Block chain behavior detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a behavior detection method and device of a block chain, electronic equipment and a storage medium, and relates to the technical field of block chains. The method comprises the steps of obtaining block data corresponding to current block time from a block chain; analyzing token behaviors in the block data to obtain corresponding behavior distribution data; and determining whether the block chain has an abnormal behavior based on the behavior distribution data and the supervision demand. According to the technical scheme provided by the invention, whether the block chain has the abnormal token behavior or not can be detected, and different supervision requirements of multiple different supervision parties can be met.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a blockchain behavior detection method, device, electronic device and storage medium. Background Art

[0002] With the development of blockchain technology, the characteristics of blockchain that cannot be tampered with and decentralized are often used to detect abnormal behaviors in application scenarios. However, for the security monitoring of specific behaviors on the blockchain, the current technology only extracts the token behavior information on the blockchain, and cannot dig out the potential abnormal behaviors, let alone meet the different regulatory needs of different regulators. Therefore, designing a method to detect abnormal token behavior on the blockchain has become an urgent problem to be solved. Summary of the invention

[0003] The present application provides a blockchain behavior detection method, device, electronic device and storage medium to detect whether there is abnormal token behavior in the blockchain; it can meet the different regulatory needs of multiple different regulators.

[0004] In a first aspect, the present application provides a behavior detection method for a blockchain, the method comprising:

[0005] Get the block data corresponding to the current block time from the blockchain;

[0006] Analyze the token behavior in the block data to obtain corresponding behavior distribution data;

[0007] Determine whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements.

[0008] Furthermore, the analyzing the token behaviors in the block data to obtain corresponding behavior distribution data includes: extracting at least one token from the block data; determining all holding accounts corresponding to each token to obtain corresponding multiple accounts; obtaining multiple token behaviors performed by each account on each token; and calculating the corresponding behavior distribution data of each account in each token based on the multiple token behaviors.

[0009] Furthermore, the at least one token includes a native token, and the behavior distribution data also includes the number of tokens held; the calculation of the behavior distribution data corresponding to each account in each token based on the multiple token behaviors includes: obtaining a first token behavior corresponding to the native token from the multiple token behaviors; calculating the native token net inflow of the first account corresponding to the native token based on the first token behavior; and determining the number of tokens held by the first account at the current block time based on the native token net inflow.

[0010] Furthermore, the at least one token also includes a non-native token, and the behavior distribution data also includes a proportion of tokens held; the calculation of the corresponding behavior distribution data of each account in each token based on the multiple token behaviors includes: obtaining a second token behavior corresponding to the non-native token from the multiple token behaviors; calculating the net inflow of the non-native token of the second account corresponding to the non-native token based on the second token behavior; determining the number of tokens held by the second account at the current block time based on the net inflow of non-native tokens; and calculating the proportion of tokens held by the second account based on the sum of the number of tokens held by the second account and the number of tokens held by all second accounts corresponding to the non-native token.

[0011] Furthermore, the determining whether the blockchain has abnormal behavior based on the behavior distribution data and the regulatory requirements includes: parsing the regulatory requirements to obtain the account to be regulated, the token to be regulated, or the token behavior to be regulated corresponding to the block data; determining whether the account to be regulated has token behavior based on the behavior distribution data, determining whether an account has initiated token behavior on the token to be regulated based on the behavior distribution data, or determining whether the token behavior to be regulated is abnormal based on the behavior distribution data; if the account to be regulated has token behavior, an account has initiated token behavior on the token to be regulated, or the token behavior to be regulated is abnormal, then it is determined that the blockchain has abnormal behavior.

[0012] Furthermore, the token behavior includes trading behavior, minting behavior and destruction behavior; determining whether the behavior of the token to be regulated is abnormal based on the behavior distribution data includes at least one of the following methods: determining whether each transaction behavior is greater than the maximum transaction amount based on the behavior distribution data; determining whether each minting behavior is greater than the maximum minting amount of minted tokens based on the behavior distribution data; determining whether each destruction behavior is greater than the maximum destruction amount of destroyed tokens based on the behavior distribution data; determining whether the number of tokens held by a single account is greater than the maximum number of tokens held based on the behavior distribution data; determining whether the proportion of tokens held by a single account is greater than the maximum proportion of tokens held based on the behavior distribution data.

[0013] Furthermore, the method also includes: when the blockchain has abnormal behavior, generating early warning prompt information; sending the early warning prompt information to the regulator corresponding to the regulatory demand, and the early warning prompt information is used to prompt the regulator that the blockchain has abnormal behavior.

[0014] In a second aspect, the present application provides a behavior detection device for a blockchain, the device comprising:

[0015] The data acquisition module is used to obtain the block data corresponding to the current block time from the blockchain;

[0016] A data analysis module, used to analyze the token behavior in the block data to obtain corresponding behavior distribution data;

[0017] A behavior detection module is used to determine whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements.

[0018] In a third aspect, the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blockchain behavior detection method described in any embodiment of the present application.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the blockchain behavior detection method described in any embodiment of the present application when executed.

[0020] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the blockchain behavior detection method described in any embodiment of the present application.

[0021] In order to address the defects of the prior art in the background technology, an embodiment of the present application provides a behavior detection method for a blockchain, and executing the method can bring the following beneficial effects: the monitoring platform of the present application reads the block data on the regulated blockchain, extracts the token behavior of various tokens in the block data, and infers and analyzes the corresponding behavior distribution data; the present application can set regulatory requirements on the monitoring platform, and based on the behavior distribution data and regulatory requirements, further explore whether there is abnormal token behavior in the blockchain; and can meet the different regulatory requirements of multiple different regulators.

[0022] It should be noted that the above-mentioned computer instructions can be stored in whole or in part on a computer-readable storage medium. Among them, the computer-readable storage medium can be packaged together with the processor of the blockchain behavior detection device, or it can be packaged separately from the processor of the blockchain behavior detection device, and this application does not limit this.

[0023] The description of the second, third, ..., and fifth aspects in this application can refer to the detailed description of the first aspect; and the beneficial effects of the description of the second, third, ..., and fifth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0024] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description.

[0025] It is understandable that before using the technical solutions disclosed in the embodiments of this application, the type, scope of use, and usage scenarios of the personal information involved in this application should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 A flowchart of a behavior detection method of a blockchain provided in an embodiment of the present application;

[0028] Figure 2 A schematic diagram of the structure of a blockchain behavior detection device provided in an embodiment of the present application;

[0029] Figure 3It is a block diagram of an electronic device used to implement a blockchain behavior detection method in an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0031] It should be noted that the terms "first", "second", "target", and "original" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including", "having", and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0032] Figure 1 This is a flowchart of a behavior detection method for a blockchain provided in an embodiment of the present application. This embodiment can be applied to the case of detecting abnormal token behavior in a blockchain. The behavior detection method for a blockchain provided in this embodiment can be performed by a behavior detection device for a blockchain provided in an embodiment of the present application. The device can be implemented in software and / or hardware and integrated in an electronic device that executes the method.

[0033] See also Figure 1 The method of this embodiment includes but is not limited to the following steps:

[0034] S110. Obtain block data corresponding to the current block time from the blockchain.

[0035] Among them, blockchain is a distributed ledger structure, a distributed database system participated by each individual node, which has technical characteristics such as decentralization, distribution, asymmetric encryption and point-to-point transmission. The blockchain in this embodiment refers to the blockchain supervised by the blockchain abnormal behavior monitoring platform (hereinafter referred to as the supervision platform) and the supervisor.

[0036] In the embodiment of the present application, the framework of the monitoring platform mainly includes three submodules, namely: data reading module, behavior analysis module and anomaly detection module. The data reading module in the monitoring platform is responsible for reading the block data on the monitored blockchain. Specifically: according to the current block time of the blockchain, the on-chain data is scanned in real time, and the block data corresponding to the current block time is read and stored, providing a data basis for the subsequent work of the behavior analysis module.

[0037] The block data is stored in the form of data structure, as shown in Table 1:

[0038] Table 1: Blockchain transaction record information and its data structure

[0039]

[0040] S120. Analyze the token behavior in the block data to obtain corresponding behavior distribution data.

[0041] Among them, token behavior refers to the various transactions, minting and destruction of tokens in the blockchain. Behavior distribution data refers to the statistical description of the corresponding data characteristics of token behavior using mathematical statistics.

[0042] Specifically, the token behaviors in the block data are analyzed to obtain corresponding behavior distribution data, including: first, the behavior analysis module in the monitoring platform extracts at least one token from the block data; then, the behavior analysis module determines all holding accounts corresponding to each token to obtain corresponding multiple accounts; secondly, the behavior analysis module obtains multiple token behaviors performed by each account on each token from the block data; finally, the behavior analysis module calculates the corresponding behavior distribution data of each account in each token based on the multiple token behaviors.

[0043] In an embodiment of the present application, the behavior analysis module is responsible for performing token behavior analysis on the extracted tokens, and based on this, inferring the corresponding behavior distribution of each account in each token. Specifically, the behavior distribution data refers to: for a specific token, the number and proportion of each account holding the token. The behavior analysis module performs analysis on each different token. For blockchain native tokens, this module infers the number of tokens held by each account through token transaction records; for tokens created by smart contracts (ie, non-native tokens), this module infers the proportion of tokens held by each account based on the number of tokens held by each account.

[0044] In an optional embodiment, the at least one token includes a native token, and the behavior distribution data also includes the number of tokens held. The native token is created directly in the underlying protocol of the blockchain network and is used for various transactions and functions within the network, that is, a homogeneous token that meets the ERC-20 standard.

[0045] Specifically, the behavior distribution data corresponding to each account in each token is calculated based on multiple token behaviors, including: the first token behavior corresponding to the native token can be screened out from the multiple token behaviors according to preset identification characters. The net inflow of native tokens of the first account corresponding to the native token is calculated based on the first token behavior, such as: the calculation method can be the token acceptance amount minus the token transfer amount. The number of tokens held by the first account corresponding to the current block time is determined based on the net inflow of native tokens, such as: the number of tokens held corresponding to the current block time is equal to the net inflow of native tokens at the current block time plus the cumulative amount of native tokens at historical block times. Among them, the first token behavior refers to the behavior of various transactions, minting and destruction of tokens in the native token of the blockchain; the first account refers to the account holding the native token in the blockchain.

[0046] In another optional embodiment, at least one token also includes a non-native token, and the behavior distribution data also includes the percentage of tokens held. Wherein, a non-native token is a token created by a smart contract on a blockchain, that is, a non-fungible token (NFTs) that meets the ERC-721 standard.

[0047] Specifically, the behavior distribution data corresponding to each account in each token is calculated based on multiple token behaviors, including: the second token behavior corresponding to the non-native token can be screened out from the multiple token behaviors according to the preset identification characters. The net inflow of non-native tokens of the second account corresponding to the non-native token is calculated based on the second token behavior, such as: the calculation method can be the token acceptance amount minus the token transfer amount. The number of tokens held by the second account at the current block time is determined based on the net inflow of non-native tokens, such as: the number of tokens held at the current block time is equal to the net inflow of native tokens at the current block time plus the cumulative amount of native tokens at the historical block time. Based on the number of tokens held by the second account and the sum of the number of tokens held by all second accounts corresponding to the non-native token, the proportion of tokens held by the second account is calculated, such as: the calculation method can be that the proportion of tokens held by a certain account is equal to the number of tokens held by the account divided by the sum of the number of tokens held by all accounts. Among them, the second token behavior refers to the behavior of various transactions, casting and destruction of tokens in the non-native tokens of the blockchain; the second account refers to the account holding the non-native token in the blockchain.

[0048] S130. Determine whether the blockchain has abnormal behavior based on behavior distribution data and regulatory requirements.

[0049] Specifically, determining whether there is abnormal behavior in the blockchain based on the behavior distribution data and regulatory requirements includes: parsing the regulatory requirements to obtain the account to be regulated, the token to be regulated, or the token behavior to be regulated corresponding to the block data; determining whether there is token behavior in the account to be regulated based on the behavior distribution data, determining whether there is an account initiating token behavior with respect to the token to be regulated based on the behavior distribution data, or determining whether there is abnormality in the token behavior to be regulated based on the behavior distribution data; if the account to be regulated has token behavior, an account has initiated token behavior with respect to the token to be regulated, or there is abnormality in the token behavior to be regulated, then it is determined that abnormal behavior exists in the blockchain.

[0050] In the embodiment of the present application, the supervision method of the abnormal behavior of the blockchain by the abnormal detection module in the monitoring platform can be as follows: First, the account address of the account to be supervised can be included in the account blacklist. When the account in the account blacklist performs token behavior (such as trading, etc.) or other operations, it can be determined that the blockchain has abnormal behavior, and then an early warning can be initiated to respond to the behavior of the account in a timely manner. Second, the contract address of the token to be supervised can be included in the token blacklist. When an account initiates a token behavior related to the token in the token blacklist (such as trading, etc.), it can be determined that the blockchain has abnormal behavior, and then an early warning can be initiated to respond to the behavior of the token in a timely manner. Third, the behavior of the token to be supervised can be at least one of trading behavior, casting behavior and destruction behavior. According to the preset supervision rules, the behavior distribution data is analyzed to determine whether the behavior of the token to be supervised is abnormal. If it is abnormal, it can be determined that the blockchain has abnormal behavior, and then an early warning can be initiated to respond to the behavior of the token in a timely manner.

[0051] Furthermore, token behaviors include trading behaviors, minting behaviors, and destruction behaviors; determining whether there are any abnormalities in the behaviors of the tokens to be regulated based on the behavior distribution data includes at least one of the following methods: determining whether each transaction behavior is greater than the maximum transaction amount based on the behavior distribution data; determining whether each minting behavior is greater than the maximum minting amount of minted tokens based on the behavior distribution data; determining whether each destruction behavior is greater than the maximum destruction amount of destroyed tokens based on the behavior distribution data; determining whether the number of tokens held by a single account is greater than the maximum number of tokens held based on the behavior distribution data; determining whether the proportion of tokens held by a single account is greater than the maximum proportion of tokens held based on the behavior distribution data.

[0052] According to the regulatory requirements of the regulator, at least one method for detecting abnormal blockchain behavior can be set. Table 2 below shows the token behavior and behavior distribution information that can be used to set abnormal detection methods:

[0053] Table 2: Token behaviors and behavior distribution information that can be used to set up anomaly detection methods

[0054]

[0055]

[0056] In an optional embodiment, the behavior detection method of the blockchain of the present application also includes: when there is abnormal behavior in the blockchain, generating early warning prompt information; sending the early warning prompt information to the regulator corresponding to the regulatory requirements, and the early warning prompt information is used to prompt the regulator that there is abnormal behavior in the blockchain. For the function of setting early warning conditions, the monitoring platform supports simultaneous supervision of multiple different regulators, as well as different regulatory requirements of the same regulator. According to the regulatory requirements of different regulators for abnormal behaviors of different blockchains, different regulatory requirements of different regulators can be met by setting different early warning conditions.

[0057] Optionally, the regulator can set early warning conditions for multiple token behaviors or behavior distribution information at the same time to achieve more refined and customized early warning conditions. For example, the regulator can set the "contract address of the token to be regulated" to "Address", the account address to "Account", and the proportion of tokens held by the account to "50%". Then, when the proportion of tokens with the contract address of Address held by the account Account exceeds 50%, it will be regarded as an abnormal behavior on the blockchain, and an early warning will be sent to the regulator who set the early warning condition.

[0058] The technical solution provided in this embodiment obtains the block data corresponding to the current block time from the blockchain; analyzes the token behavior in the block data to obtain the corresponding behavior distribution data; and determines whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements. The monitoring platform of this application reads the block data on the regulated blockchain, extracts the token behavior of various tokens in the block data, and infers and analyzes the corresponding behavior distribution data; this application can set regulatory requirements on the monitoring platform, and based on the behavior distribution data and regulatory requirements, it can further explore whether there is abnormal token behavior in the blockchain; it can meet the different regulatory requirements of multiple different regulators.

[0059] In an embodiment of a practical application, the specific application scenarios of the blockchain behavior detection method of the present application include but are not limited to: Rug Pull event detection, phishing fraud detection, and Ponzi scheme detection. In different application scenarios, the blockchain behavior detection method of the present application is the same in the main process, and the difference lies in the alarm conditions set by the regulator.

[0060] Taking Rug Pull event detection as an example, Rug Pull refers to the behavior of developers or project owners in the decentralized finance and cryptocurrency markets who obtain user funds through malicious means and then suddenly withdraw the funds and run away. Attackers usually achieve this by selling a large number of tokens, minting a large number of tokens, and withdrawing a large amount of token liquidity from decentralized exchanges. Based on these attack methods, regulators can set corresponding alarm conditions to promptly detect Rug Pull events and implement corresponding measures.

[0061] The alarm conditions that can be used to detect Rug Pull events include but are not limited to: (1) monitoring abnormal token behavior. For example, if an account mints a large number of tokens, the account can launch an attack by selling these large numbers of minted tokens; (2) monitoring abnormal token distribution. For example, if an account holds too many tokens in the market, the account can manipulate the token price and launch an attack by holding a large number of tokens.

[0062] Figure 2 A schematic diagram of a blockchain behavior detection device provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the device 200 may include:

[0063] The data acquisition module 210 is used to obtain the block data corresponding to the current block time from the blockchain;

[0064] A data analysis module 220, for analyzing the token behavior in the block data to obtain corresponding behavior distribution data;

[0065] The behavior detection module 230 is used to determine whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements.

[0066] Furthermore, the above-mentioned data analysis module 220 can be specifically used to: extract at least one token from the block data; determine all holding accounts corresponding to each token to obtain corresponding multiple accounts; obtain multiple token behaviors performed by each account on each token; and calculate the behavior distribution data corresponding to each account in each token based on the multiple token behaviors.

[0067] In one embodiment, the at least one token includes a native token, and the behavior distribution data also includes the number of tokens held;

[0068] Furthermore, the above-mentioned data analysis module 220 can also be specifically used to: obtain a first token behavior corresponding to the native token from the multiple token behaviors; calculate the native token net inflow of the first account corresponding to the native token based on the first token behavior; and determine the number of tokens held by the first account at the current block time based on the native token net inflow.

[0069] In one embodiment, the at least one token further includes a non-native token, and the behavior distribution data further includes a percentage of held tokens;

[0070] Furthermore, the above-mentioned data analysis module 220 can also be specifically used to: obtain a second token behavior corresponding to the non-native token from the multiple token behaviors; calculate the net inflow of the non-native token of the second account corresponding to the non-native token based on the second token behavior; determine the number of tokens held by the second account at the current block time based on the net inflow of non-native tokens; calculate the proportion of tokens held by the second account based on the sum of the number of tokens held by the second account and the number of tokens held by all second accounts corresponding to the non-native token.

[0071] Furthermore, the above-mentioned behavior detection module 230 can be specifically used to: parse the supervision requirements to obtain the account to be regulated, the token to be regulated or the token behavior to be regulated corresponding to the block data; determine whether the account to be regulated has token behavior based on the behavior distribution data, determine whether there is an account initiating token behavior to the token to be regulated based on the behavior distribution data, or determine whether there is abnormality in the token behavior to be regulated based on the behavior distribution data; if the account to be regulated has token behavior, there is an account initiating token behavior to the token to be regulated, or the token behavior to be regulated is abnormal, it is determined that the blockchain has abnormal behavior.

[0072] In one embodiment, the token behavior includes trading behavior, minting behavior and destruction behavior; determining whether the behavior of the token to be regulated is abnormal based on the behavior distribution data includes at least one of the following methods: determining whether each transaction behavior is greater than the maximum transaction amount based on the behavior distribution data; determining whether each minting behavior is greater than the maximum minting amount of minted tokens based on the behavior distribution data; determining whether each destruction behavior is greater than the maximum destruction amount of destroyed tokens based on the behavior distribution data; determining whether the number of tokens held by a single account is greater than the maximum number of tokens held based on the behavior distribution data; determining whether the proportion of tokens held by a single account is greater than the maximum proportion of tokens held based on the behavior distribution data.

[0073] Furthermore, the above-mentioned blockchain behavior detection device may also include: an abnormal warning module;

[0074] The abnormal warning module is used to generate warning prompt information when the blockchain has abnormal behavior; the warning prompt information is sent to the regulator corresponding to the regulatory demand, and the warning prompt information is used to prompt the regulator that the blockchain has abnormal behavior.

[0075] The blockchain behavior detection device provided in this embodiment can be applied to the blockchain behavior detection method provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0076] Figure 3 It is a block diagram of an electronic device for implementing a behavior detection method of a blockchain of an embodiment of the present application. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0077] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0078] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0079] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the behavior detection method of the blockchain.

[0080] In some embodiments, the behavior detection method of the blockchain may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the behavior detection method of the blockchain described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the behavior detection method of the blockchain in any other appropriate manner (e.g., by means of firmware).

[0081] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0082] The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow charts and / or block diagrams are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0083] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0084] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0085] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server) or a computing system that includes middleware components (e.g., an application server) or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein) or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0086] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0087] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments, and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. For example, those skilled in the art can use the various forms of processes shown above to reorder, add, or delete steps; the steps recorded in the present application can be performed in parallel, sequentially, or in different orders, as long as the desired results of the technical solution of the present application can be achieved, and this document does not limit them here.

[0088] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A behavior detection method for blockchain, characterized in that: The method comprises: Get the block data corresponding to the current block time from the blockchain; Analyze the token behavior in the block data to obtain corresponding behavior distribution data; Determine whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements.

2. The behavior detection method of blockchain according to claim 1 is characterized in that: The analyzing the token behavior in the block data to obtain corresponding behavior distribution data includes: Extracting at least one token from the block data; Determine all holding accounts corresponding to each token and obtain the corresponding multiple accounts; Get multiple token actions performed by each account on each token; Based on the multiple token behaviors, the behavior distribution data corresponding to each account in each token is calculated.

3. The behavior detection method of blockchain according to claim 2 is characterized in that: The at least one token includes a native token, and the behavior distribution data also includes the number of tokens held; and the calculation of the behavior distribution data corresponding to each account in each token based on the multiple token behaviors includes: Obtaining a first token behavior corresponding to the native token from the multiple token behaviors; Calculate the net inflow of the native token of the first account corresponding to the native token based on the first token behavior; The number of tokens held by the first account at the current block time is determined based on the net inflow of the native token.

4. The behavior detection method of blockchain according to claim 2 is characterized in that: The at least one token further includes a non-native token, and the behavior distribution data further includes a proportion of tokens held; and the calculation of the behavior distribution data corresponding to each account in each token based on the multiple token behaviors includes: Obtaining a second token behavior corresponding to the non-native token from the multiple token behaviors; Calculate the net inflow of the non-native token of the second account corresponding to the non-native token based on the second token behavior; Determine the number of tokens held by the second account at the current block time based on the net inflow of the non-native token; Based on the number of tokens held by the second account and the sum of the number of tokens held by all second accounts corresponding to the non-native token, the proportion of tokens held by the second account is calculated.

5. The behavior detection method of blockchain according to claim 2 is characterized in that: The determining whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements includes: Parsing the regulatory requirements to obtain the accounts to be regulated, the tokens to be regulated, or the token behaviors to be regulated corresponding to the block data; Determine whether the account to be regulated has any token behavior based on the behavior distribution data, determine whether an account has initiated token behavior on the token to be regulated based on the behavior distribution data, or determine whether the behavior of the token to be regulated is abnormal based on the behavior distribution data; If the account to be regulated has token behavior, an account has initiated token behavior on the token to be regulated, or the token to be regulated has abnormal behavior, it is determined that the blockchain has abnormal behavior.

6. The behavior detection method of blockchain according to claim 5 is characterized in that: The token behaviors include trading behaviors, minting behaviors, and destruction behaviors; determining whether the behaviors of the tokens to be regulated are abnormal based on the behavior distribution data includes at least one of the following methods: Determine whether each transaction behavior is greater than a maximum transaction amount based on the behavior distribution data; Determine whether each minting behavior is greater than the maximum minting amount of the minted token based on the behavior distribution data; Determine whether each destruction behavior is greater than the maximum destruction amount of the destroyed tokens based on the behavior distribution data; Determining whether the number of tokens held by a single account is greater than the maximum number of tokens held based on the behavior distribution data; Based on the behavior distribution data, determine whether the token holding ratio of a single account is greater than the maximum token holding ratio.

7. The behavior detection method of blockchain according to claim 1 is characterized in that: The method further comprises: When the blockchain has abnormal behavior, generate early warning information; The early warning prompt information is sent to the supervisory party corresponding to the supervision requirement, and the early warning prompt information is used to prompt the supervisory party that the blockchain has abnormal behavior.

8. A behavior detection device for blockchain, characterized in that: The device comprises: The data acquisition module is used to obtain the block data corresponding to the current block time from the blockchain; A data analysis module, used to analyze the token behavior in the block data to obtain corresponding behavior distribution data; A behavior detection module is used to determine whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blockchain behavior detection method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the behavior detection method of the blockchain described in any one of claims 1 to 7 when executed.

Images