Network cascade failure processing method and device and storage medium

Abstract

The invention provides a network cascade failure processing method and device and a storage medium. The method comprises the following steps: constructing a network model based on acquired bank transaction data; for each network model, calculating feature information of nodes in the network model; determining an attacked node sequence based on the feature information; attacking the to-be-attacked nodes according to the attacked node sequence; and when it is determined that the dynamic threshold value corresponding to the node to be attacked accords with a preset threshold value range and the first proportion corresponding to the node to be attacked is greater than a preset proportion, determining that the node to be attacked has cascade failure. The cascade failure model attacks the to-be-attacked node according to the sequence of the attacked nodes, and when it is determined that the dynamic threshold value corresponding to the to-be-attacked node conforms to the preset threshold value range and the first proportion corresponding to the to-be-attacked node is larger than the preset proportion, it is determined that the cascade failure occurs in the to-be-attacked node. The nodes with cascade failure can be quickly determined, so that the attack effect is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cascading failure processing, and in particular to a method, device and storage medium for cascading failure processing of a network. Background Art

[0002] The status of each node in the network model is not the same, and the failure of some important nodes may lead to the collapse of the entire system.

[0003] At present, the research on cascading failure behavior often starts from attacking nodes with smaller degrees in the network model. When there are many nodes in the network model, it is difficult to quickly determine the nodes where cascading failure occurs through existing methods, resulting in poor attack effect. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a network cascading failure processing method, device and storage medium to solve the problem of poor attack effect in the prior art.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] A first aspect of an embodiment of the present invention shows a method for handling cascading failures in a network, the method comprising:

[0007] Build a network model based on the acquired bank transaction data;

[0008] For each network model, calculating characteristic information of nodes in the network model;

[0009] Determine the node order of attack based on the characteristic information;

[0010] Attacking the attacking nodes according to the attacking node order;

[0011] When it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range, and the first ratio corresponding to the node to be attacked is greater than the preset ratio, it is determined that the node to be attacked has a cascading failure, wherein the first ratio is obtained by processing the degree of the node to be attacked after the attack and the degree in the feature information.

[0012] Optionally, a network model is constructed based on the acquired bank transaction data, including:

[0013] Get bank transaction data within a historical period;

[0014] Sorting the bank accounts based on the bank transaction information, and extracting bank transaction data corresponding to a preset number of bank accounts in the sorted order, and using them as target transaction data;

[0015] A network model is constructed based on the identity information of the transaction parties in the target transaction data.

[0016] Optionally, determining the node order of the attack based on the characteristic information includes:

[0017] Comparing the degree of each node of the feature information;

[0018] The nodes are sorted in descending order according to the degree to obtain a sorting order, and the sorting order is used as the node order of the attack.

[0019] Optionally, attack the attacking nodes in the order of attacking nodes, including:

[0020] According to the node sequence of the attack, determine the current node to be attacked;

[0021] Determine the attack time and attack times of the node to be attacked;

[0022] When determining whether the number of attacks is less than or equal to a preset number of times, the node to be attacked is attacked based on the attack time.

[0023] Optionally, also include:

[0024] When it is determined that the number of attacks is greater than a preset number of times, determining whether there are still unattacked nodes in the attacked node sequence;

[0025] If so, executing the step of determining the current node to be attacked according to the order of the nodes to be attacked;

[0026] If not, it is determined that the cascading failure attack of the nodes in the network model is ended.

[0027] Optionally, also include:

[0028] When attacking the node to be attacked, the attack time, attack data, and the dynamic threshold and node trust corresponding to the previous node to be attacked are obtained based on the number of attacks of the node to be attacked, wherein if the number of attacks is the first attack, the dynamic threshold and node trust corresponding to the previous node are the initial dynamic threshold and initial node trust;

[0029] The dynamic threshold of the node to be attacked at the current attack time is determined based on the attack time, the attack data, the dynamic threshold corresponding to the node to be attacked last time, and the node trust.

[0030] Optionally, determining the dynamic threshold of the node to be attacked at the current attack time based on the attack time, the attack data, the dynamic threshold corresponding to the node to be attacked last time, and the node trust degree includes:

[0031] Based on the attack data, the node trust corresponding to the node to be attacked in the previous time is updated to obtain the current node trust of the node to be attacked;

[0032] The dynamic threshold corresponding to the node to be attacked is determined based on the current node trust of the node to be attacked, the dynamic threshold corresponding to the node to be attacked last time, the attack time and the attack data.

[0033] Optionally, when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range and the first ratio corresponding to the node to be attacked is greater than the preset ratio, determining that the node to be attacked has a cascading failure includes:

[0034] Obtaining a first ratio based on the degree of the node to be attacked after the attack and the degree in the feature information;

[0035] Determine whether the first ratio corresponding to the node to be attacked is greater than a preset ratio;

[0036] If so, determining whether the dynamic threshold corresponding to the node to be attacked meets the preset threshold range;

[0037] If so, it is determined that a cascading failure occurs in the node to be attacked.

[0038] A second aspect of an embodiment of the present invention shows a cascading failure processing device for a network, the device comprising:

[0039] A construction unit, used for constructing a network model based on the acquired bank transaction data;

[0040] A calculation unit, used for calculating characteristic information of nodes in each network model;

[0041] A cascading failure model is used to determine the order of nodes to be attacked based on the characteristic information; attack the nodes to be attacked according to the order of the nodes to be attacked; when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range and the first ratio corresponding to the node to be attacked is greater than the preset ratio, it is determined that the node to be attacked has a cascading failure, wherein the first ratio is obtained by processing the degree of the node to be attacked after the attack and the degree in the characteristic information.

[0042] A third aspect of an embodiment of the present invention shows a storage medium, which includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute the cascading failure processing method of the network shown in the first aspect of the embodiment of the present invention.

[0043] Based on the above-mentioned embodiment of the present invention, a network cascading failure processing method, device and storage medium are provided, the method includes: building a network model based on the acquired bank transaction data; for each network model, calculating the characteristic information of the nodes in the network model; determining the attack node sequence based on the characteristic information; attacking the nodes to be attacked according to the attack node sequence; when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range and the first ratio corresponding to the node to be attacked is greater than the preset ratio, determining that the node to be attacked has a cascading failure, wherein the first ratio is obtained by processing the degree of the node to be attacked after the attack and the degree in the characteristic information. In an embodiment of the present invention, a corresponding network model is first constructed, and then each node of the network model is processed to determine the characteristic information of the nodes in the network model, and then determine the node sequence of the attack in the network model; after the cascading failure model receives the network model and the node sequence of the attack, the nodes to be attacked are attacked according to the node sequence of the attack, that is, the attack starts from the node with the largest degree, and when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range, and the first ratio corresponding to the node to be attacked is greater than the preset ratio, it is determined that the node to be attacked has a cascading failure, and the node that has a cascading failure can be quickly determined, thereby improving the attack effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A schematic diagram of a flow chart of a method for handling cascading failures of a network according to an embodiment of the present invention;

[0046] Figure 2 A node schematic diagram of a network model shown in an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of a flow chart of a cascading failure processing method according to an embodiment of the present invention;

[0048] Figure 4 The present invention is a schematic diagram of the architecture of a cascading failure processing device for a network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] It should be noted that the descriptions of "first", "second", etc. in the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0052] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0053] See also Figure 1 , is a flow chart of a method for handling cascading failures of a network according to an embodiment of the present invention, the method comprising:

[0054] Step S101: constructing a network model based on the acquired bank transaction data.

[0055] It should be noted that the network model includes a high-frequency trading network model, i.e., the first network model, a large-value transaction network model, i.e., the second network model, and a trust relationship network model, i.e., the third network model.

[0056] The specific implementation process of step S101 includes the following steps:

[0057] Step S11: Obtain bank transaction data within a historical time period;

[0058] In the specific implementation of step S11, the processor collects bank transaction data within a historical time period.

[0059] It should be noted that bank transaction data includes but is not limited to the identity information of the two parties to the transaction, transaction amount, transaction frequency and transaction time.

[0060] Among them, the identity information of the two parties to the transaction refers to the account numbers of the sender and the receiver; the transaction amount refers to the amount of each transaction; the transaction frequency refers to the number of transactions between the two parties within a preset time period, and the transaction time refers to the timestamp of the transaction.

[0061] Optionally, the transaction relationship may be determined based on the identity information of both transaction parties, that is, a transaction relationship exists between the sender and the receiver of the transaction.

[0062] It should be further explained that the historical time period and the preset time period are set by the technicians according to the actual situation, and the embodiment of the present invention does not limit this.

[0063] Step S12: sorting the bank accounts based on the bank transaction information, and extracting bank transaction data corresponding to a preset number of bank accounts in the sorting order, and using them as target transaction data;

[0064] Step S13: constructing a network model based on the identity information of the transaction parties in the target transaction data.

[0065] There are multiple ways to implement the process of step S12 and step S13.

[0066] The first implementation method includes the following steps:

[0067] Step S21: If the network model is the first network model, bank transaction data of accounts corresponding to N transaction frequencies are extracted in descending order of the transaction frequencies, and used as target transaction data, where N is a positive integer greater than or equal to 2.

[0068] Wherein, N is a preset number.

[0069] In the process of implementing step S21, if the network model to be constructed is the first network model, that is, the high-frequency trading network model; the processor sorts the accounts in the identity information in order of transaction frequency from high to low, and extracts the transaction data corresponding to the first N accounts in order from high to low, and uses it as the target transaction data.

[0070] Step S22: constructing a first network model based on the identity information of the transaction parties in the target transaction data.

[0071] In the specific implementation of step S22, the processor uses the accounts of the identity information of the transaction parties in the target transaction data as nodes and the transaction relationships indicated by the identity information as edges to draw a network diagram and obtain a first network model.

[0072] Optionally, the transaction relationship indicated by the identity information as an edge means establishing an edge for each pair of transaction accounts, i.e., a sender and a receiver of the transaction.

[0073] Among them, the edge weight w(u,v) is the transaction frequency, which can be calculated through the historical transaction records in the target transaction data, that is, w(u,v) = number of transactions / time period.

[0074] Among them, the edge weight w(u,v) represents the weight of the edge from node u to node v.

[0075] The second implementation method includes the following steps:

[0076] Step S31: If the network model is the second transaction network, extract bank transaction data of accounts corresponding to M transaction amounts in order from high to low, and use them as target transaction data, where M is a positive integer greater than or equal to 2.

[0077] Wherein, M is a preset number.

[0078] In the process of implementing step S31, if the network model to be constructed is the second network model, that is, the large-value transaction network model; the processor sorts the accounts in the identity information in order of transaction frequency from high to low, and extracts the transaction data corresponding to the first M accounts in order from high to low, and uses it as the target transaction data.

[0079] Step S32: constructing a second network model based on the identity information of the transaction parties in the target transaction data.

[0080] In the specific implementation of step S32, the processor uses the accounts of the identity information of the transaction parties in the target transaction data as nodes and the transaction relationships indicated by the identity information as edges to draw a network diagram and obtain a first network model.

[0081] Optionally, the transaction relationship indicated by the identity information as an edge means establishing an edge for each pair of transaction accounts, i.e., a sender and a receiver of the transaction.

[0082] Among them, the weight of the edge w(u,v) is the transaction amount, which can be calculated through the historical transaction records in the target transaction data, that is, w(u,v) = ∑transaction amount.

[0083] The third implementation method includes the following steps:

[0084] Step S41: If the network model is a third transaction network, the transaction trust is calculated based on the transaction amount and transaction frequency in the bank transaction data, and the bank transaction data of L corresponding accounts are extracted in order of transaction trust from high to low, and used as the target transaction data, where L is a positive integer greater than or equal to 2.

[0085] Wherein, L is the preset number.

[0086] In the process of implementing step S41, if the network model to be constructed is the third network model, that is, the trust relationship network model; the processor first counts the number of transactions of each transaction party, that is, the sender or the receiver, and then calculates the total transaction amount of each transaction party within the above transaction number; then the product of the total transaction amount and the number of transactions is used as the transaction trust; then the accounts in the identity information are sorted in order from high to low according to the transaction trust, and the transaction data corresponding to the first L accounts are extracted in order from high to low, and they are used as the target transaction data.

[0087] Among them, transaction trust can also be comprehensively evaluated through multiple factors such as historical transaction records, transaction frequency, and transaction amount.

[0088] Step S42: constructing a third network model based on the identity information of the transaction parties in the target transaction data.

[0089] In the specific implementation of step S42, the processor uses the accounts of the identity information of the transaction parties in the target transaction data as nodes and the transaction relationships indicated by the identity information as edges to draw a network diagram to obtain a third network model.

[0090] Optionally, the transaction relationship indicated by the identity information as an edge means establishing an edge for each pair of transaction accounts, i.e., a sender and a receiver of the transaction.

[0091] The edge weight w(u,v) is the transaction amount, which can be calculated from the historical transaction records in the target transaction data, that is,

[0092] It should be noted that the nodes in the third network model represent accounts that have a high degree of transaction trust with each other.

[0093] In the embodiment of the present invention, three network models are constructed using the above method, and the three network models are respectively stored in the database mongodb cache, so that for each subsequent attack, the three networks are the same, the influence of randomness is shielded, and a single variable is controlled.

[0094] Among them, MongoDB is a non-relational NoSQL database based on document storage. It uses a flexible document model to store data, and the data structure can be dynamically adjusted as needed.

[0095] Step S102: for each network model, calculating characteristic information of nodes in the network model;

[0096] In the specific implementation of step S102, the processor first counts the number of transaction partners of each account, that is, the degree of each node, for each network model, so as to construct a degree distribution;

[0097] Next, the weight distribution of the edges is analyzed to understand the distribution of transaction frequency, transaction amount, or transaction trust of each node; then, the connectivity between nodes in the network model is evaluated to determine whether there are isolated accounts or islands after subsequent attacks.

[0098] Finally, the centrality of each network model is calculated, that is, the node with the largest degree and the largest edge is the central node corresponding to the centrality, which is the key account.

[0099] Based on this, based on each network model, the degree, transaction frequency, transaction amount or transaction trust and centrality of the node are composed into characteristic information.

[0100] Optionally, the processor inputs the feature information and the network model into a cascading failure model.

[0101] Step S103: determining the node order of the attack based on the characteristic information;

[0102] It should be noted that the specific implementation of step S103 includes the following steps:

[0103] Step S51: Compare the degree of each node of the feature information.

[0104] Step S52: Sort the nodes in descending order of the degree to obtain a sorting order, and use the sorting order as the node order for attack.

[0105] In the process of implementing step S51 and step S52, for each network model, the degree of each node is compared, and the nodes are queued in descending order to obtain the queue order, and the sorting order is used as the node order of attack to determine the node order of attack to start attacking from the node with the larger degree.

[0106] like Figure 2 As shown in the figure, there are 9 nodes in a network model, among which the degree k of nodes 6, 7, 8 and 9 is 3; the degree k of nodes 4 and 5 is 2; the degree k of nodes 1, 2 and 3 is 1. The attack starts with the nodes with larger k values, that is, the nodes with k value of 3 in the figure, followed by the nodes with k value of 2, and finally the nodes with k value of 1. In other words, the nodes are sorted in descending order of degree, and the attack order of nodes is determined as nodes 6, 7, 8 and 9, node 3, node 4 and node 5, and node 1, node 2 and node 3.

[0107] The execution order of nodes with the same degree is random, which is not limited in the embodiment of the present invention.

[0108] Step S104: attacking the nodes in the order of attacking nodes;

[0109] It should be noted that the cascading failure model uses the time step method to attack, that is, the attack is divided into different small time steps r, that is, an attack is performed once every time interval r, and the r can be set to 10s, that is, an attack is performed once every ten seconds, and it is iterated in sequence. In other words, each node has a set number of attacks, that is, a preset number of times, and then an attack is performed every ten seconds according to the time.

[0110] The cascading failure model shown in this application is a fusion of the k-shell model and the q model.

[0111] Among them, the q model is the simplest threshold model for studying cascading failure behavior in complex networks;

[0112] The cascading failure model attacks in order from large to small degrees, that is, the cascading failure behavior attacks are carried out in the attack order. At the same time, the variable f is introduced, which represents the probability of node failure and takes a value between 0 and 1.

[0113] All nodes in the network model have state r i {0,1}, when the state of node i is 1, node i is an active node, and when the state of node i is 0, node i is an inactive node.

[0114] The status of all nodes in the network belongs to one of the two, and the status of a node will change as the status of other nodes changes.

[0115] In the cascading failure model, each node i has a Threshold The threshold of node i does not change over time.

[0116] Optionally, it also includes: in the cascading failure model, a static threshold T0 is pre-set for each node of the network model.

[0117] It should be noted that the static threshold T0 of a node is determined based on the degree of the node, the centrality of the network model in which it is located, or other characteristics.

[0118] For example: for node a in the first network model, obtain the characteristic information corresponding to node a in the first network model; search the corresponding static threshold table based on the product of the degree of node a in the characteristic information and the centrality of the network model, and determine the static threshold T0 of node a, that is, the initial threshold of node a;

[0119] Each node, that is, the user account, will generate a transaction trust every time it conducts a transaction, and the initial node trust is obtained by averaging the transaction trust.

[0120] Optionally, the initial node trust can also be directly allocated according to the actual situation or preliminary experiments, and can generally be set to 0.5.

[0121] The static threshold T0 of the node can also be directly allocated according to the actual situation or preliminary experiments.

[0122] It should be noted that the initial node trust reflects the node's initial sensitivity or trust level to information.

[0123] The specific implementation process of step S104 is as follows: Figure 3 As shown, the following steps are included:

[0124] Step S301: Determine the current node to be attacked according to the order of the nodes to be attacked;

[0125] In the specific implementation of step S301, the cascading failure model determines the node to be attacked according to the order of the attacked nodes, and marks the node as being attacked.

[0126] Step S302: Determine the attack time and attack times of the node to be attacked;

[0127] Step S303: determine whether the attack times are less than or equal to the preset times, if yes, execute step S304, if no, it means the attack on the current node is over and not invalid, and execute step S305;

[0128] In the process of implementing step S302 and step S303, the cascading failure model takes the current node to be attacked as the first attack as an example, determines that the attack time t0=0 of the node to be attacked at this time, and the number of attacks is t1=1; determines that the number of attacks is less than or equal to the preset number, if so, executes step S304, if not, it means that the attack of the current node is finished and there is no failure, and executes step S305;

[0129] If the current node to be attacked is not the first attack, obtain the number of attacks t1 and the attack time t0 of the previous node to be attacked, determine the attack time t0 of the node to be attacked at this time = t0 (the previous attack time) + r, and the attack time t1 of the node to be attacked at this time = t1 (the previous number of attacks) + 1; determine whether the number of attacks is less than or equal to the preset number, if so, execute step S304, if not, it means that the attack on the current node is completed and has not failed, and execute step S305.

[0130] Step S304: Attack the node to be attacked based on the attack time.

[0131] In the specific implementation of step S304, when the current time reaches the attack time, the attack on the node to be attacked is started according to the variable f. Specifically, new, unsafe transaction information is sent to the node to be attacked. When the node in the network model receives the transaction information, the security of the transaction caused by the transaction information causes a large-scale cascading failure of other nodes connected to the node, thereby realizing the attack on the node to be attacked;

[0132] Among them, each time the node to be attacked attacks, it will record the number of attacks t1 = 1 and the attack time t0 = 0;

[0133] The current time refers to the time starting from 0. Generally speaking, the time starts when the node to be attacked is determined.

[0134] Step S305: Determine whether there are any unattacked nodes in the node sequence of the attack; if so, return to step S301 to attack the next node in the network model; if not, execute step S306.

[0135] Optionally, since each node has a preset number of attacks, if it does not fail within the preset number of attacks, it means that the node will not fail.

[0136] Step S306: Determine whether the cascading failure attack of the nodes in the network model is finished.

[0137] In the process of implementing step S306, it is determined that no new node fails at this time, which indicates that the cascading failure attack of the nodes in the network model is over.

[0138] Step S105: Determine whether the dynamic threshold corresponding to the node to be attacked meets the preset threshold range, and the first ratio corresponding to the node to be attacked is greater than the preset ratio. If it is determined that the dynamic threshold corresponding to the node to be attacked is less than the preset threshold, and the first ratio corresponding to the node to be attacked is greater than the preset ratio, execute step S106. If any one of them is no, it means that the attack on the node to be attacked has not failed at this time. At this time, return to execute step S302 to determine the next attack on the node to be attacked, until the number of attacks on the node to be attacked exceeds the preset number.

[0139] Optionally, based on the method shown in the above embodiment of the present invention, the process of implementing the dynamic threshold of the node to be attacked includes:

[0140] Step S61: After attacking the node to be attacked, the attack time, attack data, the dynamic threshold corresponding to the previous node to be attacked and the node trust of the current node to be attacked are obtained based on the number of attacks of the node to be attacked.

[0141] If the attack is the first time, the corresponding dynamic threshold and node trust of the previous node are the initial dynamic threshold and initial node trust.

[0142] In the process of implementing step S61, if the node to be attacked is currently being attacked for the first time, the dynamic threshold corresponding to the node to be attacked last time is the initial dynamic threshold, and the node trust corresponding to the node to be attacked last time is the initial node trust. The cascading failure model obtains the initial dynamic threshold and initial node trust stored in itself, and obtains the attack time and the attack data of the node to be attacked at this time.

[0143] If the node to be attacked is not being attacked for the first time, the dynamic threshold corresponding to the node to be attacked last time is the dynamic threshold after the last adjustment record, and the node trust corresponding to the node to be attacked last time is also the node credit received last time. The cascading failure model obtains the dynamic threshold after the last adjustment record and the node credit received last time stored in itself, and obtains the attack time and the attack data of the node to be attacked at this time.

[0144] It should be noted that attack data refers to the amount of transaction information received by the node to be attacked during the attack process.

[0145] Step S62: Based on the attack time, attack data, the dynamic threshold corresponding to the node to be attacked last time, and the node trust, a current dynamic threshold corresponding to the node to be attacked is determined and stored.

[0146] It should be noted that the specific process of implementing step S62 includes the following steps:

[0147] Step S71: updating the node trust corresponding to the node to be attacked last time based on the attack data to obtain the current node trust of the node to be attacked;

[0148] The node trust α(t) is dynamically adjusted as the information is received. For example, during the attack, if node a frequently receives confirmation messages from other nodes, its trust may increase; conversely, if node a frequently receives contradictory messages from other nodes, its trust may decrease. The specific adjustment can be processed by the following formula (1).

[0149] In the specific implementation of step S71, the node trust α(t) corresponding to the node to be attacked in the previous time and the consistency W of the information received in the attack data are substituted into formula (1) for processing to adjust the node trust and obtain the current node trust α(t) of the node to be attacked;

[0150] Formula (1):

[0151] α(t)=g(α(t),W)

[0152] Among them, g() is a function that updates the trust according to the current trust and the consistency W of the received information.

[0153] It should be noted that the consistency W of the received information refers to whether the identifiers in the transaction information sent by other nodes received after the attack is completed in the attack data are consistent.

[0154] For example, if node a receives the same suspicious transaction information from different nodes multiple times, and the content of this information is consistent, the ratio of the amount of suspicious transaction information to all transaction information received by node a is calculated and used as the value of information consistency W.

[0155] Step S72: Based on the current node trust α(t) of the node to be attacked, the dynamic threshold corresponding to the node to be attacked last time, the attack time and the attack data, a calculation is performed to determine the dynamic threshold corresponding to the node to be attacked.

[0156] In the specific implementation of step S72, the current node trust α(t) of the node to be attacked and the dynamic threshold T corresponding to the node to be attacked last time are calculated. t-1 , the attack time t and the amount of all transaction information y received by the node to be attacked in the attack data 信息量 Substitute into formula (2) to calculate and determine the dynamic threshold T(t) of the node to be attacked at the current attack time.

[0157] Formula (2):

[0158] T(t)=Tt-1 +f(y 信息量 , t,α(t))

[0159] Among them, f() is a function that adjusts the dynamic threshold according to the amount of information received by the node, the current time t and the trust of the node α(t).

[0160] The specific implementation of step S105 includes the following steps:

[0161] Step S81: obtaining a first ratio based on the degree of the node to be attacked after the attack and the degree in the feature information.

[0162] In the specific implementation of step S81, after the attack of the to-be-received node is completed, the remaining degree of the reception is calculated, that is, the ratio of the neighbor node lost by the node to the degree in the characteristic information, to obtain a first ratio;

[0163] Step S82: Determine whether the first ratio corresponding to the node to be attacked is greater than the preset ratio. If so, execute step S83. If not, it means that the attack on the node to be attacked has not invalidated it at this time, and return to execute step S302 to continue to determine the next attack number and next attack time of the node to be attacked.

[0164] In the specific implementation of step S82, the cascading failure model determines the threshold value corresponding to the node i to be attacked. And use it as the preset ratio; then determine whether the first ratio corresponding to the node to be attacked is greater than the preset ratio. If so, execute step S83. If not, it means that the attack on the node to be attacked has not invalidated it at this time, and return to execute step S302 to continue to determine the next attack number and next attack time of the node to be attacked.

[0165] Optionally, in addition to the methods shown in the above steps S81 and S82, other methods can be used to determine whether the node to be attacked has a cascading failure, and compare whether the proportion of active nodes in the neighboring nodes of the node to be attacked reaches a threshold. If the threshold condition is met, the state of the node to be attacked is updated to the active state and maintained, otherwise the node to be attacked is inactive, that is, a cascading failure occurs.

[0166] The state of node i satisfies the following formula (3).

[0167] Formula (3):

[0168]

[0169] Among them, k i is the degree of the node, N iis the number of infected neighbor nodes, that is, the number of neighbor nodes of the attacked node in the network.

[0170] Step S83: Determine whether the dynamic threshold corresponding to the node to be attacked meets the preset threshold range. If so, execute step S106. If not, it means that the attack on the node to be attacked has not invalidated it at this time, and return to execute step S302 to continue to determine the next attack number and next attack time of the node to be attacked.

[0171] It should be noted that the preset threshold range is set by technicians after multiple experiments.

[0172] Step S106: Determine whether a cascading failure occurs in the node to be attacked.

[0173] In the specific implementation of step S106, the node to be attacked leaves the network model.

[0174] Optionally, after executing step S106, the network model is updated based on the failed node to be attacked, that is, the edges connected to the node to be attacked in the network are deleted, and then, the neighboring nodes of the cascading failure affected by the node to be attacked are determined, thereby updating the network model; then return to execute step S301 to continue to perform failure processing on the next node in the network model.

[0175] At this time, it is determined whether the failed node exists in the network. The failure of one or a few nodes or lines will cause other nodes to fail through the coupling relationship between nodes, thereby producing a cascade effect.

[0176] Optionally, after a certain attack moment is completed, the attack effect after the current attack moment is determined based on the remaining nodes in the network model and the nodes of the network model before the attack.

[0177] Specifically, after a certain attack is executed, the percentage t of the number of remaining nodes in the network is counted: at the sth time step, at the nth attack number, the percentage of the number of nodes that have not left the current network to the number of initial nodes in the network, as shown in formula (4).

[0178] Formula (4):

[0179]

[0180] Among them, N s represents the sth time step, that is, the total number of nodes in the network that have not left the current network at the current attack time s, N 0 Represents the total number of nodes in the network at time 0 before cascading failure occurs.

[0181] Alternatively, the attack effect can be determined by the activity level of nodes in the network, as shown in formula (5).

[0182] Formula (5):

[0183]

[0184] Where N is the total number of nodes in the network at time 0 before cascading failure occurs.

[0185] In an embodiment of the present invention, a corresponding network model is first constructed, and then each node of the network model is processed to determine the characteristic information of the nodes in the network model, and then determine the node sequence of the attack in the network model; after the cascading failure model receives the network model and the node sequence of the attack, the nodes to be attacked are attacked according to the node sequence of the attack, that is, the attack starts from the node with the largest degree, and when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range, and the first ratio corresponding to the node to be attacked is greater than the preset ratio, it is determined that the node to be attacked has a cascading failure, and the node that has a cascading failure can be quickly determined, thereby improving the attack effect.

[0186] Based on the above-mentioned method for handling cascading failures of a network shown in the embodiment of the present invention, correspondingly, the embodiment of the present invention shows a device for handling cascading failures of a network, such as Figure 4 As shown, the device comprises:

[0187] A construction unit 401, configured to construct a network model based on the acquired bank transaction data;

[0188] A calculation unit 402, configured to calculate, for each network model, characteristic information of nodes in the network model;

[0189] The cascading failure model 403 is used to determine the order of nodes to be attacked based on the characteristic information; attack the nodes to be attacked according to the order of nodes to be attacked; when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range and the first ratio corresponding to the node to be attacked is greater than the preset ratio, it is determined that the node to be attacked has a cascading failure, wherein the first ratio is obtained by processing the degree of the node to be attacked after the attack and the degree in the characteristic information.

[0190] The specific principles and execution processes of each unit in the cascading failure processing device for a network disclosed in the above embodiment of the present invention are the same as the corresponding contents in the cascading failure processing method for a network provided in the above embodiment of the present invention. Please refer to the corresponding parts of the cascading failure processing method for a network disclosed in the above embodiment of the present invention, and will not be repeated here.

[0191] In an embodiment of the present invention, a corresponding network model is first constructed, and then each node of the network model is processed to determine the characteristic information of the nodes in the network model, and then determine the node sequence of the attack in the network model; after the cascading failure model receives the network model and the node sequence of the attack, the nodes to be attacked are attacked according to the node sequence of the attack, that is, the attack starts from the node with the largest degree, and when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range, and the first ratio corresponding to the node to be attacked is greater than the preset ratio, it is determined that the node to be attacked has a cascading failure, and the node that has a cascading failure can be quickly determined, thereby improving the attack effect.

[0192] Optionally, based on the cascading failure processing device for a network shown in the above embodiment of the present invention, the construction unit 401 is specifically used to:

[0193] Get bank transaction data within a historical period;

[0194] Sorting the bank accounts based on the bank transaction information, and extracting bank transaction data corresponding to a preset number of bank accounts in the sorted order, and using them as target transaction data;

[0195] A network model is constructed based on the identity information of the transaction parties in the target transaction data.

[0196] Optionally, based on the cascading failure processing device for a network shown in the above embodiment of the present invention, the cascading failure model 403 for determining the node sequence of the attack based on the characteristic information is specifically used for:

[0197] Comparing the degree of each node of the feature information;

[0198] The nodes are sorted in descending order according to the degree to obtain a sorting order, and the sorting order is used as the node order of the attack.

[0199] Optionally, based on the cascading failure processing device of a network shown in the above embodiment of the present invention, the cascading failure model 403 for attacking the nodes to be attacked according to the order of the nodes to be attacked is specifically used for:

[0200] According to the node sequence of the attack, determine the current node to be attacked;

[0201] Determine the attack time and attack times of the node to be attacked;

[0202] When determining whether the number of attacks is less than or equal to a preset number of times, the node to be attacked is attacked based on the attack time.

[0203] Optionally, based on the cascading failure processing device for a network shown in the above embodiment of the present invention, the cascading failure model 403 is further used for:

[0204] When it is determined that the number of attacks is greater than a preset number of times, determining whether there are still unattacked nodes in the attacked node sequence;

[0205] If so, executing the step of determining the current node to be attacked according to the order of the nodes to be attacked;

[0206] If not, it is determined that the cascading failure attack of the nodes in the network model is ended.

[0207] Optionally, based on the cascading failure processing device for a network shown in the above embodiment of the present invention, the cascading failure model 403 is further used for:

[0208] When attacking the node to be attacked, the attack time, attack data, and the dynamic threshold and node trust corresponding to the previous node to be attacked are obtained based on the number of attacks of the node to be attacked, wherein if the number of attacks is the first attack, the dynamic threshold and node trust corresponding to the previous node are the initial dynamic threshold and initial node trust;

[0209] The dynamic threshold of the node to be attacked at the current attack time is determined based on the attack time, the attack data, the dynamic threshold corresponding to the node to be attacked last time, and the node trust.

[0210] Wherein, determining the dynamic threshold of the node to be attacked at the current attack time based on the attack time, the attack data, the dynamic threshold corresponding to the node to be attacked last time, and the node trust degree includes:

[0211] Based on the attack data, the node trust corresponding to the node to be attacked in the previous time is updated to obtain the current node trust of the node to be attacked;

[0212] The dynamic threshold corresponding to the node to be attacked is determined based on the current node trust of the node to be attacked, the dynamic threshold corresponding to the node to be attacked last time, the attack time and the attack data.

[0213] Optionally, based on the cascading failure processing device of a network shown in the above embodiment of the present invention, when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range and the first ratio corresponding to the node to be attacked is greater than the preset ratio, a cascading failure model 403 is determined in which the node to be attacked has a cascading failure, which is specifically used to:

[0214] Obtaining a first ratio based on the degree of the node to be attacked after the attack and the degree in the feature information;

[0215] Determine whether the first ratio corresponding to the node to be attacked is greater than a preset ratio;

[0216] If so, determining whether the dynamic threshold corresponding to the node to be attacked meets the preset threshold range;

[0217] If so, it is determined that a cascading failure occurs in the node to be attacked.

[0218] An embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory is used for program codes and data for cascading failure processing of a network, and the processor is used to call program instructions in the memory to execute the steps shown in the cascading failure processing method of the network in the above embodiment.

[0219] An embodiment of the present application provides a storage medium, which includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute the cascading failure processing method of the network shown in the above embodiment.

[0220] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0221] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0222] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for handling cascading failures in a network, characterized in that: The method comprises: Build a network model based on the acquired bank transaction data; For each network model, calculating characteristic information of nodes in the network model; Determine the node order of attack based on the characteristic information; Attacking the attacking nodes according to the attacking node order; When it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range, and the first ratio corresponding to the node to be attacked is greater than the preset ratio, it is determined that the node to be attacked has a cascading failure, wherein the first ratio is obtained by processing the degree of the node to be attacked after the attack and the degree in the feature information.

2. The method according to claim 1, characterized in that Build a network model based on the acquired bank transaction data, including: Obtain bank transaction data within a historical period; Sorting the bank accounts based on the bank transaction information, and extracting bank transaction data corresponding to a preset number of bank accounts in the sorted order, and using them as target transaction data; A network model is constructed based on the identity information of the transaction parties in the target transaction data.

3. The method according to claim 1, characterized in that Determining the node sequence of the attack based on the characteristic information includes: Comparing the degree of each node of the feature information; The nodes are sorted in descending order according to the degree to obtain a sorting order, and the sorting order is used as the node order of the attack.

4. The method according to claim 1, characterized in that: Attack the attacking nodes in the order of attacking nodes, including: According to the node sequence of the attack, determine the current node to be attacked; Determine the attack time and attack times of the node to be attacked; When determining whether the number of attacks is less than or equal to a preset number of times, the node to be attacked is attacked based on the attack time.

5. The method according to claim 4, characterized in that Also includes: When it is determined that the number of attacks is greater than a preset number of times, determining whether there are still unattacked nodes in the attacked node sequence; If so, executing the step of determining the current node to be attacked according to the order of the nodes to be attacked; If not, it is determined that the cascading failure attack of the nodes in the network model is ended.

6. The method according to claim 4, characterized in that Also includes: When attacking the node to be attacked, the attack time, attack data, and the dynamic threshold and node trust corresponding to the previous node to be attacked are obtained based on the number of attacks of the node to be attacked, wherein if the number of attacks is the first attack, the dynamic threshold and node trust corresponding to the previous node are the initial dynamic threshold and initial node trust; The dynamic threshold of the node to be attacked at the current attack time is determined based on the attack time, the attack data, the dynamic threshold corresponding to the node to be attacked last time, and the node trust.

7. The method according to claim 6, characterized in that Determining the dynamic threshold of the node to be attacked at the current attack time based on the attack time, attack data, the dynamic threshold corresponding to the node to be attacked last time, and the node trust, includes: Based on the attack data, the node trust corresponding to the node to be attacked in the previous time is updated to obtain the current node trust of the node to be attacked; The dynamic threshold corresponding to the node to be attacked is determined based on the current node trust of the node to be attacked, the dynamic threshold corresponding to the node to be attacked last time, the attack time and the attack data.

8. The method according to claim 7, characterized in that When it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range, and the first ratio corresponding to the node to be attacked is greater than the preset ratio, determining that the node to be attacked has a cascading failure, includes: Obtaining a first ratio based on the degree of the node to be attacked after the attack and the degree in the feature information; Determine whether the first ratio corresponding to the node to be attacked is greater than a preset ratio; If so, determining whether the dynamic threshold corresponding to the node to be attacked meets the preset threshold range; If so, it is determined that a cascading failure occurs in the node to be attacked.

9. A network cascading failure processing device, characterized in that: The device comprises: A construction unit, used for constructing a network model based on the acquired bank transaction data; A calculation unit, used for calculating characteristic information of nodes in each network model; A cascading failure model is used to determine the node order of attack based on the characteristic information; attack the nodes to be attacked according to the node order of attack; when it is determined that the dynamic threshold corresponding to the node to be attacked meets the preset threshold range and the first ratio corresponding to the node to be attacked is greater than the preset ratio, it is determined that the node to be attacked has a cascading failure, wherein the first ratio is obtained by processing the degree of the node to be attacked after the attack and the degree in the characteristic information.

10. A storage medium, characterized in that: The storage medium includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute the cascading failure processing method for a network as described in any one of claims 1 to 8.

Images