Transaction processing method and device based on block chain, equipment, medium and product

Abstract

The embodiment of the invention discloses a transaction processing method and device based on a block chain, equipment, a medium and a product. The method comprises the steps of obtaining transaction data of a to-be-processed transaction in a block chain network; performing feature extraction on the transaction data of the to-be-processed transaction according to an attack detection model deployed in the block chain network to obtain a target feature of the transaction data of the to-be-processed transaction; the attack detection model is obtained by training attack features obtained by performing feature extraction on the abnormal transaction data; and matching the target feature with the attack feature to obtain a matching result, and if the matching result indicates that the target feature is related to the attack feature, carrying out transaction interception on the to-be-processed transaction. The technical scheme of the embodiment of the invention does not need to consume a large amount of time and computing resources for detection, can effectively and timely prevent transaction attacks in the block chain, and improves the security and reliability of the block chain network.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and specifically, to a blockchain-based transaction processing method, a blockchain-based transaction processing device, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] In the blockchain network, a blockchain attack refers to a malicious attack on the blockchain network with the purpose of destroying the security, integrity or availability of the blockchain, or illegally obtaining benefits. At present, the prevention method of blockchain attacks usually requires the detection of all transactions, such as checking whether the transaction has been broadcasted before and whether the transaction contains sufficient information such as handling fees.

[0003] However, current blockchain attack prevention methods have some limitations; first, these methods require a lot of time and computing resources to detect and verify transactions, which will lead to a decrease in transaction processing speed, especially in the case of large transaction volumes; second, blockchain attacks can often bypass general detection methods to attack, making it impossible to detect blockchain attacks, resulting in the security of the blockchain network being affected. Summary of the invention

[0004] The embodiments of the present application provide a blockchain-based transaction processing method, a blockchain-based transaction processing device, an electronic device, a computer-readable storage medium, and a computer program product, which do not require a large amount of time and computing resources to detect, and can effectively and timely prevent the occurrence of transaction attacks in the blockchain, thereby improving the security and reliability of the blockchain network.

[0005] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0006] According to one aspect of an embodiment of the present application, a blockchain-based transaction processing method is provided, including: obtaining transaction data of a transaction to be processed in a blockchain network; performing feature extraction on the transaction data of the transaction to be processed according to an attack detection model deployed on the blockchain network to obtain a target feature of the transaction data of the transaction to be processed; the attack detection model is trained based on an attack feature obtained by extracting features from abnormal transaction data; matching the target feature with the attack feature to obtain a matching result; if the matching result indicates that the target feature is related to the attack feature, intercepting the transaction to be processed.

[0007] According to one aspect of an embodiment of the present application, a blockchain-based transaction processing device is provided, including: an acquisition module, used to acquire transaction data of a pending transaction in a blockchain network; a detection module, used to extract features of the transaction data of the pending transaction according to an attack detection model deployed on the blockchain network, to obtain target features of the transaction data of the pending transaction; the attack detection model is trained based on attack features obtained by extracting features from abnormal transaction data; a matching module, used to match the target features with the attack features to obtain a matching result; and an interception module, used to intercept the pending transaction if the matching result indicates that the target features are related to the attack features.

[0008] In one embodiment of the present application, the device also includes a training module, which is used to obtain normal transactions and multiple types of attack transactions, and obtain transaction data of the normal transactions and transaction data of the attack transactions; determine the abnormal transaction data based on the correlation between the transaction data of multiple attack transactions, and the difference between the transaction data of the normal transactions and the transaction data of the attack transactions; extract features from the abnormal transaction data to obtain the attack features; train the training model based on the attack features to obtain the attack detection model.

[0009] In one embodiment of the present application, the training module is further used to generate the abnormal transaction data based on the data content of the transaction data of the attack transactions if the similarity between the data content of the transaction data of multiple attack transactions is greater than a preset similarity threshold; if the similarity between the data content of the transaction data of multiple attack transactions is less than the preset similarity threshold, obtain the usage frequency of the data content of the transaction data of each attack transaction; when there is a correlation between the usage frequencies of the data content of the transaction data of multiple attack transactions, generate the abnormal transaction data based on the data content of the transaction data of the attack transactions and the usage frequency of the data content.

[0010] In one embodiment of the present application, the training module is further used to obtain first attribute information corresponding to the transaction data of the normal transaction within a preset time, and second attribute information corresponding to the transaction data of the attack transaction within a preset time; calculate the difference attribute information between the first attribute information and the second attribute information; if the difference attribute information is greater than a preset difference information threshold, generate the abnormal transaction data according to the second attribute information and the difference attribute information.

[0011] In one embodiment of the present application, the training module is further used to extract key data from the abnormal transaction data if the abnormal transaction data is text data, and generate basic attack features based on the key data; if the abnormal transaction data is numerical data, extract periodic data from the abnormal transaction data, and generate the basic attack features based on the periodic data; combine multiple different basic attack features to obtain a combined attack feature, and obtain the attack feature based on the basic attack feature and the combined attack feature.

[0012] In one embodiment of the present application, the training module is further used to train the model to be trained according to the attack characteristics to obtain an initial attack detection model; obtain verification transaction data; detect the verification transaction data according to the initial attack detection model to obtain a detection result; construct a loss function according to the detection result and the expected result of the verification transaction data, and optimize the model parameters of the initial attack detection model based on the loss function to obtain the attack detection model.

[0013] In one embodiment of the present application, the training module is further used to perform data amplification based on the verification transaction data to obtain new abnormal transaction data if the difference between the expected result and the detection result is greater than a preset difference threshold; perform feature extraction on the new abnormal transaction data to obtain new attack features; retrain the initial attack detection model according to the attack features, and optimize the model parameters of the retrained initial attack detection model based on the loss function to obtain the attack detection model.

[0014] In one embodiment of the present application, the training module is further used to optimize the transaction data of the attack transaction based on the verification transaction data to add the transaction data of the new attack transaction to obtain the first amplified data; obtain the second amplified data based on the difference between the verification transaction data and the transaction data of the normal transaction; and generate the new abnormal transaction data based on the first amplified data and the second amplified data.

[0015] In an embodiment of the present application, the device further includes an updating module, which is used to update the attack detection model according to the target feature if the target feature is different from the attack feature.

[0016] In one embodiment of the present application, the device also includes a processing module, which is used to obtain the transaction scenario of the transaction to be processed, and the correspondence between the preset transaction scenario and the defense strategy; determine the defense strategy for the transaction to be processed based on the transaction scenario of the transaction to be processed and the correspondence; and process the transaction to be processed according to the defense strategy of the transaction to be processed.

[0017] In one embodiment of the present application, the processing module is further used to prevent the pending transaction from being uploaded to the chain if the transaction scenario of the pending transaction is the first transaction scenario, and to disclose the private key used to sign the pending transaction to other blockchain nodes; if the transaction scenario of the pending transaction is the second transaction scenario, the security factor of the participant of the pending transaction is obtained according to the historical operations of the participant of the pending transaction, wherein the scenario level of the second transaction scenario is lower than the scenario level of the first transaction scenario; when the security factor of the participant of the pending transaction is less than the preset security factor, multiple signatures are requested from the participant of the pending transaction.

[0018] According to one aspect of an embodiment of the present application, an embodiment of the present application provides an electronic device, comprising one or more processors; a storage device for storing one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the electronic device implements the blockchain-based transaction processing method as described above.

[0019] According to one aspect of an embodiment of the present application, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor of an electronic device, the electronic device executes the blockchain-based transaction processing method as described above.

[0020] According to one aspect of an embodiment of the present application, an embodiment of the present application provides a computer program product, including a computer program, wherein the computer program is stored in a computer-readable storage medium, and a processor of an electronic device reads and executes the computer program from the computer-readable storage medium, so that the electronic device performs the blockchain-based transaction processing method as described above.

[0021] In the technical solution provided in the embodiments of the present application, after obtaining the transaction data of the pending transaction in the blockchain network, feature extraction is performed on the transaction data of the pending transaction according to the deployed attack detection model, and the attack detection model is trained based on the attack features obtained by feature extraction of abnormal transaction data, so that the attack detection model can automatically and accurately extract the target features of the transaction data of the pending transaction, and then match the target features with the attack features to obtain a matching result. If the matching result indicates that the target features are related to the attack features, it means that the transaction data of the pending transaction is related to the abnormal transaction data, and then the pending transaction is intercepted. There is no need to spend a lot of time and computing resources for detection, and the detection of the attack detection model can effectively and timely prevent the occurrence of transaction attacks in the blockchain, thereby improving the security and reliability of the blockchain network.

[0022] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0024] Figure 1 It is a schematic diagram of the structure of the blockchain network;

[0025] Figure 2 It is a schematic diagram of the connection relationship between blocks in the blockchain;

[0026] Figure 3 It is a schematic diagram of an implementation environment involved in this application;

[0027] Figure 4 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0028] Figure 5 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0029] Figure 6 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0030] Figure 7 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0031] Figure 8 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0032] Fig. 9 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0033] Fig.10 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0034] Fig.11 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0035] Fig.12 is a flow chart of a transaction processing method shown in an exemplary embodiment of the present application;

[0036] Fig.13 is a flow chart of another transaction processing method shown in an exemplary embodiment of the present application;

[0037] Fig.14 is a flow chart of a transaction processing method shown in an exemplary embodiment of the present application;

[0038] Fig.15 is a schematic diagram of a transaction processing network architecture layer shown in another exemplary embodiment of the present application;

[0039] Fig.16 is a flow chart of a transaction processing method shown in an exemplary embodiment of the present application;

[0040] Fig.17 It is a schematic diagram of the generation process of a double-spending attack detection model shown in an exemplary embodiment of the present application;

[0041] Fig.18 is a structural block diagram of a transaction processing device shown in an exemplary embodiment of the present application;

[0042] Fig.19 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0043] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0044] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0045] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all contents and operations, nor must they be executed in the order described. For example, some operations may be decomposed, while some operations may be combined or partially combined, so the actual execution order may change according to actual conditions.

[0046] It should also be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0047] The technical solution of the embodiment of the present application relates to the field of blockchain technology. Before introducing the technical solution of the embodiment of the present application, a brief introduction to blockchain technology is first given.

[0048] Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks (i.e. blocks) generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0049] As mentioned above, blockchain is essentially a decentralized database, and the blockchain is maintained by the nodes in the blockchain network. Figure 1 ,exist Figure 1 The blockchain network shown may include multiple nodes 101, and the multiple nodes 101 may be various servers and clients forming the blockchain network. Each node 101 may receive input information during normal operation, and maintain the shared data in the blockchain network based on the received input information. In order to ensure the information intercommunication within the blockchain network, there may be an information connection between each node in the blockchain network, and the nodes may transmit information through the above information connection. For example, when any node in the blockchain network receives input information, other nodes in the blockchain network obtain the input information according to the consensus algorithm, and store the input information as shared data, so that the data stored on all nodes in the blockchain network are consistent.

[0050] Each node in the blockchain network has a corresponding node identifier, and each node in the blockchain network can store the node identifiers of other nodes, so that the generated blocks can be broadcast to other nodes in the blockchain network according to the node identifiers of other nodes. A node identifier list can be maintained in each node, and the node name and node identifier are stored in the node identifier list accordingly. The node identifier can be an IP (Internet Protocol, a protocol for interconnecting networks) address or any other information that can be used to identify the node.

[0051] It is understandable that each node in the blockchain network can be a server or a client. The server can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and intelligent platforms. The client can be a smart phone, a tablet computer, a laptop, a desktop computer, a smart speaker, a smart watch, a client used in a car, an aircraft, etc., but is not limited to this. Each node can be directly or indirectly connected by wired or wireless communication, and this application is not limited here.

[0052] See also Figure 2 The blockchain consists of multiple blocks. The genesis block includes a block header and a block body. The block header stores input information feature values, version numbers, timestamps, and difficulty values, and the block body stores input information. The next block of the genesis block uses the genesis block as its parent block. The next block also includes a block header and a block body. The block header stores the input information feature values ​​of the current block, the block header feature values, version numbers, timestamps, and difficulty values ​​of the parent block, and so on. This ensures that the block data stored in each block in the blockchain is associated with the block data stored in the parent block, thereby ensuring the security of the input information in the block.

[0053] It is understandable that each node in the blockchain network can be a server or a client. The server can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and intelligent platforms. The client can be a smart phone, a tablet computer, a laptop, a desktop computer, a smart speaker, a smart watch, a client used in a car, an aircraft, etc., but is not limited to this. Each node can be directly or indirectly connected by wired or wireless communication, and this application is not limited here.

[0054] The technical solution of the embodiment of the present application specifically relates to blockchain technology. The technical solution of the embodiment of the present application is described in detail below:

[0055] See also Figure 3 , Figure 3 1 is a schematic diagram of an implementation environment involved in the present application. The implementation environment includes a blockchain node 101, a transaction party 301 and a service party 302 in a blockchain network.

[0056] Among them, the transaction party 301 is the initiator of the transaction behavior, and sends the transaction corresponding to the transaction behavior to the blockchain node 101.

[0057] The service provider 302 is the output provider of the attack detection model, and is used to deploy the attack detection model in the blockchain node, wherein the attack detection model is trained based on the attack features obtained by extracting features from abnormal transaction data.

[0058] Blockchain node 101 is a transaction processor, used to process pending transactions. Specifically, the transaction data of pending transactions in the blockchain network is obtained, and feature extraction is performed on the transaction data of pending transactions according to the deployed attack detection model; the target feature is matched with the attack feature to obtain a matching result, and if the matching result indicates that the target feature is related to the attack feature, the pending transaction is intercepted to prevent the pending transaction from attacking the blockchain network.

[0059] In one example, the blockchain node can also be the output party of the attack detection model, that is, the attack detection model is obtained by training the blockchain node based on the attack features obtained by extracting features from abnormal transaction data.

[0060] Among them, the aforementioned transaction party 301 can be any electronic device that can obtain the target video and the image to be processed, such as a smart phone, a tablet, a laptop computer, a computer, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, etc. The service party 302 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network) and big data and artificial intelligence platforms. There is no restriction on this here.

[0061] It should be noted that in the specific implementation of the present application, the transaction data of the transaction to be processed involves object-related. When the embodiment of the present application is applied to a specific product or technology, it is necessary to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0062] The following is a detailed description of various implementation details of the technical solution of the embodiment of the present application:

[0063] like Figure 4 As shown, Figure 4 is a flowchart of a transaction processing method based on blockchain shown in an embodiment of the present application, which can be applied to Figure 3 In the implementation environment shown, the method may be executed by a blockchain node. The transaction processing method based on blockchain may include S410 to S440, which are described in detail as follows:

[0064] S410: Obtain transaction data of pending transactions in the blockchain network.

[0065] In the embodiment of the present application, the pending transaction is sent by the transaction party to the blockchain network, wherein the number of pending transactions can be one or more, which is not limited here. The blockchain node can obtain the transaction data related to the pending transaction, which refers to the data generated by the transaction behavior, and the transaction behavior is the process of the pending transaction in the blockchain network. Therefore, the transaction data includes all data related to the pending transaction, for example, the transaction data of the pending transaction includes transaction information, such as transaction time, transaction resource volume, etc. The transaction data also includes block data, such as block height, block production time, etc. The transaction data also includes transaction object data, and relevant data of the transaction initiator and the transaction recipient.

[0066] In one example, a blockchain node may extract transaction data of a pending transaction from blocks to be uploaded to the blockchain sent by other blockchain nodes; a blockchain node may also directly receive pending transactions carrying transaction data sent by a transaction initiator to the blockchain network.

[0067] S420. Extract features of the transaction data of the transaction to be processed according to the attack detection model deployed in the blockchain network to obtain target features of the transaction data of the transaction to be processed; the attack detection model is trained based on the attack features obtained by extracting features from the abnormal transaction data.

[0068] In an embodiment of the present application, the attack detection model is a trained model, which is deployed in each blockchain node in the blockchain network, and is used to extract features from the transaction data of the pending transactions in the blockchain network to obtain target features, and then detect whether the pending transactions have attack characteristics based on the target features, which is not conducive to the normal operation of the blockchain network.

[0069] The attack detection model is trained based on attack features, which are obtained by extracting features from abnormal transaction data; the abnormal transaction data refers to transaction data that is equivalent to normal transaction data but has abnormalities, such as transaction data with attack features; in one example, the abnormal transaction data can be extracted from historical transaction data; the abnormal transaction data can also be extracted from simulated transaction data; and then feature extraction is performed on the abnormal transaction data to obtain attack features, i.e., features with attack characteristics.

[0070] In one example of the present application, the transaction data of the transaction to be processed can be input into an attack detection model, and the attack detection model extracts features from the transaction data of the transaction to be processed to obtain target features, so as to detect whether the transaction data is abnormal transaction data, and further determine whether the transaction to be processed is a normal transaction.

[0071] S430: Match the target feature with the attack feature to obtain a matching result.

[0072] In an embodiment of the present application, the blockchain node may match the target feature output by the attack detection model with the attack feature to obtain a matching result; or the attack detection model may extract the target feature from the transaction data of the transaction to be processed, and then match the target feature with the attack feature to output a matching result.

[0073] In one example, the matching result includes that the target feature is related to the attack feature, which may be that the target feature is similar to the attack feature, such as the similarity is greater than a preset similarity threshold; or that the target feature and the attack feature have some of the same features; or that the target feature and the attack feature are associated, such as if the target feature is A and the attack feature is B, and target feature A is associated with feature C, and attack feature B is associated with feature C, then target feature A and attack feature B are associated, etc.; the matching result also includes that the target feature is not related to the attack feature, that is, the target feature and the attack feature are not similar or the similarity is lower than a preset similarity threshold, do not contain the same features or are not associated.

[0074] In one example, a distance between the target feature and the attack feature, such as a cosine distance, may be calculated to determine the similarity between the target feature and the attack feature.

[0075] S440: If the matching result indicates that the target feature is related to the attack feature, the transaction to be processed is intercepted.

[0076] If the matching result indicates that the target feature is related to the attack feature, it means that the transaction data of the pending transaction may be abnormal transaction data. In order to ensure the normal operation of the blockchain network, it is necessary to intercept the pending transaction. Transaction interception means interrupting or canceling the processing of the pending transaction, such as not processing the pending transaction.

[0077] In one example, after the transaction to be processed is intercepted, the transaction to be processed may be further inspected to determine whether to reject the transaction to be processed.

[0078] In one example, after intercepting the pending transaction, an interception message for the pending transaction may be sent to other blockchain nodes in the blockchain network so that other blockchain network nodes do not process the pending transaction for the time being.

[0079] In an embodiment of the present application, after obtaining the transaction data of the pending transaction in the blockchain network, feature extraction is performed on the transaction data of the pending transaction according to the deployed attack detection model, and the attack detection model is trained based on the attack features obtained by feature extraction of abnormal transaction data, so that the attack detection model can automatically and accurately extract the target features of the transaction data of the pending transaction, and then match the target features with the attack features to obtain a matching result. If the matching result indicates that the target features are related to the attack features, the transaction to be processed is intercepted, thereby effectively and timely preventing the occurrence of blockchain attacks, thereby improving the security and reliability of the blockchain network.

[0080] In one embodiment of the present application, another blockchain-based transaction processing method is provided, which can be applied to Figure 3 In the implementation environment shown, the method can be executed by a blockchain node or by a blockchain node and a service provider. Taking the blockchain node execution as an example, Figure 5 As shown in FIG. 1 , the transaction processing method based on blockchain is Figure 4 On the basis of S410 to S440 shown in , a training process of the attack detection model is added before S420 or S410, including steps S510 to S540; wherein S510 to S540 are described in detail as follows:

[0081] S510: Acquire normal transactions and multiple types of attack transactions, and acquire transaction data of the normal transactions and transaction data of the attack transactions.

[0082] In an embodiment of the present application, the normal transactions and attack transactions obtained can be simulated, that is, virtual real transactions, in which normal transactions and various types of attack transactions are simulated; the normal transactions and attack transactions obtained can also be real historical normal transactions and historical attack transactions in the blockchain network; normal transactions refer to transactions that will not affect the normal operation of the blockchain network and will not cause unfair transactions to other transaction parties; attack transactions refer to transactions that will attack the blockchain network to affect the security and trust of the blockchain; among them, attack transactions include various types, such as transactions that initiate double payment attacks, transactions that launch 51% attacks, transactions that confirm transaction speed attacks, etc.

[0083] It is worth noting that the normal transactions and various types of attack transactions obtained carry transaction labels, which are used to distinguish the types of transactions, such as the transaction label of normal transactions is normal, and the transaction label of attack transactions is abnormal. The specific transaction labels vary according to the type of attack, that is, different types of attack transactions have different transaction labels, such as the transaction label of the attack transaction of 51% attack is 51% abnormal, and the transaction label of the attack transaction that initiates a double payment attack is payment abnormal, etc.; it can be understood that the expression form of the transaction labels of normal transactions and attack transactions can be flexibly adjusted according to actual needs.

[0084] In an embodiment of the present application, the simulated normal transaction and the simulated attack transaction can be simulated and sent to the blockchain network to obtain the transaction data of the modeled normal transaction and the transaction data of the simulated attack transaction, wherein the transaction data of the normal transaction and the transaction data of the attack transaction may include transaction information, block data, and transaction object data, etc.; and the corresponding transaction data of the real historical normal transaction and the historical attack transaction can be directly extracted from the blockchain network.

[0085] S520: Determine abnormal transaction data according to the correlation between the transaction data of multiple attack transactions and the difference between the transaction data of normal transactions and the transaction data of attack transactions.

[0086] It should be noted that if there is correlation between attack transactions, then there is also correlation between the transaction data of multiple attack transactions. The correlation can be similarity or contain the same regularity. Therefore, the transaction data of multiple attack transactions can be compared and analyzed to determine the same or similar data between the transaction data, or data with the same regularity, so as to determine abnormal transaction data. Among them, multiple attack transactions can be multiple attack transactions of the same type, or multiple attack transactions of different types.

[0087] There must be differences between normal transactions and attack transactions. The transaction data of normal transactions and attack transactions can be compared and analyzed to determine the different data, and the abnormal transaction data can be determined based on the different data.

[0088] In one example, abnormal transaction data can also be determined based on first data corresponding to the correlation between transaction data of multiple attack transactions and second data corresponding to the difference between transaction data of normal transactions and transaction data of attack transactions. For example, the first data corresponding to the correlation and the second data corresponding to the difference are further matched. If there is similar or identical data between the first data and the second data, the similar or identical data is used as abnormal transaction data.

[0089] S530: Extract features from abnormal transaction data to obtain attack features.

[0090] In an embodiment of the present application, feature extraction is performed on abnormal transaction data to obtain attack features, wherein the feature extraction process may be performed by convolutional neural network extraction, or by one-hot encoding to extract text data from the abnormal transaction data, or by standardization, regularization, and normalization to extract numerical data from the abnormal transaction data, which is not limited here.

[0091] S540: Train the model to be trained according to the attack features to obtain an attack detection model.

[0092] The attack features and transaction labels are input into the model to be trained. The model to be trained learns the association between the input features and the corresponding transaction labels to learn the patterns and rules for distinguishing normal transactions from attack transactions.

[0093] In one example, after extracting features from abnormal transaction data to obtain attack features through the model to be trained, the model to be trained learns the association between the input features and the corresponding labels to train the model to be trained and obtain an attack detection model.

[0094] In one example, the model to be trained can be a classification model, such as a decision tree, support vector machine, logistic regression, etc. In another example, the model to be trained can also be an anomaly detection model, such as an isolation forest, and a suitable model can be selected according to the specific situation; wherein, in the process of model training, techniques such as cross-validation and parameter tuning can be used to improve model performance and generalization ability. It can be understood that the goal of training a model is to use the input feature data to build a classifier or regression model so that when given new unknown data, it can predict whether the data belongs to an attack transaction.

[0095] It should be noted that Figure 5 For more detailed information about S410 to S440, see Figure 4 S410 to S440 shown are not described in detail here.

[0096] In an embodiment of the present application, based on the correlation between the transaction data of multiple attack transactions and the difference between the transaction data of normal transactions and the transaction data of attack transactions, abnormal transaction data with attack characteristics is determined, and then the to-be-trained model is trained with the extracted features, so that the to-be-trained model can learn to distinguish the patterns and rules of normal transactions and attack transactions, thereby ensuring the accuracy and reliability of the attack detection model.

[0097] The present application embodiment provides another transaction processing method based on blockchain, which can be applied to Figure 3 In the implementation environment shown, the method can be executed by a blockchain node or by a blockchain node and a service provider. Taking the blockchain node execution as an example, Figure 6 As shown in FIG. 1 , the transaction processing method based on blockchain is Figure 5 Based on the basis shown in Figure 5 The S520 shown in the figure is expanded to S610 to S640. S610 to S640 are described in detail as follows:

[0098] S610: If the similarity between the data contents of the transaction data of the multiple attack transactions is greater than a preset similarity threshold, abnormal transaction data is generated according to the data contents of the transaction data of the attack transactions.

[0099] In an embodiment of the present application, the transaction data of each attack transaction corresponds to data content. For example, if the transaction data is a transaction address, the data content is specific address information. Among them, the transaction data of each attack transaction may correspond to multiple data contents, for example, the transaction address includes 3 different specific address information.

[0100] If the similarity between the data contents of the transaction data of multiple attack transactions is greater than a preset similarity threshold, it means that the data contents are correlated, and abnormal transaction data is generated based on the correlated data contents; wherein the data contents of the transaction data of multiple attack transactions may be one or more data contents of the transaction contents of multiple different attack transactions.

[0101] In one example, the data content of the transaction data of the attack transaction may be directly used as the abnormal transaction data, or similar or common content in the data content of the transaction data may be used as the abnormal transaction data.

[0102] For example, the data content of transaction data 1 of attack transaction A is transaction address x, and the data content of transaction data 1 of attack transaction B is transaction address y. Transaction address x and transaction address y contain most of the same information, such as the same region where the addresses are located, that is, the similarity is greater than the preset similarity threshold, then transaction address x and transaction address y are regarded as abnormal transaction data.

[0103] S620: If the similarity between the data contents of the transaction data of multiple attack transactions is less than a preset similarity threshold, obtain the usage frequency of the data content of the transaction data of each attack transaction.

[0104] In an embodiment of the present application, if the similarity between the data contents of the transaction data of multiple attack transactions is less than a preset similarity threshold, it is necessary to further determine the usage of the data content of the transaction data to determine whether the usage of the data content is regular. Therefore, the usage frequency of the data content of the transaction data of multiple attack transactions is obtained. The usage frequency of the data content of the transaction data can be calculated based on the usage time and number of usage of the transaction data of the simulated attack transactions.

[0105] S630: When there is a correlation between the usage frequencies of the data contents of the transaction data of the multiple attack transactions, generate abnormal transaction data based on the data contents of the transaction data of the attack transactions and the usage frequencies of the data contents.

[0106] The usage frequencies of the data contents of the transaction data of multiple attack transactions are correlated with each other. The usage frequencies may be the same or similar, such as the usage frequency of transaction address x is once every 30 seconds, and the usage frequency of transaction address y is once every 31 seconds, and the transaction frequencies are similar. Alternatively, the usage frequencies satisfy a certain law, such as the usage frequencies satisfy an arithmetic interval, the usage frequency of transaction address x is k1, the usage frequency of transaction address y is k2, and the usage frequency of transaction address z is k3, and k2-k1=k3-k2.

[0107] There is a correlation between the usage frequencies of the data content of the transaction data of multiple attack transactions, which means that they may be sent out regularly by the machine and are not sent out normally. Therefore, abnormal transaction data can be generated based on the data content of the transaction data and the usage frequency of the data content, such as taking the transaction address x used once every 30 seconds and the transaction address y used once every 31 seconds as abnormal transaction data.

[0108] S640: Determine abnormal transaction data according to the difference between the transaction data of the normal transaction and the transaction data of the attack transaction.

[0109] For details, please see Figure 7 The embodiment shown.

[0110] It should be noted that Figure 6For detailed description of S410~S440, S510, S530~S540 shown in Figure 5 S410~S440, S510, S530~S540 shown are not repeated here.

[0111] In an embodiment of the present application, when the similarity between the data contents of the transaction data of multiple attack transactions is greater than a preset similarity threshold, the correlation is represented by the data contents of the transaction data of the attack transactions, thereby generating abnormal transaction data. When the similarity is less than the preset similarity threshold, the correlation can be represented by the association between the usage frequencies of the data contents, thereby making the generated abnormal transaction data more comprehensive.

[0112] The present application also provides another blockchain-based transaction processing method, which can be applied to Figure 3 In the implementation environment shown, the method can be executed by a blockchain node, or by a blockchain node and a service provider. Taking the blockchain node as an example, in the embodiment of the present application, the method is described by taking the server as an example. Figure 7 As shown, in Figure 5 Based on the basis shown in Figure 5 The S520 shown in the figure is expanded to S710 to S740. Among them, S710 to S740 are described in detail as follows:

[0113] S710: Obtain first attribute information corresponding to transaction data of normal transactions within a preset time, and second attribute information corresponding to transaction data of attack transactions within a preset time.

[0114] In an embodiment of the present application, the transaction data of normal transactions and the transaction data of attack transactions include transaction time, and the corresponding first attribute information and second attribute information within the preset time include the transaction time interval within the preset time; the transaction data includes the transaction resource amount, and the first attribute information and the second attribute information include the total amount of transaction resources within the preset time; the transaction data includes the number of transactions, and the first attribute information and the second attribute information include the transaction frequency within the preset time; the first attribute information and the second attribute information also include the transaction confirmation number, and the transaction confirmation number refers to the number of attack transactions in an unconfirmed state.

[0115] S720: Calculate difference attribute information between the first attribute information and the second attribute information.

[0116] The first attribute information and the second attribute information can be compared to calculate difference attribute information to reflect the difference between normal transactions and attack transactions; where the first attribute information includes multiple types of attribute information and the second attribute information includes multiple types of attribute information, it is necessary to compare the attribute information of the same type to calculate the difference attribute information.

[0117] S730: If the difference attribute information is greater than a preset difference information threshold, abnormal transaction data is generated according to the second attribute information and the difference attribute information.

[0118] In the embodiment of the present application, the attack transaction is usually a multiple transaction within a period of time, that is, the transaction time interval is shorter than the transaction time interval of the normal transaction. If the difference between the transaction time interval of the first attribute information and the transaction time interval of the second attribute information is greater than the preset difference time interval, it means that the attack transaction corresponding to the second attribute information is an abnormal transaction; for example, the time difference between each normal transaction and the previous normal transaction is calculated, and these time differences are counted, and the average time interval, minimum time interval and maximum time interval of normal transactions can be calculated. If the time interval of a transaction is far from the average time interval and exceeds the range of the maximum or minimum time interval, the transaction data can be regarded as abnormal transaction data.

[0119] Similarly, the difference between the total amount of transaction resources, the difference between the transaction frequencies, and the difference between the transaction confirmation numbers are compared with the corresponding thresholds respectively. If the difference is greater than the threshold, abnormal transaction data is generated according to the second attribute information and the difference attribute information.

[0120] In one example, the abnormal transaction data is generated according to the second attribute information and the difference attribute information, and the second attribute information and the difference attribute information are associated, and the abnormal transaction data is generated from the associated information.

[0121] In one example, the upper limit of the second attribute information can be amplified according to the difference attribute information, and the amplified second attribute information can be used as abnormal transaction data. For example, if the second attribute information is transaction time interval A, and the difference time interval is b, the transaction time interval (0, Ab) is used as abnormal transaction data.

[0122] S740: Determine abnormal transaction data according to the correlation between transaction data of multiple attack transactions.

[0123] For details, please see Figure 6 shown.

[0124] It should be noted that Figure 7 For more detailed information about S410~S440, S510, S530~S540, see Figure 5S410~S440, S510, S530~S540 shown in the figure are not repeated here.

[0125] In the embodiment of the present application, the difference between the first transaction attribute of the normal transaction and the second transaction attribute of the attack transaction is used to represent the difference, and then the abnormal transaction data is generated to ensure the reliability and comprehensiveness of the abnormal transaction data.

[0126] In one embodiment of the present application, another transaction processing method based on blockchain is also provided. The transaction processing method based on blockchain can be applied to Figure 3 In the implementation environment shown, the method can be executed by a blockchain node or by a blockchain node and a service provider. Taking the blockchain node execution as an example, Figure 8 As shown in FIG. 1 , the transaction processing method based on blockchain is Figure 5 Based on the above, S530 is expanded to S810~S830. S810~S830 are described in detail as follows:

[0127] S810: If the abnormal transaction data is text data, extract key data from the abnormal transaction data, and generate basic attack features based on the key data.

[0128] In an embodiment of the present application, the abnormal transaction data includes text data (such as transaction address) and numerical data (transaction time interval). If the abnormal transaction data is text data, it is necessary to perform key data extraction on the text data to filter out useless information in the text-type abnormal transaction data, and then generate basic attack features based on the key data, so that the basic attack features can more accurately reflect the transaction data of the attack transaction.

[0129] In one example, key data extraction of abnormal transaction data may be performed to extract data of valid semantic information contained in the abnormal transaction data, such as a specific region, a specific street, and the like.

[0130] In one example, key data extraction from abnormal transaction data may be performed by extracting data that is common among multiple abnormal transaction data of the same type, such as extracting the same country or region from transaction addresses x and y.

[0131] In an embodiment of the present application, basic attack features are generated based on key information, and the key information can be input into a text model, such as word2vector, to obtain the basic attack features.

[0132] S820: If the abnormal transaction data is numerical data, extract periodic data from the abnormal transaction data, and generate basic attack features based on the periodic data.

[0133] In an embodiment of the present application, if the abnormal transaction data is numerical data, it is necessary to extract periodic data from the abnormal transaction data and determine the regularity of the abnormal transaction data through the periodic data, wherein the periodic data refers to the periodicity between numerical data, such as a transaction time interval of once per minute.

[0134] In one example, to extract periodic data from abnormal transaction data, methods such as Fourier transform can be used to analyze the periodic components of transaction time series data; through spectrum analysis, the main period of the transaction time series can be extracted, such as one day, one week or one month.

[0135] In one example, basic attack features are generated based on periodic data, which may be performed by converting continuous numerical data into discrete categorical features through discretization, or by converting periodic data into a series of binary features or categorical features through one-hot encoding or binary encoding.

[0136] S830. Combining a plurality of different basic attack features to obtain a combined attack feature, and obtaining an attack feature based on the basic attack feature and the combined attack feature.

[0137] In an embodiment of the present application, a plurality of different basic attack features are combined, and the basic attack features corresponding to text data may be combined, the basic attack features corresponding to numerical data may be combined, or the basic attack features corresponding to text data and the basic attack features corresponding to numerical data may be combined to obtain a combined attack feature.

[0138] In one example, the basic attack feature and the combined attack feature may be used as the attack feature.

[0139] It should be noted that Figure 8 For more detailed information about S410~S440, S510~S520, and S540 shown in Figure 5 S410~S440, S510~S520, and S540 shown are not repeated here.

[0140] In the embodiment of the present application, different extraction methods are used for text-based and numerical-based abnormal transaction data, so that the extracted content can more accurately represent the abnormal characteristics. After the features are extracted, the obtained attack features are made more reliable and richer through feature combination.

[0141] It is worth noting that in one embodiment of the present application, another transaction processing method based on blockchain is also provided. The transaction processing method based on blockchain can be applied to Figure 3In the implementation environment shown, the method can be executed by a blockchain node or by a blockchain node and a service provider. Taking the blockchain node execution as an example, Fig. 9 As shown in FIG. 1 , the transaction processing method based on blockchain is Figure 5 Based on the information shown in , S540 is expanded to include S910 to S940. S910 to S940 are described in detail as follows:

[0142] S910: Train the model to be trained according to the attack features to obtain an initial attack detection model.

[0143] In an embodiment of the present application, attack features and transaction labels are input into a model to be trained, and the model to be trained learns the characteristics of the attack features by learning the relationship between the attack features and the transaction labels, so as to learn the patterns and rules for distinguishing normal transactions from attack transactions, and obtain an initial attack detection model.

[0144] S920: Obtain verification transaction data.

[0145] In order to ensure that the trained model can accurately detect attack transactions, the initial attack detection model needs to be verified. First, the verification transaction data is obtained. The verification transaction data includes normal transactions and attack transactions, that is, the verification transaction data also carries verification labels, and normal transactions and attack transactions are distinguished by verification labels.

[0146] S930: Detect the verification transaction data according to the initial attack detection model to obtain a detection result.

[0147] The verification transaction data is input into the initial attack detection model, the initial attack detection model extracts features from the verification transaction data, and detects the verification transaction data based on the extracted features to obtain a detection result, which includes a normal transaction or an attack transaction.

[0148] S940: construct a loss function according to the detection result and the expected result of the verification transaction data, and optimize the model parameters of the initial attack detection model based on the loss function to obtain the attack detection model.

[0149] In an embodiment of the present application, the verification transaction data corresponds to an expected result, which is the verification tag of the verification transaction data. The detection result and the expected result of the initial detection model can be used to determine whether the initial attack detection model can accurately detect. If the detection result and the expected result are different, it means that the initial attack detection model needs to be optimized. A loss function is constructed based on the detection combination and the expected result, and the model parameters of the initial attack detection model are optimized based on the loss function to bring the initial attack detection model closer to the detection result and the expected result. When the initial attack detection model converges, the attack detection model is optimized.

[0150] In one example, the loss function is a cross entropy loss function or a log loss function.

[0151] It should be noted that Fig. 9 For more detailed information about S410~S440 and S510~S530 shown in Figure 5 S410~S440 and S510~S530 shown are not described in detail here.

[0152] In an embodiment of the present application, after the initial attack detection model is trained, the initial attack detection model is verified and a loss function is constructed to optimize the initial attack detection model, so that the detection of the trained attack detection model is more accurate.

[0153] In one embodiment of the present application, another transaction processing method based on blockchain is also provided. The transaction processing method based on blockchain can be applied to Figure 3 In the implementation environment shown, the method can be executed by a blockchain node or by a blockchain node and a service provider. Taking the blockchain node execution as an example, Fig.10 As shown in FIG. 1 , the transaction processing method based on blockchain is Fig. 9 Based on the information shown in , S940 is expanded to S1010 to S1030. S1010 to S1030 are described in detail as follows:

[0154] S1010: If the difference between the expected result and the detection result is greater than a preset difference threshold, data amplification is performed based on the verification transaction data to obtain new abnormal transaction data.

[0155] If the difference between the expected result and the detection result is greater than the preset difference threshold, it means that the detection is inaccurate. In the embodiment of the present application, on the one hand, the initial attack detection model can be optimized by the constructed loss function, and on the other hand, the attack features for training the initial attack detection model can be amplified to enrich the training samples. Therefore, it is necessary to first perform data amplification based on the verified transaction data to obtain new abnormal transaction data, so that the new abnormal transaction data can more comprehensively reflect the attack characteristics related to the verified transaction data.

[0156] In one example, data augmentation is performed based on the verified transaction data, and the verified transaction data and transaction data similar to the verified transaction data may be used as new abnormal transaction data.

[0157] S1020. Extract features from the new abnormal transaction data to obtain new attack features.

[0158] In the embodiment of the present application, feature extraction is performed on the new abnormal transaction data. The extraction method can be found in Figure 8 , I will not go into details here.

[0159] S1030. Retrain the initial attack detection model according to the new attack features, and optimize the model parameters of the retrained initial attack detection model based on the loss function to obtain the attack detection model.

[0160] In an embodiment of the present application, the initial attack detection model is retrained according to the new attack features, that is, the new attack detection model is input into the initial attack detection model so that the initial attack detection model learns the attack characteristics corresponding to the new attack features, and at the same time, the model of the retrained initial attack detection model is optimized based on the constructed loss function to obtain the attack detection model.

[0161] It should be noted that Fig.10 For more detailed information about S410~S440, S510~S530, S910~S930, see Fig. 9 S410 to S440, S510 to S530, and S910 to S930 shown are not described in detail here.

[0162] In the embodiment of the present application, not only is the initial attack detection model optimized through the loss function, but the transaction data of the attack transaction is also amplified to enrich the attack features for training the model, thereby improving the reliability of the model training and further ensuring the accuracy of the model detection.

[0163] In one embodiment of the present application, another transaction processing method based on blockchain is also provided. The transaction processing method based on blockchain can be applied to Figure 3 In the implementation environment shown, the method can be executed by a blockchain node or by a blockchain node and a service provider. Taking the blockchain node execution as an example, Fig.11 As shown in FIG. 1 , the transaction processing method based on blockchain is Fig.10 Based on the figure shown in , S1010 is expanded to S1110 to S1130. Among them, S1110 to S1130 are described in detail as follows:

[0164] S1110: If the difference between the expected result and the detection result is greater than a preset difference threshold, the transaction data of the attack transaction is optimized based on the verification transaction data to add the transaction data of the new attack transaction to obtain first amplified data.

[0165] In an embodiment of the present application, the transaction data of the attack transaction can be optimized based on the verification transaction data, such as adding transaction data of a new attack transaction based on the transaction data of the attack transaction, where the transaction data of the new attack transaction includes transaction data of an attack transaction that is similar or related to the verification transaction data, and then obtaining the first amplified data based on the transaction data of the attack transaction and the transaction data of the new attack transaction.

[0166] S1120. Obtain second amplified data based on the difference between the verification transaction data and the transaction data of the normal transaction.

[0167] In the embodiment of the present application, in addition to adding the transaction data of the new attack transaction, the verification transaction data can also be analyzed to extract data in the verification transaction data that can reflect the characteristics of the attack transaction. The verification transaction data can be matched with the transaction data of the normal transaction to obtain the second amplified data according to the different transaction data.

[0168] S1130. Generate new abnormal transaction data based on the first amplified data and the second amplified data.

[0169] In one example, the first amplified data and the second amplified data may be directly used as new abnormal transaction data.

[0170] In one example, the first amplified data and the second amplified data may be screened to screen out key data, and the key data may be used as new abnormal transaction data; wherein the key data may be data included in both the first amplified data and the second amplified data.

[0171] It should be noted that Fig.11 For more detailed information about S410~S440, S510~S530, S910~S930, S1020~S1030, please refer to Fig.10 S410-S440, S510-S530, S910-S930, S1020-S1030 shown are not described in detail here.

[0172] In an embodiment of the present application, on the one hand, the transaction data of the attack transaction is optimized by verifying the transaction data, and on the other hand, second amplified data is obtained based on the difference between the verified transaction data and the transaction data of the normal transaction, so that the amplified new abnormal transaction data is more comprehensive, accurate and rich.

[0173] In one embodiment of the present application, another transaction processing method based on blockchain is also provided. The transaction processing method based on blockchain can be applied to Figure 3 In the implementation environment shown, the method can be executed by a blockchain node, such as Fig.12 As shown in FIG. 1 , the transaction processing method based on blockchain is Figure 4 Based on the above, S1210 is added after S440. S1210 is described in detail as follows:

[0174] S1210: If the target feature is different from the simulated attack feature, the attack detection model is updated according to the target feature.

[0175] In the embodiment of the present application, the target feature is different from the attack feature, which means that the target feature is not exactly the same as the attack feature, that is, there are features in the target feature that are different from the attack feature. The different features can be regarded as features that the attack detection model cannot detect whether they are attack characteristics. In order to make the attack detection model adapt to attack transactions with different attack characteristics, the attack detection model is updated according to the target feature, that is, the target feature is used as a training sample to enable the attack detection model to learn the characteristics in the target feature.

[0176] In one example, the attack detection model is updated only if the target feature is different from the attack feature and the different feature accounts for a preset proportion of the target feature, such as the different feature accounts for 50% or more of the target feature.

[0177] It should be noted that Fig.12 For more detailed information about S410 to S440, see Figure 4 S410 to S440 shown are not described in detail here.

[0178] In an embodiment of the present application, when the target feature is different from the attack feature, the attack detection model is updated according to the target feature. The attack detection model can be continuously updated to adapt to different attack transactions, thereby improving the accuracy of attack detection and defense.

[0179] The present application embodiment provides another transaction processing method based on blockchain, which can be applied to Figure 3 In the implementation environment shown, the method can be executed by a blockchain node, such as Fig.13 As shown in FIG. 1 , the transaction processing method based on blockchain is Figures 4 to 12 On the basis of S440, S1310 to S1330 are added after S440. S1310 to S1330 are described in detail as follows:

[0180] S1310: Obtain the transaction scenario of the transaction to be processed, and the corresponding relationship between the preset transaction scenario and the defense strategy.

[0181] In an embodiment of the present application, a correspondence between transaction scenarios and defense strategies is preset, and the correspondence includes at least two transaction scenarios and defense strategies corresponding to at least two transaction scenarios; wherein the scenario levels of the transaction scenarios in the correspondence are different, and the higher the scenario level, the more important the transaction involved in the transaction scenario. Similarly, the strictness of the defense strategy corresponding to the transaction scenario is also different, and the higher the scenario level, the stricter the defense strategy.

[0182] In one example, transaction scenarios include but are not limited to large-amount transaction scenarios, short-time transaction scenarios, etc.; defense strategies include but are not limited to transaction rejection, limiting transaction volume, limiting transaction time, etc. It is understandable that transaction scenarios and corresponding defense strategies can be flexibly adjusted according to actual conditions.

[0183] In one example, the transaction scenario of the pending transaction can be determined based on the transaction data of the pending transaction, such as determining whether it is a short-term transaction scenario or a large-amount transaction scenario based on the transaction time or transaction volume of the transaction data. If the transaction scenario also includes individual transactions and combined transactions, the transaction scenario of the pending transaction can also be determined based on the transaction initiator and transaction recipient of the pending transaction.

[0184] S1320: Determine a defense strategy for the pending transaction based on the transaction scenario and the corresponding relationship of the pending transaction.

[0185] In an embodiment of the present application, the transaction scenario of the transaction to be processed can be compared with the preset transaction scenario in the corresponding relationship to determine the defense strategy corresponding to the matching preset transaction scenario, and then obtain the defense strategy for the transaction to be processed.

[0186] In one example, if the transaction to be processed is matched with the preset transaction scenarios in the corresponding relationship and two preset transaction scenarios are matched, the defense strategy corresponding to the scenario with the highest scenario level in the two preset transaction scenarios is determined as the defense strategy for the transaction to be processed.

[0187] In one example, if the preset transaction scenario in the corresponding relationship is not matched, the defense strategy corresponding to the scenario most similar to the preset transaction scenario can be used as the defense strategy for the pending transaction. Or the corresponding relationship also includes a default scenario and a defense strategy corresponding to the default scenario, the default scenario is an unrecognized scenario, and the defense strategy corresponding to the default scenario is to reject the transaction. In this case, if the preset transaction scenario in the corresponding relationship is not matched, the defense strategy corresponding to the default scenario is used as the defense strategy for the pending transaction.

[0188] S1330. Process the transaction to be processed according to the defense strategy of the transaction to be processed.

[0189] In the embodiment of the present application, the pending transaction is processed according to the defense strategy of the pending transaction, such as rejecting the transaction, limiting the transaction time, etc. In one example, after the pending transaction is processed, the management party related to the transaction can also be notified so that the management party can observe the subsequent operations of the pending transaction.

[0190] It should be noted that Fig.13 For more detailed information about S410 to S440, see Figure 4S410 to S440 shown are not described in detail here.

[0191] In the embodiment of the present application, different defense strategies are used to process the transactions to be processed according to different transaction scenarios of the transactions to be processed, so as to ensure the rationality of the processing of the transactions to be processed and avoid false positives and false negatives.

[0192] The present application embodiment provides another transaction processing method based on blockchain, which can be applied to Figure 1 In the implementation environment shown, the method can be executed by a blockchain node, such as Fig.14 As shown in FIG. 1 , the transaction processing method based on blockchain is Fig.13 Based on the results shown in Fig.13 The S1330 shown is expanded to S1410 to S1430. S1410 to S1430 are described in detail as follows:

[0193] S1410. If the transaction scenario of the pending transaction is the first transaction scenario, the pending transaction is prevented from being uploaded to the chain, and the private key used to sign the pending transaction is disclosed to other blockchain nodes.

[0194] In the embodiment of the present application, the corresponding relationship includes a first transaction scenario, which has the highest scenario level; if the transaction scenario in which the pending transaction is located is the first transaction scenario, the corresponding defense strategy is to prevent the pending transaction from being put on the chain, that is, to reject the pending transaction, and disclose the private key used to sign the pending transaction to other blockchain nodes, so that the pending transaction cannot be put on the chain through other blockchain nodes, and there is a situation where the transaction initiator of the pending transaction loses transaction resources. For example, when the transaction initiator of the pending transaction goes on the chain through other blockchain nodes, the other blockchain nodes reject the transaction and confiscate the transaction resources according to the private key of the transaction initiator of the pending transaction.

[0195] S1420. If the transaction scenario of the pending transaction is the second transaction scenario, obtain the safety factor of the participant of the pending transaction according to the historical operation of the participant of the pending transaction, wherein the scenario level of the second transaction scenario is lower than the scenario level of the first transaction scenario.

[0196] In the embodiment of the present application, the scenario level of the second transaction scenario is lower than the scenario level of the first transaction scenario. If the transaction scenario of the pending transaction is the second transaction scenario, it is necessary to further determine whether the participants of the pending transaction are credible participants before performing corresponding processing. It is necessary to first determine the safety factor of the participants of the pending transaction based on the historical operations of the participants of the pending transaction, and characterize the credibility of the participants through the safety factor of the participants of the pending transaction; wherein, the participants of the pending transaction include the transaction initiator, the transaction receiver, and the blockchain node that transmits or broadcasts the pending transaction.

[0197] In one example, the safety factor of the party to be processed is determined based on the historical operations of the party to be processed. The safety factor of the party to be processed can be determined based on information such as the transaction frequency, transaction scale, transaction time and location of the party to be processed, wherein the closer the transaction frequency, transaction scale, transaction time and location are to normal transactions, the higher the safety factor of the party; the safety factor of the party can also be determined based on the evaluation and feedback of other parties to the party, and the higher the evaluation and the more positive the feedback, the higher the safety factor of the party.

[0198] S1430. When the security factor of the party to the pending transaction is less than the preset security factor, request multiple signatures from the party to the pending transaction.

[0199] In the embodiment of the present application, multi-signature is a mechanism that requires the participants of the transaction to provide multiple signatures to complete the transaction confirmation; it is necessary to designate several participants in the transaction as signatories and stipulate the number of signatures required. This ensures that multiple independent participants confirm and authorize the transaction before the transaction is completed, increasing the security and credibility of the transaction. When the security factor of any participant in the pending transaction is less than the preset security factor, it means that the participant in the pending transaction is not trustworthy, and it is necessary to request multiple signatures from all participants in the pending transaction.

[0200] In one example, if multiple signatures are requested, the pending transaction is processed on the chain; if multiple signatures are not requested, the pending transaction is prevented from being processed on the chain.

[0201] It should be noted that Fig.14 For detailed description of S410~S440 and S1310~S1320 shown in Fig.13 S410~S440 and S1310~S1320 shown in the figure are not repeated here.

[0202] In the embodiment of the present application, for the first transaction scenario with a high scenario level, the pending transaction is prevented from being uploaded to the chain, and the private key used to sign the pending transaction is disclosed to other blockchain nodes, so that the pending transaction cannot be uploaded to the chain through other blockchain nodes; for the second transaction scenario with a slightly lower scenario level, the accuracy and reliability of detection are further improved through the security factor of the participants and multiple signatures.

[0203] For ease of understanding, the present application embodiment also provides a network architecture layer for transaction processing, taking the attack as a double-spending attack as an example for explanation, such as Fig.15 As shown, it includes detection and alarm layer, machine learning layer, data collection layer and double flower construction layer, among which:

[0204] like Fig.16 As shown in the figure, the double-spending construction layer simulates various double-spending attacks, such as 51% attack, launching double payment attack, confirming transaction speed attack, and double-spending transaction rollback attack; injects the blockchain network through the double-spending attack to simulate the attack on the blockchain network; collects the relevant data of the double-spending attack, and stores the data of the double-spending attack construction layer into the relevant database through the data collection layer, such as transaction data (transaction amount of the attacker, transaction time, etc.), block data (block height, transaction hash, transaction status, etc.), network data (attacker's IP, transaction broadcast information, etc.) and other related data are recorded in the database, the data stored in the database is cleaned, the collected data is cleaned and pre-processed, and then the data is divided into training set, verification set test set, etc. The machine learning layer converts the data in the training set into the required features through the feature extraction method, and then uses the machine learning algorithm to train the model for the features of the training set, evaluates and tunes it through the verification set, and obtains the double-spending attack detection model, and deploys the trained double-spending attack detection model to the blockchain system, and uses it in the actual double-spending attack detection. The performance indicators of the model are further optimized and improved to improve the accuracy and robustness of the model.

[0205] Among them, a transaction detection module is added to the blockchain system. This module detects whether the transaction is a double-spending attack transaction when a transaction occurs. When a new transaction is received, the transaction data is used as the model input, and the machine learning model is used for detection to output the result.

[0206] Among them, a double-spending attack refers to an attack in which an attacker exploits the distributed nature of the blockchain and attempts to spend the same encrypted resource twice. For example, an attacker attempts to send two or more identical transactions within a time window in the blockchain network and make one of the transactions confirmed by the network as quickly as possible, thereby controlling the consensus of the blockchain network. The attacker then sends another transaction to other nodes and attempts to make the other transaction recognized by the network before the previous transaction is confirmed, so as to send the same encrypted resource payment to different recipients and achieve the purpose of double payment.

[0207] For double-spending attack transactions, they may be multiple transactions conducted within a period of time. The corresponding characteristics of double-spending attack transactions include transaction time intervals, especially short transaction time intervals. Therefore, the characteristics also include transaction frequency. The frequency between transactions may have certain rules or patterns. In order to avoid being identified by the blockchain network, attackers will use multiple addresses to initiate transactions, or attackers will send multiple transactions to one or more addresses among multiple addresses. There are similar or common characteristics between multiple addresses, such as the frequency of use of the addresses and the country or region where the addresses are located. Therefore, the corresponding characteristics of double-spending attack transactions also include transaction sending addresses and transaction receiving addresses.

[0208] Double-spending attacks require the attacker to bear certain costs and risks, such as paying higher resource fees. Therefore, the corresponding characteristics of double-spending attack transactions also include the transaction amount.

[0209] In addition, attackers may attempt to use blockchain transactions to send to an unconfirmed state to conduct a double-spending attack, that is, they need to send multiple identical transactions as quickly as possible before the transaction is confirmed, and use computing power or network delays to speed up the transaction confirmation. Therefore, the corresponding characteristics of double-spending attack transactions include transaction confirmation speed and the number of transaction confirmations.

[0210] An attacker may try to revoke one of the transactions within a certain period of time so that the blockchain network only accepts one of the transactions and regards the other transaction as invalid. This can be achieved by sending information about the revoked transaction in the network or by colluding with miner nodes. Therefore, revocable transactions are also a feature corresponding to double-spending attack transactions.

[0211] An attacker may forge the signature of a transaction to make it appear legitimate and pass verification by network nodes, so a false signature is also a characteristic of a double-spending attack transaction.

[0212] The double-spending attack detection model has learned the features of the above-mentioned double-spending attack transactions during the training phase; after receiving a new transaction, the transaction data of the new transaction is extracted and input into the double-spending attack detection model. The transaction data includes the transaction address, transaction amount, transaction signature, transaction time interval initiated by the object to which the transaction belongs, transaction frequency, etc. The double-spending attack detection model extracts the features of the corresponding transaction data and scores the input transaction data based on the learned double-spending attack mode and feature weights. The score can indicate the probability or degree of suspicion that the transaction may be a double-spending attack.

[0213] Among them, the extracted features are matched with the features corresponding to the learned double-spending attack pattern. If the correlation between the extracted features and the learned features is greater than the preset correlation, the extracted features are used as candidate features. It can be understood that when performing feature matching, the extracted features can also be combined, and the combined features are then matched with the learned features to obtain subsequent feature combinations.

[0214] After obtaining the candidate features and candidate feature combinations, the weights of various types of candidate features and candidate feature combinations are obtained. The weight represents the importance of each feature in determining whether a transaction is a double-spending attack. The weight is learned by the model during the training phase based on the double-spending attack sample transaction data. For example, the weights of the features corresponding to the transaction time interval and transaction confirmation speed are greater than the weights of the features corresponding to the transaction address and transaction amount.

[0215] According to the feature weights, the candidate features and candidate feature combinations are weighted so that more important features will have a greater impact on the final score, while less important features will contribute less to the score. Finally, the weighted features are processed through the logistic regression network layer of the double-spending attack detection model to obtain the score, and transactions with scores higher than the threshold are marked as double-spending attack transactions, while transactions with scores lower than the threshold are regarded as normal transactions.

[0216] After detecting a double-spending attack transaction, the attack is intercepted, that is, the corresponding transaction is intercepted, and corresponding defensive measures are taken to avoid the occurrence of double-spending attack transactions, such as considering limiting the transaction amount, limiting the transaction time, etc.; after detecting a double-spending attack transaction and defending it, the relevant information of the double-spending attack is recorded in the database, such as recording relevant information, including the time of the attack, the address of the attacker, the amount of the attack, etc., to facilitate subsequent data analysis and system optimization, and automatically send alarm information to notify management personnel to prevent further occurrence of double-spending attack transactions.

[0217] If there is no abnormality in the transaction, it is considered a normal transaction and will be uploaded to the chain normally. The entire process is automated.

[0218] Here, the generation process of the double-spending attack detection model is described in detail. Fig.17 As shown, including:

[0219] S1701, data collection: simulate double-spending attack transactions, collect all relevant transaction data of double-spending attack transactions through the data collection layer, and obtain relevant transaction data of normal transactions, as shown below:

[0220] Transaction data: including transaction initiator, transaction recipient, transaction amount, transaction time, etc.

[0221] Block data: block height, block hash value, block generation time, etc.

[0222] Network data: communication records between nodes, data transmission time, transmission protocol, etc.

[0223] Object data: identity information of the transaction initiator and recipient, historical transaction records, etc.

[0224] System data: blockchain system version, node configuration information, system logs, etc.

[0225] S1702. Preliminary data cleaning: The collected information is preliminarily cleaned. First, preliminary cleaning is performed, such as removing invalid data (such as marking whether the data is valid first, 0 represents invalid, 1 represents valid, filtering invalid data and updating the data). Invalid data includes addresses that cannot be identified or verified, such as incorrect address formats, non-existent addresses or cancelled addresses; invalid data also includes amount fields containing illegal or invalid values, such as negative numbers, non-numeric characters, etc.; filling missing values ​​(such as filling missing values ​​with 0); processing outliers (such as replacing outliers with the median of multiple normal values) and other operations to ensure data quality.

[0226] S1703. Deep data cleaning: After preliminary cleaning of transaction data, interactive data exploration and analysis are conducted. For example, data visualization tools are used to explore and analyze the data, summarize the relationships and patterns of double-spending abnormal transaction data, and provide a basis for subsequent feature engineering. For example, correlation coefficient matrices, scatter plots, heat maps and other tools can be used to visualize the correlation between transaction data.

[0227] Among them, the distribution map of transaction amount, the trend map of transaction time, the heat map of transaction address, etc. can be drawn, and the drawn ones can be clustered and analyzed to show the correlation and outliers between transaction data; for example, abnormal fluctuation of transaction amount, that is, the transaction amount of double-spending attack transaction is larger than that of normal transaction; for example, abnormal concentration of transaction address, the transaction address of normal transaction is hashed, while the transaction address of double-spending attack transaction is similar and concentrated in one area; for example, abnormal concentration of transaction time, in order to realize double-spending attack, the transaction time interval is short, and the transaction time in a short time is more concentrated; therefore, through the drawn graph, the potential rules and relationships of double-spending abnormal data can be revealed, so as to extract transaction data with double-spending attack characteristics.

[0228] After the initial cleaning of the transaction data, descriptive statistical analysis can also be performed on the transaction data, such as by calculating the mean, variance, maximum, minimum, etc. of the transaction confirmation speed, the number of revocable transactions, and the transaction frequency of normal transactions and double-spending attack transactions respectively. By comparing the mean, variance, maximum, and minimum values ​​of normal transactions and double-spending attack transactions, the difference between double-spending attack transactions and normal transactions can be determined, thereby extracting transaction data with double-spending attack characteristics.

[0229] After the initial cleaning of the transaction data, the transaction data can also be analyzed for association rules to extract the correlation between the transaction data, such as which transaction data appear frequently, or when a certain transaction data appears, the probability of another transaction data appearing is higher. Among them, the transaction data needs to be converted first, and the transaction data needs to be converted into a format suitable for the correlation, such as splitting the transaction time field into date and time and standardizing it, encoding the text data, etc.; setting the support threshold and confidence threshold, the support is used to indicate the probability of a certain transaction data appearing in all transaction data, and the confidence indicates the reliability of the transaction data association, that is, the probability of another transaction data appearing when one transaction data appears. According to the set support threshold and the support of each transaction data, the frequent transaction data is determined from all transaction data, and the transaction data combination that often appears at the same time is found from the frequent transaction data, so as to determine the association relationship of the transaction data combination, so as to calculate the confidence of the transaction data combination, and based on the confidence threshold and the confidence of the transaction data combination, the transaction data with correlation is found, and then the transaction data with double-spending attack characteristics is extracted based on the frequent transaction data and the transaction data combination.

[0230] S1704, Feature Engineering: Based on the data processing results, extract the transaction data with double-spending attack characteristics, perform feature extraction, convert and combine the extracted features, and generate a machine learning feature set. Combined with the characteristics of double-spending attack transactions, the following characteristics are summarized:

[0231] Transaction time interval: An attacker may try to make multiple transactions within a period of time, so that the same cryptographic resources are used in multiple transactions at the same time. Therefore, the transaction time interval can be a feature of double-spending attack transactions.

[0232] Transaction amount: Attackers usually try to send a large amount of encrypted resources in a short period of time to achieve a double-spending attack. Therefore, the transaction amount can also be a feature of the double-spending attack transaction.

[0233] Sending address: An attacker may use multiple addresses to conduct double-spending attack transactions. These addresses may have some similarities or common features, such as the country or region where the address is located, the frequency of use of the address, etc.

[0234] Receiving address: The attacker may send encrypted resources to one or more addresses among multiple addresses. These addresses may have some similarities or common characteristics, such as the country or region where the address is located, the frequency of use of the address, etc.

[0235] Transaction frequency: An attacker may attempt to make multiple transactions in a short period of time, and the frequency of these transactions may have certain regularities or patterns.

[0236] Transaction confirmation number: Attackers may try to exploit the unconfirmed state of blockchain transactions to perform double-spending attacks. Therefore, the transaction confirmation number can be a feature of double-spending attack transactions.

[0237] The above-mentioned transaction time interval, transaction amount, sending address, receiving address, transaction frequency and transaction confirmation number can be used as transaction data with double-spending attack characteristics.

[0238] S1705, model training and optimization: Use machine learning algorithms to generate a double-spending attack detection model by training the feature set, and optimize the model based on evaluation indicators to improve the accuracy and robustness of the model. When training the model, the model can also be tuned through cross-validation and other technologies.

[0239] S1706. Model evaluation and verification: Use the test data set to further evaluate and verify the double-spending attack detection model. By comparing the model's predicted results and actual results, the model's performance indicators are evaluated to further optimize and improve the model. After optimization, the model is further improved and optimized through evaluation indicators such as accuracy, recall, precision, etc.

[0240] S1707, model deployment and launch: deploy the trained double-spending attack detection model to the blockchain system, and add a transaction detection module to the blockchain node program. This module can detect in real time whether the transaction is a double-spending attack transaction when the transaction occurs. When the detection module receives a new transaction, it uses the transaction data as the model input, performs detection through the double-spending attack detection model, and outputs the detection result.

[0241] S1708. Prediction results and model monitoring: The model predicts new transactions to detect whether they are double-spending attack transactions. At the same time, the model is monitored to determine whether the model is operating normally to ensure the stability and accuracy of the model.

[0242] S1709, data reflow: record and analyze the test results, and return the results to the data collection layer to optimize the model and data analysis.

[0243] In summary, after the data set obtained from the double-spending attack transaction is cleaned and preprocessed, the double-spending attack detection model is summarized little by little according to the feature set obtained by feature engineering, and then the verification data is used for repeated verification and optimization. Finally, the trained double-spending attack detection model is deployed in the blockchain. It can be deployed using blockchain smart contracts or off-chain services. A transaction detection module is added to the blockchain node program. This module can detect the occurrence of new transactions in real time. When the detection module receives a new transaction, it uses the transaction data as the model input and detects it through the double-spending attack detection model. The detection module outputs the detection result. If the detection result is a double-spending attack transaction, the transaction will be intercepted and an alarm will be issued; if the detection result is a non-attack transaction, the transaction will be released.

[0244] In the embodiment of the present application, a machine learning algorithm is used to analyze the data of double-spending attack transactions, and double-spending attack transactions are automatically detected and identified, which is not available in traditional defense measures. It can not only detect and prevent double-spending attack transactions, but also predict possible double-spending attack behaviors; in this way, preparations can be made in advance to prevent potential double-spending attack risks and can customize double-spending attack defense strategies based on machine learning analysis of double-spending attack transactions and specific transaction scenarios; this will make detection and defense more efficient and reliable, and avoid too many false positives and false negatives. In addition, the accuracy of double-spending attack detection and defense can be improved by continuously updating the machine learning model to adapt to different double-spending attack behaviors.

[0245] Herein, an apparatus embodiment of the present application is introduced, which can be used to execute the transaction processing method based on blockchain in the above-mentioned embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the above-mentioned embodiment of the transaction processing method based on blockchain in the present application.

[0246] The present application embodiment provides a transaction processing device based on blockchain, such as Fig.18 As shown, the device comprises:

[0247] An acquisition module 1810 is used to acquire transaction data of pending transactions in a blockchain network;

[0248] The detection module 1820 is used to extract features from the transaction data of the transaction to be processed according to the attack detection model deployed in the blockchain network, so as to obtain target features of the transaction data of the transaction to be processed; the attack detection model is trained based on the attack features obtained by extracting features from the abnormal transaction data;

[0249] A matching module 1830 is used to match the target feature with the attack feature to obtain a matching result;

[0250] The interception module 1840 is configured to intercept the transaction to be processed if the matching result indicates that the target feature is related to the attack feature.

[0251] In one embodiment of the present application, based on the aforementioned scheme, the device also includes a training module for obtaining normal transactions and multiple types of attack transactions, and obtaining transaction data of simulated normal transactions and transaction data of simulated attack transactions; determining abnormal transaction data based on the correlation between the transaction data of multiple attack transactions, and the difference between the transaction data of normal transactions and the transaction data of attack transactions; extracting features from the abnormal transaction data to obtain attack features; and training a training model based on the attack features to obtain an attack detection model.

[0252] In one embodiment of the present application, based on the aforementioned scheme, the training module is further used to generate abnormal transaction data based on the data content of the transaction data of the attack transactions if the similarity between the data content of the transaction data of multiple attack transactions is greater than a preset similarity threshold; if the similarity between the data content of the transaction data of multiple attack transactions is less than the preset similarity threshold, then obtain the usage frequency of the data content of the transaction data of each attack transaction; when there is a correlation between the usage frequencies of the data content of the transaction data of multiple attack transactions, generate abnormal transaction data based on the data content of the transaction data of the attack transactions and the usage frequency of the data content.

[0253] In one embodiment of the present application, based on the aforementioned scheme, the training module is further used to obtain first attribute information corresponding to the transaction data of normal transactions within a preset time, and second attribute information corresponding to the transaction data of attack transactions within a preset time; calculate the difference attribute information between the first attribute information and the second attribute information; if the difference attribute information is greater than a preset difference information threshold, generate abnormal transaction data based on the second attribute information and the difference attribute information.

[0254] In one embodiment of the present application, based on the aforementioned scheme, the training module is further used to extract key data from the abnormal transaction data if the abnormal transaction data is text data, and generate basic attack features based on the key data; if the abnormal transaction data is numerical data, extract periodic data from the abnormal transaction data, and generate basic attack features based on the periodic data; combine multiple different basic attack features to obtain a combined attack feature, and obtain an attack feature based on the basic attack feature and the combined attack feature.

[0255] In one embodiment of the present application, based on the aforementioned scheme, the training module is further used to train the training model according to the attack characteristics to obtain an initial attack detection model; obtain verification transaction data; detect the verification transaction data according to the initial attack detection model to obtain a detection result; construct a loss function based on the detection result and the expected result of the verification transaction data, and optimize the model parameters of the initial attack detection model based on the loss function to obtain an attack detection model.

[0256] In one embodiment of the present application, based on the aforementioned scheme, the training module is further used to perform data amplification based on the verified transaction data to obtain new abnormal transaction data if the difference between the expected result and the detection result is greater than a preset difference threshold; perform feature extraction on the new abnormal transaction data to obtain new attack features; retrain the initial attack detection model according to the attack features, and optimize the model parameters of the retrained initial attack detection model based on the loss function to obtain the attack detection model.

[0257] In one embodiment of the present application, based on the aforementioned scheme, the training module is further used to optimize the transaction data of the attack transaction based on the verification transaction data to add the transaction data of the new attack transaction to obtain the first amplified data; obtain the second amplified data based on the difference between the verification transaction data and the transaction data of the normal transaction; and generate new abnormal transaction data based on the first amplified data and the second amplified data.

[0258] In one embodiment of the present application, based on the above-mentioned solution, the device further includes an updating module, which is used to update the attack detection model according to the target feature if the target feature is different from the attack feature.

[0259] In one embodiment of the present application, based on the aforementioned scheme, the device also includes a processing module for obtaining the transaction scenario of the transaction to be processed, and the correspondence between the preset transaction scenario and the defense strategy; determining the defense strategy for the transaction to be processed based on the transaction scenario and the correspondence between the transaction to be processed; and processing the transaction to be processed based on the defense strategy of the transaction to be processed.

[0260] In one embodiment of the present application, based on the aforementioned scheme, the processing module is further used to prevent the pending transaction from being uploaded to the chain if the transaction scenario of the pending transaction is the first transaction scenario, and disclose the private key used to sign the pending transaction to other blockchain nodes; if the transaction scenario of the pending transaction is the second transaction scenario, obtain the security factor of the participant of the pending transaction based on the historical operations of the participant of the pending transaction, wherein the scenario level of the second transaction scenario is lower than the scenario level of the first transaction scenario; when the security factor of the participant of the pending transaction is less than the preset security factor, request multiple signatures from the participant of the pending transaction.

[0261] It should be noted that the device provided in the above embodiment and the method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment and will not be repeated here.

[0262] An embodiment of the present application also provides an electronic device, comprising one or more processors and a storage device, wherein the storage device is used to store one or more computer programs, and when the one or more computer programs are executed by one or more processors, the electronic device implements the above-mentioned blockchain-based transaction processing method.

[0263] Fig.19 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0264] It should be noted that Fig.19 The computer system 1900 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0265] like Fig.19 As shown, the computer system 1900 includes a processor (Central Processing Unit, CPU) 1901, which can perform various appropriate actions and processes according to the program stored in the read-only memory (Read-Only Memory, ROM) 1902 or the program loaded from the storage part 1908 to the random access memory (Random Access Memory, RAM) 1903, such as executing the method in the above embodiment. In RAM 1903, various programs and data required for system operation are also stored. CPU 1901, ROM 1902 and RAM 1903 are connected to each other through bus 1904. Input / output (Input / Output, I / O) interface 1905 is also connected to bus 1904.

[0266] In some embodiments, the following components are connected to the I / O interface 1905: an input section 1906 including a keyboard, a mouse, etc.; an output section 1907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 1908 including a hard disk, etc.; and a communication section 1909 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1909 performs communication processing via a network such as the Internet. A drive 1910 is also connected to the I / O interface 1905 as needed. A removable medium 1911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1910 as needed, so that a computer program read therefrom is installed into the storage section 1908 as needed.

[0267] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1909, and / or installed from a removable medium 1911. When the computer program is executed by a processor (CPU) 1901, various functions defined in the system of the present application are executed.

[0268] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (Erasable Programmable Read Only Memory), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. This propagated data signal can take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. A computer program contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0269] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the devices, methods and computer program products according to various embodiments of the present application. Among them, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and a computer program.

[0270] The units or modules involved in the embodiments described in this application may be implemented by software or hardware, and the units or modules described may also be set in a processor. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0271] Another aspect of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the transaction processing method based on blockchain as described above. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0272] Another aspect of the present application further provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of an electronic device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the electronic device executes the transaction processing method based on blockchain as described above in the above-mentioned various embodiments.

[0273] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0274] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0275] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person of ordinary skill in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. A transaction processing method based on blockchain, characterized in that: include: Get transaction data of pending transactions in the blockchain network; Extracting features of the transaction data of the transaction to be processed according to the attack detection model deployed on the blockchain network to obtain target features of the transaction data of the transaction to be processed; The attack detection model is trained based on attack features obtained by extracting features from abnormal transaction data; Matching the target feature with the attack feature to obtain a matching result; If the matching result indicates that the target feature is related to the attack feature, the transaction to be processed is intercepted.

2. The method according to claim 1, characterized in that Before extracting features from the transaction data of the pending transaction according to the attack detection model deployed on the blockchain network, the method further includes: Acquire normal transactions and multiple types of attack transactions, and the transaction data of the normal transactions and the transaction data of the attack transactions; Determining the abnormal transaction data according to the correlation between the transaction data of the plurality of attack transactions and the difference between the transaction data of the normal transaction and the transaction data of the attack transaction; Extracting features from the abnormal transaction data to obtain the attack features; The model to be trained is trained according to the attack features to obtain the attack detection model.

3. The method according to claim 2, characterized in that The determining the abnormal transaction data according to the correlation between the transaction data of the plurality of attack transactions and the difference between the transaction data of the normal transaction and the transaction data of the attack transaction comprises: If the similarity between the data contents of the transaction data of the plurality of attack transactions is greater than a preset similarity threshold, generating the abnormal transaction data according to the data contents of the transaction data of the attack transactions; If the similarity between the data contents of the transaction data of the plurality of attack transactions is less than a preset similarity threshold, obtaining the usage frequency of the data content of the transaction data of each of the attack transactions; When there is a correlation between the usage frequencies of the data contents of the transaction data of the plurality of attack transactions, the abnormal transaction data is generated based on the data contents of the transaction data of the attack transactions and the usage frequencies of the data contents.

4. The method according to claim 2, characterized in that: The determining the abnormal transaction data according to the correlation between the transaction data of the plurality of attack transactions and the difference between the transaction data of the normal transaction and the transaction data of the attack transaction comprises: Acquire first attribute information corresponding to the transaction data of the normal transaction within a preset time, and second attribute information corresponding to the transaction data of the attack transaction within a preset time; Calculating difference attribute information between the first attribute information and the second attribute information; If the difference attribute information is greater than a preset difference information threshold, the abnormal transaction data is generated according to the second attribute information and the difference attribute information.

5. The method according to claim 2, characterized in that: The extracting features of the abnormal transaction data to obtain the attack features includes: If the abnormal transaction data is text data, extract key data from the abnormal transaction data, and generate basic attack features based on the key data; If the abnormal transaction data is numerical data, extracting periodic data from the abnormal transaction data, and generating the basic attack feature based on the periodic data; A plurality of different basic attack features are combined to obtain a combined attack feature, and the attack feature is obtained based on the basic attack features and the combined attack feature.

6. The method according to claim 2, characterized in that The step of training the training model according to the attack features to obtain the attack detection model includes: Training the model to be trained according to the attack features to obtain an initial attack detection model; Get verification transaction data; Detecting the verification transaction data according to the initial attack detection model to obtain a detection result; A loss function is constructed according to the detection result and the expected result of the verification transaction data, and the model parameters of the initial attack detection model are optimized based on the loss function to obtain the attack detection model.

7. The method according to claim 6, characterized in that The step of optimizing the model parameters of the initial attack detection model based on the loss function to obtain the attack detection model includes: If the difference between the expected result and the detection result is greater than a preset difference threshold, data amplification is performed based on the verification transaction data to obtain new abnormal transaction data; Extracting features from the new abnormal transaction data to obtain new attack features; The initial attack detection model is retrained according to the attack features, and the model parameters of the retrained initial attack detection model are optimized based on the loss function to obtain the attack detection model.

8. The method according to claim 7, characterized in that The data amplification based on the verification transaction data to obtain new abnormal transaction data includes: Optimizing the transaction data of the attack transaction based on the verification transaction data to add the transaction data of the new attack transaction to obtain first augmented data; Obtaining second augmented data based on the difference between the verification transaction data and the transaction data of the normal transaction; The new abnormal transaction data is generated based on the first amplified data and the second amplified data.

9. The method according to claim 1, characterized in that: After intercepting the pending transaction, the method further includes: If the target feature is different from the attack feature, the attack detection model is updated according to the target feature.

10. The method according to any one of claims 1 to 9, characterized in that: After intercepting the pending transaction, the method further includes: Obtaining the transaction scenario of the pending transaction and the corresponding relationship between the preset transaction scenario and the defense strategy; Determining a defense strategy for the pending transaction according to the transaction scenario of the pending transaction and the corresponding relationship; The pending transaction is processed according to the defense strategy of the pending transaction.

11. The method according to claim 10, characterized in that The processing of the transaction to be processed according to the defense strategy of the transaction to be processed includes: If the transaction scenario of the pending transaction is the first transaction scenario, the pending transaction is prevented from being uploaded to the chain, and the private key used to sign the pending transaction is disclosed to other blockchain nodes; If the transaction scenario of the pending transaction is the second transaction scenario, obtaining the safety factor of the participant of the pending transaction according to the historical operation of the participant of the pending transaction, wherein the scenario level of the second transaction scenario is lower than the scenario level of the first transaction scenario; When the security factor of the party participating in the transaction to be processed is less than the preset security factor, multiple signatures are requested from the party participating in the transaction to be processed.

12. A transaction processing device based on blockchain, characterized in that: include: An acquisition module, used to obtain transaction data of pending transactions in the blockchain network; A detection module, configured to extract features of the transaction data of the transaction to be processed according to an attack detection model deployed on the blockchain network, so as to obtain target features of the transaction data of the transaction to be processed; The attack detection model is trained based on attack features obtained by extracting features from abnormal transaction data; A matching module, used for matching the target feature with the attack feature to obtain a matching result; The interception module is used to intercept the pending transaction if the matching result indicates that the target feature is related to the attack feature.

13. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to execute the method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor of an electronic device, the electronic device executes the method according to any one of claims 1 to 11.

15. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program is stored in a computer-readable storage medium, and a processor of an electronic device reads and executes the computer program from the computer-readable storage medium, so that the electronic device executes the method according to any one of claims 1 to 11.

Images