Intelligent contract abnormal behavior real-time detection and early warning method driven by multi-source heterogeneous big data

Abstract

The invention discloses a multi-source heterogeneous big data driven intelligent contract abnormal behavior real-time detection and early warning method, and relates to the technical field of block chains. According to the invention, a multilayer data preprocessor is adopted to carry out standardized conversion on intelligent contract codes, transaction records and network traffic, the problem that the traditional method is limited to single data source analysis so that the detection accuracy is low is solved, and a graph neural network, a time sequence analysis algorithm and a deep auto-encoder are utilized to carry out deep analysis on data. Multi-dimensional features of abnormal behaviors are comprehensively captured, the detection accuracy is remarkably improved, false alarm and missing alarm are effectively reduced, real-time data streams are processed by means of a streaming computing framework, millisecond-level real-time detection, quick response and early warning of the abnormal behaviors are achieved through parallel feature extraction and distributed computing resource scheduling, and safe operation of smart contracts is ensured.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, specifically a method for real-time detection and early warning of abnormal behavior in smart contracts driven by multi-source heterogeneous big data. Background Art

[0002] With the widespread application of blockchain technology, smart contracts, as a core component of decentralized applications, are directly related to the security of digital assets and user trust, and have become a crucial technological infrastructure in the blockchain ecosystem. The fact that smart contracts are difficult to modify once deployed means that security vulnerabilities and abnormal behavior can cause significant economic losses and systemic risks.

[0003] Current smart contract security detection methods mainly rely on static code analysis and single data source monitoring. These solutions are clearly insufficient when facing complex attack patterns. Traditional detection systems are often limited to specific types of data analysis and lack comprehensive utilization of multi-dimensional information, resulting in low detection accuracy and high false alarm rate. Most existing methods adopt offline analysis mode, which cannot meet the urgent need for real-time monitoring. Summary of the Invention

[0004] The purpose of this invention is to provide a real-time detection and early warning method for abnormal behavior of smart contracts driven by multi-source heterogeneous big data. By fusing multi-source heterogeneous data, real-time streaming computing and dynamic model optimization, the accuracy, real-time performance and adaptability of abnormal behavior detection of smart contracts are significantly improved, providing comprehensive protection for the safe operation of smart contracts.

[0005] The purpose of the present invention can be achieved through the following technical solutions: This application provides a method for real-time detection and early warning of abnormal behavior in smart contracts driven by multi-source heterogeneous big data, including the following steps: A multi-layer data preprocessor is used to standardize and transform three types of heterogeneous data sources: smart contract code, transaction records, and network traffic. The original data with different structures is mapped into standardized feature vectors, resulting in a preprocessed data set with unified dimensions and numerical range. A graph neural network algorithm is used to construct a code dependency graph. The graph structure feature representation of the contract code is obtained through node embedding and edge weight calculation, and the complexity of the code call path and the distribution of potential risk points are judged. For the distribution of risk points identified in the graph structure feature representation, a time series analysis algorithm is used to process the transaction record data through a sliding window. By calculating the statistical characteristics of transaction frequency, amount changes and time intervals, a time series feature vector reflecting contract execution behavior is obtained. Based on the abnormal fluctuation patterns in the time-series feature vector, a deep autoencoder is used to reconstruct the network traffic data by dimensionality reduction. By comparing the reconstruction error threshold and performing traffic pattern clustering analysis, the abnormal communication behavior characteristics at the network layer are determined. When the abnormal network communication behavior characteristics exceed the preset threshold, the graph structure features, temporal feature vectors and network behavior features are input into the multimodal feature fusion module. The importance weight of each dimension feature is calculated through the attention mechanism weighted fusion algorithm to obtain a comprehensive abnormal score. Based on the numerical distribution of the comprehensive anomaly score, a sliding threshold dynamic adjustment mechanism is used to optimize the anomaly detection boundary in real time, and then the severity level of the abnormal behavior is determined. The classification results of the severity levels of abnormal behavior are used to adjust the detection model parameters online using an incremental learning update mechanism. The optimized detection model parameter configuration is obtained by calculating the deviation between the feature distribution of new samples and the historical model.

[0006] Furthermore, a preprocessed dataset with uniform dimensions and numerical range is obtained, specifically including: The original data structure is obtained from three heterogeneous data sources: smart contract code, transaction record data, and network traffic information through a multi-layer data preprocessor. The data from different sources is initially cleaned. The cleaned data is structured and mapped using a data format conversion module. Field alignment and format unification are performed on the characteristics of each type of data to generate an intermediate data set with a consistent structure. Based on the characteristics of the intermediate dataset, the data is adjusted to have a consistent numerical range using standardization methods. Then, the standardized dataset is transformed in dimension using feature vector mapping technology. The corresponding feature values ​​are extracted from the key attributes of each type of data to generate a feature dataset with a unified dimensional range. The process involves identifying potential anomaly patterns in the feature dataset, classifying the data using a pre-established support vector machine model, determining whether there are outlier data points, obtaining the classified feature dataset, grouping the data using clustering analysis, analyzing the distribution characteristics of each data group based on the grouping results, and determining the final preprocessed dataset.

[0007] Furthermore, assessing the complexity of the code call path and the distribution of potential risk points specifically includes: The contract code structure information is obtained from the preprocessed dataset, and the function call relationship in the smart contract code is parsed. The call chain between functions is extracted using syntax analysis technology to generate an initial set of function call relationships. A graph neural network algorithm is used to construct a code dependency graph, and a vector representation is generated for each function node through node embedding technology to obtain a set of function node vectors. By using the edge weight calculation method, weights are assigned to the call relationships in the function node vector set. Combined with the propagation mechanism of the graph neural network, a graph structure feature set containing edge weights is generated. When the edge weights in the graph structure feature set exceed a preset threshold, a depth-first traversal is performed on the corresponding call path to obtain the function call order in the path. Cluster analysis is used to group paths, generating a set of path complexity distributions. Feature vectors are extracted from each group of paths, and a support vector machine model is used to classify the path complexity and determine the distribution of potential risk points.

[0008] Furthermore, a temporal feature vector reflecting the contract execution behavior is obtained, specifically including: For the risk point distribution identified in the graph structure feature representation, the sliding window method is used to segment the transaction records. By calculating the transaction frequency, amount change and time interval within each segment, and then processing it through a time series analysis algorithm, a time series feature vector reflecting the change of transaction behavior over time is obtained. Cluster analysis is used to group transaction behaviors. By analyzing the time-series characteristics of each group, a set of transaction behavior patterns is obtained. When the transaction frequency or amount change of a certain group in the pattern set exceeds a preset threshold, the transaction behavior of that group is deeply mined to obtain the feature distribution of abnormal transactions. By combining the risk point distribution identified in the graph structure features, the correlation between trading behavior and risk points is determined through matching analysis. The graph traversal algorithm is used to identify trading behaviors associated with high-risk points, resulting in a set of high-risk trading behaviors. Then, a second analysis of time series features is performed to obtain the time dynamic characteristics of trading behaviors and determine the final distribution of high-risk trading behaviors.

[0009] Furthermore, the characteristics of anomalous communication behavior at the network layer are identified, specifically including: The abnormal fluctuation patterns in the time-series feature vector are obtained. The network traffic data is segmented using the sliding window method. The traffic frequency, packet size change and time interval characteristics in each segment are calculated. Then, a deep autoencoder is used for dimensionality reduction to obtain the first feature vector after dimensionality reduction. Based on the first feature vector, the reconstruction error is calculated. When the reconstruction error exceeds the preset threshold, it is determined to be the second feature vector of abnormal fluctuation. The K-means clustering algorithm is used to group the patterns and obtain the pattern distribution of abnormal communication behavior. Based on the pattern distribution, the time series features of each pattern are extracted, and the time series decomposition method is used to obtain the time dynamic characteristics of the pattern. When the frequency change or data packet size change of a certain pattern exceeds the preset dynamic threshold, it is identified as a set of high-risk communication behaviors. Based on the set of high-risk communication behaviors, a graph analysis method is used in conjunction with the network topology to obtain the node distribution associated with the high-risk communication behaviors and determine the final abnormal communication behavior characteristics.

[0010] Furthermore, a comprehensive anomaly score is obtained, specifically including: When the abnormal network communication behavior characteristics exceed the preset threshold, the graph structure features, temporal feature vectors and network behavior features are concatenated according to rules to form a multimodal feature input matrix, providing comprehensive information for subsequent fusion processing; The attention mechanism is used to process the multimodal feature input matrix, automatically learn and calculate the importance weights of each dimension of features, and dynamically adjust the weights to adapt to different anomaly detection scenarios. Features are weighted and fused based on attention weights, and a comprehensive anomaly score is calculated using an anomaly scoring function to achieve comprehensive detection and evaluation of abnormal network behavior.

[0011] Furthermore, determining the severity level of abnormal behavior specifically includes: By obtaining the comprehensive score distribution characteristics from the data stream, a pre-established analysis model is used to extract features from the distribution characteristics. Combined with the sliding threshold and adjustment mechanism, the detection boundary is initially calibrated, and the boundary adjustment parameters are determined. When there is a deviation between the boundary adjustment parameters and the feedback data in the historical results, the rationality of the boundary adjustment is judged by comparing the matching degree between the current data and the statistical features. Based on the rationality of the boundary adjustment, a dynamic optimization strategy is obtained, and the optimized detection boundary is obtained by combining the statistical features of the current data. The distribution characteristics of abnormal behavior are analyzed, the severity level of abnormal behavior is determined based on the optimized detection boundary, and the abnormal behavior is classified using a support vector machine algorithm by combining historical results and feedback data. Then, the trend of the comprehensive score is obtained to determine the final abnormal behavior assessment result.

[0012] Furthermore, the optimized detection model parameter configuration is obtained, specifically including: New sample data is acquired in real time from the data stream and its features are extracted to obtain the feature distribution of the new samples. The deviation between the feature distribution of the new samples and the historical model parameters is then calculated. When the deviation exceeds a preset threshold, the incremental learning algorithm is triggered. Based on the feature distribution of the new samples and the historical model parameters, the model parameters are dynamically adjusted and updated. The boundary of the detection model is reconfigured using the updated model parameters to obtain the optimized detection boundary.

[0013] Furthermore, after configuring the optimized detection model parameters, the process also includes: using a streaming computing framework to perform millisecond-level anomaly detection processing on the real-time data stream, and determining the final detection result of the smart contract's abnormal behavior through parallel feature extraction and distributed computing resource scheduling.

[0014] Furthermore, the final results of the smart contract abnormal behavior detection are determined, specifically including: By integrating real-time data streams into a streaming computing framework, the data can be processed in real time. This is achieved by setting up multiple parallel task nodes, each of which is responsible for extracting features from a portion of the data stream. Through a distributed computing resource scheduling mechanism, computing resources are dynamically allocated based on the current data flow load and task execution status. The extracted feature data is sent to the anomaly detection model for real-time analysis to determine whether abnormal behavior exists. Based on the model's output, the abnormal behavior detection results of the smart contract are determined, and a response is given within milliseconds.

[0015] The beneficial effects of this invention are as follows: This invention addresses the problem of low detection accuracy caused by traditional methods being limited to analyzing a single data source by standardizing and transforming three types of heterogeneous data sources: smart contract code, transaction records, and network traffic, through the use of a multi-layer data preprocessor. It utilizes graph neural network algorithms to construct code dependency graphs and combines time series analysis algorithms and deep autoencoders to conduct in-depth analysis of transaction record and network traffic data, which can comprehensively capture the multi-dimensional features of abnormal behavior, thereby significantly improving detection accuracy and effectively reducing false positives and false negatives. By processing real-time data streams through a streaming computing framework and implementing parallel feature extraction and distributed computing resource scheduling, millisecond-level real-time detection of abnormal smart contract behavior is achieved. This solves the problem that most existing methods adopt offline analysis mode and cannot meet the needs of real-time monitoring. It can quickly respond to and warn of abnormal behavior, ensuring the safe operation of smart contracts. By employing a sliding threshold dynamic adjustment mechanism and an incremental learning update mechanism, the detection model parameters are dynamically optimized based on the statistical characteristics of real-time data streams and the accuracy feedback of historical detection results. This solves the problem that traditional detection systems with fixed thresholds cannot adapt to data changes, resulting in insufficient detection accuracy and adaptability. At the same time, by combining the support vector machine algorithm to classify abnormal behaviors and assess their severity, the system provides security teams with more accurate decision-making basis and improves the efficiency of abnormal behavior management and handling. Attached Figure Description

[0016] To better understand and implement this application, the technical solution is described in detail below with reference to the accompanying drawings.

[0017] Figure 1 A flowchart illustrating the real-time detection and early warning method for abnormal smart contract behavior driven by multi-source heterogeneous big data provided in this application; Figure 2A flowchart illustrating the process of determining the complexity of code call paths and the distribution of potential risk points in the real-time detection and early warning method for abnormal behavior of smart contracts driven by multi-source heterogeneous big data provided in this application. Figure 3 This is a flowchart illustrating the process of determining the severity level of abnormal behavior in the real-time detection and early warning method for abnormal smart contract behavior driven by multi-source heterogeneous big data provided in this application. Detailed Implementation

[0018] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, exemplary embodiments will be described in detail below, examples of which are illustrated in the accompanying drawings. In the following description relating to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of methods and systems consistent with some aspects of this application as detailed in the appended claims.

[0019] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0020] The following detailed description of the specific implementation methods, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided in detail.

[0021] Please see Figures 1-3 This embodiment provides a method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data, including the following steps: S1. A multi-layer data preprocessor is used to standardize and transform three types of heterogeneous data sources: smart contract code, transaction records, and network traffic. A unified data format conversion module maps the original data with different structures into standardized feature vectors, resulting in a preprocessed data set with unified dimensions and numerical range. Furthermore, a preprocessed dataset with uniform dimensions and numerical range is obtained, specifically including: The original data structure is obtained from three heterogeneous data sources: smart contract code, transaction record data, and network traffic information through a multi-layer data preprocessor. The data from different sources is initially cleaned. The cleaned data is structured and mapped using a data format conversion module. Field alignment and format unification are performed on the characteristics of each type of data to generate an intermediate data set with a consistent structure. Based on the characteristics of the intermediate dataset, the data is adjusted to have a consistent numerical range using standardization methods. Then, the standardized dataset is transformed in dimension using feature vector mapping technology. The corresponding feature values ​​are extracted from the key attributes of each type of data to generate a feature dataset with a unified dimensional range. The process involves identifying potential anomaly patterns in the feature dataset, classifying the data using a pre-established support vector machine model, determining whether there are outlier data points, obtaining the classified feature dataset, grouping the data using clustering analysis, analyzing the distribution characteristics of each data group based on the grouping results, and determining the final preprocessed dataset.

[0022] Specifically, by standardizing smart contract code, transaction records, and network traffic through a multi-layer data preprocessor, heterogeneous data is transformed into feature vectors with unified dimensions and numerical ranges. This solves the processing difficulties and inconsistencies caused by diverse data sources in traditional methods, providing high-quality input data for subsequent abnormal behavior detection and improving detection efficiency and accuracy.

[0023] S2. Based on the contract code structure information in the preprocessed dataset, a graph neural network algorithm is used to construct a code dependency graph. The graph structure feature representation of the contract code is obtained through node embedding and edge weight calculation to determine the complexity of the code call path and the distribution of potential risk points. Furthermore, assessing the complexity of the code call path and the distribution of potential risk points specifically includes: S21. Obtain contract code structure information from the preprocessed data set, parse the function call relationship in the smart contract code, extract the call chain between functions using syntax analysis technology, generate an initial set of function call relationships, construct a code dependency graph using graph neural network algorithm, and generate a vector representation for each function node using node embedding technology to obtain a set of function node vectors; S22. By using the edge weight calculation method, weights are assigned to the call relationships in the function node vector set. Combined with the propagation mechanism of the graph neural network, a graph structure feature set containing edge weights is generated. When the edge weights in the graph structure feature set exceed a preset threshold, a depth-first traversal is performed on the corresponding call path to obtain the function call order in the path. S23. Use cluster analysis to group the paths, generate a set of path complexity distributions, extract the feature vectors of each path group, use the support vector machine model to classify the path complexity, and determine the distribution of potential risk points.

[0024] Specifically, by constructing a code dependency graph using a graph neural network algorithm and combining node embedding and edge weight calculation, this invention can accurately analyze the complexity of the call path and the distribution of potential risk points in smart contract code. This process not only effectively solves the shortcomings of traditional static code analysis methods when facing complex call relationships, but also further refines the risk assessment through depth traversal and cluster analysis, making the identification of potential risk points more accurate and comprehensive, and providing a deeper insight and more reliable basis for the security assessment of smart contracts.

[0025] S3. For the distribution of risk points identified in the graph structure feature representation, a time series analysis algorithm is used to process the transaction record data through a sliding window. By calculating the statistical characteristics of transaction frequency, amount changes and time intervals, a time series feature vector reflecting contract execution behavior is obtained. Furthermore, a temporal feature vector reflecting the contract execution behavior is obtained, specifically including: For the risk point distribution identified in the graph structure feature representation, the sliding window method is used to segment the transaction records. By calculating the transaction frequency, amount change and time interval within each segment, and then processing it through a time series analysis algorithm, a time series feature vector reflecting the change of transaction behavior over time is obtained. Among these features, transaction frequency reflects the density of transactions within a specific time period; changes in transaction amount reflect the fluctuation trend of transaction amount; and time interval reveals the pattern of time intervals between transactions. These features can describe the changes in transaction behavior over time from different perspectives and are an important component in constructing a time-series feature vector. Cluster analysis is used to group transaction behaviors. By analyzing the time-series characteristics of each group, a set of transaction behavior patterns is obtained. When the transaction frequency or amount change of a certain group in the pattern set exceeds a preset threshold, the transaction behavior of that group is deeply mined to obtain the feature distribution of abnormal transactions. In particular, the feature distribution of abnormal transactions is further refined and extracted. Abnormal transactions often have different temporal characteristics than normal transactions. These abnormal characteristics can be obtained through in-depth mining, thereby enriching and improving the temporal feature vector so that it can better reflect abnormal situations in contract execution behavior.

[0026] By combining the risk point distribution identified in the graph structure features, the correlation between trading behavior and risk points is determined through matching analysis. The graph traversal algorithm is used to identify trading behaviors associated with high-risk points, resulting in a set of high-risk trading behaviors. Then, a second analysis of time series features is performed to obtain the time dynamic characteristics of trading behaviors and determine the final distribution of high-risk trading behaviors.

[0027] Specifically, the contract execution behavior was comprehensively analyzed from multiple aspects, including the extraction of temporal features from transaction records, cluster analysis of transaction behavior patterns, and graph structure feature analysis of risk point associations. Ultimately, temporal feature vectors reflecting the changes in transaction behavior over time were obtained. These temporal feature vectors can comprehensively describe the dynamic characteristics of contract execution behavior, providing strong support for identifying abnormal and high-risk transaction behaviors.

[0028] Specifically, by employing a time-series analysis algorithm to process transaction record data using a sliding window, and calculating statistical characteristics such as transaction frequency, amount changes, and time intervals, this invention can accurately capture changes in transaction behavior over time and generate a time-series feature vector reflecting contract execution behavior. Combined with clustering analysis and deep mining techniques, the feature distribution of abnormal transactions is further refined, enriching the time-series feature vector and enabling it to better reflect abnormal situations. Simultaneously, by combining the risk point distribution in the graph structure features, and through matching analysis and graph traversal algorithms, transaction behaviors associated with high-risk points are identified, determining the final distribution of high-risk transaction behaviors. This allows for more comprehensive and accurate monitoring of abnormal smart contract behavior, providing strong support for risk warning.

[0029] S4. Based on the abnormal fluctuation patterns in the time-series feature vector, a deep autoencoder is used to reconstruct the network traffic data by dimensionality reduction. By comparing the reconstruction error threshold and performing traffic pattern clustering analysis, the abnormal communication behavior characteristics at the network layer are determined. Furthermore, the characteristics of anomalous communication behavior at the network layer are identified, specifically including: The abnormal fluctuation patterns in the time-series feature vector are obtained. The network traffic data is segmented using the sliding window method. The traffic frequency, packet size change and time interval characteristics in each segment are calculated. Then, a deep autoencoder is used for dimensionality reduction to obtain the first feature vector after dimensionality reduction. Based on the first feature vector, the reconstruction error is calculated. When the reconstruction error exceeds the preset threshold, it is determined to be the second feature vector of abnormal fluctuation. The K-means clustering algorithm is used to group the patterns and obtain the pattern distribution of abnormal communication behavior. Based on the pattern distribution, the time series features of each pattern are extracted, and the time series decomposition method is used to obtain the time dynamic characteristics of the pattern. When the frequency change or data packet size change of a certain pattern exceeds the preset dynamic threshold, it is identified as a set of high-risk communication behaviors. Based on the set of high-risk communication behaviors, a graph analysis method is used in conjunction with the network topology to obtain the node distribution associated with the high-risk communication behaviors and determine the final abnormal communication behavior characteristics.

[0030] Specifically, by using a deep autoencoder to reconstruct network traffic data through dimensionality reduction, and combining reconstruction error threshold comparison and traffic pattern clustering analysis, this invention can accurately identify abnormal communication behavior characteristics at the network level. This process effectively solves the difficulties of traditional methods in processing high-dimensional network traffic data, improving the accuracy and efficiency of anomaly detection. At the same time, by obtaining the temporal dynamic characteristics of patterns through time series decomposition and combining graph analysis methods to identify the node distribution associated with high-risk communication behavior, the identification and localization of abnormal behavior are further refined, providing a more comprehensive and in-depth analytical capability for network-level anomaly detection of smart contracts.

[0031] S5. When the abnormal network communication behavior characteristics exceed the preset threshold, the graph structure characteristics, temporal feature vector and network behavior characteristics are input into the multimodal feature fusion module. The importance weight of each dimension feature is calculated through the attention mechanism weighted fusion algorithm to obtain the comprehensive abnormal score. Furthermore, a comprehensive anomaly score is obtained, specifically including: When the abnormal network communication behavior characteristics exceed the preset threshold, the graph structure features, temporal feature vectors and network behavior features are concatenated according to rules to form a multimodal feature input matrix, providing comprehensive information for subsequent fusion processing; The attention mechanism is used to process the multimodal feature input matrix, automatically learn and calculate the importance weights of each dimension of features, and dynamically adjust the weights to adapt to different anomaly detection scenarios. Features are weighted and fused based on attention weights, and a comprehensive anomaly score is calculated using an anomaly scoring function to achieve comprehensive detection and evaluation of abnormal network behavior.

[0032] The comprehensive anomaly score is expressed as follows: , This represents the anomaly scoring function, used to calculate the anomaly score of the comprehensive feature vector f. It is a rating weight vector. It is a bias term.

[0033] Specifically, through a multimodal feature fusion module and an attention mechanism weighted fusion algorithm, this invention can comprehensively consider graph structure features, temporal feature vectors, and network behavior features, automatically calculate the importance weights of features in each dimension, and obtain a comprehensive anomaly score accordingly. This process effectively solves the detection limitations caused by a single feature dimension in traditional methods, improves the comprehensiveness and accuracy of anomaly detection, and the dynamic weight adjustment of the attention mechanism can adapt to different anomaly detection scenarios, making the comprehensive anomaly score more accurately reflect the overall degree of anomaly, providing strong support for the comprehensive detection and evaluation of abnormal behavior in smart contracts.

[0034] S6. Based on the numerical distribution of the comprehensive anomaly score, a sliding threshold dynamic adjustment mechanism is used to optimize the anomaly detection boundary in real time. The severity level of the abnormal behavior is determined by the accuracy feedback of historical detection results and the statistical characteristics of the current data stream. Furthermore, determining the severity level of abnormal behavior specifically includes: S61. By obtaining the comprehensive score distribution characteristics from the data stream, the distribution characteristics are extracted using a pre-established analysis model. Combined with the sliding threshold and adjustment mechanism, the detection boundary is initially calibrated, and the boundary adjustment parameters are determined. S62. When there is a deviation between the boundary adjustment parameters and the feedback data in the historical results, the rationality of the boundary adjustment is judged by comparing the matching degree between the current data and the statistical features. Based on the rationality of the boundary adjustment, a dynamic optimization strategy is obtained, and the optimized detection boundary is obtained by combining the statistical features of the current data. S63. Analyze the distribution characteristics of abnormal behaviors, determine the severity level of abnormal behaviors based on the optimized detection boundary, and classify abnormal behaviors using a support vector machine algorithm by combining historical results and feedback data. Then, obtain the trend of the comprehensive score change to determine the final abnormal behavior assessment result. If the trend exceeds the preset threshold, it indicates that the severity of the abnormal behavior is high; conversely, if the trend is below the preset threshold, it indicates that the severity of the abnormal behavior is low.

[0035] The SVM algorithm can categorize abnormal behaviors into different classes, with each class corresponding to a severity level.

[0036] Specifically, through a multimodal feature fusion module and an attention-based weighted fusion algorithm, this invention comprehensively considers graph structure features, temporal feature vectors, and network behavior features, automatically calculates the importance weights of features in each dimension, and obtains a comprehensive anomaly score accordingly. This process effectively solves the detection limitations caused by a single feature dimension in traditional methods, improving the comprehensiveness and accuracy of anomaly detection. Simultaneously, the dynamic weight adjustment of the attention mechanism can adapt to different anomaly detection scenarios, making the comprehensive anomaly score more accurately reflect the overall degree of anomaly, providing strong support for the comprehensive detection and evaluation of abnormal behavior in smart contracts.

[0037] S7. For the classification results of the severity level of abnormal behavior, the detection model parameters are adjusted online using an incremental learning update mechanism. The optimized detection model parameter configuration is obtained by calculating the deviation between the feature distribution of the new samples and the historical model.

[0038] Furthermore, the optimized detection model parameter configuration is obtained, specifically including: New sample data is acquired in real time from the data stream, and features are extracted from these data to obtain the feature distribution of the new samples. The deviation between the feature distribution of the new samples and the historical model parameters is then calculated. When the deviation exceeds a preset threshold, the incremental learning algorithm is triggered. Based on the feature distribution of the new samples and the historical model parameters, the model parameters are dynamically adjusted and updated. The boundary of the detection model is reconfigured using the updated model parameters to obtain an optimized detection boundary, thereby improving the model's ability to detect abnormal behavior and its adaptability.

[0039] Specifically, by adopting an incremental learning update mechanism, this invention can dynamically adjust the detection model parameters according to the feature distribution of new samples. When the deviation between the new sample and the historical model exceeds a preset threshold, the incremental learning algorithm is triggered to automatically update the model parameters and optimize the detection boundary. This process effectively solves the problem of insufficient adaptability of traditional detection models when facing new data, improves the model's ability to detect abnormal behavior and adaptability, and ensures that the detection model remains efficient and accurate in a constantly changing data environment.

[0040] Furthermore, after configuring the optimized detection model parameters, the process also includes: using a streaming computing framework to perform millisecond-level anomaly detection processing on the real-time data stream, and determining the final detection result of the smart contract's abnormal behavior through parallel feature extraction and distributed computing resource scheduling.

[0041] Furthermore, the final results of the smart contract abnormal behavior detection are determined, specifically including: By integrating real-time data streams into a streaming computing framework, the data can be processed in real time. Multiple parallel task nodes are set up, with each node responsible for extracting features from a portion of the data stream. The extracted features include, but are not limited to, transaction frequency, amount changes, and data packet size. Through a distributed computing resource scheduling mechanism, computing resources are dynamically allocated based on the current data flow load and task execution status to ensure that each task node can run efficiently. The extracted feature data is sent to the anomaly detection model for real-time analysis. The anomaly detection model can be a machine learning or deep learning model, which can quickly determine whether there is abnormal behavior based on the extracted features. Based on the model's output, the abnormal behavior detection results of the smart contract are determined, and a response is given within milliseconds. In this way, efficient and rapid anomaly detection of real-time data streams can be achieved, ensuring the security and stability of smart contracts.

[0042] Specifically, by employing a streaming computing framework, this invention achieves millisecond-level anomaly detection processing for real-time data streams. Utilizing parallel feature extraction and distributed computing resource scheduling, it can efficiently process large-scale real-time data streams, quickly extract key features, and perform anomaly detection. This process not only ensures the real-time nature and efficiency of detection but also improves the accuracy and response speed of smart contract anomaly detection, providing strong protection for the secure operation of smart contracts.

[0043] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for real-time detection and early warning of abnormal behavior in smart contracts driven by multi-source heterogeneous big data, characterized by: Includes the following steps: A multi-layer data preprocessor is used to standardize and transform three types of heterogeneous data sources: smart contract code, transaction records, and network traffic. The original data with different structures is mapped into standardized feature vectors, resulting in a preprocessed data set with unified dimensions and numerical range. A graph neural network algorithm is used to construct a code dependency graph. The graph structure feature representation of the contract code is obtained through node embedding and edge weight calculation, and the complexity of the code call path and the distribution of potential risk points are judged. For the distribution of risk points identified in the graph structure feature representation, a time series analysis algorithm is used to process the transaction record data through a sliding window. By calculating the statistical characteristics of transaction frequency, amount changes and time intervals, a time series feature vector reflecting contract execution behavior is obtained. Based on the abnormal fluctuation patterns in the time-series feature vector, a deep autoencoder is used to reconstruct the network traffic data by dimensionality reduction. By comparing the reconstruction error threshold and performing traffic pattern clustering analysis, the abnormal communication behavior characteristics at the network layer are determined. When the abnormal network communication behavior characteristics exceed the preset threshold, the graph structure features, temporal feature vectors and network behavior features are input into the multimodal feature fusion module. The importance weight of each dimension feature is calculated through the attention mechanism weighted fusion algorithm to obtain a comprehensive abnormal score. Based on the numerical distribution of the comprehensive anomaly score, a sliding threshold dynamic adjustment mechanism is used to optimize the anomaly detection boundary in real time, and then the severity level of the abnormal behavior is determined. The classification results of the severity levels of abnormal behavior are used to adjust the detection model parameters online using an incremental learning update mechanism. The optimized detection model parameter configuration is obtained by calculating the deviation between the feature distribution of new samples and the historical model.

2. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 1, characterized in that: The resulting preprocessed data set has uniform dimensions and numerical range, specifically including: The original data structure is obtained from three heterogeneous data sources: smart contract code, transaction record data, and network traffic information through a multi-layer data preprocessor. The data from different sources is initially cleaned. The cleaned data is structured and mapped using a data format conversion module. Field alignment and format unification are performed on the characteristics of each type of data to generate an intermediate data set with a consistent structure. Based on the characteristics of the intermediate dataset, the data is adjusted to have a consistent numerical range using standardization methods. Then, the standardized dataset is transformed in dimension using feature vector mapping technology. The corresponding feature values ​​are extracted from the key attributes of each type of data to generate a feature dataset with a unified dimensional range. The process involves identifying potential anomaly patterns in the feature dataset, classifying the data using a pre-established support vector machine model, determining whether there are outlier data points, obtaining the classified feature dataset, grouping the data using clustering analysis, analyzing the distribution characteristics of each data group based on the grouping results, and determining the final preprocessed dataset.

3. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 1, characterized in that: Assess the complexity of the code call path and the distribution of potential risk points, specifically including: The contract code structure information is obtained from the preprocessed dataset, and the function call relationship in the smart contract code is parsed. The call chain between functions is extracted using syntax analysis technology, and a code dependency graph is constructed using a graph neural network algorithm. Vector representations are generated for each function node through node embedding technology, resulting in a set of function node vectors. By using the edge weight calculation method, weights are assigned to the call relationships in the function node vector set. Combined with the propagation mechanism of the graph neural network, a graph structure feature set containing edge weights is generated. When the edge weights in the graph structure feature set exceed a preset threshold, a depth-first traversal is performed on the corresponding call path to obtain the function call order in the path. Cluster analysis is used to group paths, generating a set of path complexity distributions. Feature vectors are extracted from each group of paths, and a support vector machine model is used to classify the path complexity and determine the distribution of potential risk points.

4. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 1, characterized in that: Obtain the time-series feature vector reflecting the contract execution behavior, specifically including: For the risk point distribution identified in the graph structure feature representation, the sliding window method is used to segment the transaction records. By calculating the transaction frequency, amount change and time interval within each segment, and then processing it through a time series analysis algorithm, a time series feature vector reflecting the change of transaction behavior over time is obtained. Cluster analysis is used to group transaction behaviors. By analyzing the time-series characteristics of each group, a set of transaction behavior patterns is obtained. When the transaction frequency or amount change of a certain group in the pattern set exceeds a preset threshold, the transaction behavior of that group is deeply mined to obtain the feature distribution of abnormal transactions. By combining the risk point distribution identified in the graph structure features, the correlation between trading behavior and risk points is determined through matching analysis. The graph traversal algorithm is used to identify trading behaviors associated with high-risk points, resulting in a set of high-risk trading behaviors. Then, a second analysis of time series features is performed to obtain the time dynamic characteristics of trading behaviors and determine the final distribution of high-risk trading behaviors.

5. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 1, characterized in that: Identifying anomalous communication behavior characteristics at the network layer, specifically including: The abnormal fluctuation patterns in the time-series feature vector are obtained. The network traffic data is segmented using the sliding window method. The traffic frequency, packet size change and time interval characteristics in each segment are calculated. Then, a deep autoencoder is used for dimensionality reduction to obtain the first feature vector after dimensionality reduction. Based on the first feature vector, the reconstruction error is calculated. When the reconstruction error exceeds the preset threshold, it is determined to be the second feature vector of abnormal fluctuation. The K-means clustering algorithm is used to group the patterns and obtain the pattern distribution of abnormal communication behavior. Based on the pattern distribution, the time series features of each pattern are extracted, and the time series decomposition method is used to obtain the time dynamic characteristics of the pattern. When the frequency change or data packet size change of a certain pattern exceeds the preset dynamic threshold, it is identified as a set of high-risk communication behaviors. Based on the set of high-risk communication behaviors, a graph analysis method is used in conjunction with the network topology to obtain the node distribution associated with the high-risk communication behaviors and determine the final abnormal communication behavior characteristics.

6. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 1, characterized in that: A comprehensive anomaly score is obtained, which includes: When the abnormal network communication behavior characteristics exceed the preset threshold, the graph structure features, temporal feature vectors and network behavior features are concatenated according to rules to form a multimodal feature input matrix, providing comprehensive information for subsequent fusion processing; The attention mechanism is used to process the multimodal feature input matrix, automatically learn and calculate the importance weights of each dimension of features, and dynamically adjust the weights to adapt to different anomaly detection scenarios. Features are weighted and fused based on attention weights, and a comprehensive anomaly score is calculated using an anomaly scoring function to achieve comprehensive detection and evaluation of abnormal network behavior.

7. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 1, characterized in that: Determining the severity level of abnormal behavior specifically includes: By obtaining the comprehensive score distribution characteristics from the data stream, a pre-established analysis model is used to extract features from the distribution characteristics. Combined with the sliding threshold and adjustment mechanism, the detection boundary is initially calibrated, and the boundary adjustment parameters are determined. When there is a deviation between the boundary adjustment parameters and the feedback data in the historical results, the rationality of the boundary adjustment is judged by comparing the matching degree between the current data and the statistical features. Based on the rationality of the boundary adjustment, a dynamic optimization strategy is obtained, and the optimized detection boundary is obtained by combining the statistical features of the current data. The distribution characteristics of abnormal behavior are analyzed, the severity level of abnormal behavior is determined based on the optimized detection boundary, and the abnormal behavior is classified using a support vector machine algorithm by combining historical results and feedback data. Then, the trend of the comprehensive score is obtained to determine the final abnormal behavior assessment result.

8. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 1, characterized in that: Obtain the optimized detection model parameter configuration, specifically including: New sample data is acquired in real time from the data stream and its features are extracted to obtain the feature distribution of the new samples. The deviation between the feature distribution of the new samples and the historical model parameters is then calculated. When the deviation exceeds a preset threshold, the incremental learning algorithm is triggered. Based on the feature distribution of the new samples and the historical model parameters, the model parameters are dynamically adjusted and updated. The boundary of the detection model is reconfigured using the updated model parameters to obtain the optimized detection boundary.

9. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 8, characterized in that: After optimizing the detection model parameter configuration, the process also includes: using a streaming computing framework to perform millisecond-level anomaly detection processing on real-time data streams, and determining the final smart contract abnormal behavior detection result through parallel feature extraction and distributed computing resource scheduling.

10. The method for real-time detection and early warning of abnormal behavior of smart contracts driven by multi-source heterogeneous big data according to claim 9, characterized in that: The final results of the smart contract anomaly detection are determined, including: By integrating real-time data streams into a streaming computing framework, the data can be processed in real time. This is achieved by setting up multiple parallel task nodes, each of which is responsible for extracting features from a portion of the data stream. Through a distributed computing resource scheduling mechanism, computing resources are dynamically allocated based on the current data flow load and task execution status. The extracted feature data is sent to the anomaly detection model for real-time analysis to determine whether abnormal behavior exists. Based on the model's output, the abnormal behavior detection results of the smart contract are determined, and a response is given within milliseconds.

Images