A network security method and system based on blockchain

Abstract

The present application provides a network security method and system based on blockchain, including: on the basis of local anomaly detection, suspicious events reported by each blockchain node are collected through the blockchain network, and the data of several blockchain nodes are analyzed by using correlation analysis and time series pattern mining algorithms to obtain the correlation of different attack stages, and form a composite attack map from a global perspective; according to the key blockchain nodes and paths in the composite attack map, corresponding detection rules are generated and sent to the local intelligence library of each blockchain node, and the rules of each blockchain node are synchronously updated by using the time series characteristics of the blockchain, and the smart contract is triggered to verify the validity of the newly added rules.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a network security method and system based on blockchain. Background Art

[0002] In the blockchain distributed intrusion detection scenario, there is a technical challenge to timely identify complex attack patterns. At present, the sharing of threat intelligence between blockchain nodes mainly relies on rule-based detection methods. However, this method has limited response speed and recognition ability when dealing with rapidly changing complex attacks. Attackers often use multiple seemingly unrelated small actions to cleverly combine into a complex attack. It is difficult for a single blockchain node to find the correlation and identify the complete attack pattern. This attack method makes it particularly difficult to achieve timely detection of complex attack patterns from a global perspective in the blockchain network. The threat intelligence collected by each blockchain node is fragmented, lacking an effective data association and fusion mechanism, making it difficult to form a complete understanding of the overall attack. At the same time, the decentralized nature of the blockchain also increases the difficulty of collaboration between blockchain nodes. How to achieve secure sharing and analysis of threat intelligence while protecting privacy is a major technical challenge. In addition, the continuous evolution of complex attack patterns also puts higher requirements on the real-time update and optimization of detection models. There is an urgent need for a mechanism that can continuously learn and adapt to keep up with the pace of changes in attack methods. Summary of the invention

[0003] The present invention provides a network security method based on blockchain, which mainly includes:

[0004] Build a peer-to-peer network consisting of several blockchain nodes, deploy an intrusion detection system on each blockchain node, standardize the interaction behavior and data format between blockchain nodes through smart contracts, maintain consistency of the threat intelligence library of each blockchain node based on the consensus of the blockchain, and encrypt the threat intelligence data shared between blockchain nodes;

[0005] Based on the unsupervised learning of the local data of the blockchain node by machine learning algorithms, the key features of the attack behavior in the attack mode are identified, and a multi-dimensional behavior baseline is generated according to the local data of the blockchain node. The deviation between the key features and the behavior baseline is monitored in real time. If a significant anomaly is found, an alarm is triggered and the relevant data is broadcast to other blockchain nodes;

[0006] When a blockchain node detects a suspicious attack event, it packages the locally captured data into blocks and attaches a timestamp, which is then synchronized to other blockchain nodes through the blockchain network. At the same time, it triggers the smart contract to call the corresponding threat intelligence analysis function, analyze the attack traffic, extract key features and compare them with the local intelligence library, identify known attacks and update detection rules;

[0007] Using a federated learning framework, each blockchain node trains a local model based on local data, and achieves collaborative optimization of the global model through encrypted parameter aggregation. Without leaking private data, the model's detection capability is enhanced by using sample information from multiple blockchain nodes, and the optimized model is regularly deployed to each blockchain node.

[0008] On the basis of local anomaly detection, suspicious events reported by each blockchain node are collected through the blockchain network. The data of several blockchain nodes are analyzed using correlation analysis and time series pattern mining algorithms to obtain the correlation of different attack stages and form a composite attack map from a global perspective.

[0009] According to the key blockchain nodes and paths in the composite attack graph, corresponding detection rules are generated and sent to the local intelligence library of each blockchain node. By utilizing the timing characteristics of the blockchain, the rules of each blockchain node are updated synchronously, and the smart contract is triggered to verify the validity of the new rules.

[0010] The present invention provides a network security system based on blockchain, which mainly includes:

[0011] Blockchain network building blocks for deploying nodes and intrusion detection systems, regulating interactions and data sharing;

[0012] A local anomaly detection module, which is used to identify attack features based on machine learning, generate behavioral baselines, and monitor anomalies;

[0013] Threat intelligence sharing module, which is used to package suspicious event data, synchronize through blockchain and trigger smart contract analysis;

[0014] Federated learning module, used to collaboratively optimize the global detection model and enhance the utilization of multi-node sample information;

[0015] The composite attack analysis module is used to correlate and analyze multi-node data, form a global attack map and generate detection rules.

[0016] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0017] The present invention discloses a network security method based on blockchain. By constructing a peer-to-peer network composed of multiple blockchain nodes, each node deploys an intrusion detection system and uses an unsupervised learning algorithm to perform anomaly detection on local data. When a suspicious attack is detected, the node synchronizes the data to the blockchain network and triggers a smart contract for in-depth analysis. A federated learning framework is used to achieve global model optimization and enhance detection capabilities. For combined attacks, the present invention constructs a composite attack graph through association analysis to identify key paths and nodes. Detection rules are automatically generated based on the graph and updated synchronously to each node. The present invention realizes the secure sharing of threat intelligence, intelligent identification of abnormal behaviors, and global perception of composite attacks, effectively improving the accuracy and real-time performance of intrusion detection in a distributed environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 The present invention is a flowchart of a network security method based on blockchain.

[0019] Figure 2 This is a schematic diagram of a blockchain-based network security method and system of the present invention.

[0020] Figure 3 This is a schematic diagram of the structure of a blockchain-based network security system of the present invention. DETAILED DESCRIPTION

[0021] In order to further understand the content of the present invention, the present invention is described in detail in conjunction with the accompanying drawings and embodiments. The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0022] like Figure 1 -3. In this embodiment, a network security system based on blockchain may specifically include:

[0023] S101. Construct a peer-to-peer network consisting of several blockchain nodes, deploy an intrusion detection system on each blockchain node, standardize the interaction behavior and data format between blockchain nodes through smart contracts, maintain consistency of the threat intelligence library of each blockchain node based on the consensus of the blockchain, and encrypt the threat intelligence data shared between blockchain nodes.

[0024] Obtain the network parameter information of the blockchain node, and construct a peer-to-peer network topology diagram and a connection relationship matrix based on the network parameter information; calculate the shortest path between nodes based on the connection relationship matrix to obtain the optimal communication route. Collect the original threat log from the intrusion detection system of the blockchain node, extract the key fields in the original threat log through regular expressions; map the key fields to standardized threat intelligence data according to the predefined format. Encrypt the standardized threat intelligence data to obtain threat fingerprint features in ciphertext form; construct an index for the threat fingerprint features in ciphertext form, and store the index in a distributed manner in the blockchain network. Define smart contracts to standardize the threat intelligence sharing interface and access control rules between blockchain nodes; blockchain nodes exchange encrypted threat fingerprints, and the receiving node calculates the Euclidean distance in the ciphertext domain using the additive homomorphic property of Paillier encryption. Perform consensus verification on the newly added threat intelligence data; if more than a preset number of nodes reach a consensus, the newly added threat intelligence data is packaged into blocks and broadcast to other nodes; the other nodes verify the validity of the blocks and append them to the local blockchain.

[0025] Exemplarily, a peer-to-peer network topology diagram is constructed according to the deployment of blockchain nodes, network parameters such as the IP address and port number of each node are obtained through network detection, a connection relationship matrix between nodes is established, and the shortest path is calculated according to the six-degree space theory to obtain the optimal communication route between nodes. The original threat logs are collected from the intrusion detection system of each blockchain node, and key fields such as IP address, port number, and attack type are extracted using regular expressions. The extracted fields are mapped to the predefined STIX format to generate standardized threat intelligence data. The standardized threat intelligence data is encrypted using the Paillier homomorphic encryption algorithm to generate threat fingerprint features in ciphertext form, and the encrypted fingerprint features are indexed and constructed based on the Bloom filter. The index is distributed and stored in the blockchain network through the consistent hashing algorithm. The blockchain nodes use smart contracts to standardize the data interaction format, define the threat intelligence sharing interface and access control rules, and the nodes exchange encrypted threat fingerprints by calling contract functions. The receiving node uses the additive homomorphic property of Paillier encryption to calculate the Euclidean distance on the ciphertext domain to determine whether it is new threat intelligence. Based on the Practical Byzantine FaultTolerance consensus algorithm, the newly added threat intelligence data is verified by consensus. Each node verifies the received threat intelligence locally, encrypts the verification results through homomorphic encryption, and then broadcasts them to other nodes. When more than two-thirds of the nodes reach an agreement, the consensus is considered to be reached, and the newly added data is packaged into blocks and broadcast to other nodes. After each node verifies the validity of the block, it is appended to the local blockchain to achieve consistent updates of the threat intelligence library. When building a peer-to-peer network topology, use the ICMP protocol to send ping requests to detect the network status of each node, and obtain IP addresses such as 192.168.1.100 and port numbers such as 8080. The shortest path between nodes is calculated using the Floyd-Warshall algorithm to generate a routing table. Collect the original threat logs from the intrusion detection system, use the regular expression pattern = "\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}" to extract the IP address, and map the field to the STIX format, such as {type: "indicator", pattern: "[ipv4-addr: value = '10.0.0.1']"}. Use the Paillier homomorphic encryption algorithm, select random prime numbers p = 17 and random prime numbers q = 19, calculate n = p * q = 323, g = n + 1 = 324, and encrypt the threat fingerprint features into the encrypted ciphertext c = g ^m * r ^nmodn ^2. Use a Bloom filter, set the bit array size m = 1024, the number of hash functions k = 7, and map the encrypted fingerprint features to the bit array.Through the consistent hashing algorithm, SHA-256 is used to generate node hash values, and the range of 0-2^256-1 is divided into 2^8 virtual nodes to realize the distributed storage of fingerprint indexes. The smart contract defines the threat intelligence sharing interface function shareIntelligence(bytes encrypted Data) to share encrypted intelligence data, and sets the access control modifier only Authorized. The node calls the contract function to exchange encrypted fingerprints, and the receiver calculates the Euclidean distance d=sqrt((c1c2^-1modn^2)^lambdamodn) in the ciphertext domain. The PBFT practical Byzantine fault-tolerant consensus algorithm is adopted, and the view number v=0 and the master node number p=vmodn are set, where n is the total number of nodes in the system. The node broadcasts the message <PRE-PREPARE, v, n, d, m>, where n is the sequence number, d is the request summary, and m is the request content. After receiving 2f+1 matching PREPARE messages, the node broadcasts <COMMIT, v, n, d, i>. After accumulating 2f+1 COMMIT messages, the request is executed and the newly added data is packaged into a block, including a block header and a block body. The block header contains fields such as the previous block hash, Merkle tree root hash, and timestamp.

[0026] S102. Unsupervised learning of the local data of blockchain nodes based on machine learning algorithms is used to identify key features of attack behaviors in attack patterns. A multi-dimensional behavior baseline is generated based on the local data of blockchain nodes. The degree of deviation between the key features and the behavior baseline is monitored in real time. If significant anomalies are found, an alarm is triggered and the relevant data is broadcast to other blockchain nodes.

[0027] The multi-dimensional data of network traffic, system logs, and user behaviors are obtained, and the principal component analysis method is used to perform dimensionality reduction processing on the multi-dimensional data to obtain the feature vector after dimensionality reduction; the Gaussian mixture model is used for unsupervised learning based on the feature vector to determine the probability density of each data point. If the probability density is lower than a preset percentile threshold, the data point is marked as a potential attack behavior; the potential attack behavior is clustered in time series to determine the representative characteristics of the attack mode and construct a multi-dimensional behavior baseline; the new data of the blockchain node is collected in real time, and the Mahalanobis distance between the new data and the multi-dimensional behavior baseline is calculated. If the Mahalanobis distance exceeds the preset threshold, an abnormal alarm is triggered, and the abnormal data and associated context information are sent to other nodes through the blockchain network.

[0028] Exemplarily, multi-dimensional data such as network traffic, system logs, and user behavior are extracted from the local database of the blockchain node, and the original data is reduced in dimension through principal component analysis. The number of principal components is determined using the scree plot method, and the principal components with a cumulative explained variance of 95% are selected to obtain the reduced eigenvector as the input for subsequent analysis. The Gaussian mixture model is used for unsupervised learning, and the Bayesian information criterion is used to determine the optimal number of clusters. The probability density of each data point is calculated, and the data points with a probability density lower than the 5th percentile are marked as potential attack behaviors. The sliding time window method is used to perform time series clustering on the marked potential attack behaviors, and the cluster center is calculated as the representative feature of the attack mode. The key feature set is screened out through the feature importance evaluation method of the random forest, and a multi-dimensional behavior baseline is constructed. A streaming processing pipeline is established, and the Kafka message queue is used to receive real-time data streams. The Spark framework is used for real-time data processing and feature extraction to ensure that the system can respond to new attack behaviors in a timely manner. The newly added data of blockchain nodes are collected in real time, and the Mahalanobis distance between the new data and the behavioral baseline is calculated. The inverse matrix of the covariance matrix is ​​used as the weight matrix, that is, the Mahalanobis distance d = sqrt((x-μ) ^T*Σ^(-1)*(x-μ)), where x is the new data point, μ is the mean of the behavioral baseline, and Σ is the covariance matrix. If the distance exceeds the preset threshold, an abnormal alarm is triggered, and the abnormal data and associated context information are packaged into messages and sent to other nodes through the broadcast mechanism of the blockchain network. In the local database of the blockchain node, the network traffic data within the last 24 hours, including features such as IP address, port number, and packet size, are extracted, totaling 100,000 records. The principal component analysis is performed on these data, and 15 principal components are retained by the scree plot method, with a cumulative explained variance of 96.3%. The feature vector after dimensionality reduction is input into the Gaussian mixture model, and the Bayesian information criterion is used to iteratively calculate the BIC values ​​of different cluster numbers from 2 to 20, and finally the optimal cluster number is determined to be 7. The probability density of each data point was calculated, and the threshold was set to the 5th percentile, i.e. 0.02, to identify 3,500 potential attack behavior data points. A 15-minute sliding time window was used to perform time series clustering on these 3,500 data points, and 5 main attack pattern clusters were obtained. A forest containing 1,000 decision trees was constructed using the random forest algorithm, and the feature importance scores were calculated. The top 10 features were selected as the key feature set, including source IP address, destination port, packet size, etc. Using the Kafka message queue, 3 partitions were set to receive about 1,000 real-time data records per second. The SparkStreaming framework performs real-time feature extraction on the data stream with a batch interval of 5 seconds. For the newly collected data points, the Mahalanobis distance between them and the behavior baseline was calculated, and a 10×10 covariance matrix was used as the weight matrix.The Mahalanobis distance threshold is set to 3.5. When a data point whose distance exceeds the threshold is detected, it and the context data of the 30 seconds before and after, about 600 records, are packaged into a JSON format message and broadcast to other nodes through the P2P protocol of the blockchain network. The average propagation time does not exceed 2 seconds.

[0029] The intrusion detection system of blockchain nodes uses the anomaly detection algorithm in unsupervised machine learning to cluster and estimate the density of local data, establish a multi-dimensional baseline of normal behavior, extract the key features of suspicious log data through feature engineering, judge the degree to which the system status deviates from the baseline in real time, identify significant abnormal patterns and classify them as potential attack behaviors.

[0030] The sliding time window method is used to extract the recent network traffic data, system logs and user behavior records from the local database of the blockchain node; the extracted data is standardized to obtain the pre-processed high-dimensional data; the pre-processed high-dimensional data is reduced in dimension by principal component analysis, and the principal component whose cumulative explained variance reaches a preset threshold is selected as the feature vector after dimension reduction; the feature vector after dimension reduction is preliminarily clustered by the DBSCAN algorithm to identify and remove outliers; the Gaussian mixture model is applied for fine clustering, the optimal number of clusters is determined by the Bayesian information criterion, the model parameters are iteratively optimized using the expectation maximization algorithm, the probability density of each data point is calculated, and a multi-dimensional baseline of normal behavior is established based on the probability density distribution; a multi-layer autoencoder network structure is established, unsupervised training is performed on the pre-processed data, and nonlinear transformation and combination of key features are performed to generate new feature representations; the Mahalanobis distance between the newly collected data and the multi-dimensional baseline is calculated, the distance value is normalized to a preset range as a quantitative indicator of the system state deviation from the baseline, and a multi-level alarm threshold is set; wherein the Mahalanobis distance between a data point x and the multi-dimensional behavior baseline μ is calculated by the following formula:

[0031] ,

[0032] Where S －1 It is the inverse of the covariance matrix; if the distance exceeds the preset threshold, the data point is marked as an anomaly, and the anomaly is verified twice through the isolation forest algorithm to determine it as a potential attack behavior.

[0033] Exemplarily, the sliding time window method is used to extract the network traffic data, system logs and user behavior records of the last 24 hours from the local database of the blockchain node, and different types of data are standardized respectively, and the network traffic data is converted into statistical features, the system logs are converted into frequency vectors, and the user behavior is converted into behavior sequences. The preprocessed high-dimensional data is reduced in dimension by principal component analysis, and the principal component with a cumulative explained variance of 95% is selected as the feature vector after dimension reduction. The DBSCAN algorithm is used to perform preliminary clustering on the feature vector after dimension reduction, identify and remove outliers, and then the Gaussian mixture model is applied for fine clustering. The optimal number of clusters is determined by the Bayesian information criterion, and the expectation maximization algorithm is used to iteratively optimize the model parameters, calculate the probability density of each data point, and establish a multi-dimensional baseline of normal behavior based on the probability density distribution. The original features are ranked according to the information gain ratio, and the top 10 features are selected as the key feature set. A 5-layer autoencoder network structure is designed, and the Adam optimizer and mean square error loss function are used to perform unsupervised training on the preprocessed data, and the key features are nonlinearly transformed and combined to generate new feature representations. The Mahalanobis-Taguchi system method is used to calculate the Mahalanobis distance between the newly collected data and the multi-dimensional baseline. The distance value is normalized to the range of 0-1 as a quantitative indicator of the system state deviation from the baseline. Three alarm thresholds of 0.7, 0.8, and 0.9 are set to correspond to anomalies of different severity. If the distance exceeds the preset threshold, the data point is marked as an anomaly. The anomaly is verified twice by the isolation forest algorithm and finally determined as a potential attack behavior. Data from the last 24 hours are extracted from the local database of the blockchain node, including 100,000 network traffic records, 50,000 system logs, and 10,000 user behavior records. The number of packets and bytes per minute of the network traffic data is calculated to obtain 2880 statistical features; the system log is converted into a 1000-dimensional word frequency vector; and the user behavior is serialized into a 500-dimensional feature vector. The 3380-dimensional features of 160,000 records are reduced to 50 dimensions through principal component analysis, with a cumulative explained variance of 96.8%. The DBSCAN algorithm was used for preliminary clustering, with eps = 0.5 and minPts = 10, and 312 outliers were identified and removed. The Gaussian mixture model was applied to the remaining 159,688 data, and the BIC values ​​of 2 to 20 clusters were iteratively calculated using the Bayesian Information Criterion, and the optimal number of clusters was determined to be 7. The expectation maximization algorithm was used for 10 iterations to obtain the mean vector and covariance matrix of each cluster. The information gain ratio was calculated, and the top 10 features such as source IP address, destination port, and packet size were selected as key features.Design a 5-layer autoencoder with 50 neurons in the input layer, 30 in the first hidden layer, 10 in the middle hidden layer (i.e., bottleneck layer), 30 in the subsequent hidden layer, and 50 neurons in the output layer. Use the Adam optimizer with a learning rate of 0.001 and a batch size of 64. Train for 50 cycles to obtain a new 10-dimensional feature representation. Use the Mahalanobis-Taguchi system to calculate the Mahalanobis distance between the new data and the baseline, and normalize the distance value to the range of 0-1 through min-max. Set 0.7, 0.8, and 0.9 as the third-level alarm thresholds. Process 1,000 new data per minute. If a data point with a distance exceeding 0.8 is detected, a secondary verification is performed through an isolation forest containing 100 decision trees. Data points with an abnormal score greater than 0.6 are eventually marked as potential attacks.

[0034] Key indicators that reflect the normal operation status of the system are extracted from system resource usage, network communication behavior, user and process behavior, and system log events. The historical data of key indicators are modeled to obtain the normal value range of each indicator, forming a multi-dimensional system behavior baseline.

[0035] According to the system resource monitoring tool, CPU usage, memory occupancy, and disk I / O data are obtained, and network traffic characteristics are obtained from the network traffic collection tool, and user login and process creation behavior data are obtained from the process manager; the original data set is cleaned and the statistical characteristics within the sliding time window are calculated, and the principal component analysis method is used to obtain the preprocessed feature matrix; if the preprocessed feature matrix meets the clustering conditions, a Gaussian mixture model is used to perform cluster analysis on it, and the Gaussian mixture model is trained by the expectation maximization algorithm; the probability density of the historical data of key indicators is estimated, and the Gaussian kernel function is selected to calculate the confidence interval; the clustering result of the Gaussian mixture model is combined with the probability density estimation result, and the probability density of the data point in the corresponding KDE model is calculated to obtain a multi-dimensional system behavior baseline.

[0036] For example, the CPU usage, memory usage, disk I / O and other data are obtained from the system resource monitoring tool sysstat, the network traffic features are collected through the network traffic collection tool Wireshark, the process manager is used to record user login, process creation and other behaviors, key event information is extracted from the system log, and the NTP service is used to synchronize the timestamps of each data source to ensure the time consistency of the data, and the original data set is aggregated. Data cleaning and feature engineering are performed on the original data set to remove outliers and missing values, and statistical features such as mean, variance, kurtosis, etc. within a 5-minute sliding time window are calculated. The principal component analysis and t-SNE methods are used to reduce the feature dimension to obtain the preprocessed feature matrix. The Gaussian mixture model is used to perform cluster analysis on the preprocessed feature matrix, and the optimal number of clusters is determined by the Bayesian information criterion. The expectation maximization algorithm is used to train the model, and the maximum number of iterations is set to 100, the convergence threshold is set to 0.001, the mean vector and covariance matrix of each cluster are calculated, and a multidimensional normal distribution model is constructed. The KDE method is used to estimate the probability density of the historical data of each key indicator, select the Gaussian kernel function, use the Silverman empirical rule to automatically select the bandwidth, calculate the 95% confidence interval as the normal value range, combine the clustering results of the Gaussian mixture model with the probability density estimation of KDE, and calculate the probability density of the data points in each cluster in the corresponding KDE model to form a multi-dimensional system behavior baseline. The sysstat tool is used to collect system resource data every 10 seconds, including 20 indicators such as CPU usage, memory occupancy, and disk I / O rate; Wireshark captures 1,000 network packets per minute and extracts 10 features such as source IP, destination IP, and protocol type; the process manager records 5 attributes such as the newly created process ID, user ID, and startup time every second; the system log extracts 100 key event information every hour. The NTP service synchronizes the timestamps of all data sources to millisecond accuracy, and aggregates 24 hours of data to form an original data set containing 864,000 records. In the data cleaning stage, records with missing values ​​exceeding 5% were deleted, and the 3-times standard deviation rule was applied to eliminate outliers, and finally 850,000 valid records were retained. In the feature engineering stage, a 5-minute sliding window was used to calculate 35 statistical features, including mean, variance, kurtosis, skewness, etc. The principal component analysis retained the principal components with a cumulative explained variance of 95%, and the t-SNE dimensionality reduction method was used to reduce the data to 50 dimensions. In the Gaussian mixture model cluster analysis, the optimal number of clusters was determined to be 7 by calculating the BIC value, and the expectation maximization algorithm was used to iterate 95 times to reach the convergence threshold of 0.001, and the mean vector and covariance matrix of the 7 clusters were obtained. The KDE method was applied to 50 key indicators, and the Gaussian kernel function was selected. The average bandwidth calculated by the Silverman rule was 0.15, and the 95% confidence interval was calculated as the normal value range.The 7 clustering results of the Gaussian mixture model are combined with the KDE model, and the probability density of each data point in the corresponding KDE model is calculated. The threshold is set to 0.01, and data points below this value are marked as abnormal. The final multi-dimensional system behavior baseline contains 7 normal behavior modes, each of which is described by a 50-dimensional feature vector and a corresponding probability density function.

[0037] S103. When a blockchain node detects a suspicious attack event, it packages the locally captured data into blocks and attaches a timestamp, which is synchronized to other blockchain nodes through the blockchain network. At the same time, it triggers the smart contract to call the corresponding threat intelligence analysis function, analyze the attack traffic, extract key features and compare them with the local intelligence library, identify known attacks and update detection rules.

[0038] When the intrusion detection system detects continuous anomalies, it triggers an alarm and captures the network traffic data, system logs and process information of the blockchain node; constructs a block data body based on the captured data, and the block data body includes serialized binary format data and a timestamp; calculates the SHA-256 hash value for the block data body to obtain a block header, and combines the block header with the block data body to form a complete block; broadcasts the complete block to other blockchain nodes through the Gossip protocol, and stores the complete block in the local blockchain database; triggers a predefined smart contract when the complete block is broadcast, and calls the The threat analysis function in the smart contract performs deep packet inspection on the attack traffic data in the complete block; performs pattern matching on the attack traffic data, extracts source IP address, target port, and protocol type features, and generates a feature vector; calculates the similarity between the feature vector and the known attack pattern stored in the local threat intelligence library, and if the similarity exceeds a preset threshold, it is determined to be a known attack type; if the similarity does not exceed the preset threshold, cluster analysis is performed on the feature vector to form a new attack pattern; based on the attack type determination result, a decision tree algorithm is used to generate new rule entries and update the local detection rule library.

[0039] For example, when the intrusion detection system of the blockchain node detects anomalies exceeding 3 standard deviations for 10 consecutive times, an alarm is triggered and the network traffic data, system logs and process information within the last 30 minutes are captured. These data are serialized into binary format, and timestamps accurate to milliseconds are attached to construct the data body of the block. The SHA-256 hash value of the constructed data body is calculated as the block header, and the block header and the data body are combined to form a complete block. The P2P broadcast is implemented to other nodes through the Gossip protocol, and the longest chain principle is used to solve potential fork problems. At the same time, the block is stored in the local blockchain database. While broadcasting the block, the event listener is used to trigger the predefined smart contract, call the threat analysis function in the contract, perform deep packet inspection on the attack traffic data in the block, use Snort rules for pattern matching, extract features such as source IP address, target port, protocol type, and generate feature vectors. The generated feature vector is similar to the known attack patterns stored in the local threat intelligence library. The cosine similarity algorithm is used. If the similarity exceeds the preset threshold, it is determined to be a known attack type; if it is an unknown attack type, the DBSCAN algorithm is used to cluster the feature vector to form a new attack pattern. According to the recognition results, the decision tree algorithm is used to generate new rule entries, update the local detection rule library, and add or modify rules. The intrusion detection system of the blockchain node collects 100 network data packets per second, calculates traffic characteristics such as packet rate and byte rate, and triggers an alarm when the feature value in 10 consecutive 1-minute time windows exceeds the historical mean by 3 standard deviations. The system immediately begins to capture data within 30 minutes, including about 1.8 million network data packets, 100,000 system logs, and 5,000 process records. After these data are compressed by the GZIP compression algorithm, the size is about 50MB, and then the UTC timestamp accurate to milliseconds is attached to form the block data body. The hash value of the data body is calculated using the SHA-256 algorithm as the 32-byte block header. The complete block is broadcast through the Gossip protocol. Each node randomly selects 3 neighbor nodes to propagate. The message covers the entire network within 30 seconds. The block height is used as the longest chain judgment standard, and a checkpoint is formed every 10 blocks. After the event listener of the smart contract detects a new block, it calls the threat analysis function and uses the Snort rule set containing 1000 rules for deep packet detection to extract a 20-dimensional feature vector. The cosine similarity between the feature vector and the 10,000 known attack patterns in the local threat intelligence library is calculated, and the threshold is set to 0.95. For unknown attacks, the DBSCAN algorithm sets eps=0.5 and minPts=5 for clustering. Finally, the C4.5 decision tree algorithm is used to generate new detection rules based on the information gain ratio and update the rule base.

[0040] S104. Adopting a federated learning framework, each blockchain node trains a local model based on local data, and achieves collaborative optimization of the global model through encrypted parameter aggregation. Without leaking private data, the detection capability of the model is enhanced by using sample information from multiple blockchain nodes, and the optimized model is regularly deployed to each blockchain node.

[0041] The latest network traffic data, system logs and user behavior records of blockchain nodes are obtained, and statistical features are extracted using a sliding time window to obtain a training sample set; a local model is trained on the training sample set using a long short-term memory network, and after the training is completed, the parameters of the local model are homomorphically encrypted; a parameter aggregation request is received from a central server, and the encrypted model parameters are sent to the central server, and the central server aggregates the encrypted parameters of each node; the updated global model parameters broadcast by the central server are received, and the local model parameters are updated on the encrypted domain; it is determined whether the global model converges, and if the global model converges, the decrypted global model sent by the central server is received, and the global model is loaded by deserialization.

[0042] Exemplarily, each blockchain node extracts the network traffic data, system logs and user behavior records of the last 7 days from the local database, and uses a 5-minute sliding time window to extract statistical features, such as traffic peaks, log frequencies, etc., to obtain a training sample set. The local model is trained locally using a long short-term memory network to capture time series features, and the model parameters are homomorphically encrypted. The central server collects the encrypted model parameters of each node, uses the federated average algorithm to aggregate the parameters, considers the amount of data of each node as a weight, calculates the weighted average of the global model parameters, and obtains the updated global model parameters. The central server broadcasts the updated global model parameters to all participating nodes, uses the consensus algorithm of the blockchain to ensure the consistency update of each node, and each node uses the properties of homomorphic encryption to update the local model parameters on the encrypted domain, completing a round of federated learning iterations. Repeat the above steps until the global model converges or reaches a preset number of iterations. The convergence condition is set to a global model loss function change of less than 0.1% for three consecutive rounds. Finally, the optimized global model is decrypted, the model is converted into a binary format through serialization, and sent to each blockchain node using a secure transmission protocol. After receiving the model, the node deserializes and loads the model to update the local anomaly detection model. The process is executed regularly once a week to continuously optimize the detection capability. In the federated learning framework, each blockchain node extracts the data of the last 7 days from the local database, and each node contains about 1 million records on average. A 5-minute sliding time window is used, sliding every 1 minute, to extract 20 statistical features, such as traffic peak, log frequency, number of user operations, etc. The constructed long short-term memory network contains 2 layers of LSTM, 128 neurons in each layer, with a 20-dimensional feature sequence as input and a binary classification result as output. The Adam optimizer with a batch size of 64 and a learning rate of 0.001 is used for training, and 100 rounds are iterated locally. The model parameters are encrypted using the Paillier homomorphic encryption scheme with a key length of 2048 bits. The central server aggregates the parameters using the federated averaging algorithm. Assuming that there are 10 nodes participating, the global parameter calculation is Σ(wi*ni) / Σni, where wi is the model parameter of node i and ni is the number of samples of node i. The PoW consensus algorithm is used to ensure update consistency, and the difficulty value is set to 4 leading zeros. The convergence condition is that the global loss function changes less than 0.1% for 3 consecutive rounds, with a maximum of 50 rounds of iterations. The final model is serialized via ProtocolBuffers, with a size of about 20MB, and transmitted using the TLS1.3 protocol. The nodes use the same deserialization process to load the model, which is triggered at 0:00 every Monday and takes an average of 4 hours to complete a global update.

[0043] S105. On the basis of local anomaly detection, suspicious events reported by each blockchain node are collected through the blockchain network. The data of several blockchain nodes are analyzed using correlation analysis and time series pattern mining algorithms to obtain the correlation of different attack stages and form a composite attack map from a global perspective.

[0044] Receive suspicious event information detected by a blockchain node, wherein the suspicious event information includes event type, timestamp, source IP, and target IP fields; package the suspicious event information into a fixed-format message and send it to other nodes through a blockchain network; divide the suspicious event message into multiple time segments using a sliding time window method; perform association rule mining on events within the time segments to obtain association rules that meet minimum support and minimum confidence thresholds; analyze event sequences across time segments according to the association rules to identify timing patterns of different attack stages; after identifying the timing patterns of the attack stages, represent the attack path using a directed graph structure.

[0045] Exemplarily, based on the local anomaly detection results, each blockchain node packages the detected suspicious event information into a fixed-format message, including fields such as event type, timestamp, source IP, and target IP, uses a Bloom filter to remove duplicate events, and sends it to other nodes through the broadcast mechanism of the blockchain network. Each participating node collects suspicious event messages from the network, parses and preprocesses the messages, extracts key features and constructs event sequences, and divides the event sequence into multiple time segments using a sliding time window method with a size of 1 hour and a step of 5 minutes. The FP-growth algorithm is used to mine association rules for events in each time segment, setting the minimum support to 0.1 and the minimum confidence to 0.7, and filtering out association rules that meet the threshold. Based on the mined association rules, the sequence pattern mining algorithm PrefixSpan is used to analyze the event sequence across time segments, identify the temporal patterns of different attack stages, construct a directed graph structure to represent the attack path, and use a graph database to store the attack map. The nodes represent attack events and the edges represent the attack stage transitions. The PageRank algorithm is used to calculate the importance of each event, highlight the key attack path, and form a composite attack map from a global perspective. The PBFT consensus algorithm is used to ensure the consistency of the global attack map of each node, and the map is updated synchronously in the network once an hour. In a network consisting of 100 blockchain nodes, each node detects an average of 5 suspicious events per minute. The node uses a Bloom filter containing 1024 bits and 4 hash functions to control the misjudgment rate to 1%.

[0046] The following effectively removes about 30% of duplicate events. The message format uses the Protocol Buffers data description language, with an average size of 200 bytes. The Gossip protocol is used to broadcast messages, and the propagation delay is controlled within 3 seconds. Each node processes about 21,000 non-duplicate events per hour, using a sliding window method with a 1-hour window and a 5-minute step to generate 12 time segments. The FP-growth algorithm sets the minimum support to 0.1 and the minimum confidence to 0.7, generating an average of 500 association rules per time segment. The PrefixSpan algorithm sets the minimum support to 0.05 and identifies an average of 50 attack sequence patterns across time segments. The Neo4j graph database is used to store the attack graph, which contains about 10,000 nodes and 50,000 edges.

[0047] The PageRank algorithm was iterated 10 times, the convergence threshold was set to 0.001, and the top 100 key events were identified. During the PBFT consensus process, the view number v = 0, the fault tolerance upper limit f = 33, and at least 67 nodes were required to reach a consensus to update the global graph.

[0048] After collecting suspicious event data reported by each blockchain node through the blockchain network, the data of several blockchain nodes are analyzed to identify signs of attack on a single blockchain node; events on different blockchain nodes are correlated across time to obtain multi-stage sequences and patterns of attacks, and an attack map is constructed to depict the steps and conversion processes between different attack stages, and to identify the key paths and hub blockchain nodes therein; detection rules are generated around key paths and blockchain nodes, and deployed at corresponding locations on the attack map.

[0049] Obtain suspicious event data reported by each node of the blockchain network, use Bloom filter to remove duplicate events in the suspicious event data, and obtain a deduplicated suspicious event data set. According to the deduplicated suspicious event data set, perform time series clustering and grouping on events on a single node, calculate the similarity between events, calculate the degree of abnormality, and if the abnormality score ranks in the top preset percentage of event clusters, it is determined to be an attack sign on a single node. For the determined attack signs, use the dynamic time warping algorithm to align the event sequences on different nodes, calculate the distance matrix between the event sequences, and apply the Ward method for hierarchical clustering to obtain the multi-stage sequence and pattern of the attack. Based on the multi-stage attack sequence, construct a directed graph structure, the nodes of the directed graph structure represent the attack stage, the edges represent the conversion process, and calculate the importance score of the node; determine the key path and hub blockchain node in the attack graph. For the key path and hub node, use the decision tree algorithm to generate detection rules, use the rule priority queue to resolve rule conflicts, and distribute the detection rules to different nodes through the consistent hashing algorithm.

[0050] Exemplarily, suspicious event data reported by each node is collected through the blockchain network, and a Bloom filter is used to remove duplicate events. The time series clustering algorithm is used to group events on a single node, and the similarity between events is calculated. The degree of abnormality is calculated using the local anomaly factor algorithm, and the event clusters with the top 5% of the abnormality scores are marked as signs of attack on a single node. The event sequences on different nodes are aligned using the dynamic time warping algorithm, the distance matrix between the event sequences is calculated, and the Ward method is applied for hierarchical clustering to classify similar event sequences to obtain multi-stage sequences and patterns of attacks. An attack graph is constructed based on the obtained multi-stage attack sequence, including obtaining multi-stage attack sequence data, analyzing the attack sequence, and identifying the attack behaviors and attack targets therein. According to the causal relationship and temporal relationship between the attack behaviors, the order and dependency of the attack behaviors are judged, and a directed graph of attack behaviors is constructed. A depth-first search algorithm is used to traverse the directed graph of attack behaviors, generate attack paths, and obtain all possible paths from the initial attack node to the target node. The attack paths are clustered by a clustering algorithm, similar attack paths are classified into one category, and the main attack intentions and attack targets of the attacker are identified. According to the attack intention and target, the attack path is risk assessed, the risk value of each attack path is calculated, and the key attack path is determined. The key attack path is visualized in the form of a directed acyclic graph to generate an attack map. The attack map is stored using the graph database Neo4j, and the directed graph structure is constructed through the relational query language Cypher. The nodes represent the attack stage, and the edges represent the conversion process. The importance score of the node is calculated using the PageRank algorithm, and the betweenness centrality algorithm is applied to identify the hub node, thereby identifying the key path and hub blockchain node in the map. Around the identified key path and hub node, the C4.5 decision tree algorithm is used to automatically generate detection rules, determine the rule priority based on the information gain ratio, and use the rule priority queue to resolve rule conflicts. The generated rules are converted into query statements and deployed on the nodes and edges corresponding to the attack map. The consistent hashing algorithm is used to assign rules to different nodes to implement a distributed rule deployment mechanism, ensure load balancing and fault tolerance, and realize real-time monitoring of the attack process. In a network consisting of 100 blockchain nodes, each node reports an average of 500 suspicious events per hour. A Bloom filter with 1024 bits and 4 hash functions was used to control the false positive rate below 1%, and about 25% of duplicate events were removed. K-means time series clustering was applied to the remaining events, with K=20 and 50 iterations to obtain 20 event clusters. The local anomaly factor algorithm was used with parameter K set to 5 to calculate the anomaly score of each cluster, and the top 5%, i.e., 1 cluster, was taken as an attack sign. The DTW algorithm was used to align the event sequences of different nodes, with the window size set to 1 hour and the step size set to 5 minutes. The Ward method was used for hierarchical clustering, with the number of clusters set to 10, to obtain 10 multi-stage attack patterns.The attack patterns are stored in the Neo4j graph database, with an average of 5 nodes and 7 edges per pattern. The graph structure is constructed using the Cypher language, e.g.

[0051] "CREATE(a:Stage)-[:TRANSITION]->(b:Stage)". The PageRank algorithm was iterated 20 times with a damping coefficient of 0.85 to obtain the node importance score. The betweenness centrality algorithm uses the Brandes algorithm to calculate 1,000 random sampling paths and identify 10 hub nodes. The C4.5 decision tree sets the minimum number of leaf node samples to 50 and the maximum depth to 5, generating about 100 rules. The rule priority is based on the information gain ratio, and a max-heap is used to maintain the priority queue. Using the consistent hashing algorithm, the number of virtual nodes is set to 100 times the actual number of nodes, and the rules are evenly distributed to each node to achieve load balancing. On average, 80-120 rules are deployed on each node.

[0052] S106. Generate corresponding detection rules based on the key blockchain nodes and paths in the composite attack graph and send them to the local intelligence library of each blockchain node. Utilize the timing characteristics of the blockchain to synchronously update the rules of each blockchain node and trigger the smart contract to verify the validity of the newly added rules.

[0053] According to the composite attack graph, the Tarjan algorithm is used to process the strongly connected components in the graph, and the key blockchain nodes and path information are obtained through processing. The key blockchain nodes and path information are input into the decision tree algorithm to generate a corresponding detection rule set, which includes trigger conditions, detection logic and response actions. After the detection rule set is generated, the detection rule set is packaged into a transaction and broadcast to all participating nodes through the blockchain network; a smart contract is established, and the smart contract contains rule verification logic, which includes syntax checking using regular expressions, semantic consistency checking based on predefined ontology models, and conflict detection using rule similarity calculation. Receive the rule triggering statistics sent by the participating nodes, and calculate the precision and recall of the rules according to the rule triggering statistics. The precision and recall are used to adjust the rule weight or triggering threshold.

[0054] Exemplarily, based on the composite attack graph, the Tarjan algorithm is used to process the strongly connected components in the graph, solve the loop problem, identify key blockchain nodes and paths, input the identification results into the C4.5 decision tree algorithm, and automatically generate the corresponding detection rule set, which includes trigger conditions, detection logic, and response actions. The generated detection rule set is packaged into a transaction and broadcast to all participating nodes through the blockchain network. The proof-of-stake consensus mechanism is adopted, and the node reputation value is considered as the weight. The Gossip protocol is used to keep the node list up to date. After receiving the transaction, each node parses the rule and stores it in the local intelligence library. Based on the timing characteristics of the blockchain, rule version control is performed, and the semantic version number combined with the block height is used as a timestamp to assign a unique version number to each rule. The node applies the rule update according to the version number and timestamp sequence, and the rule merging strategy is designed to handle possible rule conflicts to ensure the synchronous update of the rule base of each node. Design smart contracts and write rule verification logic in the contracts, including syntax checking using regular expressions, semantic consistency checking based on predefined ontology models, and conflict detection using rule similarity calculation. When new rules are broadcast to the network, the contract execution verification is automatically triggered. Rules that pass the verification are formally adopted by each node, and rules that fail the verification are marked and notified to the initiating node for correction. Implement the rule effect feedback mechanism, collect the rule triggering statistics of each node, use the sliding time window to calculate the precision and recall of the rules, automatically adjust the rule weight or trigger threshold, and continuously optimize the detection effect. In a network consisting of 1,000 blockchain nodes, the composite attack graph contains 5,000 nodes and 8,000 edges. The Tarjan algorithm identified 15 strongly connected components in 0.5 seconds and solved the 3 loops in the graph. The C4.5 decision tree algorithm sets the minimum number of leaf node samples to 50 and the maximum depth to 10, generating 200 detection rules. The rules are packaged in JSON format with an average size of 2KB. The PoS consensus mechanism is adopted. The initial weight is based on the number of tokens held by the node, and the reputation value is dynamically adjusted between 0 and 100. The Gossip protocol updates the node list every 10 seconds and tolerates 20% node fluctuations. The rule version number adopts the format of "major version.minor version.revision number", such as "2.3.1", combined with the block height, such as #1234567 as the timestamp. The rule merging strategy uses a priority queue, and high-priority rules are retained in case of conflict. The rule verification logic in the smart contract includes 50 regular expression patterns, the ontology model contains 100 concepts and 200 relationships, and the rule similarity threshold is set to 0.85. Rules that fail to verify are automatically returned to the initiating node and are required to be corrected within 30 minutes. The feedback mechanism uses a 1-hour sliding window and updates statistics every 5 minutes. When the rule precision is lower than 0.6 or the recall rate is lower than 0.5, the trigger threshold is automatically adjusted or the rule weight is reduced by 20%.

[0055] The present invention provides a network security system based on blockchain, which mainly includes:

[0056] Blockchain network building blocks for deploying nodes and intrusion detection systems, regulating interactions and data sharing;

[0057] A local anomaly detection module, which is used to identify attack features based on machine learning, generate behavioral baselines, and monitor anomalies;

[0058] Threat intelligence sharing module, which is used to package suspicious event data, synchronize through blockchain and trigger smart contract analysis;

[0059] Federated learning module, used to collaboratively optimize the global detection model and enhance the utilization of multi-node sample information;

[0060] The composite attack analysis module is used to correlate and analyze multi-node data, form a global attack map and generate detection rules.

[0061] What is disclosed above is only a preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. A person skilled in the art can understand that all or part of the processes of the above embodiments and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A network security method based on blockchain, characterized in that: The method comprises: Build a peer-to-peer network consisting of several blockchain nodes, deploy an intrusion detection system on each blockchain node, standardize the interaction behavior and data format between blockchain nodes through smart contracts, maintain consistency of the threat intelligence library of each blockchain node based on the consensus of the blockchain, and encrypt the threat intelligence data shared between blockchain nodes; Based on the unsupervised learning of the local data of the blockchain node by machine learning algorithms, the key features of the attack behavior in the attack mode are identified, and a multi-dimensional behavior baseline is generated according to the local data of the blockchain node. The deviation between the key features and the behavior baseline is monitored in real time. If a significant anomaly is found, an alarm is triggered and the relevant data is broadcast to other blockchain nodes; When a blockchain node detects a suspicious attack event, it packages the locally captured data into blocks and attaches a timestamp, which is then synchronized to other blockchain nodes through the blockchain network. At the same time, it triggers the smart contract to call the corresponding threat intelligence analysis function, analyze the attack traffic, extract key features and compare them with the local intelligence library, identify known attacks and update detection rules; Using a federated learning framework, each blockchain node trains a local model based on local data, and achieves collaborative optimization of the global model through encrypted parameter aggregation. Without leaking private data, the model's detection capability is enhanced by using sample information from multiple blockchain nodes, and the optimized model is regularly deployed to each blockchain node. On the basis of local anomaly detection, suspicious events reported by each blockchain node are collected through the blockchain network. The data of several blockchain nodes are analyzed using correlation analysis and time series pattern mining algorithms to obtain the correlation of different attack stages and form a composite attack map from a global perspective. According to the key blockchain nodes and paths in the composite attack graph, corresponding detection rules are generated and sent to the local intelligence library of each blockchain node. By utilizing the timing characteristics of the blockchain, the rules of each blockchain node are updated synchronously, and the smart contract is triggered to verify the validity of the new rules.

2. The method according to claim 1, characterized in that The construction of a peer-to-peer network consisting of several blockchain nodes, wherein an intrusion detection system is deployed on each blockchain node, and the interaction behavior and data format between blockchain nodes are regulated through smart contracts. The threat intelligence library of each blockchain node is kept consistent based on the consensus of the blockchain, and the threat intelligence data shared between blockchain nodes is encrypted, including: Obtain network parameter information of blockchain nodes, and construct a peer-to-peer network topology diagram and a connection relationship matrix based on the network parameter information; Calculate the shortest path between nodes based on the connection relationship matrix to obtain the optimal communication route; Collecting original threat logs from the intrusion detection system of the blockchain node, and extracting key fields in the original threat logs through regular expressions; Mapping the key fields into standardized threat intelligence data according to a predefined format; Encrypting the standardized threat intelligence data to obtain threat fingerprint features in ciphertext form; Constructing an index for the threat fingerprint feature in the encrypted form, and distributing and storing the index in a blockchain network; Define smart contracts to regulate threat intelligence sharing interfaces and access control rules between blockchain nodes; Blockchain nodes exchange encrypted threat fingerprints, and the receiving node uses the additive homomorphic property of Paillier encryption to calculate the Euclidean distance in the ciphertext domain; Conduct consensus verification on new threat intelligence data; If more than a preset number of nodes reach a consensus, the newly added threat intelligence data is packaged into blocks and broadcast to other nodes; The other nodes verify the validity of the block and append it to the local blockchain.

3. The method according to claim 1, characterized in that The machine learning algorithm is based on unsupervised learning of the local data of the blockchain node, identifying the key features of the attack behavior in the attack mode, generating a multi-dimensional behavior baseline based on the local data of the blockchain node, and monitoring the deviation between the key features and the behavior baseline in real time. If a significant anomaly is found, an alarm is triggered and the relevant data is broadcast to other blockchain nodes, including: Acquire multi-dimensional data of network traffic, system logs and user behavior, and use principal component analysis to reduce the dimension of the multi-dimensional data to obtain a feature vector after the dimension reduction; Performing unsupervised learning using a Gaussian mixture model based on the feature vector to determine the probability density of each data point, and marking the data point as a potential attack behavior if the probability density is lower than a preset percentile threshold; Performing temporal clustering on the potential attack behaviors, determining representative features of the attack patterns, and constructing a multi-dimensional behavior baseline; Collect new data of blockchain nodes in real time, calculate the Mahalanobis distance between the new data and the multi-dimensional behavior baseline, and if the Mahalanobis distance exceeds a preset threshold, trigger an abnormal alarm, and send abnormal data and associated context information to other nodes through the blockchain network; It also includes: the intrusion detection system of the blockchain node uses the anomaly detection algorithm in unsupervised machine learning to cluster and estimate the density of local data, establish a multi-dimensional baseline of normal behavior, extract key features of suspicious log data through feature engineering, judge the degree to which the system status deviates from the baseline in real time, identify significant abnormal patterns and classify them as potential attack behaviors; Extract key indicators that reflect the normal operation of the system from system resource usage, network communication behavior, user and process behavior, and system log events, model the historical data of key indicators, obtain the normal value range of each indicator, and form a multi-dimensional system behavior baseline, including: According to the system resource monitoring tool, CPU usage, memory occupancy, and disk I / O data are obtained, and network traffic characteristics are obtained from the network traffic collection tool, and user login and process creation behavior data are obtained from the process manager; the original data set is cleaned and the statistical characteristics within the sliding time window are calculated, and the principal component analysis method is used to obtain the preprocessed feature matrix; if the preprocessed feature matrix meets the clustering conditions, a Gaussian mixture model is used to perform cluster analysis on it, and the Gaussian mixture model is trained by the expectation maximization algorithm; the probability density of the historical data of key indicators is estimated, and the Gaussian kernel function is selected to calculate the confidence interval; the clustering result of the Gaussian mixture model is combined with the probability density estimation result, and the probability density of the data point in the corresponding KDE model is calculated to obtain a multi-dimensional system behavior baseline.

4. The method according to claim 3, characterized in that The intrusion detection system of the blockchain node uses the anomaly detection algorithm in unsupervised machine learning to cluster and estimate the density of local data, establish a multi-dimensional baseline of normal behavior, extract key features of suspicious log data through feature engineering, judge the degree of deviation of the system status from the baseline in real time, identify significant abnormal patterns and classify them as potential attack behaviors, including: A sliding time window method is used to extract recent network traffic data, system logs, and user behavior records from the local database of blockchain nodes; Perform standardization processing on the extracted data to obtain preprocessed high-dimensional data; Performing dimensionality reduction on the preprocessed high-dimensional data by principal component analysis, and selecting the principal component whose cumulative explained variance reaches a preset threshold as the eigenvector after dimensionality reduction; Using the DBSCAN algorithm to perform preliminary clustering on the feature vectors after dimension reduction, and identify and remove outliers; Applying Gaussian mixture model for fine clustering, determining the optimal number of clusters by Bayesian information criterion, iteratively optimizing model parameters using expectation maximization algorithm, calculating the probability density of each data point, and establishing a multi-dimensional baseline of normal behavior based on the probability density distribution; Establishing a multi-layer autoencoder network structure, performing unsupervised training on the preprocessed data, performing nonlinear transformation and combination on key features, and generating new feature representations; Calculate the Mahalanobis distance between the newly collected data and the multi-dimensional baseline, normalize the distance value to a preset range as a quantitative indicator of the system state deviation from the baseline, and set a multi-level alarm threshold; The Mahalanobis distance between a data point x and the multidimensional behavioral baseline μ is calculated by the following formula: , where S －1 is the inverse of the covariance matrix; If the distance exceeds the preset threshold, the data point is marked as an anomaly, and the anomaly is secondary verified through the isolation forest algorithm to determine it as a potential attack behavior.

5. The method according to claim 1, characterized in that When a blockchain node detects a suspicious attack event, it packages the locally captured data into blocks and attaches a timestamp, which is synchronized to other blockchain nodes through the blockchain network. At the same time, it triggers the smart contract to call the corresponding threat intelligence analysis function, analyze the attack traffic, extract key features and compare them with the local intelligence library, identify known attacks and update detection rules, including: When the intrusion detection system detects continuous anomalies, it triggers an alarm and captures the network traffic data, system logs, and process information of the blockchain node; Constructing a block data body according to the captured data, wherein the block data body includes serialized binary format data and a timestamp; Calculating a SHA-256 hash value for the block data body to obtain a block header, and combining the block header with the block data body to form a complete block; Broadcast the complete block to other blockchain nodes through the Gossip protocol, and store the complete block in the local blockchain database; The predefined smart contract is triggered when the complete block is broadcasted, and the threat analysis function in the smart contract is called to perform deep packet inspection on the attack traffic data in the complete block; Performing pattern matching on the attack traffic data, extracting source IP address, target port and protocol type features, and generating a feature vector; Calculate the similarity between the feature vector and the known attack pattern stored in the local threat intelligence library. If the similarity exceeds a preset threshold, it is determined to be a known attack type. If the similarity does not exceed the preset threshold, cluster analysis is performed on the feature vector to form a new attack pattern; According to the attack type determination results, the decision tree algorithm is used to generate new rule entries and update the local detection rule base.

6. The method according to claim 1, characterized in that The federated learning framework is adopted, and each blockchain node trains a local model based on local data, and realizes the collaborative optimization of the global model through encrypted parameter aggregation. Without leaking private data, the sample information of multiple blockchain nodes is used to enhance the detection ability of the model, and the optimized model is regularly deployed to each blockchain node, including: Obtain the recent network traffic data, system logs, and user behavior records of blockchain nodes, use sliding time windows to extract statistical features, and obtain a training sample set; Performing local model training on the training sample set using a long short-term memory network, and performing homomorphic encryption processing on the parameters of the local model after the training is completed; Receiving a parameter aggregation request sent by a central server, sending the encrypted model parameters to the central server, and the central server aggregates the encrypted parameters of each node; Receiving updated global model parameters broadcasted by the central server, and updating local model parameters on the encrypted domain; Determine whether the global model converges. If the global model converges, receive the decrypted global model sent by the central server, and load the global model by deserialization.

7. The method according to claim 1, characterized in that On the basis of local anomaly detection, the suspicious events reported by each blockchain node are collected through the blockchain network, and the data of several blockchain nodes are analyzed by using correlation analysis and time series pattern mining algorithms to obtain the correlation of different attack stages and form a composite attack map from a global perspective, including: Receive suspicious event information detected by a blockchain node, wherein the suspicious event information includes event type, timestamp, source IP, and target IP fields; Packing the suspicious event information into a fixed-format message and sending it to other nodes through the blockchain network; Using a sliding time window method to divide the suspicious event message into multiple time segments; Performing association rule mining on the events within the time segment to obtain association rules that meet minimum support and minimum confidence thresholds; According to the association rules, the event sequence across time segments is analyzed to identify the temporal patterns of different attack stages; After identifying the temporal pattern of the attack phase, the attack path is represented by a directed graph structure; It also includes: after collecting suspicious event data reported by each blockchain node through the blockchain network, analyzing several blockchain node data to identify signs of attack on a single blockchain node; correlating events on different blockchain nodes across time to obtain multi-stage sequences and patterns of attacks, and constructing an attack map to depict the steps and conversion processes between different attack stages, and identify the key paths and hub blockchain nodes therein; generating detection rules around key paths and blockchain nodes, and deploying them at corresponding locations on the attack map.

8. The method according to claim 7, characterized in that After collecting suspicious event data reported by each blockchain node through the blockchain network, the data of several blockchain nodes are analyzed to identify signs of attacks on a single blockchain node; events on different blockchain nodes are correlated across time to obtain multi-stage sequences and patterns of attacks, and an attack map is constructed to depict the steps and conversion processes between different attack stages, and to identify the key paths and hub blockchain nodes therein; Generate detection rules around key paths and blockchain nodes and deploy them at corresponding locations on the attack graph, including: Obtain suspicious event data reported by each node of the blockchain network, and use a Bloom filter to remove duplicate events in the suspicious event data to obtain a deduplicated suspicious event data set; According to the deduplicated suspicious event data set, the events on a single node are clustered and grouped in time series, the similarity between events is calculated, and the degree of abnormality is calculated. If the abnormality score ranks in the top preset percentage of event clusters, it is determined to be a sign of attack on the single node; Based on the identified attack signs, the dynamic time warping algorithm is used to align the event sequences on different nodes, the distance matrix between the event sequences is calculated, and the Ward method is used for hierarchical clustering to obtain the multi-stage sequence and pattern of the attack; Based on the multi-stage attack sequence, a directed graph structure is constructed, wherein the nodes of the directed graph structure represent the attack stages, the edges represent the conversion processes, and the importance scores of the nodes are calculated; Determine the key paths and hub blockchain nodes in the attack graph; For the key paths and hub nodes, a decision tree algorithm is used to generate detection rules, a rule priority queue is used to resolve rule conflicts, and a consistent hashing algorithm is used to distribute the detection rules to different nodes.

9. The method according to claim 1, characterized in that: According to the key blockchain nodes and paths in the composite attack graph, corresponding detection rules are generated and sent to the local intelligence library of each blockchain node. By using the timing characteristics of the blockchain, the rules of each blockchain node are updated synchronously, and the smart contract is triggered to verify the validity of the newly added rules, including: According to the composite attack graph, the Tarjan algorithm is used to process the strongly connected components in the graph, and the key blockchain nodes and path information are obtained through processing; Inputting the key blockchain nodes and path information into a decision tree algorithm to generate a corresponding detection rule set, wherein the detection rule set includes trigger conditions, detection logic, and response actions; After generating the detection rule set, the detection rule set is packaged into a transaction and broadcast to all participating nodes through the blockchain network; Establishing a smart contract, wherein the smart contract includes rule verification logic, wherein the rule verification logic includes syntax checking using regular expressions, semantic consistency checking based on a predefined ontology model, and conflict detection using rule similarity calculation; Receive the rule triggering statistical information sent by the participating nodes, and calculate the precision and recall of the rules according to the rule triggering statistical information, wherein the precision and recall are used to adjust the rule weight or triggering threshold.

10. A network security system based on blockchain, characterized in that: Using the blockchain-based network security method according to any one of claims 1 to 9, the system comprises: Blockchain network building blocks for deploying nodes and intrusion detection systems, regulating interactions and data sharing; A local anomaly detection module, which is used to identify attack features based on machine learning, generate behavioral baselines, and monitor anomalies; Threat intelligence sharing module, which is used to package suspicious event data, synchronize through blockchain and trigger smart contract analysis; Federated learning module, used to collaboratively optimize the global detection model and enhance the utilization of multi-node sample information; The composite attack analysis module is used to correlate and analyze multi-node data, form a global attack map and generate detection rules.

Images