Blockchain eclipse attack detection method based on self-attention clustering

Abstract

The application provides a blockchain Eclipse attack detection method based on self-attention clustering, a multi-core neural network model uses a self-attention encoder to learn a low-dimensional representation of data, this process not only reduces the data dimension, but also retains as much internal related information of the data as possible, and ensures the accuracy of the final clustering; as can be seen, the novel clustering technology is used to mine internal information of data in the application, so that multi-dimensional features of traffic data are extracted, the detection performance of the classification model can be effectively improved, and then the Eclipse attack in the blockchain can be effectively detected.

Description

Technical Field

[0001] This invention belongs to the field of deep learning technology in machine learning, and particularly relates to a blockchain Eclipse attack detection method based on self-attention clustering. Background Technology

[0002] Blockchain is a decentralized distributed ledger technology that links data together in the form of blocks and uses cryptographic methods to protect the integrity and security of that data. With ongoing research into blockchain, its decentralized, immutable, and transparent characteristics have led to its widespread application in areas such as supply chain management, financial services, and cryptocurrencies. However, as blockchain networks expand, the number of nodes also increases, bringing with it numerous security vulnerabilities. The blockchain network layer is a P2P network built on the Kademlia algorithm. While Kademlia is designed as a relatively secure and robust distributed hash table algorithm, it still presents potential attacks and security threats, including Sybil attacks, DDoS attacks, and Eclipse attacks, which can severely disrupt the stable operation of the blockchain network.

[0003] The Eclipse attack is a typical blockchain network layer attack. Its strategy involves attackers controlling a large number of zombie nodes connected to the victim node, filling the victim node's routing table and overwriting all incoming and outgoing connections. Ultimately, this monopolizes the victim node's channel, completely controlling its information flow. In an Eclipse attack, the attacker forces the victim node's network path to be fixed within the range of nodes controlled by the attacker. In this situation, the victim node cannot establish connections to legitimate nodes, causing it to become isolated in the blockchain network. Once the attacker successfully controls a sufficient number of victim nodes, they can even launch a 51% attack with limited computing power, disrupting the stability and security of the entire blockchain network.

[0004] Although researchers have thoroughly defined the attack flow and model of the Eclipse attack, existing research on how to effectively detect it is relatively limited. Some methods rely on routing management to defend against attacks, but the accuracy of this approach is unstable due to the influence of blockchain network routing. Therefore, machine learning techniques have been introduced, using machine learning classification models to detect whether an Eclipse attack has occurred. However, existing machine learning detection schemes still have two problems: (1) classification-based features focus only on statistical categories, easily leading to overfitting; (2) the data features in the dataset are redundant and do not fully explore the information correlations across different dimensions of the data. Therefore, there is an urgent need for efficient and intelligent methods to defend against Eclipse attacks. Summary of the Invention

[0005] To address the problem that existing blockchain Eclipse attack detection methods fail to fully extract information from Eclipse attack data, resulting in poor detection accuracy, this invention provides a blockchain Eclipse attack detection method based on self-attention clustering. This method effectively detects Eclipse attacks in the blockchain by fully extracting information from the Eclipse attack data.

[0006] A blockchain Eclipse attack detection method based on self-attention clustering includes the following steps:

[0007] Obtain the traffic data of the blockchain node under test in the current time period, wherein the traffic data consists of data segments with different statistical characteristics;

[0008] Delete the data segments corresponding to useless and redundant statistical features in the traffic data to obtain the second traffic data;

[0009] The second traffic data is input into each sub-network of the trained multi-core neural network model for clustering to obtain the initial classification attack category of the traffic data in the current time period and the corresponding low-dimensional representation. Each sub-network corresponds to an Eclipse attack category, and each sub-network uses a self-attention encoder to obtain the low-dimensional representation of the traffic data.

[0010] The cluster center feature vectors of the sub-networks corresponding to the initial attack category are concatenated with the second traffic data to obtain the node extended traffic data.

[0011] By inputting the node-extended traffic data into the trained classification network model, the final attack category of the traffic data in the current time period can be obtained.

[0012] Furthermore, the training method for the multi-core neural network model is as follows:

[0013] Obtain traffic data of the blockchain node under test at different time periods, and obtain the attack category label value corresponding to the traffic data at each time period;

[0014] Delete the data segments corresponding to useless and redundant statistical features in each traffic data to obtain multiple second traffic data;

[0015] A cluster center feature vector is initialized for each sub-network, and then a prediction operation is performed based on each sub-network. The prediction operation is as follows: each second traffic data is input into each sub-network, and each sub-network outputs the attack category prediction value and the corresponding low-dimensional representation of each traffic data.

[0016] The judgment operation is performed based on each sub-network. The judgment operation is as follows: construct a loss function according to the attack category prediction value and attack category label value of each traffic data, and judge whether the loss function is less than the set value. If it is, the final multi-core neural network model is obtained. If it is not, the Adam gradient optimization method is used to change the cluster center feature vector of each sub-network to complete the update of each sub-network.

[0017] The prediction and judgment operations are re-executed based on the updated sub-networks until the final multi-core neural network model is obtained.

[0018] Furthermore, the loss function L is:

[0019]

[0020] Where c is the number of subnetworks, L p L is the mean squared error between the predicted attack category value and the attack category label value of each traffic data point. c For the intra-cluster distance and d S and cluster outside distance and d D The sum of, and Where δ is a set constant;

[0021] L p The calculation formula is:

[0022]

[0023] Where i = 1, 2, ..., c, N is the number of records in the second flow data, j = 1, 2, ..., N, p ij Let y be the predicted attack category value for the j-th second traffic data in the i-th subnetwork. j The attack category label value for the j-th second traffic data;

[0024] Intra-cluster distance and d S The calculation formula is:

[0025]

[0026] Where m is the number of features contained in the low-dimensional representation corresponding to the second flow data, k = 1, 2, ..., m, R i Let r = 1, 2, ..., R be the number of second traffic data entries belonging to the i-th sub-network. i And all the second traffic data belonging to the i-th sub-network form the i-th cluster, E irk V is the k-th data value in the low-dimensional representation corresponding to the r-th second traffic data belonging to the i-th sub-network. ikLet k be the k-th eigenvalue of the cluster center eigenvector of the i-th sub-network; the method for obtaining the sub-network to which any second traffic data belongs is as follows:

[0027] Obtain the attack category prediction value of the current second traffic data output by each sub-network;

[0028] The sub-network corresponding to the maximum predicted attack category value is designated as the sub-network to which the current second traffic data belongs.

[0029] Cluster outside distance and d D The calculation formula is:

[0030]

[0031] Among them, V qk Let q be the k-th eigenvalue of the cluster center eigenvector of the q-th subnetwork, where q = 1, 2, ..., c, and q ≠ i.

[0032] Furthermore, the useless statistical features include -1, null values, IP addresses, and port numbers.

[0033] Furthermore, the method for obtaining redundant statistical features in traffic data is as follows:

[0034] Obtain the Pearson correlation coefficient between any two statistical features, and determine whether the Pearson correlation coefficient exceeds a set threshold. If it does, the two statistical features are redundant; if not, the two statistical features are not redundant.

[0035] Furthermore, the method for deleting data segments corresponding to redundant statistical features in traffic data is as follows:

[0036] Construct a set of features to be deleted from all statistical features of the traffic data, and number each statistical feature in the set of features to be deleted;

[0037] The deletion operation is performed on the set of features to be deleted. The deletion operation is as follows: in the current set of features to be deleted, each statistical feature is taken as the current statistical feature in ascending order of number. The Pearson correlation coefficient between the current statistical feature and the other statistical features is obtained respectively. The statistical features with Pearson correlation coefficients exceeding a set threshold are taken as redundant statistical features of the current statistical features. The data segments corresponding to the redundant statistical features are deleted from the traffic data.

[0038] Redundant statistical features are removed from the set of features to be deleted, resulting in an updated set of features to be deleted.

[0039] The updated set of features to be deleted is used as the current set of features to be deleted, and the deletion operation is performed again until all redundant statistical features are deleted.

[0040] Furthermore, the second flow data is z-score normalized before being input into the various subnetworks of the trained multi-core neural network model.

[0041] Furthermore, the trained classification network model can be a random forest model, an MLP model, a logistic regression model, a support vector machine, a gradient boosting tree model, or an LSTM model.

[0042] Furthermore, the statistical characteristics include the length of the data packet, the number of times the data packet is forwarded, the length of the returned data packet, the sending time, the transmission rate, and the transmission protocol.

[0043] Beneficial effects:

[0044] 1. This invention provides a blockchain Eclipse attack detection method based on self-attention clustering. The multi-core neural network model uses a self-attention encoder to learn a low-dimensional representation of the data. This process not only reduces the data dimensionality but also retains as much relevant information as possible within the data, ensuring the accuracy of the final clustering. Thus, this invention employs a novel clustering technique to mine the internal information of the data, thereby extracting multi-dimensional features of the traffic data, which can effectively improve the detection performance of the classification model and thus effectively detect Eclipse attacks in the blockchain.

[0045] 2. This invention provides a blockchain Eclipse attack detection method based on self-attention clustering. It utilizes a multi-core neural network clustering framework, where different sub-networks work in parallel, each focusing on a specific data category. This parallel structure can more efficiently capture various types of attack behaviors, thereby improving the overall performance of the clustering model. Attached Figure Description

[0046] Figure 1 A flowchart illustrating a blockchain Eclipse attack detection method based on self-attention clustering provided by this invention;

[0047] Figure 2 A system diagram of the blockchain Eclipse attack detection method based on self-attention clustering provided by this invention;

[0048] Figure 3 A comparative diagram showing the attack detection accuracy of the blockchain Eclipse attack detection method based on self-attention clustering provided by this invention under six different classification models;

[0049] Figure 4 This diagram illustrates a comparison of the attack detection accuracy of the blockchain Eclipse attack detection method based on self-attention clustering provided by this invention in scenarios including and excluding the clustering module. Detailed Implementation

[0050] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0051] like Figure 1 As shown, a blockchain Eclipse attack detection method based on self-attention clustering includes the following steps:

[0052] S1: Obtain the traffic data of the blockchain node under test in the current time period, wherein the traffic data consists of data segments with different statistical characteristics; wherein the statistical characteristics include the length of the data packet, the number of data packet forwardings, the length of the returned data packet, the sending time, the transmission rate, the transmission protocol, etc.

[0053] S2: Delete the data segments corresponding to useless and redundant statistical features in the traffic data to obtain the second traffic data; among which, useless statistical features include -1, null values, IP addresses, and port numbers, etc.; the method for judging redundant statistical features in the traffic data is as follows:

[0054] Obtain the Pearson correlation coefficient between any two statistical features, and determine whether the Pearson correlation coefficient exceeds a set threshold. If it does, the two statistical features are redundant; if not, the two statistical features are not redundant.

[0055] The Pearson correlation coefficient between any two features is calculated as follows:

[0056]

[0057] Among them, f i and f j These represent the i-th and j-th features in the dataset, respectively, and cov(f i ,f j ) represents feature f i and f j The covariance, σ(f) i ) and σ(f j ) represent features f respectively i and f j Standard deviation;

[0058] Furthermore, the method for deleting data segments corresponding to redundant statistical features in traffic data is as follows:

[0059] Construct a set of features to be deleted from all statistical features of the traffic data, and number each statistical feature in the set of features to be deleted;

[0060] The deletion operation is performed on the set of features to be deleted. The deletion operation is as follows: in the current set of features to be deleted, each statistical feature is taken as the current statistical feature in ascending order of number. The Pearson correlation coefficient between the current statistical feature and the other statistical features is obtained respectively. The statistical features with Pearson correlation coefficients exceeding a set threshold are taken as redundant statistical features of the current statistical features. The data segments corresponding to the redundant statistical features are deleted from the traffic data.

[0061] Redundant statistical features are removed from the set of features to be deleted, resulting in an updated set of features to be deleted.

[0062] The updated set of features to be deleted is used as the current set of features to be deleted, and the deletion operation is performed again until all redundant statistical features are deleted.

[0063] S3: After z-score normalization of the second traffic data, it is then input into each sub-network of the trained multi-core neural network model for clustering to obtain the initial classification attack category of the traffic data in the current time period and the corresponding low-dimensional representation. Each sub-network corresponds to an Eclipse attack category. Each sub-network uses a self-attention encoder to obtain the low-dimensional representation of the traffic data. Each sub-network works in parallel.

[0064] For example, a multi-kernel neural network model includes two sub-networks: one sub-network corresponds to the presence of the Eclipse attack, and the other sub-network corresponds to the absence of the Eclipse attack; the z-score normalization method is as follows:

[0065] For each column feature f in the dataset l Each value x in li calculate Where E(f) l ) and σ(f l ) are respectively f l The expected value and standard deviation of the mathematical value;

[0066] S4: Concatenate the cluster center feature vector of the sub-network corresponding to the initial attack category with the second traffic data to obtain the node extended traffic data;

[0067] For example, assuming the cluster center feature vector is u-dimensional and the second flow data is v-dimensional, then the node extended flow data is (u+v)-dimensional.

[0068] S5: Input the node-expanded traffic data into a trained classification network model, such as a random forest model, MLP model, logistic regression model, support vector machine, gradient boosting tree model, or LSTM model, to obtain the final classification attack category of the traffic data in the current time period.

[0069] It should be noted that classification network models can be trained using traditional methods, such as initializing a classification model. Subsequently, in each training round, the model from the previous round is trained locally multiple times using the expanded traffic dataset D through nodes until convergence, ultimately yielding the local model for round t. In this process, each node independently trains its local model using stochastic gradient descent (SGD) based on its set learning rate (lr), number of training epochs (M), and other parameters. After T iterations, the classification network model converges, completing the training and ultimately yielding the trained model. It can be used to detect Eclipse attacks.

[0070] The following details the training method for multi-core neural network models, including the following steps:

[0071] S31: Obtain traffic data of the blockchain node under test at different time periods, and obtain the attack category label value corresponding to the traffic data at each time period;

[0072] S32: Delete the data segments corresponding to useless and redundant statistical features in each traffic data to obtain multiple second traffic data;

[0073] S33: Initialize a cluster center feature vector for each sub-network, and then perform a prediction operation based on each sub-network. The prediction operation is as follows: input each second traffic data into each sub-network, and each sub-network outputs the attack category prediction value and the corresponding low-dimensional representation of each traffic data.

[0074] It should be noted that each sub-network includes a self-attention encoder and multiple fully connected layers. The self-attention encoder in the sub-network assigns weights to each dimension of the sample data through an attention mechanism, and outputs an m-dimensional low-dimensional representation E of each second traffic data through a fully connected layer. After that, the low-dimensional representation E will continue to pass through the fully connected layers inside the sub-network and finally output a value p to represent the distance between the second traffic data and the cluster center represented by the sub-network. For each second traffic data, the category of the sub-network corresponding to the maximum value of p is taken as the category of the current second traffic data, and the attack category label value corresponding to the category is taken as the attack category prediction value.

[0075] S34: Perform a judgment operation based on each sub-network. The judgment operation is as follows: construct a loss function based on the attack category prediction value and attack category label value of each traffic data, and judge whether the loss function is less than the set value. If yes, the final multi-core neural network model is obtained. If no, the Adam gradient optimization method is used to change the cluster center feature vector of each sub-network to complete the update of each sub-network.

[0076] Specifically, the loss function L is:

[0077]

[0078] Where c is the number of subnetworks, L p L is the mean squared error between the predicted attack category value and the attack category label value of each traffic data point. c For the intra-cluster distance and d S and cluster outside distance and d D The sum of, and Where δ is a set constant;

[0079] L p The calculation formula is:

[0080]

[0081] Where i = 1, 2, ..., c, N is the number of records in the second flow data, j = 1, 2, ..., N, p ij Let y be the predicted attack category value for the j-th second traffic data in the i-th subnetwork. j The attack category label value for the j-th second traffic data;

[0082] Intra-cluster distance and d S The calculation formula is:

[0083]

[0084] Where m is the number of features contained in the low-dimensional representation corresponding to the second flow data, k = 1, 2, ..., m, R i Let r = 1, 2, ..., R be the number of second traffic data entries belonging to the i-th sub-network. i And all the second traffic data belonging to the i-th sub-network form the i-th cluster, E irk V is the k-th data value in the low-dimensional representation corresponding to the r-th second traffic data belonging to the i-th sub-network. ik Let k be the k-th eigenvalue of the cluster center eigenvector of the i-th sub-network; the method for obtaining the sub-network to which any second traffic data belongs is as follows:

[0085] Obtain the attack category prediction value of the current second traffic data output by each sub-network;

[0086] The sub-network corresponding to the maximum predicted attack category value is designated as the sub-network to which the current second traffic data belongs.

[0087] Cluster outside distance and d D The calculation formula is:

[0088]

[0089] Among them, V qk Let q be the k-th eigenvalue of the cluster center eigenvector of the q-th subnetwork, where q = 1, 2, ..., c, and q ≠ i.

[0090] S35: Re-execute the prediction and judgment operations based on the updated sub-network until the final multi-core neural network model is obtained.

[0091] In other words, if the loss function obtained in this iteration does not meet the requirements, the Adam gradient optimization method is needed to change the cluster center feature vector of each sub-network. The flow data used as samples remains unchanged. Then, the optimized cluster center feature vector and the original sample data are used to perform prediction and judgment operations again until a loss function that meets the requirements is obtained, and the final cluster center feature vector is obtained accordingly.

[0092] Furthermore, based on the detailed steps of model training for the self-attention clustering-based blockchain Eclipse attack detection method on the blockchain Eclipse attack dataset described above, this invention provides, as follows: Figure 2 The system diagram shown is for a blockchain Eclipse attack detection method based on self-attention clustering. Figure 2 Consider an Eclipse attack detection system comprising three modules. The system's input is a dataset of blockchain node traffic, containing 12,000 data entries, of which 6,000 are attack data and 6,000 are normal data. The data processing module processes the blockchain node traffic dataset and outputs the original node dataset. The clustering module, after multiple rounds of iteration and updates, outputs cluster center features and combines them with the original node dataset to form an expanded node dataset. The classification module, after multiple rounds of iteration and updates, will converge its classification model.

[0093] Specifically, the complete training process of the Eclipse attack detection model in this system includes the following steps:

[0094] Step 1: Build an Eclipse attack detection system. The system includes three modules: data processing, clustering, and classification. Initialize the multi-kernel neural network model of the clustering module and the classification model of the classification module. The clustering module contains a multi-kernel neural network model that can generate cluster center features, and the classification module contains a classification model that can identify Eclipse attacks.

[0095] Step 2: The data processing module processes the traffic dataset of the blockchain nodes as input to the clustering module. The complete data processing process includes the following sub-steps:

[0096] Step 2.1, Data Validation: The data processing module validates each data entry in the node traffic dataset and deletes data containing -1 or null values.

[0097] Step 2.2, Feature Selection: The data processing module first removes features such as IP addresses and port numbers from the traffic dataset that are useless for model training. Then, it calculates the Pearson correlation coefficient between every two features. Where f i and f j These represent the i-th and j-th features in the dataset, respectively, and cov(f i ,f j ) represents feature f i and f j The covariance, σ(f) i ) and σ(f j ) represent features f respectively i and f j The standard deviation of the standard deviation. After calculating the correlation between all features, redundant features with high correlation are deleted, with a threshold of 0.92; features exceeding 0.92 are deleted.

[0098] Step 2.3, Data Normalization: The data processing module performs z-score normalization on the traffic dataset. Specifically, it performs z-score normalization on each column of feature f in the dataset. l Each value x in li calculate Where E(f) l ) and σ(f l ) are respectively f l The expected value and standard deviation of the mathematical value;

[0099] Step 3: The clustering module trains a multi-kernel neural network model based on the original node dataset processed by the data processing module, and finally outputs cluster center features. The specific model training process includes the following sub-steps:

[0100] Step 3.1, Forward Propagation: Traffic data is input into different sub-networks of the multi-core neural network model, working in parallel. The self-attention encoder in each sub-network assigns weights to each dimension of the sample data through an attention mechanism and outputs a 10-dimensional low-dimensional representation E for each sample data through a fully connected layer. This low-dimensional representation then continues to pass through fully connected layers within the sub-network, ultimately outputting a value p representing the distance between the sample data and the cluster center represented by that sub-network.

[0101] Step 3.2, Backpropagation: A cluster center feature vector V is initialized in each sub-network, and this vector is continuously updated during the iterative training process.

[0102] Therefore, the training of the multi-core neural network model for the clustering module in this invention includes:

[0103] Each sub-network in the multi-core neural network model initializes cluster center features;

[0104] The self-attention encoder in the sub-network processes the original dataset of the nodes to obtain a low-dimensional representation of the data.

[0105] The fully connected layers in the sub-network process the low-dimensional representation of the data to obtain the output of the multi-core neural network model.

[0106] Based on the Adam gradient descent method, the multi-kernel neural network model is iteratively trained until convergence, and the final cluster center features are obtained. These features are then combined with the original node dataset to obtain the node extended dataset.

[0107] Step 4: Classification module model training

[0108] The classification module initializes a classification model. Subsequently, in each training round, the model from the previous round is trained locally multiple times using the expanded dataset D with nodes until convergence, ultimately obtaining the local model for round t. Each node trains its local model independently using stochastic gradient descent (SGD) based on its own set learning rate (lr), number of training epochs (M), and other parameters. Here, the learning rate is uniformly set to 0.001 and the number of training epochs to 100.

[0109] Step 5: Repeat Step 4 until the classification model converges; that is, based on the stochastic gradient descent method, input the node extended dataset into the classification module's classification model for iterative training until convergence, and obtain the final classification model that can be used to identify Eclipse attacks.

[0110] To verify whether the above system can detect Eclipse attacks, this invention, based on the extended dataset, tested various classification models to identify attack traffic, including Random Forest, MLP, Logistic Regression, Support Vector Machine, Gradient Boosting Tree, and LSTM. This invention calculated the accuracy of these six classification models on the same dataset. Figure 3 As shown in the figure, the experimental results further demonstrate that the classification model performs very well with the extended dataset based on a combination of cluster center features and original data features. The accuracy of each classification model reaches over 95%, with the MLP model even achieving 98% accuracy. This indicates that the distribution of the extended dataset has significant differences, allowing any classification model to easily identify Eclipse attacks.

[0111] Step 6: To further illustrate that the cluster center features generated by the clustering module of this invention can improve the performance of the classification model, this invention selects to train the MLP model on the original dataset and the extended dataset respectively. The results are as follows: Figure 4 As shown, after 100 rounds of training and convergence, the model trained on the original dataset achieves a 5% lower classification accuracy than the model trained on the expanded dataset. This result further demonstrates the effectiveness of the clustering module, which can significantly improve the performance of the classification model. The above experimental results fully confirm the superior performance of this invention throughout the entire process. From dataset processing and the application of clustering techniques to obtain cluster center features, to the training of the classification model, each module has achieved remarkable results.

[0112] The experimental results of the above process show that the present invention inputs the traffic data of blockchain nodes into the data processing module to obtain the original node dataset; inputs the original node dataset into the multi-kernel neural network model of the clustering module for training to obtain cluster center features, which are combined with the original node data to obtain the node extended dataset; inputs the node extended dataset into the classification model of the classification module to obtain the accuracy of node detection of Eclipse attacks; thus, the present invention not only proposes a novel clustering technology that can mine internal information of data and extract multi-dimensional features, but also effectively detects Eclipse attacks in the blockchain.

[0113] Of course, the present invention may have other various embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and modifications according to the present invention, but these corresponding changes and modifications should all fall within the protection scope of the appended claims.

Claims

1. A blockchain Eclipse attack detection method based on self-attention clustering, characterized in that, The method comprises the following steps: Obtain traffic data of a current period of a to-be-tested blockchain node, wherein the traffic data is composed of data segments with different statistical characteristics; Delete data segments corresponding to useless statistical characteristics and redundant statistical characteristics in the traffic data to obtain second traffic data; Input the second traffic data into each subnetwork of a trained multi-kernel neural network model respectively to perform clustering, to obtain an initial classification attack category to which the traffic data of the current period belongs and a corresponding low-dimensional representation, and each subnetwork corresponds to an Eclipse attack category, and each subnetwork uses a self-attention encoder to obtain the low-dimensional representation of the traffic data; Cascade a clustering center feature vector of a subnetwork corresponding to the initial classification attack category with the second traffic data to obtain node extended traffic data; Input the node extended traffic data into a trained classification network model to obtain a final classification attack category to which the traffic data of the current period belongs; The training method of the multi-kernel neural network model comprises the following steps: Obtain traffic data of different periods of a to-be-tested blockchain node, and obtain attack category label values corresponding to the traffic data of each period; Delete data segments corresponding to useless statistical characteristics and redundant statistical characteristics in each piece of traffic data to obtain multiple pieces of second traffic data; Initialize a clustering center feature vector for each subnetwork respectively, and then perform a prediction operation based on each subnetwork, wherein the prediction operation comprises the following steps: input each piece of second traffic data into each subnetwork, and each subnetwork outputs an attack category prediction value and a corresponding low-dimensional representation to which each piece of traffic data belongs; Perform a judgment operation based on each subnetwork, wherein the judgment operation comprises the following steps: construct a loss function according to the attack category prediction value and the attack category label value to which each piece of traffic data belongs, and determine whether the loss function is less than a set value; if yes, a final multi-kernel neural network model is obtained; if no, an Adam gradient optimization method is used to change the clustering center feature vector of each subnetwork, and each subnetwork is updated; Re-perform the prediction operation and the judgment operation based on the updated subnetworks until a final multi-kernel neural network model is obtained.

2. The blockchain Eclipse attack detection method based on self-attention clustering according to claim 1, wherein, The loss function is: wherein, is the number of sub-networks, is the mean square error between the predicted value of the attack category to which each flow data belongs and the label value of the attack category, is the sum of the intra-cluster distance and is the sum of the inter-cluster distance and is the sum value of and wherein, is a set constant; The calculation formula is: wherein, , is the number of second traffic data, , is the attack class prediction value of the jth second traffic data in the ith subnetwork, is the attack class label value of the jth second traffic data. Intra-cluster distance and The formula for calculating is: wherein, is the number of features contained in the low-dimensional representation corresponding to the second flow data, , is the number of second flow data belonging to the i-th sub-network, , and all second flow data belonging to the i-th sub-network form the i-th cluster, is the k-th data value of the low-dimensional representation corresponding to the r-th second flow data belonging to the i-th sub-network, is the k-th feature value of the cluster center feature vector of the i-th sub-network; and the method for obtaining the sub-network to which any second flow data belongs is: Obtain an attack category prediction value of the current second traffic data output by each subnetwork; The subnetwork corresponding to a maximum attack category prediction value is taken as a belonging subnetwork of the current second traffic data. Cluster-out distance and The formula for calculating the cluster-out distance is: wherein, is the kth eigenvalue of the cluster center feature vector of the qth subnetwork, , and .

3. The blockchain Eclipse attack detection method based on self-attention clustering according to claim 1, wherein, The useless statistical characteristics include -1, a null value, an IP address, and a port number.

4. The blockchain Eclipse attack detection method based on self-attention clustering according to claim 1, wherein, The method for obtaining redundant statistical characteristics in traffic data comprises the following steps: Obtain a Pearson correlation coefficient between any two statistical characteristics, and determine whether the Pearson correlation coefficient exceeds a set threshold value; if yes, the two statistical characteristics are redundant statistical characteristics; if no, the two statistical characteristics are not redundant statistical characteristics.

5. The blockchain Eclipse attack detection method based on self-attention clustering according to claim 1, wherein, The method for deleting data segments corresponding to redundant statistical characteristics in traffic data comprises the following steps: Construct a to-be-deleted feature set of all statistical characteristics of the traffic data, and number each statistical characteristic in the to-be-deleted feature set; Performing a deletion operation on the to-be-deleted feature set, the deletion operation being: in the current to-be-deleted feature set, in ascending order of number, taking each statistical feature as a current statistical feature, respectively obtaining the Pearson correlation coefficient between the current statistical feature and the remaining statistical features, taking the statistical feature with a Pearson correlation coefficient exceeding a set threshold as a redundant statistical feature of the current statistical feature, and deleting a data subsegment corresponding to the redundant statistical feature from the flow data; Removing the redundant statistical feature from the to-be-deleted feature set to obtain an updated to-be-deleted feature set; Re-executing the deletion operation with the updated to-be-deleted feature set as the current to-be-deleted feature set until the redundant statistical feature is deleted.

6. The blockchain Eclipse attack detection method based on self-attention clustering according to claim 1, wherein, The second flow data is input into each subnetwork of the trained multi-kernel neural network model after z score normalization processing.

7. The blockchain Eclipse attack detection method based on self-attention clustering according to any one of claims 1-6, characterized in that, The trained classification network model is a random forest model, an MLP model, a logistic regression model, a support vector machine, a gradient boosting tree model, or an LSTM model.

8. The blockchain Eclipse attack detection method based on self-attention clustering according to any one of claims 1-6, characterized in that, The statistical features include the length of a data packet, the number of data packet forwarding, the length of a returned data packet, the sending time, the transmission rate, and the transmission protocol.

Images