Cross-chain attack detection method, device and equipment and readable storage medium

Abstract

The invention discloses a cross-chain attack detection method, device and equipment and a readable storage medium, and the method comprises the steps: obtaining a transaction execution track between a source chain and a target chain, and constructing a cross-chain transaction graph based on the transaction execution track; on the basis, key transaction information is integrated, redundant transaction information is removed, and the method can be suitable for different block chain platforms; then, an attack detection model can be obtained, and global features and local features of the cross-chain transaction graph are extracted; using the attack detection model to detect whether a cross-chain attack exists based on the global features and the local features; and the attack detection model completes cross-chain attack identification based on the global features and the local features, so that the accuracy and sensitivity of detection can be improved. Therefore, the complexity and the difficulty of attack discrimination are reduced, and the universality, the applicability, the application universality, the detection accuracy and the sensitivity are further improved.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and more specifically, to a cross-chain attack detection method, device, equipment and readable storage medium. Background Art

[0002] In recent years, with the rapid development of blockchain technology, cross-chain transactions have received increasing attention as a key mechanism to promote interoperability between different blockchain platforms. However, this cross-chain interoperability also brings new security challenges and risks. Cross-chain transactions involve the transfer of assets and data between different blockchain platforms, which provides attackers with more attack surfaces.

[0003] Therefore, in order to ensure the security of cross-chain transactions, it is necessary to detect cross-chain attacks. Summary of the invention

[0004] In view of this, the present application provides a cross-chain attack detection method, device, equipment and readable storage medium for detecting cross-chain attacks and ensuring transaction security.

[0005] In order to achieve the above objectives, the proposed solution is as follows:

[0006] A cross-chain attack detection method, comprising:

[0007] Obtain an attack detection model and a transaction execution trace between a source chain and a target chain, wherein the attack detection model is trained using a semi-supervised learning method;

[0008] Based on the transaction execution track, a cross-chain transaction graph is constructed;

[0009] Extracting global features and local features of the cross-chain transaction graph;

[0010] The attack detection model is used to detect whether a cross-chain attack exists based on the global features and local features.

[0011] Optionally, obtain transaction execution information between the source chain and the target chain, including:

[0012] Replay transactions on the source chain and the target chain to integrate transaction execution tracks between the source chain and the target chain.

[0013] Optionally, constructing a cross-chain transaction graph based on the transaction execution track includes:

[0014] Extract all operation codes and the number of operations corresponding to each operation code from the transaction execution trace;

[0015] Based on each opcode and its corresponding operands, a cross-chain transaction graph is constructed.

[0016] Optionally, extracting the global features and local features of the cross-chain transaction graph includes:

[0017] Using a graph embedding method to extract structural features of the cross-chain transaction graph;

[0018] Analyze the clustering, connectivity, density, complexity, central nodes, disorder and local information processing capabilities of the cross-chain transaction graph to generate statistical features, wherein the statistical features and the structural features constitute the global features;

[0019] Analyze the node interaction relationship of the cross-chain transaction graph to generate local features.

[0020] Optionally, the analysis of the clustering, connectivity, density, complexity, central nodes, disorder and local information processing capabilities of the cross-chain transaction graph to generate statistical features includes:

[0021] Analyze the clustering of the cross-chain transaction graph, and calculate the clustering coefficient and average clustering coefficient of the cross-chain transaction graph;

[0022] Analyze the connectivity of the cross-chain transaction graph, and calculate the number of connected components, graph Laplace eigenvalues, and spectral radius of the cross-chain transaction graph;

[0023] Analyze the density of the cross-chain transaction graph and calculate the graph density of the cross-chain transaction graph;

[0024] Analyze the complexity of the cross-chain transaction graph and calculate the graph entropy of the cross-chain transaction graph;

[0025] Analyze the central nodes of the cross-chain transaction graph, and calculate the degree centrality, eigenvector centrality, betweenness centrality, and closeness centrality of the cross-chain transaction graph;

[0026] Analyze the disorder degree of the cross-chain transaction graph, and calculate the degree distribution entropy of the cross-chain transaction graph;

[0027] Analyze the local information processing capability of the cross-chain transaction graph and calculate the average local efficiency of the cross-chain transaction graph;

[0028] The clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalues, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy and the average local efficiency constitute the statistical characteristics.

[0029] Optionally, obtain the attack detection model, including:

[0030] Obtain the initial decision tree classification model and cross-chain training samples corresponding to different historical cross-chain transaction graphs. Each cross-chain training sample consists of two types of cross-chain training samples. One type of cross-chain training sample has a label indicating whether the corresponding historical cross-chain transaction graph has a cross-chain attack, and the other type of cross-chain training sample has no label. Each cross-chain training sample contains the training global features and training local features of the corresponding historical cross-chain transaction graph.

[0031] The initial decision tree classification model is trained using each cross-chain training sample, and the final initial decision tree classification model is used as the attack detection model.

[0032] Optionally, the using each cross-chain training sample to train the initial decision tree classification model, and using the final obtained initial decision tree classification model as the attack detection model, includes:

[0033] Training the initial decision tree classification model using a plurality of labeled cross-chain training samples;

[0034] Input multiple cross-chain training samples without labels into the latest initial decision tree classification model in sequence to obtain prediction results of multiple cross-chain training samples without labels;

[0035] Determine the confidence level of each prediction result, and use the prediction results with a confidence level exceeding the confidence threshold as the labels of the corresponding cross-chain training samples;

[0036] Return to the step of training the initial decision tree classification model using a plurality of cross-chain training samples with labels until the latest initial decision tree classification model meets the preset training stop condition.

[0037] A cross-chain attack detection device, comprising:

[0038] An acquisition module, used to acquire an attack detection model and a transaction execution track between a source chain and a target chain, wherein the attack detection model is trained by a semi-supervised learning method;

[0039] A construction module, used to construct a cross-chain transaction graph based on the transaction execution trajectory;

[0040] An extraction module, used to extract global features and local features of the cross-chain transaction graph;

[0041] The detection module is used to use the attack detection model to detect whether there is a cross-chain attack based on the global features and local features.

[0042] A cross-chain attack detection device, comprising a memory and a processor;

[0043] The memory is used to store programs;

[0044] The processor is used to execute the program to implement each step of the above-mentioned cross-chain attack detection method.

[0045] A readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, each step of the above-mentioned cross-chain attack detection method is implemented.

[0046] It can be seen from the above technical solutions that the method for detecting cross-chain attacks provided by this application can obtain the transaction execution trajectory between the source chain and the target chain, and construct a cross-chain transaction graph based on the transaction execution trajectory; based on this, this application integrates the complicated transaction execution trajectories to form a cross-chain transaction graph, presents the transaction execution trajectory in the form of a graph, further sorts out the transaction process between the source chain and the target chain, integrates key transaction information, and removes redundant transaction information; in the application process, different transaction execution trajectories can form corresponding cross-chain transaction graphs, and standardize different transaction execution trajectories into a unified representation method, so that this application can be applied to different blockchain platforms; then, the attack detection model can be obtained , and extract the global features and local features of the cross-chain transaction graph; use the attack detection model to detect whether there is a cross-chain attack based on the global features and local features; based on this, the present application can use the attack detection model to detect whether there is a cross-chain attack in the corresponding transaction execution trajectory based on the global features and local features of the cross-chain transaction graph; because the global features can indicate the overall situation of the entire cross-chain transaction graph; the local features can indicate local information such as the local connection mode, the specific features represented by a specific node, the local subgraph structure and the local abnormal information, therefore, the attack detection model completes the cross-chain attack identification based on the global features and local features, which can improve the accuracy and sensitivity of the detection. It can be seen that the present application can integrate the execution trajectory of the cross-chain transaction into a unified form of the cross-chain transaction graph, and use the attack detection model to perform attack detection based on the overall situation and local situation of the cross-chain transaction graph, which reduces the complexity and difficulty of attack identification, and further improves the versatility, applicability, wide application, detection accuracy and sensitivity. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0048] Figure 1 A flow chart of a cross-chain attack detection method disclosed in an embodiment of the present application;

[0049] Figure 2This is a structural block diagram of a cross-chain attack detection device disclosed in an embodiment of the present application;

[0050] Figure 3 This is a hardware structure block diagram of a cross-chain attack detection device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] Next, combine Figure 1 The cross-chain attack detection method of this application is introduced in detail, including the following steps:

[0053] Step S1: Obtain an attack detection model and the transaction execution trace between the source chain and the target chain.

[0054] Specifically, the attack detection model may be an initial decision tree classification model trained by a semi-supervised learning method.

[0055] Semi-supervised learning methods can be generative methods, self-training methods, or collaborative training methods.

[0056] The transaction execution trace generated when the source chain and the target chain conduct cross-chain transactions can be obtained.

[0057] Among them, the source chain can be the transaction initiator, and the target chain can be the transaction receiver.

[0058] The transaction execution trace can contain a large amount of transaction information, such as the transaction hash used to represent the unique identifier of the transaction, the transaction initiator used to represent the sender address of the transaction, the transaction receiver used to represent the receiver address of the transaction, the transaction amount, the transaction data containing the input data contained in the transaction, the EVM operation code executed at each step, the parameters of each operation code, the result after each operation code is executed, the method name and its parameters called in the contract, the nested call information, the return value of each contract method call, the changes in the account balance involved in the transaction execution process, the change information of the contract storage state used to characterize the storage slots and their new and old values, the changes in EVM memory, the event log used to represent the events triggered by the contract during the execution process, the log data including the event name, parameters, etc., the initial gas amount at the beginning of the transaction, the gas amount consumed by each operation code or contract call, the remaining gas amount at the end of the transaction execution, the gas refund, the abnormal information occurring during the transaction execution, and the failure reason of the relevant operation code or contract call.

[0059] Among them, the transaction recipient can be a contract address or a normal account address.

[0060] Transaction data is usually the encoded data for calling contract methods.

[0061] Step S2: construct a cross-chain transaction graph based on the transaction execution trajectory.

[0062] Specifically, transactions on the source chain and the target chain are matched mainly through data flow transmission. However, the execution flow is not included, because the two transactions are independent of each other in the execution flow, but the data flow can be transmitted through the off-chain repeater. Specifically, the transaction on the source chain outputs information to the off-chain repeater; after the off-chain repeater receives the information, it triggers the transaction on the target chain. Therefore, we can integrate the transaction execution track through the flow of information.

[0063] Relay nodes can be introduced between the source chain and the target chain to make the relationship of the graph complete.

[0064] According to the preset node and relationship creation method, a cross-chain transaction graph can be constructed based on the transaction execution trajectory.

[0065] Step S3: extracting global features and local features of the cross-chain transaction graph.

[0066] Specifically, the statistical features, structural features and local features of the cross-chain transaction graph can be extracted.

[0067] Step S4: Utilize the attack detection model to detect whether a cross-chain attack exists based on the global features and local features.

[0068] Specifically, the attack detection model can be used to analyze global and local features, determine the correlation between the corresponding transaction execution trajectory and the cross-chain attack, and detect whether a cross-chain attack exists.

[0069] It can be seen from the above technical solutions that the method for detecting cross-chain attacks provided by the present application can obtain the transaction execution trajectory between the source chain and the target chain, and construct a cross-chain transaction graph based on the transaction execution trajectory; based on this, the present application integrates the complicated transaction execution trajectories to form a cross-chain transaction graph, and presents the transaction execution trajectory in the form of a graph, further sorts out the transaction process between the source chain and the target chain, integrates key transaction information, and removes redundant transaction information; in the application process, different transaction execution trajectories can form corresponding cross-chain transaction graphs, and standardize different transaction execution trajectories into a unified representation method, effectively solving the problem of differences in transaction data structures for cross-chain attack detection, so that the present application can be applied to different blockchain platforms; subsequently, the attack detection model can be obtained, and the global and local features of the cross-chain transaction graph can be extracted; using the attack The detection model detects whether there is a cross-chain attack based on the global features and local features; based on this, the present application can use the attack detection model to detect whether there is a cross-chain attack in the corresponding transaction execution trajectory based on the global features and local features of the cross-chain transaction graph; because the global features can indicate the overall situation of the entire cross-chain transaction graph; the local features can indicate the local connection mode, the specific features represented by the specific nodes, the local subgraph structure and the local abnormal information, therefore, the attack detection model completes the cross-chain attack identification based on the global features and local features, which can improve the accuracy and sensitivity of the detection; because the advantage of the semi-supervised learning method is that it can make full use of a large amount of unlabeled data to improve the generalization ability and robustness of the model, therefore, the present application uses the attack detection model trained by the semi-supervised learning method to further improve the detection reliability. It can be seen that the present application can integrate the execution trajectory of the cross-chain transaction into a unified form of the cross-chain transaction graph, and use the attack detection model to perform attack detection based on the overall situation and local situation of the cross-chain transaction graph, which reduces the complexity and difficulty of attack identification, and further improves the versatility, applicability, wide application, detection accuracy and sensitivity.

[0070] In some embodiments of the present application, the process of obtaining the transaction execution trace between the source chain and the target chain in step S1 is described in detail, and the steps are as follows:

[0071] S10: replay transactions on the source chain and the target chain, and integrate the transaction execution tracks between the source chain and the target chain.

[0072] Specifically, cross-chain interactions include asset deposits and locks on the source chain, cross-chain communications of off-chain relays, and asset authorization and withdrawals on the target chain. Therefore, both source and target chain transactions need to be replayed.

[0073] By using the Geth client or the RPC service provided by a third party, transactions are replayed on the source chain and the target chain to obtain the transaction execution track between the source chain and the target chain.

[0074] The Geth client has performance and memory requirements for the server, and it is more convenient to use the RPC service provided by a third party.

[0075] It can be seen from the above technical solution that this embodiment provides an optional method for obtaining transaction execution traces. Through the above method, the transaction execution traces can be obtained through transaction replay, thereby improving the integrity of the transaction execution traces.

[0076] In some embodiments of the present application, the process of obtaining the attack detection model in step S1 is described in detail, and the steps are as follows:

[0077] S11. Obtain an initial decision tree classification model and cross-chain training samples corresponding to different historical cross-chain transaction graphs. Each cross-chain training sample consists of two types of cross-chain training samples. One type of cross-chain training sample has a label indicating whether the corresponding historical cross-chain transaction graph has a cross-chain attack, and the other type of cross-chain training sample has no label. Each cross-chain training sample contains the training global features and training local features of the corresponding historical cross-chain transaction graph.

[0078] Specifically, two types of cross-chain training samples can be constructed, and each cross-chain training sample has a unique corresponding historical cross-chain transaction graph.

[0079] One type of cross-chain training samples has labels, and the other type of cross-chain training samples has no labels.

[0080] Each cross-chain training sample contains corresponding global features and local features.

[0081] S12. Use each cross-chain training sample to train the initial decision tree classification model, and use the final initial decision tree classification model as the attack detection model.

[0082] Specifically, based on each cross-chain training sample, the initial decision tree classification model is used as the initial model for training.

[0083] It can be seen from the above technical solution that this embodiment provides an optional method for obtaining an attack detection model. The above method can be used to train the model using unlabeled samples and labeled samples, thereby supplementing more data features and patterns through unlabeled samples to increase data diversity and comprehensiveness; it helps the attack detection model to learn more general feature representations and reduce overfitting of labeled samples; it helps the attack detection model to discover potential rules and structures that are not covered in labeled samples; it makes up for the problem of insufficient number of labeled samples to a certain extent and reduces the manpower and time costs required to obtain a large number of labeled samples.

[0084] In some embodiments of the present application, the process of step S12, using each cross-chain training sample to train the initial decision tree classification model, and using the final initial decision tree classification model as the attack detection model is described in detail, and the steps are as follows:

[0085] S120: Train the initial decision tree classification model using a plurality of cross-chain training samples with labels.

[0086] Specifically, two or more cross-chain training samples with labels can be selected from each cross-chain training sample with labels to train the initial decision tree classification model, and the parameters of the initial decision tree classification model can be adjusted.

[0087] S121. Input multiple cross-chain training samples without labels into the latest initial decision tree classification model in sequence to obtain prediction results of multiple cross-chain training samples without labels.

[0088] Specifically, multiple cross-chain training samples can be selected from each cross-chain training sample without a label, and are sequentially input into the latest initial decision tree classification model to obtain multiple prediction results.

[0089] Each prediction result has a corresponding cross-chain training sample without a label.

[0090] S122. Determine the confidence of each prediction result, and use the prediction result whose confidence exceeds the confidence threshold as the label of the corresponding cross-chain training sample; return to execute step S120 until the latest initial decision tree classification model meets the preset training stop condition.

[0091] Specifically, the confidence threshold can be set according to the accuracy requirement.

[0092] The confidence of each prediction result can be calculated, and each confidence can be compared with a preset confidence threshold. The prediction result with a confidence greater than the confidence threshold can be used as the label of the corresponding cross-chain training sample.

[0093] Return to step S120 and execute until the number of iterations is greater than a preset iteration threshold, or the latest initial decision tree classification model converges.

[0094] It can be seen from the above technical solution that this embodiment provides an optional method for training the initial decision tree classification model. Through the above method, labeled training samples can be gradually increased to further improve the training efficiency and model generalization ability.

[0095] In some embodiments of the present application, the process of step S2, constructing a cross-chain transaction graph based on the transaction execution track, is described in detail, and the steps are as follows:

[0096] S20. Extract all operation codes and the operands corresponding to each operation code from the transaction execution trace.

[0097] Specifically, each operation code and each operand can be extracted to determine the function call relationship, destruction relationship and exception relationship.

[0098] S21. Based on each opcode and its corresponding operand, a cross-chain transaction graph is constructed.

[0099] Specifically, based on the functional type of each opcode, a graph setting method corresponding to the type can be adopted to form a cross-chain transaction graph.

[0100] Function types can represent calling other contract functions, creating relationships, destroying operations, or handling exceptions during contract execution.

[0101] For function types such as CALL, CALLCODE, DELEGATECALL, and STATICCALL, they are opcodes that represent calls to other contract functions. Based on the corresponding operands, it can be determined whether the caller and the callee are a node respectively. If so, a call edge is added; if not, a new node is created and then a call edge is added.

[0102] For function types such as CREATE and CREATE2, which are operation codes that represent the creation of a relationship, it is possible to determine whether the caller and the callee are respectively a node based on the corresponding operands. If so, a creation relationship edge is added; if not, a creation relationship edge is added after a new node is created.

[0103] For operation codes whose function types represent destruction operations, such as SELFDESTRUCT, a destruction relationship edge can be created between the self-destruction contract and the creator of the contract according to the corresponding operands.

[0104] For operation codes such as REVERT, INVALID, THROW, etc. that represent exception handling operations during contract execution, exception handling can be rolling back transactions, throwing exceptions, etc. A new exception node can be created, and an exception relationship edge can be established between the function that throws the operation and the exception node.

[0105] It can be seen from the above technical solution that this embodiment provides an optional method for constructing a cross-chain transaction graph based on the transaction execution trajectory. Through the above method, the construction of the cross-chain transaction graph can be completed based on the operands and operation codes in the transaction execution trajectory, further removing redundancy and simplifying the cross-chain transaction graph.

[0106] In some embodiments of the present application, step S3, the process of extracting the global features and local features of the cross-chain transaction graph is described in detail, and the steps are as follows:

[0107] S30. Using a graph embedding method, extract the structural features of the cross-chain transaction graph.

[0108] Specifically, graph embedding methods such as GCNs and GAT can be used to extract the structural features of the cross-chain transaction graph.

[0109] For example, GCNs can be used to gradually aggregate the features of each node and its neighbors in the cross-chain transaction graph through a hierarchical structure, average or pool the embeddings of all nodes to generate the structural features of the graph.

[0110] GAT can be used to introduce an attention mechanism to perform weighted aggregation on each node and its neighbors in the cross-chain transaction graph, generate node embeddings, and perform pooling operations on all node embeddings to obtain the structural features of the graph.

[0111] S31. Analyze the clustering, connectivity, density, complexity, central nodes, disorder and local information processing capabilities of the cross-chain transaction graph to generate statistical features, wherein the statistical features and the structural features constitute the global features.

[0112] Specifically, we can comprehensively analyze the cross-chain transaction graph based on clustering, connectivity, density, complexity, central nodes, disorder, and local information processing capabilities to generate statistical features.

[0113] S32: Analyze the node interaction relationship of the cross-chain transaction graph to generate local features.

[0114] Specifically, the node interaction relationship in the cross-chain transaction graph can be analyzed to identify the motif features existing in the cross-chain transaction graph.

[0115] Motif features can be subgraph structures or subgraph patterns that exist in the cross-chain transaction graph. These subgraph structures usually appear more frequently than in random graphs, reflecting the local characteristics and functional modules of the cross-chain transaction graph, and can help us understand the organization and function of the cross-chain transaction graph.

[0116] It can be seen from the above technical solution that the present application provides an optional method for extracting the global features and local features of the cross-chain transaction graph. Through the above method, the structural features and statistical features of the cross-chain transaction graph can be extracted, and the local features reflecting the interaction relationship between the nodes of the cross-chain transaction graph can be extracted to better complete the feature extraction.

[0117] In some embodiments of the present application, step S31, analyzing the clustering, connectivity, density, complexity, central nodes, disorder and local information processing capabilities of the cross-chain transaction graph, and generating statistical features is described in detail, and the steps are as follows:

[0118] S310: Analyze the clustering of the cross-chain transaction graph, and calculate the clustering coefficient and average clustering coefficient of the cross-chain transaction graph.

[0119] Specifically, the clustering coefficient is an indicator to measure the degree of clustering of nodes in a network. It reflects how likely it is that a node's neighboring nodes are connected to each other. The average value of the clustering coefficient is used to quantify the degree of clustering of the entire network.

[0120] The clustering coefficient is equal to the ratio of twice the actual number of edges to the possible number of edges.

[0121] The number of edges that actually exist may be the number of actual connections between neighbors of a particular node. The number of possible edges may be k(k-1) / 2, where k is the number of neighbors of a particular node.

[0122] Calculate the sum of the local clustering coefficients of all nodes in the cross-chain transaction graph.

[0123] Divide the sum by the total number of nodes in the cross-chain transaction graph to get the average clustering coefficient.

[0124] The clustering coefficient can be used to measure the clustering tendency of nodes in a graph and reflect the degree of local connection.

[0125] The average clustering coefficient can be used to measure the clustering tendency of the entire graph.

[0126] S311. Analyze the connectivity of the cross-chain transaction graph, and calculate the number of connected components, graph Laplacian eigenvalues, and spectral radius of the cross-chain transaction graph.

[0127] Specifically, the number of connected components can be the number of interconnected subgraphs in the cross-chain transaction graph; the number of connected components is used to measure the overall connectivity of the cross-chain transaction graph and reflect the degree of separation.

[0128] The graph Laplace eigenvalue can be the eigenvalue of the Laplace matrix; the graph Laplace eigenvalue is used to analyze the connectivity, graph clustering and graph embedding of the cross-chain transaction graph.

[0129] The spectral radius can be the maximum eigenvalue of the adjacency matrix; the spectral radius is used to reflect the stability and connectivity of the cross-chain transaction graph.

[0130] S312: Analyze the density of the cross-chain transaction graph and calculate the graph density of the cross-chain transaction graph.

[0131] Specifically, graph density can be the ratio of the actual number of edges in the cross-chain transaction graph to the maximum number of edges that may exist; graph density can be used to measure the density of the cross-chain transaction graph and reflect the richness of connections.

[0132] S313. Analyze the complexity of the cross-chain transaction graph and calculate the graph entropy of the cross-chain transaction graph.

[0133] Specifically, graph entropy can be the information entropy of the entire cross-chain transaction graph; graph entropy is used to measure the complexity and uncertainty of the cross-chain transaction graph.

[0134] S314. Analyze the central nodes of the cross-chain transaction graph, and calculate the degree centrality, eigenvector centrality, betweenness centrality, and closeness centrality of the cross-chain transaction graph.

[0135] Specifically, degree centrality can be the degree divided by the maximum possible degree; degree centrality is used to measure the importance or influence of a node.

[0136] Eigenvector centrality is the influence of each node; eigenvector centrality not only considers its number of connections, but also the centrality of its connected nodes; eigenvector centrality is used to identify the most influential nodes in the graph.

[0137] Betweenness centrality can be the number of times a node passes through all shortest paths; betweenness centrality is used to measure the ability of a node as a network intermediary and identify key bridging nodes.

[0138] Closeness centrality can be the sum of the reciprocals of the shortest path lengths between a node and all other nodes; closeness centrality is used to measure the central position of a node in the graph, reflecting the proximity of the nodes.

[0139] S315. Analyze the disorder degree of the cross-chain transaction graph, and calculate the degree distribution entropy of the cross-chain transaction graph.

[0140] Specifically, the degree distribution entropy can be the entropy value of the degree distribution. The degree distribution entropy is used to measure the disorder of the graph, reflect the uniformity of the node degree distribution, and indicate the randomness of the graph.

[0141] S316. Analyze the local information processing capability of the cross-chain transaction graph, and calculate the average local efficiency of the cross-chain transaction graph.

[0142] Specifically, the average local efficiency can be the average efficiency of the local subgraph of each node in the graph; the average local efficiency is used to measure the local information processing capability of the graph and reflect the robustness and efficiency of the cross-chain transaction graph.

[0143] S317, the clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalues, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy and the average local efficiency constitute the statistical characteristics.

[0144] Specifically, the statistical features may include the clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalues, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy and the average local efficiency.

[0145] It can be seen from the above technical solution that this embodiment provides an optional way to obtain statistical features, through which statistical features can be analyzed from multiple aspects. It is possible to analyze and process key features in transaction data. Based on these features, the attack detection model can automatically learn and adjust the detection algorithm to identify potential attack behaviors. Compared with the traditional rule-based method, this feature extraction-based method has significant advantages. It can dynamically adapt to changing attack patterns and emerging threat types without the need to manually define new detection rules, thereby improving the flexibility and accuracy of detection.

[0146] Next, we will combine Figure 2 The cross-chain attack detection device provided in the present application is introduced in detail. The cross-chain attack detection device provided below can be compared with the cross-chain attack detection method provided above.

[0147] See also Figure 2 It can be found that the cross-chain attack detection device may include:

[0148] An acquisition module 10 is used to acquire an attack detection model and a transaction execution track between a source chain and a target chain, wherein the attack detection model is trained by a semi-supervised learning method;

[0149] A construction module 20, configured to construct a cross-chain transaction graph based on the transaction execution trajectory;

[0150] An extraction module 30, used to extract global features and local features of the cross-chain transaction graph;

[0151] The detection module 40 is used to use the attack detection model to detect whether there is a cross-chain attack based on the global features and local features.

[0152] Furthermore, the acquisition module may include:

[0153] The transaction replay unit is used to replay transactions on the source chain and the target chain, and integrate the transaction execution tracks between the source chain and the target chain.

[0154] Furthermore, the acquisition module may also include:

[0155] A cross-chain training sample acquisition unit is used to obtain the initial decision tree classification model and cross-chain training samples corresponding to different historical cross-chain transaction graphs. Each cross-chain training sample consists of two types of cross-chain training samples. One type of cross-chain training sample has a label indicating whether the corresponding historical cross-chain transaction graph has a cross-chain attack, and the other type of cross-chain training sample has no label. Each cross-chain training sample contains the training global features and training local features of the corresponding historical cross-chain transaction graph.

[0156] The model training unit is used to train the initial decision tree classification model using each cross-chain training sample, and use the final initial decision tree classification model as the attack detection model.

[0157] Furthermore, the model training unit may include:

[0158] A first model training component, used to train the initial decision tree classification model using a plurality of cross-chain training samples with labels;

[0159] The second model training component is used to sequentially input multiple cross-chain training samples without labels into the latest initial decision tree classification model to obtain prediction results of multiple cross-chain training samples without labels;

[0160] The third model training component is used to determine the confidence of each prediction result, and use the prediction result whose confidence exceeds the confidence threshold as the label of the corresponding cross-chain training sample; return to call the first model training component until the latest initial decision tree classification model meets the preset training stop condition.

[0161] Further, building blocks may include:

[0162] An operation code extraction unit, used to extract all operation codes and operands corresponding to each operation code from the transaction execution trace;

[0163] The cross-chain transaction graph construction unit is used to construct a cross-chain transaction graph based on each operation code and its corresponding operand.

[0164] Furthermore, the extraction module may include:

[0165] A structural feature extraction unit, used to extract structural features of the cross-chain transaction graph using a graph embedding method;

[0166] A statistical feature generation unit, used to analyze the clustering, connectivity, density, complexity, central nodes, disorder and local information processing capabilities of the cross-chain transaction graph, and generate statistical features, wherein the statistical features and the structural features constitute the global features;

[0167] The local feature generation unit is used to analyze the node interaction relationship of the cross-chain transaction graph and generate local features.

[0168] Furthermore, the statistical feature generating unit may include:

[0169] A first statistical feature generation component, used to analyze the clustering of the cross-chain transaction graph, and calculate the clustering coefficient and average clustering coefficient of the cross-chain transaction graph;

[0170] A second statistical feature generation component is used to analyze the connectivity of the cross-chain transaction graph, and calculate the number of connected components, graph Laplacian eigenvalues, and spectral radius of the cross-chain transaction graph;

[0171] A third statistical feature generation component is used to analyze the density of the cross-chain transaction graph and calculate the graph density of the cross-chain transaction graph;

[0172] A fourth statistical feature generation component, used to analyze the complexity of the cross-chain transaction graph and calculate the graph entropy of the cross-chain transaction graph;

[0173] A fifth statistical feature generation component, used to analyze the central nodes of the cross-chain transaction graph, and calculate the degree centrality, eigenvector centrality, betweenness centrality and closeness centrality of the cross-chain transaction graph;

[0174] A sixth statistical feature generation component, used to analyze the disorder degree of the cross-chain transaction graph and calculate the degree distribution entropy of the cross-chain transaction graph;

[0175] The seventh statistical feature generation component is used to analyze the local information processing capability of the cross-chain transaction graph and calculate the average local efficiency of the cross-chain transaction graph; the clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplace eigenvalue, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy and the average local efficiency constitute the statistical features.

[0176] The cross-chain attack detection device provided in the embodiment of the present application can be applied to cross-chain attack detection equipment, such as PC terminals, cloud platforms, servers and server clusters. Figure 3 The hardware structure diagram of the cross-chain attack detection device is shown in FIG. Figure 3 ,The hardware structure of the cross-chain attack detection device may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4;

[0177] In the embodiment of the present application, the number of the processor 1, the communication interface 2, the memory 3, and the communication bus 4 is at least one, and the processor 1, the communication interface 2, and the memory 3 communicate with each other through the communication bus 4;

[0178] The processor 1 may be a central processing unit CPU, or an application-specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention, etc.;

[0179] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), etc., such as at least one disk memory;

[0180] The memory stores a program, and the processor can call the program stored in the memory, wherein the program is used to:

[0181] Obtain an attack detection model and a transaction execution trace between a source chain and a target chain, wherein the attack detection model is trained using a semi-supervised learning method;

[0182] Based on the transaction execution track, a cross-chain transaction graph is constructed;

[0183] Extracting global features and local features of the cross-chain transaction graph;

[0184] The attack detection model is used to detect whether a cross-chain attack exists based on the global features and local features.

[0185] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0186] The embodiment of the present application further provides a readable storage medium, which may store a program suitable for execution by a processor, wherein the program is used to:

[0187] Obtain an attack detection model and a transaction execution trace between a source chain and a target chain, wherein the attack detection model is trained using a semi-supervised learning method;

[0188] Based on the transaction execution track, a cross-chain transaction graph is constructed;

[0189] Extracting global features and local features of the cross-chain transaction graph;

[0190] The attack detection model is used to detect whether a cross-chain attack exists based on the global features and local features.

[0191] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0192] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0193] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0194] The above description of the disclosed embodiments enables professionals and technicians in the field to implement or use the present application. Various modifications to these embodiments will be apparent to professionals and technicians in the field, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. The various embodiments of the present application can be combined with each other. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cross-chain attack detection method, characterized in that: include: Obtain an attack detection model and a transaction execution trace between a source chain and a target chain, wherein the attack detection model is trained using a semi-supervised learning method; Based on the transaction execution track, a cross-chain transaction graph is constructed; Extracting global features and local features of the cross-chain transaction graph; The attack detection model is used to detect whether a cross-chain attack exists based on the global features and local features.

2. The cross-chain attack detection method according to claim 1, characterized in that: Get transaction execution information between the source chain and the target chain, including: Replay transactions on the source chain and the target chain to integrate transaction execution tracks between the source chain and the target chain.

3. The cross-chain attack detection method according to claim 1, characterized in that: The constructing a cross-chain transaction graph based on the transaction execution track includes: Extract all operation codes and the number of operations corresponding to each operation code from the transaction execution trace; Based on each opcode and its corresponding operands, a cross-chain transaction graph is constructed.

4. The cross-chain attack detection method according to claim 1, characterized in that: The extracting of global features and local features of the cross-chain transaction graph includes: Using a graph embedding method to extract structural features of the cross-chain transaction graph; Analyze the clustering, connectivity, density, complexity, central nodes, disorder and local information processing capabilities of the cross-chain transaction graph to generate statistical features, wherein the statistical features and the structural features constitute the global features; Analyze the node interaction relationship of the cross-chain transaction graph to generate local features.

5. The cross-chain attack detection method according to claim 4 is characterized in that: Analyze the clustering, connectivity, density, complexity, central nodes, disorder and local information processing capabilities of the cross-chain transaction graph to generate statistical features, wherein the statistical features and the structural features constitute the global features, including: Analyze the clustering of the cross-chain transaction graph, and calculate the clustering coefficient and average clustering coefficient of the cross-chain transaction graph; Analyze the connectivity of the cross-chain transaction graph, and calculate the number of connected components, graph Laplace eigenvalues, and spectral radius of the cross-chain transaction graph; Analyze the density of the cross-chain transaction graph and calculate the graph density of the cross-chain transaction graph; Analyze the complexity of the cross-chain transaction graph and calculate the graph entropy of the cross-chain transaction graph; Analyze the central nodes of the cross-chain transaction graph, and calculate the degree centrality, eigenvector centrality, betweenness centrality, and closeness centrality of the cross-chain transaction graph; Analyze the disorder degree of the cross-chain transaction graph, and calculate the degree distribution entropy of the cross-chain transaction graph; Analyze the local information processing capability of the cross-chain transaction graph and calculate the average local efficiency of the cross-chain transaction graph; The clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalues, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy and the average local efficiency constitute the statistical characteristics.

6. The cross-chain attack detection method according to claim 1, characterized in that: Get the attack detection model, including: Obtain the initial decision tree classification model and cross-chain training samples corresponding to different historical cross-chain transaction graphs. Each cross-chain training sample consists of two types of cross-chain training samples. One type of cross-chain training sample has a label indicating whether the corresponding historical cross-chain transaction graph has a cross-chain attack, and the other type of cross-chain training sample has no label. Each cross-chain training sample contains the training global features and training local features of the corresponding historical cross-chain transaction graph. The initial decision tree classification model is trained using each cross-chain training sample, and the final initial decision tree classification model is used as the attack detection model.

7. The cross-chain attack detection method according to claim 6, characterized in that: The method of training the initial decision tree classification model using each cross-chain training sample and using the final initial decision tree classification model as the attack detection model includes: Training the initial decision tree classification model using a plurality of labeled cross-chain training samples; Input multiple cross-chain training samples without labels into the latest initial decision tree classification model in sequence to obtain prediction results of multiple cross-chain training samples without labels; Determine the confidence level of each prediction result, and use the prediction results with a confidence level exceeding the confidence threshold as the labels of the corresponding cross-chain training samples; Return to the step of training the initial decision tree classification model using a plurality of cross-chain training samples with labels until the latest initial decision tree classification model meets the preset training stop condition.

8. A cross-chain attack detection device, characterized in that: include: An acquisition module, used to acquire an attack detection model and a transaction execution track between a source chain and a target chain, wherein the attack detection model is trained by a semi-supervised learning method; A construction module, used to construct a cross-chain transaction graph based on the transaction execution trajectory; An extraction module, used to extract global features and local features of the cross-chain transaction graph; The detection module is used to use the attack detection model to detect whether there is a cross-chain attack based on the global features and local features.

9. A cross-chain attack detection device, characterized in that: including memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the cross-chain attack detection method as described in any one of claims 1-7.

10. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, each step of the cross-chain attack detection method as described in any one of claims 1 to 7 is implemented.

Images