Behavior Detection Method, Device, Electronic Device and Storage Medium of Blockchain

Abstract

The present application discloses a method, device, electronic device and storage medium for behavior detection of a blockchain, relating to the technical field of blockchain. Among them, the method includes: obtaining block data corresponding to the current block time from the blockchain; analyzing the token behavior in the block data to obtain corresponding behavior distribution data; and determining whether there is abnormal behavior in the blockchain based on the behavior distribution data and regulatory requirements. The technical solution provided by the present application can detect whether there is abnormal token behavior in the blockchain and can meet the different regulatory requirements of multiple different regulatory parties.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, and in particular, to a method, device, electronic device, and storage medium for detecting behaviors of a blockchain. Background Art

[0002] With the development of blockchain technology, the characteristics of immutability and decentralization of the blockchain are usually utilized to detect abnormal behaviors in application scenarios. However, for the security monitoring of specific behaviors on the blockchain, current technologies only extract token behavior information on the blockchain and cannot discover potential abnormal behaviors therein, let alone meet the different regulatory requirements of different regulatory parties. Therefore, designing a method for detecting abnormal token behaviors on the blockchain has become an urgent problem to be solved. Summary of the Invention

[0003] This application provides a method, device, electronic device, and storage medium for detecting behaviors of a blockchain to detect whether there are abnormal token behaviors in the blockchain and can meet the different regulatory requirements of multiple different regulatory parties.

[0004] In a first aspect, this application provides a method for detecting behaviors of a blockchain, the method including:

[0005] Obtaining block data corresponding to the current block time from the blockchain;

[0006] Analyzing token behaviors in the block data to obtain corresponding behavior distribution data;

[0007] Determining whether there are abnormal behaviors in the blockchain based on the behavior distribution data and regulatory requirements.

[0008] Further, the analyzing token behaviors in the block data to obtain corresponding behavior distribution data includes: extracting at least one token from the block data; determining all holding accounts corresponding to each token to obtain corresponding multiple accounts; obtaining multiple token behaviors executed by each account for each token; calculating, based on the multiple token behaviors, behavior distribution data corresponding to each account in each token.

[0009] Further, the at least one token includes native tokens, and the behavior distribution data further includes the quantity of tokens held; calculating the behavior distribution data corresponding to each account in each token based on the multiple token behaviors includes: obtaining the first-generation token behavior corresponding to the native token from the multiple token behaviors; calculating the net inflow of the native token of the first account corresponding to the native token based on the first-generation token behavior; and determining the quantity of tokens held by the first account corresponding to the current block time based on the net inflow of the native token.

[0010] Further, the at least one token further includes non-native tokens, and the behavior distribution data further includes the proportion of tokens held; calculating the behavior distribution data corresponding to each account in each token based on the multiple token behaviors includes: obtaining the second-generation token behavior corresponding to the non-native token from the multiple token behaviors; calculating the net inflow of the non-native token of the second account corresponding to the non-native token based on the second-generation token behavior; determining the quantity of tokens held by the second account corresponding to the current block time based on the net inflow of the non-native token; and calculating the proportion of tokens held corresponding to the second account based on the quantity of tokens held by the second account and the total quantity of tokens held by all second accounts corresponding to the non-native token.

[0011] Further, determining whether there is an abnormal behavior in the blockchain based on the behavior distribution data and regulatory requirements includes: parsing the regulatory requirements to obtain the accounts to be supervised, tokens to be supervised, or token behaviors to be supervised corresponding to the block data; determining whether there are token behaviors of the accounts to be supervised based on the behavior distribution data, determining whether there are accounts initiating token behaviors for the tokens to be supervised based on the behavior distribution data, or determining whether the token behaviors to be supervised are abnormal based on the behavior distribution data; and if there are token behaviors of the accounts to be supervised, there are accounts initiating token behaviors for the tokens to be supervised, or the token behaviors to be supervised are abnormal, determining that there is an abnormal behavior in the blockchain.

[0012] Further, the token behaviors include trading behaviors, minting behaviors, and burning behaviors; determining whether the token behavior to be supervised is abnormal based on the behavior distribution data includes at least one of the following methods: determining whether each trading behavior is greater than the maximum trading amount based on the behavior distribution data; determining whether each minting behavior is greater than the maximum minting amount of the minted tokens based on the behavior distribution data; determining whether each burning behavior is greater than the maximum burning amount of the burned tokens based on the behavior distribution data; determining whether the number of tokens held by a single account is greater than the maximum number of tokens held based on the behavior distribution data; determining whether the proportion of tokens held by a single account is greater than the maximum proportion of tokens held based on the behavior distribution data.

[0013] Further, the method further includes: when there is an abnormal behavior in the blockchain, generating a warning prompt message; sending the warning prompt message to the supervisor corresponding to the supervision requirement, and the warning prompt message is used to prompt the supervisor that there is an abnormal behavior in the blockchain.

[0014] In a second aspect, the present application provides a behavior detection device for a blockchain, and the device includes:

[0015] A data acquisition module, configured to acquire block data corresponding to the current block time from the blockchain;

[0016] A data analysis module, configured to analyze the token behaviors in the block data to obtain corresponding behavior distribution data;

[0017] A behavior detection module, configured to determine whether there is an abnormal behavior in the blockchain based on the behavior distribution data and the supervision requirement.

[0018] In a third aspect, the present application provides an electronic device, and the electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blockchain behavior detection method according to any embodiment of the present application.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium, and the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the blockchain behavior detection method according to any embodiment of the present application when executed.

[0020] In a fifth aspect, the present application provides a computer program product, including a computer program, and the computer program implements the blockchain behavior detection method according to any embodiment of the present application when executed by a processor.

[0021] To address the deficiencies of the prior art in the background art, an embodiment of the present application provides a method for detecting the behavior of a blockchain. Executing this method can bring the following beneficial effects: The monitoring platform of the present application reads the block data on the regulated blockchain, extracts the token behaviors of various tokens in the block data, and infers and analyzes the corresponding behavior distribution data; The present application can set regulatory requirements on the monitoring platform, and based on the behavior distribution data and regulatory requirements, further explore whether there are abnormal token behaviors in the blockchain; It can meet the different regulatory requirements of multiple different regulatory parties.

[0022] It should be noted that the above computer instructions can be stored in whole or in part on a computer-readable storage medium. Among them, the computer-readable storage medium can be packaged together with the processor of the blockchain behavior detection device, or can be separately packaged from the processor of the blockchain behavior detection device. The present application does not make any limitations in this regard.

[0023] The descriptions of the second aspect, the third aspect, …, and the fifth aspect in the present application can refer to the detailed description of the first aspect; and, the beneficial effects of the descriptions of the second aspect, the third aspect, …, and the fifth aspect can refer to the beneficial effect analysis of the first aspect, and will not be elaborated here.

[0024] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become easily understood through the following description.

[0025] It can be understood that before using the technical solutions disclosed in the embodiments of the present application, the types, usage scopes, usage scenarios, etc. of the personal information involved in the present application should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] To more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0027] Figure 1 It is a schematic flowchart of a method for detecting the behavior of a blockchain provided by an embodiment of the present application;

[0028] Figure 2 It is a schematic structural diagram of a device for detecting the behavior of a blockchain provided by an embodiment of the present application;

[0029] Figure 3It is a block diagram of an electronic device for implementing a blockchain behavior detection method according to an embodiment of the present application. Detailed implementation manners

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part rather than all of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0031] It should be noted that the terms "first", "second", "target", and "original" in the specification, claims, and the above-mentioned drawings of the present application are used to distinguish similar objects and do not necessarily need to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including", "having", and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units does not necessarily need to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these process, method, product, or device.

[0032] Figure 1 It is a schematic flowchart of a blockchain behavior detection method provided by an embodiment of the present application. This embodiment is applicable to the situation of detecting abnormal token behaviors in a blockchain. The blockchain behavior detection method provided by this embodiment can be executed by the blockchain behavior detection device provided by the embodiment of the present application. The device can be implemented in software and / or hardware and integrated in the electronic device that executes this method.

[0033] See Figure 1 , the method of this embodiment includes but is not limited to the following steps:

[0034] S110. Obtain block data corresponding to the current block time from the blockchain.

[0035] Among them, the blockchain is a distributed ledger structure, a distributed database system participated by individual nodes. It has technical features such as decentralization, distribution, asymmetric encryption, and peer-to-peer transmission. The blockchain in this embodiment refers to the blockchain supervised by the blockchain abnormal behavior monitoring platform (hereinafter referred to as the supervision platform) and the supervisor.

[0036] In the embodiments of the present application, the framework of the monitoring platform mainly includes three sub-modules, namely: a data reading module, a behavior analysis module, and an anomaly detection module. The data reading module in the monitoring platform is responsible for reading the block data on the monitored blockchain. Specifically: it scans the data on the chain in real time according to the current block time of the blockchain, reads and stores the block data corresponding to the current block time, and provides a data basis for the subsequent work of the behavior analysis module.

[0037] The block data is stored in the form of a data structure, as shown in Table 1 specifically:

[0038] Table 1: Blockchain transaction record information and its data structure

[0039]

[0040] S120. Analyze the token behavior in the block data to obtain the corresponding behavior distribution data.

[0041] Among them, token behavior refers to various behaviors of trading, minting, and burning tokens in the blockchain. Behavior distribution data refers to the statistical description of the data characteristics corresponding to token behavior using mathematical statistics methods.

[0042] Specifically, analyzing the token behavior in the block data to obtain the corresponding behavior distribution data includes: First, the behavior analysis module in the monitoring platform extracts at least one token from the block data; then, the behavior analysis module determines all the holding accounts corresponding to each token to obtain the corresponding multiple accounts; secondly, the behavior analysis module obtains multiple token behaviors performed by each account on each token from the block data; finally, the behavior analysis module calculates the behavior distribution data corresponding to each account in each token based on the multiple token behaviors.

[0043] In the embodiments of the present application, the behavior analysis module is responsible for analyzing the token behavior of the extracted tokens, and based on this, infers the corresponding behavior distribution of each account in each token. Specifically, the behavior distribution data refers to: for a specific token, the quantity and proportion of each account holding the token. The behavior analysis module analyzes each different token. For the native token of the blockchain, this module infers the quantity of tokens held by each account through the token transaction record; for the tokens created by smart contracts (i.e., non-native tokens), on the basis of inferring the quantity of tokens held by each account, this module further speculates on the proportion of tokens held by each account.

[0044] In an alternative embodiment, the at least one token includes native tokens, and the behavior distribution data further includes the quantity of tokens held. Among them, native tokens are directly created in the underlying protocol of the blockchain network and are used for various transactions and functions within the network. That is, they are fungible tokens that meet the ERC-20 standard.

[0045] Specifically, calculating the behavior distribution data corresponding to each account in each token based on multiple token behaviors includes: filtering out the first-generation token behaviors corresponding to the native tokens from the multiple token behaviors according to a preset identification character. Calculating the net inflow of native tokens of the first account corresponding to the native tokens based on the first-generation token behaviors. For example, the calculation method can be the token acceptance amount minus the token transfer amount. Determining the quantity of tokens held by the first account at the current block time based on the net inflow of native tokens. For example, the quantity of tokens held at the current block time is equal to adding the net inflow of native tokens at the current block time to the cumulative amount of native tokens at historical block times. Among them, the first-generation token behaviors refer to the behaviors of conducting various transactions, minting, and burning of tokens in the native tokens of the blockchain; the first account refers to the account in the blockchain that holds native tokens.

[0046] In another alternative embodiment, the at least one token further includes non-native tokens, and the behavior distribution data further includes the proportion of tokens held. Among them, non-native tokens are tokens created through smart contracts on the blockchain. That is, they are non-fungible tokens (Non-Fungible Tokens, NFTs) that meet the ERC-721 standard.

[0047] Specifically, calculate the corresponding behavior distribution data of each account in each token based on multiple token behaviors, including: filtering out the second-generation token behaviors corresponding to non-native tokens from multiple token behaviors according to a preset identification character. Calculate the net inflow of non-native tokens of the second account corresponding to non-native tokens based on the second-generation token behaviors. For example, the calculation method can be the token acceptance amount minus the token transfer amount. Determine the number of tokens held by the second account corresponding to the current block time based on the net inflow of non-native tokens. For example, the number of tokens held corresponding to the current block time is equal to the net inflow of native tokens at the current block time plus the accumulated amount of native tokens at historical block times. Calculate the proportion of tokens held corresponding to the second account based on the number of tokens held by the second account and the total sum of the number of tokens held by all second accounts corresponding to non-native tokens. For example, the calculation method can be that the proportion of tokens held corresponding to a certain account is equal to the number of tokens held by that account divided by the total sum of the number of tokens held by all accounts. Among them, the second-generation token behavior refers to the behavior of conducting various transactions, minting, and burning of tokens in non-native tokens of the blockchain; the second account refers to the account in the blockchain that holds non-native tokens.

[0048] S130. Determine whether there are abnormal behaviors in the blockchain based on the behavior distribution data and regulatory requirements.

[0049] Specifically, determine whether there are abnormal behaviors in the blockchain based on the behavior distribution data and regulatory requirements, including: parsing the regulatory requirements to obtain the accounts to be supervised, tokens to be supervised, or token behaviors to be supervised corresponding to the block data; determining whether there are token behaviors of the accounts to be supervised based on the behavior distribution data, determining whether there are accounts initiating token behaviors for the tokens to be supervised based on the behavior distribution data, or determining whether the token behaviors to be supervised are abnormal based on the behavior distribution data; if there are token behaviors of the accounts to be supervised, there are accounts initiating token behaviors for the tokens to be supervised, or the token behaviors to be supervised are abnormal, then determine that there are abnormal behaviors in the blockchain.

[0050] In the embodiments of the present application, the supervision methods of the abnormal detection module in the monitoring platform for blockchain abnormal behaviors can be the following three situations: First, the account address of the account to be supervised can be included in the account blacklist. When an account in the account blacklist conducts token behaviors (such as transactions, etc.) or other operations, it can be determined that there are abnormal behaviors in the blockchain, and then a warning can be issued to react to the behaviors of the account in a timely manner. Second, the contract address of the token to be supervised can be included in the token blacklist. When an account initiates token behaviors (such as transactions, etc.) related to the token in the token blacklist, it can be determined that there are abnormal behaviors in the blockchain, and then a warning can be issued to react to the behaviors of the token in a timely manner. Third, the token behaviors to be supervised can be at least one of transaction behaviors, minting behaviors, and burning behaviors. Analyze the behavior distribution data according to the preset supervision rules to determine whether there are abnormal token behaviors to be supervised. If there are abnormalities, it can be determined that there are abnormal behaviors in the blockchain, and then a warning can be issued to react to the behaviors of the token in a timely manner.

[0051] Furthermore, the token behaviors include transaction behaviors, minting behaviors, and burning behaviors; determining whether there are abnormal token behaviors to be supervised based on the behavior distribution data includes at least one of the following methods: determining whether each transaction behavior is greater than the maximum transaction amount based on the behavior distribution data; determining whether each minting behavior is greater than the maximum minting amount of the minted tokens based on the behavior distribution data; determining whether each burning behavior is greater than the maximum burning amount of the burned tokens based on the behavior distribution data; determining whether the number of tokens held by a single account is greater than the maximum number of tokens held based on the behavior distribution data; determining whether the proportion of tokens held by a single account is greater than the maximum proportion of tokens held based on the behavior distribution data.

[0052] At least one blockchain behavior abnormal detection method can be set according to the supervision requirements of the supervisor. The following Table 2 shows the token behaviors and behavior distribution information that can be used to set the abnormal detection method:

[0053] Table 2: Token Behaviors and Behavior Distribution Information for Setting Abnormal Detection Methods

[0054]

[0055]

[0056] In an alternative embodiment, the blockchain behavior detection method of the present application further includes: when there is an abnormal behavior in the blockchain, generating a warning prompt message; sending the warning prompt message to the regulatory party corresponding to the regulatory requirement, where the warning prompt message is used to prompt the regulatory party that there is an abnormal behavior in the blockchain. For the function of setting warning conditions, the monitoring platform supports monitoring multiple different regulatory parties at the same time, as well as different regulatory requirements of the same regulatory party. According to the regulatory requirements of different regulatory parties for different blockchain abnormal behaviors, different regulatory requirements of different regulatory parties can be met by setting different warning conditions.

[0057] Optionally, the regulatory party can set warning conditions by simultaneously targeting multiple token behaviors or behavior distribution information to achieve more refined and customized warning conditions. For example: the regulatory party can set the "contract address of the token to be supervised" as "Address", the account address as "Account", and the proportion of tokens held by the account as "50%". Then, when the proportion of tokens with the contract address of Address held by the account Account exceeds 50%, it will be regarded as an abnormal behavior on the blockchain, and a warning will be sent to the regulatory party that sets the warning condition.

[0058] The technical solution provided in this embodiment obtains block data corresponding to the current block time from the blockchain; analyzes the token behaviors in the block data to obtain corresponding behavior distribution data; and determines whether there is an abnormal behavior in the blockchain based on the behavior distribution data and regulatory requirements. The monitoring platform of the present application reads the block data on the supervised blockchain, extracts the token behaviors of various tokens in the block data, and infers and analyzes the corresponding behavior distribution data; the present application can set regulatory requirements on the monitoring platform, and based on the behavior distribution data and regulatory requirements, it can further explore whether there are abnormal token behaviors in the blockchain; it can meet the different regulatory requirements of multiple different regulatory parties.

[0059] In an embodiment of an actual application, the specific application scenarios of the blockchain behavior detection method of the present application include but are not limited to: Rug Pull event detection, phishing fraud detection, and Ponzi scheme detection, etc. In different application scenarios, the main processes of the blockchain behavior detection method of the present application are the same, and the difference lies in the alarm conditions set by the regulatory party.

[0060] Taking the Rug Pull event detection as an example, Rug Pull refers to the behavior in the decentralized finance and cryptocurrency markets where developers or project parties suddenly withdraw funds and run away after obtaining users' funds through malicious means. Attackers usually achieve this by means of massive token selling, massive token minting, and massive withdrawal of token liquidity in decentralized exchanges. Based on these attack methods, the regulatory authorities can set corresponding alarm conditions to timely detect Rug Pull events and implement corresponding measures.

[0061] The alarm conditions that can be adopted for detecting Rug Pull events include, but are not limited to: (1) Monitoring abnormal token behaviors. For example, if a certain account mints a large number of tokens, this account can launch an attack by selling these minted tokens in large quantities; (2) Monitoring abnormal token distributions. For example, if a certain account holds an excessive proportion of tokens in the market, this account can manipulate the token price and launch an attack by holding a large number of tokens.

[0062] Figure 2 The structural schematic diagram of a behavior detection device for a blockchain provided by an embodiment of this application is as Figure 2 shown. The device 200 may include:

[0063] A data acquisition module 210, configured to acquire block data corresponding to the current block time from the blockchain;

[0064] A data analysis module 220, configured to analyze the token behaviors in the block data to obtain corresponding behavior distribution data;

[0065] A behavior detection module 230, configured to determine whether there is any abnormal behavior in the blockchain based on the behavior distribution data and regulatory requirements.

[0066] Furthermore, the above data analysis module 220 may specifically be configured to: extract at least one token from the block data; determine all holding accounts corresponding to each token to obtain corresponding multiple accounts; acquire multiple token behaviors performed by each account on each token; and calculate the behavior distribution data corresponding to each account in each token based on the multiple token behaviors.

[0067] In one embodiment, the at least one token includes a native token, and the behavior distribution data further includes the quantity of tokens held;

[0068] Further, the above data analysis module 220 can also be specifically configured to: obtain the first token behavior corresponding to the native token from the multiple token behaviors; calculate the net inflow of the native token of the first account corresponding to the native token based on the first token behavior; and determine the number of tokens held by the first account at the current block time based on the net inflow of the native token.

[0069] In one embodiment, the at least one token further includes a non-native token, and the behavior distribution data further includes the token holding ratio.

[0070] Further, the above data analysis module 220 can also be specifically configured to: obtain the second token behavior corresponding to the non-native token from the multiple token behaviors; calculate the net inflow of the non-native token of the second account corresponding to the non-native token based on the second token behavior; determine the number of tokens held by the second account at the current block time based on the net inflow of the non-native token; and calculate the token holding ratio corresponding to the second account based on the number of tokens held by the second account and the total number of tokens held by all second accounts corresponding to the non-native token.

[0071] Further, the above behavior detection module 230 can be specifically configured to: parse the regulatory requirements to obtain the account to be regulated, the token to be regulated, or the token behavior corresponding to the block data; determine whether there is a token behavior for the account to be regulated based on the behavior distribution data, determine whether there is an account initiating a token behavior for the token to be regulated based on the behavior distribution data, or determine whether the token behavior to be regulated is abnormal based on the behavior distribution data; if there is a token behavior for the account to be regulated, there is an account initiating a token behavior for the token to be regulated, or the token behavior to be regulated is abnormal, then determine that there is an abnormal behavior in the blockchain.

[0072] In one embodiment, the token behavior includes a transaction behavior, a minting behavior, and a burning behavior; determining whether the token behavior to be regulated is abnormal based on the behavior distribution data includes at least one of the following methods: determining whether each transaction behavior is greater than the maximum transaction amount based on the behavior distribution data; determining whether each minting behavior is greater than the maximum minting amount of the minted token based on the behavior distribution data; determining whether each burning behavior is greater than the maximum burning amount of the burned token based on the behavior distribution data; determining whether the number of tokens held by a single account is greater than the maximum number of tokens held based on the behavior distribution data; and determining whether the token holding ratio of a single account is greater than the maximum token holding ratio based on the behavior distribution data.

[0073] Further, the above-mentioned behavior detection device of the blockchain may further include: an anomaly warning module;

[0074] The anomaly warning module is configured to generate a warning prompt message when there is an abnormal behavior in the blockchain; and send the warning prompt message to the supervisor corresponding to the supervision requirement, where the warning prompt message is used to prompt the supervisor that there is an abnormal behavior in the blockchain.

[0075] The behavior detection device of the blockchain provided in this embodiment can be applied to the behavior detection method of the blockchain provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0076] Figure 3 It is a block diagram of an electronic device for implementing a behavior detection method of a blockchain according to an embodiment of the present application. The electronic device 10 is intended to represent various forms of digital computers, such as, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present application described and / or claimed herein.

[0077] As Figure 3 shown, the electronic device 10 includes at least one processor 11, and a memory communicatively connected to at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc. Among them, the memory stores a computer program executable by at least one processor, and the processor 11 can execute various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0078] Multiple components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disc, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0079] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the behavior detection method of the blockchain.

[0080] In some embodiments, the behavior detection method of the blockchain can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the behavior detection method of the blockchain described above can be executed. Alternatively, in other embodiments, the processor 11 can be configured to execute the behavior detection method of the blockchain in any other suitable way (e.g., by means of firmware).

[0081] The various embodiments of the systems and technologies described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, the programmable processor can be a dedicated or general-purpose programmable processor, can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit the data and instructions to the storage system, the at least one input device, and the at least one output device.

[0082] A computer program for implementing the method of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer programs are executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a stand-alone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0083] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0084] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which the user can provide input to the electronic device. Other kinds of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and the input received from the user can be in any form (including acoustic input, voice input, or tactile input).

[0085] The systems and techniques described herein can be implemented in a computing system including backend components (e.g., as a data server), or a computing system including middleware components (e.g., an application server), or a computing system including frontend components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described herein), or a computing system including any combination of such backend, middleware, or frontend components. The components of the system can be interconnected to each other by digital data communication in any form or medium (e.g., a communication network). Examples of communication networks include: local area network (LAN), wide area network (WAN), blockchain network, and the Internet.

[0086] A computing system can include a client and a server. The client and the server are generally remote from each other and typically interact through a communication network. The client-server relationship is created by computer programs running on respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system, and solves the defects of difficult management and weak business scalability existing in traditional physical hosts and VPS services.

[0087] Note that the above are only the preferred embodiments of the present application and the applied technical principles. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and various obvious changes, re-adjustments, and substitutions can be made by those skilled in the art without departing from the protection scope of the present application. For example, those skilled in the art can use various forms of processes shown above, re-order, add, or delete steps; the steps described in the present application can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present application can be achieved, and no limitations are made herein.

[0088] The above specific implementation manners do not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present application shall be included within the protection scope of the present application.

Claims

1. A behavior detection method for blockchain, characterized in that: The method comprises: Get the block data corresponding to the current block time from the blockchain; Analyzing the token behaviors in the block data to obtain corresponding behavior distribution data, including: extracting at least one token from the block data; determining all holding accounts corresponding to each token to obtain a plurality of corresponding accounts; obtaining a plurality of token behaviors performed by each account on each token; and calculating the behavior distribution data corresponding to each account in each token based on the plurality of token behaviors; Determining whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements; Among them, the at least one token includes a native token, and the behavior distribution data also includes the number of tokens held; the calculation of the corresponding behavior distribution data of each account in each token based on the multiple token behaviors includes: obtaining the first token behavior corresponding to the native token from the multiple token behaviors; calculating the native token net inflow of the first account corresponding to the native token based on the first token behavior; and determining the number of tokens held by the first account at the current block time based on the native token net inflow.

2. The behavior detection method of blockchain according to claim 1 is characterized in that: The at least one token further includes a non-native token, and the behavior distribution data further includes a proportion of tokens held; and the calculation of the behavior distribution data corresponding to each account in each token based on the multiple token behaviors includes: Obtaining a second token behavior corresponding to the non-native token from the multiple token behaviors; Calculate the net inflow of the non-native token of the second account corresponding to the non-native token based on the second token behavior; Determine the number of tokens held by the second account at the current block time based on the net inflow of the non-native token; Based on the number of tokens held by the second account and the sum of the number of tokens held by all second accounts corresponding to the non-native token, the proportion of tokens held by the second account is calculated.

3. The behavior detection method of blockchain according to claim 1 is characterized in that: The determining whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements includes: Parsing the regulatory requirements to obtain the accounts to be regulated, the tokens to be regulated, or the token behaviors to be regulated corresponding to the block data; Determine whether the account to be regulated has any token behavior based on the behavior distribution data, determine whether an account has initiated token behavior on the token to be regulated based on the behavior distribution data, or determine whether the behavior of the token to be regulated is abnormal based on the behavior distribution data; If the account to be regulated has token behavior, an account has initiated token behavior on the token to be regulated, or the token behavior to be regulated is abnormal, it is determined that the blockchain has abnormal behavior.

4. The behavior detection method of blockchain according to claim 3 is characterized in that: The token behaviors include trading behaviors, minting behaviors, and destruction behaviors; determining whether the behaviors of the tokens to be regulated are abnormal based on the behavior distribution data includes at least one of the following methods: Determine whether each transaction behavior is greater than a maximum transaction amount based on the behavior distribution data; Determine whether each minting behavior is greater than the maximum minting amount of the minted token based on the behavior distribution data; Determine whether each destruction behavior is greater than the maximum destruction amount of the destroyed tokens based on the behavior distribution data; Determining whether the number of tokens held by a single account is greater than the maximum number of tokens held based on the behavior distribution data; Based on the behavior distribution data, determine whether the token holding ratio of a single account is greater than the maximum token holding ratio.

5. The behavior detection method of blockchain according to claim 1 is characterized in that: The method further comprises: When the blockchain has abnormal behavior, generate early warning information; The early warning prompt information is sent to the supervisory party corresponding to the supervision requirement, and the early warning prompt information is used to prompt the supervisory party that the blockchain has abnormal behavior.

6. A behavior detection device for blockchain, characterized in that: For implementing the behavior detection method of blockchain according to claim 1, the device comprises: The data acquisition module is used to obtain the block data corresponding to the current block time from the blockchain; A data analysis module, used to analyze the token behavior in the block data to obtain corresponding behavior distribution data; A behavior detection module is used to determine whether the blockchain has abnormal behavior based on the behavior distribution data and regulatory requirements.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blockchain behavior detection method described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the behavior detection method of the blockchain according to any one of claims 1 to 5 when executed.

Images