An Active Identification Method for Anonymous Blockchain Nodes

Abstract

The present invention discloses an active identification method for anonymous blockchain nodes. The method obtains the traffic in the Internet in real time, determines whether the traffic starts from blockchain traffic based on the feature matrix obtained by mapping by the traffic feature extraction module, and then clusters and identifies the traffic. For unknown traffic, the present invention uses its feature matrix and uses the transfer learning method to retrain the classification model so that it can identify the unknown blockchain obtained. The present invention can actively and adaptively update the traffic classification model, and efficiently and accurately identify unknown and anonymous blockchains without affecting the correctness and efficiency of the main system.

Description

Technical Field

[0001] The present invention belongs to the field of Internet security, and in particular relates to a method for actively identifying anonymous blockchain nodes. Background Art

[0002] Blockchain is a decentralized database. Each node on the blockchain maintains the same data. The data is tamper-proof and will be permanently stored on the node. Based on the nature of blockchain, many applications are deployed on the chain, such as product supply chain tracking, medical data sharing, commercial insurance services, etc. These applications have played a positive role in social production. However, the characteristics of blockchain may also be used maliciously. Malicious behavior will disrupt the network environment and cause property losses to citizens. Cracking down on illegal blockchains and blockchain applications can maintain social order and protect citizens' property, which has certain practical significance. Some malicious behaviors are executed based on public blockchains, which are easier to identify and collect evidence; while some malicious applications are deployed on private blockchains. The chain has not announced its network characteristics, operating mechanisms, and joining methods on the network, so it has a certain anonymity and is not easy to be identified. Summary of the invention

[0003] In order to solve the problem that anonymous blockchains in the Internet are difficult to be discovered, detected and identified, the present invention proposes an active identification method for anonymous blockchain nodes, which can actively identify private blockchains existing in the Internet and detect nodes using the blockchain.

[0004] The method for detecting anonymous blockchain traffic in the Internet described in the present invention should include the construction of: an Internet traffic acquisition module, a traffic feature extraction module, and a training module for an anonymous blockchain traffic identification model. To implement the anonymous blockchain traffic identification model, it should include: a training set, a test set, and a training model. The training set and the test set should include normal traffic in the Internet, known blockchain traffic, and unknown blockchain traffic.

[0005] For the Internet traffic acquisition module described in the present invention, the traffic is captured in the Internet, and the traffic will be processed by the traffic feature extraction module.

[0006] The traffic feature extraction module described in the present invention extracts data from the traffic at the traffic packet level according to the characteristics of the blockchain for its node discovery, block broadcasting and other behaviors, and converts the data into a feature matrix. The traffic feature extraction module can convert all traffic in the network, including normal traffic, and use it as the training set and test set of the blockchain traffic identification model.

[0007] The blockchain traffic identification model described in the present invention is composed of three submodules: a normal traffic and blockchain traffic classification submodule, a blockchain traffic clustering submodule, and a transfer learning submodule. The normal traffic and blockchain traffic classification submodule is used to perform coarse-grained classification of traffic in the network to screen out the blockchain traffic existing in the network. The blockchain traffic can contain several different blockchains, including known or public blockchains and private or anonymous blockchains; the blockchain traffic clustering submodule is used to cluster the above-screened blockchain traffic, and according to its matrix features in the above-mentioned traffic feature extraction module, each blockchain traffic is subdivided in the complex traffic data mixed with multiple blockchains, and unknown blockchain traffic is screened out; the transfer learning submodule is used to retrain the blockchain traffic identification model so that it can identify the above-mentioned unknown blockchain traffic. Therefore, the blockchain traffic identification model proposed in the present invention can detect the unknown blockchain traffic existing in the network, and actively and adaptively update its own model to achieve accurate identification of unknown blockchain traffic.

[0008] In order to achieve the above-mentioned object of the invention, the method proposed by the present invention specifically comprises the following steps:

[0009] S1. Build an Internet traffic acquisition module to capture network traffic in the Internet, and the traffic will be processed by the traffic feature extraction module.

[0010] S2. Construct a traffic feature extraction module. This module can process the network traffic captured by the Internet traffic acquisition module, extract certain features for each network traffic, and construct a two-dimensional matrix. The extracted features are related to the blockchain network communication mechanism (such as heartbeat mechanism, block broadcast mechanism, transaction broadcast mechanism). Specifically, for each network traffic S, extract the packet direction, length, timestamp, application layer data, lifetime, sequence number and other data, and transform the extracted data to construct a two-dimensional feature matrix I of size m×n.

[0011] S3. Construct and initialize a blockchain traffic identification model. The function of this model is to use the two-dimensional feature matrix I as input to determine whether the traffic represented by the two-dimensional feature matrix I is blockchain traffic. The blockchain traffic identification model consists of two parts. The first part is a classification sub-model M1, which is used to classify network traffic. The input is a two-dimensional feature matrix I of size m×n, and the output is an output matrix O1 of size 1×2, which satisfies

[0012] O1[0]+O1[1]=1

[0013] Among them, O1[0] and O1[1] represent the probability that the traffic S is ordinary traffic and blockchain traffic respectively. When O1[1]>0.5, the traffic is identified as blockchain traffic. The second part is the clustering sub-model M2. The second part is processed according to the output of the first part, and the network traffic S identified as belonging to the blockchain in O1 is merged into a set {S} (assuming the number of traffic is x), and the traffic feature extraction module is used to extract features of the network traffic in the set {S} to obtain the feature matrix set {I}. At this time, the dimension of the set {I} is x×m×n. The clustering sub-model M2 takes the set {i} as input and the matrix O2 of size x×1 as output, where O2 represents the clustering result of x blockchain traffic. The value of each row of O2 is an integer between the interval [0,y], which represents which type of blockchain traffic the traffic is clustered as by M2, where y represents the number of blockchain types that the set {S} can be divided into;

[0014] Model M1 can be composed of l matrix calculation layers, each layer contains a parameter matrix W, which is used to perform matrix operations. The calculation formula is

[0015]

[0016] Where level represents the number of matrix calculation layers. represents the output of the matrix a-th row and b-th column obtained after the calculation of the level layer, h and w represent the size of the row and column of the parameter matrix in the level-1 layer respectively, and W i,j represents the value of the i-th row and j-th column of the two-dimensional parameter matrix W of size h×w, represents the output of row a+i and column b+j after the calculation of level-1. In the first layer, A 0 It is represented by the two-dimensional feature matrix I of network traffic.

[0017] Model M2 calculates {I} according to the following formula and classifies blockchain traffic with similar characteristics into one category.

[0018] N Eps ={p,q∈I|dist(p,q) <Eps,

[0019] N Eps (P)>MinPts}

[0020] Where dist(p,q) represents the distance between the two-dimensional feature matrix I of any two traffic entities p and q, Eps represents the minimum distance between the two traffic entities p and q, and N EpsRepresents the number related to the traffic entity p. If for a traffic entity p, its ∈ neighborhood (i.e., the minimum distance Eps) contains at least MinPts points, then this point is considered to be a core point, and the traffic entity q whose distance to the core point p is less than Eps is considered to belong to the same category as entity p.

[0021] S4. Process each type of blockchain traffic output by M2. Specifically, for the above y types of blockchains, first screen out those that have not been discovered, add the corresponding traffic to the new set {S′}, and finally construct the traffic feature matrix set {I′}. Assume that its dimension is x′×m×n, copy model M1 to M3, use {I′} as the training set to update M3 to M′3, and use M′3 as the new classification model to replace M1.

[0022] S5. Use the Internet traffic acquisition module and the traffic feature extraction module to capture and extract features from the Internet traffic, create a test set, obtain the set {I″} and use it as the input of the classification sub-model M1, and use the output of M1 as the input of the clustering sub-model M2, and finally obtain the output of M2. Judge the accuracy, false alarm rate, and missed alarm rate of M1 and M2. If the accuracy, false alarm rate, and missed alarm rate reach the predetermined target, stop step S5 and obtain the final classification model M, otherwise return to S3 to continue training.

[0023] After obtaining the final classification model M, the final classification model M can be mounted in the security system as an independent identification module, and the network traffic is identified based on the network traffic obtained by the Internet traffic acquisition module and the network traffic features extracted by the traffic feature extraction module to determine whether the network traffic is blockchain traffic. If the traffic belongs to blockchain traffic, the anonymous blockchain node can be actively identified based on the feature data (such as IP address) in the network traffic packet.

[0024] The present invention identifies anonymous blockchain traffic based on the traffic generated in the Internet, and performs targeted feature acquisition, extraction, and construction based on blockchain traffic. In order to realize equal information sharing between nodes, blockchain will design a unique network communication mechanism, such as the heartbeat mechanism used between nodes to ensure normal communication, the block broadcast mechanism used by nodes to publish to the whole chain after packaging blocks, and the transaction broadcast mechanism used to unify the transaction format. In order to realize complete functions, each blockchain will complete the heartbeat mechanism, block broadcast mechanism, and transaction broadcast mechanism, and will generate unique network traffic, which can be used to determine whether there is blockchain traffic in the network. In addition, different blockchains have different implementation methods for the heartbeat mechanism, block broadcast mechanism, and transaction broadcast mechanism, and different blockchains have different implementation methods for the mechanism, which will cause the network traffic generated to be different, so network traffic can also be used to distinguish different blockchains and discover unknown blockchains.

[0025] The active identification method of anonymous blockchain nodes proposed in the present invention can be isolated from the actual production environment, so it will not affect the operating efficiency of the production or core work system; in addition, the method proposed in the present invention is independent of other security software and does not affect the accuracy and detection efficiency of other security software. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A flowchart of a blockchain traffic identification model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical scheme and advantages of the present invention clearer, the specific implementation of the present invention is described below in combination with the implementation mode and the accompanying drawings, so that those skilled in the art can better understand the present invention. It should be noted that the described embodiments are part of the embodiments of the present invention, not all of the embodiments, and are not intended to limit the scope of the invention claimed for protection. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] The anonymous blockchain traffic detection method in the Internet described in the present invention should include: an Internet traffic acquisition module, a traffic feature extraction module, and a training module for an anonymous blockchain traffic identification model. To implement the anonymous blockchain traffic identification model, it should include: a training set, a test set, and a training model. The training set and the test set should include normal traffic in the Internet, known blockchain traffic, and unknown blockchain traffic.

[0029] For the Internet traffic acquisition module described in the present invention, the traffic is captured in the Internet, and the traffic will be processed by the traffic feature extraction module.

[0030] For the traffic feature extraction module of the present invention, according to the characteristics of the blockchain, the data in the traffic is extracted at the traffic packet level for its node discovery, block broadcast and other behaviors, and the data is converted into a feature matrix. The traffic feature extraction module can convert all traffic in the network, including normal traffic, and use it as the training set and test set of the blockchain traffic identification model. The traffic features and mapping values ​​collected by the traffic feature extraction module of this embodiment are shown in Table 1.

[0031] Table 1 Traffic characteristics and mapping values

[0032] Selected Fields Mapping Values Package direction 1bit Timestamp 16Byte Application layer data 120KB IP packet length 4Byte Flags and fragment offsets 4Byte Survival time 4Byte Serial Number 4Byte Emergency pointer valid flag 1bit push data flag 1bit Window size 4Byte

[0033] The blockchain traffic identification model described in the present invention is composed of three submodules: a normal traffic and blockchain traffic classification submodule, a blockchain traffic clustering submodule, and a transfer learning submodule. The normal traffic and blockchain traffic classification submodule is used to perform coarse-grained classification of traffic in the network to screen out the blockchain traffic existing in the network. The blockchain traffic can contain several different blockchains, including known or public blockchains and private or anonymous blockchains; the blockchain traffic clustering submodule is used to cluster the above-screened blockchain traffic, and according to its matrix features in the above-mentioned traffic feature extraction module, each blockchain traffic is subdivided in the complex traffic data mixed with multiple blockchains, and unknown blockchain traffic is screened out; the transfer learning submodule is used to retrain the blockchain traffic identification model so that it can identify the above-mentioned unknown blockchain traffic. Therefore, the blockchain traffic identification model proposed in the present invention can detect the unknown blockchain traffic existing in the network, and actively and adaptively update its own model to achieve accurate identification of unknown blockchain traffic.

[0034] like Figure 1 As shown, the implementation method of the blockchain traffic identification model includes the following steps:

[0035] S1. Build an Internet traffic acquisition module to capture network traffic in the Internet.

[0036] S2. Construct a traffic feature extraction module. This module can process the network traffic provided by the Internet traffic acquisition module, extract certain features for each network traffic, and construct a two-dimensional matrix. The extracted features are related to the blockchain network communication mechanism (such as heartbeat mechanism, block broadcast mechanism, transaction broadcast mechanism). Specifically, for each network traffic S, extract the packet direction, length, timestamp, application layer data, lifetime, sequence number and other data, and convert the extracted data to construct a two-dimensional feature matrix I of size 50×76.

[0037] S3. Construct and initialize a blockchain traffic identification model. The function of this model is to use the feature matrix I described in S1 as input to determine whether the traffic represented by the feature matrix I is blockchain traffic. The blockchain traffic identification model consists of two parts. The first part is the classification sub-model M1, which is used to classify network traffic. The input is a two-dimensional feature matrix I of size 50×76, and the output is an output matrix O1 of size 1×2, which satisfies

[0038] O1[0]+O1[1]=1

[0039] Where O1[0]+O1[1] represents the probability that the traffic S is ordinary traffic and blockchain traffic respectively. When O1[1]>0.5, the traffic is identified as blockchain traffic. The second part is the clustering sub-model M2. The second part processes according to the output of the first part, merges the network traffic S identified as belonging to the blockchain in O1 into a set {S} (assuming the number of traffic is x), and extracts features from the network traffic in the set {S} according to the traffic feature extraction module constructed by S1., and obtains the feature matrix set {I} (assuming the number of traffic is 1000). At this time, the dimension of the set {I} is 1000×50×76. The clustering sub-model M2 takes the set {I} as input and the matrix O2 of size 1000×1 as output, where O2 represents the clustering result of x blockchain traffics. The value of each row of O2 is an integer between the interval [0,6], representing which blockchain traffic the traffic is clustered as by M2, where 6 represents the number of blockchain types that the set {S} can be divided into;

[0040] Model M1 can be composed of 8 matrix calculation layers, each of which contains a parameter matrix W to perform matrix operations. The calculation formula is

[0041]

[0042] Where level represents the number of matrix calculation layers. represents the output of the matrix a-th row and b-th column obtained after the calculation of the level layer, h and w represent the size of the row and column of the parameter matrix in the level-1 layer respectively, represents the output of row a+i and column b+j after the calculation of level-1. In the first layer, A 0 It is represented by the two-dimensional feature matrix I of network traffic.

[0043] Model M2 calculates {I} according to the following formula and classifies blockchain traffic with similar characteristics into one category.

[0044] N Eps ={p,q∈I|dist(p,q) <Eps,

[0045] N Eps (P)>MinPts}

[0046] Where dist(p,q) represents the distance between the feature matrices I of any two traffic entities p and q (which can be 0.1 here), Eps represents the minimum distance between the two traffic entities p and q, and N EpsRepresents the number related to the traffic entity p. If for a traffic entity p, its ∈ neighborhood (i.e., the minimum distance Eps) contains at least MinPts points, then this point is considered a core point, and the traffic entity q whose distance from the core point p is less than Eps is considered to belong to the same category as entity p. In this example, there are 6 core points, representing that the traffic set {S} is divided into 6 types of blockchain traffic, and the 6 types of traffic are represented by integers in the interval [0,6].

[0047] S4. Process each of the 6 types of blockchain traffic output by M2. Specifically, for the above 6 blockchains, first screen out the ones that have not been discovered, add the corresponding traffic to the new set {S′}, and finally construct the traffic feature matrix set {I′}, assuming its dimension is 100×50×76, copy model M1 to M3, use {I′} as the training set to update M3 to M′3, and use M′3 as the new classification model to replace M1.

[0048] S5. Use the Internet traffic acquisition module and the traffic feature extraction module to capture and extract features from the Internet traffic, create a test set, obtain the set {I″} and use it as the input of the classification sub-model M1, and use the output of M1 as the input of the clustering sub-model M2, and finally obtain the output of M2. Judge the accuracy, false alarm rate, and missed alarm rate of M1 and M2. If the accuracy, false alarm rate, and missed alarm rate reach the predetermined target (such as the accuracy is higher than 95%, and the false alarm and missed alarm rates are not higher than 0.1%), stop step S5 and obtain the final classification model M, otherwise return to S3 to continue training.

[0049] After obtaining the final classification model M, M can be mounted in the security system as an independent identification module, and the network traffic can be identified based on the network traffic obtained by the Internet traffic acquisition module and the network traffic features extracted by the traffic feature extraction module to determine whether the network traffic is blockchain traffic. If the traffic belongs to blockchain traffic, the anonymous blockchain node can be actively identified based on the feature data (such as IP address) in the network traffic packet.

[0050] In summary, the present invention obtains the traffic in the Internet in real time, determines whether the traffic starts from blockchain traffic based on the feature matrix obtained by mapping the traffic feature extraction module, and then clusters and identifies the traffic. For unknown traffic, this method uses its feature matrix and uses the transfer learning method to retrain the classification model so that it can identify the unknown blockchain obtained. This method can actively and adaptively update the traffic classification model, and efficiently and accurately identify unknown and anonymous blockchains without affecting the correctness and efficiency of the main system.

[0051] Through the above discussion, those skilled in the art can clearly understand the implementation method of the present method, which can be implemented with the help of the general hardware platform required by the system. Based on this understanding, the technicians can use a suitable development environment to implement the invention. In the implementation process, the objective function category of the model optimization can be selected according to the data characteristics of the system to be tested. The flow feature extraction method of this embodiment is as follows: Figure 1 As shown, those skilled in the art may adopt other traffic feature extraction methods; those skilled in the art may collect traffic for blockchain traffic data including but not limited to heartbeat mechanism, and those skilled in the art may use other technologies or omit or merge some modules to achieve the same effect.

[0052] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A method for actively identifying anonymous blockchain nodes, characterized in that: The method comprises the following steps: S1. Build an Internet traffic acquisition module to capture network traffic in the Internet; S2. Construct a traffic feature extraction module, which processes the network traffic captured by the Internet traffic acquisition module, extracts features for each network traffic, and constructs a two-dimensional matrix. The extracted features are related to the blockchain network communication mechanism. For each network traffic S, extract the packet direction, length, timestamp, application layer data, lifetime, and sequence number data, and transform the extracted data to construct a two-dimensional feature matrix I of size m×n; S3. Construct and initialize a blockchain traffic identification model. The function of the model is to use the two-dimensional feature matrix I as input to determine whether the traffic represented by the two-dimensional feature matrix I is blockchain traffic. The blockchain traffic identification model consists of two parts. The first part is a classification sub-model M1, which is used to classify network traffic. The input is a two-dimensional feature matrix I of size m×n, and the output is an output matrix O1 of size 1×2, which satisfies O1[0]+O1[1]=1 Where O1[0] and O1[1] represent the probability that the traffic S is ordinary traffic and blockchain traffic respectively. When O1[1]>0.5, the traffic is considered to be blockchain traffic. The second part is the clustering sub-model M2. The second part is processed according to the output of the first part, and the network traffic S identified as belonging to the blockchain in O1 is merged into a set {S}. Assuming that the number of traffic is x, the traffic feature extraction module is used to extract features of the network traffic in the set {S} to obtain a feature matrix set {I}. At this time, the dimension of the set {I} is x×m×n. The clustering sub-model M2 takes the set {I} as input and the matrix O2 of size x×1 as output, where O2 represents the clustering result of x blockchain traffic. The value of each row of O2 is an integer between the interval [0, y], which represents which blockchain traffic the traffic is clustered into by M2, where y represents the number of blockchain types that the set {S} can be divided into; Model M1 can be composed of l matrix calculation layers, each layer contains a parameter matrix W, which is used to perform matrix operations. The calculation formula is: Where level represents the number of matrix calculation layers. represents the output of the matrix a-th row and b-th column obtained after the calculation of the level layer, h and w represent the size of the row and column of the parameter matrix in the level-1 layer respectively, and W i,j represents the value of the i-th row and j-th column of the two-dimensional parameter matrix W of size h×w, represents the output of row a+i and column bi+j after the calculation of level-1. In the first layer, A 0 It is represented by the two-dimensional characteristic matrix I of network traffic; Model M2 calculates {I} according to the following formula, classifying blockchain traffic with similar characteristics into one category: N Eps ={p,q∈I|dist(p,q)<Eps, N Eps (P)>MinPts} Where dist(p,q) represents the distance between the two-dimensional feature matrix I of any two traffic entities p and q, Eps represents the minimum distance between the two traffic entities p and q, and N Eps Represents the number related to the traffic entity p; if for a traffic entity p, its ∈ neighborhood contains at least MinPts points, then this point is considered to be a core point, and the traffic entity q whose distance to the core point p is less than Eps is considered to belong to the same category as entity p; S4. Process each blockchain traffic output by M2. For the above y blockchains, first filter out the ones that have not been discovered, add the corresponding traffic to the new set {S′}, and finally construct the traffic feature matrix set {I′}. Assume that its dimension is x′×m×n, copy model M1 to M3, use {I′} as the training set to update M3 to M′3, and use M′3 as the new classification model to replace M1; S5. Use the Internet traffic acquisition module and the traffic feature extraction module to capture and extract features from the Internet traffic, make a test set, obtain the set {I″} and use it as the input of the classification sub-model M1, and use the output of M1 as the input of the clustering sub-model M2, and finally obtain the output of M2; judge the accuracy, false alarm rate, and missed alarm rate of M1 and M2. If the accuracy, false alarm rate, and missed alarm rate reach the predetermined target, stop step S5 and obtain the final classification model M, otherwise return to S3 to continue training; The final classification model M is mounted as an independent identification module in the security system. Based on the network traffic obtained by the Internet traffic acquisition module and the network traffic features extracted by the traffic feature extraction module, the network traffic is identified to determine whether the network traffic is blockchain traffic. If the traffic belongs to blockchain traffic, the anonymous blockchain node is actively identified based on the feature data in the network traffic packet.

2. The method for actively identifying anonymous blockchain nodes according to claim 1, characterized in that: The blockchain network communication mechanism described in step S2 specifically includes a heartbeat mechanism, a block broadcast mechanism, and a transaction broadcast mechanism.

3. The method for actively identifying anonymous blockchain nodes according to claim 2, characterized in that: The characteristic data in the network traffic packet is the IP address.

Images