A promotion data security analysis method and system based on blockchain

Abstract

The present invention discloses a blockchain-based promotion data security analysis method and system, and relates to the technical field of data security monitoring. The blockchain-based promotion data security analysis method comprises the following steps: data collection; feature extraction; abnormal behavior detection; and blockchain security visualization. The present invention collects data from the promotion blockchain, then extracts features from the obtained node behavior records to obtain node behavior features, and performs abnormal behavior detection in combination with abnormal conditions to obtain abnormal nodes. Based on this, the security of the promotion blockchain is evaluated to obtain a security evaluation index, and finally blockchain security visualization is achieved, achieving a more accurate effect of realizing the security analysis of promotion data based on blockchain, and solving the problem of insufficient correlation between the accuracy of the security analysis of promotion data based on blockchain and the node in the prior art.

Description

Technical Field

[0001] The present invention relates to the technical field of data security monitoring, and in particular to a promotion data security analysis method and system based on blockchain. Background Art

[0002] With the rapid development of Internet technology and the large-scale application of data, data security issues have received more and more attention. Especially in promotion activities, a large amount of user data is collected and analyzed to optimize marketing strategies and improve user experience. However, problems such as data leakage, abuse and privacy infringement frequently occur, bringing serious security risks to enterprises and users. Therefore, the promotion data security analysis system has become an important means to ensure data security, helping enterprises identify and repair potential security vulnerabilities and ensure the security of promotion data throughout its life cycle.

[0003] Existing promotion data security analysis systems mainly rely on centralized storage and management methods to achieve data security. These promotion data security analysis systems store and manage all promotion data through centralized central servers to ensure unified control and access management of promotion data. The system will use technologies such as checksums, hash values ​​or digital signatures to verify the integrity of promotion data, track users' abnormal behavior through centralized logging and monitoring tools, and use role-based access control models to limit user permissions.

[0004] For example, the invention patent announcement with announcement number: CN114565114B discloses a computer data security monitoring method and system based on big data technology, including: a big data module for online car-hailing operation, an order distribution module, and a time prediction module; the output end of the order distribution module is connected to the input end of the big data module for online car-hailing operation; the output end of the big data module for online car-hailing operation is connected to the input end of the time prediction module. The system also includes a tone analysis module and a blockchain module; the output end of the tone analysis module is connected to the input end of the blockchain module.

[0005] For example, the invention patent with announcement number CN113033926B discloses a blockchain-based supply chain logistics data security sharing system and method, which includes a data sharing platform, a security control unit, a data collection unit, a block construction unit, a registration and login unit, and a database. The data collection unit collects data from logistics sites, sorts each logistics site, and reasonably selects the best delivery route.

[0006] However, in the process of implementing the technical solution of the invention in the embodiments of the present application, the present application found that the above technology has at least the following technical problems:

[0007] In the prior art, the promotion data security analysis system is mainly designed for the traditional centralized storage method, but lacks an effective security analysis method for the promotion data stored in the blockchain. Due to the distributed nature of the blockchain, it is difficult to obtain the security of the promotion data directly by verifying the integrity of the data like a centralized system. There is a problem that the accuracy of the blockchain-based promotion data security analysis is not sufficiently associated with the nodes. Summary of the invention

[0008] The embodiments of the present application provide a blockchain-based promotion data security analysis method and system, which solves the problem of insufficient node association in the accuracy of blockchain-based promotion data security analysis in the prior art, and achieves more accurate blockchain-based promotion data security analysis.

[0009] The embodiment of the present application provides a blockchain-based promotion data security analysis method, comprising the following steps: S1, collecting data from the promotion blockchain to obtain node behavior records, the promotion blockchain represents a blockchain network that stores promotion data, and the node behavior records refer to operation records of the promotion nodes on the promotion blockchain; S2, extracting features from the node behavior records to obtain node behavior features, the node behavior features are used to describe the operation frequency and interval of the promotion nodes on the promotion blockchain; S3, performing abnormal behavior detection on the node behavior features according to abnormal conditions to obtain abnormal nodes, and performing security assessment on the promotion blockchain according to the abnormal nodes to obtain a security assessment index, the security assessment index is used to reflect the security status of the promotion blockchain; S4, realizing blockchain security visualization through abnormal nodes and security assessment index, the blockchain security visualization is used to show the relationship between the security assessment index and abnormal nodes of the promotion blockchain during operation.

[0010] Furthermore, the specific steps of data collection are as follows: A1, real-time monitoring of the promoted blockchain through a listening tool to obtain blockchain events, and recording the blockchain events in a blockchain event log, wherein the blockchain events refer to the state changes and operation records of the promoted blockchain generated by the promotion node operation; A2, extracting a preset number of blockchain events from the blockchain event log, and obtaining node behavior records based on the blockchain events, wherein the node behavior records include node ID, event time, event type and event traffic, wherein the event types include upload events and download events, and the event traffic is used to describe the amount of data uploaded or downloaded by the promotion node.

[0011] Furthermore, the specific steps of feature extraction are as follows: B1, counting the node behavior records according to the node ID to obtain the number of participations and the total number of nodes of the corresponding promoted node, and obtaining the node frequency based on the number of participations and the total number of nodes, the number of participations represents the number of blockchain events corresponding to the node ID in the node behavior record, and the total number of nodes represents the number of blockchain events with different node IDs in the node behavior record; B2, counting the node behavior records according to the event time and the node ID to obtain the average interval time of the corresponding promoted node, and the average interval time refers to the average value of all interval times of the corresponding node ID; B3, classifying the node behavior records according to the event type to obtain upload records and download records, and counting the upload records and download records according to the node ID to obtain the number of uploads, the amount of uploaded data, and the number of downloads, the amount of downloaded data, and the average upload amount and the average download amount, thereby obtaining the node behavior characteristics including node frequency, average interval time, average upload amount and average download amount.

[0012] Furthermore, the specific steps of abnormal behavior detection are as follows: C1, obtaining a feature parameter set through a preset database, the feature parameter set including a historical feature reference value and a historical feature reference deviation, the historical feature reference deviation including a node frequency reference deviation, an average interval time reference deviation, an average upload amount reference deviation, and an average download amount reference deviation; C2, obtaining a behavior feature deviation through the node behavior characteristics of the promoted node and the historical feature reference value, the behavior feature deviation including a node frequency deviation, an average interval time deviation, an average upload amount deviation, and an average download amount deviation; C3, obtaining an abnormal condition through abnormal parameters, the abnormal parameters including a behavior feature deviation and a historical feature reference deviation; C4, screening the promoted nodes according to the abnormal conditions to obtain abnormal nodes, the abnormal nodes referring to promoted nodes that meet any two abnormal conditions.

[0013] Furthermore, the abnormal conditions include a first condition, a second condition, a third condition and a fourth condition; the first condition is that the node frequency deviation of the promoted node is greater than twice the node frequency reference deviation; the second condition is that the average interval time deviation of the promoted node is greater than twice the average interval time reference deviation; the third condition is that the average upload volume deviation of the promoted node is greater than twice the average upload volume reference deviation; the fourth condition is that the average download volume deviation of the promoted node is greater than twice the average download volume reference deviation.

[0014] Furthermore, the specific acquisition process of the feature parameter set is as follows: obtaining historical node behavior characteristics from a preset database, the historical node behavior characteristics representing the node behavior characteristics in a historical time period; performing statistical analysis on the historical node behavior characteristics according to the node ID to obtain historical feature reference values ​​and historical feature reference deviations, the historical feature reference values ​​including reference node frequency, reference average interval time, reference average upload amount and reference average download amount.

[0015] Furthermore, the security assessment index is obtained by performing a security assessment on the promoted blockchain according to the abnormal nodes, and the node influence index is obtained according to the abnormal nodes and the blockchain event log. The node influence index is used to describe the degree of influence of the abnormal node on the promoted blockchain. The specific process is as follows: extract abnormal events from the blockchain event log according to the node ID of the abnormal node, and the abnormal event represents the blockchain event operated by the abnormal node; divide the abnormal events according to the preset level and abnormal behavior records to obtain abnormal event groups, and the abnormal behavior records include the event time, event type and event flow of the abnormal events, and the abnormal event groups include the first abnormal group, the second abnormal group and the third abnormal group; count the abnormal event groups to obtain the number of abnormal node events, and the number of abnormal node events includes the first node event number, the second node event number and the third node event number; obtain the preset level weight from the preset database, and the preset level weight includes the first level weight, the second level weight and the third level weight; obtain the node influence index of the abnormal node through the number of abnormal node events, the preset level weight and the event time of the abnormal event, and the specific calculation formula of the node influence index is as follows:

[0016] +1;

[0017] Where n is the number of the abnormal node, , N is the total number of abnormal nodes, is the node influence index of the nth abnormal node, is the number of the abnormal event in the first abnormal group of the nth abnormal node, , is the total number of abnormal events in the first abnormal group of the nth abnormal node, is the number of the abnormal event in the second abnormal group of the nth abnormal node, , is the total number of abnormal events in the second abnormal group of the nth abnormal node, is the number of the abnormal event in the third abnormal group of the nth abnormal node, , is the total number of abnormal events in the third abnormal group of the nth abnormal node, is the first abnormal group of the nth abnormal node The event time of an abnormal event, is the nth abnormal node in the second abnormal group The event time of an abnormal event, is the nth abnormal node in the third abnormal group The event time of an abnormal event, To evaluate the time, is the time decay factor, is the first level weight, is the second level weight, The third level weight.

[0018] Furthermore, the specific calculation process of the security assessment index is as follows: obtaining a preset security weight from a preset database, wherein the preset security weight includes a first weight, a second weight, a third weight, and a fourth weight; obtaining the security assessment index according to the abnormal parameters, the node impact index, and the preset security weight, wherein the specific calculation formula of the security assessment index is as follows:

[0019] ;

[0020] In the formula, , M is the total number of promoted nodes, To promote the security assessment index of blockchain, is the node frequency deviation of the mth promoted node, is the average interval time deviation of the mth promotion node, is the average upload deviation of the mth promotion node, is the average download deviation of the mth promotion node, is the node frequency reference deviation of the mth promoted node, is the average interval time reference deviation, is the average upload reference deviation, is the reference deviation of the average download volume, is the first weight, is the second weight, is the third weight, The fourth weight.

[0021] Furthermore, the specific process of the blockchain security visualization is as follows: the number of abnormal nodes and the security assessment index are obtained from a preset database, and a scatter plot of the number of abnormal nodes-security assessment index is drawn with the number of abnormal nodes as the X-axis and the security assessment index as the Y-axis, and the scatter plot of the number of abnormal nodes-security assessment index is used to show the relationship between the number of abnormal nodes and the security assessment index; the node influence index of the abnormal node is obtained from the preset database, and an abnormal node influence diagram is drawn with the number of the abnormal node as the X-axis and the node influence index as the Y-axis, and the abnormal node influence diagram is used to show the relationship between the abnormal node and the node influence index.

[0022] The embodiment of the present application provides a blockchain-based promotion data security analysis system, including: a data collection module, a feature extraction module, an abnormal behavior detection module and a blockchain security visualization module; wherein the data collection module is used to collect data from the promotion blockchain to obtain node behavior records, the promotion blockchain represents a blockchain network that stores promotion data, and the node behavior records refer to operation records of promotion nodes on the promotion blockchain; the feature extraction module is used to obtain node behavior features by extracting features from node behavior records, and the node behavior features are used to describe the operation frequency and interval of the promotion nodes on the promotion blockchain; the abnormal behavior detection module is used to perform abnormal behavior detection on the node behavior features according to abnormal conditions to obtain abnormal nodes, and perform security assessment on the promotion blockchain according to the abnormal nodes to obtain a security assessment index, and the security assessment index is used to reflect the security status of the promotion blockchain; the blockchain security visualization module is used to realize blockchain security visualization through abnormal nodes and security assessment index, and the blockchain security visualization is used to display the relationship between the security assessment index and abnormal nodes of the promotion blockchain during operation.

[0023] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0024] 1. By collecting data on the promotion blockchain and extracting features from the obtained node behavior records to obtain node behavior features, abnormal behavior detection is then performed in combination with abnormal conditions to obtain abnormal nodes. Based on this, the security of the promotion blockchain is evaluated to obtain a security evaluation index. Finally, blockchain security visualization is achieved, thereby achieving an intuitive display of the security of the promotion blockchain, and further achieving a more accurate implementation of blockchain-based promotion data security analysis, effectively solving the problem of insufficient correlation between the accuracy of blockchain-based promotion data security analysis and nodes in the prior art;

[0025] 2. Obtain historical node behavior characteristics from the preset database, perform statistical analysis to obtain historical characteristic reference values, then combine the node behavior characteristics of the promoted nodes to obtain behavior characteristic deviations, and then combine the historical characteristic reference deviations to obtain abnormal conditions. Based on this, the promoted nodes are screened to obtain abnormal nodes, thereby identifying abnormal nodes with security risks, and thus achieving accurate monitoring of the security of the promoted blockchain network;

[0026] 3. By extracting abnormal behavior records of abnormal events from blockchain event logs, and dividing abnormal events into abnormal event groups according to preset levels, and then counting each group of abnormal events to obtain the number of abnormal node events, the node influence index of the abnormal node is obtained by combining the preset level weight and event time, and the security assessment index is obtained by combining the abnormal parameters and preset security weights, thereby realizing the numeration of the security assessment index and achieving a comprehensive assessment of the overall security status of the promoted blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flowchart of a blockchain-based promotion data security analysis method provided in an embodiment of the present application;

[0028] Figure 2 A schematic diagram of the change of the node influence index provided in the embodiment of the present application;

[0029] Figure 3 A scatter plot of the number of abnormal nodes and security assessment index provided in an embodiment of the present application;

[0030] Figure 4 An abnormal node influence diagram provided in an embodiment of the present application;

[0031] Figure 5 A schematic diagram of the structure of a blockchain-based promotion data security analysis system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The embodiment of the present application solves the problem of insufficient correlation between the accuracy of security analysis of promotion data based on blockchain and nodes in the prior art by providing a promotion data security analysis method and system based on blockchain. Node behavior records are obtained by collecting data from the promotion blockchain, and then node behavior features are obtained by extracting features from the node behavior records. Abnormal behavior detection is performed on the node behavior features based on abnormal conditions to obtain abnormal nodes. Security assessment of the promotion blockchain is then performed based on the abnormal nodes to obtain a security assessment index. Finally, blockchain security visualization is achieved through abnormal nodes and security assessment index, thereby achieving more accurate security analysis of promotion data based on blockchain.

[0033] The technical solution in the embodiment of the present application is to solve the problem that the accuracy of the security analysis of the promotion data based on blockchain is not sufficiently associated with the nodes. The overall idea is as follows:

[0034] The node behavior features are obtained by extracting features from the node behavior records, and abnormal behavior detection is performed in combination with abnormal conditions to obtain abnormal nodes. Based on this, a security assessment is performed on the promoted blockchain to obtain a security assessment index and realize blockchain security visualization, achieving a more accurate effect of realizing blockchain-based promotion data security analysis.

[0035] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0036] like Figure 1 As shown, it is a flowchart of a promotion data security analysis method based on blockchain provided by an embodiment of the present application, and the method includes the following steps: S1, collecting data from the promotion blockchain to obtain node behavior records, the promotion blockchain represents a blockchain network storing promotion data, the promotion data refers to data related to promotion activities, data collection refers to real-time recording of promotion nodes to collect node behavior records, the promotion node refers to an individual node in the promotion blockchain, and the node behavior record refers to the operation record of the promotion node on the promotion blockchain; S2, extracting features from the node behavior record to obtain node behavior features, feature extraction refers to analyzing the node behavior record to obtain the behavior features of the promotion node, and the node behavior features are used to describe the operation frequency and interval of the promotion node on the promotion blockchain. S3, abnormal behavior detection is performed on the node behavior characteristics according to the abnormal conditions to obtain abnormal nodes, and the security assessment index is obtained by performing security assessment on the promoted blockchain according to the abnormal nodes. The abnormal conditions are obtained through the node behavior characteristics of the historical time period. Abnormal behavior detection refers to marking abnormal nodes by analyzing the behavior characteristics of the promoted nodes. Abnormal nodes represent promoted nodes whose node behavior characteristics meet the abnormal conditions. Security assessment refers to evaluating the overall security status of the promoted blockchain based on abnormal nodes. The security assessment index is used to reflect the security status of the promoted blockchain. S4, blockchain security visualization is realized through abnormal nodes and security assessment index. Blockchain security visualization is used to show the relationship between the security assessment index and abnormal nodes of the promoted blockchain during operation.

[0037] In this embodiment, the promotion activity is specifically an online course promotion activity carried out by an Internet company. The promotion node refers to the specific platform that participates in and executes the promotion activity. The promotion data includes promotion activity information and user participation data. The promotion activity information refers to the activity content, course target audience data and promotion time period data uploaded by the Internet company. The user participation data refers to the number of user clicks, user registrations and course purchases uploaded by the promotion node. The node behavior record specifically refers to the operation record of the promotion node on the promotion activity information and user participation data, including the promotion node uploading user participation data to the promotion blockchain and the promotion node downloading promotion activity information from the promotion blockchain; it realizes more accurate implementation of blockchain-based promotion data security analysis, and effectively solves the problem of insufficient correlation between the accuracy of blockchain-based promotion data security analysis and nodes in the prior art.

[0038] Furthermore, the specific steps of data collection are as follows: A1, monitor the promotion blockchain in real time through a monitoring tool to obtain blockchain events, and record the blockchain events in the blockchain event log. The monitoring tool refers to a monitoring device or software used to capture various operations occurring in the promotion blockchain in real time. Blockchain events refer to the state changes and operation records of the promotion blockchain generated by the promotion node operation. The blockchain event log represents the record information of blockchain events; A2, extract a preset number of blockchain events from the blockchain event log, and obtain node behavior records based on the blockchain events. The node behavior records include node ID, event time, event type and event traffic. The preset number is determined by the preset personnel based on the efficiency of the promotion data security analysis. The node ID represents the identifier of the promotion node. The event time refers to the time when the blockchain event occurs. The event type includes upload events and download events. Upload events refer to the promotion node uploading promotion data to the promotion blockchain. Download events refer to the promotion node downloading data from the promotion blockchain. Event traffic is used to describe the amount of data uploaded or downloaded by the promotion node.

[0039] In this embodiment, the monitoring tool should be selected according to the performance requirements of the promoted blockchain. In this embodiment, the blockchain event listener is used as the monitoring tool. The blockchain event listener is a highly real-time and widely used monitoring tool that can capture various operation events occurring in the blockchain network in real time, thereby improving the real-time performance of the promoted data security analysis method. The event time is in the format of a timestamp, which is convenient for subsequent feature extraction operations. The preset number should be determined by conducting experiments on blockchain events in historical time periods in the blockchain event log. The experimental process is as follows: extract blockchain events from the blockchain event log for the past month, and summarize them by day to obtain the number of events per day, then calculate the average and standard deviation of the number of events per day, set the preset number as the average of the number of events per day plus 1 times the standard deviation, and then perform the experiment in the promoted data security analysis system. Actual verification is carried out and the running performance is observed. If the promotion data security analysis system is overloaded during peak hours, the preset number is reduced. If the promotion data security analysis system has a large amount of idle resources during normal time periods, the preset number is increased until an optimal value is found that can ensure efficient operation and effectively detect abnormal nodes. Blockchain events are divided into upload events and download events. Upload events specifically refer to the promotion node uploading user participation data to the promotion blockchain. Download events specifically refer to the promotion node downloading promotion activity information from the promotion blockchain. By extracting the node ID, event time, event type and event flow of each blockchain event, a data basis is provided for subsequent feature extraction, thereby improving the reliability of feature extraction operations in the promotion data security analysis method.

[0040] Furthermore, the specific steps of feature extraction are as follows: B1, the node behavior records are counted according to the node ID to obtain the participation times and the total number of nodes of the corresponding promoted node, and the node frequency is obtained based on the participation times and the total number of nodes. The participation times represent the number of blockchain events corresponding to the node ID in the node behavior record, and the total number of nodes represents the number of blockchain events with different node IDs in the node behavior record. The node frequency is used to describe the activity level of the promoted node in the blockchain network; B2, the node behavior records are counted by event time and node ID to obtain the average interval time of the corresponding promoted node. The average interval time refers to the average value of all interval times of the corresponding node ID, and the interval time represents the time difference between the event times of two adjacent blockchain events; B3, the node behavior records are classified according to the event type to obtain upload records and download records. , according to the node ID, the upload records and download records are counted to obtain the number of uploads, the amount of uploaded data, the number of downloads, and the amount of downloaded data, and the average upload amount and average download amount are obtained accordingly. The upload record represents the blockchain event whose event type is the upload event, and the download record represents the blockchain event whose event type is the download event. The number of uploads represents the number of blockchain events corresponding to the node ID in the upload record, and the number of downloads represents the number of blockchain events corresponding to the node ID in the download record. The amount of uploaded data is the sum of the event traffic corresponding to the node ID in the upload record, and the amount of downloaded data is the sum of the event traffic corresponding to the node ID in the download record. The average upload amount represents the ratio of the amount of uploaded data to the number of uploads, and the average download amount represents the ratio of the amount of downloaded data to the number of downloads. The node behavior characteristics include node frequency, average interval time, average upload amount, and average download amount.

[0041] In this embodiment, the node frequency is used to indicate the activity level of the promotion node in the promotion blockchain, the average interval time is used to describe the law of the promotion node's execution of operations, and the average upload amount and the average download amount are used to describe the specific circumstances of the promotion node's data transmission in the promotion blockchain. The average upload amount can reflect the average amount of data when the node uploads user participation data, and the average download amount indicates the average amount of data that the node downloads from the blockchain for promotion activity information. By comprehensively analyzing the node frequency, the average interval time, the average upload amount and the average download amount, it is possible to describe the operation mode of each promotion node through data, thereby improving the accuracy of feature extraction in the promotion data security analysis method.

[0042] Furthermore, the specific steps of abnormal behavior detection are as follows: C1, obtain a feature parameter set through a preset database, the feature parameter set includes a historical feature reference value and a historical feature reference deviation, the historical feature reference value represents the node behavior characteristics of a normal promotion node, and the historical feature reference deviation includes a node frequency reference deviation, an average interval time reference deviation, an average upload amount reference deviation, and an average download amount reference deviation; C2, obtain a behavior feature deviation through the node behavior characteristics of the promotion node and the historical feature reference value, the behavior feature deviation is obtained by the absolute value of the difference between the node behavior characteristics of the same node ID and the historical feature reference value, and the behavior feature deviation includes a node frequency deviation, an average interval time deviation, an average upload amount deviation, and an average download amount deviation; C3, obtain an abnormal condition through an abnormal parameter, the abnormal parameter includes a behavior feature deviation and a historical feature reference deviation; C4, screen the promotion nodes according to the abnormal conditions to obtain abnormal nodes, and an abnormal node refers to a promotion node that meets any two abnormal conditions.

[0043] In this embodiment, the behavior feature deviation is obtained by comparing the node behavior feature with the historical feature reference value. The behavior feature deviation indicates the difference between the node behavior feature of the current promotion node and the normal node behavior feature, including node frequency deviation, average interval time deviation, average upload amount deviation and average download amount deviation, wherein the node frequency deviation is the absolute value of the difference between the node frequency and the reference node frequency, the average interval time deviation is the absolute value of the difference between the average interval time and the reference average interval time, the average upload amount deviation is the absolute value of the difference between the average upload amount and the reference average upload amount, and the average download amount deviation is the absolute value of the difference between the average download amount and the reference average download amount; by comprehensively considering the behavior feature deviation and the historical feature reference deviation, clear abnormal conditions are set, so as to accurately identify abnormal nodes that may pose risks, thereby enhancing the accuracy of abnormal behavior detection in the promotion data security analysis method.

[0044] Among them, abnormal conditions include the first condition, the second condition, the third condition and the fourth condition; the first condition is that the node frequency deviation of the promoted node is greater than twice the node frequency reference deviation; the second condition is that the average interval time deviation of the promoted node is greater than twice the average interval time reference deviation; the third condition is that the average upload volume deviation of the promoted node is greater than twice the average upload volume reference deviation; the fourth condition is that the average download volume deviation of the promoted node is greater than twice the average download volume reference deviation.

[0045] It should be understood that each abnormal condition is based on the comparison of the behavioral feature deviation and twice the historical feature reference deviation. The twice historical feature reference deviation is determined according to the 68-95-99.7 rule, that is, under the normal distribution, about 68% of the data falls within one standard deviation of the mean, 95% of the data falls within two standard deviations of the mean, and 99.7% of the data falls within three standard deviations of the mean. By using twice the standard deviation to determine the behavioral feature deviation outside the 95% probability, it is ensured that only those promotion nodes that significantly deviate from the normal behavior pattern will be marked as abnormal nodes, thereby ensuring that the abnormal behavior detection is scientific and reasonable, and enhancing the reliability of abnormal behavior detection in the promotion data security analysis method.

[0046] Furthermore, the specific acquisition process of the feature parameter set is as follows: historical node behavior characteristics are obtained from a preset database, and the historical node behavior characteristics represent the node behavior characteristics in the historical time period; historical node behavior characteristics are statistically analyzed according to the node ID to obtain historical feature reference values ​​and historical feature reference deviations, and the historical feature reference values ​​represent the average value of historical behavior characteristics of the same node ID. The historical feature reference values ​​include reference node frequency, reference average interval time, reference average upload amount and reference average download amount, and the historical feature reference deviation represents the standard deviation of historical behavior characteristics of the same node ID.

[0047] In this embodiment, the historical feature reference value represents the average value corresponding to the node frequency, average interval time, average upload volume and average download volume of a certain promotion node within a historical period of time, which is used to measure whether the behavior of the current promotion node is consistent with its past behavior pattern. The historical feature reference deviation represents the standard deviation of the node frequency, average interval time, average upload volume and average download volume of a certain promotion node within the same historical period of time, which is used to measure the fluctuation range of the node behavior characteristics of the current promotion node. By calculating the historical feature reference value and the historical feature reference deviation, reliable benchmark data is provided for abnormal behavior detection, which further enhances the reliability of abnormal behavior detection in the promotion data security analysis method.

[0048] Furthermore, a security assessment index is obtained by performing a security assessment on the promoted blockchain according to the abnormal nodes, which also includes obtaining a node influence index according to the abnormal nodes and the blockchain event logs. The node influence index is used to describe the degree of influence of the abnormal nodes on the promoted blockchain. The specific process is as follows: abnormal events are extracted from the blockchain event log according to the node ID of the abnormal node, and the abnormal events represent blockchain events operated by the abnormal nodes; abnormal events are divided into abnormal event groups according to preset levels and abnormal behavior records, and the abnormal behavior records include the event time, event type and event flow of the abnormal events. The preset level is determined by the preset personnel according to the security rules of the promoted blockchain. The abnormal event groups include the first abnormal group, the second abnormal group and the third abnormal group. The first abnormal group refers to abnormal events whose event flow is not greater than the preset data volume and the event type is a download event. The second abnormal group refers to abnormal events whose event flow is not greater than the preset data volume and the event type is an upload event. The third abnormal group refers to abnormal events whose event flow is greater than the preset data volume. The preset data The amount is determined by the preset personnel according to the historical event flow in the preset database; the abnormal event group is counted to obtain the number of abnormal node events, which includes the first node event number, the second node event number and the third node event number. The first node event number represents the number of abnormal events in the first abnormal group, the second node event number represents the number of abnormal events in the second abnormal group, and the third node event number represents the number of abnormal events in the third abnormal group; the preset level weight is obtained from the preset database, and the preset level weight includes the first level weight, the second level weight and the third level weight. The first level weight is used to describe the degree of influence of the abnormal events of the first abnormal group on the node impact index, the second level weight is used to describe the degree of influence of the abnormal events of the second abnormal group on the node impact index, and the third level weight is used to describe the degree of influence of the abnormal events of the third abnormal group on the node impact index; the node impact index of the abnormal node is obtained by the number of abnormal node events, the preset level weight and the event time of the abnormal event. The specific calculation formula of the node impact index is as follows:

[0049] +1;

[0050] Where n is the number of the abnormal node, , N is the total number of abnormal nodes, is the node influence index of the nth abnormal node, is the number of the abnormal event in the first abnormal group of the nth abnormal node, , is the total number of abnormal events in the first abnormal group of the nth abnormal node, is the number of the abnormal event in the second abnormal group of the nth abnormal node, , is the total number of abnormal events in the second abnormal group of the nth abnormal node, is the number of the abnormal event in the third abnormal group of the nth abnormal node, , is the total number of abnormal events in the third abnormal group of the nth abnormal node, is the first abnormal group of the nth abnormal node The event time of an abnormal event, is the nth abnormal node in the second abnormal group The event time of an abnormal event, is the nth abnormal node in the third abnormal group The event time of an abnormal event, To evaluate the time, is the time decay factor, is the first level weight, is the second level weight, The third level weight.

[0051] In this embodiment, the evaluation time is the moment of evaluation obtained by the clock, which is in the format of a timestamp; the number of abnormal node events is used to describe the number of abnormal events that occur in the abnormal node in the promoted blockchain. The higher the number of abnormal node events, the more frequent the abnormal activities of the promoted node, and the greater the security threat to the promoted blockchain, so the node impact index is higher; the time decay factor and event time are used to describe the timeliness of the abnormal event on the node impact index. The abnormal events that occurred earlier have a smaller impact on the node impact index, while the abnormal events that occurred recently have a greater impact on the node impact index. Therefore, the larger the event time, the lower the node impact index; the preset level weight is used to measure the contribution of different types of abnormal events to the node impact index. The larger the preset level weight, the more significant the impact of this type of abnormal event on the node impact index, so the node impact index is higher; the node impact index comprehensively considers the number of abnormal node events, the time decay factor, the event time and the preset level weight, and is used to describe the overall impact of the abnormal node on the promoted blockchain. The higher the node impact index, the greater the impact of the abnormal node on the promoted blockchain.

[0052] In order to simplify the description of the independent variables of the node influence index, the first event time index is defined as , is the first abnormal group of the nth abnormal node The first event time index of the abnormal event is defined as , is the nth abnormal node in the second abnormal group The second event time index of the abnormal event is defined as , is the nth abnormal node in the third abnormal group The third event time index of an abnormal event is simplified as follows: +1, is 2.5, nA, nB and nC are all 1, is 0.3, is 0.3, Taking 0.4 as an example, Figure 2 As shown, it is a schematic diagram of the change of the node influence index provided in the embodiment of the present application. It can be seen from the figure that the first event time index, the second event time index and the node influence index are positively correlated. Because an abnormal node has limited influence on the promoted blockchain, as the first event time index and the second event time index increase, the node influence index approaches 2; the first event time index, the second event time index and the third event time index are combined to quantify the behavior of the abnormal node in the promoted blockchain into a specific index value, which provides an important reference basis for the next security assessment, thereby improving the reliability of the security assessment in the promoted data security analysis method.

[0053] Specifically, the first level weight is obtained from a preset database. In a specific embodiment, a mapping set of the first event time index and the first level weight is constructed according to the relationship between the first event time index and the node influence index in the historical time period, and the real-time first event time index is input into the mapping set to obtain the corresponding first level weight.

[0054] Specifically, the second level weight is obtained from a preset database. In a specific embodiment, a mapping set of the second event time index and the second level weight is constructed according to the relationship between the second event time index and the node influence index in the historical time period, and the real-time second event time index is input into the mapping set to obtain the corresponding second level weight.

[0055] Specifically, the third level weight is obtained from a preset database. In a specific embodiment, a mapping set of the third event time index and the first level weight is constructed according to the relationship between the third event time index and the node influence index in the historical time period, and the real-time third event time index is input into the mapping set to obtain the corresponding third level weight.

[0056] Specifically, the time decay factor is obtained from a preset database. In a specific embodiment, a mapping set of event time and time decay factor is constructed according to the relationship between the event time of abnormal events in the historical time period and the node impact index, and the real-time event time is input into the mapping set to obtain the corresponding time decay factor.

[0057] The algorithm of this embodiment combines the "first event time index of the th abnormal event in the first abnormal group of the nth abnormal node", "the second event time index of the th abnormal event in the second abnormal group of the nth abnormal node" and "the third event time index of the th abnormal event in the third abnormal group of the nth abnormal node" to obtain the "node influence index of the nth abnormal node" through comprehensive analysis. In addition, each parameter is related to each other and does not exist independently. It is a whole. The "node influence index of the nth abnormal node" cannot be obtained by simple combination and addition. For example, in this formula, the "first event time index of the th abnormal event in the first abnormal group of the nth abnormal node" is conducive to increasing the " The node influence index of the nth abnormal node does not necessarily mean that the node influence index of the nth abnormal node is large. At this time, it is also necessary to consider the "second event time index of the th abnormal event in the second abnormal group of the nth abnormal node" and the "third event time index of the th abnormal event in the third abnormal group of the nth abnormal node". It can also determine the influence of abnormal nodes on the promotion of blockchain. The correlation and mutual influence between various factors are considered in a quantitative way. The algorithm itself is obtained through comprehensive analysis, which can accurately and quantitatively analyze the influence of abnormal nodes on the promotion of blockchain, indicating the effect of comprehensive evaluation of node influence index. Therefore, accurate analysis is carried out by establishing mathematical form.

[0058] Furthermore, the specific calculation process of the security assessment index is as follows: obtain the preset security weight from the preset database, the preset security weight includes the first weight, the second weight, the third weight and the fourth weight, the first weight is used to describe the influence of the node frequency deviation on the security assessment index, the second weight is used to describe the influence of the average interval time deviation on the security assessment index, the third weight is used to describe the influence of the average upload volume deviation on the security assessment index, and the fourth weight is used to describe the influence of the average download volume deviation on the security assessment index; the security assessment index is obtained according to the abnormal parameters, the node impact index and the preset security weight. The specific calculation formula of the security assessment index is as follows:

[0059] ;

[0060] In the formula, , M is the total number of promoted nodes, To promote the security assessment index of blockchain, is the node frequency deviation of the mth promoted node, is the average interval time deviation of the mth promotion node, is the average upload deviation of the mth promotion node, is the average download deviation of the mth promotion node, is the node frequency reference deviation of the mth promoted node, is the average interval time reference deviation, is the average upload reference deviation, is the reference deviation of the average download volume, is the first weight, is the second weight, is the third weight, The fourth weight.

[0061] In this embodiment, the node frequency deviation indicates the difference between the node frequency of the promoted node and the reference node frequency. A larger node frequency deviation indicates that the promoted node has performed an abnormally large number of operations in a short period of time, or vice versa, the operations are too rare, both of which may indicate potential security risks, so the security assessment index is lower; the average interval time deviation indicates the difference between the average time interval of the promoted node and the reference average time interval. A larger average interval time deviation indicates that the operation mode of the promoted node has undergone an abnormal change, so the security assessment index is lower; the average upload volume deviation indicates the difference between the average upload volume of the promoted node and the reference average upload volume. A larger average upload volume deviation indicates that the promoted node suddenly uploads a large amount of data or the uploaded data volume drops sharply, so the security assessment index is lower; the average download volume deviation indicates the difference between the average download volume of the promoted node and the reference average download volume , a larger average download volume deviation indicates that the download volume of the promoted node has undergone significant abnormal changes, so the security assessment index is lower; the node influence index indicates the overall impact of the abnormal node on the promoted blockchain. The higher the node influence index, the greater the impact of the abnormal node on the promoted blockchain, so the security assessment index is lower; the preset security weight is used to measure the impact of the behavioral feature deviation on the security assessment index. The larger the preset security weight, the more significant the impact of the behavioral feature deviation on the security assessment index, so the security assessment index is lower; the security assessment index comprehensively considers the behavioral feature deviation of all promoted nodes, the preset security weight and the node impact index of the abnormal node, and is used to comprehensively measure the security of the promoted blockchain. The higher the security assessment index, the safer the promoted blockchain, and vice versa, it indicates that there are greater security risks.

[0062] In order to simplify the description of the independent variables of the safety assessment index, the node frequency deviation index is defined as , is the node frequency deviation index of the mth promotion node, and the average interval time deviation index is defined as , is the average interval time deviation index of the mth promotion node, and the average upload volume deviation index is defined as , is the average upload deviation index of the mth promotion node, and the average download deviation index is defined as , is the average download deviation index of the mth promotion node, and the simplified formula is: , with N and M both equal to 1, is 0.2, is 0.3, is 0.3, Taking 0.2 as an example, the statistical table of changes in the safety assessment index is shown in Table 1:

[0063] Table 1 Statistics of changes in safety assessment index

[0064] Node Impact Index 1.5 3.1 1.5 1.5 1.5 1.5 Node frequency deviation index 0.21 0.21 0.76 0.21 0.21 0.21 Mean Interval Deviation Index 0.25 0.25 0.25 0.83 0.25 0.25 Average upload deviation index 0.24 0.24 0.24 0.24 0.81 0.24 Average download volume deviation index 0.12 0.12 0.12 0.12 0.12 0.78 Safety Assessment Index 0.539 0.261 0.483 0.453 0.454 0.472

[0065] According to the data in the first and second columns of Table 1, it can be seen that when the node influence index increases, the security assessment index decreases, and the node influence index and the security assessment index are inversely correlated; according to the data in the first and third columns, it can be seen that when the node frequency deviation index increases, the security assessment index decreases, and the node frequency deviation index and the security assessment index are inversely correlated; according to the data in the first and fourth columns, it can be seen that when the average interval time deviation index increases, the security assessment index decreases, and the average interval time deviation index and the security assessment index are inversely correlated; according to the data in the first and fifth columns, it can be seen that when the average upload deviation index increases, the security assessment index decreases, and the average upload deviation index and the security assessment index are inversely correlated; according to the data in the first and sixth columns, it can be seen that when the average download deviation index increases, the security assessment index decreases, and the average download deviation index and the security assessment index are inversely correlated; By comprehensively obtaining the security assessment index from the node influence index, the node frequency deviation index, the average interval time deviation index, the average upload deviation index and the average download deviation index, the interference of subjective factors can be effectively avoided, thereby improving the accuracy of security assessment in the promotion data security analysis method.

[0066] Specifically, the first weight is obtained from a preset database. In a specific embodiment, a mapping set of the node frequency deviation index and the first weight is constructed according to the relationship between the node frequency deviation index and the safety assessment index in a historical time period, and the real-time node frequency deviation index is input into the mapping set to obtain the corresponding first weight.

[0067] Specifically, the second weight is obtained from a preset database. In a specific embodiment, a mapping set of the average interval time deviation index and the second weight is constructed according to the relationship between the average interval time deviation index and the safety assessment index in the historical time period, and the real-time average interval time deviation index is input into the mapping set to obtain the corresponding second weight.

[0068] Specifically, the third weight is obtained from a preset database. In a specific embodiment, a mapping set of the average upload deviation index and the third weight is constructed according to the relationship between the average upload deviation index and the security assessment index in a historical time period, and the real-time average upload deviation index is input into the mapping set to obtain the corresponding third weight.

[0069] Specifically, the fourth weight is obtained from a preset database. In a specific embodiment, a mapping set of the average download volume deviation index and the fourth weight is constructed according to the relationship between the average download volume deviation index and the security assessment index in a historical time period, and the real-time average download volume deviation index is input into the mapping set to obtain the corresponding fourth weight.

[0070] The algorithm of this embodiment combines the "node influence index of the nth abnormal node", "node frequency deviation index of the mth promoted node", "average interval time deviation index of the mth promoted node", "average upload deviation index of the mth promoted node" and "average download deviation index of the mth promoted node" to obtain the "security assessment index of the promoted blockchain" through comprehensive analysis. In addition, each parameter is related to each other and does not exist independently. It is a whole. It is not possible to obtain the "security assessment index of the promoted blockchain" by simply combining and adding them. For example, the "node influence index of the nth abnormal node" in this formula is conducive to reducing the "security assessment index of the promoted blockchain". Index", does not necessarily mean that the "security assessment index of the promoted blockchain" is small. At this time, it is also necessary to consider the "node frequency deviation index of the m-th promoted node", "average interval time deviation index of the m-th promoted node", "average upload volume deviation index of the m-th promoted node" and "average download volume deviation index of the m-th promoted node". It can also determine the security status of the promoted blockchain. The correlation and mutual influence between various factors are considered in a quantitative way. The algorithm itself is obtained through comprehensive analysis, which can accurately and quantitatively analyze the security status of the promoted blockchain, indicating the effect of comprehensive evaluation of the security assessment index. Therefore, precise analysis is carried out by establishing mathematical forms.

[0071] Furthermore, the specific process of blockchain security visualization is as follows: obtain the number of abnormal nodes and the security assessment index from the preset database, and draw a scatter plot of the number of abnormal nodes-security assessment index with the number of abnormal nodes as the X-axis and the security assessment index as the Y-axis. The scatter plot of the number of abnormal nodes-security assessment index is used to show the relationship between the number of abnormal nodes and the security assessment index. Each point in the figure represents an abnormal node number and its corresponding security assessment index; obtain the node influence index of the abnormal node from the preset database, and draw an abnormal node influence diagram with the number of the abnormal node as the X-axis and the node influence index as the Y-axis. The abnormal node influence diagram is used to show the relationship between the abnormal node and the node influence index. Each point in the figure represents the abnormal node number and its corresponding node influence index.

[0072] In this embodiment, the scatter plot of abnormal node quantity-security evaluation index reflects the relationship between the number of abnormal nodes and overall security. Figure 3 As shown in FIG. 1 , a scatter plot of the number of abnormal nodes and the security assessment index provided in an embodiment of the present application is shown. In the figure, 0.7 is set as the threshold of the security assessment index. It can be seen from the figure that when the number of abnormal nodes reaches 3, the security assessment index is less than the threshold, indicating that there is a greater security risk in the promotion of blockchain at this time, and further processing is required by relevant personnel; the abnormal node impact diagram reflects the degree of influence of each abnormal node on the security of the blockchain, such as Figure 4 As shown, it is an abnormal node impact diagram provided in an embodiment of the present application. It can be seen from the figure that the abnormal node numbered 6 has the highest node impact index. Relevant personnel should give priority to processing this abnormal node to reduce potential threats to the promotion of blockchain; by visually displaying the security assessment index and the abnormal node impact index, relevant personnel can identify key issues in the promotion of blockchain in a short time, thereby improving the efficiency of the promotion data security analysis method.

[0073] like Figure 5As shown, it is a structural schematic diagram of a blockchain-based promotion data security analysis system provided by an embodiment of the present application. The blockchain-based promotion data security analysis system provided by an embodiment of the present application includes: a data collection module, a feature extraction module, an abnormal behavior detection module and a blockchain security visualization module; wherein the data collection module is used to collect data from the promotion blockchain to obtain node behavior records, the promotion blockchain represents a blockchain network that stores promotion data, the promotion data refers to data related to promotion activities, data collection refers to real-time recording of promotion nodes to collect node behavior records, the promotion node refers to an individual node in the promotion blockchain, and the node behavior record refers to the operation record of the promotion node on the promotion blockchain; the feature extraction module is used to obtain node behavior features by extracting features from the node behavior records, and feature extraction refers to obtaining the behavior features of the promotion nodes by analyzing the node behavior records. The node behavior characteristics are used to describe the operation frequency and interval of the promotion nodes on the promotion blockchain; the abnormal behavior detection module is used to perform abnormal behavior detection on the node behavior characteristics according to abnormal conditions to obtain abnormal nodes, and perform security assessment on the promotion blockchain according to the abnormal nodes to obtain a security assessment index. The abnormal conditions are obtained through the node behavior characteristics of the historical time period. Abnormal behavior detection refers to marking abnormal nodes by analyzing the behavior characteristics of the promotion nodes. Abnormal nodes represent node behavior characteristics that meet the abnormal conditions. Security assessment refers to evaluating the overall security status of the promotion blockchain based on abnormal nodes. The security assessment index is used to reflect the security status of the promotion blockchain; the blockchain security visualization module is used to realize blockchain security visualization through abnormal nodes and security assessment index. Blockchain security visualization is used to show the relationship between the security assessment index and abnormal nodes of the promotion blockchain during operation.

[0074] In this embodiment, the data collection module includes a blockchain event listener and a data collection server. The blockchain event listener is used to monitor the promotion node operations in the promotion blockchain in real time and capture various operation events occurring in the blockchain network. The data collection server is used to centrally store the blockchain events collected by the blockchain event listener and extract them to obtain node behavior records; the feature extraction module includes a feature calculation program, and the feature calculation program is used to obtain node frequency, average interval time, average upload volume and average download volume through node behavior records; the abnormal behavior detection module includes an abnormal detection program and a security assessment program. The abnormal detection program is used to detect abnormal patterns in node behavior characteristics and mark abnormal nodes according to preset abnormal conditions. The security assessment program is used to calculate the security assessment index based on the detected abnormal nodes, thereby evaluating the overall security status of the promotion blockchain; the blockchain security visualization module includes a chart generator and a display device. The chart generator is used to generate charts of the security assessment index and the abnormal node impact index, and the display device is used to display these charts to achieve a visual display of blockchain security; through the collaborative work of the four modules, real-time monitoring of the promotion blockchain, abnormal behavior detection, security assessment and visual display of their results are achieved.

[0075] To summarize, the embodiment of the present application collects data on the promoted blockchain, extracts features from the obtained node behavior records to obtain node behavior features, then performs abnormal behavior detection in combination with abnormal conditions to obtain abnormal nodes, and based on this, performs a security assessment on the promoted blockchain to obtain a security assessment index, and finally realizes blockchain security visualization, thereby achieving an intuitive display of the security of the promoted blockchain, and further achieving a more accurate implementation of blockchain-based promotion data security analysis, effectively solving the problem of insufficient correlation between the accuracy of blockchain-based promotion data security analysis and nodes in the prior art.

[0076] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0077] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0078] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0079] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0080] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0081] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A promotion data security analysis method based on blockchain, characterized in that: The following steps are involved: S1, collecting data from the promotion blockchain to obtain node behavior records, wherein the promotion blockchain represents a blockchain network storing promotion data, and the node behavior records refer to operation records of the promotion nodes on the promotion blockchain; S2, extracting features from the node behavior records to obtain node behavior features, where the node behavior features are used to describe the operation frequency and interval of the promoted node on the promoted blockchain; S3, performing abnormal behavior detection on the node behavior characteristics according to the abnormal conditions to obtain abnormal nodes, and performing security assessment on the promoted blockchain according to the abnormal nodes to obtain a security assessment index, wherein the security assessment index is used to reflect the security status of the promoted blockchain; S4, realizing blockchain security visualization through abnormal nodes and security assessment index, wherein the blockchain security visualization is used to display the relationship between the security assessment index and abnormal nodes of the promoted blockchain during operation; The security assessment index is obtained by performing a security assessment on the promoted blockchain according to the abnormal nodes, and the node impact index is obtained according to the abnormal nodes and the blockchain event log. The node impact index is used to describe the degree of influence of the abnormal nodes on the promoted blockchain. The specific process is as follows: Extracting abnormal events from the blockchain event log according to the node ID of the abnormal node, wherein the abnormal event represents the blockchain event operated by the abnormal node; The abnormal events are divided into abnormal event groups according to preset levels and abnormal behavior records, wherein the abnormal behavior records include event time, event type and event flow of the abnormal events; The abnormal event group is counted to obtain the number of abnormal node events; Get preset level weights from a preset database; The node impact index of the abnormal node is obtained by the number of abnormal node events, the preset level weight and the event time of the abnormal event; The specific calculation process of the safety assessment index is as follows: Obtain preset security weights from a preset database; The safety assessment index is obtained based on abnormal parameters, node impact index and preset safety weight; The specific steps of abnormal behavior detection are as follows: C1, obtaining a characteristic parameter set through a preset database, wherein the characteristic parameter set includes a historical characteristic reference value and a historical characteristic reference deviation, wherein the historical characteristic reference deviation includes a node frequency reference deviation, an average interval time reference deviation, an average upload amount reference deviation, and an average download amount reference deviation; C2, obtains behavior feature deviation by generalizing node behavior features and historical feature reference values ​​of the node, wherein the behavior feature deviation includes node frequency deviation, average interval time deviation, average upload amount deviation and average download amount deviation; C3, obtaining abnormal conditions through abnormal parameters, wherein the abnormal parameters include behavioral feature deviation and historical feature reference deviation; C4, screening the promoted nodes according to the abnormal conditions to obtain abnormal nodes, wherein the abnormal nodes refer to the promoted nodes that meet any two abnormal conditions.

2. A blockchain-based promotion data security analysis method as claimed in claim 1, characterized in that: The specific steps of data collection are as follows: A1, using a monitoring tool to monitor the promoted blockchain in real time to obtain blockchain events, and record the blockchain events in a blockchain event log. The blockchain events refer to the state changes and operation records of the promoted blockchain generated by the promotion node operation; A2, extracting a preset number of blockchain events from the blockchain event log, and obtaining node behavior records based on the blockchain events, wherein the node behavior records include node ID, event time, event type and event traffic, wherein the event type includes upload events and download events, and the event traffic is used to describe the amount of data uploaded or downloaded by the promotion node.

3. A blockchain-based promotion data security analysis method as claimed in claim 2, characterized in that: The specific steps of feature extraction are as follows: B1, count the node behavior records according to the node ID to obtain the participation times and total node times of the corresponding promoted node, and obtain the node frequency according to the participation times and total node times, where the participation times represent the number of blockchain events corresponding to the node ID in the node behavior record, and the total node times represent the number of blockchain events with different node IDs in the node behavior record; B2, the node behavior records are counted by event time and node ID to obtain the average interval time of the corresponding promoted node, and the average interval time refers to the average value of all interval times of the corresponding node ID; B3, classify the node behavior records according to the event type to obtain upload records and download records, and count the upload records and download records according to the node ID to obtain the number of uploads, the amount of uploaded data, the number of downloads, and the amount of downloaded data, thereby obtaining the average upload amount and the average download amount. The node behavior characteristics include node frequency, average interval time, average upload amount and average download amount.

4. A blockchain-based promotion data security analysis method as claimed in claim 1, characterized in that: The abnormal conditions include a first condition, a second condition, a third condition and a fourth condition; The first condition is that the node frequency deviation of the promoted node is greater than twice the node frequency reference deviation; The second condition is that the average interval time deviation of the promoted nodes is greater than twice the average interval time reference deviation; The third condition is that the average upload deviation of the promotion node is greater than twice the average upload reference deviation; The fourth condition is that the average download volume deviation of the promotion node is greater than twice the average download volume reference deviation.

5. A blockchain-based promotion data security analysis method as claimed in claim 1, characterized in that: The specific process of obtaining the characteristic parameter set is as follows: Acquire historical node behavior features from a preset database, where the historical node behavior features represent node behavior features in a historical time period; A historical feature reference value and a historical feature reference deviation are obtained by performing a statistical analysis on the historical node behavior features according to the node ID. The historical feature reference value includes a reference node frequency, a reference average interval time, a reference average upload amount, and a reference average download amount.

6. A blockchain-based promotion data security analysis method as claimed in claim 1, characterized in that: The specific process of blockchain security visualization is as follows: Obtain the number of abnormal nodes and the safety assessment index from a preset database, and draw a scatter plot of the number of abnormal nodes-safety assessment index with the number of abnormal nodes as the X-axis and the safety assessment index as the Y-axis, wherein the scatter plot of the number of abnormal nodes-safety assessment index is used to show the relationship between the number of abnormal nodes and the safety assessment index; The node influence index of the abnormal node is obtained from the preset database, and an abnormal node influence diagram is drawn with the number of the abnormal node as the X-axis and the node influence index as the Y-axis. The abnormal node influence diagram is used to show the relationship between the abnormal node and the node influence index.

7. A system for applying the blockchain-based promotion data security analysis method as described in any one of claims 1 to 6, characterized in that: include: Data collection module, feature extraction module, abnormal behavior detection module and blockchain security visualization module; The data collection module is used to collect data from the promotion blockchain to obtain node behavior records, the promotion blockchain represents a blockchain network storing promotion data, and the node behavior records refer to operation records of promotion nodes on the promotion blockchain; The feature extraction module is used to obtain node behavior features by extracting features from node behavior records, and the node behavior features are used to describe the operation frequency and interval of the promotion node on the promotion blockchain; The abnormal behavior detection module is used to perform abnormal behavior detection on the node behavior characteristics according to the abnormal conditions to obtain abnormal nodes, and to perform security assessment on the promoted blockchain according to the abnormal nodes to obtain a security assessment index, wherein the abnormal nodes represent the node behavior characteristics that meet the abnormal conditions, and the security assessment index is used to reflect the security status of the promoted blockchain; The blockchain security visualization module is used to realize blockchain security visualization through abnormal nodes and security assessment indexes, and the blockchain security visualization is used to display the relationship between relevant data of the promoted blockchain during operation.

Images