization and a ReLU activation function. The receptive field of this branch is small, focusing on capturing local detailed features and suitable for detecting fine abnormal patterns. Preferably, the number of channels in the convolutional layers of this branch is 32, 64, and 128 in sequence, realizing the gradual expansion of the feature dimension.

[0097] The medium branch 332 adopts a parameter configuration with a 5×5 convolutional kernel and a stride of 2, and includes two convolutional layers, each followed by batch normalization and a ReLU activation function. This branch has a medium-sized receptive field, capable of capturing regional feature patterns and suitable for detecting medium-scale anomalies. Preferably, the number of channels in the convolutional layers of this branch is 48 and 96 in sequence, reducing the spatial resolution while expanding the feature dimension.

[0098] The large branch 333 adopts a parameter configuration with a 7×7 convolutional kernel and a stride of 3, and includes one convolutional layer, followed by batch normalization and a ReLU activation function. This branch has a large receptive field, capable of capturing global feature patterns and suitable for detecting large-scale abnormal behaviors. Preferably, the number of channels in the convolutional layer of this branch is 64, directly mapping the input features to a high-dimensional feature space.

[0099] The output features of the three branches are first adjusted to the same spatial dimension through upsampling or downsampling, and then integrated through the feature fusion layer 334. Feature fusion adopts an attention-weighted method, dynamically adjusting the weights according to the importance of the features of different branches to generate the final multi-scale feature representation. Specifically, the fusion layer first calculates the importance scores of the features of each branch, then generates fusion weights based on the scores, and finally combines the features of each branch by weighting.

[0100] This multi-scale convolutional backbone architecture enables the system to simultaneously focus on abnormal patterns at different scales, being able to capture both local subtle abnormal signals and identify complex attack patterns spanning a large spatio-temporal range, greatly improving the comprehensiveness and accuracy of detection.

[0101] Example 6

[0102] As Figure 6 shown, the lightweight inference module 4 includes a residual knowledge injection unit 41, a depthwise separable convolution unit 42, and a quantization-aware training unit 43.

[0103] The residual knowledge injection unit 41 fuses expert experience and learning results to enhance the model's ability to recognize known attack patterns. This unit adopts a weighted fusion method, dynamically adjusting the weights of expert knowledge and learning results according to the model confidence. The fusion calculation formula is:

[0104] F final = α·F learned +(1 - α)·F expert ,

[0105] where F final represents the final feature representation, F learned represents the features generated by the deep learning model, F expert represents the features constructed based on expert knowledge, and α represents the dynamic balance coefficient, which is automatically adjusted according to the model confidence. When the model has a high confidence in the current sample, the value of α is close to 1, mainly relying on the learning results; when the confidence is low, the value of α decreases, increasing the influence of expert knowledge. This mechanism enables the system to combine data-driven learning ability and the guidance of prior knowledge, improving the generalization ability for various attacks.

[0106] The depthwise separable convolution unit 42 adopts a depthwise separable convolution structure, significantly reducing the computational complexity. Compared with traditional convolution, depthwise separable convolution decomposes the standard convolution into two steps: depthwise convolution and pointwise convolution, significantly reducing the amount of computation and the number of parameters. For an input feature map with a size of D f ×D f , the number of input channels is M, the number of output channels is N, and the convolution kernel size is Dk ×D k For the case of, the computational load comparison is as follows:

[0107] Computational load of ordinary convolution: O(D f ·D f ·M·N·D k ·D k ),

[0108] Depthwise separable convolution: O(D f ·D f ·M·D k ·D k +M·N),

[0109] Through this structural optimization, while maintaining the model's expressive power, the computational complexity is reduced by 8 - 9 times, enabling the system to operate efficiently on resource - constrained devices.

[0110] The quantization - aware training unit 43 realizes the low - bit quantization representation of model parameters, further reducing the storage and computational overhead. This unit simulates the impact of quantization operations during training, enabling the model to learn to adapt to the accuracy loss caused by quantization. The quantization process uses the following formula:

[0111] W quantized = round(W float / scale)*scale,

[0112] scale=(max(W)-min(W)) / (2 bits -1),

[0113] where W quantized represents the quantized weight, W float represents the floating - point weight, round represents the rounding operation, scale represents the quantization scale factor, and bits represents the quantization bit number (4 bits in this embodiment). Through 4 - bit integer quantization, the model size is reduced by 8 times, and at the same time, the inference speed is significantly improved, with only less than 2% loss in detection accuracy.

[0114] The output of the lightweight inference module 4 is the attack type determination and confidence score. This result comprehensively considers the inference results of the deep - learning model and the guidance of expert knowledge, and has high reliability and interpretability. At the same time, the lightweight design enables the model to be efficiently deployed on edge devices to achieve real - time anomaly detection.

[0115] Embodiment 7

[0116] As Figure 7 shown, the blockchain storage module 5 includes a distributed verification unit 51, a federated reinforcement learning unit 52, and an adaptive retraining trigger unit 53.

[0117] The distributed verification unit 51 ensures the reliability and immutability of the information stored on the blockchain based on the multi-node signature verification attack determination result. This unit organizes information using a block data structure, and each block contains fields such as model hash, performance metrics, verification signature, and timestamp:

[0118] Block structure: {Model hash: SHA-256(ModelParameters)

[0119] Performance metrics: {accuracy, precision, recall, F1}

[0120] Verification signature: multi-signature of network nodes

[0121] Timestamp: UTC_timestamp}

[0122] Blocks are linked by hashes to form a blockchain, ensuring that the data cannot be tampered with once written. A lightweight consensus mechanism based on Proof of Performance (PoP) is adopted between nodes to verify model performance rather than computing power, avoiding the resource waste problem of the traditional Proof of Work mechanism.

[0123] The federated reinforcement learning unit 52 aggregates the model gradient updates of multiple nodes, realizing distributed knowledge sharing while protecting data privacy. This unit aggregates distributed gradients using a weighted average method:

[0124] G = ∑(w i ·G i ) / ∑w i ,

[0125] where G represents the global gradient, G i represents the local gradient provided by node i, and w i represents the weight of node i, which is dynamically adjusted based on model performance and trustworthiness. In this way, the system can collaboratively optimize the detection model without sharing the original data, protecting privacy and improving the model training efficiency.

[0126] The adaptive retraining trigger unit 53 initiates model retraining when new attack features are detected. This unit determines whether to trigger model update by comparing the similarity between the newly discovered attack features and known patterns:

[0127] if(NewAttackFeatures.similarityKnownPatterns < threshold): TriggerRetraining(ModelParams, NewFeatures)

[0128] Among them, the similarity function calculates the cosine similarity of feature vectors, and the threshold represents the similarity threshold for triggering retraining (usually set to 0.7). When a new type of attack that is significantly different from known patterns is detected, the system will automatically initiate the model retraining process, add new features to the training set, and update the model parameters, enabling the system to quickly adapt to attack variants.

[0129] The blockchain storage module 5 constructs a transparent, trustworthy, and immutable security knowledge base through a distributed consensus and secure storage mechanism, recording the attack detection history and the model evolution trajectory. At the same time, the federated learning mechanism enables network nodes to co-evolve, forming collective intelligence and greatly improving the system's adaptability to new types of attacks.

[0130] Embodiment 8

[0131] As Figure 8 shown, the defense execution module 6 includes a warning unit 61, a mild defense unit 62, and a strong defense unit 63.

[0132] The warning unit 61 increases the monitoring intensity when detecting low-confidence abnormal situations and makes early defense preparations. When the abnormal confidence level is between 0.3 and 0.5, this unit is activated and performs the following operations: increasing the spectrum sampling rate from the standard 10 ms to 5 ms; expanding the monitoring frequency band range to cover more potential abnormal frequency bands; starting additional abnormal feature analysis tasks to deeply explore possible attack signs. These warning measures do not affect the normal communication function of the system but provide more sensitive early warning capabilities.

[0133] The mild defense unit 62 restricts the bandwidth of suspicious connections when detecting medium-confidence abnormal situations to reduce the impact of potential attacks. When the abnormal confidence level is between 0.5 and 0.8, this unit is activated and performs the following operations: implementing bandwidth restrictions on suspicious IP addresses and reducing their communication rate to 30% of the normal value; increasing the connection proportion of trusted nodes to ensure network connection diversity; activating comprehensive logging to record all network activities in detail for subsequent analysis. These measures effectively limit the scope of influence of potential attacks while maintaining the basic communication function.

[0134] The strong defense unit 63 suspends suspicious connections when detecting high-confidence abnormal situations and completely blocks the attack path. When the abnormal confidence level is greater than 0.8, this unit is activated and performs the following operations: temporarily disconnecting the connection with the suspicious node; clearing the possibly contaminated entries in the routing table; requesting a new list of trusted nodes from the DNS seed server; and reconstructing a healthy connection network. Compared with the prior art, this strong defense measure is more targeted, only isolating the confirmed malicious nodes instead of cutting off all connections, thus minimizing the impact on normal network functions.

[0135] The hierarchical defense strategy of the defense execution module 6 adopts different intensities of defense measures according to the threat level, achieving an accurate match between the defense intensity and the threat level, minimizing the impact on normal services while ensuring system security. In addition, different levels of defense measures can be smoothly transitioned and dynamically adjusted according to the change of anomaly confidence, making the defense response more flexible and efficient.

[0136] Embodiment 9

[0137] As Figure 9 shown, the multi-level cache module 7 stores the original spectrum data, feature map data and detection results in layers, optimizing the data flow efficiency.

[0138] The multi-level cache module 7 adopts a three-level cache architecture: The L1 cache 71 is used to store the original spectrum data of the last 10 seconds, adopting a circular buffer structure, supporting high-speed writing and reading; The L2 cache 72 is used to store the feature map data of the last 1 hour, adopting a time-series index structure, facilitating quick query of the features in a specific time window; The L3 cache 73 is used to store the detection results of the last 24 hours, adopting a compressed storage method, saving storage space while retaining key information.

[0139] The cache management adopts the LRU (Least Recently Used) strategy, automatically eliminating the data that has not been accessed for a long time, ensuring the efficient use of the cache space. The data flow between the three-level caches follows the following rules: Frequently accessed L2 and L3 data will be temporarily promoted to a higher-level cache; Infrequently accessed L1 data will be demoted to the L2 cache; Expired data will be automatically cleared or archived and stored.

[0140] By reasonably allocating memory resources, the multi-level cache module 7 keeps the frequently accessed data in the high-speed cache, significantly improving the system response speed. Tests show that compared with a single storage structure, the multi-level cache scheme reduces the average data access latency by 78%, and the overall system throughput is increased by 3.2 times.

[0141] In addition, the cache module also implements a data prefetch mechanism, predicting the data that may be needed in the future according to the historical access pattern, and preloading it into a higher-level cache in advance to further optimize the access performance. The prefetch algorithm is based on a simple Markov prediction model, predicting the next possible accessed data according to the recent access sequence, and the prefetch accuracy can reach more than 65%.

[0142] The optimized design of the multi-level cache module 7 enables the system to efficiently process a large amount of spectrum and feature data, providing a solid data management foundation for real-time anomaly detection.

[0143] Embodiment 10

[0144] The working process of the radio spectrum anomaly monitoring device based on CNN and blockchain in the embodiment of the present invention is as follows:

[0145] 1. Spectrum data acquisition: The spectrum sensing module 1 collects radio signals in multiple frequency bands in parallel to generate a spectrum energy density matrix. The sampling process adopts an aperiodic random sampling strategy to avoid being predicted by attackers.

[0146] 2. Feature extraction and processing: The feature processing module 2 receives the spectrum energy density matrix, performs signal denoising and feature extraction through adaptive wavelet transform and self-organizing mapping algorithm to generate a two-dimensional feature topology map. During the processing, the system dynamically selects the optimal wavelet basis function according to the signal characteristics to ensure the accuracy of feature extraction.

[0147] 3. Multi-scale anomaly detection: The anomaly detection module 3 receives the feature topology map, performs deep feature extraction based on the dynamic convolution kernel structure and frequency domain attention mechanism to generate a regional anomaly probability distribution map. The detection process uses convolutional branches at three scales of small, medium, and large to process in parallel to capture anomaly features at different scales.

[0148] 4. Lightweight inference decision: The lightweight inference module 4 fuses expert knowledge residuals and deep learning results to determine the attack type and confidence score. The inference process adopts depthwise separable convolution and 4-bit quantization technology, significantly reducing the computational resource requirements while maintaining high-precision inference capabilities.

[0149] 5. Blockchain verification and storage: The blockchain storage module 5 records the attack determination results, verifies the reliability of the attack determination through distributed consensus, and stores the updated model parameters after verification. The verification process adopts a lightweight consensus mechanism based on proof of performance to avoid resource waste.

[0150] 6. Hierarchical defense response: According to the attack confidence, the defense execution module 6 takes different levels of defense measures. For low-confidence anomalies, increase the monitoring intensity; for medium-confidence anomalies, limit the bandwidth of suspicious connections; for high-confidence anomalies, suspend suspicious connections and reconstruct a healthy network.

[0151] 7. Federated learning evolution: The system updates the model parameters through federated reinforcement learning based on the detection results and defense effects. The update process realizes distributed knowledge sharing while protecting the privacy of the original data, improving the overall robustness of the system.

[0152] The entire workflow forms a closed-loop system. From spectrum sensing to defense execution, and then to model evolution, an adaptive, efficient, and reliable anomaly monitoring and defense system is constructed.

[0153] Example 11

[0154] To verify the actual effectiveness of the present invention, we deployed this system in a real blockchain network environment and conducted detection tests on various abnormal behaviors such as eclipse attacks. The test network included 100 normal nodes and 20 attack nodes, and the attack nodes simulated various attack behaviors such as eclipse attacks, Sybil attacks, and abnormal spectrum interference.

[0155] Compared with the benchmark system (CN115065502B), the present invention shows significant advantages in multiple key indicators:

[0156] 1. Detection accuracy: The detection accuracy for known attacks reaches 98.7%, which is 15.3 percentage points higher than the benchmark system; the detection accuracy for unknown attack variants reaches 87.4%, which is 23.6 percentage points higher than the benchmark system.

[0157] 2. Resource consumption: Under the same hardware conditions, the CPU usage rate is reduced by 78.2%, the memory occupancy is reduced by 65.4%, and the energy consumption is reduced by 53.8%. The lightweight design enables the system to operate efficiently on resource-constrained devices. A single-core ARM processor (1GHz) with 512MB RAM can meet the operation requirements in the lightweight mode.

[0158] 3. Adaptation speed: For new attack variants, the system adaptation cycle is shortened from an average of 72 hours in the benchmark system to 4.2 hours, which is increased by 17 times. The blockchain distributed learning mechanism enables the system to quickly distribute new attack features and defense strategies, greatly shortening the time to respond to new threats.

[0159] 4. Defense effect: When 30% of the nodes are under attack, the system can still maintain a detection ability of 95.3%, while the detection ability of the benchmark system drops to 62.4% under the same conditions. The hierarchical defense strategy enables the system to take appropriate-intensity defense measures according to the threat level, minimizing the impact on normal services.

[0160] In addition, the multi-modal perception mechanism of this system also demonstrates unique advantages. In cases where it is difficult to identify attacks at the pure logic layer, spectrum sensing can capture abnormal patterns at the physical layer, providing an additional detection dimension. Tests show that approximately 18% of the attack behaviors appear normal in logical layer analysis but exhibit obvious abnormalities in spectrum analysis, proving the practical value of multi-modal perception.

[0161] In summary, the radio spectrum anomaly monitoring device based on CNN and blockchain provided by the present invention realizes a high-precision, low-resource-consumption, and adaptive anomaly monitoring system by integrating physical-layer spectrum sensing and network-layer deep learning analysis, and combining blockchain distributed storage and consensus mechanisms. It effectively solves the problems existing in the prior art, such as lack of adaptability in feature extraction, high computational resource requirements, and overly aggressive defense measures, and provides a more comprehensive and efficient guarantee for blockchain network security.

[0162] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, various changes and modifications can be made to the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A radio spectrum anomaly monitoring device based on CNN and blockchain, characterized in that, It includes: A spectrum sensing module, which is used to collect multi-band radio signals and generate a spectrum energy density matrix; A feature processing module, which is communicatively connected to the spectrum sensing module, and is used to receive the spectrum energy density matrix, perform signal denoising by applying adaptive wavelet transform, and generate a two-dimensional feature topology map; An anomaly detection module, which is communicatively connected to the feature processing module, and is used to receive the two-dimensional feature topology map, perform deep feature extraction based on a dynamic convolution kernel structure and a frequency domain attention mechanism, and generate a regional anomaly probability distribution map; A lightweight inference module, which is communicatively connected to the anomaly detection module, and is used to receive the regional anomaly probability distribution map, fuse expert knowledge residuals and deep learning results, and determine the attack type and confidence score; A blockchain storage module, which is communicatively connected to the lightweight inference module, and is used to record the attack type and confidence score, verify the attack determination result based on distributed consensus, and store the verified model update parameters.

2. The device according to claim 1, characterized in that The spectrum sensing module includes: A multi-band sampling unit, which is used to collect radio signals in the 2.4 GHz, 5 GHz, and custom frequency bands in parallel; A signal preprocessing unit, which is used to perform denoising and standardization processing on the collected signals; A differential spectrum analysis unit, which is used to calculate the deviation value between the current spectrum and the historical baseline.

3. The device according to claim 1, wherein The feature processing module includes: A wavelet basis function selection unit, which is used to dynamically select the best wavelet basis function from the Haar, Daubechies, Symlets, and Coiflets wavelet function sets; A self-organizing mapping network unit, which is used to reduce the high-dimensional spectrum features to a two-dimensional topology map; An adaptive threshold noise suppression unit, which is used to dynamically adjust the noise suppression threshold based on the signal characteristics.

4. The device according to claim 1, wherein The anomaly detection module includes: A dynamic convolution kernel generation unit, which is used to adaptively adjust the convolution kernel size according to the spectrum complexity; A frequency domain attention unit, which is used to automatically focus on the frequency bands with high anomaly probabilities; A multi-scale convolutional branch network unit, which includes small, medium, and large convolutional branches, and is respectively used to detect anomaly features of different scales.

5. The device according to claim 4, characterized in that, The small branch of the multi-scale convolutional branch network unit adopts a parameter configuration of a 3×3 convolution kernel and a stride of 1, the medium branch adopts a parameter configuration of a 5×5 convolution kernel and a stride of 2, and the large branch adopts a parameter configuration of a 7×7 convolution kernel and a stride of 3.

6. The device according to claim 1, characterized in that, The lightweight inference module includes: A residual knowledge injection unit, which is used to fuse expert experience and learning results; A depthwise separable convolution unit, which is used to reduce the computational complexity; A quantization-aware training unit, which is used to quantize the model parameters into 4-bit integer representations.

7. The device according to claim 1, characterized in that, The blockchain storage module includes: A distributed verification unit, which is used to verify the attack determination result based on multi-node signatures; A federated reinforcement learning unit, which is used to aggregate the model gradient updates of multiple nodes; An adaptive retraining trigger unit, which is used to initiate model retraining when new attack features are detected.

8. The device according to claim 1, characterized in that, It further includes a defense execution module, which is communicatively connected to the lightweight inference module, and is used to execute a hierarchical defense strategy based on the attack type and confidence score.

9. The device according to claim 8, wherein The defense execution module includes: An early warning unit, which is used to increase the monitoring intensity in the case of low-confidence anomalies; A mild defense unit is used to limit the bandwidth of suspicious connections in the case of medium-confidence anomalies; A strong defense unit is used to suspend suspicious connections in the case of high-confidence anomalies.

10. The device according to claim 1, characterized in that, It further includes a multi-level cache module, which is communicatively connected to the spectrum sensing module and the feature processing module, and is used to hierarchically store the original spectrum data, feature map data, and detection results, optimizing the data flow efficiency.

Images