Memory depletion abnormity early warning method and device for block chain and electronic equipment

Abstract

The invention provides a memory depletion abnormity early warning method and device for a block chain and electronic equipment, and the method comprises the steps: injecting abnormal data used for triggering memory depletion abnormity into the block chain, and collecting first feature data used for describing the memory resource use condition of a block node during the injection period of the abnormal data; training by adopting the first feature data to obtain a machine learning model used for identifying the memory depletion abnormity; during the business operation period of the block chain, collecting second feature data used for describing the memory resource use condition of the block node, and inputting the second feature data into the machine learning model to obtain an identification result of the machine learning model; and based on an identification result of the machine learning model, performing memory depletion abnormity early warning on the block chain during the service operation period. According to the embodiment of the invention, memory depletion abnormity early warning can be timely and accurately carried out, so that the stability and security of the block chain are ensured.

Description

Technical Field

[0001] The present application relates to the field of blockchain, and specifically to a method, device and electronic device for warning abnormal memory exhaustion of blockchain. Background Art

[0002] In the application of blockchain technology, in order to improve the stability and security of blockchain, it is of great significance to detect and prevent the occurrence of memory exhaustion anomalies. In related technologies, since the measures used to prevent memory exhaustion anomalies are too dependent on the personal experience of technicians, it is difficult to detect blockchains that are or are about to have memory exhaustion anomalies in a timely and sufficiently accurate manner, and it is also difficult to ensure the stability and security of blockchains. Summary of the invention

[0003] One purpose of the present application is to propose a method, device and electronic device for abnormal warning of memory exhaustion for blockchain, which can timely and accurately provide abnormal warning of memory exhaustion, thereby ensuring the stability and security of blockchain.

[0004] According to one aspect of an embodiment of the present application, a memory exhaustion abnormality warning method for a blockchain is disclosed, the method comprising:

[0005] Injecting abnormal data for triggering a memory exhaustion exception on the blockchain, and during the injection of the abnormal data, collecting first characteristic data for describing the memory resource usage status of the block node;

[0006] Using the first feature data, training a machine learning model for identifying the memory exhaustion anomaly;

[0007] During the business operation of the blockchain, second feature data for describing the memory resource usage status of the block node is collected, and the second feature data is input into the machine learning model to obtain a recognition result of the machine learning model;

[0008] Based on the recognition result of the machine learning model, a memory exhaustion abnormality warning is issued to the blockchain during business operation.

[0009] According to one aspect of an embodiment of the present application, a memory exhaustion abnormality warning device for a blockchain is disclosed, the device comprising:

[0010] An abnormal data injection module is configured to inject abnormal data for triggering a memory exhaustion exception on the blockchain, and during the injection of the abnormal data, collect first characteristic data for describing the memory resource usage status of the block node;

[0011] a machine learning model training module, configured to use the first feature data to train a machine learning model for identifying the memory exhaustion anomaly;

[0012] A machine learning model application module is configured to collect second feature data used to describe the memory resource usage status of the block node during the business operation of the blockchain, and input the second feature data into the machine learning model to obtain a recognition result of the machine learning model;

[0013] The abnormal warning module is configured to provide a memory exhaustion abnormality warning for the blockchain during business operation based on the recognition result of the machine learning model.

[0014] In an exemplary embodiment of the present application, the machine learning model training module is configured as follows:

[0015] During the period when the abnormal data is not injected, collecting third characteristic data for describing the memory resource usage status of the block node;

[0016] The machine learning model is trained by using the first feature data marked as abnormal data and the third feature data marked as normal data in a supervised learning manner.

[0017] In an exemplary embodiment of the present application, the machine learning model training module is configured as follows:

[0018] Comparing the first feature data with a preset feature threshold, and labeling the first feature data according to the comparison result to obtain a label for the first feature data;

[0019] The machine learning model is trained by using the first feature data and the label of the first feature data in a supervised learning manner.

[0020] In an exemplary embodiment of the present application, the device is configured as follows:

[0021] When the normal business operation of the block node is blocked by the memory exhaustion exception, obtaining fourth characteristic data for describing the memory resource usage status of the block node;

[0022] If the degree of blockage of normal business operation is positively correlated with the value of the fourth characteristic data, setting the characteristic threshold to be lower than the minimum value of the fourth characteristic data;

[0023] If the degree of congestion of normal business operation is negatively correlated with the value of the fourth characteristic data, the characteristic threshold is set to be higher than the maximum value of the fourth characteristic data.

[0024] In an exemplary embodiment of the present application, the abnormal causes of the memory exhaustion abnormality include at least two; the machine learning module training module is configured as follows:

[0025] According to the comparison result, detecting whether the memory exhaustion exception has been triggered when the first characteristic data is collected;

[0026] If the memory exhaustion exception is triggered when the first characteristic data is collected, the abnormal cause type corresponding to the first characteristic data is detected, and the first characteristic data is marked as abnormal data of the abnormal cause type.

[0027] In an exemplary embodiment of the present application, the abnormal data includes at least one of the following: abnormal data for simulating large transaction volumes, abnormal data for simulating large blocks, abnormal data for simulating reduction of node memory, and abnormal data for simulating smart contract vulnerabilities.

[0028] In an exemplary embodiment of the present application, the abnormal data used to simulate smart contract vulnerabilities includes at least one of the following: abnormal data used to simulate infinite loop attack vulnerabilities, abnormal data used to simulate access out-of-bounds attack vulnerabilities, and abnormal data used to simulate denial of service attack vulnerabilities.

[0029] According to one aspect of an embodiment of the present application, an electronic device is disclosed, comprising: one or more processing units; a storage unit for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device implements any one of the above embodiments.

[0030] According to one aspect of an embodiment of the present application, a computer-readable storage medium is disclosed, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer executes any one of the above embodiments.

[0031] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the above various optional implementations.

[0032] In the embodiment of the present application, abnormal data for triggering memory exhaustion anomaly is injected into the blockchain, and during the injection of abnormal data, the first characteristic data for describing the memory resource usage of the block node is collected; the first characteristic data is used to train a machine learning model for identifying memory exhaustion anomaly; during the business operation of the blockchain, the second characteristic data for describing the memory resource usage of the block node is collected, and the second characteristic data is input into the machine learning model to obtain the recognition result of the machine learning model; based on the recognition result of the machine learning model, the blockchain during the business operation is warned of memory exhaustion anomaly. By adopting this method, during the business operation of the blockchain, if the second characteristic data of a block node has the characteristics that meet the memory exhaustion anomaly, even if the block node has not yet experienced the memory exhaustion anomaly, the machine learning model can confirm that the block node has a trend of memory exhaustion according to the second characteristic data of the block node, and then identify the second characteristic data of the block node as belonging to the memory exhaustion anomaly. Therefore, according to the recognition result of the machine learning model, when the block node has a trend of memory exhaustion, it can timely detect and identify that the block node is about to have a memory exhaustion anomaly, and then timely and accurately warn of the memory exhaustion anomaly, thereby ensuring the stability and security of the blockchain.

[0033] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0034] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The above and other objects, features and advantages of the present application will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.

[0036] Figure 1 A schematic diagram of a data sharing system according to an embodiment of the present application is shown.

[0037] Figure 2 A schematic diagram of the structure of a blockchain according to an embodiment of the present application is shown.

[0038] Figure 3 A schematic diagram of generating blocks in a blockchain according to an embodiment of the present application is shown.

[0039] Figure 4 A flowchart of a method for abnormal early warning of memory exhaustion for blockchain according to an embodiment of the present application is shown.

[0040] Figure 5 A schematic diagram of the architecture of a memory exhaustion anomaly warning system for blockchain according to an embodiment of the present application is shown.

[0041] Figure 6 A detailed flow chart of a method for warning abnormal memory exhaustion in blockchain according to an embodiment of the present application is shown.

[0042] Figure 7 It shows an embodiment according to the present application Figure 6 Schematic diagram of the implementation of the OOM exception construction module of the embodiment.

[0043] Figure 8 It shows an embodiment according to the present application Figure 7 A schematic diagram of an implementation of a resource monitoring module of an embodiment.

[0044] Fig. 9 It shows an embodiment according to the present application Figure 6 Schematic diagram of the implementation of the machine learning model training application module of the embodiment.

[0045] Fig.10 A block diagram of a memory exhaustion anomaly warning device for blockchain according to an embodiment of the present application is shown.

[0046] Fig.11 A hardware diagram of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0047] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of the present application will be more comprehensive and complete and the concepts of the example embodiments will be fully conveyed to those skilled in the art. The accompanying drawings are only schematic illustrations of the present application and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0048] In addition, the described features, structures or characteristics may be combined in one or more example embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the example embodiments of the present application. However, those skilled in the art will appreciate that the technical solution of the present application may be practiced while omitting one or more of the specific details, or other methods, components, steps, etc. may be adopted. In other cases, known structures, methods, implementations or operations are not shown or described in detail to avoid obscuring the present application and making the various aspects of the present application obscure.

[0049] Some of the blocks shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0050] Blockchain is mainly used in data sharing systems to store data in a decentralized manner. Figure 1 The data sharing system shown, the data sharing system 100 refers to a system for sharing data between nodes, and the data sharing system may include multiple nodes 101, and the multiple nodes 101 may refer to each client in the data sharing system. Each node 101 can receive input information when performing normal work, and maintain the shared data in the data sharing system based on the received input information. In order to ensure the information intercommunication within the data sharing system, there may be an information connection between each node in the data sharing system, and information can be transmitted between nodes through the above information connection. For example, when any node in the data sharing system receives input information, other nodes in the data sharing system obtain the input information according to the consensus algorithm, and store the input information as data in the shared data, so that the data stored on all nodes in the data sharing system are consistent.

[0051] Each node in the data sharing system has a corresponding node identifier, and each node in the data sharing system can store the node identifiers of other nodes in the data sharing system, so that the generated blocks can be broadcast to other nodes in the data sharing system according to the node identifiers of other nodes. A node identifier list as shown in the following table can be maintained in each node, and the node name and node identifier are stored in the node identifier list accordingly. Among them, the node identifier can be an IP (Internet Protocol, a protocol for interconnecting networks) address and any other information that can be used to identify the node. Table 1 only takes the IP address as an example for illustration.

[0052] Node Name Node ID Node 1 117.114.151.174 Node 2 117.116.189.145 … … Node N 119.123.789.258

[0053] Each node in the data sharing system stores the same blockchain. The blockchain consists of multiple blocks, see Figure 2The blockchain consists of multiple blocks. The genesis block includes a block header and a block body. The block header stores the input information characteristic value, version number, timestamp and difficulty value, and the block body stores the input information; the next block of the genesis block takes the genesis block as the parent block, and the next block also includes a block header and a block body. The block header stores the input information characteristic value of the current block, the block header characteristic value, version number, timestamp and difficulty value of the parent block, and so on, so that the block data stored in each block in the blockchain is associated with the block data stored in the parent block, ensuring the security of the input information in the block.

[0054] When generating each block in the blockchain, see Figure 3 When the node where the blockchain is located receives the input information, it verifies the input information. After the verification is completed, the input information is stored in the memory pool and the hash tree used to record the input information is updated. After that, the update timestamp is updated to the time when the input information is received, and different random numbers are tried to calculate the eigenvalue multiple times so that the calculated eigenvalue can satisfy the following formula:

[0055] SHA256(SHA256(version+prev_hash+merkle_root+ntime+nbits+x)) <TARGET

[0056] Among them, SHA256 is the eigenvalue algorithm used to calculate the eigenvalue; version (version number) is the version information of the relevant block protocol in the blockchain; prev_hash is the block header eigenvalue of the parent block of the current block; merkle_root is the eigenvalue of the input information; ntime is the update time of the update timestamp; nbits is the current difficulty, which is a fixed value within a period of time and is determined again after exceeding the fixed time period; x is a random number; TARGET is the eigenvalue threshold, which can be determined based on nbits.

[0057] In this way, when the random number that satisfies the above formula is calculated, the information can be stored accordingly, the block header and block body can be generated, and the current block can be obtained. Subsequently, the node where the blockchain is located sends the newly generated block to other nodes in the data sharing system according to the node identification of other nodes in the data sharing system. Other nodes verify the newly generated block and add the newly generated block to the blockchain stored in them after the verification is completed.

[0058] Out of Memory, also known as OOM, is a short form of Out of Memory. During the running of a computer program, if the memory requested by a program from the operating system exceeds the available memory allocated to the program by the operating system, it will lead to memory exhaustion, which may cause the program to crash or be forcibly terminated by the operating system. Memory exhaustion is usually caused by program memory leaks, improper program algorithms, or excessive program load.

[0059] In the related art, in order to prevent the occurrence of memory exhaustion anomalies, experienced technicians are usually required to manually judge the possibility of future memory exhaustion anomalies in the blockchain based on the operation data of the block nodes, and then take corresponding intervention measures. Since this method of the related art is too dependent on the personal experience of the technicians, it is difficult for the related art to detect blockchains that are or are about to have memory exhaustion anomalies in a timely and sufficiently accurate manner, and it is also difficult to ensure the stability and security of the blockchain.

[0060] In order to overcome the above-mentioned defects in the related art, the present application provides a memory exhaustion abnormal warning method for blockchain. Figure 4 A flowchart of a memory exhaustion abnormal warning method for blockchain provided by the present application is shown, and the method includes:

[0061] Step S210: injecting abnormal data for triggering a memory exhaustion exception on the blockchain, and during the injection of the abnormal data, collecting first characteristic data for describing the memory resource usage status of the block node;

[0062] Step S220: using the first feature data to train a machine learning model for identifying memory exhaustion anomalies;

[0063] Step S230: During the business operation of the blockchain, second feature data for describing the memory resource usage status of the block node is collected, and the second feature data is input into the machine learning model to obtain a recognition result of the machine learning model;

[0064] Step S240: Based on the recognition result of the machine learning model, a memory exhaustion abnormality warning is issued to the blockchain during business operation.

[0065] In the embodiment of the present application, the execution process of the memory exhaustion abnormal warning method for blockchain mainly includes two stages: an abnormal simulation stage and an abnormal warning stage.

[0066] Among them, the abnormal simulation stage is mainly used to simulate the memory exhaustion abnormality of the blockchain, and then train a machine learning model for identifying memory exhaustion abnormalities based on the memory resource usage of the block nodes during this period. The abnormal warning stage is mainly used during the business operation of the blockchain to apply the trained machine learning model to identify the memory resource usage of the block nodes during this period, and then issue a memory exhaustion abnormal warning to the blockchain based on the identification results.

[0067] Specifically, the abnormal simulation stage further includes the following two stages: abnormal data injection stage and machine learning model training stage.

[0068] Abnormal data injection phase: Generate abnormal data for triggering memory exhaustion exception, and then inject the abnormal data into the blockchain, so that under the effect of the abnormal data, the blockchain will have a memory exhaustion exception. It should be noted that the occurrence of memory exhaustion exception usually requires gradual accumulation. Therefore, after the abnormal data is injected into the blockchain, the blockchain will generally not immediately have a memory exhaustion exception. Usually, the blockchain will have a memory exhaustion exception after a period of continuous injection of abnormal data.

[0069] During the injection of abnormal data, the first feature data used to describe the memory resource usage status of the block node is collected. Since the first feature data is collected during the injection of abnormal data, the first feature data has the characteristics that meet the memory exhaustion anomaly, so the first feature data can be used to train a machine learning model for identifying memory exhaustion anomalies. Among them, the first feature data may specifically include one or more features as follows: memory occupancy change characteristics (for example: memory occupancy peak, memory occupancy fluctuation range, memory occupancy rise and fall speed, etc.), system load characteristics (for example: system CPU usage, system disk usage, system network delay, etc.), system configuration characteristics (for example: system CPU core number, system memory capacity, system disk space size, etc.), program running status characteristics (for example: the number of processes opened by the program, the number of threads opened by the program, the number of files opened by the program, etc.).

[0070] Machine learning model training phase: using the first feature data to train a pre-built machine learning model so that the machine learning can identify memory exhaustion anomalies with a certain degree of accuracy, thereby obtaining a machine learning model for identifying memory exhaustion anomalies.

[0071] During the machine learning model training phase, the machine learning model can be trained using supervised learning or unsupervised learning.

[0072] Furthermore, when using supervised learning, the main training idea is to label the training data, and the labeling result (also called label) is used to describe whether the corresponding training data belongs to the memory exhaustion anomaly. Then the training data is input into the machine learning model, so that the machine learning model judges the category to which each training data belongs, and obtains the recognition result of the machine learning model. Then, according to the deviation between the recognition result and the labeling result of the machine learning model, the parameters of the machine learning model are adjusted, and then the training data is input into the machine learning model again. This cycle is repeated until the deviation between the recognition result and the labeling result of the machine learning model meets the requirements, which indicates that the machine learning model can identify the memory exhaustion anomaly with a certain accuracy.

[0073] When using unsupervised learning, the main training idea is: mix the training data that belongs to the memory exhaustion anomaly with the training data that does not belong to the memory exhaustion anomaly, and then input all the training data into the machine learning model, so that the machine learning model performs K-means clustering on all the training data, so that the machine learning model divides all the training data into two data sets to form a stable data set, which shows that the machine learning model can distinguish the training data that belongs to the memory exhaustion anomaly from the training data that does not belong to the memory exhaustion anomaly, and further shows that the machine learning model can be used to identify memory exhaustion anomalies.

[0074] After training a machine learning model for identifying memory exhaustion anomalies, we can enter the anomaly warning stage and apply the machine learning model to the blockchain during business operation to provide memory exhaustion anomaly warning for the blockchain during business operation.

[0075] Specifically, in the abnormal warning stage: during the business operation of the blockchain, the second characteristic data used to describe the memory resource usage of the block node is collected. Similar to the first characteristic data, the second characteristic data may specifically include one or more characteristics as follows: memory occupancy change characteristics, system load characteristics, system configuration characteristics, and program running status characteristics.

[0076] After collecting the second feature data, the second feature data is input into the machine learning model to obtain a recognition result of the machine learning model.

[0077] It should be noted that during the business operation of the blockchain, if the second characteristic data of a certain block node has the characteristics that meet the memory exhaustion anomaly, even if the block node has not yet experienced the memory exhaustion anomaly, the machine learning model can confirm that the block node has a trend of memory exhaustion based on the second characteristic data of the block node, and then identify the second characteristic data of the block node as belonging to the memory exhaustion anomaly. Therefore, according to the recognition results of the machine learning model, when the block node has a trend of memory exhaustion, it can be timely detected and identified that the block node is about to experience memory exhaustion anomaly, and then the memory exhaustion anomaly warning can be timely and accurately issued, thereby ensuring the stability and security of the blockchain.

[0078] It should be noted that in the blockchain, memory exhaustion exceptions in block nodes are mainly caused by the following reasons: the block node receives a large amount of transaction information; the block node receives blocks with large amounts of information; the block node has a memory overflow; the block node is attacked due to a smart contract vulnerability.

[0079] Therefore, in order to enable the machine learning model to identify at least one of the above abnormal reasons, in one embodiment, the abnormal data includes at least one of the following: abnormal data for simulating large transaction volumes, abnormal data for simulating large blocks, abnormal data for simulating reducing node memory, and abnormal data for simulating smart contract vulnerabilities.

[0080] Specifically, by injecting abnormal data used to simulate a large transaction volume into the blockchain, the first characteristic data has the characteristics that are consistent with the memory exhaustion anomaly caused by receiving a large amount of transaction information, so that the machine learning model trained using the first characteristic data can identify the memory exhaustion anomaly caused by receiving a large amount of transaction information.

[0081] Similarly, by injecting abnormal data used to simulate large blocks into the blockchain, the first characteristic data has the characteristics that are consistent with the memory exhaustion anomaly caused by receiving blocks with a large amount of information, so that the machine learning model trained using the first characteristic data can identify the memory exhaustion anomaly caused by receiving blocks with a large amount of information.

[0082] Similarly, by injecting abnormal data used to simulate the reduction of node memory into the blockchain, the first feature data has the characteristics consistent with the memory exhaustion anomaly caused by memory overflow, so that the machine learning model trained using the first feature data can identify the memory exhaustion anomaly caused by memory overflow.

[0083] Similarly, by injecting abnormal data used to simulate smart contract vulnerabilities on the blockchain, the first feature data has the characteristics that are consistent with the memory exhaustion anomaly caused by attacks due to smart contract vulnerabilities, so that the machine learning model trained using the first feature data can identify the memory exhaustion anomaly caused by attacks due to smart contract vulnerabilities.

[0084] In one embodiment, the abnormal data used to simulate smart contract vulnerabilities includes at least one of the following: abnormal data used to simulate infinite loop attack vulnerabilities, abnormal data used to simulate access out-of-bounds attack vulnerabilities, and abnormal data used to simulate denial of service attack vulnerabilities.

[0085] In this embodiment, considering that the smart contract vulnerabilities in the blockchain mainly include three types: infinite loop attack vulnerabilities, out-of-bounds attack vulnerabilities, and denial of service attack vulnerabilities, three types of abnormal data are generated specifically to fully simulate the smart contract vulnerabilities.

[0086] Specifically, an infinite loop attack refers to an attacker inserting an infinite loop code into a smart contract, causing the block node to keep running and unable to stop, thereby causing a memory exhaustion exception.

[0087] An out-of-bounds attack refers to an attacker accessing an out-of-bounds array or memory space in a smart contract, causing a block node memory overflow and then triggering a memory exhaustion exception.

[0088] A denial of service attack refers to an attacker implementing some functions that take up a lot of computing resources (such as encryption calculation functions, hash calculation functions, etc.) in a smart contract, causing the machine resources of the block node to be exhausted, thereby causing a memory exhaustion exception.

[0089] In one embodiment, the first feature data is used to train a machine learning model for identifying memory exhaustion anomalies, including:

[0090] During the period when no abnormal data is injected, third characteristic data for describing the memory resource usage status of the block node is collected;

[0091] The first feature data marked as abnormal data and the third feature data marked as normal data are used to train a machine learning model in a supervised learning manner.

[0092] In this embodiment, the training data is marked as abnormal data or normal data based on whether it is in the injection period of abnormal data, and then the machine learning model is trained in a supervised learning manner. The machine learning model trained in this way can detect the trend of memory exhaustion of the block node in advance before the memory exhaustion exception occurs.

[0093] Specifically, during the injection of abnormal data, the first characteristic data for describing the memory resource usage of the block node is collected. During the non-injection of abnormal data, the third characteristic data for describing the memory resource usage of the block node is collected.

[0094] Then the first feature data is marked as abnormal data, and the third feature data is marked as normal data. Then the first feature data and the third feature data are input into the machine learning model as training data, so that the machine learning model judges the category to which each training data belongs, and obtains the recognition result of the machine learning model. Then, according to the deviation between the recognition result and the marking result of the machine learning model, the parameters of the machine learning model are adjusted, and then the training data is input into the machine learning model again. This cycle is repeated until the machine learning model can identify the first feature data as abnormal data and the third feature data as normal data with a certain accuracy.

[0095] In one embodiment, the first feature data is used to train a machine learning model for identifying memory exhaustion anomalies, including:

[0096] Comparing the first feature data with a preset feature threshold, and labeling the first feature data according to the comparison result to obtain a label for the first feature data;

[0097] The first feature data and the label of the first feature data are used to train a machine learning model in a supervised learning manner.

[0098] Specifically, considering that in some cases, in the early stage of abnormal data injection, the block node has not yet shown a trend of memory exhaustion, or the trend shown is relatively weak, it is difficult for the machine learning model to stably and accurately detect the memory exhaustion anomaly in the early stage of abnormal data injection, which makes it difficult for the machine learning model training process to converge. Since in the early stage of abnormal data injection, the block node has not yet shown a trend of memory exhaustion, or the trend shown is relatively weak, it means that in the early stage of abnormal data injection, the block node can be regarded as operating normally, and there is no need to be too strict to require that the machine learning model be trained to detect memory exhaustion anomalies in the early stage of abnormal data injection.

[0099] Therefore, in this embodiment, a corresponding characteristic threshold is preset for the memory resource usage of the block node. After the first characteristic data during the injection period of the abnormal data is collected, the first characteristic data is compared with the characteristic threshold. Then, based on the comparison result, part of the first characteristic data is marked as normal data, and the other part of the first characteristic data is marked as abnormal data. Among them, the first characteristic data marked as normal data is the first characteristic data collected in the early stage of the injection of the abnormal data. This part of the first characteristic data has not yet shown a trend of memory exhaustion, or the trend shown is relatively weak; this part of the first characteristic data marked as abnormal data has already clearly shown a trend of memory exhaustion.

[0100] Then, the first feature data is used as training data and input into the machine learning model, so that the machine learning model judges the category to which each training data belongs, and obtains the recognition result of the machine learning model. Then, according to the deviation between the recognition result and the labeling result of the machine learning model, the parameters of the machine learning model are adjusted, and then the training data is input into the machine learning model again. This cycle is repeated until the machine learning model can recognize the first feature data labeled as normal data as normal data and the first feature data labeled as abnormal data as abnormal data with a certain accuracy.

[0101] In this way, this embodiment avoids the overly strict requirement that the machine learning model be trained to be able to detect memory exhaustion anomalies at an early stage of abnormal data injection, thereby reducing the difficulty of convergence in the machine learning model training process.

[0102] In one embodiment, the method provided by the present application further includes:

[0103] When the normal business operation of the block node is blocked by memory exhaustion abnormality, fourth characteristic data for describing the memory resource usage status of the block node is obtained;

[0104] If the degree of blocking of normal business operation is positively correlated with the value of the fourth characteristic data, the characteristic threshold is set to be lower than the minimum value of the fourth characteristic data;

[0105] If the degree of congestion of normal business operation is negatively correlated with the value of the fourth characteristic data, the characteristic threshold is set to be higher than the maximum value of the fourth characteristic data.

[0106] In this embodiment, in order to enable the machine learning model to detect in advance the trend of memory exhaustion of the block node, the business operation of the block node is monitored, and whether the business operation of the block node is normal is detected in real time.

[0107] If the business operation of the block node is detected to be abnormal, indicating that the normal business of the block node is blocked, the characteristic data collected at the corresponding moment to describe the memory resource usage status of the block node is used as the fourth characteristic data. The fourth characteristic data is the characteristic data when the normal business operation is blocked.

[0108] If the degree of blockage of normal business operation is positively correlated with the value of the fourth characteristic data, it means that the larger the value of the fourth characteristic data is, the more serious the degree of blockage of normal business operation is. Then the characteristic threshold used to distinguish normal data from abnormal data is set to be lower than the minimum value of the fourth characteristic data, so that the machine learning model can detect in advance that the block node has a trend of memory exhaustion.

[0109] Similarly, if the degree of blockage of normal business operation is negatively correlated with the value of the fourth characteristic data, it means that the smaller the value of the fourth characteristic data, the more serious the blockage of normal business operation. In this way, the characteristic threshold used to distinguish normal data from abnormal data is set to a value higher than the maximum value of the fourth characteristic data, so that the machine learning model can detect in advance that the block node has a trend of memory exhaustion.

[0110] In one embodiment, the abnormal reasons for the memory exhaustion abnormality include at least two. According to the comparison result, the first feature data is labeled to obtain a label of the first feature data, including:

[0111] According to the comparison result, detecting whether a memory exhaustion exception has been triggered when the first characteristic data is collected;

[0112] If the memory exhaustion exception is triggered when the first characteristic data is collected, the abnormal cause type corresponding to the first characteristic data is detected, and the first characteristic data is marked as abnormal data of the abnormal cause type.

[0113] In this embodiment, the injected abnormal data corresponds to memory exhaustion anomalies caused by various abnormal reasons. In order to enable the machine learning model to detect not only the memory exhaustion anomaly but also the abnormal reason causing the memory exhaustion anomaly, the first feature data is labeled according to the abnormal reason.

[0114] Specifically, the first feature data is compared with a preset feature threshold, and based on the comparison result, it is detected whether a memory exhaustion exception has been triggered when the first feature data is collected.

[0115] If the memory exhaustion exception is not triggered when the first characteristic data is collected, the first characteristic data is marked as normal data.

[0116] If the memory exhaustion exception has been triggered when the first characteristic data is collected, the type of abnormal cause corresponding to the first characteristic data is detected, and then the first characteristic data is marked as abnormal data of the corresponding abnormal cause type. For example: the abnormal data injected into the blockchain is used to simulate a large transaction volume. If the memory exhaustion exception has been triggered when the first characteristic data is collected, the first characteristic data is marked as abnormal data of the large transaction volume type.

[0117] Figure 5 A schematic diagram of the architecture of a memory exhaustion anomaly warning system for blockchain in one embodiment of the present application is shown.

[0118] See also Figure 5 In one embodiment, the architecture of the memory exhaustion anomaly warning system for blockchain mainly includes: OOM anomaly construction layer, OOM anomaly detection layer, data record storage layer, machine learning model training layer, and OOM anomaly warning layer.

[0119] OOM exception construction layer: constructs abnormal data used to simulate triggering OOM exceptions. The simulated OOM exceptions may be caused by large transaction volumes, large blocks, reduced node memory, and smart contract vulnerabilities.

[0120] OOM anomaly detection layer: monitors the memory resource usage of the block node, and then detects whether an OOM anomaly occurs based on the set feature thresholds, and triggers the recording operation. The set feature thresholds include memory usage threshold, memory leak threshold, garbage collection frequency threshold, thread number threshold, etc.

[0121] Data recording storage layer: According to the recording operation triggered by the OOM anomaly detection layer, the detected OOM anomaly information and machine resource information (for example, timestamp, node information, memory usage, etc.) are recorded and then stored in the OOM information library for training machine learning models.

[0122] Machine learning model training layer: Use the recorded OOM exception information and machine resource information to train the machine learning model so that the machine learning model can be used to identify OOM exceptions.

[0123] OOM abnormality warning layer: Deploy the trained machine learning model to the blockchain, and issue OOM abnormality warning to the blockchain during the business operation of the blockchain.

[0124] Figure 6 The detailed flow chart of the memory exhaustion abnormal warning method for blockchain in one embodiment of the present application is shown. Figure 6 In one embodiment, the memory exhaustion anomaly warning method for blockchain mainly includes two modules: OOM anomaly construction module and machine learning model training application module.

[0125] Figure 7 Further shown in one embodiment Figure 6 Schematic diagram of the implementation of the OOM abnormal construction module of the embodiment. Figure 7 In one embodiment, through SDK calls, abnormal data for OOM exceptions caused by large transaction volume, large blocks, and smart contract vulnerabilities are constructed. The memory size of the block node is controlled by the memory size limiter, and abnormal data for OOM exceptions caused by reducing node memory is constructed.

[0126] Specifically, large transaction volume: by creating a large number of transactions and then sending them to the blockchain, abnormal data is constructed to trigger the OOM exception caused by large transaction volume.

[0127] Large blocks: By setting the capacity of a single block to be very large, it can ensure that the block contains a large number of transactions, or the volume of a single transaction can be set to be very large, thereby constructing abnormal data of OOM anomalies caused by large blocks.

[0128] Infinite loop attack in smart contract vulnerability: Insert infinite loop code into the smart contract to construct abnormal data of OOM exception caused by infinite loop attack.

[0129] Out-of-bounds attacks in smart contract vulnerabilities: Accessing out-of-bounds arrays or memory space in smart contracts, thereby constructing abnormal data that causes OOM exceptions due to out-of-bounds attacks.

[0130] Denial of service attacks in smart contract vulnerabilities: Implement some functions that occupy a large amount of computing resources in the smart contract, thereby constructing abnormal data of OOM exceptions caused by denial of service attacks.

[0131] Reduce node memory: simulate memory overflow by simulating insufficient memory on the machine where the block node is located. Specifically, you can set the memory of the machine where the block node is located to a fixed low value to simulate insufficient memory on the machine where the block node is located; you can also use a docker compose file to manage multiple containers, and use the mem_limit parameter in the docker compose file to set the maximum memory limit of each container to simulate insufficient memory on the machine where the block node is located.

[0132] After constructing the abnormal data, the abnormal data is injected into the blockchain, and during the injection of the abnormal data, the OOM abnormal information (including memory occupancy, CPU occupancy, IO load, etc.) is collected through the resource monitoring module.

[0133] Figure 8 Further shown in one embodiment Figure 7Schematic diagram of the implementation of the resource monitoring module of the embodiment. Figure 8 In one embodiment, the resource monitoring module uses the Prometheus system to monitor resources. The Prometheus system is an open source system monitoring and alarm system, and it is the second project hosted in CNCF after k8s. In the Kubernetes container management system, the Prometheus system is usually used for monitoring. It also supports a variety of Exporters to collect data and also supports data reporting. The performance of the Prometheus system is sufficient to support clusters of tens of thousands of units. Among them, Exporter refers to the collection end, which reserves a URL address in the form of HTTP service; the Prometheus Server can obtain the monitoring data that needs to be collected by accessing the endpoint provided by the collection end.

[0134] Specifically, the resource monitoring module exposes the machine resource information of the machine where the block node is located to the Prometheus system through the node collection terminal Node Exporter, and then compares and judges the collected machine resource information with the preset feature thresholds (including memory usage threshold, memory leakage threshold, garbage collection frequency threshold, thread number threshold, etc.).

[0135] If the machine resource information does not trigger the corresponding feature threshold, the OOM exception is constructed and data collection continues. If the machine resource information triggers the corresponding feature threshold, the OOM exception information is obtained, and then the OOM exception information, machine resource information, and log information are recorded and stored.

[0136] The collected data is then processed by the machine learning model training application module. Fig. 9 Further shown in one embodiment Figure 6 Schematic diagram of the implementation of the machine learning model training application module of the embodiment. Fig. 9 In one embodiment, the OOM exception information stored in the OOM information library is cleaned to remove abnormal values ​​in the OOM exception information, and the data is normalized to ensure the accuracy and consistency of the data.

[0137] After data cleaning, feature engineering is performed on the OOM exception information to extract the following feature data: memory usage change characteristics, system load characteristics, system configuration characteristics, program running status characteristics, historical OOM exception record characteristics (for example: the number of OOM exceptions, the interval between OOM exceptions, the system status when the OOM exception occurs, etc.).

[0138] The feature data is then randomly shuffled and divided into 80% training set, 10% validation set, and 10% test set.

[0139] Then the training set is used to iteratively train the machine learning model. During the training process, the parameters of the machine learning model are adjusted and optimized according to the data of the training set to improve the prediction accuracy of the machine learning model. The training process is as follows:

[0140] a. Define the model structure and parameters: Before training the model, you need to define the model structure and parameters.

[0141] b. Initialize model parameters: Before starting training, the model parameters need to be initialized.

[0142] c. Calculate the loss function: The loss function is used to measure the prediction error of the model. During the training process, it is necessary to calculate the error between the predicted value and the true value of each sample, and sum them as the loss function value of the entire training set.

[0143] d. Back propagation: Back propagation refers to the process of updating model parameters according to the gradient of the loss function. During the back propagation process, the model will update the model parameters according to the current parameter values ​​and the gradient of the loss function, so that the loss function value gradually decreases.

[0144] f. Parameter update: Update the model parameters based on the results of back propagation. The update method can use optimization algorithms such as gradient descent.

[0145] e. Iterative training: Repeat the above steps until the model's loss function converges or the preset number of training times is reached.

[0146] g. Model evaluation: Use the validation set to evaluate the trained model. You can calculate the accuracy, precision, recall and other indicators of the model on the validation set to evaluate the performance of the model.

[0147] h. Model parameter adjustment: According to the results of model evaluation, adjust the parameters and structure of the model to improve the prediction performance of the model. The optimal parameter combination can be found through grid search, random search and other methods.

[0148] After training is completed, the machine learning model is applied to the validation set to obtain the prediction results, and the prediction accuracy, recall rate and other indicators are calculated. If the model performance is not good enough, the model parameters can be adjusted. When the OOM anomaly model reaches a certain level, the model can be applied to the test set for evaluation, and the prediction accuracy, recall rate, F1 score and other evaluation indicators can be calculated and compared with the performance of the validation set to ensure that the model has good generalization ability.

[0149] After verification, the machine learning model is deployed to the blockchain. Then the blockchain is monitored during business operation, and feature data used to describe the memory resource usage of the block node during business operation is collected and input into the machine learning model to obtain the prediction results of the machine learning model.

[0150] If the prediction result indicates that there is an OOM anomaly in the block node, an alarm will be issued, and the impending OOM anomaly of the blockchain can be intervened to ensure the stability and security of the blockchain.

[0151] Fig.10 A block diagram of a memory exhaustion abnormal warning device for blockchain according to an embodiment of the present application is shown, and the device includes:

[0152] The abnormal data injection module 310 is configured to inject abnormal data for triggering a memory exhaustion abnormality on the blockchain, and during the injection of the abnormal data, collect first characteristic data for describing the memory resource usage status of the block node;

[0153] The machine learning model training module 320 is configured to use the first feature data to train a machine learning model for identifying memory exhaustion anomalies;

[0154] The machine learning model application module 330 is configured to collect second feature data for describing the memory resource usage status of the block node during the business operation of the blockchain, and input the second feature data into the machine learning model to obtain the recognition result of the machine learning model;

[0155] The abnormal warning module 340 is configured to issue a memory exhaustion abnormal warning to the blockchain during business operation based on the recognition result of the machine learning model.

[0156] In an exemplary embodiment of the present application, the machine learning model training module 320 is configured as follows:

[0157] During the period when no abnormal data is injected, third characteristic data for describing the memory resource usage status of the block node is collected;

[0158] The first feature data marked as abnormal data and the third feature data marked as normal data are used to train a machine learning model in a supervised learning manner.

[0159] In an exemplary embodiment of the present application, the machine learning model training module 320 is configured as follows:

[0160] Comparing the first feature data with a preset feature threshold, and labeling the first feature data according to the comparison result to obtain a label for the first feature data;

[0161] The first feature data and the label of the first feature data are used to train a machine learning model in a supervised learning manner.

[0162] In an exemplary embodiment of the present application, the device is configured as follows:

[0163] When the normal business operation of the block node is blocked by memory exhaustion abnormality, fourth characteristic data for describing the memory resource usage status of the block node is obtained;

[0164] If the degree of blocking of normal business operation is positively correlated with the value of the fourth characteristic data, the characteristic threshold is set to be lower than the minimum value of the fourth characteristic data;

[0165] If the degree of congestion of normal business operation is negatively correlated with the value of the fourth characteristic data, the characteristic threshold is set to be higher than the maximum value of the fourth characteristic data.

[0166] In an exemplary embodiment of the present application, the abnormal causes of the memory exhaustion abnormality include at least two; the machine learning module training module 320 is configured as follows:

[0167] According to the comparison result, detecting whether a memory exhaustion exception has been triggered when the first characteristic data is collected;

[0168] If the memory exhaustion exception is triggered when the first characteristic data is collected, the abnormal cause type corresponding to the first characteristic data is detected, and the first characteristic data is marked as abnormal data of the abnormal cause type.

[0169] In an exemplary embodiment of the present application, the abnormal data includes at least one of the following: abnormal data for simulating large transaction volumes, abnormal data for simulating large blocks, abnormal data for simulating reduction of node memory, and abnormal data for simulating smart contract vulnerabilities.

[0170] In an exemplary embodiment of the present application, the abnormal data used to simulate smart contract vulnerabilities include at least one of the following: abnormal data used to simulate infinite loop attack vulnerabilities, abnormal data used to simulate access out-of-bounds attack vulnerabilities, and abnormal data used to simulate denial of service attack vulnerabilities.

[0171] Reference below Fig.11 The electronic device 40 according to an embodiment of the present application is described. Fig.11 The electronic device 40 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0172] like Fig.11As shown, the electronic device 40 is in the form of a general computing device. The components of the electronic device 40 may include, but are not limited to: at least one processing unit 410, at least one storage unit 420, and a bus 430 connecting different system components (including the storage unit 420 and the processing unit 410).

[0173] The storage unit 420 stores program codes, which can be executed by the processing unit 410, so that the processing unit 410 performs the steps according to various exemplary embodiments of the present invention described in the description of the exemplary method described above in this specification. For example, the processing unit 410 can perform the following steps: Figure 4 The steps shown in .

[0174] The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 4201 and / or a cache storage unit 4202 , and may further include a read-only storage unit (ROM) 4203 .

[0175] The storage unit 420 may also include a program / utility 4204 having a set (at least one) of program modules 4205, such program modules 4205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0176] Bus 430 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0177] The electronic device 40 may also communicate with one or more external devices 500 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 40, and / or communicate with any device that enables the electronic device 40 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 450. The input / output (I / O) interface 450 is connected to a display unit 440. In addition, the electronic device 40 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 460. As shown, the network adapter 460 communicates with other modules of the electronic device 40 via a bus 430. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 40, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0178] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0179] In an exemplary embodiment of the present application, a computer-readable storage medium is further provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer executes the method described in the above method embodiment.

[0180] According to one embodiment of the present application, a program product for implementing the method in the above method embodiment is also provided, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited to this. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0181] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0182] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0183] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0184] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as JAVA, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0185] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0186] In addition, although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0187] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0188] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the appended claims.

Claims

1. A memory exhaustion abnormal warning method for blockchain, characterized in that: The method comprises: Injecting abnormal data for triggering a memory exhaustion exception on the blockchain, and during the injection of the abnormal data, collecting first characteristic data for describing the memory resource usage status of the block node; Using the first feature data, training a machine learning model for identifying the memory exhaustion anomaly; During the business operation of the blockchain, second feature data for describing the memory resource usage status of the block node is collected, and the second feature data is input into the machine learning model to obtain a recognition result of the machine learning model; Based on the recognition result of the machine learning model, a memory exhaustion abnormality warning is issued to the blockchain during business operation.

2. The method according to claim 1, characterized in that The first feature data is used to train a machine learning model for identifying the memory exhaustion anomaly, including: During the period when the abnormal data is not injected, collecting third characteristic data for describing the memory resource usage status of the block node; The machine learning model is trained by using the first feature data marked as abnormal data and the third feature data marked as normal data in a supervised learning manner.

3. The method according to claim 1, characterized in that The first feature data is used to train a machine learning model for identifying the memory exhaustion anomaly, including: Comparing the first feature data with a preset feature threshold, and labeling the first feature data according to the comparison result to obtain a label for the first feature data; The machine learning model is trained by using the first feature data and the label of the first feature data in a supervised learning manner.

4. The method according to claim 3, characterized in that The method further comprises: When the normal business operation of the block node is blocked by the memory exhaustion exception, obtaining fourth characteristic data for describing the memory resource usage status of the block node; If the degree of blockage of normal business operation is positively correlated with the value of the fourth characteristic data, setting the characteristic threshold to be lower than the minimum value of the fourth characteristic data; If the degree of congestion of normal business operation is negatively correlated with the value of the fourth characteristic data, the characteristic threshold is set to be higher than the maximum value of the fourth characteristic data.

5. The method according to claim 3, characterized in that: The abnormal reasons for the memory exhaustion abnormality include at least two. According to the comparison result, the first feature data is labeled to obtain a label of the first feature data, including: According to the comparison result, detecting whether the memory exhaustion exception has been triggered when the first characteristic data is collected; If the memory exhaustion exception is triggered when the first characteristic data is collected, the abnormal cause type corresponding to the first characteristic data is detected, and the first characteristic data is marked as abnormal data of the abnormal cause type.

6. The method according to claim 1, characterized in that The abnormal data includes at least one of the following: abnormal data for simulating large transaction volumes, abnormal data for simulating large blocks, abnormal data for simulating reduction of node memory, and abnormal data for simulating smart contract vulnerabilities.

7. The method according to claim 6, characterized in that The abnormal data used to simulate smart contract vulnerabilities includes at least one of the following: abnormal data used to simulate infinite loop attack vulnerabilities, abnormal data used to simulate access out-of-bounds attack vulnerabilities, and abnormal data used to simulate denial of service attack vulnerabilities.

8. A memory exhaustion abnormal warning device for blockchain, characterized in that: The device comprises: An abnormal data injection module is configured to inject abnormal data for triggering a memory exhaustion exception on the blockchain, and during the injection of the abnormal data, collect first characteristic data for describing the memory resource usage status of the block node; a machine learning model training module, configured to use the first feature data to train a machine learning model for identifying the memory exhaustion anomaly; A machine learning model application module is configured to collect second feature data used to describe the memory resource usage status of the block node during the business operation of the blockchain, and input the second feature data into the machine learning model to obtain a recognition result of the machine learning model; The abnormal warning module is configured to provide a memory exhaustion abnormality warning for the blockchain during business operation based on the recognition result of the machine learning model.

9. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the electronic device to implement the method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored thereon, and when the computer-readable instructions are executed by a processor of a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

Images