Classification method of blockchain nodes, client device and storage medium

Abstract

The invention is applicable to the technical field of block chains, and provides a block chain node classification method, client equipment and a storage medium, the method is applied to a client, the client is deployed in a block chain in a full-node manner, and the method comprises the following steps: collecting traffic data of a plurality of nodes in a current block chain; extracting flow characteristics of each node from the flow data, wherein the flow characteristics comprise characteristics in multiple dimensions; according to the flow characteristics in the multiple dimensions, each node is pre-classified; and clustering the pre-classification result of each node, and determining the node type of each node. According to the scheme, the behavior pattern of the nodes can be fully reflected while node classification is realized.

Description

Technical Field

[0001] The present application belongs to the field of blockchain technology, and in particular relates to a classification method for blockchain nodes, a client device, and a storage medium. Background Art

[0002] Blockchain technology is a distributed system based on P2P networks, which consists of many different types of nodes. The behavior patterns of these nodes will directly affect the security of the blockchain network, so it is necessary to adopt relevant technical means to classify and supervise the nodes in the blockchain network. Existing technologies usually identify different types of nodes by counting the transaction information and block information of the nodes and analyzing the network topology, but the above methods cannot accurately describe the behavior patterns of the nodes, so it is necessary to seek a new classification method. Summary of the invention

[0003] The purpose of this application is to provide a blockchain node classification method, apparatus, client device and storage medium, which can fully reflect the node behavior pattern while realizing node classification.

[0004] A first aspect of an embodiment of the present application provides a method for classifying blockchain nodes, which is applied to a client, wherein the client is deployed in a blockchain in a full-node manner, and the method includes:

[0005] Collect traffic data of multiple nodes in the current blockchain;

[0006] Extracting traffic features of each node from the traffic data, wherein the traffic features include features in multiple dimensions;

[0007] Pre-classifying each of the nodes according to the traffic characteristics in the multiple dimensions;

[0008] Clustering is performed on the pre-classification results of each node to determine the node type of each node.

[0009] In an optional embodiment, the traffic feature includes traffic size, and extracting the traffic feature of each node from the traffic data includes:

[0010] Obtain the amount of traffic data corresponding to each node within a preset time period, wherein the traffic data includes transaction data, block data, and consensus data;

[0011] The amounts of the transaction data, the block data and the consensus data of each node in a unit time period are calculated respectively as the traffic size of each node, where the traffic size includes the transaction data traffic size, the block data traffic size and the consensus data traffic size.

[0012] In an optional embodiment, the traffic feature further includes traffic frequency, and the extracting the traffic feature of each node from the traffic data further includes:

[0013] For each type of traffic data, respectively calculate the average value of the sum of time intervals of the traffic data of the type at any node;

[0014] The reciprocal of the average value is used as the traffic frequency corresponding to the type of traffic data, and the traffic frequency includes transaction data traffic frequency, block data traffic frequency and consensus data traffic frequency.

[0015] In an optional embodiment, the traffic feature further includes a traffic pattern and a traffic type, the traffic pattern includes a periodic traffic pattern or a non-periodic traffic pattern, the traffic type includes a transaction data type, a block data type or a consensus data type, and the extracting of the traffic feature of each node from the traffic data further includes:

[0016] Analyze the frequency domain data corresponding to the traffic data of each node, and determine the traffic pattern of the node that conforms to the periodic change law as a periodic traffic pattern;

[0017] Obtain the number of each type of traffic data corresponding to each node, and calculate the total number of traffic data corresponding to each node;

[0018] Based on the total amount of the traffic data, respectively calculate the proportion of each type of traffic data;

[0019] The type of the traffic data whose ratio is greater than the corresponding threshold is determined as the traffic type of the node.

[0020] In an optional embodiment, the pre-classifying each node according to the traffic characteristics in the multiple dimensions includes:

[0021] According to the traffic size, traffic frequency, traffic pattern and / or traffic type of each node, each node is classified as a verification node, a normal node or a malicious node; wherein the traffic size and traffic frequency of the verification node are both greater than the corresponding threshold value, and the traffic pattern of the verification node is a periodic traffic pattern; the traffic size and traffic frequency of the malicious node are greater than the corresponding maximum value or less than the corresponding minimum value, and the traffic pattern of the verification node is a non-periodic traffic pattern.

[0022] In an optional embodiment, the pre-classification result includes a plurality of pre-classified node sets of different node types, each node in each pre-classified node set has the same node type, and clustering the pre-classification result of each node to determine the node type of each node includes:

[0023] Clustering each node in each pre-classified node set to obtain a clustering score of each node;

[0024] When the clustering score of any node is greater than a preset score threshold, the node is deleted from the current pre-classified node set;

[0025] The pre-classified node set after deleting all nodes whose clustering scores are greater than the preset score threshold is used as the final node classification set, and the node type of any node is the same as the type of the node classification set in which it belongs.

[0026] In an optional embodiment, clustering each node in each pre-classified node set to obtain a clustering score of each node includes:

[0027] Select K nodes as initial cluster centers in each pre-classified node set, and each initial cluster center corresponds to a cluster;

[0028] Determine the cluster corresponding to each node according to the distance between each node and each initial cluster center;

[0029] Repeating the iterative operation until the updated cluster center remains unchanged, the iterative operation includes: setting the average value of the feature vectors of all nodes in each cluster as the updated cluster center, combining the distance between each node and each updated cluster center, and re-determining the cluster corresponding to each node;

[0030] The clustering score of each node is determined according to the distance between each node in each cluster and the corresponding updated cluster center and the preset corresponding relationship between the distance and the clustering score.

[0031] In an optional embodiment, determining the cluster corresponding to each node according to the distance between each node and each initial cluster center includes:

[0032] The classification operation is repeatedly performed until the cluster corresponding to each node is determined, and the classification operation includes: calculating the distance between any node in the pre-classified node set and each initial cluster center, determining the initial cluster center with the smallest distance to the node as the initial cluster center corresponding to the node, and determining the cluster corresponding to the initial cluster center as the cluster corresponding to the node.

[0033] A second aspect of an embodiment of the present application provides a classification device for blockchain nodes, including:

[0034] A collection module, used to collect traffic data of multiple nodes in the current blockchain, wherein the traffic data includes received traffic data and / or output traffic data;

[0035] An extraction module, used to extract the traffic features of each node from the traffic data, wherein the traffic features include features in multiple dimensions;

[0036] A pre-classification module, used for pre-classifying each node according to the traffic characteristics in the multiple dimensions;

[0037] The clustering module is used to cluster the pre-classification results of each node to determine the node type of each node.

[0038] A third aspect of an embodiment of the present application provides a client device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the computer program.

[0039] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0040] A fifth aspect of the embodiments of the present application provides a computer program product. When the computer program product is run on a client device, the client device executes the method described in the first aspect.

[0041] Beneficial effects of this application

[0042] By adopting the classification method, client device and storage medium of blockchain nodes provided in the present application, by monitoring the traffic data of blockchain nodes and extracting traffic features corresponding to the traffic data from multiple dimensions, it is possible to fully reflect the behavior patterns of nodes from multiple traffic feature dimensions, and by monitoring the traffic features of traffic data, it is possible to timely discover and isolate nodes with abnormal traffic, which helps to improve the security of the blockchain. In addition, the nodes are pre-classified based on the extracted traffic features, and then the pre-classification results are clustered, thereby solving the possible misclassification of the pre-classification results and further improving the accuracy of node classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 One of the flowcharts of a method for classifying blockchain nodes provided in an embodiment of the present application;

[0045] Figure 2 A second flowchart of a method for classifying blockchain nodes provided in an embodiment of the present application;

[0046] Figure 3 A flowchart of a method for classifying blockchain nodes provided in an embodiment of the present application;

[0047] Figure 4 A fourth flowchart of a method for classifying blockchain nodes provided in an embodiment of the present application;

[0048] Figure 5 A fifth flowchart of a method for classifying blockchain nodes provided in an embodiment of the present application;

[0049] Figure 6 Flow chart six of a method for classifying blockchain nodes provided in an embodiment of the present application;

[0050] Figure 7 A schematic diagram of the structure of a classification device for a blockchain node provided in an embodiment of the present application;

[0051] Figure 8 A schematic diagram of the structure of a client device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0053] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0054] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0055] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0056] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0057] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0058] It should be understood that the size of the serial numbers of the steps in this embodiment does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0059] As a distributed system architecture built on a P2P network, blockchain technology is composed of many different types of nodes at its core. The behavior patterns of these nodes are crucial to ensuring the security of the entire blockchain network. Existing management mechanisms mainly rely on transaction records, statistical analysis of block content, and analysis of network topology when monitoring and classifying these nodes, but these methods cannot accurately portray the behavior patterns of nodes. In response to this, the present application provides a classification method for blockchain nodes, a client device, and a storage medium that can fully reflect the behavior patterns of nodes while achieving node classification.

[0060] It should be noted that in a blockchain network, a node refers to a device or server that participates in the operation and maintenance of the network. It is responsible for storing blockchain data, verifying transactions, generating new blocks, and participating in the consensus process. Each node stores a copy of the blockchain, that is, a record of all transactions on the blockchain. These records are organized into a series of blocks and interconnected through encryption technology to form an unalterable data structure.

[0061] In order to illustrate the technical solution of the present application, specific embodiments are provided below.

[0062] Figure 1 A flowchart of a method for classifying blockchain nodes provided in an embodiment of the present application is shown. Figure 1 The classification method provided in the embodiment of the present application specifically includes the following steps:

[0063] Step S101: Collecting traffic data of multiple nodes in the current blockchain;

[0064] Step S102: extracting traffic features of each node from the traffic data, wherein the traffic features include features in multiple dimensions;

[0065] Step S103: pre-classifying each node according to the traffic characteristics in the multiple dimensions;

[0066] Step S104: clustering the pre-classification results of each node to determine the node type of each node.

[0067] Among them, the flow data in step S101 can be obtained through the network interface, log record or blockchain network protocol itself. The flow data collected by the client can be recorded and stored according to key information such as timestamp, data packet size, source address, and destination address. The flow data includes received flow data and / or output flow data. Received flow data refers to the data received by the node, and output flow data refers to the data sent by the node. By executing step S101, detailed flow data of each node in the blockchain can be obtained. These data can reflect the network activity of the node and are an important basis for subsequent node classification, identification of node behavior patterns, and detection of abnormal or malicious behavior.

[0068] The traffic features in step S102 include features in multiple dimensions, including at least one of traffic size, traffic frequency, traffic pattern and traffic type. By extracting traffic features, the original traffic data can be converted into traffic feature data with analytical value, providing effective input for subsequent pre-classification and clustering analysis, and laying the foundation for identifying different types of nodes.

[0069] In step S103, a machine learning classification algorithm (such as decision tree, random forest, K-nearest neighbor, etc.) or a statistical classification algorithm can be used to pre-classify each node according to the extracted traffic features. The classification algorithm will divide the nodes into different node types according to the similarities and differences between the features. Based on the traffic features of each node, the node types can be specifically divided into verification nodes, ordinary nodes, and malicious nodes. Step S103 can preliminarily divide the nodes in the blockchain into different categories through pre-classification, provide direction for subsequent in-depth analysis, and narrow the scope of subsequent analysis, thereby improving the efficiency and accuracy of classification.

[0070] In step S104, based on the pre-classification, the pre-classification results of the nodes are further clustered and analyzed for optimization, so that different types of nodes in the blockchain can be more accurately identified. Specifically, an unsupervised learning algorithm can be used to perform cluster analysis on the pre-classification results. The unsupervised learning algorithm can specifically use a K-means algorithm, a DBSCAN algorithm, and the like.

[0071] Exemplarily, the API interface in the client is used to collect the receiving traffic data and output traffic data of multiple nodes in the blockchain; the traffic features of the collected traffic data are extracted from four dimensions, namely, traffic size, traffic frequency, traffic pattern and traffic type, to obtain the traffic size, traffic frequency, traffic pattern and traffic type corresponding to each node; based on the above traffic features, possible node types are determined to include verification nodes, ordinary nodes and malicious nodes, and each node is pre-classified using a machine learning classification algorithm, and nodes with similar traffic features are assigned to the same node type to obtain a pre-classified node set corresponding to each node type; the K-means algorithm is used to perform cluster analysis on the pre-classified node sets corresponding to each node type to further clarify the nodes corresponding to each node type, thereby improving the accuracy of node classification.

[0072] In this embodiment, by real-time monitoring of the traffic data of each node in the blockchain and in-depth extraction of its traffic characteristics from multiple dimensions, it is possible to fully reflect the behavior pattern of the node from multiple traffic characteristic dimensions, and by closely monitoring the traffic characteristics of the traffic data, it is possible to quickly identify and isolate nodes with abnormal behavior, thereby significantly improving the overall security protection capability of the blockchain system. In addition, based on the extracted traffic characteristics, the nodes are firstly classified, and then the clustering algorithm is used to optimize and integrate the preliminary classification results, which can not only effectively correct possible misclassification situations and enhance the accuracy of node classification, but also realize the visualization expression of node classification through clustering analysis, thereby promoting the ability to identify nodes of different categories, making node management in the blockchain network more efficient and accurate.

[0073] It should be noted that the classification method of blockchain nodes provided in the embodiment of the present application is applied to the client, which has strong traffic monitoring capabilities, can collect traffic data in real time, and is deployed in the blockchain as a full node to ensure that it can receive and send transactions, blocks and other information in the network.

[0074] The flow feature extraction process in step S102 is described in detail below.

[0075] In an embodiment that can be implemented in the present application, the flow characteristics in step S102 are set to include flow size, which can be obtained by calculating the number of times the node receives and sends flow data per unit time. Figure 2 Step S102 may specifically include the following steps:

[0076] Step S201: Obtain the amount of traffic data corresponding to each node within a preset time period, where the traffic data includes transaction data, block data, and consensus data;

[0077] Step S202: Calculate the amount of the transaction data, the block data and the consensus data of each node in a unit time period respectively as the traffic size of each node, where the traffic size includes the transaction data traffic size, the block data traffic size and the consensus data traffic size.

[0078] Among them, transaction data includes information such as the node that first broadcasts the transaction, transaction hash value, timestamp, etc.; block data includes information such as the node that first broadcasts the block, block hash value, timestamp, etc.; consensus data includes information such as node ID, node voting record, node proposal information, node verification information, etc.; step S201 provides a basis for subsequent analysis and calculation by collecting the number of transaction data, block data and consensus data processed by each node within a preset time period; execute step S202, take the number of transaction data, the number of block data and the number of consensus data as numerators, take the preset time period as the denominator, calculate the number of transaction data processed by each node within a unit time period, and obtain the transaction data flow size of each node, calculate the number of block data processed by each node within a unit time period, and obtain the block data flow size of each node, calculate the number of consensus data processed by each node within a unit time period, and obtain the consensus data flow size of each node, and the flow size corresponding to different flow data in each node calculated by step S202 can be used to measure the activity and processing capacity of the node.

[0079] For example, the specific calculation formula of the flow size is as follows:

[0080]

[0081] in, It indicates the number of different types of traffic data in the T time period, including the number of transaction data, block data and consensus data. T is the length of the preset time period. Due to the need for real-time monitoring, a short time window is used for statistics, such as 1-5 minutes.

[0082] It should be noted that the traffic data of each node also includes node data, which includes data such as the connection node ID, connection node IP, and connection node duration, which are used to distinguish different traffic sources and targets between blockchain nodes.

[0083] In one embodiment that can be implemented in the present application, the flow characteristics in step S102 are set to also include flow frequency. Specifically, the flow frequency of the node can be obtained by calculating the average time interval for the node to obtain flow data. Figure 3 Step S102 specifically further includes the following steps:

[0084] Step S301: for each type of flow data, respectively calculate the average value of the sum of time intervals of the flow data of the type at any node;

[0085] Step S302: taking the reciprocal of the average value as the traffic frequency corresponding to the type of traffic data, the traffic frequency including transaction data traffic frequency, block data traffic frequency and consensus data traffic frequency.

[0086] Exemplarily, for the transaction data of any node, determine the timestamps corresponding to each transaction data of the node within a preset time period, calculate the average value of the sum of the time intervals between two adjacent transaction data, and use the inverse of the average value as the transaction data traffic frequency of the node; for the block data of any node, determine the timestamps corresponding to each block data of the node within a preset time period, calculate the average value of the sum of the time intervals between two adjacent block data, and use the inverse of the average value as the block data traffic frequency of the node; for the consensus data of any node, determine the timestamps corresponding to each consensus data of the node within a preset time period, calculate the average value of the sum of the time intervals between two adjacent consensus data, and use the inverse of the average value as the consensus data traffic frequency of the node.

[0087] Exemplarily, the specific calculation formula of the flow frequency is as follows:

[0088]

[0089] Among them, N is the number of different types of traffic data corresponding to each in the T time period, including the number of transaction data, block data and consensus data. i Indicates the start time of each time interval corresponding to each type of traffic data collected by each node, Ti+1 Indicates the end time of each time interval corresponding to each type of traffic data collected by each node.

[0090] Calculating the traffic frequencies of different types of traffic data of nodes through the above embodiments helps to understand and analyze the behavior patterns of nodes, such as transaction processing speed, block generation speed, and efficiency of consensus mechanisms, and provides data reference for node classification and supervision.

[0091] In another embodiment that can be implemented in the present application, the flow characteristics in step S102 are set to also include a flow pattern and a flow type, the flow pattern includes a periodic flow pattern or a non-periodic flow pattern, the flow type includes a transaction data type, a block data type or a consensus data type, and the corresponding reference Figure 4 Step S102 specifically further includes the following steps:

[0092] Step S401: Analyze the frequency domain data corresponding to the flow data of each node, and determine the flow pattern of the node that conforms to the periodic change law as a periodic flow pattern;

[0093] Step S402: Obtain the quantity of each type of flow data corresponding to each node, and calculate the total quantity of flow data corresponding to each node;

[0094] Step S403: Based on the total amount of the traffic data, respectively calculate the proportion of each type of traffic data;

[0095] Step S404: Determine the type of the traffic data with a ratio greater than a corresponding threshold as the traffic type of the node.

[0096] In the above step S401, frequency domain data refers to the representation of time domain signals in the frequency spectrum. By performing mathematical processing such as Fourier transform on the time domain signals, the time domain signals can be converted into frequency domain data. Frequency domain data analysis is mainly used to identify periodic components in the signal. As a time domain signal, the flow data is subjected to mathematical processing such as Fourier transform to convert it into corresponding frequency domain data. The flow pattern of the node whose frequency domain data conforms to the law of periodic change is determined as a periodic flow pattern, and the flow pattern of the node whose frequency domain data does not conform to the law of periodic change is determined as a non-periodic flow pattern. Step S401 can accurately identify the flow pattern of the node, which helps to understand and analyze the behavior pattern of the node.

[0097] Exemplarily, the flow data may be converted into frequency domain data by using the following calculation formula:

[0098]

[0099] Among them, X(k) is the amplitude of different frequency components, N is the number of sample points, that is, the length of the time series, x(n) is the time series data, including the transaction data, block data and consensus data of each node, i is the imaginary unit, and k is the frequency index, ranging from 0 to N-1.

[0100] For a non-periodic traffic pattern, that is, a bursty traffic pattern, the discrete degree of the traffic data can be calculated using the following formula.

[0101]

[0102] Among them, x represents the current number of transaction data, block data and consensus data, μ represents the mean of the traffic, σ is the standard deviation of the traffic, and z represents the degree of dispersion of each type of current traffic data relative to the mean of the traffic.

[0103] It should be noted that, when the z value is larger or smaller, it means that the traffic data will be bursty, and the corresponding traffic pattern is a non-periodic traffic pattern.

[0104] In the above steps S402 to S404, the number of transaction data, block data and consensus data corresponding to each node are counted and summed to obtain the total number of traffic data. The number of transaction data, block data and consensus data are used as numerators, respectively, and the total number of traffic data is used as the denominator. The proportion of transaction data type, the proportion of block data type and the proportion of consensus data type are calculated respectively, and the traffic type with a proportion greater than the corresponding threshold is determined as the traffic type of the corresponding node. Exemplarily, the corresponding thresholds of the three traffic data types can be set to 34%.

[0105] Exemplarily, the specific calculation formula for the traffic type ratio is as follows:

[0106]

[0107] Among them, s represents the corresponding quantity of different types of traffic data, including the number of transaction data, the number of block data and the number of consensus data, and G represents the total amount of traffic data.

[0108] Exemplarily, the number of transaction data of the node is set to 50, the number of block data is set to 40, the number of consensus data is set to 10, and the corresponding total amount of traffic data is set to 100. By calculation, the proportion of transaction data type is 50%, the proportion of block data type is 40%, and the proportion of consensus data type is 10%. Since the proportions of transaction data type and block data type are both greater than 34%, the transaction data type and block data type are determined as the traffic type of the node.

[0109] The above embodiment determines the traffic type of the node by the ratio of different types of traffic data, which helps to understand and analyze the behavior pattern of the node from multiple dimensions. In addition, the present application monitors the traffic data from four dimensions: traffic size, traffic frequency, traffic pattern, and traffic type. If a sudden traffic peak is found, it may indicate the occurrence of a DDoS attack. Through real-time multi-dimensional monitoring, the present application can improve the efficiency and accuracy of identifying nodes at risk.

[0110] In an embodiment that can be implemented in the present application, step S103 specifically includes the following steps:

[0111] According to the traffic size, traffic frequency, traffic pattern and / or traffic type of each node, each node is classified as a verification node, a normal node or a malicious node; wherein the traffic size and traffic frequency of the verification node are both greater than the corresponding threshold value, and the traffic pattern of the verification node is a periodic traffic pattern; the traffic size and traffic frequency of the malicious node are greater than the corresponding maximum value or less than the corresponding minimum value, and the traffic pattern of the verification node is a non-periodic traffic pattern.

[0112] It should be noted that the verification node is responsible for verifying transactions and generating new blocks, and has a higher traffic size and traffic frequency. The verification node receives and sends a large amount of data per unit time, and the block generation and verification process is periodic. Therefore, the verification node has an obvious periodic traffic pattern, and the proportion of block data type and consensus data type is high; ordinary nodes are responsible for receiving and forwarding transactions and block data, with a high proportion of transaction data type, relatively stable data transmission, medium traffic size and traffic frequency, and non-periodic traffic pattern; the corresponding thresholds of the verification node traffic size and traffic frequency can be set according to the traffic size and traffic frequency of all nodes , at least the traffic size and traffic frequency of the verification node need to be higher than the traffic size and traffic frequency of the ordinary node respectively; malicious nodes usually send irregular data traffic to try to disrupt the normal operation of the blockchain network, which is a non-periodic traffic pattern. Its traffic size and traffic frequency are prone to show extreme values, which may be too high or too low, that is, greater than the corresponding maximum value or less than the corresponding minimum value, depending on its attack strategy; the maximum and minimum values ​​can be set according to the traffic size and traffic frequency of all nodes, at least the traffic size and traffic frequency of the malicious node need to be much higher than the traffic size and traffic frequency of the verification node, or much lower than the traffic size and traffic frequency of the ordinary node.

[0113] The above method pre-classifies nodes according to their traffic size, traffic frequency, traffic pattern and traffic type, which helps to improve the efficiency of subsequent clustering analysis and is helpful for the management and maintenance of blockchain networks, especially in identifying potential security threats and ensuring network stability.

[0114] In an embodiment that can be implemented in the present application, the pre-classification result of step S103 includes a plurality of pre-classified node sets of different node types, and each node in each pre-classified node set has the same node type, that is, the pre-classified result includes a pre-classified node set of verification nodes, a pre-classified node set of common nodes, and a pre-classified node set of malicious nodes. Then, cluster analysis is performed on the pre-classified results, and the corresponding reference Figure 5 , step S104 specifically includes the following steps:

[0115] Step S501: clustering each node in each pre-classified node set to obtain a clustering score of each node;

[0116] Step S502: when the clustering score of any node is greater than a preset score threshold, the node is deleted from the current pre-classified node set;

[0117] Step S503: the pre-classified node set after deleting all nodes whose clustering scores are greater than the preset score threshold is used as the final node classification set, and the node type of any node is the same as the type of the node classification set.

[0118] The clustering score in step S501 can be obtained by calculating the distance between each node in each pre-classified node set and the corresponding cluster center. Step S501 can specifically adopt an unsupervised learning algorithm to cluster the nodes in each pre-classified node set based on the traffic feature data and node data of the nodes to obtain the location data of the cluster center, so as to calculate the clustering score corresponding to each node; wherein the traffic feature data and node data of the specific node include: connection node ID, connection node IP, transaction data traffic size, block data traffic size, consensus data traffic size, transaction data traffic frequency, block data traffic frequency, consensus data traffic frequency, traffic pattern category (periodic traffic pattern or non-periodic traffic pattern), proportion of transaction data type, proportion of block data type and proportion of consensus data type;

[0119] Step S502 traverses each node in the pre-classified node set to determine whether the clustering score of each node is greater than a preset score threshold. If so, the node is considered to be an abnormal node or a node with potential threats, and the node is deleted from the pre-classified node set; execute step S503 to determine the final node classification set.

[0120] It should be noted that before executing step S502, the preset score threshold can be determined in the following manner: by changing the threshold, observing the change in the number of nodes to be deleted in the clustering results, when the threshold increases to a certain extent, the reduction rate of the node data to be deleted will be significantly slowed down, then this threshold can be used as the preset score threshold.

[0121] As an example, see Figure 6 , step S501 may specifically include the following steps:

[0122] Step S601: Select K nodes in each pre-classified node set as initial cluster centers, each initial cluster center corresponds to a cluster;

[0123] Step S602: determining the cluster corresponding to each node according to the distance between each node and each initial cluster center;

[0124] Step S603: Repeat the iterative operation until the updated cluster center remains unchanged, the iterative operation includes: setting the average value of the feature vectors of all nodes in each cluster as the updated cluster center, and re-determining the cluster corresponding to each node in combination with the distance between each node and each updated cluster center;

[0125] Step S604: Determine the clustering score of each node according to the distance between each node in each cluster and the corresponding updated cluster center and the preset corresponding relationship between the distance and the clustering score.

[0126] Among them, step S602 specifically includes: repeatedly performing the classification operation until the cluster corresponding to each node is determined, and the classification operation includes: calculating the distance between any node in the pre-classified node set and each initial cluster center, determining the initial cluster center with the smallest distance to the node as the initial cluster center corresponding to the node, and determining the cluster corresponding to the initial cluster center as the cluster corresponding to the node.

[0127] Exemplarily, for each set of pre-classified nodes, K nodes are randomly selected as initial cluster centers, each initial cluster center represents the starting position of a cluster, the distance between each node and all initial cluster centers is calculated, each node is assigned to the cluster corresponding to the initial cluster center closest to it, and the average value of the characteristic vectors of all nodes in each cluster is calculated as the updated cluster center; the distance between each node and each updated cluster center is recalculated, and the nodes are reallocated to the corresponding clusters according to the new distance, and the above iterative operation is repeated until the position of the cluster center no longer changes; for each node in the cluster, the distance between it and the corresponding updated cluster center is calculated, and the clustering score is set to the distance value, then the clustering score corresponding to each node is obtained.

[0128] By clustering the pre-classification results, a more accurate node classification set can be obtained, the accuracy of node classification can be improved, and the node clustering analysis process can be visualized, thereby more effectively identifying nodes of different categories. In addition, for the deleted node, the node type of the node can be determined as a malicious node.

[0129] Figure 7 A structural diagram of a classification device for a blockchain node provided in an embodiment of the present application. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0130] The classification device may specifically include the following modules:

[0131] A collection module 701 is used to collect traffic data of multiple nodes in the current blockchain, where the traffic data includes received traffic data and / or output traffic data;

[0132] An extraction module 702 is used to extract the traffic features of each node from the traffic data, wherein the traffic features include features in multiple dimensions;

[0133] A pre-classification module 703, configured to pre-classify each node according to the traffic characteristics in the multiple dimensions;

[0134] The clustering module 704 is used to cluster the pre-classification results of each node to determine the node type of each node.

[0135] The acquisition module 701 obtains detailed traffic data of each node in the blockchain. These data can reflect the network activity of the node and are an important basis for subsequent node classification, identification of node behavior patterns, and detection of abnormal or malicious behaviors. The extraction module 702 extracts traffic features to obtain traffic feature data, providing data support for subsequent identification of node types. The pre-classification module 703 pre-classifies each node according to the extracted traffic features, and preliminarily divides the nodes in the blockchain into different categories, providing direction for subsequent in-depth analysis and narrowing the scope of subsequent analysis, thereby improving the efficiency of classification. The clustering module 704 further optimizes the pre-classification results of the nodes based on the pre-classification, thereby being able to more accurately identify different types of nodes in the blockchain.

[0136] By adopting the classification device provided by the present application, by monitoring the traffic data of the blockchain nodes and extracting the traffic features corresponding to the traffic data from multiple dimensions, it is possible to fully reflect the behavior patterns of the nodes from multiple traffic feature dimensions, and by monitoring the traffic features of the traffic data, it is possible to timely discover and isolate nodes with abnormal traffic, which helps to improve the security of the blockchain. In addition, the nodes are pre-classified based on the extracted traffic features, and then the pre-classification results are clustered. On the one hand, it can solve the possible misclassification of the pre-classification results and further improve the accuracy of node classification. On the other hand, it can also create portraits for the nodes through clustering operations and realize node classification visualization, so that nodes of different categories can be more effectively identified.

[0137] Figure 8 A schematic diagram of the structure of a client device provided in an embodiment of the present application. The client device 801 includes: at least one processor 802 ( Figure 8 Only one is shown in the figure) a processor, a memory 803, and a computer program 804 stored in the memory 803 and executable on the at least one processor 802, and when the processor 802 executes the computer program 804, the steps in the above method embodiment are implemented.

[0138] The client device 801 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The client device may include, but is not limited to, a processor 802 and a memory 803. Those skilled in the art will appreciate that Figure 8 This is only an example of the client device 801 and does not constitute a limitation on the client device 801 . The client device 801 may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0139] The processor 802 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0140] In some embodiments, the memory 803 may be an internal storage unit of the client device 801, such as a hard disk or memory of the client device 801. In other embodiments, the memory 803 may also be an external storage device of the client device 801, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the client device 801. Further, the memory 803 may also include both an internal storage unit of the client device 801 and an external storage device. The memory 803 is used to store an operating system, an application program, a boot loader (Boot Loader), data, and other programs, such as the program code of the computer program, etc. The memory 803 may also be used to temporarily store data that has been output or is to be output.

[0141] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0142] In the above embodiments, the description of each embodiment has its own emphasis. If a rated part is not described or recorded in detail in a certain embodiment, reference may be made to the relevant description of other embodiments.

[0143] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0144] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0145] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0146] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0147] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0148] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above units may be implemented in the form of hardware or software.

[0149] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0150] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for classifying blockchain nodes, characterized in that: Applied to a client, the client is deployed in a blockchain in a full node mode, and the method includes: Collect traffic data of multiple nodes in the current blockchain; Extracting traffic features of each node from the traffic data, wherein the traffic features include features in multiple dimensions; Pre-classifying each of the nodes according to the traffic characteristics in the multiple dimensions; Clustering is performed on the pre-classification results of each node to determine the node type of each node.

2. The method according to claim 1, characterized in that The traffic feature includes the traffic size, and the extracting the traffic feature of each node from the traffic data includes: Obtain the amount of traffic data corresponding to each node within a preset time period, wherein the traffic data includes transaction data, block data, and consensus data; The amounts of the transaction data, the block data and the consensus data of each node in a unit time period are calculated respectively as the traffic size of each node, where the traffic size includes the transaction data traffic size, the block data traffic size and the consensus data traffic size.

3. The method according to claim 2, characterized in that The traffic feature also includes traffic frequency, and the extracting the traffic feature of each node from the traffic data also includes: For each type of traffic data, respectively calculate the average value of the sum of time intervals of the traffic data of the type at any node; The reciprocal of the average value is used as the traffic frequency corresponding to the type of traffic data, and the traffic frequency includes transaction data traffic frequency, block data traffic frequency and consensus data traffic frequency.

4. The method according to claim 2, characterized in that: The traffic characteristics also include a traffic pattern and a traffic type, the traffic pattern includes a periodic traffic pattern or a non-periodic traffic pattern, the traffic type includes a transaction data type, a block data type or a consensus data type, and the traffic characteristics of each node extracted from the traffic data also include: Analyze the frequency domain data corresponding to the traffic data of each node, and determine the traffic pattern of the node that conforms to the periodic change law as a periodic traffic pattern; Obtain the number of each type of traffic data corresponding to each node, and calculate the total number of traffic data corresponding to each node; Based on the total amount of the traffic data, respectively calculate the proportion of each type of traffic data; The type of the traffic data whose ratio is greater than the corresponding threshold is determined as the traffic type of the node.

5. The method according to any one of claims 1 to 4, characterized in that: The pre-classifying each node according to the traffic characteristics in the multiple dimensions includes: According to the traffic size, traffic frequency, traffic pattern and / or traffic type of each node, each node is classified as a verification node, a normal node or a malicious node; wherein the traffic size and traffic frequency of the verification node are both greater than the corresponding threshold value, and the traffic pattern of the verification node is a periodic traffic pattern; the traffic size and traffic frequency of the malicious node are greater than the corresponding maximum value or less than the corresponding minimum value, and the traffic pattern of the verification node is a non-periodic traffic pattern.

6. The method according to claim 5, characterized in that The pre-classification result includes a plurality of pre-classified node sets of different node types, each node in each pre-classified node set has the same node type, and clustering the pre-classification result of each node to determine the node type of each node includes: Clustering each node in each pre-classified node set to obtain a clustering score of each node; When the clustering score of any node is greater than a preset score threshold, the node is deleted from the current pre-classified node set; The pre-classified node set after deleting all nodes whose clustering scores are greater than the preset score threshold is used as the final node classification set, and the node type of any node is the same as the type of the node classification set in which it belongs.

7. The method according to claim 6, characterized in that The clustering of each node in each pre-classified node set to obtain a clustering score of each node includes: Select K nodes as initial cluster centers in each pre-classified node set, and each initial cluster center corresponds to a cluster; Determine the cluster corresponding to each node according to the distance between each node and each initial cluster center; Repeating the iterative operation until the updated cluster center remains unchanged, the iterative operation includes: setting the average value of the feature vectors of all nodes in each cluster as the updated cluster center, combining the distance between each node and each updated cluster center, and re-determining the cluster corresponding to each node; The clustering score of each node is determined according to the distance between each node in each cluster and the corresponding updated cluster center and the preset corresponding relationship between the distance and the clustering score.

8. The method according to claim 7, characterized in that Determining the cluster corresponding to each node according to the distance between each node and each initial cluster center includes: The classification operation is repeatedly performed until the cluster corresponding to each node is determined, and the classification operation includes: calculating the distance between any node in the pre-classified node set and each initial cluster center, determining the initial cluster center with the smallest distance to the node as the initial cluster center corresponding to the node, and determining the cluster corresponding to the initial cluster center as the cluster corresponding to the node.

9. A client device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images