Smart contract anomaly detection method, blockchain network, device and storage medium

Abstract

The present invention discloses a smart contract anomaly detection method, a blockchain network, a device and a storage medium, and belongs to the field of blockchain. The method includes: obtaining a smart contract call request sent by a client application software to a peer node, wherein the smart contract call request carries data to be processed; based on each preset anomaly detection model, performing corresponding anomaly detection processing on the data to be processed to obtain an anomaly set corresponding to each preset anomaly detection model; based on the determined anomaly detection strategy, performing comprehensive processing on each anomaly set of each preset anomaly detection model to obtain an anomaly detection result; feeding back the anomaly detection result to the peer node, so that the peer node determines the result of the simulated execution of the smart contract according to the anomaly detection result.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain, and specifically relates to a smart contract anomaly detection method, a blockchain network, an electronic device and a computer-readable storage medium. Background Art

[0002] Blockchain is a distributed ledger technology maintained by multiple parties. It is an integrated innovation of P2P (peer to peer) network, consensus mechanism, cryptographic algorithm, smart contract and other technologies. The blockchain system encrypts and hashes data and data operation records through cryptographic methods to form an open, transparent, tamper-proof and traceable distributed database accounting system. This technology can be widely used in payment and settlement, evidence storage and collection, value transfer, supply chain finance, user credit reporting, regulatory audit and other fields.

[0003] Smart contracts are computer transaction protocols that do not require intermediaries, are self-verified, and automatically execute contract terms. In recent years, they have attracted much attention with the increasing popularity of blockchain technology. Smart contracts on blockchains have the characteristics of decentralization, trustlessness, programmability, and immutability. They can be flexibly embedded with various data and assets, helping to achieve safe and efficient information exchange, value transfer, and asset management, and helping to apply blockchain to various industries.

[0004] Smart contracts are a key technology that makes up the blockchain. Smart contract applications usually involve real-world economic interests. Incorrect and flawed smart contracts can cause huge economic losses and real problems.

[0005] With the development of computer technology, more and more technologies are applied in the financial field. The traditional financial industry is gradually transforming to Fintech, and blockchain technology is no exception. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology.

[0006] At present, the security of blockchain systems has attracted more and more attention. There is currently no better solution to ensure the security of blockchain systems in terms of vulnerability detection in smart contracts, especially outlier detection in smart contracts. Summary of the invention

[0007] The purpose of the embodiments of the present invention is to provide a smart contract anomaly detection method, a blockchain network, an electronic device and a computer-readable storage medium to solve the problem of outlier detection of smart contracts.

[0008] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0009] In a first aspect, an embodiment of the present invention provides a method for detecting anomalies in a smart contract, the method comprising:

[0010] Obtaining a smart contract call request sent by the client application software to the peer node, wherein the smart contract call request carries data to be processed;

[0011] Based on each preset anomaly detection model, the corresponding anomaly detection processing is performed on the data to be processed to obtain an anomaly value set corresponding to each preset anomaly detection model;

[0012] Based on the determined anomaly detection strategy, each anomaly value set of each preset anomaly detection model is comprehensively processed to obtain an anomaly value detection result;

[0013] The result of the outlier detection is fed back to the peer node, so that the peer node determines the result of the simulated execution of the smart contract according to the result of the outlier detection.

[0014] In a second aspect, an embodiment of the present invention provides a blockchain network, the blockchain network comprising:

[0015] An interceptor is used to obtain a smart contract call request sent by a client application software to a peer node, wherein the smart contract call request carries data to be processed; an anomaly detection module is used to perform corresponding outlier detection processing on the data to be processed based on each preset anomaly detection model, and obtain an outlier set corresponding to each preset anomaly detection model; based on the determined anomaly detection strategy, each outlier set of the preset anomaly detection model is comprehensively processed to obtain an outlier detection result; the result of the outlier detection is fed back to the peer node, so that the peer node determines the result of the simulated execution of the smart contract according to the result of the outlier detection.

[0016] In a third aspect, an embodiment of the present invention provides a peer node, the peer node comprising:

[0017] A first communication module is used to send an anomaly detection request to an anomaly detection module after receiving a smart contract call request sent by the client application software, wherein the smart contract call request carries data to be processed;

[0018] A first processing module, configured to determine that the result of the simulated execution of the smart contract is an alarm state according to the result of the abnormal value detection fed back by the abnormality detection module that the data to be processed is abnormal;

[0019] The first communication module is also used to return the determined result of the simulated execution of the smart contract to the client application software, so that the client application software issues a prompt message according to the alarm status.

[0020] In a fourth aspect, an embodiment of the present invention provides a client application software, the client application software comprising:

[0021] A second communication module is used to send a smart contract call request to a peer node, wherein the smart contract call request carries data to be processed; and receive a result of the simulated execution of the smart contract returned by the peer node;

[0022] The second processing module is used to issue a prompt message for the alarm state according to the result of the simulated execution of the smart contract.

[0023] In a fifth aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the smart contract anomaly detection method as described in the first aspect.

[0024] In a sixth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the smart contract anomaly detection method as described in the first aspect are implemented.

[0025] In an embodiment of the present invention, by obtaining a smart contract call request sent by a client application software to a peer node, wherein the smart contract call request carries data to be processed, based on each preset anomaly detection model, corresponding outlier detection processing is performed on the data to be processed, and an outlier set corresponding to each preset anomaly detection model is obtained; based on the determined anomaly detection strategy, each outlier set of each preset anomaly detection model is comprehensively processed to obtain an outlier detection result, and the outlier detection result is fed back to the peer node, so that the peer node determines the result of the smart contract simulation execution according to the outlier detection result; an outlier detection of the smart contract in an unsupervised manner is realized, and there is no need to set monitoring and detection rules for the business logic and parameters of the smart contract respectively, and the independence of the detection rules from the business is realized, so that the number of detection rules converges, and the influence of more and more detection rules on the normal execution performance of the smart contract can be avoided, which can be used as an effective supplement to the existing supervision method of the smart contract, is easy to deploy and implement, and does not affect the development and deployment process of the client and smart contract of the existing blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 is a flow chart of a smart contract anomaly detection method provided by an embodiment of the present invention;

[0027] Figure 2 is a flow chart of another smart contract anomaly detection method provided by an embodiment of the present invention;

[0028] Figure 3 is a schematic diagram of a property tree constructed by a key-value pair structure provided by an embodiment of the present invention;

[0029] Figure 4 It is a flowchart of an implementation method of updating an anomaly detection model according to an attribute value provided by an embodiment of the present invention;

[0030] Figure 5 is a way of Figure 3 A schematic diagram of setting a historical value library at each leaf node of the attribute tree to store attribute values;

[0031] Figure 6 is a flow chart of another smart contract anomaly detection method provided by an embodiment of the present invention;

[0032] Figure 7 It is a flowchart of an implementation method for determining the result of intelligent contract simulation execution according to the result of outlier detection provided by an embodiment of the present invention;

[0033] Figure 8 It is a schematic diagram of an application scenario of a smart contract anomaly detection method provided by an embodiment of the present invention;

[0034] Fig. 9 It is a structural diagram of a smart contract anomaly detection device provided by an embodiment of the present invention;

[0035] Fig.10 is a schematic diagram of the structure of a peer node provided by an embodiment of the present invention;

[0036] Fig.11 It is a structural diagram of a client application software provided by an embodiment of the present invention;

[0037] Fig.12 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] The terms "first", "second", etc. in the specification and claims of the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0040] The following describes in detail the identity sharing method, identity sharing device, electronic device and computer-readable storage medium provided by the embodiments of the present invention through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0041] See also Figure 1 , Figure 1 is a flow chart of a smart contract anomaly detection method provided by an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0042] Step 101, obtaining a smart contract call request sent by the client application software to the peer node, wherein the smart contract call request carries data to be processed.

[0043] In the embodiment of the present invention, the smart contract is the rules between different organizations defined by executable code, and the client application software APP can generate transactions recorded in the ledger by calling the smart contract. Taking the Fabric platform as an example, its smart contract can implement the business rules between different organizations by setting, obtaining and deleting the ledger data, etc., for the client application software to call. The structure of the smart contract may include: smart contract, SHIM API and ledger. Among them, SHIM API provides the main interfaces PutState, GetState, DelState, etc. for smart contract calls to complete the setting, obtaining and deleting of ledger data. The basic definitions of the interfaces PutState, GetState, and DelState are as follows:

[0044] GetState(key string)([]byte,error)

[0045] PutState(key string,value[]byte)error

[0046] DelState(key string)error

[0047] The client application software can call the smart contract to simulate the generation of transactions recorded in the ledger by sending a smart contract call request with the data to be processed to the peer node Peer.

[0048] In an embodiment of the present invention, an interceptor can be deployed at each peer node of the blockchain network to obtain the smart contract call request sent by the client application software to the peer node, wherein the interceptor plays a role similar to that of a gateway, which can receive the smart contract call request issued by the client application software and forward the received smart contract call request to the peer node.

[0049] Step 102: Based on each preset anomaly detection model, corresponding outlier detection processing is performed on the data to be processed to obtain an outlier set corresponding to each preset anomaly detection model.

[0050] In an embodiment of the present invention, the anomaly detection model may be an algorithm model pre-set according to the needs of anomaly detection, so that the corresponding anomaly detection processing is performed on the processed data through these algorithm models to obtain an outlier set corresponding to each preset anomaly detection model. Optionally, the outlier detection processing performed on the processed data may include at least one of the following: data type judgment, data feature derivation judgment, discrete value continuous value judgment, multi-factor outlier detection, etc. Each preset anomaly detection model may include at least one of the following: The algorithm model includes an outlier detection model based on proximity, an outlier detection model based on density, an isolated forest algorithm model, etc. The embodiment of the present invention does not limit the type of outlier detection and the type of algorithm model for implementing outlier detection. In the embodiment of the present invention, outlier detection can be to determine a legal but unreasonable value. For example, the value of age is generally concentrated between 1 and 100. When a value greater than 100 appears, it will be determined that an outlier has occurred, and the user needs to further confirm it.

[0051] In an embodiment of the present invention, an anomaly detection module can be deployed in a blockchain network to receive the data to be processed obtained by each interceptor deployed at each peer node in the blockchain network, and based on the preset anomaly detection models, the corresponding anomaly value detection processing is performed on the obtained data to be processed by each interceptor to obtain a set of anomaly values ​​corresponding to each preset anomaly detection model for each data to be processed.

[0052] Step 103 , based on the determined anomaly detection strategy, comprehensively process each anomaly value set of each preset anomaly detection model to obtain an anomaly value detection result.

[0053] In an embodiment of the present invention, various outlier detection processes performed by various preset outlier detection models on the processed data can be comprehensively considered, and different outlier detection strategies can be formulated in advance to meet different requirements for outlier detection in different application scenarios. For example, the pre-formulated outlier detection strategies may include: negative strategies, cautious strategies, and positive strategies. Optionally, each pre-formulated outlier detection strategy can be implemented by performing corresponding operations on the outlier value sets corresponding to each preset outlier detection model. For example, it can be implemented by performing intersection and union operations between the outlier value sets of each preset outlier detection model. The embodiment of the present invention does not limit the type and implementation of the outlier detection strategy.

[0054] In an embodiment of the present invention, after obtaining the various outlier value sets for the corresponding outlier value detection processing performed by the preset outlier detection models on the data to be processed, the outlier detection module can perform intersection and union operations between the sets specified by the outlier detection strategy on the various outlier value sets of the preset outlier detection models according to a predetermined outlier detection strategy for performing outlier detection on the data to be processed, thereby achieving comprehensive processing of the various outlier value sets and obtaining the result of the outlier value detection of the data to be processed, wherein the result of the outlier value detection can be that the data to be processed is abnormal or that the data to be processed is normal.

[0055] Step 104, feeding back the result of the outlier detection to the peer node, so that the peer node determines the result of the smart contract simulation execution according to the result of the outlier detection.

[0056] In an embodiment of the present invention, after obtaining the result of the outlier detection, the anomaly detection module will feed back the result of the outlier detection to the corresponding peer node. If the result of the outlier detection is that the data to be processed is normal, the peer node will call the smart contract to simulate the generation of transactions recorded in the account book, and determine the result of the simulated execution of the smart contract, and return the determined result of the simulated execution of the smart contract to the client application software. For example, at this time, the result of the simulated execution of the smart contract can be a success state or a failure state. If the result of the outlier detection is that the data to be processed is abnormal, the peer node will determine the result of the simulated execution of the smart contract based on the abnormal data to be processed, and return the determined result of the simulated execution of the smart contract to the client application software. For example, at this time, the result of the simulated execution of the smart contract can be an alarm state.

[0057] In an embodiment of the present invention, by obtaining a smart contract call request sent by a client application software to a peer node, wherein the smart contract call request carries data to be processed, based on each preset anomaly detection model, corresponding outlier detection processing is performed on the data to be processed, and an outlier set corresponding to each preset anomaly detection model is obtained; based on the determined anomaly detection strategy, each outlier set of each preset anomaly detection model is comprehensively processed to obtain an outlier detection result, and the outlier detection result is fed back to the peer node, so that the peer node determines the result of the smart contract simulation execution according to the outlier detection result; an outlier detection of the smart contract in an unsupervised manner is realized, and there is no need to set monitoring and detection rules for the business logic and parameters of the smart contract respectively, and the independence of the detection rules from the business is realized, so that the number of detection rules converges, and the influence of more and more detection rules on the normal execution performance of the smart contract can be avoided, which can be used as an effective supplement to the existing supervision method of the smart contract, is easy to deploy and implement, and does not affect the development and deployment process of the client and smart contract of the existing blockchain.

[0058] See also Figure 2 , Figure 2 is a flow chart of another smart contract anomaly detection method provided by an embodiment of the present invention. Figure 2 As shown, after parsing the data to be processed carried in the smart contract call request based on a preset attribute tree and extracting the attribute value of the data to be processed, the method includes the following steps:

[0059] Step 201, obtaining a smart contract call request sent by the client application software to the peer node, wherein the smart contract call request carries data to be processed.

[0060] Step 202: Based on a preset attribute tree, the data to be processed is parsed and the attribute values ​​of the data to be processed are extracted, wherein the attribute tree is constructed based on a smart contract.

[0061] In an embodiment of the present invention, before performing corresponding outlier detection processing on the data to be processed based on the preset anomaly detection models, the data to be processed can also be parsed and processed based on a preset attribute tree and the attribute values ​​of the data to be processed can be extracted. When performing corresponding outlier detection processing on the data to be processed based on the preset anomaly detection models, corresponding outlier detection processing can be performed on the attribute values ​​of the extracted data to be processed based on the preset anomaly detection models, thereby obtaining an outlier value set corresponding to each preset anomaly detection model.

[0062] Optionally, the property tree can be pre-built according to the smart contract, and different smart contracts correspond to different property trees. The properties corresponding to the smart contract rules can be determined by analyzing the rules of the smart contract, and then the corresponding property tree is constructed through the key-value pair (Key / Value, K / V for short) structure based on the properties determined by the smart contract rules, wherein the key in the key-value pair serves as the root node of the property tree, and the values ​​in the key-value pair correspond to multiple properties in the smart contract rules, which serve as property nodes other than the root node in the property tree, forming a nested structure containing multiple properties. The rules of the smart contract are mainly concentrated in the values ​​in the key-value pair. Figure 3 As shown, an attribute tree is constructed by a key-value pair structure, wherein the root node Key can be a string (string), and the remaining attribute nodes Attr1, Attr2, AttrM, AttrN, Attr2.1, AttrM.1, AttrM.2, Attr2.1.1, and Attr2.1.2 can be a byte (Byte).

[0063] In an embodiment of the present invention, by obtaining a smart contract call request sent by a client application software to a peer node, the data to be processed carried in the smart contract call request can be obtained. Based on the preset attribute tree corresponding to the smart contract, the data to be processed obtained from the smart contract call request can be parsed and processed, and the attribute values ​​of the data to be processed can be extracted. For example, according to the API of the smart contract to be called determined in the smart contract call request, for example, the API of the smart contract to be called is PutState, the data to be processed is parsed and processed through the attribute tree, and the attribute values ​​of the data to be processed are extracted, and only the Key and Value that conform to PutState can be obtained. The Key and Value obtained each time the API is called are Figure 2 A subtree of the attribute tree in the Figure 2 Traversal of the property tree in .

[0064] In an embodiment of the present invention, after obtaining the smart contract call request, the interceptor can parse and process the data to be processed carried in each smart contract call request based on a preset attribute tree, and extract the attribute value of each data to be processed. The attribute value of the data to be processed obtained by each interceptor and the key of the corresponding attribute tree can be received through the anomaly detection module, and based on the preset anomaly detection models, the attribute value of the data to be processed obtained by each interceptor can be subjected to corresponding anomaly detection processing, so as to obtain anomaly value sets corresponding to the preset anomaly detection models.

[0065] Step 203 , based on each preset anomaly detection model, corresponding anomaly detection processing is performed on the attribute value of the extracted data to be processed, so as to obtain an anomaly value set corresponding to each preset anomaly detection model.

[0066] Step 204 , based on the determined anomaly detection strategy, comprehensively process each anomaly value set of each preset anomaly detection model to obtain an anomaly value detection result.

[0067] Step 205, feeding back the outlier detection result to the peer node, so that the peer node determines the result of the smart contract simulation execution according to the outlier detection result.

[0068] In the embodiment of the present invention, the description of steps 201, 203, 204, and 205 can be found in Figure 1 The relevant descriptions about steps 101, 102, 103, and 104 are described in detail in the previous section, so they will not be repeated here.

[0069] This embodiment parses the data to be processed by attribute values ​​and extracts the attribute values ​​of the data to be processed, and uses the attribute values ​​of the data to be processed for anomaly detection processing of each preset anomaly monitoring model, which can reduce the amount of data for anomaly detection processing by the anomaly monitoring model and improve the efficiency of anomaly detection.

[0070] See also Figure 4 , Figure 4 is a flowchart of an implementation method for updating an anomaly detection model according to an attribute value provided by an embodiment of the present invention, such as Figure 4 As shown, after parsing the data to be processed and extracting the attribute values ​​of the data to be processed based on the preset attribute tree, the following steps are also included:

[0071] Step 401: store the attribute values ​​of the to-be-processed data corresponding to the attribute nodes in the preset attribute tree.

[0072] In the embodiment of the present invention, after obtaining the attribute value of the data to be processed and the key of the corresponding attribute tree, the anomaly detection module can also store the attribute value of the data to be processed corresponding to the attribute node in the preset attribute tree to form a historical data pool, that is, a sample space. Figure 5 As shown, this can be done by Figure 3 A historical value library is set at each leaf node of the attribute tree to store the attribute values ​​of the corresponding data to be processed.

[0073] Step 402: According to a preset time period, the preset anomaly detection model is updated using the stored attribute values ​​of the data to be processed as samples.

[0074] In an embodiment of the present invention, the anomaly detection module can use the stored historical data of the attribute values ​​of the data to be processed as samples according to a preset time period to iteratively update the preset anomaly detection model. Usually, only when the number of stored historical values ​​of each attribute reaches a certain number, can the stored historical values ​​of each attribute be used as samples to iteratively update the preset anomaly detection model, and before this, the results of the anomaly value detection returned by the anomaly detection module are all normal for the data to be processed. Among them, the cycle for iteratively updating the preset anomaly detection model can be set according to demand, for example, iteratively updating the model once a day, and the embodiment of the present invention does not limit this.

[0075] This embodiment obtains historical data of each attribute by storing attribute values, and periodically iterates and updates the preset anomaly detection model based on the historical data of each attribute as a sample, so as to continuously optimize the preset anomaly detection model and improve the accuracy of the preset anomaly detection model in detecting anomalies.

[0076] See also Figure 6 , Figure 6 is a flow chart of another smart contract anomaly detection method provided by an embodiment of the present invention. Figure 6 As shown, the method comprises the following steps:

[0077] Step 601, obtaining a smart contract call request sent by the client application software to the peer node, wherein the smart contract call request carries data to be processed.

[0078] Step 602: Based on a preset attribute tree, the data to be processed is parsed and the attribute values ​​of the data to be processed are extracted, wherein the attribute tree is constructed based on a smart contract.

[0079] Step 603: Receive an anomaly detection request sent by a peer node.

[0080] In an embodiment of the present invention, the outlier detection processing of the data to be processed may be performed after the peer node receives the smart contract call request sent by the client application software, in response to the outlier detection request issued by the peer node. Optionally, the outlier detection request issued by the peer node may be issued to an outlier detection module deployed in the blockchain network before calling the smart contract to simulate the generation of transactions recorded in the ledger.

[0081] Step 604 , based on each preset anomaly detection model, perform corresponding anomaly detection processing on the attribute value of the extracted data to be processed, and obtain an anomaly value set corresponding to each preset anomaly detection model.

[0082] Step 605 , based on the determined anomaly detection strategy, comprehensively process each anomaly value set of each preset anomaly detection model to obtain an anomaly value detection result.

[0083] Step 606, the result of the outlier detection is fed back to the peer node, so that the peer node determines the result of the smart contract simulation execution according to the result of the outlier detection.

[0084] In the embodiment of the present invention, the description of steps 601, 604, 602, and 606 can be found in Figure 1 For the relevant description of steps 101, 102, 103, and 104, and for the description of step 602, please refer to Figure 2 The relevant description about step 202 is given in the above description, so it will not be repeated here.

[0085] This embodiment triggers anomaly detection on the data to be processed through an anomaly detection request issued by a peer node. It can decide whether to perform anomaly detection on the data to be processed based on the actual business processing situation of the blockchain network, which can improve the flexibility of the smart contract anomaly detection application.

[0086] See also Figure 7 , Figure 7 is a flowchart of an implementation method for determining the result of a simulated execution of a smart contract according to the result of an outlier detection provided by an embodiment of the present invention, such as Figure 7 As shown, the peer node determines the result of the smart contract simulation execution based on the result of the outlier detection, including the following steps:

[0087] Step 701, according to the result of the outlier detection, the data to be processed is abnormal, and the result of the smart contract simulation execution is determined to be an alarm state.

[0088] In an embodiment of the present invention, after receiving the result of the outlier detection fed back by the anomaly detection module, the peer node will determine the result of the simulated execution of the smart contract based on the result of the outlier detection. When the result of the outlier detection is that the data to be processed is abnormal, the peer node will determine that the result of the simulated execution of the smart contract is an alarm state based on the abnormal data to be processed, and there is no need to call the smart contract to simulate the generation of transactions recorded in the ledger.

[0089] Step 702, returning the determined result of the smart contract simulation execution to the client application software, so that the client application software issues a prompt message according to the alarm status.

[0090] In an embodiment of the present invention, after determining the result of the simulated execution of the smart contract, the peer node will return the determined result of the simulated execution of the smart contract to the client application software. After the client application software receives the result of the simulated execution of the smart contract fed back by the peer node, if the result of the simulated execution of the smart contract is an alarm state, the client application software will issue a prompt message according to the alarm state to inform the user of the result of the abnormal value detection, and the user will further confirm whether to execute the subsequent process. Optionally, the prompt message issued by the client application software can be in at least one form of text, voice, picture, etc., and the embodiment of the present invention does not limit this. If the result of the simulated execution of the smart contract is a successful state, the client application software will issue a prompt message according to the alarm state, and the client application software will issue a sorting request to the sorting node Order, and the Order node will generate a block of smart contract execution, and send it to each peer node Peer of the blockchain network for writing and updating the block.

[0091] In this embodiment, when the result of the outlier value detection by the peer node is that the data to be processed is abnormal, the result of the simulated execution of the smart contract is directly determined to be an alarm state based on the abnormal data to be processed, and the alarm state is returned to the client application software, without calling the smart contract to simulate the generation of transactions recorded in the ledger, which can simplify the processing process of the peer node.

[0092] See also Figure 8 , Figure 8 is a schematic diagram of an application scenario of a smart contract anomaly detection method provided by an embodiment of the present invention, such as Figure 8 As shown, the embodiment of the present invention can be implemented by deploying an interceptor and an anomaly detection module in an existing blockchain network, wherein an interceptor is deployed at each peer node of the blockchain network, and an anomaly detection module is deployed in the entire blockchain network to aggregate data collected by the interceptors deployed at each peer node. After the interceptor and anomaly detection module are introduced into the blockchain network, the processing flow of the blockchain network is as follows:

[0093] 1. The user uses the App front-end application to call the smart contract (chain code) and make a chain-based business request;

[0094] New1. The interceptor obtains the input data of the calling chain code, parses the data and sends it to the anomaly detection function module;

[0095] New2, the peer node requests to determine whether the data is abnormal;

[0096] New3. The anomaly detection module determines whether the data received from the interceptor is normal based on its preset outlier detection algorithm model (3δ, isolated point forest, etc.).

[0097] 2. After the peer node Peer receives the on-chain business request, if the received anomaly detection module determines that the data is normal, it simulates the execution of the smart contract and returns the obtained status result OK / FAIL to the front-end application App. If the received anomaly detection module determines that the data is abnormal, the obtained status result is WARN.

[0098] New4. When the status result is WARN, the front-end application App will give a prompt message to inform the outlier detection result, and the user will further confirm whether to execute the subsequent process.

[0099] 3. When the status result is OK, the front-end application App will request the sorting node Order to generate a block for the smart contract execution, and the sorting node Order will send it to each peer node Pee of the blockchain network to write and update the block.

[0100] Among them, in the blockchain network, multiple organizations contribute multiple peer nodes, and the interceptors are deployed on each peer node. The anomaly detection module is deployed uniformly, which can gather more data and is conducive to the iterative update of the anomaly detection model. Outlier detection is an optional function of the blockchain network. Organizations on the blockchain can determine whether to enable related functions by themselves, that is, New2, New3, and New4 are optional steps. For example, the outlier detection function can be turned off for scenarios with high timeliness requirements. Outlier detection can have two application scenarios: one is real-time judgment, that is, the above optional steps are enabled to provide blockchain users with real-time prompts of outliers; the other is offline analysis, through the outlier analysis of the data, determine whether the outlier is an unreasonable value, that is, start manual intervention to set the unreasonable value to a reasonable value, and provide a basis for subsequent real-time judgment.

[0101] The following is a brief description of several outlier detection methods combined with the attribute values ​​of the data to be processed:

[0102] Data type judgment can judge the data type of each attribute value according to the regular expression of each data type. For example, each data type can include integer, floating point number, byte code, string, etc., wherein the regular expression of integer can be ^-? [1-9]\d*$, the regular expression of floating point number can be ^-? ([1-9]\d*\.\d*|0\.\d*[1-9]\d*|0?\.0+|0)$, and the regular expression of HEX string can be ([0-9A-Fa-f]{2})+. Optionally, the judgment of data type can be continuously refined as needed. For example, numbers can include but are not limited to byte, int16, int32, int64, etc.; character types can include English, English+number, case-sensitive and case-insensitive, etc.

[0103] The derived judgment of data features can be made based on the length of the attribute value and the number of values. The length of the attribute value is a newly derived feature, which can be used to judge abnormal values ​​or outliers. For example, hash and encrypted ciphertext are fixed to multiples of 8 or 16. The number of values ​​is a technology that requires regularity. The relationship between the number of value increases and the number of values ​​is determined. When the number of attribute value increases and the number of values ​​are linearly related, the attribute value can be judged as a continuous value. When the number of values ​​converges with the increase of the attribute value, that is, the number of values ​​<< the number of attribute values, the attribute value can be judged as a discrete value. For example, for the gender field male and female, as the number of attribute values ​​increases, the number of values ​​converges to 2, and the segment attribute value is judged to be a discrete value. At this time, when other values ​​appear, other values ​​can be judged as abnormal values.

[0104] Outlier judgment is to judge the continuous digital type. Since each model algorithm has its applicable sample space requirements, using only one algorithm may cause a large number of false positives or only detect a small number of outliers. When used for smart contract detection, a multi-factor outlier detection method can be used. When making judgments, the following algorithm models can be called, requiring a judgment to be made within a specified time. If the timeout is exceeded, it is defaulted to normal:

[0105] 1. Algorithm model, if the difference between the observed value and the mean value exceeds 3 standard deviations, it can be regarded as an outlier. The probability is 99.7%, then the distance from the mean The probability of a value other than This is a rare event with a low probability. Method, periodically calculate the mean and variance of attribute values, and calculate the historical sample space in The probability between needs to be less than the specified probability z, for example z = 0.003, which can be increased or decreased according to the actual situation, and then increased to t = 4 times the standard deviation until the historical sample space The probability of occurrence is less than <z。

[0106] 2. Outlier detection model based on proximity degree: For the sample space of data, a distance r threshold can be specified to define the reasonable distance of the object. For each sample s, the number of samples in the r neighborhood can be examined. If most samples are far away from sample s, then s can be regarded as an outlier. Common algorithms based on proximity degree include k-nearest neighbor (KNN). This detection method has requirements for the distribution of sample space, and as the sample space increases, the algorithm takes a long time.

[0107] 3. Density-based outlier detection model, outliers are objects in low-density areas. Density-based outlier detection is closely related to proximity-based outlier detection, because density is usually defined in terms of proximity. A common way to define density is to define it as the inverse of the average distance to the k nearest neighbors. If the distance is small, the density is high, and vice versa.

[0108] 4. Isolation Forest algorithm model, which is an unsupervised anomaly detection method suitable for continuous data. In the isolation forest, outliers are defined as those "outliers that are easily isolated", that is, points that are sparsely distributed and far away from high-density groups. In the data space, if there are only sparsely distributed points in an area, it means that the probability of data points falling in this area is very low, so the points in these areas can be considered abnormal. The present invention uses the value range space of samples in a recursive manner to infer a reasonable confidence space, and randomly generates segmentation points in this confidence space to segment the data set until all sample points are isolated. Under this random segmentation method, outliers usually have the shortest path.

[0109] The following will explain the form of the anomaly detection strategy in combination with the above algorithm models 1 to 4:

[0110] Passive strategy: {algorithm model 1}∩{algorithm model 2}∩{algorithm model 3}∩{algorithm model 4};

[0111] Cautious strategy: {algorithm model 1}∩({algorithm model 2}∪{algorithm model 3})∩{algorithm model 4};

[0112] Active strategy: {algorithm model 1}∪({algorithm model 2}∩{algorithm model 3})∪{algorithm model 4}.

[0113] See also Fig. 9 , Fig. 9 is a schematic diagram of the structure of a blockchain network provided by an embodiment of the present invention, such as Fig. 9 As shown, the blockchain network 90 may include:

[0114] The interceptor 91 is used to obtain the smart contract call request sent by the client application software to the peer node, wherein the smart contract call request carries the data to be processed.

[0115] The anomaly detection module 92 is used to perform corresponding anomaly detection processing on the processed data based on the preset anomaly detection models to obtain the anomaly set corresponding to the preset anomaly detection model; based on the determined anomaly detection strategy, comprehensively process the anomaly sets of the preset anomaly detection models to obtain the result of the anomaly detection; and feed back the result of the anomaly detection to the peer node, so that the peer node determines the result of the intelligent contract simulation execution according to the result of the anomaly detection.

[0116] Optionally, the interceptor 91 is further used to parse the data to be processed and extract the attribute values ​​of the data to be processed based on a preset attribute tree, wherein the attribute tree is constructed based on a smart contract;

[0117] The anomaly detection module 92 is used to perform corresponding anomaly detection processing on the attribute values ​​of the extracted data to be processed based on the preset anomaly detection models, and obtain an anomaly value set corresponding to the preset anomaly detection models.

[0118] Optionally, the interceptor 91 is also used to construct a corresponding attribute tree through a key-value pair structure based on the attributes determined by the rules of the smart contract, wherein the key in the key-value pair serves as the root node of the attribute tree, and the value in the key-value pair corresponds to multiple attributes in the rules of the smart contract, serving as attribute nodes other than the root node in the attribute tree.

[0119] Optionally, the anomaly detection module 92 is further used to store the attribute values ​​of the data to be processed corresponding to the attribute nodes in the preset attribute tree; and update the preset anomaly detection model according to a preset time period using the stored attribute values ​​of the data to be processed as samples.

[0120] Optionally, the anomaly detection module 92 is further configured to receive an anomaly detection request sent by a peer node.

[0121] Optionally, the outlier detection processing performed on the data to be processed includes at least one of the following: data type judgment, data feature derivation judgment, discrete value and continuous value judgment, and multi-factor outlier detection.

[0122] Optionally, each preset anomaly detection model includes at least one of the following: Algorithm model, neighbor-based outlier detection model, density-based outlier detection, isolation forest algorithm model.

[0123] It is understandable that the blockchain network 90 of the embodiment of the present invention can achieve the above Figures 1 to 8 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0124] See also Fig.10 , Fig.10 is a schematic diagram of the structure of a peer node provided by an embodiment of the present invention, such as Fig.10 As shown, the peer node 100 may include:

[0125] The first communication module 110 is used to send an exception detection request to the exception detection module after receiving the smart contract call request sent by the client application software, wherein the smart contract call request carries data to be processed.

[0126] The first processing module 120 is used to determine that the result of the intelligent contract simulation execution is an alarm state according to the result of the abnormal value detection fed back by the abnormality detection module that the data to be processed is abnormal.

[0127] The first communication module 110 is also used to return the determined result of the intelligent contract simulation execution to the client application software, so that the client application software issues a prompt message according to the alarm status.

[0128] It is understandable that the peer node 100 of the embodiment of the present invention can implement the above Figure 7 The various processes and Figure 8 Part of the process of the embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0129] See also Fig.11 , Fig.11 is a schematic diagram of the structure of a client application software provided by an embodiment of the present invention, such as Fig.11 As shown, the client application software 200 may include:

[0130] The second communication module 210 is used to send a smart contract call request to a peer node, wherein the smart contract call request carries data to be processed; and receive the result of the smart contract simulation execution returned by the peer node.

[0131] The second processing module 220 is used to issue a prompt message for the alarm state according to the result of the intelligent contract simulation execution.

[0132] It is understandable that the client application software 200 of the embodiment of the present invention can implement the above Figure 8 Part of the process of the embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0133] In addition, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program can achieve the above-mentioned Figures 1 to 8The various processes of the method embodiment shown can achieve the same technical effect, and to avoid repetition, they will not be described again here.

[0134] See also Fig.12 As shown, an embodiment of the present invention further provides an electronic device 300 , including a bus 310 , a transceiver 320 , an antenna 330 , a bus interface 340 , a processor 350 , and a memory 360 .

[0135] In the embodiment of the present invention, the electronic device 300 further includes: a program or instruction stored in the memory 360 and executable on the processor 350. Optionally, when the program or instruction is executed by the processor 350, the following steps may be implemented:

[0136] Obtaining a smart contract call request sent by the client application software to the peer node, wherein the smart contract call request carries data to be processed;

[0137] Based on each preset anomaly detection model, the corresponding anomaly detection processing is performed on the data to be processed to obtain an anomaly value set corresponding to each preset anomaly detection model;

[0138] Based on the determined anomaly detection strategy, each anomaly value set of each preset anomaly detection model is comprehensively processed to obtain an anomaly value detection result;

[0139] The result of the outlier detection is fed back to the peer node, so that the peer node determines the result of the simulated execution of the smart contract according to the result of the outlier detection.

[0140] It is understandable that when the computer program is executed by the processor 350, the above Figures 1 to 8 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0141] exist Fig.12In the embodiment, a bus architecture (represented by bus 310) is provided, bus 310 may include any number of interconnected buses and bridges, bus 310 links various circuits including one or more processors represented by processor 350 and memory represented by memory 360. Bus 310 may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 340 provides an interface between bus 310 and transceiver 320. Transceiver 320 may be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. Data processed by processor 350 is transmitted on a wireless medium via antenna 330, and further, antenna 330 also receives data and transmits the data to processor 30.

[0142] Processor 350 is responsible for managing bus 310 and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. Memory 360 can be used to store data used by processor 350 when performing operations.

[0143] Optionally, the processor 350 may be a CPU, an ASIC, an FPGA or a CPLD.

[0144] The embodiment of the present invention further provides a computer-readable storage medium having a program or instruction stored thereon, which can implement the above-mentioned Figures 1 to 8 The various processes of the method embodiment shown can achieve the same technical effect, and to avoid repetition, they will not be described again here.

[0145] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0146] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0147] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0148] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a service classification device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0149] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A smart contract anomaly detection method, characterized in that: include: Obtaining a smart contract call request sent by the client application software to the peer node, wherein the smart contract call request carries data to be processed; Based on each preset anomaly detection model, the corresponding anomaly detection processing is performed on the data to be processed to obtain an anomaly value set corresponding to each preset anomaly detection model; Based on the determined anomaly detection strategy, each anomaly value set of each preset anomaly detection model is comprehensively processed to obtain an anomaly value detection result; The result of the outlier detection is fed back to the peer node, so that the peer node determines the result of the simulated execution of the smart contract according to the result of the outlier detection.

2. The method according to claim 1, characterized in that Before performing corresponding outlier detection processing on the to-be-processed data based on each preset anomaly detection model, the method further includes: Based on a preset attribute tree, the data to be processed is parsed and attribute values ​​of the data to be processed are extracted, wherein the attribute tree is constructed based on the smart contract; The performing corresponding outlier detection processing on the data to be processed based on each preset outlier detection model includes: Based on the preset anomaly detection models, corresponding anomaly detection processing is performed on the extracted attribute values ​​of the data to be processed to obtain an anomaly value set corresponding to each preset anomaly detection model.

3. The method according to claim 2, characterized in that The method further comprises: Based on the attributes determined by the rules of the smart contract, the corresponding attribute tree is constructed through a key-value pair structure, wherein the key in the key-value pair serves as the root node of the attribute tree, and the values ​​in the key-value pair correspond to multiple attributes in the rules of the smart contract, serving as attribute nodes in the attribute tree other than the root node.

4. The method according to claim 3, characterized in that After parsing the data to be processed and extracting the attribute value of the data to be processed based on the preset attribute tree, the method further includes: Storing the attribute values ​​of the data to be processed corresponding to the attribute nodes in the preset attribute tree; According to a preset time period, each preset anomaly detection model is updated using the stored attribute values ​​of the data to be processed as samples.

5. The method according to claim 1, characterized in that Before performing corresponding outlier detection processing on the to-be-processed data based on each preset anomaly detection model, the method further includes: An anomaly detection request sent by the peer node is received.

6. The method according to any one of claims 1 to 5, characterized in that The outlier detection processing performed on the data to be processed includes at least one of the following: Data type judgment, data feature derivative judgment, discrete value and continuous value judgment, and multi-factor outlier detection.

7. The method according to any one of claims 1 to 5, characterized in that The preset anomaly detection models include at least one of the following: Algorithm model, neighbor-based outlier detection model, density-based outlier detection, isolation forest algorithm model.

8. The method according to claim 1, characterized in that The peer node determines the result of the simulated execution of the smart contract according to the result of the outlier detection, including: According to the result of the abnormal value detection, the data to be processed is abnormal, and the result of the simulated execution of the smart contract is determined to be an alarm state; The determined result of the simulated execution of the smart contract is returned to the client application software, so that the client application software issues a prompt message according to the alarm status.

9. A blockchain network, characterized in that: include: An interceptor, used to obtain a smart contract call request sent by a client application software to a peer node, wherein the smart contract call request carries data to be processed; The anomaly detection module is used to perform corresponding outlier detection processing on the data to be processed based on the preset anomaly detection models to obtain the outlier value sets corresponding to the preset anomaly detection models; based on the determined anomaly detection strategy, perform comprehensive processing on the outlier value sets of the preset anomaly detection models to obtain the result of the outlier detection; and feed back the result of the outlier detection to the peer node so that the peer node determines the result of the simulated execution of the smart contract according to the result of the outlier detection.

10. The blockchain network according to claim 9, characterized in that: The interceptor is further used to parse the data to be processed and extract attribute values ​​of the data to be processed based on a preset attribute tree, wherein the attribute tree is constructed based on the smart contract; The anomaly detection module is used to perform corresponding anomaly detection processing on the extracted attribute values ​​of the data to be processed based on the preset anomaly detection models, so as to obtain an anomaly value set corresponding to each preset anomaly detection model.

11. The blockchain network according to claim 10, characterized in that: The interceptor is also used to construct the corresponding attribute tree through a key-value pair structure based on the attributes determined by the rules of the smart contract, wherein the key in the key-value pair serves as the root node of the attribute tree, and the value in the key-value pair corresponds to multiple attributes in the rules of the smart contract, serving as attribute nodes in the attribute tree other than the root node.

12. The blockchain network according to claim 11, characterized in that: The anomaly detection module is further used to store the attribute values ​​of the data to be processed corresponding to the attribute nodes in the preset attribute tree; and update the preset anomaly detection models according to a preset time period using the stored attribute values ​​of the data to be processed as samples.

13. The blockchain network according to claim 9, characterized in that: The anomaly detection module is further used to receive an anomaly detection request sent by the peer node.

14. The blockchain network according to any one of claims 9 to 13, characterized in that: The outlier detection processing performed on the data to be processed includes at least one of the following: Data type judgment, data feature derivative judgment, discrete value and continuous value judgment, and multi-factor outlier detection.

15. The blockchain network according to any one of claims 9 to 13, characterized in that: The preset anomaly detection models include at least one of the following: Algorithm model, neighbor-based outlier detection model, density-based outlier detection, isolation forest algorithm model.

16. A peer node, characterized in that: include: A first communication module is used to send an anomaly detection request to an anomaly detection module after receiving a smart contract call request sent by a client application software, wherein the smart contract call request carries data to be processed; A first processing module, configured to determine that the result of the simulated execution of the smart contract is an alarm state according to the result of the abnormal value detection fed back by the abnormality detection module that the data to be processed is abnormal; The first communication module is also used to return the determined result of the simulated execution of the smart contract to the client application software, so that the client application software issues a prompt message according to the alarm status.

17. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the smart contract anomaly detection method as described in any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the smart contract anomaly detection method as described in any one of claims 1 to 8 are implemented.

Images