An abnormal blockchain node detection method and device

Abstract

The specification discloses an abnormal blockchain node detection method and device. The method comprises: constructing a graph structure for at least two blockchain nodes in a blockchain network, each graph node corresponding to each blockchain node, each graph node being connected to at least one edge, the weight of any edge being positively correlated with the similarity between the two graph nodes connected by the edge, and the similarity between the two graph nodes being the similarity between the data of the same address on the blockchain of the corresponding two blockchain nodes; inputting the original representation corresponding to the graph structure into a graph neural network for mapping processing to obtain a mapping representation corresponding to the graph structure; the original representation comprises original features of each graph node and weights of each edge, and the mapping representation comprises mapping features of each graph node; applying an anomaly detection algorithm in the mapping features of each graph node to determine an abnormal mapping feature, and determining the blockchain node corresponding to the graph node with the abnormal mapping feature as an abnormal blockchain node.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification relate to the field of blockchains, and in particular to an abnormal blockchain node detection method and device. BACKGROUND

[0002] At present, blockchain networks are applied in many businesses. For example, data storage, virtual currency, etc. The blockchain network has many advantages such as encryption, non-tamperability, traceability, etc.

[0003] However, the blockchain network can also be attacked, resulting in errors in the blockchain data. For example, eclipse attack. Since the blockchain network includes multiple blockchain nodes, when the blockchain network is attacked, there are usually abnormal blockchain nodes due to the attack, for example, the attacked blockchain nodes may store incorrect blockchain data. Therefore, by detecting whether the blockchain node is abnormal, it can help identify whether the blockchain network is attacked.

[0004] In order to facilitate the identification of whether the blockchain network is attacked, there is an urgent need for a method for detecting whether the blockchain node is abnormal. SUMMARY

[0005] In order to solve the above technical problems, the embodiments of the present specification provide an abnormal blockchain node detection method and device. The technical solution is as follows.

[0006] An abnormal blockchain node detection method comprises:

[0007] A graph structure is constructed for at least two blockchain nodes in a blockchain network, wherein each graph node corresponds to each blockchain node one by one, each graph node is connected to at least one edge, and the weight of any edge is positively correlated with the similarity between the two graph nodes connected by the edge. The similarity between the two graph nodes is the similarity between the data of the same address on the blockchain of the corresponding two blockchain nodes;

[0008] The original representation corresponding to the graph structure is input into a graph neural network for mapping processing to obtain a mapping representation corresponding to the graph structure. The original representation includes the original features of each graph node and the weight of each edge, and the mapping representation includes the mapping features of each graph node;

[0009] An anomaly detection algorithm is applied in the mapping features of each graph node to determine abnormal mapping features, and the blockchain nodes corresponding to the graph nodes with abnormal mapping features are determined as abnormal blockchain nodes.

[0010] An abnormal blockchain node detection device comprises:

[0011] A construction unit is configured to construct a graph structure for at least two blockchain nodes in a blockchain network, wherein each graph node corresponds to each blockchain node, each graph node is connected to at least one edge, and the weight of any edge is positively correlated with the similarity between the two graph nodes connected by the edge, and the similarity between the two graph nodes is the similarity between the data of the same address on the blockchain of the corresponding two blockchain nodes.

[0012] A mapping unit is configured to map the original representation of the graph structure into a graph neural network to obtain a mapped representation of the graph structure, wherein the original representation includes the original features of each graph node and the weight of each edge, and the mapped representation includes the mapped features of each graph node.

[0013] An anomaly determination unit is configured to apply an anomaly detection algorithm to the mapped features of each graph node to determine an abnormal mapped feature, and determine the blockchain node corresponding to the graph node with the abnormal mapped feature as an abnormal blockchain node.

[0014] By the above technical solution, the similarity of the blockchain data between the blockchain nodes obtained from the blockchain network can be intuitively represented by the graph structure. From the whole graph structure, the similarity of the blockchain data is integrated into the mapped features of the graph nodes based on the graph neural network, so that the difference between the mapped features of the abnormal blockchain nodes and the mapped features of the normal blockchain nodes is large. For the mapped features, the abnormal mapped features can be determined by using the anomaly detection algorithm, and then the abnormal blockchain nodes can be determined comprehensively and quickly, which facilitates the identification of whether the blockchain network is attacked. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present specification or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0016] Figure 1 is a flow diagram of an abnormal blockchain node detection method provided by the embodiments of the present specification;

[0017] Figure 2 is a schematic diagram of a graph structure to be detected provided by the embodiments of the present specification;

[0018] Figure 3 is a structural diagram of an abnormal blockchain node detection device provided by the embodiments of the present specification;

[0019] Figure 4 is a structural diagram of a device for configuring the method of the embodiments of the present specification. DETAILED DESCRIPTION

[0020] In order for those skilled in the art to better understand the technical solutions in the embodiments of the present specification, the technical solutions in the embodiments of the present specification will be described in detail below in combination with the drawings in the embodiments of the present specification. Obviously, the described embodiments are only a part of the embodiments of the present specification, not all the embodiments. Based on the embodiments in the present specification, all other embodiments obtained by those skilled in the art should belong to the disclosed range.

[0021] At present, the blockchain network is becoming mature and has applications in various businesses. For example, data storage, virtual currency, etc. The blockchain network has advantages such as encryption, non-tamperability, traceability, etc.

[0022] However, the current blockchain network can also be attacked, resulting in consequences such as tampering with data in the blockchain. For example, eclipse attack.

[0023] The eclipse attack will be explained in detail below. First, the blockchain network usually includes multiple blockchain nodes. Each blockchain node can obtain new blocks from other blockchain nodes or generate new blocks itself and send the new blocks to other blockchain nodes. Since the blockchain network belongs to distributed storage, it needs to unify the blockchain stored in all blockchain nodes in the blockchain network, so each blockchain node can determine the same new block through a consensus mechanism (for example, proof of work) to add to the blockchain, so that the blockchain stored in all blockchain nodes remains consistent.

[0024] For example, in the proof of work consensus mechanism, each blockchain node can construct a blockchain branch according to different new blocks received, and determine the longest blockchain branch as the correct blockchain (i.e., the blockchain branch with the most blocks) after a period of time.

[0025] However, for any normal blockchain node, the source of obtaining new blocks may be limited, which may result in not being able to obtain the correct block, and there is no correct blockchain on the normal blockchain node, so it is impossible to determine the correct blockchain through the consensus mechanism.

[0026] For example, in the case where the blockchain node controlled by the attacker controls the source of obtaining new blocks for the normal blockchain node, the normal blockchain node can only obtain the wrong blocks sent by the attacker's blockchain node, and will not obtain the correct blocks sent by other normal blockchain nodes, so that the normal blockchain node is in an isolated state and is further controlled by the attacker. Since the normal blockchain node itself cannot obtain the correct block, there is no correct blockchain branch, so it is difficult to determine the correct blockchain through the consensus mechanism.

[0027] And the controlled normal blockchain node can further send the error block to other normal blockchain nodes, so that other normal blockchain nodes are further controlled by the attacker.

[0028] For example, the blockchain nodes of the attacker include blockchain nodes 1-3, and the normal blockchain node 4 usually obtains the new block from the blockchain nodes 1-3. The attacker can send the error block to the blockchain node 4 through the blockchain nodes 1-3, and the blockchain node 4 cannot find the error of the block, nor can it obtain the correct block on other normal blockchain nodes, so that the error block chain is formed through the consensus mechanism, and the normal blockchain node 4 is also controlled by the attacker. Further, the blockchain node 4 also sends the error block to other normal blockchain nodes.

[0029] Before performing the eclipse attack, the attacker can also pre-fabricate a plurality of virtual blockchain nodes through the witch attack, and connect the normal blockchain node with the virtual blockchain nodes controlled by the attacker, so that the normal blockchain node can only obtain the error block from the virtual blockchain nodes controlled by the attacker, thereby completing the control of the normal blockchain node.

[0030] Of course, the above eclipse attack is only an example of attack, and there are other attack methods for the blockchain network, which will not be described here. The attacked blockchain network will have abnormal blockchain nodes, and the abnormal blockchain nodes usually store error block chains different from the correct block chain.

[0031] At present, there is an urgent need for a method for detecting whether the blockchain node in the blockchain network is abnormal, so as to facilitate further detection or corrective measures for these abnormal blockchain nodes, and to facilitate the identification of whether the blockchain network is attacked, so that the influence of the attack will not be expanded.

[0032] In order to solve the above technical problems, the present specification provides an abnormal blockchain node detection method. The abnormal blockchain node can be a blockchain node that stores an error block chain different from the correct block chain.

[0033] In view of the above situation that the blockchain network is attacked, there is a cryptographic association between adjacent blocks in the blockchain, which is embodied in that the hash value of the previous block is recorded in the block header of the subsequent block, forming a chain structure.

[0034] Therefore, if the abnormal blockchain node adds the error block to the correct block chain, the hash value of the previous block recorded in the subsequent block of the error block is completely different from the correct block chain, further causing the subsequent block to also differ from the correct block chain, thereby gradually forming 2 completely different block chains.

[0035] In other words, an abnormal blockchain node usually stores a wrong blockchain that is completely different from a correct blockchain, and thus there is a difference between the blocks stored on a normal blockchain node and the blocks stored on an abnormal blockchain node, and the similarity is low. The abnormal blockchain node can be detected by using the characteristics of the abnormal blockchain node.

[0036] It should be noted that, for a blockchain network, it is usually difficult to determine all the blockchain nodes in the blockchain network due to various reasons. For example, the limitation of computing power, the limitation of storage capacity, the limitation of communication capacity, and the like. It is obviously difficult to directly determine the correct blockchain according to part of the blockchain nodes in the blockchain network. In addition, for a part of consensus mechanism, such as proof of work, there are usually multiple branches in the blockchain, and it is also difficult to directly determine the correct blockchain after a period of time.

[0037] Therefore, after obtaining the blockchain-related information of multiple blockchain nodes, it is difficult to directly determine the correct blockchain. For example, the obtained blockchain node information is not all the blockchain nodes in the blockchain network, and the blockchain with the largest proportion cannot be directly determined as the correct blockchain; or there are multiple blockchain branches on each blockchain node, and the correct blockchain cannot be temporarily determined.

[0038] In order to determine the abnormal blockchain node, in the method provided in the embodiments of the present disclosure, the similarity of the blockchain data between different blockchain nodes can be analyzed.

[0039] It should be noted that, although it is difficult to directly determine the correct blockchain, the difference between the blockchain data of the normal blockchain node and the abnormal blockchain node is large, and the similarity of the blockchain data is low.

[0040] In addition, in general, the proportion of abnormal blockchain nodes in the blockchain network is small, and the proportion of normal blockchain nodes is large, and thus this situation usually exists in part of the obtained blockchain nodes. Specifically, the proportion of abnormal blockchain nodes in the obtained blockchain nodes is small, and the proportion of normal blockchain nodes in the obtained blockchain nodes is large.

[0041] Therefore, the abnormal blockchain node can be determined by using the characteristics that the similarity of the blockchain data between the abnormal blockchain node and the normal blockchain node is low, and the proportion of the abnormal blockchain node in the obtained blockchain nodes is small.

[0042] In the method, the similarity of the blockchain data between the blockchain nodes can be represented by a graph structure.

[0043] Specifically, a graph structure can be constructed for the obtained blockchain nodes, each graph node corresponding to a blockchain node, each graph node connected to at least one edge, and the weight of any edge being positively correlated to the similarity between the two graph nodes connected by the edge, the similarity between the two graph nodes being the similarity between the data of the same address on the blockchains of the corresponding two blockchain nodes.

[0044] The graph nodes in the graph structure have original features, which can be used to represent the relevant information of the corresponding blockchain nodes.

[0045] The weights of the edges in the graph structure can be used to represent the similarity of the blockchain data between the blockchain nodes.

[0046] For the graph structure, the original features of the graph nodes and the weights of the edges in the graph structure can be fused by a graph neural network to obtain mapped features of the graph nodes, so that the mapped features can reflect the similarity of the blockchain data.

[0047] Specifically, the original features of each graph node and the weight of each edge in the graph structure can be input into the graph neural network, and the graph neural network can obtain the mapped features of each graph node by synthesizing the features of the neighbor nodes of the graph node and the weights of the corresponding edges.

[0048] For two graph nodes that are neighbor nodes of each other, the greater the weight of the edge connecting the two graph nodes, the higher the similarity of the blockchain data of the corresponding two blockchain nodes, and the greater the influence of the features of the neighbor nodes on the process of obtaining the mapped features, and the more similar the two mapped features obtained.

[0049] If the weight of the edge connecting the two graph nodes is smaller, it indicates that the similarity of the blockchain data of the corresponding two blockchain nodes is lower, and the influence of the features of the neighbor nodes on the process of obtaining the mapped features is smaller, and the difference between the two mapped features obtained is greater.

[0050] Therefore, for blockchain nodes with high similarity of blockchain data, similar mapped features with low dispersion and tight distribution can be obtained by constructing a graph structure and mapping by a graph neural network.

[0051] For blockchain nodes with low similarity of blockchain data, mapped features with large differences, high dispersion, and sparse distribution can be obtained by constructing a graph structure and mapping by a graph neural network.

[0052] Since the blockchain data similarity between the normal blockchain nodes and the abnormal blockchain nodes is low, by constructing a graph structure and mapping through a graph neural network, the mapping features of the normal blockchain nodes and the mapping features of the abnormal blockchain nodes can be made to be quite different, so that they can be distinguished from each other.

[0053] Since the abnormal blockchain nodes usually account for a small proportion in the obtained blockchain nodes, and the normal blockchain nodes usually account for a large proportion in the obtained blockchain nodes, the mapping features of the normal blockchain nodes account for a large proportion and are densely distributed, and can be regarded as a group.

[0054] In comparison, the mapping features of the abnormal blockchain nodes are quite different from the mapping features of the normal blockchain nodes, are far away from the group of the mapping features of the normal blockchain nodes, and since the abnormal blockchain nodes account for a small proportion, the mapping features are less and sparsely distributed, so the mapping features of the abnormal blockchain nodes have the characteristics of outliers in all mapping features.

[0055] Therefore, for all the obtained mapping features, an anomaly detection algorithm for detecting outliers can be used for detection to determine the outlier mapping features, and the outlier mapping features are determined as abnormal mapping features. Then, the blockchain nodes corresponding to the graph nodes with abnormal mapping features can be determined as abnormal blockchain nodes.

[0056] After determining the abnormal blockchain nodes through the mapping features, since the determined abnormal blockchain nodes are determined according to the blockchain data similarity analysis, and it cannot be directly determined that the abnormal blockchain nodes are abnormal due to being attacked by an attacker, further detection can be performed to determine whether the abnormal blockchain nodes are abnormal due to being attacked by an attacker, so as to facilitate the determination of whether the blockchain network where the abnormal blockchain nodes are located is attacked.

[0057] The method does not limit a specific anomaly detection algorithm. As an example, the mapping features can be optionally clustered, and the mapping features corresponding to different blockchain nodes with high blockchain data similarity can be aggregated into one category.

[0058] Since the blockchain data of the normal blockchain nodes and the abnormal blockchain nodes is quite different, the similarity of the blockchain data is low, and the respective mapping features are usually difficult to be aggregated into one category. Moreover, the similarity of the blockchain data between the normal blockchain nodes is usually high, and the similarity of the blockchain data between different abnormal blockchain nodes attacked by the same attacker is usually high.

[0059] Therefore, the mapping features corresponding to normal blockchain nodes can be aggregated, and the mapping features corresponding to different abnormal blockchain nodes attacked by the same attacker can be aggregated, so that at least two categories in the clustering result can be obtained.

[0060] In some cases, for example, the blockchain network is not attacked, only one category can be included in the clustering result. In some cases, normal blockchain nodes can be aggregated into multiple categories. For example, there are multiple branches of the correct blockchain. In some cases, abnormal blockchain nodes can also be aggregated into multiple categories, for example, in the case of the blockchain network being attacked by different attackers, there are abnormal blockchain nodes attacked by different attackers.

[0061] For the clustering result, based on the feature that the abnormal blockchain nodes account for a small proportion in the obtained blockchain nodes, the abnormal category can be determined according to the number of mapping features included in the category.

[0062] Specifically, the category whose proportion of mapping features in the clustering result is less than a preset proportion or contains less mapping features than a preset threshold can be determined as an abnormal category, and the mapping features corresponding to the blockchain nodes in the determined abnormal category can be determined as abnormal blockchain nodes, facilitating further detection of abnormal blockchain nodes.

[0063] Of course, other ways of anomaly detection can also be performed on the mapping features, and the clustering method is not limited. Specific explanations can be referred to the method flow in the following.

[0064] Through the above method, the similarity of blockchain data between the blockchain nodes obtained from the blockchain network can be intuitively represented by the graph structure. From the whole graph structure, the blockchain data similarity is integrated into the mapping features of the graph nodes based on the graph neural network, so that for the blockchain nodes with low blockchain data similarity, the mapping features with large differences can be obtained, so that the mapping features corresponding to the abnormal blockchain nodes and the mapping features corresponding to the normal blockchain nodes can be greatly different, facilitating the determination of abnormal mapping features by using the anomaly detection algorithm based on the mapping features, and further comprehensive and rapid determination of abnormal blockchain nodes, which can help to identify whether the blockchain network where the abnormal blockchain nodes are located is attacked.

[0065] The following further combines the drawings to explain the anomaly blockchain node detection method provided in the present specification.

[0066] Since there is a graph structure in the method flow, the blockchain nodes are easily confused with the nodes in the graph structure. In order to facilitate the distinction, the nodes in the graph structure are referred to as graph nodes.

[0067] As Figure 1As shown, it is a flow diagram of an abnormal blockchain node detection method provided in the specification. The method can be applied to a detection device. The detection device can be a device for detecting abnormal blockchain nodes in a blockchain network.

[0068] The method can at least include the following steps.

[0069] S101: Construct a graph structure for at least two blockchain nodes in a blockchain network.

[0070] Each graph node corresponds to each blockchain node one by one, each graph node is connected to at least one edge, and the weight of any edge is positively related to the similarity between the two graph nodes connected by the edge.

[0071] Optionally, the similarity between two graph nodes is the similarity between the data of the same address on the blockchain of the corresponding two blockchain nodes.

[0072] S102: Input the original representation corresponding to the graph structure into the graph neural network for mapping processing to obtain the mapping representation corresponding to the graph structure.

[0073] Optionally, the original representation can include the original features of each graph node and the weight of each edge, and the mapping representation can include the mapping features of each graph node.

[0074] S103: Apply an anomaly detection algorithm to the mapping features of each graph node to determine abnormal mapping features, and determine the blockchain nodes corresponding to the graph nodes with abnormal mapping features as abnormal blockchain nodes.

[0075] The above method flow can intuitively represent the similarity of blockchain data between the blockchain nodes obtained from the blockchain network by using the graph structure. From the whole graph structure, the similarity of the blockchain data is integrated into the mapping features of the graph nodes based on the graph neural network, so that the mapping features of the blockchain nodes with low similarity of the blockchain data can be greatly different. Therefore, the mapping features corresponding to the abnormal blockchain nodes and the mapping features corresponding to the normal blockchain nodes can be greatly different, which facilitates the use of the anomaly detection algorithm to determine the abnormal mapping features based on the mapping features, and further can comprehensively and quickly determine the abnormal blockchain nodes, and facilitate to help identify whether the blockchain network where the abnormal blockchain nodes are located is attacked.

[0076] S101: Construct a graph structure for at least two blockchain nodes in a blockchain network.

[0077] Each graph node corresponds to each blockchain node one by one, each graph node is connected to at least one edge, and the weight of any edge is positively related to the similarity between the two graph nodes connected by the edge.

[0078] Optionally, the similarity between two graph nodes is the similarity between data of the same address on the blockchain of the corresponding two blockchain nodes.

[0079] In an optional embodiment, since the blockchain itself is constantly updated, it is impossible to predict when the blockchain network is attacked and the new block is tampered with, so the method flow can be frequently executed for abnormal blockchain node detection. Specifically, it can be periodic detection, or it can be irregular detection.

[0080] It can be understood that the method flow describes the process of one-time abnormal blockchain node detection, and the process of multiple abnormal blockchain node detection can be obtained by simple reasoning.

[0081] Optionally, S101-S103 can be performed at each time point included in the preset time plan.

[0082] The preset time plan can include periodic time points, for example, 5 am and 6 pm every day. It can also include irregular time points, for example, 3 pm on a certain day in a certain month. The method flow also does not limit the specific preset time plan, which can include one or more time points.

[0083] Performing the method flow at each time point included in the preset time plan can detect abnormal blockchain nodes. When the preset time plan includes multiple time points, which can be periodic or irregular, continuous abnormal node detection can further improve the security of the blockchain network and facilitate detection of whether the blockchain network is attacked.

[0084] Optionally, when the method flow is executed multiple times, the previous graph nodes and edges can be reused when constructing the graph structure, and only the original features of the graph nodes and the weights of the edges are modified, so that the execution efficiency of the method flow can be improved.

[0085] In an optional embodiment, before constructing the graph structure, at least two blockchain nodes need to be determined from the blockchain network, and then the graph structure is constructed for the determined at least two blockchain nodes.

[0086] For the determined at least two blockchain nodes, it should be noted that the determined at least two blockchain nodes belong to the same blockchain network and can be used to maintain the same blockchain.

[0087] The method flow does not limit the specific method of determining the blockchain node. Since the graph structure is constructed later, the original features of the graph nodes need to be determined, and the similarity of the blockchain data between the blockchain nodes needs to be determined, so the information needs to be obtained from the determined blockchain nodes.

[0088] Optionally, determining at least 2 blockchain nodes from the blockchain network can comprise: for the blockchain network in need of abnormal blockchain node detection, determining at least 2 blockchain nodes from which information can be obtained.

[0089] Optionally, determining at least 2 blockchain nodes from the blockchain network can comprise: for the blockchain network in need of abnormal blockchain node detection, sending a request for obtaining information to the blockchain nodes therein, and determining at least 2 blockchain nodes that return information in response to the request.

[0090] Optionally, the more the number of determined blockchain nodes, the higher the accuracy of abnormal blockchain node detection of the method flow.

[0091] Optionally, the information required to be obtained from the blockchain nodes can at least include: blockchain-related data on the blockchain nodes, operation records of the blockchain nodes for the blockchain, and blockchain data transmission relationships between the blockchain nodes, etc. The specific role will be explained later.

[0092] Obviously, for the blockchain nodes that cannot obtain information or refuse to respond to the information acquisition request, the method flow cannot construct a graph structure for these blockchain nodes, and it is difficult to detect abnormal blockchain nodes for all blockchain nodes in the blockchain network.

[0093] For the construction of the graph structure, the method flow does not limit the construction method of the graph structure, as long as each graph node corresponds to each blockchain node, each graph node is connected to at least one edge, and the weight of any edge is positively related to the similarity between the two graph nodes connected by the edge.

[0094] The similarity between two graph nodes can be the similarity between the data of the same address on the corresponding two blockchain nodes.

[0095] The following provides an optional embodiment as an exemplary illustration.

[0096] In an optional embodiment, constructing a graph structure for at least 2 blockchain nodes in the blockchain network can comprise three steps of constructing graph nodes, constructing edges between graph nodes, and determining the weight of the edges.

[0097] This embodiment does not limit the execution order of the three steps, which can be executed in parallel. For example, the graph nodes can be constructed first, then all the edges between the graph nodes are constructed, and finally the weights of all the edges are determined. Alternatively, the graph nodes can be constructed at the same time, the edges can be constructed for the constructed graph structure, and the weights can be determined for the constructed edges at the same time.

[0098] 1) For constructing graph nodes.

[0099] Optionally, for each of the at least two blockchain nodes in the blockchain network, a unique corresponding graph node can be constructed.

[0100] Optionally, after the graph node is constructed, the original feature of the graph node can also be determined. The original feature of each graph node can be determined after the construction of the graph node is completed, or the original feature of each graph node can be determined in real time when the graph node is constructed.

[0101] Optionally, before S102, the original feature of any graph node in the graph structure can be determined.

[0102] The embodiment does not limit the specific determination method of the original feature.

[0103] Optionally, the original feature of the graph node in the graph structure can be determined according to the blockchain-related information on the blockchain node corresponding to the graph node.

[0104] Optionally, the blockchain-related information on the blockchain node can include: operation records of the blockchain node for the blockchain, and / or data on the blockchain of the blockchain node.

[0105] Since a normal blockchain node usually needs to add the same block, the operation records of the blockchain node for the blockchain are often similar to each other, and the data on the blockchain are also similar to each other. The original feature of the graph node can be determined through the blockchain-related information, so that the original features of the normal blockchain nodes are similar, facilitating subsequent mapping processing through the graph neural network, and obtaining similar mapping features through the similar original features of the normal blockchain nodes.

[0106] The operation records specifically can include operation logs of the blockchain node.

[0107] Of course, since the blocks in the blockchain are cryptographically associated, only the newly added blockchain-related information can be considered, thereby saving computing resources and facilitating fast determination of the original feature.

[0108] Optionally, the blockchain-related information on the blockchain node can include: operation records newly added by the blockchain node for the blockchain within a second preset time length before the current time; and / or data newly added on the blockchain of the blockchain node within the second preset time length before the current time.

[0109] The embodiment does not limit the determination method of the second preset time length. The second preset time length can be specified in advance, or in the case of periodically performing the method process, the second preset time length can be set as the time length of one period, so that the original feature can be determined for the blockchain-related information newly added after the last abnormal blockchain node detection.

[0110] When determining the original features of the graph nodes based on the blockchain-related information, the method does not limit the specific method for determining the original features.

[0111] Since the original features of the graph nodes are usually in the form of vectors, optionally, a pre-trained language model can be used to convert the blockchain-related information into a feature vector. Of course, other ways can also be used to convert the blockchain node information into a feature vector.

[0112] 2) Build edges between graph nodes.

[0113] Since the constructed graph structure is used to determine the blockchain data similarity between the blockchain nodes in the whole reaction area, for any two blockchain nodes, the blockchain data similarity can be compared. Therefore, the embodiment does not limit the method for constructing edges between graph nodes, as long as each graph node is connected to at least one edge.

[0114] Optionally, edges can be constructed for each two graph nodes to construct a fully connected graph, so that the blockchain data similarity between all the obtained blockchain nodes can be comprehensively analyzed, and the accuracy of the abnormal blockchain node detection can be improved.

[0115] Optionally, in order to save computing resources and improve efficiency, a number of groups of two graph nodes can be specified to construct edges, and a fully connected graph is not constructed. Specifically, a number of groups of two graph nodes can be randomly specified to construct edges, as long as each graph node is connected to at least one edge.

[0116] In an optional embodiment, since the attack on the blockchain network usually needs to be implemented through the transmission of blockchain data, edges can be constructed for the corresponding two graph nodes according to the actual blockchain data transmission relationship between the blockchain nodes.

[0117] Optionally, other blockchain nodes that exist in the data transmission connection can be obtained from the blockchain nodes, and edges can be constructed for the corresponding two graph nodes based on the obtained data transmission connection relationship.

[0118] By constructing edges for the data transmission connection relationship, the blockchain data similarity can be determined for the blockchain nodes that exist in the data transmission connection relationship.

[0119] Optionally, among the determined blockchain nodes, there can be a case that the data transmission connection relationship cannot be obtained for a blockchain node, or a case that the data transmission connection relationship does not exist between the blockchain node and other determined blockchain nodes, so that the edge cannot be connected for the graph node corresponding to the blockchain node. Therefore, the edge can be directly constructed with at least one other graph node.

[0120] 3) Determine the weight of the edge.

[0121] Since the difference between the normal blockchain node and the abnormal blockchain node mainly reflects in the difference of the blockchain data, optionally, the difference of the blockchain data can be reflected in the weight of the edge.

[0122] Specifically, the weight of the edge between the two graph nodes corresponding to the two blockchain nodes can be determined by using the similarity of the blockchain data between the two blockchain nodes. The similarity of the blockchain data can be positively correlated with the weight of the edge.

[0123] Optionally, the weight of any edge is positively correlated with the similarity between the two graph nodes connected by the edge, and the similarity between the two graph nodes is the similarity between the data of the same address on the corresponding two blockchain nodes.

[0124] Therefore, optionally, determining the weight of the edge can include determining the similarity between the two graph nodes connected by the edge, and then determining the weight according to the determined similarity.

[0125] It should be noted that the blockchain data can include blocks, or specific transaction data in the blocks, and the data of the same address on the blockchain can be blocks of the same height, or transaction data of the same offset in the same block.

[0126] In an optional embodiment, since the blockchain is usually associated in a cryptographic manner for different blocks, determining the similarity of the blockchain data by the blocks can improve efficiency.

[0127] Optionally, the data of the same address on the blockchain of the corresponding two blockchain nodes can include blocks of the same height on the blockchain of the corresponding two blockchain nodes.

[0128] Optionally, the similarity can be determined for all blocks of the same height on the blockchain of the corresponding two blockchain nodes, or for part of the blocks of the same height on the blockchain of the corresponding two blockchain nodes.

[0129] Optionally, since there is a cryptographic association between the blocks in the blockchain, if the similarity of part of the blocks is low, the similarity of the blocks in the entire blockchain is also low, and the newly added blocks of the blockchain are also different, therefore, the similarity can be determined for part of the blocks in the blockchain, thereby saving computing resources.

[0130] For example, when attacking the blockchain, the attacker usually tampers with newly added blocks and forges different blocks to add to the blockchain, so only the newly added part of the blocks can be focused on, thereby saving computing resources.

[0131] Correspondingly, the data of the same address on the blockchains of the respective two blockchain nodes can include: blocks of the same height on the blockchains of the respective two blockchain nodes; or blocks of the same height in blocks respectively newly added within a first preset time period before the current time on the blockchains of the respective two blockchain nodes; or blocks of the same height in blocks of a preset height range on the blockchains of the respective two blockchain nodes.

[0132] The embodiment does not limit the determination method of the first preset time period. The first preset time period can be specified in advance, or in the case of periodically performing the method, the first preset time period can be set as the time length of one period, so that the similarity can be determined for the blocks newly added after the last abnormal blockchain node detection.

[0133] It should be noted that the method can be executed multiple times, and the similarity of the blockchain data needs to be calculated each time. In order to avoid calculating the similarity of the same block each time, the first preset time period can be determined according to the preset time plan. Alternatively, the first preset time period can be the time period between the current time point and the last time point in the preset time plan.

[0134] The preset height range can be used to determine the similarity of the blockchain data for the blocks of the same height in the blocks of the preset height range on the blockchains of the respective two blockchain nodes, which can also save computing resources. The preset height range can include a range from the maximum height in the blockchain minus the first preset height to the maximum height.

[0135] Since the newly added blocks in the blockchain are usually added at the end of the blockchain, the preset height range can be used to conveniently determine the newly added blocks. Of course, the preset height range can also be dynamically updated with the first preset height as the method is executed multiple times, so as to avoid repeatedly calculating the similarity of the same block.

[0136] When determining the similarity of the blockchain data, all blocks or part of the blocks can be compared. Therefore, the data of the same address on the blockchains of the respective two blockchain nodes can include: N blocks of the same height to be compared on the blockchains of the respective two blockchain nodes; N≥1.

[0137] The blocks to be compared are blocks that need to be compared to determine the similarity.

[0138] The determination method of the similarity between the two graph nodes can be to determine the number M of blocks to be compared of the same height and the same data on the blockchains of the respective two blockchain nodes, 0≤M≤N; and to determine the similarity between the two graph nodes according to the ratio between M and N.

[0139] The same height block on the blockchain of the corresponding two blockchain nodes can be directly obtained for comparison.

[0140] Optionally, in order to save computing resources, communication resources and storage resources, and avoid transmitting complete blocks, the identifier of the block can be directly obtained for comparison.

[0141] The identifier of the block can be the hash value of the entire block. On the one hand, the hash value of the block is naturally saved in the blockchain, which is used to generate the next block and ensure that the blocks are cryptographically associated. On the other hand, even if there is a slight difference between the two blocks, the difference in the calculated hash values of the different blocks is large. By using this feature, it can be directly and accurately determined whether the blocks are the same. If the hash values are the same, the corresponding blocks are also the same.

[0142] Of course, the identifier of the block can also be information in the block header, and specifically can be the hash value of the block body stored in the block header.

[0143] Therefore, the method for determining the similarity between the two graph nodes can include: obtaining the hash value of each to-be-compared block on the blockchain of the corresponding two blockchain nodes; determining the number M of to-be-compared blocks on the blockchain of the corresponding two blockchain nodes that are of the same height and have the same hash value; 0≤M≤N; and determining the similarity between the two graph nodes according to the ratio between M and N.

[0144] Optionally, the similarity between the two graph nodes is determined according to the ratio between M and N, which does not specifically limit the method for determining the similarity, and specifically can directly determine the ratio between M and N as the similarity between the two graph nodes, or normalize or standardize the ratio between M and N to obtain the similarity between the two graph nodes.

[0145] After determining the similarity between the two graph nodes connected by the edge, the weight of the edge also needs to be determined according to the determined similarity.

[0146] The method flow does not limit the specific method for determining the weight, as long as the weight of the edge is positively correlated with the similarity between the two graph nodes connected by the edge.

[0147] As an example, the determined similarity can be directly determined as the weight of the edge, or after determining the similarity of all edges in the graph structure, the similarity corresponding to each edge can be normalized or standardized to obtain the weight of the edge.

[0148] S102: inputting the original representation corresponding to the graph structure into the graph neural network for mapping processing to obtain a mapped representation corresponding to the graph structure.

[0149] Optionally, the original representation can include original features of each graph node and weights of each edge, and the mapping representation can include mapping features of each graph node.

[0150] The original features of the graph nodes and the weights of each edge obtained by constructing the graph structure in S101 can be input into the graph neural network as the original representation corresponding to the graph structure.

[0151] The graph neural network can be GraphSage, GCN, GAT, CompGCN, or GeniePath, but is not limited thereto.

[0152] For the graph structure, the original features of the graph nodes and the weights of the edges in the graph structure can be fused by the graph neural network to obtain the mapping features of the graph nodes, so that the mapping features can reflect the similarity of the blockchain data.

[0153] Specifically, the original features of the graph nodes and the weights of each edge in the graph structure can be input into the graph neural network, and the graph neural network can obtain the mapping features of each graph node by synthesizing the features of the neighbor nodes of the graph node and the weights of the corresponding edges.

[0154] To facilitate understanding, a specific embodiment of the graph neural network is given below.

[0155] Optionally, the original features of the graph nodes and the weights of the edges in the graph structure can also be used to perform the following steps in a loop: for each graph node in the graph structure, the current features of the graph node and the weighted sum of the current features of other graph nodes connected to the graph node are obtained, and the weighted sum is calculated as the new current features of the graph node, and the weights are the weights of the edges connecting the graph node and the other graph nodes.

[0156] Optionally, the weighted average can also be calculated as the new current features of the graph node.

[0157] The above loop can be performed once or multiple times until a preset loop stopping requirement is met. The loop stopping requirement can include that the number of loops reaches a preset number of loops, or the difference between the mapping features obtained in the current loop and the mapping features obtained in the last loop is less than a preset difference.

[0158] For two graph nodes that are neighbor nodes of each other, the greater the weight of the edge connecting the two graph nodes, the higher the similarity of the blockchain data of the corresponding two blockchain nodes, and the greater the influence of the features of the neighbor nodes on the mapping features, and the more similar the two mapping features obtained.

[0159] If the weight of the edge connecting the two graph nodes is smaller, it indicates that the similarity of the blockchain data of the corresponding two blockchain nodes is lower, and the feature of the neighbor node will have less influence on the process of obtaining the mapping feature, and the difference between the two obtained mapping features will be greater.

[0160] Therefore, for the blockchain nodes with high similarity of blockchain data, similar mapping features with low discrete degree and tight distribution can be obtained by constructing the graph structure and mapping through the graph neural network.

[0161] For the blockchain nodes with low similarity of blockchain data, mapping features with high discrete degree and sparse distribution can be obtained by constructing the graph structure and mapping through the graph neural network.

[0162] Since the similarity of the blockchain data between the normal blockchain nodes and the abnormal blockchain nodes is low, by constructing the graph structure and mapping through the graph neural network, the mapping features of the normal blockchain nodes and the mapping features of the abnormal blockchain nodes can be made to have greater difference, so that they can be distinguished from each other.

[0163] Because the abnormal blockchain nodes usually account for a small proportion in the obtained blockchain nodes, and the normal blockchain nodes usually account for a large proportion in the obtained blockchain nodes, the mapping features of the normal blockchain nodes account for a large proportion and have tight distribution, and can be regarded as a group.

[0164] In comparison, the mapping features of the abnormal blockchain nodes have greater difference with the mapping features of the normal blockchain nodes, and are far away from the group of the mapping features of the normal blockchain nodes. In addition, since the abnormal blockchain nodes account for a small proportion, the mapping features are less and have sparse distribution, and therefore, the mapping features of the abnormal blockchain nodes have the characteristics of outliers in all mapping features.

[0165] Therefore, for all the obtained mapping features, the abnormal detection algorithm for detecting outliers can be used for detection to determine the outlier mapping features, which are determined as abnormal mapping features. Then, the blockchain nodes corresponding to the graph nodes with abnormal mapping features can be determined as abnormal blockchain nodes.

[0166] For ease of understanding, a specific embodiment is provided in the specification.

[0167] As shown in Figure 2 , a schematic diagram of a to-be-detected graph structure provided by the embodiment of the specification is shown. In the to-be-detected graph structure, five graph nodes can be included, which are a first graph node (1, 1), a second graph node (1, 2), a third graph node (2, 1), a fourth graph node (3, 1), and a fifth graph node (4, 1).

[0168] The first graph node is connected with the second graph node, and the weight on the edge is 0.5; the first graph node is connected with the fourth graph node, and the weight on the edge is 0.5.

[0169] The second graph node is connected with the third graph node in addition to the first graph node, and the weight on the edge is 0.2; the second graph node is connected with the fifth graph node, and the weight on the edge is 0.3.

[0170] When the feature vector corresponding to the graph node is determined based on the to-be-detected graph structure, the weighted sum of each graph node can be calculated. Specifically, for the first graph node, (1, 1) + (1, 2) * 0.5 + (3, 1) * 0.5 = (3, 2.5) is calculated, and a new feature (3, 2.5) is obtained.

[0171] For the second graph node, (1, 2) + (1, 1) * 0.5 + (2, 1) * 0.2 + (4, 1) * 0.3 = (3.1, 3) is calculated, and a new feature (3.1, 3) is obtained.

[0172] It should be clear that since the above-mentioned feature determination method uses the weight of the edge to calculate the weighted result (weighted sum or weighted average), obviously, the greater the weight of the edge, the greater the influence on the feature of the graph node, and the closer the features corresponding to the two graph nodes connected by the edge.

[0173] For example, there are two interconnected graph nodes (1, 1) and (10, 10) in the graph structure, and the weight on the edge is 1. The graph node (1, 1) is additionally connected with a graph node (1, 2), but the weight on the edge is 0.1.

[0174] In the case of calculating the weighted sum as the new feature, the new feature corresponding to the graph node (1, 1) can be (11.1, 11.2), the new feature corresponding to the graph node (10, 10) can be (11, 11), and the new feature corresponding to the graph node (1, 2) can be (1.1, 2.1).

[0175] Obviously, even if the graph node (1, 1) and the graph node (1, 2) are close in the original graph structure, under the influence of the weight of the edge, the new features corresponding to the graph node (1, 1) and the graph node (10, 10) are close.

[0176] S103: Apply an anomaly detection algorithm to the mapping features of each graph node to determine an abnormal mapping feature, and determine the blockchain node corresponding to the graph node with the abnormal mapping feature as an abnormal blockchain node.

[0177] Since the similarity of the blockchain data is contained in the mapping feature, the mapping feature of the normal blockchain node and the mapping feature of the abnormal blockchain node are quite different, and thus can be distinguished from each other.

[0178] Therefore, the obtained all mapping features can be detected by an anomaly detection algorithm for detecting outliers, and the outlier mapping feature is determined as an abnormal mapping feature. Then, the blockchain node corresponding to the graph node with the abnormal mapping feature can be determined as an abnormal blockchain node.

[0179] The embodiment is not limited to a specific anomaly detection algorithm. As an exemplary illustration, a clustering algorithm or a time series anomaly detection algorithm can be used.

[0180] For ease of understanding, the following three embodiments are provided in the specification.

[0181] Embodiment one.

[0182] When the blockchain in the normal blockchain node is attacked, an error block is usually added, and the blocks after the error block are different from the correct blockchain, so that the similarity of the blockchain data decreases a lot. If the similarity of the blockchain data suddenly decreases a lot, the weight of the edge connected to the graph node corresponding to the blockchain node will change greatly when the mapping feature of the blockchain node is obtained based on the graph structure multiple times, so that the obtained mapping feature changes greatly.

[0183] Therefore, the time series anomaly detection algorithm can be used to detect the current mapping feature of a single graph node. Specifically, the mapping feature change of the graph node in history can be used to determine whether the current mapping feature has a large change, and then determine whether it is an abnormal blockchain node.

[0184] Optionally, applying the anomaly detection algorithm to the mapping features of the graph nodes to determine the abnormal mapping feature can include: for each graph node in the graph structure, predicting based on the mapping feature history time sequence of the graph node to obtain the predicted mapping feature corresponding to the graph node; and in the case that the difference between the current mapping feature of the graph node and the predicted mapping feature is greater than a preset threshold, determining the actual mapping feature corresponding to the graph node as an abnormal mapping feature.

[0185] The mapping feature history time sequence includes one or more historical mapping features of the graph node arranged in time sequence.

[0186] After determining the abnormal mapping feature, the blockchain node corresponding to the graph node with the abnormal mapping feature can be determined as an abnormal blockchain node.

[0187] Embodiment two.

[0188] Generally, in the initial stage of the attack on the blockchain, the proportion of the abnormal blockchain node in the entire blockchain network is small, and therefore, when all or part of the blockchain nodes in the blockchain network are obtained, the proportion of the abnormal blockchain node in the obtained blockchain nodes is usually small.

[0189] Optionally, the mapping features of each graph node in the graph structure can be clustered, and the clustering results can be further screened to determine the category farthest from most of the mapping features, and then determine the abnormal mapping features.

[0190] Specifically, the mapping features of each graph node in the graph structure can be clustered, and the mapping features contained in the category satisfying the preset abnormal clustering condition in the clustering result can be determined as the abnormal mapping features.

[0191] Optionally, the abnormal mapping features can be determined by applying an anomaly detection algorithm to the mapping features of each graph node, which can include: clustering the mapping features of each graph node; determining the category satisfying the preset abnormal clustering condition in the clustering result, and determining the mapping features contained in the determined category as the abnormal mapping features.

[0192] In this embodiment, the specific preset abnormal clustering condition is not limited, as long as it can represent the outlier feature. As an exemplary illustration, the preset abnormal clustering condition can include: the number of mapping features contained in the category is less than the preset number, or the proportion of the number of mapping features contained in the category in the number of all graph node mapping features is less than the preset proportion, or the distance between the center mapping feature in the category and the center mapping feature in other categories is greater than the preset distance.

[0193] After determining the abnormal mapping features, the graph node corresponding to the abnormal mapping features can be determined as the abnormal blockchain node.

[0194] Embodiment three.

[0195] In addition to determining the mapping features farthest from most of the mapping features through clustering, the mapping features can also be determined through division.

[0196] Since the abnormal mapping features are usually distributed sparsely and far from the high-density mapping feature group, by recursively randomly dividing the mapping feature set until a certain division times or until all feature vectors are individually divided into subsets, the abnormal mapping features are usually individually divided into subsets after a few times of division due to their sparse distribution and far distance from the high-density mapping feature group, which meets the outlier feature.

[0197] Therefore, the abnormal mapping features can be determined by the division times.

[0198] Optionally, an anomaly detection algorithm is applied in the mapping features of the respective graph nodes to determine abnormal mapping features, including: obtaining a mapping feature set, the mapping feature set including the mapping features of the respective graph nodes in the graph structure; performing a division step on the mapping feature set; the mapping feature set corresponding to a division number of 0.

[0199] The division step can include: randomly determining a current feature threshold for the current mapping feature set; dividing the current mapping feature set into two subsets based on the current feature threshold, and determining the current mapping feature set corresponding to a division number of +1 as the division numbers corresponding to the two divided subsets; for each subset obtained by division, if the division number corresponding to the subset is greater than or equal to a preset division number, stop further division; if the number of elements in the subset is greater than 1 and the division number corresponding to the subset is less than the preset division number, execute the same division step on the subset as the current mapping feature set; if the number of elements in the subset is 1 and the division number corresponding to the subset is less than the preset division number, determine the mapping feature included in the subset as an abnormal mapping feature.

[0200] If the mapping feature included in the subset is sparse in distribution and far away from the high-density group, it meets the outlier characteristics, and can be determined as an abnormal mapping feature.

[0201] After determining the abnormal mapping features, the blockchain nodes corresponding to the graph nodes with the abnormal mapping features can be determined as abnormal blockchain nodes.

[0202] In addition, when dividing the subsets, the feature vectors greater than the current vector threshold can be determined as one subset, and the feature vectors less than or equal to the current vector threshold can be determined as another subset. However, there can be a case where the divided subset is empty, in which case no operation can be performed on the empty subset. That is, in the case where the number of elements in the subset is equal to 0, the operation is stopped.

[0203] After it is clear how to perform anomaly detection, the anomaly detection algorithm can be used to determine the abnormal mapping features, and the blockchain nodes corresponding to the graph nodes with the abnormal mapping features can be determined as abnormal blockchain nodes.

[0204] Therefore, the embodiment can perform anomaly detection on the graph structure through the graph neural network, determine the graph nodes with abnormalities from the whole, and to some extent avoid incorrect judgment of being attacked due to business fluctuations or errors in the consensus mechanism of the blockchain.

[0205] After the abnormal blockchain node is determined through the mapping feature, since the determined abnormal blockchain node is determined according to the blockchain data similarity analysis, it cannot be directly determined that the abnormal blockchain node is abnormal due to being attacked by an attack party, and therefore, further detection or processing can be performed to determine whether the abnormal blockchain node is abnormal due to being attacked by an attack party, thereby facilitating determination of whether the blockchain network in which the abnormal blockchain node is located is attacked.

[0206] Specifically, whether abnormal connection or abnormal operation exists can be determined by manually checking the operation log and connection condition of the abnormal blockchain node, and whether the abnormal blockchain node is attacked and the attack condition can be determined.

[0207] The method flow can intuitively represent the similarity of the blockchain data between the blockchain nodes obtained from the blockchain network by using a graph structure, and the similarity of the blockchain data is integrated into the mapping feature of the graph node based on the graph neural network from the overall consideration of the graph structure, so that the mapping feature corresponding to the abnormal blockchain node and the mapping feature corresponding to the normal blockchain node are greatly different. The abnormal mapping feature can be determined by using the anomaly detection algorithm with respect to the mapping feature, and then the abnormal blockchain node can be comprehensively and quickly determined, thereby facilitating identification of whether the blockchain network is attacked.

[0208] In addition to the method flow described above, the present specification also provides a corresponding device embodiment.

[0209] As shown in Figure 3 FIG. 1 is a structural schematic diagram of an abnormal blockchain node detection device provided by an embodiment of the present specification. The device comprises the following units.

[0210] The construction unit 301 is configured to construct a graph structure for at least two blockchain nodes in a blockchain network.

[0211] Each graph node corresponds to each blockchain node in a one-to-one manner, each graph node is connected to at least one edge, and the weight of any edge is positively correlated with the similarity between the two graph nodes connected by the edge. The similarity between the two graph nodes is the similarity between the data of the same address on the corresponding two blockchain nodes.

[0212] The mapping unit 302 is configured to input the original representation of the graph structure into the graph neural network for mapping processing to obtain the mapping representation of the graph structure. The original representation includes the original feature of each graph node and the weight of each edge, and the mapping representation includes the mapping feature of each graph node.

[0213] The abnormality determination unit 303 is configured to apply an anomaly detection algorithm to the mapping feature of each graph node to determine an abnormal mapping feature, and determine the blockchain node corresponding to the graph node with the abnormal mapping feature as an abnormal blockchain node.

[0214] Optionally, the data at the same address on the blockchains of the two corresponding blockchain nodes include: blocks of the same height on the blockchains of the two corresponding blockchain nodes; or blocks of the same height among the blocks newly added on the blockchains of the two corresponding blockchain nodes within a first preset time period before the current time; or blocks of the same height among the blocks within a preset height range on the blockchains of the two corresponding blockchain nodes.

[0215] Optionally, the data at the same address on the blockchains of the two corresponding blockchain nodes includes: N blocks of the same height on the blockchains of the two corresponding blockchain nodes to be compared; N≥1.

[0216] Optionally, the method for determining the similarity between two graph nodes includes: obtaining the hash value of each block to be compared on the blockchain of the two corresponding blockchain nodes; determining the number M of blocks to be compared with the same height and the same hash value on the blockchain of the two corresponding blockchain nodes; 0≤M≤N; and determining the similarity between the two graph nodes based on the ratio between M and N.

[0217] Optionally, the construction unit 301 may execute a method for determining the similarity between two graph nodes. The construction unit 301 is configured to: obtain the hash value of each block to be compared on the blockchain of the two corresponding blockchain nodes; determine the number M of blocks to be compared with the same height and the same hash value on the blockchain of the two corresponding blockchain nodes; 0≤M≤N; and determine the similarity between the two graph nodes based on the ratio between M and N.

[0218] Optionally, the construction unit 301 is further configured to: for any graph node in the graph structure, determine the original characteristics of the graph node in the graph structure based on the blockchain-related information on the blockchain node corresponding to the graph node.

[0219] Optionally, the blockchain-related information on the blockchain node includes: the blockchain node's operation records on the blockchain; or the blockchain node's newly added operation records on the blockchain within a second preset time period before the current time; or the data on the blockchain of the blockchain node; or the data newly added on the blockchain of the blockchain node within a second preset time period before the current time.

[0220] Optionally, the anomaly determination unit 303 may include a temporal anomaly detection subunit 303a, used for: predicting the predicted mapping features corresponding to each graph node in the graph structure based on the historical temporal sequence of the mapping features of the graph node; and determining the actual mapping features corresponding to the graph node as an abnormal mapping feature if the difference between the current mapping features and the predicted mapping features of the graph node is greater than a preset threshold; the historical temporal sequence of mapping features includes one or more historical mapping features of the graph node arranged in chronological order.

[0221] Optionally, the anomaly determining unit 303 can include a clustering anomaly detection subunit 303b configured to: cluster the mapping features of each graph node; determine a category in the clustering result that satisfies a preset anomaly clustering condition, and determine the mapping features contained in the determined category as the anomaly mapping features.

[0222] Optionally, the anomaly determining unit 303 can include a division anomaly detection subunit 303c configured to: obtain a mapping feature set, the mapping feature set including the mapping features of each graph node in the graph structure; perform a division step on the mapping feature set; and the mapping feature set corresponds to a division number of 0.

[0223] The division step includes: randomly determining a current feature threshold for the current mapping feature set; dividing the current mapping feature set into two subsets based on the current feature threshold, and determining the division number corresponding to the current mapping feature set as the division numbers corresponding to the two divided subsets respectively; for each subset obtained by division, if the division number corresponding to the subset is greater than or equal to a preset division number, stop further division; if the number of elements in the subset is greater than 1 and the division number corresponding to the subset is less than the preset division number, execute the division step on the subset as the current mapping feature set; if the number of elements in the subset is 1 and the division number corresponding to the subset is less than the preset division number, determine the mapping feature contained in the subset as the anomaly mapping feature.

[0224] Other explanations of the above device embodiments can be referred to the above method flow, which will not be repeated here.

[0225] The embodiments of the present specification also provide a computer device, which at least includes a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements an anomaly blockchain node detection method when executing the program.

[0226] The embodiments of the present specification also provide a machine readable storage medium, which stores a program, and the program is executed by a processor to implement an anomaly blockchain node detection method.

[0227] Figure 4 A more specific computer device hardware structure schematic diagram provided by the embodiments of the present specification is shown, which can include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.

[0228] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing relevant programs to implement the technical solutions provided by the embodiments of the present specification.

[0229] The memory 1020 can be implemented by a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and called and executed by the processor 1010.

[0230] The input / output interface 1030 is configured to connect input / output modules to implement information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input devices can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices can include a display, a speaker, a vibrator, an indicator light, etc.

[0231] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to implement the communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as USB, network cable, etc.) or through a wireless manner (such as mobile network, WIFI, Bluetooth, etc.).

[0232] The bus 1050 includes a channel for transmitting information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0233] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only include the components necessary to implement the solutions of the embodiments of the present specification, and does not have to include all the components shown in the figure.

[0234] The embodiment of the present specification also provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize an abnormal blockchain node detection method.

[0235] Computer readable media includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible by a computing device. According to the definition herein, computer readable media does not include transitory computer readable media, such as modulated data signals and carriers.

[0236] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments of the present specification can be implemented by means of software plus necessary universal hardware platforms. Based on such understanding, the technical solutions of the embodiments of the present specification can be embodied in the form of a software product, which can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments of the present specification.

[0237] The system, device, module or unit illustrated in the above embodiments can be specifically implemented by a computer chip or entity, or by a product with certain functions. A typical implementation device is a computer, and the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0238] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate. When implementing the embodiments of this specification, the functions of each module can be implemented in one or more software and / or hardware. Alternatively, some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0239] The above description is merely a specific implementation of the embodiments of this specification. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principles of the embodiments of this specification, and these improvements and modifications should also be considered as protection of the embodiments of this specification.

Claims

1. A method for detecting abnormal blockchain nodes, comprising: A graph structure is constructed for at least two blockchain nodes in a blockchain network, wherein each graph node corresponds one-to-one with each blockchain node, each graph node is connected to at least one edge, and the weight of any edge is positively correlated with the similarity between the two graph nodes connected by the edge. The similarity between the two graph nodes is the similarity between the data with the same address on the blockchain of the corresponding two blockchain nodes. The original representation corresponding to the graph structure is input into a graph neural network for mapping processing to obtain the mapped representation corresponding to the graph structure. The original representation includes the original features of each graph node and the weight of each edge, and the mapped representation includes the mapped features of each graph node. Specifically, for any graph node in the graph structure, the original features of the graph node in the graph structure are determined based on the blockchain-related information on the blockchain node corresponding to that graph node. The blockchain-related information on the blockchain node includes at least one of the following: the blockchain node's operation records on the blockchain, the blockchain node's newly added operation records on the blockchain within a second preset time period before the current time, the data on the blockchain of the blockchain node, and the data newly added on the blockchain of the blockchain node within a second preset time period before the current time. An anomaly detection algorithm is applied to the mapping characteristics of each graph node to identify abnormal mapping characteristics. Furthermore, the blockchain nodes corresponding to graph nodes with abnormal mapping characteristics are identified as abnormal blockchain nodes.

2. The method according to claim 1, wherein the data at the same address on the blockchain of the corresponding two blockchain nodes includes: Blocks at the same height on the blockchains of the two corresponding blockchain nodes; or Among the blocks of the same height added within the first preset time period before the current moment on the blockchains of the corresponding two blockchain nodes; or Blocks of the same height within a preset height range on the blockchains of the two corresponding blockchain nodes.

3. The method according to claim 1, wherein the data at the same address on the blockchain of the corresponding two blockchain nodes includes: The corresponding N blocks of the same height on the blockchains of the two blockchain nodes to be compared; N≥1； The method for determining the similarity between the two graph nodes includes: Obtain the hash value of each block to be compared on the blockchain of the two corresponding blockchain nodes; Determine the number M of blocks of the same height and with the same hash value on the blockchains of the two corresponding blockchain nodes to be compared; 0≤M≤N; The similarity between two graph nodes is determined based on the ratio between M and N.

4. The method according to claim 1, wherein applying an anomaly detection algorithm to the mapping features of each graph node to determine anomaly mapping features includes: For each graph node in the graph structure, prediction is performed based on the historical time series of the mapping features of that graph node to obtain the predicted mapping features corresponding to that graph node. If the difference between the current mapping feature of the graph node and the predicted mapping feature is greater than a preset threshold, the actual mapping feature corresponding to the graph node is determined as an abnormal mapping feature; the historical time series of the mapping feature includes one or more historical mapping features of the graph node arranged in time series.

5. The method according to claim 1, wherein applying an anomaly detection algorithm to determine anomaly mapping features in the mapping features of each graph node includes: Clustering is performed based on the mapping characteristics of each graph node; Identify the categories in the clustering results that meet the preset abnormal clustering conditions, and determine the mapping features contained in the identified categories as abnormal mapping features.

6. The method according to claim 1, wherein applying an anomaly detection algorithm to determine anomaly mapping features in the mapping features of each graph node includes: Obtain a mapping feature set, which includes the mapping features of each graph node in the graph structure; A partitioning step is performed on the mapping feature set; the number of partitions corresponding to the mapping feature set is 0. The partitioning steps include: For the current set of mapped features, randomly determine the current feature threshold; Based on the current feature threshold, the current mapping feature set is divided into two subsets, and the number of partitions corresponding to the current mapping feature set + 1 is determined as the number of partitions corresponding to the two subsets respectively. For each subset obtained by partitioning, if the number of partitions corresponding to the subset is greater than or equal to the preset number of partitions, the partitioning is stopped; if the number of elements in the subset is greater than 1 and the number of partitions corresponding to it is less than the preset number of partitions, the subset is used as the current mapping feature set and the partitioning step is performed; if the number of elements in the subset is 1 and the number of partitions corresponding to it is less than the preset number of partitions, the mapping features contained in the subset are determined as abnormal mapping features.

7. An abnormal blockchain node detection device, comprising: A construction unit is used to construct a graph structure for at least two blockchain nodes in a blockchain network, wherein each graph node corresponds one-to-one with each blockchain node, each graph node is connected to at least one edge, and the weight of any edge is positively correlated with the similarity between the two graph nodes connected by the edge. The similarity between the two graph nodes is the similarity between the data with the same address on the blockchain of the corresponding two blockchain nodes. A mapping unit is used to input the original representation corresponding to the graph structure into a graph neural network for mapping processing to obtain the mapped representation corresponding to the graph structure. The original representation includes the original features of each graph node and the weight of each edge, and the mapped representation includes the mapped features of each graph node. Specifically, for any graph node in the graph structure, the original features of the graph node in the graph structure are determined based on the blockchain-related information on the blockchain node corresponding to that graph node. The blockchain-related information on the blockchain node includes at least one of the following: the blockchain node's operation records on the blockchain, the blockchain node's newly added operation records on the blockchain within a second preset time period before the current time, the data on the blockchain of the blockchain node, and the data newly added on the blockchain of the blockchain node within a second preset time period before the current time. The anomaly determination unit is used to apply anomaly detection algorithms to the mapping features of each graph node, determine the abnormal mapping features, and identify the blockchain node corresponding to the graph node with the abnormal mapping features as the abnormal blockchain node.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.

9. A machine-readable storage medium having a program stored thereon that, when executed by a processor, implements the method as described in any one of claims 1 to 6.

Images