Cross-chain attack detection method, device, equipment and readable storage medium

Abstract

The application discloses a cross-chain attack detection method and device, equipment and a readable storage medium. The method can acquire a transaction execution track between a source chain and a target chain, and construct a cross-chain transaction graph based on the transaction execution track. Based on this, the application integrates key transaction information and removes redundant transaction information, which can be applied to different blockchain platforms. Then, an attack detection model can be acquired, and global features and local features of the cross-chain transaction graph are extracted. The attack detection model is used to detect whether there is a cross-chain attack based on the global features and the local features. The attack detection model completes cross-chain attack identification based on the global features and the local features, which can improve the accuracy and sensitivity of detection. It can be seen that the application reduces the complexity and difficulty of attack identification, and further improves the universality, applicability, wide applicability, detection accuracy and sensitivity.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain, more particularly, to a cross-chain attack detection method and device, equipment and a readable storage medium. BACKGROUND

[0002] In recent years, with the rapid development of blockchain technology, cross-chain transactions, as a key mechanism to promote interoperability between different blockchain platforms, have received increasing attention. However, this cross-chain interoperability also brings new security challenges and risks. Cross-chain transactions involve the transfer of assets and data between different blockchain platforms, which provides more attack surfaces for attackers.

[0003] Therefore, in order to ensure the security of cross-chain transactions, it is necessary to detect cross-chain attacks. SUMMARY

[0004] Therefore, the present application provides a cross-chain attack detection method, device, equipment and readable storage medium for detecting cross-chain attacks and ensuring transaction security.

[0005] In order to achieve the above purpose, the present scheme is as follows:

[0006] A cross-chain attack detection method, comprising:

[0007] Obtaining an attack detection model and a transaction execution trajectory between a source chain and a target chain, the attack detection model being obtained by semi-supervised learning;

[0008] Based on the transaction execution trajectory, a cross-chain transaction graph is constructed;

[0009] Extracting global features and local features of the cross-chain transaction graph;

[0010] Using the attack detection model, based on the global features and local features, detecting whether there is a cross-chain attack.

[0011] Optionally, obtaining transaction execution information between the source chain and the target chain, comprising:

[0012] Replaying transactions on the source chain and the target chain, and integrating the transaction execution trajectory between the source chain and the target chain.

[0013] Optionally, based on the transaction execution trajectory, constructing a cross-chain transaction graph, comprising:

[0014] Extracting all operation codes and the corresponding operands of each operation code from the transaction execution trajectory;

[0015] Based on each operation code and its corresponding operands, a cross-chain transaction graph is constructed.

[0016] Optionally, the extracting the global feature and the local feature of the cross-chain transaction graph comprises:

[0017] The structure feature of the cross-chain transaction graph is extracted by using a graph embedding method.

[0018] The clustering condition, connectivity, density, complexity, central node, disorder degree and local information processing capacity of the cross-chain transaction graph are analyzed to generate statistical features, wherein the statistical features and the structure features constitute the global features.

[0019] The node interaction relationship of the cross-chain transaction graph is analyzed to generate local features.

[0020] Optionally, the analyzing the clustering condition, connectivity, density, complexity, central node, disorder degree and local information processing capacity of the cross-chain transaction graph to generate statistical features comprises:

[0021] The clustering condition of the cross-chain transaction graph is analyzed to calculate the clustering coefficient and the average clustering coefficient of the cross-chain transaction graph.

[0022] The connectivity of the cross-chain transaction graph is analyzed to calculate the number of connected components, the graph Laplacian eigenvalue and the spectral radius of the cross-chain transaction graph.

[0023] The density of the cross-chain transaction graph is analyzed to calculate the graph density of the cross-chain transaction graph.

[0024] The complexity of the cross-chain transaction graph is analyzed to calculate the graph entropy of the cross-chain transaction graph.

[0025] The central node of the cross-chain transaction graph is analyzed to calculate the degree centrality, eigenvector centrality, betweenness centrality and closeness centrality of the cross-chain transaction graph.

[0026] The disorder degree of the cross-chain transaction graph is analyzed to calculate the degree distribution entropy of the cross-chain transaction graph.

[0027] The local information processing capacity of the cross-chain transaction graph is analyzed to calculate the average local efficiency of the cross-chain transaction graph.

[0028] The clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalue, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy and the average local efficiency constitute the statistical features.

[0029] Optionally, the attack detection model is obtained, comprising:

[0030] obtain an initial decision tree classification model and cross-chain training samples corresponding to different historical cross-chain transaction graphs, each cross-chain training sample being composed of two types of cross-chain training samples, one type of cross-chain training sample having a label indicating whether the corresponding historical cross-chain transaction graph has a cross-chain attack, and the other type of cross-chain training sample not having a label, each cross-chain training sample containing training global features and training local features of the corresponding historical cross-chain transaction graph;

[0031] train the initial decision tree classification model using each cross-chain training sample, and use the final obtained initial decision tree classification model as the attack detection model.

[0032] Optionally, the training of the initial decision tree classification model using each cross-chain training sample, and the use of the final obtained initial decision tree classification model as the attack detection model, comprise:

[0033] training the initial decision tree classification model using multiple cross-chain training samples having labels;

[0034] inputting multiple cross-chain training samples not having labels into the latest initial decision tree classification model in sequence to obtain prediction results of the multiple cross-chain training samples not having labels;

[0035] determining the confidence of each prediction result, and using the prediction result with a confidence exceeding a confidence threshold as the label of the corresponding cross-chain training sample;

[0036] returning to the step of training the initial decision tree classification model using multiple cross-chain training samples having labels until the latest initial decision tree classification model meets a preset training stop condition.

[0037] A cross-chain attack detection device comprises:

[0038] An obtaining module is configured to obtain an attack detection model and a transaction execution track between a source chain and a target chain, the attack detection model being obtained through semi-supervised learning.

[0039] A construction module is configured to construct a cross-chain transaction graph based on the transaction execution track.

[0040] An extraction module is configured to extract global features and local features of the cross-chain transaction graph.

[0041] A detection module is configured to detect whether a cross-chain attack exists based on the global features and the local features using the attack detection model.

[0042] A cross-chain attack detection device comprises a memory and a processor.

[0043] The memory is configured to store a program.

[0044] The processor is configured to execute the program to implement each step of the cross-chain attack detection method.

[0045] A readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements each step of the cross-chain attack detection method.

[0046] As can be seen from the above technical solutions, the detection cross-chain attack method provided by the present application can obtain the transaction execution track between the source chain and the target chain, and construct a cross-chain transaction graph based on the transaction execution track. Based on this, the present application integrates the complex transaction execution track into a cross-chain transaction graph, displays the transaction execution track in the form of a graph, further sorts out the transaction process between the source chain and the target chain, integrates the key transaction information, and removes the redundant transaction information. In the application process, different transaction execution tracks can form corresponding cross-chain transaction graphs, and different transaction execution tracks are standardized into a unified representation method, so that the present application can be applied to different blockchain platforms. Then, an attack detection model can be obtained, and global features and local features of the cross-chain transaction graph can be extracted. Using the attack detection model, whether there is a cross-chain attack is detected based on the global features and the local features. Based on this, the present application can use the attack detection model to detect whether there is a cross-chain attack in the corresponding transaction execution track based on the global features and the local features of the cross-chain transaction graph. Since the global features can indicate the overall situation of the cross-chain transaction graph, the local features can indicate local connection patterns, specific features represented by specific nodes, local subgraph structures, and local abnormal information, etc. Therefore, the attack detection model completes the cross-chain attack identification based on the global features and the local features, which can improve the accuracy and sensitivity of detection. As can be seen, the present application can integrate the execution track of cross-chain transactions into a unified cross-chain transaction graph, and use the attack detection model to detect attacks based on the overall situation and the local situation of the cross-chain transaction graph, which reduces the complexity and difficulty of attack identification, and further improves the universality, applicability, wide applicability, detection accuracy and sensitivity. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present application, and those skilled in the art can obtain other drawings according to the provided drawings without creating any creative labor.

[0048] Figure 1 A cross-chain attack detection method flowchart disclosed by the embodiments of the present application;

[0049] Figure 2A cross-chain attack detection device structure block diagram disclosed by an embodiment of the present application;

[0050] Figure 3 A hardware structure block diagram of a cross-chain attack detection device disclosed by an embodiment of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0052] Next, the cross-chain attack detection method of the present application will be described in detail, including the following steps: Figure 1 The cross-chain attack detection method of the present application will be described in detail, including the following steps:

[0053] Step S1, obtaining an attack detection model, and a transaction execution track between a source chain and a target chain.

[0054] Specifically, the attack detection model can be an initial decision tree classification model trained by a semi-supervised learning method.

[0055] The semi-supervised learning method can be a generative method, a self-training method or a co-training method, etc.

[0056] The transaction execution track generated when the source chain and the target chain perform cross-chain transactions can be obtained.

[0057] The source chain can be a transaction initiator, and the target chain can be a transaction receiver.

[0058] The transaction execution track can include a large amount of transaction information, such as a transaction hash for representing a unique identifier of a transaction, a transaction initiator for representing a sender address of a transaction, a transaction receiver for representing a receiver address of a transaction, a transaction amount, transaction data containing input data of a transaction, an EVM operation code for each step of execution, parameters of each operation code, a result after execution of each operation code, a method name and its parameters in a contract called, nested call information, a return value of each contract method call, a change of an account balance involved in the transaction execution process, change information of a contract storage state for representing a storage slot and its new and old values, a change of an EVM memory, an event log for representing an event triggered in the execution process of a contract, log data including an event name, parameters, etc., an initial Gas amount at the beginning of the transaction, a Gas amount consumed by each operation code or contract call, a remaining Gas amount at the end of the transaction execution, a Gas refund, exception information occurring in the transaction execution process, and failure reasons containing related operation codes or contract calls.

[0059] Wherein, the transaction receiver can be a contract address or a normal account address.

[0060] The transaction data is usually the encoded data of calling contract methods.

[0061] Step S2, based on the transaction execution track, build a cross-chain transaction graph.

[0062] Specifically, the transactions of the source chain and the target chain are mainly matched through the data flow transmission mode. But the execution flow is not included, because two transactions are independent on the execution flow, but the data flow can be transmitted through the off-chain relay. Specifically, the transaction on the source chain outputs information to the off-chain relay; after receiving the information, the off-chain relay triggers a transaction on the target chain. Therefore, we can integrate the transaction execution track through the flow direction of the information.

[0063] Between the source chain and the target chain, a relay node can be introduced to make the relationship of the graph complete.

[0064] According to the preset node and relationship creation mode, a cross-chain transaction graph can be built based on the transaction execution track.

[0065] Step S3, extract the global features and local features of the cross-chain transaction graph.

[0066] Specifically, the statistical features, structural features and local features of the cross-chain transaction graph can be extracted.

[0067] Step S4, using the attack detection model, based on the global features and local features, detect whether there is a cross-chain attack.

[0068] Specifically, the attack detection model can be used to analyze the global features and local features, determine the correlation between the corresponding transaction execution track and the cross-chain attack, and detect whether there is a cross-chain attack.

[0069] It can be seen from the technical solutions that the method for detecting cross-chain attacks provided by the application can obtain a transaction execution track between a source chain and a target chain, and construct a cross-chain transaction graph based on the transaction execution track. Based on this, the application integrates complex transaction execution tracks into a cross-chain transaction graph, displays the transaction execution track in the form of a graph, further analyzes the transaction process between the source chain and the target chain, integrates key transaction information, and removes redundant transaction information. In the application process, different transaction execution tracks can form corresponding cross-chain transaction graphs, and different transaction execution tracks are standardized into a unified representation, effectively solving the problem of transaction data structure differences in cross-chain attack detection, so that the application can be applied to different blockchain platforms. Then, an attack detection model can be obtained, and global features and local features of the cross-chain transaction graph can be extracted. The attack detection model is used to detect whether there is a cross-chain attack based on the global features and the local features. Based on this, the application can use the attack detection model to detect whether there is a cross-chain attack in the corresponding transaction execution track based on the global features and the local features of the cross-chain transaction graph. Since the global features can indicate the overall situation of the cross-chain transaction graph, the local features can indicate the local connection mode, the specific features represented by a specific node, the local subgraph structure and the local abnormal information. Therefore, the attack detection model can complete cross-chain attack identification based on the global features and the local features, which can improve the accuracy and sensitivity of detection. Since the advantage of semi-supervised learning method is that it can make full use of a large amount of unlabeled data to improve the generalization ability and robustness of the model, the attack detection model trained by the semi-supervised learning method can further improve the detection reliability. It can be seen that the application can integrate the execution track of cross-chain transactions into a unified cross-chain transaction graph, and use the attack detection model to detect attacks based on the overall situation and local situation of the cross-chain transaction graph, which reduces the complexity and difficulty of attack identification, and further improves the universality, applicability, application range, detection accuracy and sensitivity.

[0070] In some embodiments of the application, the process of obtaining the transaction execution track between the source chain and the target chain in step S1 is described in detail as follows:

[0071] S10, replaying transactions of the source chain and the target chain, and integrating the transaction execution track between the source chain and the target chain.

[0072] Specifically, cross-chain interaction includes asset deposit and locking on the source chain, cross-chain communication of the off-chain relay, and asset authorization and withdrawal on the target chain. Therefore, replay operations need to be performed on both the source chain transactions and the target chain transactions.

[0073] By using a Geth client or an RPC service provided by a third party, the transaction replay of the source chain and the target chain is performed to obtain the transaction execution track between the source chain and the target chain.

[0074] The Geth client has performance and memory requirements on the server, and it is more convenient to use the RPC service provided by a third party.

[0075] From the above technical solution, it can be seen that the embodiment provides an optional way to obtain a transaction execution track. Through the above way, the transaction execution track can be obtained through transaction replay, and the completeness of the transaction execution track is improved.

[0076] In some embodiments of the present application, the process of obtaining the attack detection model in step S1 is described in detail, and the steps are as follows:

[0077] S11, obtain an initial decision tree classification model and cross-chain training samples corresponding to different historical cross-chain transaction graphs, each cross-chain training sample is composed of two types of cross-chain training samples, one type of cross-chain training sample has a label indicating whether the corresponding historical cross-chain transaction graph has a cross-chain attack, and the other type of cross-chain training sample does not have a label; each cross-chain training sample contains training global features and training local features of the corresponding historical cross-chain transaction graph.

[0078] Specifically, two types of cross-chain training samples can be constructed, and each cross-chain training sample has a unique corresponding historical cross-chain transaction graph.

[0079] One type of cross-chain training sample has a label, and the other type of cross-chain training sample has no label.

[0080] Each cross-chain training sample contains corresponding global features and local features.

[0081] S12, training the initial decision tree classification model using each cross-chain training sample, and finally obtaining the initial decision tree classification model as the attack detection model.

[0082] Specifically, based on each cross-chain training sample, the initial decision tree classification model is used as an initial model for training.

[0083] From the above technical solution, it can be seen that the embodiment provides an optional way to obtain an attack detection model. Through the above way, the model can be trained using unlabeled samples and labeled samples, so that more data features and patterns are supplemented by the unlabeled samples, and the diversity and comprehensiveness of the data are increased; it is helpful for the attack detection model to learn more general feature representations and reduce overfitting to labeled samples; it is helpful for the attack detection model to discover potential rules and structures not covered in the labeled samples; to a certain extent, it makes up for the problem of insufficient number of labeled samples, and reduces the labor and time cost of obtaining a large number of labeled samples.

[0084] In some embodiments of the present application, the process of training the initial decision tree classification model using each cross-chain training sample, and finally obtaining the initial decision tree classification model as the attack detection model, is described in detail as follows:

[0085] S120, training the initial decision tree classification model using a plurality of cross-chain training samples with existence labels.

[0086] Specifically, more than two cross-chain training samples with existence labels can be selected from the respective cross-chain training samples with existence labels to train the initial decision tree classification model, and the initial decision tree classification model can be adjusted in parameters.

[0087] S121, sequentially inputting a plurality of cross-chain training samples without labels into the latest initial decision tree classification model to obtain a plurality of prediction results of the cross-chain training samples without labels.

[0088] Specifically, a plurality of cross-chain training samples without labels can be selected from the respective cross-chain training samples without labels and sequentially input into the latest initial decision tree classification model to obtain a plurality of prediction results.

[0089] Each prediction result corresponds to a cross-chain training sample without labels.

[0090] S122, determining the confidence of each prediction result, and taking the prediction result with a confidence exceeding a confidence threshold as the label of the corresponding cross-chain training sample; returning to execute step S120 until the latest initial decision tree classification model meets a preset training stopping condition.

[0091] Specifically, the confidence threshold can be set according to the accuracy requirement.

[0092] The confidence of each prediction result can be calculated, and each confidence can be compared with a preset confidence threshold, and the prediction result with a confidence greater than the confidence threshold can be taken as the label of the corresponding cross-chain training sample.

[0093] Returning to execute step S120 until the number of iterations is greater than a preset iteration threshold, or the latest initial decision tree classification model converges.

[0094] As can be seen from the above technical solutions, the present embodiment provides an optional way of training an initial decision tree classification model, which can gradually increase the labeled training samples and further improve the training efficiency and model generalization ability.

[0095] In some embodiments of the present application, the process of constructing a cross-chain transaction graph based on the transaction execution track is described in detail as follows:

[0096] S20, extract all operation codes and the corresponding operands of each operation code from the transaction execution track.

[0097] Specifically, each operation code and each operand can be extracted, and function call relationship, destruction relationship and exception relationship can be determined.

[0098] S21, based on each operation code and its corresponding operand, a cross-chain transaction graph is constructed.

[0099] Specifically, based on the function type of each operation code, the corresponding graph setting method of the type can be used to form a cross-chain transaction graph.

[0100] The function type can be indicative of calling other contract functions, indicative of creating a relationship, indicative of a destruction operation, and indicative of an exception handling operation in the contract execution process.

[0101] For the function types of CALL, CALLCODE, DELEGATECALL, and STATICCALL, the operation codes are indicative of calling other contract functions. According to the corresponding operands, it can be determined whether the caller and the callee are respectively one node, if so, an invocation edge is added, if not, a new node is created and an invocation edge is added.

[0102] For the function types of CREATE and CREATE2, the operation codes are indicative of creating a relationship. According to the corresponding operands, it can be determined whether the caller and the callee are respectively one node, if so, a creation relationship edge is added, if not, a new node is created and a creation relationship edge is added.

[0103] For the function type of SELFDESTRUCT, the operation code is indicative of a destruction operation. According to the corresponding operand, a destruction relationship edge can be created between the self-destruct contract and the creator of the contract.

[0104] For the operation codes of REVERT, INVALID, and THROW, which are indicative of exception handling operations in the contract execution process, the exception handling can be transaction rollback, exception throwing, etc. An exception node can be newly created, and an exception relationship edge can be established between the function throwing the operation and the exception node.

[0105] As can be seen from the above technical solutions, the embodiment provides an optional way of constructing a cross-chain transaction graph based on a transaction execution track. Through the above way, the construction of the cross-chain transaction graph can be completed based on the operands and operation codes in the transaction execution track, and further redundancy can be removed and the cross-chain transaction graph can be simplified.

[0106] In some embodiments of the present application, the process of step S3, extracting the global features and local features of the cross-chain transaction graph, is described in detail as follows:

[0107] S30, extracting structural features of the cross-chain transaction graph by using a graph embedding method.

[0108] Specifically, graph embedding methods such as GCNs and GAT can be used to extract the structural features of the cross-chain transaction graph.

[0109] For example, GCNs can be used to gradually aggregate the features of each node and its neighbors in the cross-chain transaction graph through a hierarchical structure, average or pool all node embeddings, and generate the structural features of the graph.

[0110] GAT can be used to introduce an attention mechanism, weight aggregate each node and its neighbors in the cross-chain transaction graph, generate node embeddings, and pool all node embeddings to obtain the structural features of the graph.

[0111] S31, analyzing the clustering, connectivity, density, complexity, center node, disorder degree and local information processing ability of the cross-chain transaction graph to generate statistical features, wherein the statistical features and the structural features constitute the global features.

[0112] Specifically, the clustering, connectivity, density, complexity, center node, disorder degree and local information processing ability of the cross-chain transaction graph can be analyzed to generate statistical features.

[0113] S32, analyzing the node interaction relationship of the cross-chain transaction graph to generate local features.

[0114] Specifically, the node interaction relationship in the cross-chain transaction graph can be analyzed to identify the motif features existing in the cross-chain transaction graph.

[0115] The motif feature can be a subgraph structure or subgraph pattern existing in the cross-chain transaction graph. These subgraph structures usually have a higher frequency than those in random graphs, reflecting the local features and functional modules of the cross-chain transaction graph, and can help us understand the organization and function of the cross-chain transaction graph.

[0116] As can be seen from the above technical solutions, the present application provides an optional way to extract global features and local features of the cross-chain transaction graph. Through the above way, the structural features, statistical features and local features reflecting the interaction relationship between nodes of the cross-chain transaction graph can be extracted, and the feature extraction can be better completed.

[0117] In some embodiments of the present application, the process of step S31, analyzing the clustering, connectivity, density, complexity, center node, disorder degree and local information processing ability of the cross-chain transaction graph to generate statistical features, is described in detail as follows:

[0118] S310, analyze the clustering of the cross-chain transaction graph, calculate the clustering coefficient and the average clustering coefficient of the cross-chain transaction graph.

[0119] Specifically, the clustering coefficient is an index for measuring the clustering degree of nodes in a network. It reflects the possibility of the neighbor nodes of a node being connected to each other. The average value of the clustering coefficient is used to quantify the clustering degree of the entire network.

[0120] The clustering coefficient is equal to the ratio of the actual number of edges to the possible number of edges.

[0121] The actual number of edges can be the actual number of connections between the neighbors of a specific node. The possible number of edges can be k(k-1) / 2, where k is the number of neighbors of the specific node.

[0122] The sum of the local clustering coefficients of all nodes in the cross-chain transaction graph is calculated.

[0123] The sum is divided by the total number of nodes in the cross-chain transaction graph to obtain the average clustering coefficient.

[0124] The clustering coefficient can be used to measure the clustering tendency of nodes in the graph, reflecting the local connection tightness.

[0125] The average clustering coefficient can be used to measure the clustering tendency of the entire graph.

[0126] S311, analyze the connectivity of the cross-chain transaction graph, calculate the number of connected components, the graph Laplacian eigenvalue, and the spectral radius of the cross-chain transaction graph.

[0127] Specifically, the number of connected components can be the number of subgraphs that are connected to each other in the cross-chain transaction graph; the number of connected components is used to measure the overall connectivity of the cross-chain transaction graph, reflecting the degree of separation.

[0128] The graph Laplacian eigenvalue can be the eigenvalue of the Laplacian matrix; the graph Laplacian eigenvalue is used to analyze the connectivity, graph clustering, and graph embedding of the cross-chain transaction graph.

[0129] The spectral radius can be the largest eigenvalue of the adjacency matrix; the spectral radius is used to reflect the stability and connectivity of the cross-chain transaction graph.

[0130] S312, analyze the density of the cross-chain transaction graph, calculate the graph density of the cross-chain transaction graph.

[0131] Specifically, the graph density can be the ratio of the actual number of edges in the cross-chain transaction graph to the maximum number of possible edges; the graph density can be used to measure the density of the cross-chain transaction graph, reflecting the richness of the connections.

[0132] S313, analyze the complexity of the cross-chain transaction graph, and calculate the graph entropy of the cross-chain transaction graph.

[0133] Specifically, the graph entropy can be the information entropy of the entire cross-chain transaction graph; the graph entropy is used to measure the complexity and uncertainty of the cross-chain transaction graph.

[0134] S314, analyze the central nodes of the cross-chain transaction graph, and calculate the degree centrality, eigenvector centrality, betweenness centrality and closeness centrality of the cross-chain transaction graph.

[0135] Specifically, the degree centrality can be the degree divided by the maximum possible degree; the degree centrality is used to measure the importance or influence of a node.

[0136] The eigenvector centrality can be the influence of each node; the eigenvector centrality not only considers the number of connections, but also considers the centrality of the connected nodes; the eigenvector centrality is used to identify the most influential nodes in the graph.

[0137] The betweenness centrality can be the number of times a node passes through all shortest paths; the betweenness centrality is used to measure the ability of a node as a network intermediary and identify key bridge nodes.

[0138] The closeness centrality can be the sum of the reciprocals of the shortest path lengths between the node and all other nodes; the closeness centrality is used to measure the central position of a node in the graph and reflect the proximity of the node.

[0139] S315, analyze the degree of disorder of the cross-chain transaction graph, and calculate the degree distribution entropy of the cross-chain transaction graph.

[0140] Specifically, the degree distribution entropy can be the entropy value of the degree distribution. The degree distribution entropy is used to measure the degree of disorder of the graph, reflect the uniformity of the node degree distribution, and represent the randomness of the graph.

[0141] S316, analyze the local information processing capability of the cross-chain transaction graph, and calculate the average local efficiency of the cross-chain transaction graph.

[0142] Specifically, the average local efficiency can be the average efficiency of the local subgraph of each node in the graph; the average local efficiency is used to measure the local information processing capability of the graph and reflect the robustness and efficiency of the cross-chain transaction graph.

[0143] S317, the clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalue, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy and the average local efficiency constitute the statistical features.

[0144] In particular, the statistical features can include the clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalue, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy, and the average local efficiency.

[0145] From the above technical solutions, the embodiment provides an optional way to obtain statistical features. Through the above method, statistical features can be obtained from multiple aspects. The key features in the transaction data are analyzed and processed. Based on these features, the attack detection model can automatically learn and adjust the detection algorithm to identify potential attack behaviors. Compared with traditional rule-based methods, this feature extraction-based method has significant advantages. It can dynamically adapt to changing attack patterns and emerging threat types without the need for human-defined new detection rules, thereby improving the flexibility and accuracy of detection.

[0146] Next, the above will be combined with Figure 2 The cross-chain attack detection device provided in the present application will be described in detail. The cross-chain attack detection device provided below can be mutually compared with the cross-chain attack detection method provided above.

[0147] Referring to Figure 2 It can be found that the cross-chain attack detection device can include:

[0148] The acquisition module 10 is configured to acquire an attack detection model and a transaction execution trajectory between a source chain and a target chain, wherein the attack detection model is obtained through semi-supervised learning.

[0149] The construction module 20 is configured to construct a cross-chain transaction graph based on the transaction execution trajectory.

[0150] The extraction module 30 is configured to extract global features and local features of the cross-chain transaction graph.

[0151] The detection module 40 is configured to detect whether there is a cross-chain attack based on the global features and the local features by using the attack detection model.

[0152] Further, the acquisition module can include:

[0153] The transaction replay unit is configured to perform transaction replay on the source chain and the target chain, and integrate the transaction execution trajectory between the source chain and the target chain.

[0154] Further, the acquisition module can further include:

[0155] The cross-chain training sample acquisition unit is configured to acquire an initial decision tree classification model and cross-chain training samples corresponding to different historical cross-chain transaction graphs, each cross-chain training sample being composed of two types of cross-chain training samples, one type of cross-chain training sample having a label indicating whether the corresponding historical cross-chain transaction graph has a cross-chain attack, and the other type of cross-chain training sample not having a label; each cross-chain training sample contains training global features and training local features of the corresponding historical cross-chain transaction graph;

[0156] The model training unit is configured to train the initial decision tree classification model by using each cross-chain training sample, and take the final obtained initial decision tree classification model as the attack detection model.

[0157] Further, the model training unit can include:

[0158] The first model training component is configured to train the initial decision tree classification model by using a plurality of cross-chain training samples with labels;

[0159] The second model training component is configured to input a plurality of cross-chain training samples without labels into the latest initial decision tree classification model in sequence to obtain prediction results of the plurality of cross-chain training samples without labels;

[0160] The third model training component is configured to determine the confidence of each prediction result, and take the prediction result with a confidence exceeding a confidence threshold as the label of the corresponding cross-chain training sample; return to call the first model training component until the latest initial decision tree classification model meets a preset training stop condition.

[0161] Further, the construction module can include:

[0162] The operation code extraction unit is configured to extract all operation codes and operation numbers corresponding to each operation code from the transaction execution track;

[0163] The cross-chain transaction graph construction unit is configured to construct a cross-chain transaction graph based on each operation code and the operation number corresponding to the operation code.

[0164] Further, the extraction module can include:

[0165] The structural feature extraction unit is configured to extract structural features of the cross-chain transaction graph by using a graph embedding method;

[0166] The statistical feature generation unit is configured to analyze clustering, connectivity, density, complexity, center node, disorder degree and local information processing capability of the cross-chain transaction graph, and generate statistical features, wherein the statistical features and the structural features constitute the global features;

[0167] The local feature generation unit is configured to analyze node interaction of the cross-chain transaction graph and generate local features.

[0168] Further, the statistical feature generation unit can include:

[0169] The first statistical feature generation component is configured to analyze clustering of the cross-chain transaction graph, and calculate a clustering coefficient and an average clustering coefficient of the cross-chain transaction graph.

[0170] The second statistical feature generation component is configured to analyze connectivity of the cross-chain transaction graph, and calculate a number of connected components, a graph Laplacian eigenvalue and a spectral radius of the cross-chain transaction graph.

[0171] The third statistical feature generation component is configured to analyze density of the cross-chain transaction graph, and calculate a graph density of the cross-chain transaction graph.

[0172] The fourth statistical feature generation component is configured to analyze complexity of the cross-chain transaction graph, and calculate a graph entropy of the cross-chain transaction graph.

[0173] The fifth statistical feature generation component is configured to analyze central nodes of the cross-chain transaction graph, and calculate a degree centrality, an eigenvector centrality, a betweenness centrality and a closeness centrality of the cross-chain transaction graph.

[0174] The sixth statistical feature generation component is configured to analyze disorder degree of the cross-chain transaction graph, and calculate a degree distribution entropy of the cross-chain transaction graph.

[0175] The seventh statistical feature generation component is configured to analyze local information processing capability of the cross-chain transaction graph, and calculate an average local efficiency of the cross-chain transaction graph. The clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalue, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the closeness centrality, the degree distribution entropy and the average local efficiency constitute the statistical features.

[0176] The cross-chain attack detection device provided by the embodiments of the present application can be applied to a cross-chain attack detection device, such as a PC terminal, a cloud platform, a server, a server cluster, etc. Optionally, Figure 3 A hardware structure block diagram of the cross-chain attack detection device is shown, and reference is made to Figure 3 The hardware structure of the cross-chain attack detection device can include at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4.

[0177] In the embodiments of the present application, the number of processors 1, communication interfaces 2, memories 3 and communication buses 4 is at least one, and the processor 1, the communication interface 2 and the memory 3 complete communication with each other through the communication bus 4.

[0178] The processor 1 can be a central processing unit CPU, or an application specific integrated circuit ASIC, or one or more integrated circuits configured to implement embodiments of the application, etc.

[0179] The memory 3 can comprise a high-speed RAM memory, and can also comprise a non-volatile memory, such as at least one disk memory, etc.

[0180] The memory stores a program, and the processor can invoke the program stored in the memory, and the program is used for:

[0181] Obtaining an attack detection model and a transaction execution track between a source chain and a target chain, the attack detection model being obtained through semi-supervised learning;

[0182] Based on the transaction execution track, a cross-chain transaction graph is constructed;

[0183] Global features and local features of the cross-chain transaction graph are extracted;

[0184] Using the attack detection model, whether there is a cross-chain attack is detected based on the global features and the local features.

[0185] Optionally, the detailed functions and the extended functions of the program can refer to the description above.

[0186] The embodiments of the application further provide a readable storage medium, which can store a program suitable for processor execution, and the program is used for:

[0187] Obtaining an attack detection model and a transaction execution track between a source chain and a target chain, the attack detection model being obtained through semi-supervised learning;

[0188] Based on the transaction execution track, a cross-chain transaction graph is constructed;

[0189] Global features and local features of the cross-chain transaction graph are extracted;

[0190] Using the attack detection model, whether there is a cross-chain attack is detected based on the global features and the local features.

[0191] Optionally, the detailed functions and the extended functions of the program can refer to the description above.

[0192] Finally, it should be noted that the terms "first", "second", and the like, herein do not denote any order, quantity, combination, or otherwise, but are used to identify one entity from another, and do not imply any actual relationship or sequence among entities. Also, the use of the term "including", "containing" or any other variant to refer to a list of elements to be combined is intended to denote that not only the listed elements can be present, but also other elements not expressly listed. The term "consisting of" excludes any element not named in the list of elements from the process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus including the element.

[0193] The various embodiments in the specification are described in progressive order with reference to each embodiment, each embodiment highlighting differences from other embodiments, and the same or similar parts among the various embodiments can be mutually referred to.

[0194] The above description of disclosed embodiments enables one skilled in the art to make or use the application. Numerous modifications to these embodiments will be apparent to those skilled in the art, and the generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the application. Various embodiments of the application can be combined with each other. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting cross-chain attacks, characterized in that, include: An attack detection model is obtained, which is trained using a semi-supervised learning method. Perform transaction replay on the source chain and the target chain, and integrate the transaction execution trajectories between the source chain and the target chain; Extract all opcodes and the operands corresponding to each opcode from the transaction execution trajectory; Construct a cross-chain transaction graph based on each opcode and its corresponding operand; The structural features of the cross-chain transaction graph are extracted using a graph embedding method. The clustering, connectivity, density, complexity, central nodes, disorder, and local information processing capabilities of the cross-chain transaction graph are analyzed to generate statistical features, wherein the statistical features and the structural features constitute global features. Analyze the node interaction relationships in the cross-chain transaction graph to generate local features; Using the attack detection model, based on the global and local features, the existence of cross-chain attacks can be detected.

2. The cross-chain attack detection method according to claim 1, characterized in that, Analyze the clustering, connectivity, density, complexity, central nodes, disorder, and local information processing capabilities of the cross-chain transaction graph to generate statistical features. These statistical features and structural features constitute global features, including: Analyze the clustering of the cross-chain transaction graph, and calculate the clustering coefficient and average clustering coefficient of the cross-chain transaction graph; Analyze the connectivity of the cross-chain transaction graph, and calculate the number of connected components, graph Laplacian eigenvalues, and spectral radius of the cross-chain transaction graph; Analyze the density of the cross-chain transaction graph and calculate its graph density; Analyze the complexity of the cross-chain transaction graph and calculate its graph entropy; Analyze the central nodes of the cross-chain transaction graph and calculate the degree centrality, eigenvector centrality, betweenness centrality, and tight centrality of the cross-chain transaction graph; Analyze the degree of disorder in the cross-chain transaction graph and calculate the degree distribution entropy of the cross-chain transaction graph; Analyze the local information processing capability of the cross-chain transaction graph and calculate the average local efficiency of the cross-chain transaction graph; The statistical features consist of the clustering coefficient, the average clustering coefficient, the number of connected components, the graph Laplacian eigenvalue, the spectral radius, the graph density, the graph entropy, the degree centrality, the eigenvector centrality, the betweenness centrality, the compact centrality, the degree distribution entropy, and the average local efficiency.

3. The cross-chain attack detection method according to claim 1, characterized in that, Obtain the attack detection model, including: Obtain the initial decision tree classification model and cross-chain training samples corresponding to different historical cross-chain transaction graphs. Each cross-chain training sample consists of two types of cross-chain training samples: one type of cross-chain training sample has a label indicating whether the corresponding historical cross-chain transaction graph has a cross-chain attack, and the other type of cross-chain training sample does not have a label. Each cross-chain training sample contains the training global features and training local features of the corresponding historical cross-chain transaction graph. The initial decision tree classification model is trained using each cross-chain training sample, and the final initial decision tree classification model is used as the attack detection model.

4. The cross-chain attack detection method according to claim 3, characterized in that, The step of training the initial decision tree classification model using each cross-chain training sample, and using the final initial decision tree classification model as the attack detection model, includes: The initial decision tree classification model is trained using multiple cross-chain training samples with labels; Multiple cross-chain training samples without labels are sequentially input into the latest initial decision tree classification model to obtain the prediction results of multiple cross-chain training samples without labels; Determine the confidence level of each prediction result, and use the prediction results with a confidence level exceeding the confidence threshold as the labels of the corresponding cross-chain training samples; Return to the step of training the initial decision tree classification model using multiple labeled cross-chain training samples, until the latest initial decision tree classification model meets the preset training stopping condition.

5. A cross-chain attack detection device, characterized in that, include: The acquisition module is used to acquire the attack detection model, which is trained using a semi-supervised learning method. Perform transaction replay on the source chain and the target chain, and integrate the transaction execution trajectories between the source chain and the target chain; A construction module is used to extract all opcodes and the operands corresponding to each opcode from the transaction execution trajectory; and to construct a cross-chain transaction graph based on each opcode and its corresponding operands. The extraction module is used to extract the structural features of the cross-chain transaction graph using a graph embedding method; The clustering, connectivity, density, complexity, central nodes, disorder, and local information processing capabilities of the cross-chain transaction graph are analyzed to generate statistical features, wherein the statistical features and the structural features constitute global features; the node interaction relationships of the cross-chain transaction graph are analyzed to generate local features. The detection module is used to detect the existence of cross-chain attacks based on the global and local features using the attack detection model.

6. A cross-chain attack detection device, characterized in that, Including memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the cross-chain attack detection method as described in any one of claims 1-4.

7. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements each step of the cross-chain attack detection method as described in any one of claims 1-4.

Images