Method for detecting block chain transaction abnormity and related product

Abstract

The invention discloses a method for detecting block chain transaction abnormity and a related product. The method comprises the following steps: acquiring first index data of a business index of a block chain transaction platform in a first period and second index data of the business index in a second period; determining a target confidence level of the second period according to the development stage of the second period; under the condition that the second index data is smaller than the first index data, determining a target threshold determination model corresponding to the target confidence level from a plurality of preset threshold determination models; determining a model according to the first data set and a target threshold value, and generating a judgment threshold value matched with the second period; and under the condition that the change rate from the first index data to the second index data is greater than a judgment threshold, determining that the transaction of the block chain transaction platform is abnormal. According to the embodiment of the invention, the transaction abnormity can be more accurately captured, and the detection sensitivity and accuracy are effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain, and in particular relates to a method for detecting blockchain transaction anomalies and related products. Background Art

[0002] In blockchain trading platforms, daily trading volume is an important indicator for measuring market activity and liquidity. Its fluctuation directly reflects the overall health of the trading platform. Once the daily trading volume fluctuates abnormally, such as a sudden drop, it may indicate an increase in market risk. Therefore, by continuously monitoring the changing trend of daily trading volume, it is possible to capture market dynamics in real time and detect data anomalies in a timely manner.

[0003] Therefore, for anomaly detection on blockchain trading platforms, monitoring the lower bound change rate of time series data is a common and effective method. By monitoring the change trend of data in real time and setting a reasonable threshold, abnormal data can be quickly identified.

[0004] However, due to different market conditions, trading products or time periods, the distribution of data often varies significantly. Therefore, if we only rely on fixed thresholds to detect trading anomalies, it is likely to lead to inaccurate detection results. Summary of the invention

[0005] Embodiments of the present invention provide a method for detecting blockchain transaction anomalies and related products. Specifically, the related products include devices, electronic devices, computer-readable storage media, and computer program products corresponding to the method for detecting blockchain transaction anomalies, which can more accurately capture transaction anomalies and effectively improve the sensitivity and accuracy of detection.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting blockchain transaction anomalies, the method comprising:

[0007] Obtain first indicator data of the business indicator of the blockchain trading platform in the first period and second indicator data in the second period, where the first period is earlier than the second period;

[0008] Determine the target confidence level for the second cycle based on the development stage of the second cycle;

[0009] In a case where the second indicator data is less than the first indicator data, determining a target threshold determination model corresponding to a target confidence level from a plurality of preset threshold determination models;

[0010] Determine a model according to the first data set and the target threshold value, and generate a judgment threshold value matching the second period, wherein the first data set includes a plurality of third indicator data of the business indicator within a first preset time period, and the first preset time period is earlier than the second period in time;

[0011] When the rate of change from the first indicator data to the second indicator data is greater than the judgment threshold, it is determined that the transaction on the blockchain transaction platform is abnormal.

[0012] As an optional implementation, the confidence level includes a first confidence level, a second confidence level, and a third confidence level with confidence intervals from wide to narrow. According to the development stage of the second cycle, determining the target confidence level of the second cycle includes:

[0013] When the development stage of the second cycle is the release stage, the target confidence level is determined to be the third confidence level;

[0014] When the development stage of the second cycle is a stable stage, the target confidence level is determined according to the user's corresponding risk sensitivity.

[0015] As an optional implementation, the risk sensitivity level includes a first level and a second level with increasing sensitivity in sequence, and the target confidence level is determined according to the risk sensitivity level corresponding to the user, including:

[0016] When the risk sensitivity level corresponding to the user is at the second level, determining the target confidence level to be the first confidence level;

[0017] When the risk sensitivity level corresponding to the user is at the first level, the target confidence level is determined to be the second confidence level.

[0018] As an optional implementation manner, before determining a target threshold determination model corresponding to a target confidence level from a plurality of preset threshold determination models, the method further includes:

[0019] Calculate the rate of change from the first indicator data to the second indicator data;

[0020] Determining a target threshold determination model corresponding to a target confidence level from a plurality of preset threshold determination models includes:

[0021] When the second indicator data is smaller than the first indicator data and the rate of change is greater than a preset threshold, a target threshold determination model corresponding to the target confidence level is determined from a plurality of preset threshold determination models.

[0022] As an optional implementation manner, before determining a target threshold determination model corresponding to a target confidence level from a plurality of preset threshold determination models, the method further includes:

[0023] Construct m confidence levels and the confidence interval corresponding to the i-th confidence level among the m confidence levels, i∈[1,m], and i and m are both positive integers;

[0024] Determine a first variable and a second variable corresponding to the i-th confidence level, the first variable represents an average of multiple indicator data of the same category, and the second variable represents a degree of dispersion of multiple indicator data of the same category;

[0025] A threshold determination model corresponding to a confidence interval of an i-th confidence level is constructed according to the first variable and the second variable.

[0026] As an optional implementation, a threshold determination model corresponding to a confidence interval of the i-th confidence level is constructed according to the first variable and the second variable, including:

[0027] When the i-th confidence level is the first confidence level, the first threshold determination model corresponding to the confidence interval of the first confidence level is constructed using the following expression:

[0028] μ-3σ

[0029] When the i-th confidence level is the second confidence level, a second threshold determination model corresponding to the confidence interval of the second confidence level is constructed using the following expression:

[0030] μ-2σ

[0031] When the i-th confidence level is the third confidence level, the third threshold determination model corresponding to the confidence interval of the third confidence level is constructed using the following expression:

[0032] μ-σ

[0033] Among them, μ is the average amount of multiple indicator data of the same category, σ is the standard deviation of multiple indicator data of the same category, Rate n-1 , n represents the change rate from the n-1th indicator data to the nth indicator data in multiple indicator data of the same category, It represents the average value of all change rates in multiple indicator data of the same category.

[0034] In a second aspect, an embodiment of the present application provides a device for detecting blockchain transaction anomalies, the device comprising:

[0035] A first acquisition module is used to obtain first indicator data of a business indicator of a blockchain trading platform in a first period and second indicator data in a second period, where the first period is earlier than the second period in time;

[0036] A first determination module, used to determine a target confidence level of the second cycle according to the development stage of the second cycle;

[0037] A second determination module, configured to determine a target threshold determination model corresponding to a target confidence level from a plurality of preset threshold determination models when the second indicator data is less than the first indicator data;

[0038] a third determination module, configured to determine a model according to a first data set and a target threshold value, and generate a judgment threshold value matching the second period, wherein the first data set includes a plurality of third indicator data of the business indicator within a first preset time period, and the first preset time period is earlier than the second period in time;

[0039] The fourth determination module is used to determine that the transaction on the blockchain trading platform is abnormal when the change rate from the first indicator data to the second indicator data is greater than the judgment threshold.

[0040] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising: a processor and a memory storing computer program instructions;

[0041] When the processor executes the computer program instructions, it implements the method for detecting blockchain transaction anomalies as described in any one of the first aspects.

[0042] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, a method for detecting blockchain transaction anomalies as described in any one of the first aspects is implemented.

[0043] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is processed and executed, it implements the method for detecting blockchain transaction anomalies of any one of the first aspects.

[0044] The method and related products for detecting blockchain transaction anomalies in the embodiments of the present application have constructed multiple threshold determination models based on different confidence levels, which can adapt to the transaction environment under different time periods, thereby significantly improving the applicability and accuracy of the threshold determination model in various situations. Specifically, the embodiments of the present application can find a target threshold determination model that matches the target confidence level corresponding to the development stage of the second cycle. Then, the target threshold determination model is used to determine the judgment threshold that matches the current second cycle. Finally, in the transaction anomaly detection of the blockchain transaction platform, transaction anomalies are identified based on the judgment threshold.

[0045] Since data from different time periods may have different volatility characteristics, different volatility characteristics require different confidence levels, and multiple threshold determination models built based on different confidence levels take into account the correlation between time periods and data volatility characteristics. Therefore, by determining the judgment threshold through a target threshold determination model that matches the confidence level of the current time period, it can be effectively ensured that the judgment threshold is consistent with the actual data volatility of the current time period, and then based on the judgment threshold, abnormal transactions under the current data volatility characteristics can be more accurately judged, significantly improving the sensitivity and accuracy of transaction anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A chart showing daily transaction volume data of a blockchain trading platform in a specific month provided by an embodiment of the present application;

[0048] Figure 2 A schematic diagram of a process for detecting blockchain transaction anomalies provided by an embodiment of the present application is shown;

[0049] Figure 3 A flowchart of a specific implementation method of S202 provided in an embodiment of the present application is shown;

[0050] Figure 4 A flowchart of a specific implementation method of S2022 provided in an embodiment of the present application is shown;

[0051] Figure 5 A flowchart of a method for detecting blockchain transaction anomalies provided by another embodiment of the present application is shown;

[0052] Figure 6 A schematic diagram of the structure of a device for detecting blockchain transaction anomalies provided by an embodiment of the present application is shown;

[0053] Figure 7 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0054] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0055] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0056] Before describing the technical solutions provided by the embodiments of the present application, in order to facilitate the understanding of the embodiments of the present application, the present application first specifically describes the relevant technologies:

[0057] The blockchain trading platform is a digital currency trading platform based on blockchain technology. The blockchain trading platform adopts a decentralized trading model and does not require the participation of centralized institutions or third parties. The transaction process is achieved through mutual verification and consensus among many nodes.

[0058] Anomaly detection on blockchain trading platforms is a key link in ensuring transaction security and system stability. Anomaly detection on blockchain trading platforms mainly covers two aspects: transaction anomalies and resource usage anomalies. Transaction anomaly detection monitors transaction data in real time to identify problems such as repeated transactions and decreased transaction volume. Resource usage anomaly detection monitors the use of machine resources by blockchain nodes to prevent excessive resource consumption from affecting system health.

[0059] For transaction anomaly detection on blockchain trading platforms, monitoring the lower bound change rate of time series data is a common and effective method. By monitoring the change trend of data in real time and setting a reasonable threshold, abnormal data can be quickly identified. However, the detection method with a single fixed threshold may not be accurate enough.

[0060] For example, in Figure 1In the data of daily transaction volume of a blockchain system shown in the figure, it can be seen that on the 6th, 13th and 29th of the month, the transaction volume decreased by 30.33%, 30.30% and 39.69% respectively. The significant month-on-month decrease on a specific date may indicate some abnormality in the market or within the platform. However, different market conditions may lead to different normal fluctuation ranges of transaction volume. For example, in a high-volatility market, a 30% daily transaction volume change may be just part of the normal market fluctuation, while in a low-volatility market, such a change may indicate a problem. In addition, the fluctuation of transaction volume may be related to the time period. For example, the transaction volume changes before and after holidays and at the opening and closing of the market may be different from those on normal trading days. Therefore, using the daily transaction volume change rate exceeding 30% as the abnormal threshold often cannot adapt to various situations under different market conditions, which may affect the accuracy and effectiveness of the transaction anomaly detection results.

[0061] In order to solve the above problems, the embodiments of the present application provide a method for detecting blockchain transaction anomalies and related products. The method for detecting blockchain transaction anomalies provided by the embodiments of the present application is first introduced below.

[0062] Figure 2 The following is a flow chart of a method for detecting blockchain transaction anomalies provided by an embodiment of the present application. Figure 2 As shown, the method may include the following steps: S201-S205.

[0063] S201: Obtain first indicator data of a business indicator of a blockchain transaction platform in a first period and second indicator data in a second period, wherein the first period is earlier than the second period in time.

[0064] S202: Determine a target confidence level for the second cycle according to the development stage of the second cycle.

[0065] S203: When the second indicator data is less than the first indicator data, determine a target threshold determination model corresponding to the target confidence level from a plurality of preset threshold determination models.

[0066] S204: Determine a model based on the first data set and the target threshold value to generate a judgment threshold value matching the second cycle, wherein the first data set includes a plurality of third indicator data of the business indicator within a first preset time period, and the first preset time period is earlier than the second cycle in time.

[0067] S205: When the rate of change from the first indicator data to the second indicator data is greater than the judgment threshold, it is determined that the blockchain transaction platform transaction is abnormal.

[0068] In the embodiment of the present application, multiple threshold determination models based on different confidence levels are constructed, which can adapt to the trading environment under different time periods, thereby significantly improving the applicability and accuracy of the threshold determination model in various situations. Specifically, first, a target threshold determination model matching the target confidence level corresponding to the development stage of the second cycle is found. Then, the target threshold determination model is used to determine the judgment threshold matching the current second cycle. Finally, in the transaction anomaly detection of the blockchain trading platform, transaction anomalies are identified based on the judgment threshold.

[0069] Since data from different time periods may have different volatility characteristics, different volatility characteristics require different confidence levels, and multiple threshold determination models built based on different confidence levels take into account the correlation between time periods and data volatility characteristics. Therefore, by determining the judgment threshold through a target threshold determination model that matches the confidence level of the current time period, it can be effectively ensured that the judgment threshold is consistent with the actual data volatility of the current time period, and then based on the judgment threshold, abnormal transactions under the current data volatility characteristics can be more accurately judged, significantly improving the sensitivity and accuracy of transaction anomaly detection.

[0070] The specific implementation methods of the above steps are introduced below.

[0071] In some embodiments, in S201, the blockchain trading platform is a platform that needs to be monitored and transaction anomaly detection. Business indicators may include transaction volume, transaction price, or the total number of nodes participating in the blockchain trading platform. The first cycle and the second cycle are cycles for collecting indicator data related to business indicators, which may be days, hours, or other time units. After each cycle, the corresponding indicator data can be collected and stored by an automated data collection tool. It is understandable that the first indicator data and the second indicator data refer to business indicators from the same category (such as transaction volume or transaction price), but at different time points.

[0072] In order to efficiently manage and analyze the business indicator data on the blockchain trading platform, as a specific example, two service programs can be integrated on the architecture of the blockchain trading platform, namely, the data synchronization service and the data acquisition service. The data synchronization service program is used to capture the indicator data related to the business indicators from the trading platform at a regular interval and accurately synchronize it to a database. The data acquisition service program dynamically retrieves and extracts the business indicator data of each cycle through interaction with the database for analysis and report generation.

[0073] In the specific implementation, in the configuration of the blockchain trading platform, add state_history_plugin (state history plug-in), which is used to record and store the indicator data corresponding to the business indicators of the blockchain trading platform. In order to further improve the searchability of the data, the data on the blockchain is synchronized with Elasticsearch (search and data analysis engine) to achieve fast indexing and efficient retrieval of indicator data. Next, use Kibana (an open source analysis and visualization platform) to work with Elasticsearch to search, view and interact with data. Through Kibana, users can access the business data of each cycle business indicator of the blockchain trading platform stored in the Elasticsearch index, so as to perform data analysis and real-time monitoring. Kibana provides a wealth of data visualization tools that enable users to easily identify patterns, trends, and possible anomalies.

[0074] In some embodiments, in S202, the development stage includes a trial stage, a release stage, and a stable stage. The trial stage means that the platform has just been launched, and the user group and transaction data are relatively small. The release stage is the initial stage of system operation, which means that the platform is in the initial stage of normal market use after the trial stage. At this time, the user group and transaction data begin to grow, but are still not very stable. The stable stage means that the system enters a stable operation period, which means that the platform is in stable operation and has a stable user group and transaction data.

[0075] Figure 3 A flowchart of a specific implementation method of S202 provided in an embodiment of the present application is shown.

[0076] As an example, the confidence level includes a first confidence level, a second confidence level, and a third confidence level with confidence intervals from wide to narrow. In order to reduce the accuracy of transaction anomaly detection on the blockchain transaction platform, as an implementation method of the present application, the present application also provides an implementation method of S202. Figure 3 As shown, the aforementioned S202 specifically includes the following steps: S2021~S2022.

[0077] S2021: When the development stage of the second cycle is the release stage, determine the target confidence level as the third confidence level.

[0078] S2022: When the development stage of the second cycle is a stable stage, determine the target confidence level according to the risk sensitivity of the user.

[0079] In some embodiments, in S2021, the user's corresponding risk sensitivity level can be determined based on the actual operation of the blockchain trading platform. Specifically, comprehensive factors such as various performance indicators, data distribution, historical performance, and the frequency and degree of possible abnormal situations exhibited during the operation of the trading platform.

[0080] In the embodiment of the present application, by using the third confidence level with a narrower confidence interval when the development stage of the second cycle is the release stage, the sensitivity to transaction anomalies is high, which helps to more strictly monitor the transaction data of the blockchain trading platform, effectively control risks, and prevent potential problems from expanding. By using a confidence level with a relatively wide confidence interval when the development stage of the second cycle is the stable stage, the probability of real transaction anomalies can be effectively monitored, which helps to reduce false alarms that are actually within the normal fluctuation range. Furthermore, the target confidence level corresponding to the second cycle in the stable stage can be more refined according to the user's personalized risk preference. By providing customized anomaly detection services for users with different risk tolerances based on the user's specific risk tolerance, it can better adapt to different user needs.

[0081] In S2022, risk sensitivity is a key indicator for assessing users' perception and tolerance of potential risks, and can usually be divided into multiple levels to provide customized anomaly detection services for users with different risk preferences. Specifically, risk sensitivity can include the first level and the second level. The first level represents a lower risk sensitivity, which is suitable for users who are relatively insensitive to risks; while the second level represents a higher risk sensitivity, which is suitable for users who are willing to bear the corresponding risks.

[0082] It is worth noting that the classification of risk sensitivity is not limited to the two fixed levels of level 1 and level 2. According to the characteristics of the trading platform and user needs, more detailed multi-level risk sensitivity can be set to provide more accurate and personalized services, so that the blockchain trading platform can more flexibly adapt to the needs of different users and market conditions.

[0083] Figure 4 A flowchart of a specific implementation method of S2022 provided in an embodiment of the present application is shown.

[0084] In order to ensure that users can maintain an acceptable risk range when facing potential market fluctuations in blockchain trading platforms. As an implementation method of this application, this application also provides an implementation method of S2022. Figure 4 As shown, the aforementioned S2022 specifically includes the following steps: S2022a~S2022b.

[0085] S2022a: When the risk sensitivity level corresponding to the user is at the second level, determine the target confidence level as the first confidence level.

[0086] S2022b: When the risk sensitivity level corresponding to the user is at the first level, determine the target confidence level as the second confidence level.

[0087] In the embodiment of the present application, by setting different confidence levels for users with different risk sensitivities, the trading platform can better adapt to the needs of different users and market conditions, and improve the flexibility and adaptability of the trading platform. At the same time, this also helps the trading platform to better perform anomaly detection, because by setting different confidence levels for users with different risk sensitivities, the trading platform can more accurately identify potential risks and abnormal trading behaviors, so as to take corresponding measures in a timely manner to ensure the stable operation of the trading platform.

[0088] As an example, a user's high risk sensitivity means that the user needs an almost certain result to reduce uncertainty and potential risks, so the confidence level corresponding to the user's high risk sensitivity is relatively high. Conversely, the confidence level corresponding to the user's low risk sensitivity is relatively low.

[0089] As another implementation of the present application, in order to further increase the accuracy of transaction anomaly detection of the trading platform, before the aforementioned S203, the following steps may also be included:

[0090] The rate of change from the first indicator data to the second indicator data is calculated by the following formula: n-1 , n:

[0091]

[0092] In formula (1), X n Represents the second indicator data, X n-1 Indicates the first indicator data.

[0093] Based on this, the aforementioned S203 may specifically include:

[0094] When the second indicator data is smaller than the first indicator data and the rate of change is greater than a preset threshold, based on the correspondence between the preset confidence level and the threshold determination model, a target threshold determination model corresponding to the target confidence level is determined from multiple preset threshold determination models.

[0095] The embodiments of the present application introduce multiple threshold determination models, which can be designed to improve the accuracy of the judgment of the lower bound abnormal data, that is, focus on the decline of the indicator data, that is, these threshold determination models can more accurately identify and quantify the decline of the indicator data, thereby ensuring the accuracy and reliability of the detection results. By limiting the size of the rate of change, the second indicator data and the first indicator data, it is helpful to comprehensively consider the relative and absolute changes in the data, so as to more comprehensively evaluate whether the decline in the indicator data is statistically and business-wise, and then optimize resource allocation, focusing attention and resources on changes that have a substantial impact on the abnormal detection of the trading platform.

[0096] In some embodiments, in S204, the first data set is a set including historical indicator data, specifically, a set of multiple third indicator data of business indicators within a first preset time period. The first preset time period is the time range covered by the collection of the first data set, and the first preset time period is earlier than the period to be detected (the second period) in time to establish a basis for transaction anomaly detection. According to the target threshold determination model and the first data set, a judgment threshold matching the second period is generated. By analyzing the patterns and trends of multiple third indicator data in the first data set through the target threshold determination model, a judgment threshold matching the current second period can be determined for transaction anomaly detection of the blockchain transaction platform.

[0097] It is worth noting here that the first period may be included in the interval of the first preset time period, or may be later than the first preset time period. The first preset time period may include multiple periods. In the scenario where the first period is included in the interval of the first preset time period, the first period may be a period that is adjacent to the second period among the multiple periods. The temporal relationship between the first period and the first preset time period depends on the actual collection requirements of the first data set and is not limited here. If the first preset time period for the collection of the first data set is adjacent to the second period of current concern, then the third indicator data corresponding to the first period that is earlier than the second period and adjacent to the second period can be included in the scope of the first data set.

[0098] Next, in S205, the rate of change is a quantitative indicator that can intuitively reflect the degree of change of the business indicator in two different time periods (the first period and the second period). The second period is the time period in which it is necessary to detect whether the blockchain trading platform transactions are abnormal. Under normal trading conditions, the rate of change of business indicators should be maintained within a relatively stable range. If the rate of change suddenly increases and exceeds the normal fluctuation range reflected by the first data set, it is likely that there is an abnormality in the trading activities in the second period.

[0099] Figure 5A flow chart of a method for detecting blockchain transaction anomalies provided by another embodiment of the present application is shown.

[0100] As an implementation of the present application, in order to construct multiple threshold determination models, before the aforementioned S203, the method may further include the following steps: S501 to S504.

[0101] S501: Construct m confidence levels and a confidence interval corresponding to the i-th confidence level among the m confidence levels, i∈[1,m], and i and m are both positive integers.

[0102] In some embodiments, the confidence level indicates the degree of confidence that a certain indicator data falls within a given confidence interval. Commonly used confidence levels are 90%, 95%, 99%, etc. m is a positive integer, which indicates the total number of confidence levels. Similarly, it also indicates that m different confidence levels are selected to construct the confidence interval. Each confidence level corresponds to a different confidence interval, and these confidence intervals may be different in width due to different confidence levels. By setting m different confidence levels and constructing a corresponding confidence interval for each confidence level, a corresponding threshold determination model is constructed. It can be understood that i is a specific number among the m confidence levels, and the relationship between i and m is an index and total number.

[0103] S502: Determine a first variable and a second variable corresponding to the i-th confidence level, the first variable representing an average of multiple indicator data of the same category, and the second variable representing a degree of dispersion of multiple indicator data of the same category.

[0104] In some embodiments, the first variable represents the average of multiple indicator data of the same category, reflecting the central tendency of the indicator data. The second variable represents the degree of dispersion of multiple indicator data of the same category, such as standard deviation, variance, etc., reflecting the dispersion of the data.

[0105] For each confidence level (i-th confidence level), determine one variable to describe the average state of the indicator data (first variable) and another variable to describe the dispersion of the indicator data (second variable). A more reasonable threshold determination model is constructed based on the central tendency and dispersion of the indicator data.

[0106] S503: Constructing a threshold determination model corresponding to the confidence interval of the i-th confidence level according to the first variable and the second variable.

[0107] In some embodiments, a threshold determination model capable of dynamically adjusting the threshold is constructed using the determined first variable and second variable. When processing indicator data with uncertainty, this threshold determination model can flexibly adjust the judgment threshold according to the actual distribution of the indicator data, thereby improving the accuracy and reliability of the decision.

[0108] As an example, different confidence levels correspond to different standard deviation multiples, and the standard deviation multiples can be adjusted according to the confidence level to expand the confidence interval around the mean. Specifically, as the confidence level increases, a wider confidence interval is required to include the possibility of the true parameter of the population, that is, as the confidence level increases, the standard deviation multiple should also increase accordingly.

[0109] In one implementation scenario, the first confidence level is 99.75%, which means that theoretically less than 0.3% of the data are abnormal data; the second confidence level is 95.44%, which means that theoretically less than 5% of the data are abnormal data; and the third confidence level is 68.26%, which means that theoretically less than 32% of the data are abnormal data.

[0110] Exemplarily, the third confidence level (68.26%) generally corresponds to the confidence interval of the mean minus 1 standard deviation. The second confidence level (95.44%) generally corresponds to the confidence interval of the mean minus 2 standard deviations. And the first confidence level (99.73%) generally corresponds to the confidence interval of the mean minus 3 standard deviations. In addition, when the confidence level is greater than 99.73%, the multiple of the standard deviation will generally be greater than 3 standard deviations, such as 6 standard deviations. When the confidence level is less than 68.26%, the multiple of the standard deviation will generally be less than 1 standard deviation, such as 0.5 standard deviation.

[0111] In the embodiment of the present application, by constructing multiple threshold determination models based on different confidence levels, the user is allowed to select the most appropriate confidence level to set the judgment threshold according to the specific application scenario and data characteristics, thereby optimizing the accuracy and reliability of the blockchain transaction anomaly detection process.

[0112] In some embodiments, the plurality of threshold determination models may include a first threshold determination model corresponding to a first confidence level, a second threshold determination model corresponding to a second confidence level, and a third threshold determination model corresponding to a third confidence level.

[0113] As an implementation of the present application, the first variable is related to the mean value, and the second variable is related to the standard deviation. In order to improve the accuracy of the construction of the multiple threshold determination model. The aforementioned S503 may specifically include:

[0114] When the i-th confidence level is the first confidence level, the first threshold determination model corresponding to the confidence interval of the first confidence level is constructed using the following expression:

[0115] μ-3σ(2)

[0116] When the i-th confidence level is the second confidence level, a second threshold determination model corresponding to the confidence interval of the second confidence level is constructed using the following expression:

[0117] μ-2σ(3)

[0118] When the i-th confidence level is the third confidence level, the third threshold determination model corresponding to the confidence interval of the third confidence level is constructed using the following expression:

[0119] μ-σ(4)

[0120] In formula (2) to formula (4), μ is the average value of multiple indicator data of the same category,

[0121] σ is the standard deviation of multiple indicator data of the same category, Rate n-1 , n represents the change rate from the n-1th indicator data to the nth indicator data in multiple indicator data of the same category, It represents the average value of all change rates in multiple indicator data of the same category.

[0122] In an embodiment of the present application, by constructing threshold determination models for different confidence levels, the distribution of data at different confidence levels can be more accurately reflected. Different business scenarios or decision-making processes may have different requirements for confidence levels. By providing multiple threshold determination models corresponding to different confidence levels, a suitable model can be selected for application according to actual needs, which is more adaptable to application scenarios with different risk preferences than a single threshold determination model, thereby improving the accuracy and reliability of the threshold determination model in practical applications.

[0123] Based on this, in the aforementioned S203, determining a target threshold determination model corresponding to the target confidence level from a plurality of preset threshold determination models may specifically include:

[0124] In the case where the target confidence level of the second cycle is determined to be the first confidence level, the first threshold determination model is determined as the target threshold determination model.

[0125] In the case where the target confidence level of the second cycle is determined to be the second confidence level, the second threshold determination model is determined as the target threshold determination model.

[0126] In the case where the target confidence level of the second cycle is determined to be the third confidence level, the third threshold determination model is determined as the target threshold determination model.

[0127] Next, the derivation process of μ and σ will be introduced in detail.

[0128] The central limit theorem states that when the number of observations in a set of data exceeds 30, the set of data obeys or approximately obeys a Gaussian distribution. The density function of the Gaussian distribution is as follows:

[0129]

[0130] In formula (5), x is a random variable, μ is the mean of the distribution, and σ is the standard deviation of the distribution.

[0131] When there are n observable samples {X1,X2,X3,…X i ,…,X n}, the maximum likelihood function L is as follows:

[0132]

[0133] Next, for L(μ,σ 2 ) and combine it with the above formula (5) to get the logarithmic likelihood function, as shown below:

[0134]

[0135] For μ and σ 2 Find the partial derivatives and get the two-variable equation system with two parameters as follows:

[0136]

[0137] Solving the above two-variable equation system, we get μ and σ as shown below: 2 The maximum likelihood estimate of .

[0138]

[0139] Randomly sample a set of observations from a Gaussian distribution

[0140] {X1,X2,X3,…X i ,…,X n}, n observable samples as S 2 As a continuous distribution variance σ 2 An unbiased estimate of , that is, the assumption is as follows:

[0141]

[0142] Sample variance S 2 As the population variance σ 2 is an unbiased estimate of , but it is actually biased. According to statistical theory, the expected value of the sample variance E[S 2 ]for:

[0143]

[0144] Based on the above formula (11), both sides of the equation are multiplied by Then we get μ and σ 2 The unbiased estimate of is calculated as:

[0145]

[0146] Through the above derivation, we get the Gaussian distribution parameters μ and σ 2 In addition, the unbiased estimation method is used to further adjust σ 2 The calculation method ensures that our estimation results will not be biased by sample characteristics. Based on accurate parameter estimation, it can provide a solid foundation for building and optimizing multiple judgment threshold models. Through this method, the model parameters can be set and adjusted more accurately, so that the model can show higher applicability in various data scenarios. Specifically,

[0147] Next, the above method will be further explained with reference to a specific example.

[0148] Assuming that the first and second cycles are in days, and the business indicator is transaction volume, a total of 36 daily transaction volume data of the blockchain trading platform are collected to obtain the first data set:

[0149] {26850020, 31214741, 28786131, 28279158, 27960858, 19479048, 18971696, 17531317, 15891344, 12065109, 12218584, 12841818, 8950118, 8495206, 11254444, 13079848, 14310001, 13932118, , 13657654, 8237570, 13597038, 19743629, 26686228, 26619141, 34863123, 30295173, 25128310}.

[0150] According to the above formula (1), 35 change rates are calculated as follows:

[0151] {16.26%, -7.78%, -1.76%, -1.13%, -30.33%, -2.60%, -7.59%, -9.35%, -24.08%, 1.27%, 5.10%, -30.30%, -5.08%, 32.48%, 16.22%, 9.40%, -2.64%, -6.75%, -17.70%, -0.06%, 1.81%, -23.98%, 40.64%, -5.22%, 0.44%, 2.03%, 20.89%, -39.69%, 65.06%, 45.21%, 35.16%, -0.25%, 30.97%, -13.10%, -17.06%}.

[0153] According to the above formula and The two parameters μ=2.185080% and σ=22.8582722% are calculated.

[0154] After analyzing the change rate data of the daily transaction volume of the blockchain trading platform, we can obtain a target set of 35 change rate data and calculate its average value (μ) and standard deviation (σ). Using these statistical data, we can set judgment thresholds according to different confidence levels to meet the needs of blockchain trading platforms at different development stages. Specifically, we considered the following three situations:

[0155] In the first case, the confidence level of 99.73% is used as the benchmark, the first threshold determination model is adopted, the target set is input into the first threshold determination model, and the judgment threshold is calculated as

[0156] μ-3σ=-66.389736%. According to industry experience, the actual judgment threshold can be set to -70%.

[0157] In the second case, the confidence level of 95.44% is used as the benchmark, the second threshold determination model is adopted, the target set is input into the second threshold determination model, and the judgment threshold is calculated as

[0158] μ-2σ=-43.531464%. According to industry experience, the actual judgment threshold can be set to -50%.

[0159] In the third case, the confidence level of 68.26% is used as the benchmark, the third threshold determination model is adopted, the target set is input into the third threshold determination model, and the judgment threshold calculated is

[0160] μ-σ=-20.673192%. According to industry experience, the actual judgment threshold can be set to -30%.

[0162] Among them, -30% can be actually used to judge transaction anomalies in the release stage; while -50% and -70% can be actually used to judge transaction anomalies in the stable stage.

[0163] In the early stage of the launch of the blockchain trading platform system, that is, the release stage, more stringent monitoring measures are usually taken to ensure the stability of the blockchain trading platform. The threshold of the monitoring indicator can be set to a drop in trading volume of more than 30%. Setting the threshold lower means that any drop of more than 30% will trigger an alarm, which statistically corresponds to a confidence level of 68.26%, that is, a significance level of 31.74%. This means that there is a probability of more than 30% that an alarm will be triggered, which is much higher than the standard of what we usually think of as a low-probability event.

[0164] However, if the threshold of the monitoring indicator is set to a decrease in trading volume of more than 30% during the stable stage, it may lead to frequent false alarms, which is the so-called "alarm storm". Figure 1 In the actual case shown, if a 30% alarm threshold is used, the alarm cause may need to be processed multiple times within a month, and these alarms are likely to be normal market fluctuations. Therefore, in order to reduce false alarms and improve monitoring efficiency, a more reasonable threshold can be adopted in the stable stage. For example, raising the alarm threshold to 50% or 70% can significantly reduce the occurrence of "alarm storms".

[0165] Specifically:

[0166] When the threshold is set to 70%, the probability of missing an event that actually requires an alarm is only 0.27%, corresponding to a confidence level of 99.73%.

[0167] When the threshold is set at 50%, the probability of missing a positive result is 4.56%, corresponding to a confidence level of 95.44%.

[0168] This method can effectively reduce false alarms caused by normal market fluctuations while ensuring that real alarms are not missed. As the system gradually enters a stable operation period, the alarm threshold can be gradually adjusted according to the actual operation situation to achieve more accurate monitoring.

[0169] In summary, by setting the judgment threshold and performing transaction anomaly detection on the blockchain transaction platform according to the embodiment of the present application, it is not only possible to reduce the waste of resources caused by false alarms, but also to ensure that real abnormal situations can be responded to in a timely manner at critical moments.

[0170] Based on the method for detecting blockchain transaction anomalies provided in the above embodiment, the present application also provides a specific implementation of a device for detecting blockchain transaction anomalies. Please refer to the following embodiment.

[0171] See first Figure 6 The device for detecting blockchain transaction anomalies provided in the embodiment of the present application includes the following modules:

[0172] The first acquisition module 601 is used to obtain first indicator data of the business indicator of the blockchain trading platform in the first period and second indicator data in the second period, where the first period is earlier than the second period in time;

[0173] A first determination module 602, configured to determine a target confidence level of the second cycle according to the development stage of the second cycle;

[0174] A second determination module 603 is used to determine a target threshold determination model corresponding to a target confidence level from a plurality of preset threshold determination models when the second indicator data is less than the first indicator data;

[0175] A third determination module 604 is used to determine a model according to the first data set and the target threshold value, and generate a judgment threshold value matching the second period, wherein the first data set includes a plurality of third indicator data of the business indicator within a first preset time period, and the first preset time period is earlier than the second period in time;

[0176] The fourth determination module 605 is used to determine that the blockchain transaction platform transaction is abnormal when the change rate from the first indicator data to the second indicator data is greater than the judgment threshold.

[0177] In the embodiment of the present application, multiple threshold determination models based on different confidence levels are constructed, which can adapt to the trading environment under different time periods, thereby significantly improving the applicability and accuracy of the threshold determination model in various situations. The second determination module 603 is used to find the target threshold determination model that matches the target confidence level of the second period, and the third determination module 604 is used to determine the judgment threshold that matches the current second period based on the target threshold determination model. After that, the transaction anomaly detection of the blockchain trading platform is performed based on the determined judgment threshold in the fourth determination module 605. By determining the judgment threshold by the target threshold determination model that matches the confidence level of the current time period, it can be effectively ensured that the judgment threshold conforms to the actual data fluctuation of the current time period, and then based on the judgment threshold, abnormal transactions under the current data fluctuation characteristics can be more accurately judged, significantly improving the sensitivity and accuracy of transaction anomaly detection.

[0178] As an implementation of the present application, the confidence level includes a first confidence level, a second confidence level, and a third confidence level with confidence intervals from wide to narrow. In order to reduce the accuracy of transaction anomaly detection on the blockchain transaction platform. The above-mentioned first determination module 602 may specifically include:

[0179] A first determination submodule is used to determine the target confidence level as a third confidence level when the development stage of the second cycle is the release stage;

[0180] The second determination submodule is used to determine the target confidence level according to the risk sensitivity corresponding to the user when the development stage of the second cycle is a stable stage.

[0181] As an implementation of the present application, in order to ensure that users can maintain a risk range acceptable to users when facing potential market fluctuations in the blockchain trading platform, the second determination submodule may specifically include:

[0182] A first determining unit, configured to determine the target confidence level to be a second confidence level when the risk sensitivity level corresponding to the user is at the first level;

[0183] The second determining unit is configured to determine the target confidence level as the first confidence level when the risk sensitivity level corresponding to the user is at the second level.

[0184] As another implementation of the present application, in order to further increase the accuracy of transaction anomaly detection of the trading platform, the above-mentioned device may also include:

[0185] The first calculation module is used to calculate the change rate from the first indicator data to the second indicator data.

[0186] Based on this, the aforementioned second determination module 603 can be specifically used to determine the target threshold determination model corresponding to the target confidence level from multiple preset threshold determination models when the second indicator data is smaller than the first indicator data and the change rate is greater than the preset threshold.

[0187] As another implementation of the present application, in order to construct multiple threshold determination models, the above-mentioned device may further include:

[0188] The first building module is used to build m confidence levels and the confidence interval corresponding to the i-th confidence level among the m confidence levels, i∈[1,m], and i and m are both positive integers.

[0189] The fifth determination module is used to determine a first variable and a second variable corresponding to the i-th confidence level, wherein the first variable represents an average of multiple indicator data of the same category, and the second variable represents a degree of dispersion of multiple indicator data of the same category.

[0190] The second construction module is used to construct a threshold determination model corresponding to the confidence interval of the i-th confidence level according to the first variable and the second variable.

[0191] As an implementation of the present application, the second building block may specifically include:

[0192] The first construction submodule is used to construct a first threshold determination model corresponding to the confidence interval of the first confidence level using the following expression when the i-th confidence level is the first confidence level:

[0193] μ-3σ

[0194] The second construction submodule is used to construct a second threshold determination model corresponding to the confidence interval of the second confidence level using the following expression when the i-th confidence level is the second confidence level:

[0195] μ-2σ

[0196] The third construction submodule is used to construct a third threshold determination model corresponding to the confidence interval of the third confidence level using the following expression when the i-th confidence level is the third confidence level:

[0197] μ-σ

[0198] Among them, μ is the average amount of multiple indicator data of the same category, σ is the standard deviation of multiple indicator data of the same category, Rate n-1 , n represents the change rate from the n-1th indicator data to the nth indicator data in multiple indicator data of the same category, It represents the average value of all change rates in multiple indicator data of the same category.

[0199] Figure 7 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0200] like Figure 7 As shown, the electronic device may include a processor 701 and a memory 702 storing computer program instructions.

[0201] Specifically, the processor 701 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0202] The memory 702 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 702 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 702 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 702 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 702 is a non-volatile solid-state memory.

[0203] The memory 702 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, typically, the memory 702 includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to the first aspect of the present disclosure.

[0204] The processor 701 implements any one of the methods for detecting blockchain transaction anomalies in the above embodiments by reading and executing computer program instructions stored in the memory 702.

[0205] In one example, the electronic device may further include a communication interface 703 and a bus 710. Figure 7 As shown, the processor 701, the memory 702, and the communication interface 703 are connected via a bus 710 and communicate with each other.

[0206] The communication interface 703 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0207] Bus 710 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 710 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0208] The electronic device can execute the method for detecting blockchain transaction anomalies in the embodiment of the present application, thereby realizing the combination Figure 1 and Figure 6 Described are methods and apparatus for detecting blockchain transaction anomalies.

[0209] In addition, in combination with the method for detecting blockchain transaction anomalies in the above embodiments, the present application embodiment may provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the methods for detecting blockchain transaction anomalies in the above embodiments is implemented.

[0210] In addition, in combination with the method for detecting blockchain transaction anomalies in the above embodiments, the present application embodiment may provide a computer program product for implementation. The computer program product includes a computer program, and when the computer program is processed and executed, any of the above methods for detecting blockchain transaction anomalies is implemented.

[0211] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0212] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0213] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0214] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0215] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for detecting blockchain transaction anomalies, characterized in that: The method comprises: Obtain first indicator data of a business indicator of a blockchain trading platform in a first period and second indicator data in a second period, wherein the first period is earlier than the second period in time; Determining a target confidence level for the second cycle according to the development stage of the second cycle; In a case where the second indicator data is less than the first indicator data, determining a target threshold determination model corresponding to the target confidence level from a plurality of preset threshold determination models; generating a judgment threshold matching the second period according to a first data set and the target threshold determination model, wherein the first data set includes a plurality of third indicator data of a business indicator within a first preset time period, and the first preset time period is earlier than the second period in time; When the rate of change from the first indicator data to the second indicator data is greater than the judgment threshold, it is determined that the transaction on the blockchain transaction platform is abnormal.

2. The method according to claim 1, characterized in that The confidence level includes a first confidence level, a second confidence level, and a third confidence level with confidence intervals from wide to narrow, and determining the target confidence level of the second cycle according to the development stage of the second cycle includes: In a case where the development stage of the second cycle is a release stage, determining the target confidence level to be a third confidence level; When the development stage of the second cycle is a stable stage, the target confidence level is determined according to the risk sensitivity of the user.

3. The method according to claim 2, characterized in that The risk sensitivity level includes a first level and a second level with increasing sensitivity in sequence, and determining the target confidence level according to the risk sensitivity level corresponding to the user includes: When the risk sensitivity level corresponding to the user is at the second level, determining the target confidence level to be the first confidence level; When the risk sensitivity level corresponding to the user is at the first level, the target confidence level is determined to be the second confidence level.

4. The method according to claim 2, characterized in that: Before determining the target threshold determination model corresponding to the target confidence level from a plurality of preset threshold determination models, the method further includes: Calculate the change rate from the first indicator data to the second indicator data; The step of determining a target threshold determination model corresponding to the target confidence level from a plurality of preset threshold determination models comprises: When the second indicator data is smaller than the first indicator data and the change rate is greater than a preset threshold, a target threshold determination model corresponding to the target confidence level is determined from a plurality of preset threshold determination models.

5. The method according to any one of claims 2 to 4, characterized in that: Before determining the target threshold determination model corresponding to the target confidence level from a plurality of preset threshold determination models, the method further includes: Construct m confidence levels and a confidence interval corresponding to the i-th confidence level among the m confidence levels, i∈[1,m], and i and m are both positive integers; Determine a first variable and a second variable corresponding to the i-th confidence level, wherein the first variable represents an average of a plurality of indicator data of the same category, and the second variable represents a degree of dispersion of a plurality of indicator data of the same category; A threshold determination model corresponding to the confidence interval of the i-th confidence level is constructed based on the first variable and the second variable.

6. The method according to claim 5, characterized in that The step of constructing a threshold determination model corresponding to the confidence interval of the i-th confidence level according to the first variable and the second variable includes: When the i-th confidence level is the first confidence level, a first threshold determination model corresponding to the confidence interval of the first confidence level is constructed using the following expression: μ-3σ When the i-th confidence level is the second confidence level, a second threshold determination model corresponding to the confidence interval of the second confidence level is constructed using the following expression: μ-2σ When the i-th confidence level is the third confidence level, a third threshold determination model corresponding to the confidence interval of the third confidence level is constructed using the following expression: μ-σ Wherein, μ is the average value of the multiple indicator data of the same category, σ is the standard deviation of the multiple indicator data of the same category, Rate n-1 , n represents the change rate from the n-1th indicator data to the nth indicator data in the plurality of indicator data of the same category, It represents the average value of all change rates in the indicator data of the same category.

7. A device for detecting blockchain transaction anomalies, characterized in that: The device comprises: A first acquisition module is used to acquire first indicator data of a business indicator of a blockchain trading platform in a first period and second indicator data in a second period, wherein the first period is earlier than the second period in time; A first determination module, configured to determine a target confidence level of the second cycle according to the development stage of the second cycle; A second determination module, configured to determine a target threshold determination model corresponding to the target confidence level from a plurality of preset threshold determination models when the second indicator data is less than the first indicator data; a third determination module, configured to generate a judgment threshold matching the second period according to a first data set and the target threshold determination model, wherein the first data set includes a plurality of third indicator data of a business indicator within a first preset time period, and the first preset time period is earlier than the second period in time; The fourth determination module is used to determine that the transaction on the blockchain transaction platform is abnormal when the rate of change from the first indicator data to the second indicator data is greater than the judgment threshold.

8. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method for detecting blockchain transaction anomalies as described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by the processor, the method for detecting blockchain transaction anomalies according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that It includes a computer program, which, when executed, implements the method for detecting blockchain transaction anomalies as described in any one of claims 1 to 6.

Images