Mining behavior detection method and device

Abstract

The embodiment of the application provides a kind of mining behavior detection method, wherein the method comprises: the first computer equipment obtains data packet arrival time sequence, the data packet arrival time sequence includes the time that at least one data packet from target equipment arrives second computer equipment;The first computer equipment obtains block arrival time sequence, and the block arrival time sequence includes the time that at least one mining task arrives mining equipment;The first computer equipment judges the approximate degree of data packet arrival time sequence and block arrival time sequence in time;If the approximate degree is greater than or equal to the first threshold value of preset, determine that the target equipment is suspected mining equipment.The technical scheme of the application can be free from manual operation and maintenance, cover multiple mining scenarios, and can protect user privacy, with strong versatility.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of computer, in particular to a mining behavior detection method and device. BACKGROUND

[0002] Mining refers to the behavior of consuming computer resources for operation to achieve the purpose of earning digital cryptocurrencies. The computer participating in mining is called miner, and the computing resources owned by each miner are called computing power. The higher the ratio of the computing power of a single miner to the total computing power of all miners in the world, the higher the probability of the miner mining cryptocurrencies. In the early days, the number of miners participating in mining cryptocurrencies in the world was small, the total computing power was low, and the ratio of the computing power of a single miner to the total computing power of the world was high, so a single miner could mine cryptocurrencies with considerable benefits. With the continuous improvement of the number and computing power of global miners, the total computing power of the world is improved, and the probability of a single miner mining cryptocurrencies is reduced, making it difficult to obtain mining benefits. The emergence of a mining pool solves this problem. Multiple low-computing-power miners are connected to the mining pool through a network, the mining pool divides a mining task into multiple subtasks, each miner is responsible for a part of the subtasks, and the miners jointly complete a complete mining task. Finally, a single miner can obtain cryptocurrency rewards according to the contribution to the mining pool, i.e., the number of completed subtasks.

[0003] Malicious mining behavior refers to the use of computer resources to mine cryptocurrencies without authorization. Due to the continuous increase in the value of cryptocurrencies, attackers have gradually popularized the method of using victim computers for malicious mining to obtain benefits. As described above, since the computing power of a single victim computer is low, it cannot obtain benefits, so the attacker will connect the victim computer to the mining pool for mining to obtain benefits. Some current mining behavior detection methods require human intervention and have poor universality, and a model for one cryptocurrency often cannot be applied to other cryptocurrencies.

[0004] Therefore, how to construct a mining behavior detection method that is free of human operation and maintenance and has strong universality is a technical problem to be solved. SUMMARY

[0005] Embodiments of the present application provide a mining behavior detection method and device, which can be free of human operation and maintenance, cover multiple mining scenarios, protect user privacy, and have strong universality.

[0006] In a first aspect, a mining behavior detection method is provided. The method comprises: a first computer device obtaining a data packet arrival time sequence, the data packet arrival time sequence comprising times at which at least one data packet from a target device arrives at a second computer device; the first computer device obtaining a block arrival time sequence, the block arrival time sequence comprising times at which at least one mining task arrives at a mining device; the first computer device determining an approximation degree of the data packet arrival time sequence and the block arrival time sequence in time; and if the approximation degree is greater than or equal to a preset first threshold, determining that the target device is a suspected mining device.

[0007] It should be understood that the second computer device is any one of the computer devices to be detected, and if it is determined that the target device is a suspected mining device, it is considered that the second computer device has a suspected mining behavior.

[0008] Optionally, the data packet arrival time can be a time at which the second computer device receives a data packet sent by the target device, or can be a time at which the second computer device receives the data packet sent by the target device according to a time at which a network device receives the data packet sent by the target device. The network device can be a switch or a router, etc.

[0009] Optionally, any one of the data packet arrival time sequence and the block arrival time sequence can be specified as a reference sequence, and the number of times in the reference sequence can be specified.

[0010] For example, the block arrival time sequence can be specified as the reference sequence, and if there is at least one data packet arrival time with a time difference from the block arrival time less than or equal to a preset threshold, it is determined that the block arrival time is aligned. The proportion of the number of aligned block arrival times to the total number of block arrival times in the block arrival time sequence is the approximation degree of the two sequences in time. When the approximation degree is greater than or equal to the first preset threshold, it is determined that the target device is a suspected mining device.

[0011] For example, the block arrival time sequence comprises 10 block arrival times, and 8 block arrival times are aligned, so that the approximation degree of the data packet arrival time sequence and the block arrival time sequence in time is 80%. If the preset first threshold is 70%, the approximation degree is greater than the preset first threshold, and it is determined that the target device is a suspected mining device.

[0012] Embodiments of the present application can obtain a block arrival time sequence and a data packet arrival time sequence, and determine whether a target device is a suspected mining device based on the block arrival time sequence and the data packet arrival time sequence. Not only does it not need to read the user network traffic content, but also it can achieve privacy protection, and it is highly versatile and applicable to all cryptocurrencies.

[0013] With reference to the first aspect, in some implementations of the first aspect, the first computer device obtains the data packet arrival time sequence by a single network connection between the target device and the second computer device.

[0014] It should be understood that the data packet arrival time sequence obtained by the first computer device can be obtained by a single network connection between the target device and the second computer device.

[0015] Embodiments of the present application obtain the data packet arrival sequence by a single network connection between the target device and the second computer device, and determine whether the target device is a suspected mining device based on the block arrival time sequence and the data packet arrival time sequence. Not only does it achieve privacy protection by not reading the user network traffic content, but it also improves the accuracy of the determination and is highly versatile, suitable for all cryptocurrencies.

[0016] With reference to the first aspect, in some implementations of the first aspect, the method further comprises: the first computer device obtaining a block height of a latest block; if the block height of the latest block is greater than a current block height, adding a current system time to the block arrival time sequence to obtain an updated block arrival time sequence, wherein the current block height is a block height corresponding to a latest time in the block arrival time sequence; and if the block height of the latest block is less than or equal to the current block height, the first computer device sleeps for a specified time, re-obtains the block height of the latest block, and updates the block arrival time sequence based on the re-obtained block height of the latest block.

[0017] Optionally, the first computer device can also obtain a block number of the latest block, and update the block arrival time sequence by comparing the block number of the latest block and a current block number, wherein the current block number is a block number corresponding to a latest time in the block arrival time sequence.

[0018] Embodiments of the present application update the block arrival time sequence by comparing the block height of the latest block and the current block height, and determine whether the target device is a suspected mining device based on the block arrival time sequence and the data packet arrival time sequence. Not only does it achieve privacy protection by not reading the user network traffic content, but it is also highly versatile and suitable for all cryptocurrencies.

[0019] With reference to the first aspect, in some implementations of the first aspect, the first computer device obtaining the block height of the latest block comprises: the first computer device sending a query request to the blockchain network, the query request being used to query the block height of the latest block in the blockchain network; and the first computer device receiving a first return request sent by the blockchain network, the first return request comprising the block height of the latest block in the blockchain network.

[0020] The embodiments of the present application can actively use a publicly accessible blockchain network to obtain the block height of the latest block, and update the block arrival time sequence based on the block height of the latest block. By using the block arrival time sequence and the data packet arrival time sequence, it is determined whether the target device is a suspected mining device. Not only the content of the user network traffic does not need to be read, but also privacy protection can be achieved, and the generality is strong and applicable to all cryptocurrencies.

[0021] With reference to the first aspect, in some implementations of the first aspect, before the first computer device obtains the block height of the latest block, the method further comprises: the first computer device joining a mining pool; and the first computer device obtaining the block height of the latest block comprises: the first computer device receiving a first mining task sent by a computer device in the mining pool, the first mining task comprising the block height of the latest block.

[0022] The embodiments of the present application obtain the block height of the latest block by joining a mining pool, and update the block arrival time sequence based on the block height of the latest block. By using the block arrival time sequence and the data packet arrival time sequence, it is determined whether the target device is a suspected mining device. Not only the content of the user network traffic does not need to be read, but also privacy protection can be achieved, and the generality is strong and applicable to all cryptocurrencies.

[0023] With reference to the first aspect, in some implementations of the first aspect, the method further comprises: the first computer device sending a mining request to the target device; the first computer device receiving a second return request of the target device; the first computer device determining whether the second return request conforms to the data characteristics of the mining pool protocol; if the second return request conforms to the data characteristics of the mining pool protocol, it is determined that the target device is the mining device; and if the second return request does not conform to the data characteristics of the mining pool protocol, it is determined that the target device is not the mining device.

[0024] It should be understood that, after the target device is determined to be a suspected mining device by the approximate degree of time of the data packet arrival time sequence and the block arrival time sequence, the target device can be further determined by the second return request.

[0025] It should be understood that the first computer device first establishes a network connection with the target device, and sends a mining request to the target device through the network connection.

[0026] Optionally, the first computer device can use any one or both of the transmission control protocol (TCP) and the transport layer security / secure sockets layer (TLS / SSL) protocol to connect with the Internet Protocol (IP) address and port of the target device, and if the connection is successful, a created network connection is obtained. It should be understood that there are many ways to establish a network connection, and one successful network connection is sufficient.

[0027] It should be understood that the mining pool protocol is a network protocol used for communication between the mining device and the mining pool, such as the Stratum protocol, the getwork protocol, and the getblocktemplate protocol.

[0028] Optionally, determining whether the second return request meets the data characteristics of the mining pool protocol can be a pattern matching method, such as a regular expression supported string matching. For example, hash* can match a string containing a hash string.

[0029] Optionally, determining whether the second return request meets the data characteristics of the mining pool protocol can also be a statistical feature based identification method. For example, the size of the data packet in the protocol, the frequency of character appearance, and the information entropy can be used to determine the mining pool protocol.

[0030] Optionally, determining whether the second return request meets the data characteristics of the mining pool protocol can also be an artificial intelligence or machine learning based identification method. For example, a mining protocol identification model can be trained.

[0031] The mining behavior detection method provided by the embodiments of the present application does not require human intervention, and only needs to initiate a network connection with the IP address and port of the target device to achieve second-level detection of a single IP address and port, automatically identify whether the target device is a mining device, and not only can avoid manual operation and maintenance, but also can protect data privacy.

[0032] In combination with the first aspect, in some implementations of the first aspect, the first computer device determines whether the second return request meets the data characteristics of the mining pool protocol, including: determining whether the data carried by the second return request contains the keywords of the mining pool protocol, and the keywords of the mining pool protocol include the block height, the mining task, and the seed hash.

[0033] For example, the mining pool protocol can be a Stratum protocol, and if the second return request contains a keyword of the Stratum protocol, it is determined that the target device is a mining device.

[0034] The embodiments of the present application support detection of TLS / SSL encrypted traffic. Since the mining request is initiated actively, the active initiator has the key to decrypt the TLS / SSL encrypted traffic, and can then detect the encrypted traffic. Compared with the privacy invasion method of passively detecting user data, the mining request of the embodiments of the present application is actively initiated, and therefore the data obtained does not belong to user privacy.

[0035] The mining behavior detection method provided by the embodiments of the present application determines whether the target device is a mining device by judging whether the return request conforms to the data characteristics of the mining pool protocol, which not only can avoid manual operation and maintenance, but also can protect data privacy.

[0036] In combination with the first aspect, in some implementations of the first aspect, the first computing device determining whether the second return request conforms to the data characteristics of the mining pool protocol further includes: determining whether a format of the second return request is a text format, and the text format includes a JSON format, a TXT format, a YAML format, or an XML format.

[0037] Optionally, it can also be judged whether the second return request is in a text format. If the return data not only includes a keyword of the mining pool protocol, but also is in a text format, such as a JSON format, a TXT format, a YAML format, or an XML format, then the probability that the IP address and the port are mining addresses is greater, and the probability that the target device is a mining device is also greater.

[0038] Since the mining pool has no authentication mechanism, any software can initiate a mining request to the mining pool, and the mining pool will return a mining task after receiving the request. The embodiments of the present application can actively send a mining request to a target device in the network, and if the target device returns mining task information, then the target device is determined to be a mining device.

[0039] The mining behavior detection method provided by the embodiments of the present application determines whether the target device is a mining device by judging whether the return request conforms to the data characteristics of the mining pool protocol and whether it is in a specific format, which is fast and accurate in detection, not only can avoid manual operation and maintenance, but also can protect data privacy.

[0040] In a second aspect, a mining behavior detection method is provided. The method comprises: a first computer device sending a mining request to a target device; the first computer device receiving a first return request from the target device; the first computer device determining whether the first return request conforms to a data feature of a mining pool protocol; and if the first return request conforms to the data feature of the mining pool protocol, determining that the target device is a mining device.

[0041] Optionally, the first computer device can use any one or both of TCP and TLS / SSL protocols to connect to the IP address and port of the target device, and if the connection is successful, a created network connection is obtained. It should be understood that there are various ways of network connection, and one successful network connection is sufficient.

[0042] It should be understood that the mining pool protocol is a network protocol used for communication between a mining device and a mining pool, such as a Stratum protocol, a getwork protocol, and a getblocktemplate protocol.

[0043] Optionally, determining whether the first return request conforms to the data feature of the mining pool protocol can be a pattern matching method, such as a regular expression supported string matching. For example, hash* can match a string containing a hash string.

[0044] Optionally, determining whether the first return request conforms to the data feature of the mining pool protocol can also be a statistical feature based recognition method. For example, the size of a data packet in the protocol, the frequency of character appearance, and information entropy can be used to determine the mining pool protocol.

[0045] Optionally, determining whether the first return request conforms to the data feature of the mining pool protocol can also be an artificial intelligence or machine learning based recognition method. For example, a mining protocol recognition model can be trained.

[0046] The mining behavior detection method provided by the embodiments of the present application does not require human intervention, and only needs to initiate a network connection with the IP address and port of the target device to achieve second-level detection of a single IP address and port, automatically identify whether the target device is a mining device, and not only can avoid human operation and maintenance, but also can protect data privacy.

[0047] In combination with the second aspect, in some implementations of the second aspect, the first computer device determines whether the first return request conforms to the data feature of the mining pool protocol, comprising: determining whether the data carried by the first return request contains a keyword of the mining pool protocol, wherein the keyword of the mining pool protocol comprises a block height, a mining task, and a seed hash.

[0048] For example, the mining pool protocol can be a Stratum protocol, and if the first return request contains a keyword of the Stratum protocol, the target device is determined to be a mining device.

[0049] The embodiments of the present application support detection of TLS / SSL encrypted traffic. Since the mining request is actively initiated, the active initiator has the key to decrypt the TLS / SSL encrypted traffic, and can then detect the encrypted traffic. Compared with the privacy invasion method of passively detecting user data, the mining request of the embodiments of the present application is actively initiated, and therefore the data obtained does not belong to user privacy.

[0050] The mining behavior detection method provided by the embodiments of the present application can determine whether the target device is a mining device by judging whether the return request conforms to the data characteristics of the mining pool protocol, and can not only save manual operation and maintenance, but also protect data privacy.

[0051] In combination with the second aspect, in some implementations of the second aspect, the first computing device determining whether the first return request conforms to the data characteristics of the mining pool protocol further includes: determining whether the format of the first return request is a text format, and the text format includes a JSON format, a TXT format, a YAML format, or an XML format.

[0052] Optionally, it can also be judged whether the first return request is in a text format. If the return data not only contains a keyword of the Stratum protocol, but also is in a text format, such as a JSON format, a TXT format, a YAML format, or an XML format, the probability that the IP address and the port are mining addresses is greater, and the probability that the target device is a mining device is also greater.

[0053] Since the mining pool has no authentication mechanism, any software can initiate a mining request to the mining pool, and the mining pool will return a mining task after receiving the request. The embodiments of the present application can actively send a mining request to a target device in the network, and if the target device returns mining task information, the target device is determined to be a mining device.

[0054] The mining behavior detection method provided by the embodiments of the present application can determine whether the target device is a mining device by judging whether the return request conforms to the data characteristics of the mining pool protocol and whether it is in a specific format, and is fast and accurate in detection, and can not only save manual operation and maintenance, but also protect data privacy.

[0055] With reference to the second aspect, in some implementations of the second aspect, the method further comprises: if the first return request does not conform to the characteristics of the mining pool protocol, the first computer device obtaining a data packet arrival time sequence, the data packet arrival time sequence comprising times at which at least one data packet from the target device arrives at the second computer device; the first computer device obtaining a block arrival time sequence, the block arrival time sequence comprising times at which at least one mining task arrives at the mining device; the first computer device determining an approximation degree in time between the data packet arrival time sequence and the block arrival time sequence; and if the approximation degree is greater than or equal to a first preset threshold, determining that the target device is the mining device.

[0056] It should be understood that when the first return request does not conform to the characteristics of the mining pool protocol, the target device can be further determined by calculating the approximation degree in time between the data packet arrival time sequence and the block arrival time sequence.

[0057] It should be understood that the second computer device is any one of the computer devices to be detected, and if it is determined that the target device is the mining device, it is considered that the second computer device has the mining behavior.

[0058] Optionally, the data packet arrival time can be a time at which the second computer device receives a data packet sent by the target device, or can be a time at which the second computer device receives the data packet sent by the target device predicted according to a time at which a network device receives the data packet sent by the target device. The network device can be a switch or a router, etc.

[0059] Optionally, any one of the data packet arrival time sequence and the block arrival time sequence can be designated as a reference sequence, and a number of times in the reference sequence can be designated.

[0060] Exemplarily, the block arrival time sequence can be designated as the reference sequence, and if there is at least one data packet arrival time with a time difference from the block arrival time less than or equal to a preset threshold, it is determined that the block arrival time is aligned. A proportion of a number of the aligned block arrival times to a total number of the block arrival times in the block arrival time sequence is the approximation degree in time between the two sequences. When the approximation degree is greater than or equal to the first preset threshold, it is determined that the network connection is related to the mining behavior, i.e., it is determined that an IP address and a port of the network connection are mining addresses, and the target device is the mining device.

[0061] For example, if the block arrival time sequence includes 10 block arrival times, 8 of which are aligned, then the approximation degree of the packet arrival time sequence and the block arrival time sequence in time is 80%. If the preset first threshold is 70%, the approximation degree is greater than the preset first threshold, and the target device is determined to be a mining device.

[0062] Embodiments of the present application can obtain a block arrival time sequence and a packet arrival time sequence, and determine whether the target device is a mining device based on the block arrival time sequence and the packet arrival time sequence. Not only does it not need to read the user network traffic content, but it also protects privacy, and it is highly versatile and applicable to all cryptocurrencies.

[0063] In combination with the second aspect, in some implementations of the second aspect, the first computer device obtains the packet arrival time sequence through a single network connection between the target device and the second computer device.

[0064] It should be understood that the packet arrival time sequence obtained by the first computer device can be obtained through a single network connection between the target device and the second computer device.

[0065] Embodiments of the present application obtain a packet arrival sequence through a single network connection between the target device and the second computer device, and determine whether the target device is a mining device based on the block arrival time sequence and the packet arrival time sequence. Not only does it not need to read the user network traffic content, but it also protects privacy, and it is highly versatile and applicable to all cryptocurrencies.

[0066] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the first computer device obtaining a block height of a latest block; if the block height of the latest block is greater than a current block height, adding a current system time to the block arrival time sequence to obtain an updated block arrival time sequence, wherein the current block height is a block height corresponding to a latest time in the block arrival time sequence; and if the block height of the latest block is less than or equal to the current block height, the first computer device sleeps for a specified time, re-obtains the block height of the latest block, and updates the block arrival time sequence according to the re-obtained block height of the latest block.

[0067] Optionally, the first computer device can also obtain a block number of a latest block, and update the block arrival time sequence by judging the size of the block number of the latest block and a current block number, wherein the current block number is a block number corresponding to a latest time in the block arrival time sequence.

[0068] The block arrival time sequence is updated by comparing the block height of the latest block and the current block height, and whether the target device is a mining device is determined based on the block arrival time sequence and the data packet arrival time sequence. Not only the user network traffic content does not need to be read, privacy protection can be achieved, but also the generality is strong, and it is applicable to all cryptocurrencies.

[0069] With reference to the second aspect, in some implementations of the second aspect, the first computer device acquires the block height of the latest block, including: the first computer device sends a query request to the blockchain network, the query request being used to query the block height of the latest block in the blockchain network; and the first computer device receives a second return request sent by the blockchain network, the second return request including the block height of the latest block in the blockchain network.

[0070] The block height of the latest block is acquired by actively using the publicly accessible blockchain network, and the block arrival time sequence is updated based on the block height of the latest block. Whether the target device is a mining device is determined based on the block arrival time sequence and the data packet arrival time sequence. Not only the user network traffic content does not need to be read, privacy protection can be achieved, but also the generality is strong, and it is applicable to all cryptocurrencies.

[0071] With reference to the second aspect, in some implementations of the second aspect, before the first computer device acquires the block height of the latest block, the method further includes: the first computer device joins a mining pool; and the first computer device acquires the block height of the latest block, including: the first computer device receives a first mining task sent by a computer device in the mining pool, the first mining task including the block height of the latest block.

[0072] The block height of the latest block is acquired by joining the mining pool, and the block arrival time sequence is updated based on the block height of the latest block. Whether the target device is a mining device is determined based on the block arrival time sequence and the data packet arrival time sequence. Not only the user network traffic content does not need to be read, privacy protection can be achieved, but also the generality is strong, and it is applicable to all cryptocurrencies.

[0073] In a third aspect, an embodiment of the present application provides a computer device, which includes units for implementing the first aspect or any possible implementation manner of the first aspect.

[0074] In a fourth aspect, an embodiment of the present application provides a computer device, which includes units for implementing the second aspect or any possible implementation manner of the second aspect.

[0075] In a fifth aspect, an embodiment of the present application provides a computer device, comprising a processor configured to couple with a memory, read and execute instructions and / or program codes in the memory to perform the first aspect or any possible implementation manner of the first aspect.

[0076] In a sixth aspect, an embodiment of the present application provides a computer device, comprising a processor configured to couple with a memory, read and execute instructions and / or program codes in the memory to perform the second aspect or any possible implementation manner of the second aspect.

[0077] In a seventh aspect, an embodiment of the present application provides a chip system, comprising a logic circuit configured to couple with an input / output interface, transmit data through the input / output interface to perform the first aspect or any possible implementation manner of the first aspect.

[0078] In an eighth aspect, an embodiment of the present application provides a chip system, comprising a logic circuit configured to couple with an input / output interface, transmit data through the input / output interface to perform the second aspect or any possible implementation manner of the second aspect.

[0079] In a ninth aspect, an embodiment of the present application provides a computer readable storage medium, which stores program codes, when the computer storage medium is run on a computer, causes the computer to perform the first aspect or any possible implementation manner of the first aspect.

[0080] In a tenth aspect, an embodiment of the present application provides a computer readable storage medium, which stores program codes, when the computer storage medium is run on a computer, causes the computer to perform the second aspect or any possible implementation manner of the second aspect.

[0081] In an eleventh aspect, an embodiment of the present application provides a computer program product, comprising: computer program codes, when the computer program codes are run on a computer, causes the computer to perform the first aspect or any possible implementation manner of the first aspect.

[0082] In a twelfth aspect, an embodiment of the present application provides a computer program product, comprising: computer program codes, when the computer program codes are run on a computer, causes the computer to perform the second aspect or any possible implementation manner of the second aspect.

[0083] The present application does not involve any digital currency mining calculation, does not generate any computing power consumption, and does not obtain any cryptocurrency income. BRIEF DESCRIPTION OF DRAWINGS

[0084] Figure 1 is a schematic diagram of a block structure provided by an embodiment of the present application.

[0085] Figure 2 is a schematic diagram of a blockchain network provided by an embodiment of the present application.

[0086] Figure 3 is a schematic diagram of a mining pool provided by an embodiment of the present application.

[0087] Figure 4 is a schematic diagram of a public mining pool direct connection scenario provided by an embodiment of the present application.

[0088] Figure 5 is a schematic diagram of a proxy direct forwarding scenario provided by an embodiment of the present application.

[0089] Figure 6 is a schematic diagram of a proxy secondary packaging scenario provided by an embodiment of the present application.

[0090] Figure 7 is a schematic diagram of an application scenario of a mining behavior detection device provided by an embodiment of the present application.

[0091] Figure 8 is an application architecture diagram of a mining behavior detection device provided by an embodiment of the present application.

[0092] Figure 9 is an exemplary flowchart of internal processing of a mining pool address automatic detection sub-module provided by an embodiment of the present application.

[0093] Figure 10 is a schematic diagram of a mining request provided by an embodiment of the present application.

[0094] Figure 11 is a schematic diagram of a return request provided by an embodiment of the present application.

[0095] Figure 12 is an exemplary flowchart of mining work performed by a mining pool provided by an embodiment of the present application.

[0096] Figure 13 is an exemplary flowchart of internal processing of a block monitoring sub-module provided by an embodiment of the present application.

[0097] Figure 14 is a schematic diagram of internal processing of a mining flow detection sub-module provided by an embodiment of the present application.

[0098] Figure 15 is an application architecture diagram of another mining behavior detection device provided by an embodiment of the present application.

[0099] Figure 16 is another exemplary flowchart of internal processing of a block monitoring submodule provided by an embodiment of the present application.

[0100] Figure 17 is a schematic diagram of internal processing of a mining flow detection submodule provided by an embodiment of the present application.

[0101] Figure 18 is a structural example diagram of a computer device provided by an embodiment of the present application.

[0102] Figure 19 is another structural example diagram of a computer device provided by an embodiment of the present application.

[0103] Figure 20 is an example diagram of a computer program product provided by an embodiment of the present application. DETAILED DESCRIPTION

[0104] A blockchain is a chain of validated blocks. Each block is connected to the previous one, all the way to the genesis block, which is the first block of the blockchain. Taking the underlying blockchain of Bitcoin as an example, Figure 1 is a schematic diagram of a block structure provided by an embodiment of the present application. A block includes a block header 000 and a block body 010. The version number indicates the validation rule followed by this block. The previous block hash is the hash value of the previous block obtained by hashing the block header of the previous block using the secure hash algorithm (SHA256). The root hash refers to the hash value of the Merkle tree root of the transaction in the block body, which is the value obtained by calculating each transaction in the block body 010 using SHA256. The timestamp refers to the approximate time when the block is created, accurate to the UNIX second timestamp. The random number refers to the random number obtained using the proof-of-work algorithm in Bitcoin. The target hash is the threshold required to verify whether the work reaches the threshold. The block body 010 is composed of the number of transactions and transactions.

[0105] Figure 2 is a schematic diagram of a blockchain network provided by an embodiment of the present application. The blockchain network 100 includes a mining pool 110, a mining pool 120, a mining pool 150, a mining pool 160, and a plurality of computer devices.

[0106] Figure 3 is a schematic diagram of a mining pool provided by an embodiment of the present application. The mining pool 110 includes a plurality of computer devices. The computer devices in the blockchain network can be referred to as miners, or computer nodes. For example, the computer device 130, the computer device 140, the computer device 111 to the computer device 116 are all miners.

[0107] Any computer device in the blockchain network 100 has the right to create a block. In the mining pool 110, it is usually the computer device in the mining pool 110 that is responsible for creating a block, which can be referred to as a miner, and then splits the block task to other miners in the mining pool 110 for mining. Illustratively, after the computer device 111 in the mining pool 110 creates a block, it splits a mining task into multiple sub-tasks, and then sends the sub-tasks to other miners in the mining pool. For example, one of the sub-tasks is sent to the computer device 111, and another sub-task is sent to the computer device 113. Each miner in the mining pool is responsible for a part of the sub-tasks, and jointly completes a complete mining task. Finally, individual miners can obtain rewards according to their contributions to the mining pool, i.e., the number of completed sub-tasks.

[0108] For the convenience of understanding the embodiments of the present application, first, some definitions involved in the present application are simply explained.

[0109] 1. Block creation time: the time when a block is created is the block creation time, which is recorded in the block header of the block. Illustratively, Figure 1 The timestamp in the block header 000 is the block creation time.

[0110] 2. Block addition time: the time when a block is added to the blockchain network is the block addition time. When a block is mined out and verified by the computer devices in the blockchain as valid and added to the blockchain network, the time when the block is added to the blockchain network is the block addition time. The block is mined out, which means that the miner has calculated a hash value that meets the requirements through hash operation. A block cannot be queried in the blockchain network before it is added to the blockchain network. That is, the block addition time cannot be accurately known. The embodiments of the present application synchronize all block information of the blockchain by joining the computer devices to the blockchain network. If it is detected that a new block is added to the blockchain, the current system time is recorded, and the current system time is used instead of the block addition time.

[0111] 3. Block arrival time: after the master of the mining pool creates a block, the mining sub-task containing the block information is sent to the miner through the network, and the time when the data packet containing the mining sub-task arrives at the miner is the block arrival time.

[0112] 4. Block height: refers to the number of blocks between a block and the genesis block in the blockchain network, in other words, the number of blocks between a block and the genesis block.

[0113] Next, the mining pool connection scenarios of three malicious mining behaviors will be introduced with reference to the drawings.

[0114] Figure 4 is a schematic diagram of a public mining pool direct connection scenario provided by the embodiments of the present application.

[0115] In such scenarios, malicious mining software connects to publicly accessible mining pools via the network to mine cryptocurrency. The network communication between the malicious mining software and the mining pool uses network protocols specifically designed for mining. Taking the Stratum protocol as an example, it is currently the most commonly used network protocol for communication between miners and mining pools. Currently, public mining pools support two data transmission methods: one is to transmit Stratum protocol data in plaintext, meaning the transmitted data is unencrypted; the other is to transmit Stratum protocol data via TLS / SSL, meaning the traffic data is encrypted.

[0116] Figure 5 This is a schematic diagram of a direct forwarding scenario provided in an embodiment of this application.

[0117] In this scenario, malicious mining software connects to a proxy server over the network, and the proxy server connects to a public mining pool. The proxy server forwards the network traffic data sent by the malicious mining software to the public mining pool without modification, and forwards the network traffic data returned by the public mining pool back to the malicious mining software without modification. In this scenario, the intermediate proxy server does not modify the traffic; it merely acts as a traffic relay node. Figure 4 Similar to the direct connection scenario of open mining pools, malicious mining software and proxy servers have two communication methods: Stratum plaintext and Stratum TLS / SSL, which correspond to the two cases of unencrypted traffic and encrypted traffic, respectively.

[0118] Figure 6 This is a schematic diagram of a proxy secondary encapsulation scenario provided in an embodiment of this application.

[0119] Unlike Figure 5 In scenarios where intermediate proxy servers directly forward data, they possess the ability to perform secondary encapsulation of network traffic data. Specifically, miners in a mining pool split a mining task into multiple mining tasks and distribute these split tasks. When a proxy receives a split mining task from a public mining pool, it further splits the task into multiple sub-tasks and distributes these sub-tasks to multiple malicious mining software programs. In this case, the communication method between the malicious mining software and the intermediate proxy server is not limited to the Stratum mining pool protocol and TLS encryption provided by the public mining pool; any protocol and encryption algorithm can be used to communicate with the malicious mining software.

[0120] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be described below. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work should fall within the protection scope of the present application.

[0121] Figure 7 is an application scenario diagram of a mining behavior detection device provided by an embodiment of the present application.

[0122] As shown in Figure 7 application examples of the mining behavior detection device include an internal network 400 and an external network 403. The internal network 400 includes a computer device 406, a network device 408 and a mining behavior detection device 401. The external network 403 includes an Internet 404 and a blockchain network 100. In some embodiments, the functions of the mining behavior detection device 401 can also be built into a switch, which is not limited in the present application.

[0123] The computer device 406 can be a server, a desktop computer, a tablet computer, a notebook computer, etc.

[0124] The network device 408 can be a switch or a router, etc.

[0125] The internal network 400 can be an enterprise or personal user network that needs to perform mining behavior detection. The computer device 406 of the internal network 400 will communicate with the external network 403 through the network device 408. The Internet 404 is a network for interacting with the outside when user business runs, and the Internet 404 can also include a blockchain network.

[0126] Network traffic is data transmitted on a network, and network traffic includes time information of data packets, size of inbound data packets, size of outbound data packets, direction of inbound data packets and direction of outbound data packets, etc. When network traffic passes through the network device 408, the network device 408 will copy a copy of the passing network traffic and send it to the mining behavior detection device 401. The copied network traffic can be referred to as bypass traffic.

[0127] Figure 8 is an application architecture diagram of a mining behavior detection device provided by an embodiment of the present application.

[0128] The mining behavior detection device 401 includes a blockchain data collection module 200, a network traffic collection module 210 and a detection module 220.

[0129] The blockchain data collection module 200 includes a blockchain node process submodule 202 and a block monitoring submodule 204. The network traffic collection module 210 includes a traffic cache submodule 212 and an IP address and port record submodule 214. The detection module 220 includes a mining traffic detection submodule 222 and a mining pool address automatic detection submodule 224.

[0130] The blockchain node process submodule 202 is responsible for synchronizing the block information of the blockchain network 100 to the local. Each cryptocurrency will provide an open source downloadable blockchain full node program, and the blockchain full node saves all data files of the blockchain network. The blockchain node process submodule 202 is connected to the blockchain network and provides a remote procedure call (RPC) interface for a third-party program to query the current blockchain network data by directly downloading and running the blockchain full node program from the network.

[0131] The block monitoring submodule 204 is responsible for querying the latest state of the block in the current blockchain network through the RPC interface to the blockchain node process submodule 202. For example, whether the specified block is mined. Then, according to the latest state of the block, the block addition time is obtained and stored in the block addition time database 240.

[0132] The network traffic collection module 210 processes the input bypass traffic to obtain a to-be-detected data packet sequence 250 and a to-be-detected IP address and port 260.

[0133] The traffic cache submodule 212 is responsible for extracting and recording the time when each data packet of each network connection arrives at the computer device 406 from the bypass traffic, and arranging them in chronological order to obtain the to-be-detected data packet sequence 250. The time when the data packet arrives at the computer device 406 can be the time when the computer device 406 receives the data packet, or the time when the computer device 406 receives the data packet predicted according to the time when the network device 408 receives the data packet. For example, the time when the data packet arrives at the computer device 406 can be obtained by adding the transmission delay of the data packet from the network device 408 to the computer device 406 to the time when the network device 408 receives the data packet. Alternatively, the time when the data packet arrives at the computer device 406 can be obtained by adding the average transmission delay of the data packet from the network device 408 to other computer devices in the network to the time when the network device 408 receives the data packet.

[0134] The mining flow detection sub-module 222 is responsible for reading the packet arrival time of the packet sequence 250 to be detected and the block addition time in the block addition time database 240, and matching the packet arrival time sequence and the block addition time sequence. If the matching is successful, it is considered that the network flow is related to mining behavior, and the alarm information is output.

[0135] The IP address and port recording sub-module 214 is responsible for extracting all network connection IP addresses and ports from the bypass flow, and outputting the IP address and port data to be detected. Optionally, the IP address and port recording sub-module 214 can include a sequence, each row in the sequence exists in the form of a key-value pair, that is, <IP address and port, whether the IP address and port has been detected>. For example, if f2pool.com:13531 has not been detected, it is <f2pool.com:13531, 0>, 0 represents that the IP address and port has not been detected, and 1 represents that the IP address and port has been detected. The IP address and port that has not been detected is output as the IP address and port to be detected 260.

[0136] Optionally, a detection period can be set. For example, every hour, all IP addresses and ports in the IP address and port recording sub-module 214 are set to not detected, and a new round of detection is started.

[0137] Optionally, the IP addresses and ports in the IP address and port recording sub-module 214 can also be provided with priorities. If a to-be-detected IP address and port has a higher probability of being a mining pool address, the to-be-detected IP address and port has a higher priority. For example, long connections in network connections have a higher priority than short connections. The IP address and port information in the IP address and port recording sub-module 214 can be arranged in priority first and in time sequence second.

[0138] The mining pool address automatic detection sub-module 224 sends a mining request to the target device, judges whether the target device is a mining device according to the return information of the request, and outputs alarm information if it is.

[0139] Below, the application is based on the application architecture example shown in Figure 8 The interaction and workflow of each module are described in detail.

[0140] Figure 9 is an exemplary flowchart of the internal processing of a mining pool address automatic detection sub-module provided by an embodiment of the application.

[0141] 610, obtaining the IP address and port to be detected.

[0142] The IP address and port recording sub-module 214 extracts all the IP addresses and ports of network connections from the bypass traffic and outputs the IP address and port data to be detected. The mining behavior detection device 401 of the embodiments of the present application inputs the IP address and port data to be detected output by the IP address and port recording sub-module 214 into the network connection program.

[0143] For example, the IP address and port recording sub-module 214 outputs an IP address and port to be detected, f2pool.com:13531. The IP address and port to be detected is input into the network connection program.

[0144] 620, a connection is established with the target device.

[0145] The IP address and port of the target device are the IP address and port obtained in 610. Alternatively, the connection can be made in any one of TCP (i.e. in plaintext) and TLS / SSL (i.e. in cipher text) or both, and if the connection is successful, a created network connection is obtained. It should be understood that the network connection can be made in multiple ways, and only one successful network connection is needed.

[0146] For example, the IP address and port of the target device are f2pool.com:13531. The connection can be attempted to be initiated to f2pool.com:13531 in TCP and TLS / SSL respectively, and since f2pool.com:13531 does not support the TLS / SSL communication mode, the TLS / SSL connection fails, and finally only a created TCP network connection is obtained.

[0147] 630, a mining request is sent to the target device.

[0148] For example, Figure 10 is a schematic diagram of a mining request provided by the embodiments of the present application. The mining request is in JSON (javascript object notation) format, which is a lightweight data exchange format in the form of key-value pairs. The mining request contains fields such as the wallet address (login field) and the mining algorithm (algo field).

[0149] 640, a return request from the target device is received.

[0150] After sending the mining request to the target device, a return request from the target device is received. For example, Figure 11 is a schematic diagram of a return request provided by the embodiments of the present application, which shows the data returned by the target device with the IP address and port f2pool.com:13531.

[0151] 650, return whether the request meets the data characteristics of the mining pool protocol.

[0152] Alternatively, it can be determined by returning whether the request contains the keyword of the mining pool protocol. For example, if the mining pool protocol is the Stratum protocol, the keyword can be the block height height, the mining task job, etc. Alternatively, it can also be determined whether the returned data is in text format, such as JSON format, TXT format, YAML format or XML format. If the return request not only includes the keyword of the Stratum protocol, but also is in text format, the probability of the target device being a mining device is greater. For example, Figure 8 The return request of the target device in the embodiment of the application meets the JSON format and includes the mining task job, and also includes the block height height, the task number job_id, the seed hash seed_hash and the task target target, etc. Therefore, it is determined that the target device is a mining device.

[0153] The way of identifying the mining protocol can also use a pattern matching based method, such as a regular expression supported string matching. For example, hash* indicates that it can match a string containing the hash string.

[0154] The way of identifying the mining protocol can also be a statistical feature based identification method. For example, the size of the data packet in the protocol, the frequency of character appearance, information entropy, etc. can be used to determine the mining pool protocol.

[0155] The way of identifying the mining protocol can also be an artificial intelligence or machine learning based identification method. For example, a mining protocol identification model can be trained.

[0156] If the received return request meets the mining pool protocol format, step 660 is performed.

[0157] 660, output alarm information.

[0158] Determine that the target device is a mining device, and output alarm information.

[0159] For example, the alarm information can be the security alarm information collected by the security software used by the user device.

[0160] Since the mining pool has no authentication mechanism, any software can initiate a mining request to the mining pool, and the mining pool will return a mining task after receiving the request. The embodiment of the application can actively send a mining request to the target device in the Internet 404. If the target device returns the mining task information, it is determined that the target device is a mining device, otherwise, it is determined to be a non-mining device.

[0161] The internal processing of the mining pool address automatic detection submodule 224 of the embodiment of the application is applicable toFigure 4 the disclosed mining pool direct connection scenario and Figure 5 the proxy direct forwarding scenario of the disclosure, support Stratum TLS / SSL encrypted traffic scene detection, without manual intervention, fast detection speed, only need to initiate a network connection, can realize the second level detection of single IP address and port, automatically identify whether the target device is a mining device, not only can avoid manual operation and maintenance, but also can protect data privacy.

[0162] In order to make up for the shortcomings of the internal processing of the mining pool address automatic detection sub module 224 that does not support the proxy secondary encapsulation scenario of the disclosure Figure 6 , the mining flow detection sub module 222 provided by the embodiment of the present application supports the detection of mining behavior in the scene of custom protocol / encryption algorithm. Figure 6

[0163] In order to facilitate understanding of the internal processing flow of the mining flow detection sub module 222 of the embodiment of the present application, first of all, the process of mining work of the mining pool involved in the present application is simply explained.

[0164] Taking the mining process of Bitcoin as an example, when the mine owner of the mining pool creates a new block, a random number needs to be found together with some information of the block header of the latest block in the blockchain network, such as timestamp, root hash, etc. to calculate a hash value. The Bitcoin protocol has a difficulty requirement for this hash value, such as the first several bits of the hash value must be zero. Therefore, before the block is packaged and added to the blockchain network, the random number must be tried a lot, and the hash calculation is carried out continuously, so as to calculate the hash value that meets the difficulty condition. Mining is the process of retrying the random number to calculate the hash value that meets the difficulty condition. Only when the hash value of the block meets the difficulty condition, it will be recognized and accepted by other miners in the blockchain network, and then the transaction fee and Bitcoin reward will be obtained.

[0165] Mining task splitting refers to that the mine owner of the mining pool splits the random number into multiple ranges of random numbers, and distributes these split random numbers to the miners in the mining pool for mining. As long as one miner in the whole mining pool calculates the hash value that meets the difficulty condition, the mining pool can package the block and add it to the blockchain network to obtain the reward.

[0166] The behavior of the mining program must be synchronized with the state of the blockchain network. For example, once a new block is mined, the latest block has been added to the blockchain network. All mining programs will abandon the existing block and start mining the next block. Since the blockchain network has the characteristics of decentralization, each computer device in the blockchain network can access the information of the entire blockchain.

[0167] Figure 12 ​is an exemplary flowchart of a mining pool performing mining work, provided by an embodiment of the present application.

[0168] The mining work performed by the mining pool can be divided into mining work performed by the mining pool side 180 and mining work performed by the miner side 190. It should be understood that, Figure 12 The work performed by the mining pool side can be regarded as the work performed by a selected computer device in the mining pool.

[0169] S101, the mining pool accesses the blockchain network to query the latest block N added to the blockchain network.

[0170] The mining pool will be connected to the blockchain network to query the latest block N in the blockchain network at this time, N is a positive integer greater than or equal to 1.

[0171] S102, the mining pool obtains a new block N+1.

[0172] It should be understood that the new block N+1 is created by a designated computer device in the mining pool. In order to optimize the mining speed, the mining pool may create the block N+1 before step S101 occurs, and directly obtain the created block at step S102, which means that there is a time difference between the creation time of the block and the arrival time of the block. If the mining pool does not create the block in advance, the block N+1 will be created at step S102.

[0173] S103, the mining pool splits the calculation target of the new block N+1 into multiple subtasks.

[0174] The miner in the mine is responsible for splitting the random number into multiple ranges of random numbers, and distributing these split random numbers to the miners in the mining pool for mining.

[0175] S104, the mining pool sends a network data packet to notify the miners of the subtask information of the new block N+1.

[0176] Exemplarily, the mining pool can send the mining subtask information of the new block N+1 to the miners through the Stratum network protocol.

[0177] S105, the miner receives the network data packet to obtain the subtask information of the new block N+1.

[0178] The time when the data packet containing the subtask information of the new block N+1 arrives at the miner is the block arrival time.

[0179] S106, the miner performs the subtask to find a hash value that meets the requirements, and sends the hash value to the mining pool after finding it.

[0180] The miner starts to perform hash calculation to mine block N+1. Once a valid hash value is found, i.e. the hash value meets the preset difficulty condition of the blockchain network, the hash value is sent back to the mining pool.

[0181] In S107, the mining pool verifies the validity of the hash value, and broadcasts block N+1 to the blockchain network if the hash value is valid.

[0182] After the mining pool receives the hash value, the mining pool first verifies the hash value. If the verification is successful, the mining pool broadcasts the valid hash value and block N+1 to all computer devices in the blockchain network. After the computer devices in the blockchain network receive the hash value and block N+1 and verify the validity of the block, the block is added to the blockchain network.

[0183] The mining flow detection submodule of the embodiment of the present application needs to compare the block arrival time sequence with the data packet arrival time sequence. As shown in Figure 12 The miner exchanges and synchronizes information with the blockchain network through the mining pool. Although the block information in the blockchain network is publicly accessible, only the block creation time is included in the block information, and the block arrival time is not included.

[0184] The internal processing of the mining flow detection submodule of the embodiment of the present application includes two cases. One is to use the block addition time as the block arrival time. The other is that the mining behavior detection device 401 can simulate the block arrival time, i.e. by joining the mining pool as a miner in the mining pool to receive the mining task information, and the time when the mining task information is received is the block arrival time.

[0185] Since the time when block N is added to the blockchain network in step S101 of the mining pool side 180 is close to the time when the network data packet is received in step S105 of the miner side 190 (i.e. the block arrival time), the time difference between the two is mainly composed of the network transmission time. This means that the block addition time of block N in step S101 can be used instead of the block arrival time when the network data packet is received in step S105. The embodiment of the present application connects the blockchain node process submodule 202 to the blockchain network 230 to simulate the process of step S101, and obtains the block addition time of block N in step S101 to replace the block arrival time of step S105.

[0186] Figure 13 is an exemplary flowchart of the internal processing of the block monitoring submodule provided by the embodiment of the present application. The block monitoring submodule 204 can obtain the block addition time and store the block addition time in the block addition time database 240.

[0187] 710, whether the RPC service of the blockchain node process submodule 202 is valid.

[0188] Detect whether the RPC service of the blockchain node process submodule 202 is started. If not, proceed to step 720, sleep for a period of time, and then execute step 710 again. After the RPC service of the blockchain node process submodule 202 is started, step 730 can be executed.

[0189] The computer nodes in the blockchain network can be divided into full nodes and light nodes. The full nodes can initiate or receive transactions, participate in the consensus of the blockchain, and have all the blockchain data. The light nodes can connect to the full nodes and access the blockchain data through the full nodes.

[0190] It should be understood that in the embodiments of the present application, the blockchain node process submodule 202 joins the blockchain network 100, and the blockchain node process submodule 202 is a full node and has complete blockchain data. The blockchain node process submodule 202 can also be a light node, that is, it can query the block information of the blockchain network from the full node in the blockchain network.

[0191] 720, sleep for a specified time.

[0192] Exemplarily, the sleep time can be specified as 0.1s. It should be understood that the shorter the specified sleep time is, the more accurate the obtained block addition time is.

[0193] 730, initialize the current block height current_height.

[0194] During the initialization process, when it is detected that the RPC service of the blockchain node process submodule 202 is started, the block monitoring submodule 204 sends an RPC request to the blockchain node process submodule 202 to query the latest block height in the blockchain network, and stores the latest block height in the variable current_height.

[0195] Exemplarily, during the initialization process, the block monitoring submodule 204 queries that the latest block height in the blockchain network is 2278260, and at this time the value of current_height is assigned as 2278260.

[0196] 740, query the block height latest_height of the latest block.

[0197] The block monitoring submodule 204 sends an RPC request to the blockchain node process submodule 202 to query the block height of the latest block in the blockchain network, and stores the block height of the latest block in the variable latest_height.

[0198] For example, the block monitoring submodule 204 queries the block height of the latest block in the blockchain network and obtains a value of 2278261. At this time, the value of latest height is set to 2278261.

[0199] 750, whether the latest height is greater than the current height.

[0200] It is determined whether the latest height is greater than the current height. If yes, it indicates that a new block has been mined in the blockchain network, and step 760 is performed. Otherwise, step 780 is performed.

[0201] For example, when the value of latest height is 2278261 and the value of current height is 2278260 at this time, it means that block 2278261 has been mined and added to the blockchain network. At this time, step 760 is performed to record the block addition time of block 2278261.

[0202] 760, the key-value pair <current timestamp, latest height> is stored in the database.

[0203] The key-value pair <current timestamp, latest height> is stored in the block addition time database 240 for subsequent detection. It should be understood that the current timestamp is the time of the current system, and the block addition time of the block with the block height of latest height is taken as the time when the block is added to the blockchain network in the embodiment of the present application.

[0204] For example, the system time of the current step 760 is taken as the block addition time of block 2278261, and the key-value pair <the system time of the current step 760, <2278261> is stored in the block addition time database 240.

[0205] 770, current height = latest height.

[0206] The current block height is updated to the block height of the latest block, that is, the value of latest height is assigned to current height.

[0207] For example, the current block height is 2278260, and the updated current block height is 2278261.

[0208] 780, sleep for a specified time.

[0209] After a period of hibernation, step 740 is executed again. Exemplarily, the hibernation time can be specified as 0.1s. It should be understood that the shorter the specified hibernation time is, the more accurate the obtained block addition time is.

[0210] It should be understood that in the embodiments of the present application, steps 710 and 720 are not necessary steps. It is also possible to directly query the block height of the latest block after initializing the current block height, and if the blockchain node process submodule 202 returns the query request, then directly proceed to step 750, and if the blockchain node process submodule 202 does not return the request within a specified time, then hibernate for a period of time and resend the query request for the block height of the latest block.

[0211] It should be understood that since there are always new blocks arriving in the blockchain network, the loop inside the block monitoring submodule 204 will continue until the mining behavior detection device 401 stops running.

[0212] Figure 14 FIG. 4 is a schematic diagram of the internal processing of a mining flow detection submodule provided by an embodiment of the present application.

[0213] When the block addition time is taken as the block arrival time, the input of the mining flow detection submodule 222 is the packet arrival time sequence and the block addition time sequence, and the output is the judgment of whether the network connection is related to mining behavior. The embodiments of the present application judge whether the network connection is related to mining behavior by calculating the degree of approximation of the packet arrival time sequence and the block addition time sequence on the time axis. If the degree of approximation is greater than or equal to a preset threshold, it is considered that the network connection is related to mining behavior.

[0214] In order to calculate the degree of approximation of the packet arrival time sequence and the block addition time sequence on the time axis, first, a time sequence needs to be selected as a reference, and the number of times in the reference sequence needs to be determined, then a first threshold and a second threshold are set to judge whether the network connection is related to mining behavior.

[0215] Optionally, any one of the packet arrival time sequence and the block addition time sequence can be specified as the reference sequence, and the number of times in the reference sequence can be specified.

[0216] Exemplarily, as shown in FIG. 4, the packet arrival time sequence is taken as the reference sequence, and the number of times in the reference sequence is specified as 1000. Figure 14As shown, the block addition time sequence can be taken as a reference sequence, which includes 18 block addition times numbered 2278259 to 2278276. If the time difference between the arrival time of at least one data packet and the block addition time is less than or equal to the first preset threshold, it is determined that the block addition time is aligned. The ratio of the number of aligned block addition times to the total number of block addition times in the block addition time sequence is the approximation degree of the two sequences. When the approximation degree is greater than or equal to the second preset threshold, it is determined that the network connection is related to mining behavior, that is, the IP address and port of the network connection are determined to be mining addresses.

[0217] Exemplarily, the first preset threshold can be 0.8s, 0.9s or 1s, and the second preset threshold can be 80%, 90% or 100%.

[0218] It should be understood that the value range of the first preset threshold and the second preset threshold also depends on the type of cryptocurrency. Exemplarily, for Monero, the value range of the first preset threshold can be 0.5 to 1 second, and the value range of the second preset threshold can be 80% to 100%.

[0219] As shown by formula (1), m is the number of aligned block addition times, n is the total number of block addition times in the block addition time sequence, and p is the approximation degree of the two sequences. Exemplarily, if there are 15 aligned block addition times and the second preset threshold is 80%, then p is about 83%, which is greater than the second preset threshold, and it is determined that the network connection at this time is related to mining behavior.

[0220]

[0221] The mining flow detection method provided by the embodiments of the present application can actively use the publicly accessible blockchain network to obtain the addition time of each block, and take the block addition time as the block arrival time of the mining data packet, and finally determine whether the target device is a mining device. The embodiments of the present application are not only suitable for the public mining pool direct connection scene of Figure 4 and the proxy direct forwarding scene of Figure 5 , but also suitable for the proxy secondary encapsulation scene of Figure 6 . Not only does it not need to read the user network flow content, but also it can protect privacy, and it is highly versatile and suitable for all cryptocurrencies.

[0222] Figure 15 is an application architecture diagram of another mining behavior detection device provided by the embodiments of the present application. When the mining behavior detection device 401 simulates to obtain the block arrival time, that is, by joining the mining pool as a miner in the mining pool to receive the mining task information, the blockchain data collection module 200 includes a mining software process submodule 203 and a block monitoring submodule 204.

[0223] The mining software process submodule 203 is responsible for receiving network data packets sent by the mining pool 280 and outputting the latest mining task information. It should be understood that the mining software process submodule 203 at this time can be regarded as a miner simulated by the embodiment of the application, that is, the mining software process submodule 203 at this time can receive the mining subtask sent by the mining pool 280, but does not execute the subtask.

[0224] The block monitoring submodule 204 monitors whether the mining software process submodule 203 outputs new mining task information. The time when the new task information output by the mining software process submodule 203 is monitored is the block arrival time, and the block arrival time and the block height in the mining task information are stored in the block arrival time database 290.

[0225] Figure 15 The remaining modules are the same as in Figure 8 The application will not be repeated.

[0226] Figure 16 is another exemplary flowchart of the internal processing of the block monitoring submodule provided by the embodiment of the application. The block monitoring submodule 204 can obtain the block arrival time and store the block arrival time in the block arrival time database 290.

[0227] 810, initialize the current block height current_height = 0.

[0228] In the initialization process, the current block height current_height is first assigned a value of 0.

[0229] 820, wait for the mining software process submodule to output task information.

[0230] After the block monitoring submodule 204 monitors that the mining software process submodule 203 outputs the mining task information, step 830 is executed.

[0231] 830, store the block number contained in the task information in latest_height.

[0232] Exemplarily, the block number contained in the task information is 2278261, and at this time the value of latest_height is assigned as 2278261.

[0233] 840, whether latest_height is greater than current_height.

[0234] It is judged whether the latest_height is greater than the current_height. If yes, it means that the network packet containing the new task has arrived at the miner device, and step 850 is executed. Otherwise, step 820 is executed.

[0235] Exemplarily, when the value of the latest_height is 2278261 and the value of the current_height is 0 at this time, it means that the network packet containing the task information of the block 2278261 has arrived at the miner device, and step 850 is executed to record the block arrival time of the block 2278261.

[0236] 850, the key-value pair <current timestamp, latest_height> is stored into the database.

[0237] The key-value pair <current timestamp, latest_height> is stored into the block arrival time database 290 for subsequent detection. It should be understood that the current timestamp is the current system time, that is, the current system time is the block arrival time of the block task with the node number latest_height arriving at the miner device.

[0238] Exemplarily, the system time at this time of step 850 is taken as the block arrival time of the block 2278261, and the key-value pair <the system time at this time of step 850, <2278261> is stored into the block arrival time database 290.

[0239] 860, the current_height = latest_height.

[0240] The current block height is updated to the block height contained in the latest task, that is, the value of the latest_height is assigned to the current_height. After the assignment, step 820 is executed.

[0241] Exemplarily, the current block height is 0, and the updated current block height is 2278261.

[0242] It should be understood that, since there are always new blocks arriving in the block chain network, the loop processed inside the block monitoring submodule 204 will continue until the mining behavior detection device 401 is closed.

[0243] Figure 17 is another schematic diagram of internal processing of a mining flow detection submodule provided by the embodiment of the application.

[0244] The input of the mining traffic detection sub-module 222 at this time is the data packet arrival time sequence and the block arrival time sequence, and the output is a judgment of whether the network connection is related to mining behavior. The embodiment of the present application judges whether the network connection is related to mining behavior by calculating the degree of approximation of the data packet arrival time sequence and the block arrival time sequence on the time axis. If the degree of approximation is greater than or equal to a preset threshold, it is considered that the network connection is related to mining behavior.

[0245] In order to calculate the degree of approximation of the data packet arrival time sequence and the block arrival time sequence on the time axis, first of all, a time sequence needs to be selected as a reference, and the number of times in the reference sequence needs to be determined, then a first threshold and a second threshold are set to judge whether the network connection is related to mining behavior.

[0246] Alternatively, the user can specify any one of the data packet arrival time sequence and the block arrival time sequence as the reference sequence, and specify the number of times in the reference sequence.

[0247] Exemplarily, as shown in Figure 17 , the block arrival time sequence can be taken as the reference sequence, and the reference sequence includes 18 block addition times of node numbers 2278259 to 2278276. If the time difference between at least one data packet arrival time and the block arrival time is less than or equal to the first preset threshold, it is determined that the block arrival time is aligned. The ratio of the number of aligned block arrival times to the total number of block arrival times in the block arrival time sequence is the degree of approximation of the two sequences. When the degree of approximation is greater than or equal to the second preset threshold, it is judged that the network connection is related to mining behavior, that is, it is determined that the IP address and port of the network connection are mining addresses.

[0248] Exemplarily, the first preset threshold can be 0.8s, 0.9s or 1s, and the second preset threshold can be 80%, 90% or 100%.

[0249] It should be understood that the value range of the first preset threshold and the second preset threshold also depends on the type of cryptocurrency. Exemplarily, for Monero, the value range of the first preset threshold can be 0.5 to 1 second, and the value range of the second preset threshold can be 80% to 100%.

[0250] As shown in formula (2), m1 is the number of aligned block arrival times, n1 is the total number of block arrival times in the block arrival time sequence, and p1 is the degree of approximation of the two sequences. If there are 15 aligned block arrival times and the second preset threshold is 80%, then p1 is about 83% at this time, which is greater than the second preset threshold, and it is determined that the network connection at this time is related to mining behavior.

[0251]

[0252] The mining flow detection method provided by the embodiments of the present application can obtain the arrival time of each block, and determine whether the target device is a mining device based on the block arrival time and the arrival time of the network packet. The embodiments of the present application are not only applicable to the direct connection scenario of the disclosed mining pool in Figure 4 and the proxy direct forwarding scenario in Figure 5 , but also applicable to the proxy secondary packaging scenario in Figure 6 . Not only does it not need to read the content of the user network flow, but also it can protect privacy, and it is highly versatile and applicable to all cryptocurrencies.

[0253] Another technical solution in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0254] The embodiments of the present application first obtain the packet arrival time sequence and the block arrival time sequence, and then determine the degree of approximation of the two in time, and determine whether the target device is a suspected mining device according to the degree of approximation of the two.

[0255] The way to obtain the packet arrival time sequence can refer to Figure 8 The flow cache submodule 212 is responsible for extracting and recording the time of each packet of each network connection arriving at the computer device 406 from the bypass flow, and arranging them in time order to obtain the to-be-detected packet sequence 250.

[0256] There are two ways to obtain the block arrival time, one is to add the block time as the block arrival time, and the other is that the mining behavior detection device 401 can simulate the block arrival time, that is, by joining the mining pool as a miner in the mining pool to receive the mining task information, the time of receiving the mining task information is the block arrival time.

[0257] The embodiments of the present application update the block arrival time sequence by comparing the block height of the latest block and the current block height, wherein the current block height is the block height corresponding to the latest time in the block arrival time sequence. The block height of the latest block can be obtained by sending a query request to the block chain network or joining the mining pool as a miner in the mining pool to receive the mining task information. The specific process can refer to Figure 13 and Figure 16 , which will not be repeated here.

[0258] The specific process of determining the degree of approximation of the packet arrival time sequence and the block arrival time sequence can refer to Figure 14 and Figure 17 , and if the preset threshold condition is met, it is determined that the target device is a suspected mining device.

[0259] It should be understood that after determining that a target device is a suspected mining device by the time approximation between the data packet arrival time series and the block arrival time series, further confirmation can be made by actively sending mining requests to the target device.

[0260] The automated mining pool address detection submodule 224 sends a mining request to the target device. Based on the returned information from this request, it determines whether the target device is a mining device. If it is, it outputs an alarm message. For details on the implementation, please refer to [link to implementation details]. Figure 9 .

[0261] The above describes a mining behavior detection method according to embodiments of this application. The following sections will combine these methods with... Figure 18 and Figure 19 This application describes apparatus and devices according to embodiments thereof.

[0262] This application also provides a computer storage medium storing program instructions, which, when executed, may include, for example... Figure 9 , Figure 13 , Figure 14 , Figure 16 , Figure 17 Some or all of the steps of the mining behavior detection method in the corresponding embodiment.

[0263] Figure 18 This is a structural example diagram of a computer device provided in an embodiment of this application. The computer device 900 includes an acquisition module 910, a processing module 920, and a transmission module 930.

[0264] The acquisition module 910 is used to acquire the data packet arrival time sequence and block arrival time sequence, the IP address and port to be detected, the return request from the blockchain network, and the block height of the latest block, and then executes... Figure 9 610 and 640 in the method, Figure 13 740 in the method, Figure 16 820 in the method.

[0265] Processing module 920 is used to execute based on the data packet arrival time sequence, block arrival time sequence, the IP address and port to be detected, the return request from the blockchain network, and the block height of the latest block. Figure 9 , Figure 13 , Figure 14 , Figure 16 and Figure 17 Some or all of the steps in the method.

[0266] The sending module 930 is used to send query requests and mining requests to the blockchain network.

[0267] Figure 19Another structural example of a computer device 1300 is provided for the embodiments of the present application. The computer device 1300 includes a processor 1302, a communication interface 1303, and a memory 1304. One example of the computer device 1300 is a chip. Another example of the computer device 1300 is a computing device.

[0268] The method disclosed in the embodiments of the present application can be applied in the processor 1302 or implemented by the processor 1302. The processor 1302 can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. In the implementation process, each step of the above method can be completed by the integrated logic circuit of hardware in the processor 1302 or the instruction in the form of software. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware coding processor for execution, or a combination of hardware and software modules in the coding processor for execution.

[0269] The memory 1304 can be a volatile memory or a nonvolatile memory, or can include both volatile and nonvolatile memory. Among others, the nonvolatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EEPROM), or flash memory. The volatile memory can be random access memory (RAM) which is used as the external cache. By way of example, and not limitation, many forms of RAM are available, for example, static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct rambus RAM (DRRAM). It is noted that the memory described herein is intended to include, without being limited to, these and any other suitable types of memory.

[0270] The processor 1302, the memory 1304 and the communication interface 1303 can communicate through a bus. The memory 1304 stores executable code, and the processor 1302 reads the executable code in the memory 1304 to execute the corresponding method. The memory 1304 can also include software modules required by other running processes such as an operating system. The operating system can be LINUXTM, UNIXTM, WINDOWSTM, etc.

[0271] For example, the executable code in the memory 1304 is used to implement the method shown in Figure 9 , Figure 13 , Figure 14 , Figure 16 , Figure 17 The processor 1302 reads the executable code in the memory 1304 to execute the method shown in Figure 9 , Figure 13 , Figure 14 , Figure 16 , Figure 17 .

[0272] In some embodiments of the application, the disclosed methods can be implemented as computer program instructions encoded on a computer-readable storage medium in machine-readable format or on other non-transitory media or articles of manufacture. Figure 20 A conceptual partial view of an example computer program product arranged in accordance with at least some embodiments presented herein is shown schematically, the example computer program product including a computer program for executing a computer process on a computing device. In one embodiment, the example computer program product 1400 is provided using a signal-bearing medium 1401. The signal-bearing medium 1401 can include one or more program instructions 1402, which, when executed by one or more processors, can provide the functionality or some portion thereof described above with respect to the methods shown in Figure 9 、 Figure 13 、 Figure 14 、 Figure 16 、 Figure 17 , Figure 9 、 Figure 13 、 Figure 14 、 Figure 16 、 Figure 17 , for example, one or more features of the embodiments shown in

[0273] In some examples, the signal bearing medium 1401 can comprise a computer- readable medium 1403, such as, but not limited to, a hard disk drive, a compact disk (CD), a digital video disk (DVD), a memory, a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electronically erasable programmable read-only memory (EEPROM), a flash memory, and / or a solid-state drive (SSD). In some embodiments, the signal bearing medium 1401 can comprise a computer recordable medium 1404, such as, but not limited to, a floppy disk, a hard disk, a CD, a DVD, and / or a memory. In some embodiments, the signal bearing medium 1401 can comprise a communications medium 1405, such as, but not limited to, a digital and / or an analog communication medium (e.g., a fiber optic cable, a waveguide, a wired communication link, a wireless communication link, and / or the like). Thus, for example, the signal bearing medium 1401 can be a wireless form of communication media 1405 (e.g., a wireless communication medium conforming with the IEEE 802.11 standard, or another transmission protocol). The one or more program instructions 1402 can be, for example, computer-executable or machine-executable instructions. In some examples, the aforementioned computing device can be configured to provide various operations, functions, or actions in response to the program instructions 1402 conveyed to the computing device by one or more of the computer readable medium 1403, the computer recordable medium 1404, and / or the communications medium 1405. It will be appreciated that the arrangements described herein are for illustrative purposes only. As such, those skilled in the art will appreciate that other arrangements and other elements (e.g., machines, interfaces, functions, orders, and the like) can be used instead, and some elements can also be omitted altogether according to the desired results. Additionally, many of the described elements can be implemented as functional entities that can be realized as discrete or distributed components, or in conjunction with other components, in any suitable combination and location.

[0274] Those skilled in the art can clearly understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0275] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described systems, devices and units can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0276] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. The division of the units is merely logical function division. There can be other division manners in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0277] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0278] In addition, each functional unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can be a physically independent unit, or two or more units can be integrated into one unit.

[0279] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0280] The above is merely specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for detecting mining behavior, characterized in that, include: A first computer device acquires a data packet arrival time sequence, the data packet arrival time sequence including the time when at least one data packet from the target device arrives at a second computer device, the second computer device being the computer device to be detected; The first computer device acquires a block arrival time sequence, the block arrival time sequence including the time when at least one mining task arrives at the mining device; The first computer device determines the degree of temporal similarity between the data packet arrival time sequence and the block arrival time sequence; If the degree of approximation is greater than or equal to a preset first threshold, then the target device is determined to be a suspected mining device, and the second computer device is suspected of mining behavior.

2. The method according to claim 1, characterized in that, The first computer device acquires the data packet arrival time series, including: The first computer device obtains the data packet arrival time sequence through a single network connection between the target device and the second computer device.

3. The method according to claim 1 or 2, characterized in that, The method further includes: The first computer device obtains the block height of the latest block; If the block height of the latest block is greater than the current block height, then the current system time is added to the block arrival time sequence to obtain an updated block arrival time sequence, wherein the current block height is the block height corresponding to the latest time in the block arrival time sequence; If the block height of the latest block is less than or equal to the current block height, the first computer device will sleep for a specified time, then reacquire the block height of the latest block, and update the block arrival time sequence according to the reacquired block height of the latest block.

4. The method according to claim 3, characterized in that, The first computer device obtains the block height of the latest block, including: The first computer device sends a query request to the blockchain network, the query request being used to query the block height of the latest block in the blockchain network; The first computer device receives a first return request sent by the blockchain network, the first return request including the block height of the latest block in the blockchain network.

5. The method according to claim 3, characterized in that, Before the first computer device obtains the block height of the latest block, the method further includes: The first computer device is added to the mining pool; The first computer device obtains the block height of the latest block, including: The first computer device receives a first mining task sent by a computer device in the mining pool, the first mining task including the block height of the latest block.

6. The method according to claim 1 or 2, characterized in that, The method further includes: The first computer device sends a mining request to the target device; The first computer device receives the second return request from the target device; The first computer device determines whether the second return request conforms to the data characteristics of the mining pool protocol; If the second return request matches the data characteristics of the mining pool protocol, then the target device is determined to be the mining device; If the second return request does not conform to the data characteristics of the mining pool protocol, then it is determined that the target device is not the mining device.

7. The method according to claim 6, characterized in that, The first computer device determines whether the second return request conforms to the data characteristics of the mining pool protocol, including: Determine whether the data carried in the second return request contains keywords of the mining pool protocol, including block height, mining task, and seed hash.

8. The method according to claim 7, characterized in that, The first computer device further determines whether the second return request conforms to the data characteristics of the mining pool protocol by including: Determine whether the format of the second returned request is a text format, including JSON, TXT, YAML, or XML formats.

9. A computer device, characterized in that, include: The acquisition module is used to acquire the data packet arrival time sequence, which includes the time when at least one data packet from the target device arrives at the second computer device, the second computer device being the computer device to be detected; The acquisition module is also used to acquire a block arrival time sequence, which includes the time when at least one mining task arrives at the mining equipment. The processing module is used to determine the degree of temporal approximation between the data packet arrival time sequence and the block arrival time sequence; The processing module is specifically used to determine that if the degree of approximation is greater than or equal to a preset first threshold, the target device is a suspected mining device and the second computer device has suspected mining behavior.

10. The apparatus according to claim 9, characterized in that, The acquisition module is specifically used for: The arrival time sequence of the data packets is obtained through a single network connection between the target device and the second computer device.

11. The apparatus according to claim 9 or 10, characterized in that, The acquisition module is also used to acquire the block height of the latest block; The processing module is specifically used for: If the block height of the latest block is greater than the current block height, then the current system time is added to the block arrival time sequence to obtain an updated block arrival time sequence, wherein the current block height is the block height corresponding to the latest time in the block arrival time sequence; If the block height of the latest block is less than or equal to the current block height, the first computer device will sleep for a specified time, then reacquire the block height of the latest block, and update the block arrival time sequence according to the reacquired block height of the latest block.

12. The apparatus according to claim 11, characterized in that, Also includes: The first sending module is used to send a query request to the blockchain network, the query request being used to query the block height of the latest block in the blockchain network; The acquisition module is further configured to receive a first return request sent by the blockchain network, the first return request including the block height of the latest block in the blockchain network.

13. The apparatus according to claim 11, characterized in that, The processing module is also used to add the data to the mining pool; The acquisition module is further configured to receive a first mining task sent by a computer device in the mining pool, the first mining task including the block height of the latest block.

14. The apparatus according to claim 9 or 10, characterized in that, Also includes: The second sending module is used to send a mining request to the target device; The acquisition module is further configured to receive a second return request from the target device; The processing module is specifically used for: Determine whether the second return request conforms to the data characteristics of the mining pool protocol; If the second return request matches the data characteristics of the mining pool protocol, then the target device is determined to be the mining device; If the second return request does not conform to the data characteristics of the mining pool protocol, then it is determined that the target device is not the mining device.

15. The apparatus according to claim 14, characterized in that, The processing module is specifically used for: Determine whether the data carried in the second return request contains keywords of the mining pool protocol, including block height, mining task, and seed hash.

16. The apparatus according to claim 15, characterized in that, The processing module is specifically used for: Determine whether the format of the second returned request is a text format, including JSON, TXT, YAML, or XML formats.

17. A computer device, characterized in that, include: A processor configured to be coupled to memory, read and execute instructions and / or program code in the memory to perform the method as described in any one of claims 1-8.

18. A chip system, characterized in that, include: A logic circuit for coupling with an input / output interface, through which data is transmitted to perform the method as described in any one of claims 1-8.

19. A computer-readable medium, characterized in that, The computer-readable medium stores program code that, when executed on a computer, causes the computer to perform the method as described in any one of claims 1-8.

Images