Abnormal task detection method, electronic device and storage medium based on blockchain

Abstract

The present invention provides a blockchain-based abnormal task detection method, an electronic device, and a storage medium, which relate to the technical field of blockchain abnormal task determination. The method comprises: predicting each task dispatcher in the next preset time period T by using a target LSTM model. next The predicted data of the data change task executed within the network is used to determine the target deviation value according to the predicted data and the actual data, thereby determining the abnormal task distributor and the abnormal time period; clustering and analyzing the sender address corresponding to each abnormal task distributor to determine the first abnormal entity corresponding to each task distributor; clustering each actual receiver address to obtain several second initial entities corresponding to each abnormal task distributor; and determining several data change tasks corresponding to the first abnormal entity and the second initial entity as abnormal tasks. The present invention can accurately detect abnormal tasks when executing abnormal tasks using the task distributor of the blockchain.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain abnormal task determination, and in particular to a blockchain-based abnormal task detection method, electronic device and storage medium. Background Art

[0002] With the rapid development of blockchain technology, more and more fields are beginning to use blockchain technology. The task distributor of blockchain, as an important component of the blockchain network, is responsible for distributing tasks to various nodes in the network for processing; however, like any computer system or network, the task distributor of blockchain is also at risk of being attacked; Distributed Denial of Service (DDoS) attack is a common network attack method. The attacker controls multiple computers or devices to send a large number of requests to the target server. Each request carries the corresponding data value that needs to be calculated, which causes the server resources to be exhausted and the service cannot be provided normally; If the task distributor is attacked by DDoS, it may cause task distribution delays or failures, which in turn affects the normal operation of the entire blockchain network; How to accurately detect abnormal tasks when the task distributor of the blockchain is attacked by abnormal tasks has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] In view of the above technical problems, the technical solution adopted by the present invention is:

[0004] According to the first aspect of the present application, a method for detecting abnormal tasks based on blockchain is provided, the method comprising the following steps:

[0005] S100, in response to the current preset time period T now Finally, the features of each task distributor on the blockchain executing data change tasks in the most recent m preset time periods are input into the target LSTM model to obtain the performance of each task distributor in the next preset time period T next Prediction data for executing data change tasks within.

[0006] S200, in response to T next End, get each task dispatcher in T next The actual data for executing data change tasks.

[0007] S300, according to each task distributor in T next The predicted data of the data change task executed within T next The actual data of the execution data change task in T next The target deviation value between the predicted data and the actual data corresponding to the data change task is executed to obtain the target deviation value list λ=(λ 1 ,λ2 , …, λ i , …, λ n ), i=1, 2,...,n; where, λ i For the i-th task dispatcher in T next The target deviation value between the predicted data and the actual data corresponding to the data change task executed internally, and n is the number of task distributors.

[0008] S400, traverse λ, if λ i >λ', the i-th task dispatcher is determined as an abnormal task dispatcher, and T next Determined as an abnormal time period; wherein λ' is a preset target deviation value threshold.

[0009] S500, for each abnormal task dispatcher in T next The sender address corresponding to each data change task executed in the cluster is clustered to obtain a plurality of first initial entities corresponding to each abnormal task distributor; the first initial entity is a computer device corresponding to the sender address.

[0010] S600, determine the first abnormal entity corresponding to each task distributor according to the characteristics of each first initial entity corresponding to each abnormal task distributor executing the historical data change task and the number of requests for data change tasks initiated within the abnormal time period; the first abnormal entity is the first initial entity with an abnormality.

[0011] S700, for each abnormal task dispatcher in T next The actual recipient address corresponding to each data change task executed in the cluster is clustered to obtain a number of second initial entities corresponding to each abnormal task distributor; the second initial entity is a computer device corresponding to the actual recipient address.

[0012] S800: If the number of the second initial entities is less than a preset second initial entity number threshold, a number of data change tasks corresponding to the first abnormal entity and the second initial entity are determined as abnormal tasks.

[0013] According to another aspect of the present application, a non-transitory computer-readable storage medium is also provided, in which at least one instruction or at least one program is stored, and the at least one instruction or at least one program is loaded and executed by a processor to implement the above-mentioned blockchain-based abnormal task detection method.

[0014] According to another aspect of the present application, an electronic device is provided, including a processor and the above-mentioned non-transitory computer-readable storage medium.

[0015] The present invention has at least the following beneficial effects:

[0016] The abnormal task detection method based on blockchain of the present invention responds to the current preset time period T now End, the target LSTM model is used to predict each task dispatcher in the next preset time period T next The predicted data of the data change task is executed in T next The actual data of the data change task executed within the time period is used to determine the target deviation value between the predicted data and the actual data corresponding to the data change task executed by each task distributor, so as to determine the abnormal task distributor and the abnormal time period according to the size of the target deviation value of each task distributor and the preset target deviation value threshold; there may be abnormal tasks in the data change tasks executed by the abnormal task distributor within the abnormal time period; then, for each abnormal task distributor in T next Cluster and analyze the sender address corresponding to each data change task executed in T to determine the first abnormal entity corresponding to each task dispatcher; next The actual recipient address corresponding to each data change task executed in T is clustered to obtain a number of second initial entities corresponding to each abnormal task dispatcher; if the number of second initial entities is less than the preset second initial entity number threshold, it means that in T next There are a large number of entities and a small number of entities performing data change tasks. It is possible that personnel are using the task distributor of the blockchain to make abnormal assets appear normal. Therefore, several data change tasks corresponding to the first abnormal entity and the second initial entity are determined as abnormal tasks; thereby, when personnel attack the task distributor through a large number of data change tasks, the abnormal tasks can be accurately detected.

[0017] Furthermore, the method of the present invention first uses the predicted data and actual data to determine the abnormal task distributor and the abnormal time period. Only after the abnormal task distributor and the abnormal time period are determined, the sender address and the receiver address are further clustered to determine the abnormal task. Since, in most cases there will be no abnormal tasks, the step of clustering the sender address and the receiver address is generally not performed, thereby reducing the amount of calculation and improving the efficiency of abnormal task detection execution. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1A flowchart of a blockchain-based abnormal task detection method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0021] It should be noted that, based on the present disclosure, those skilled in the art should understand that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement a device and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0022] The following will refer to Figure 1 The flowchart of the abnormal task detection method based on blockchain is shown, which introduces an abnormal task detection method based on blockchain.

[0023] The abnormal task detection method based on blockchain may include the following steps:

[0024] S100, in response to the current preset time period T now Finally, the features of each task distributor on the blockchain executing data change tasks in the most recent m preset time periods are input into the target LSTM model to obtain the performance of each task distributor in the next preset time period T next Prediction data for executing data change tasks within.

[0025] In this embodiment, the length of the preset time period can be set according to actual needs, for example: the length of the preset time period is 10 minutes or 30 minutes; there is no time interval between two adjacent preset time periods, that is, the end time point of the previous preset time period in two adjacent preset time periods is the start time point of the next preset time period; the data change task can be understood as a data calculation task preset by personnel, for example: a calculation task corresponding to a data value; each data change task corresponds to a changed data value, and within a preset time period, the task distributor will execute several data change tasks.

[0026] Furthermore, step S100 includes the following steps:

[0027] S110, obtaining the characteristics of the data change tasks of each task distributor on the blockchain within the most recent m preset time periods, so as to obtain a data change task feature vector list set A=(A 1 , A 2 , …, A i , …, A n ), i=1, 2,...,n; among them, A i A is the data change task feature vector list corresponding to the i-th task distributor; i =(A i，1 , A i，2 , …, A i，j , …, A i，m )、j=1,2,…,m;A i，j is the jth preset time period TQ of the i-th task dispatcher in the most recent m preset time periods j The data change task feature vector within A i，j =(A i，j _tag1, A i，j _tag2, A i，j _tag3, A i，j _tag4, A i，j _tag5, A i，j _tag6);A i，j _tag1 is TQ j Corresponding date; A i，j _tag2 is TQ j The corresponding identification within the preset period; A i，j _tag3 is TQ j The corresponding first type of time stamp, A i，j _tag3 is used to characterize TQ j Belong to working time or non-working time; A i，j _tag4 is TQ j The corresponding second type of time mark, A i，j _tag4 is used to characterize TQ j The peak period or non-peak period of the data change task; A i，j _tag5 is TQ j The corresponding network-wide active index group; A i，j _tag6 is TQ j The corresponding data change feature group, A i，j _tag6 includes the i-th task dispatcher in TQ j The total number of sender addresses corresponding to all data change tasks, the average changed data, and the volatility of the changed data.

[0028] In this embodiment, for any task distributor on the blockchain, when executing a data change task within the most recent m preset time periods, there is a corresponding data change task feature, and the features of the data change tasks of each task distributor on the blockchain within the most recent m preset time periods can be obtained to obtain a data change task feature vector list set A; among the most recent m preset time periods, for one of the preset time periods, the preset time period has several features, including: date, an identifier within the preset period, a first type of time identifier, a second type of time identifier, a full network activity index group, and a data change feature group; the identifier within the preset period can be understood as a week identifier, that is, the day of the week, for example: the identifier within the preset period is Wednesday; the full network activity index group can be The unit is minute, and the network-wide active index corresponding to each minute is obtained through the data released by relevant websites; the number of network-wide active indexes in the network-wide active index group can be equal to the number of minutes corresponding to the preset duration; any task distributor has the total number of sender addresses corresponding to the data change task within a preset time period, the average change data and the volatility of the change data, so as to obtain the corresponding data change feature group; the average change data can be understood as the average transaction amount, and the volatility of the change data can be understood as the variance of the corresponding transaction amount; through the above characteristics, it is possible to better characterize the overall situation of each task distributor executing the data change task in the most recent m preset time periods, so as to more accurately predict the situation of executing the data change task in the next preset time period.

[0029] S120, A i Input to the target LSTM model to obtain the i-th task distributor at T next Prediction data B for executing data change tasks i =(B i，1 , B i，2 , B i，3 ); where B i，1 For the i-th task dispatcher in T next The total number of prediction requests for data change tasks received within B i，2 For the i-th task dispatcher in T next The predicted total number of sender addresses corresponding to the data change task requests received within B i，3 For the i-th task dispatcher in T next The predicted average change data corresponding to the data change tasks received within.

[0030] In this embodiment, A i Input to the target LSTM model, it can predict the i-th task distributor at T next Prediction data B for executing data change tasks i .

[0031] Furthermore, the target LSTM model can be obtained by the following steps:

[0032] S131, obtaining a number of data change task feature vectors corresponding to each type of task distributor.

[0033] In this embodiment, based on the method in step S110, combined with the historical data of each type of task distributor, several data change task feature vectors of each type of task distributor in the historical time period can be obtained. The dimension of the data change task feature vector is the same as that of A in step S110. i，j The dimensions are the same.

[0034] S132, using a number of data change task feature vectors corresponding to each type of task distributor to train the initial LSTM model to obtain the target LSTM model.

[0035] In this embodiment, after obtaining a large number of data change task feature vectors, the initial LSTM model can be trained to obtain the target LSTM model; it should be noted that those skilled in the art can use existing LSTM model training methods to train the initial LSTM model according to actual needs to obtain the target LSTM model, which is not elaborated here; since the initial LSTM model is trained using several data change task feature vectors corresponding to each type of task distributor, the obtained target LSTM model is applicable to all types of task distributors.

[0036] S200, in response to T next End, get each task dispatcher in T next The actual data for executing data change tasks.

[0037] In this embodiment, at T next At the end, each task dispatcher is next The actual data of the data change task executed in the task dispatcher can be obtained; the actual data includes the next The actual total number of data change task requests received within T next The actual total number of sender addresses corresponding to the data change task requests received within T next The actual average change data corresponding to the data change tasks received within.

[0038] S300, according to each task distributor in T next The predicted data of the data change task executed within T next The actual data of the execution data change task within the task dispatcher is determined in T nextThe target deviation value between the predicted data and the actual data corresponding to the data change task is executed to obtain the target deviation value list λ=(λ 1 ,λ 2 , …, λ i , …, λ n ), i=1, 2,...,n; where, λ i For the i-th task dispatcher in T next The target deviation value between the predicted data and the actual data corresponding to the data change task executed internally, and n is the number of task distributors.

[0039] Furthermore, i This can be determined by the following steps:

[0040] S310, obtaining the i-th task distributor in T next The actual data C that performs the data change task i =(C i，1 , C i，2 , C i，3 ); where C i，1 For the i-th task dispatcher in T next The actual total number of data change task requests received within C i，2 For the i-th task dispatcher in T next The actual total number of sender addresses corresponding to the data change task requests received within C i，3 For the i-th task dispatcher in T next The actual average change data corresponding to the data change tasks received within.

[0041] S311, according to B i and C i , determine λ i =α 1 ×|B i，1 -C i，1 | / C i，1 +α 2 ×|B i，2 -C i，2 | / C i，2 +α 3 ×|B i，3 -C i，3 | / C i，3 ; Among them, α 1 is the first preset weight, α 2 is the second preset weight, α 3 is the third preset weight; α 1 +α 2 +α 3 =1.

[0042] In this embodiment, α1 , α 2 and α 3 It can be obtained through a large number of experiments. Through the above steps S310-S311, λ can be determined relatively quickly. i , the determined λ i It is obtained based on its own independent data and is not combined with the data of other task distributors. Therefore, the determined λ i It may not be accurate. Based on this, another λ is provided. i The method for determining comprises the following steps:

[0043] S320, obtain the i-th task distributor in T next The actual data C that performs the data change task i =(C i，1 , C i，2 , C i，3 ); where C i，1 For the i-th task dispatcher in T next The actual total number of data change task requests received within C i，2 For the i-th task dispatcher in T next The actual total number of sender addresses corresponding to the data change task requests received within C i，3 For the i-th task dispatcher in T next The actual average change data corresponding to the data change tasks received within.

[0044] S321, according to B i and C i , determine the first deviation value β corresponding to the i-th task distributor i , and then get the first deviation value list β=(β 1 , β 2 , …, β i , …, β n ); where β i =α 1 ×|B i，1 -C i，1 | / C i，1 +α 2 ×|B i，2 -C i，2 | / C i，2 +α 3 ×|B i，3 -C i，3 | / C i，3 ; Among them, α 1 is the first preset weight, α 2 is the second preset weight, α 3 is the third preset weight; α 1 +α 2+α 3 =1.

[0045] S322, according to β, determine the second deviation value γ corresponding to the i-th task distributor i =|β i -(1 / n)×∑ n i=1 β i | / ((1 / n)×∑ n i=1 β i ).

[0046] S323, according to β i and γ i , determine λ i =α 4 ×β i +α 5 ×γ i ; Among them, α 4 is the fourth preset weight, α 5 is the fifth preset weight; α 4 +α 5 =1.

[0047] In this embodiment, through the above steps S320-S323, the λ i , not only combines the data of the i-th task distributor itself, but also compares it with other task distributors horizontally, to avoid the normal situation where the data of all task distributors fluctuate greatly. i The value of is large, which leads to misjudgment of the i-th task distributor.

[0048] S400, traverse λ, if λ i >λ', the i-th task dispatcher is determined as an abnormal task dispatcher, and T next Determined as an abnormal time period; wherein λ' is a preset target deviation value threshold.

[0049] In this embodiment, if λ i >λ', indicating that the deviation between the predicted data of the ith task distributor and the actual data is large, and the ith task distributor is next An abnormal task may be executed, so the i-th task dispatcher is determined as an abnormal task dispatcher, and T next Determined as an abnormal time period; it is understandable that in T next There will be a large number of data change tasks, among which only some data change tasks are abnormal tasks.

[0050] S500, for each abnormal task dispatcher in T nextThe sender address corresponding to each data change task executed in the cluster is clustered to obtain a plurality of first initial entities corresponding to each abnormal task distributor; the first initial entity is a computer device corresponding to the sender address.

[0051] In this embodiment, each data change task corresponds to a sender address. At the same time, the data change task also corresponds to several historical behavior characteristics, such as: the request time of the data change task, the corresponding data value, the task type, whether a large number of task requests are issued when the data change task request is issued, etc. Based on the historical behavior characteristics corresponding to the data change task, each abnormal task dispatcher can be next The sender address corresponding to each data change task executed in T is clustered to obtain a number of first initial entities; each first initial entity can be understood as a computer device; it should be noted that those skilled in the art can use the existing historical behavior characteristics obtained based on the data change task correspondence according to actual needs to cluster each abnormal task dispatcher in T next The sender address corresponding to each data change task executed in the cluster is clustered to obtain a number of first initial entities corresponding to each abnormal task distributor, which will not be repeated here.

[0052] S600, determine the first abnormal entity corresponding to each task distributor according to the characteristics of each first initial entity corresponding to each abnormal task distributor executing the historical data change task and the number of requests for data change tasks initiated within the abnormal time period; the first abnormal entity is the first initial entity with an abnormality.

[0053] In this embodiment, each abnormal task distributor corresponds to a plurality of first initial entities, and the first abnormal entity may exist in the plurality of initial entities. Therefore, it is necessary to further determine the first abnormal entity corresponding to each task distributor.

[0054] Further, step S600 may include the following steps:

[0055] S610, obtaining each first initial entity corresponding to each abnormal task distributor in T next The first eigenvector in the eigenvector to obtain the first eigenvector list set D = (D 1 , D 2 , …, D x , …, D y ), x=1, 2, …, y; where D x is the first feature vector list corresponding to the xth abnormal task distributor, y is the number of abnormal task distributors; D x =(D x，1 , D x，2 , …, D x，u , …, Dx，f（x） ), u=1, 2,…, f(x); D x，u The uth first initial entity ST corresponding to the xth abnormal task distributor x，u In T next The first eigenvector in, f(x) is the number of the first initial entity corresponding to the x-th abnormal task distributor; D x，u Including ST x，u In T next The total number of sender addresses, the total number of receiver addresses, the average change data, and the volatility of the change data.

[0056] In this embodiment, each first initial entity corresponding to each task distributor is next There are several data change tasks in the corresponding data, which can obtain each first initial entity in T next The total number of sender addresses, the total number of receiver addresses, the average change data and the volatility of the change data corresponding to the first initial entity in T are obtained; the average change data can be understood as the first initial entity corresponding to the first initial entity in T next The average changed data value of the data change tasks initiated within the task; the volatility of the changed data can be understood as the variance of the corresponding changed data value; when the data change task is a transaction task, the changed data value can be understood as the transaction amount.

[0057] S620, obtain D x，u With D x，u ' Similarity between XD x，u Among them, D x，u 'For ST x，u The historical average feature vector within a certain historical preset time period; D x，u 'Including ST x，u The average total number of sender addresses, the average total number of receiver addresses, the average change data, and the average volatility of the change data within several historical preset time periods.

[0058] In this embodiment, each first initial entity has historical records of corresponding data change tasks within several historical preset times. The average total number of sender addresses, the average total number of receiver addresses, the average change data and the average volatility of the change data of each first initial entity within each historical preset time can be obtained through the corresponding historical records, and the historical feature vector of each first initial entity within each historical preset time is obtained. Then, the average vector of all historical feature vectors corresponding to each first initial entity is calculated to obtain the historical average feature vector of each first initial entity within several historical preset time periods.

[0059] S630, if XD x，u <XD' and NUMnext / NUM>σ, then ST x，u Determined to be the first anomalous entity; otherwise, ST x，u Determined as a normal entity; where XD' is the preset similarity threshold; NUM next For ST x，u In T next The number of data change task requests initiated, NUM is ST x，u The average number of data change task requests initiated within a number of historical preset time periods, σ is a preset threshold value for the change rate of the number of data change task requests; σ>1.

[0060] In this embodiment, under normal circumstances, the characteristics of the data change tasks corresponding to an entity within a preset time period should be relatively similar and will not change significantly; therefore, if XD x，u <XD' and NUM next / NUM>σ, indicating ST x，u In T next If the characteristics of the corresponding data change task have changed significantly, and the number of initiated data change task requests has changed significantly compared to the previous average number, then ST x，u Determined as the first abnormal entity; XD' and σ can be obtained by analyzing a large amount of historical data.

[0061] S700, for each abnormal task dispatcher in T next The actual recipient address corresponding to each data change task executed in the cluster is clustered to obtain a number of second initial entities corresponding to each abnormal task distributor; the second initial entity is a computer device corresponding to the actual recipient address.

[0062] In this embodiment, for each data change task, the apparent recipient address is the address of the task distributor, and each data change task corresponds to an actual recipient address. At the same time, the data change task also corresponds to a number of historical behavior characteristics, such as: the request time of the data change task, the corresponding data value, the task type, whether a large number of task requests are issued when the data change task request is issued, etc. Based on the historical behavior characteristics of the data change task, each abnormal task distributor can be next The actual recipient address corresponding to each data change task executed in the cluster is clustered to obtain a number of second initial entities; each second initial entity can be understood as a computer device; it should be noted that those skilled in the art can use the existing historical behavior characteristics obtained based on the data change task correspondence according to actual needs, and each abnormal task dispatcher in T nextThe actual recipient addresses corresponding to each data change task executed within are clustered to obtain a number of second initial entities corresponding to each abnormal task distributor, which will not be elaborated here.

[0063] S800: If the number of the second initial entities is less than a preset second initial entity number threshold, a number of data change tasks corresponding to the first abnormal entity and the second initial entity are determined as abnormal tasks.

[0064] In this embodiment, if the number of the second initial entities is less than the preset second initial entity number threshold, it means that in T nect There are data change tasks executed between a large number of entities and a small number of entities, that is, a user controls multiple computer devices and uses the multiple computer devices to send data change task requests to a small number of computer devices, so that the task distributor instantly receives a large number of data change task requests. Therefore, several data change tasks corresponding to the first abnormal entity and the second initial entity are determined as abnormal tasks.

[0065] Further, step S800 may include the following steps:

[0066] S810: If the number of the second initial entities is less than a preset second initial entity number threshold, all data change tasks corresponding to the first abnormal entity and all data change tasks corresponding to the second initial entity are obtained.

[0067] S820, perform deduplication processing on all data change tasks corresponding to the first abnormal entity and all data change tasks corresponding to the second initial entity to obtain abnormal tasks.

[0068] Furthermore, in order to improve the accuracy of determining the abnormal task, the intersection of all data change tasks corresponding to the first abnormal entity and all data change tasks corresponding to the second initial entity may be calculated to obtain the abnormal task.

[0069] The abnormal task detection method based on blockchain in this embodiment responds to the current preset time period T now End, the target LSTM model is used to predict each task dispatcher in the next preset time period T next The predicted data of the data change task is executed in T next The actual data of the data change task executed within the time period is used to determine the target deviation value between the predicted data and the actual data corresponding to the data change task executed by each task distributor, so as to determine the abnormal task distributor and the abnormal time period according to the size of the target deviation value of each task distributor and the preset target deviation value threshold; there may be abnormal tasks in the data change tasks executed by the abnormal task distributor within the abnormal time period; then, for each abnormal task distributor in Tnext Cluster and analyze the sender address corresponding to each data change task executed in T to determine the first abnormal entity corresponding to each task dispatcher; next The actual recipient address corresponding to each data change task executed in T is clustered to obtain a number of second initial entities corresponding to each abnormal task dispatcher; if the number of second initial entities is less than the preset second initial entity number threshold, it means that in T next There are a large number of entities and a small number of entities performing data change tasks. It is possible that personnel are using the task distributor of the blockchain to make abnormal assets appear normal. Therefore, several data change tasks corresponding to the first abnormal entity and the second initial entity are determined as abnormal tasks; thereby, when personnel attack the task distributor through a large number of data change tasks, the abnormal tasks can be accurately detected.

[0070] Furthermore, the method of the present invention first uses the predicted data and actual data to determine the abnormal task distributor and the abnormal time period. Only after the abnormal task distributor and the abnormal time period are determined, the sender address and the receiver address are further clustered to determine the abnormal task. Since, in most cases there will be no abnormal tasks, the step of clustering the sender address and the receiver address is generally not performed, thereby reducing the amount of calculation and improving the efficiency of abnormal task detection execution.

[0071] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0072] An embodiment of the present invention also provides a non-transitory computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to implementing a method in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method provided in the above embodiment.

[0073] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0074] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0075] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0076] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0077] An embodiment of the present invention further provides an electronic device, comprising a processor and the aforementioned non-transitory computer-readable storage medium.

[0078] The electronic device is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0079] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the at least one processor mentioned above, the at least one memory mentioned above, and a bus connecting different system components (including the memory and the processor).

[0080] The memory stores program codes, which can be executed by the processor, so that the processor executes the steps in various embodiments described in this specification.

[0081] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0082] The memory may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include an implementation of a network environment.

[0083] The bus may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0084] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device (e.g., routers, modems, etc.) that enables the electronic device to communicate with one or more other computing devices. Such communication may be performed through an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter. The network adapter communicates with other modules of the electronic device through a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0085] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0086] An embodiment of the present invention further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present invention described above in this specification.

[0087] Although some specific embodiments of the present invention have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are only for illustration, not for limiting the scope of the present invention. It should also be understood by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present invention.

Claims

1. A method for detecting abnormal tasks based on blockchain, characterized in that: The method comprises the following steps: S100, in response to the current preset time period T now Finally, the features of each task distributor on the blockchain executing data change tasks in the most recent m preset time periods are input into the target LSTM model to obtain the performance of each task distributor in the next preset time period T next Predicted data for executing data change tasks within the system; S200, in response to T next End, get each task dispatcher in T next The actual data of the data change task executed within; S300, according to each task distributor in T next The predicted data of the data change task executed within T next The actual data of the execution data change task within the task dispatcher is determined in T next The target deviation value between the predicted data and the actual data corresponding to the data change task is executed to obtain the target deviation value list λ=(λ1, λ2, …, λ i , …, λ n ), i=1, 2,...,n; where, λ i For the i-th task dispatcher in T next The target deviation value between the predicted data and the actual data corresponding to the internal execution data change task, n is the number of task distributors; S400, traverse λ, if λ i >λ', the i-th task dispatcher is determined as an abnormal task dispatcher, and T next Determined as an abnormal time period; wherein λ' is a preset target deviation value threshold; S500, for each abnormal task dispatcher in T next The sender address corresponding to each data change task executed in the cluster is clustered to obtain a plurality of first initial entities corresponding to each abnormal task distributor; the first initial entity is a computer device corresponding to the sender address; S600, determining the first abnormal entity corresponding to each task distributor according to the characteristics of each first initial entity corresponding to each abnormal task distributor executing the historical data change task and the number of requests for the data change task initiated within the abnormal time period; the first abnormal entity is the first initial entity with an abnormality; S700, for each abnormal task dispatcher in T next The actual receiver address corresponding to each data change task executed in the cluster is clustered to obtain a plurality of second initial entities corresponding to each abnormal task distributor; the second initial entity is a computer device corresponding to the actual receiver address; S800: If the number of the second initial entities is less than a preset second initial entity number threshold, a number of data change tasks corresponding to the first abnormal entity and the second initial entity are determined as abnormal tasks.

2. The abnormal task detection method based on blockchain according to claim 1 is characterized in that: Step S100 includes the following steps: S110, obtaining the characteristics of the data change tasks of each task distributor on the blockchain within the most recent m preset time periods, so as to obtain a data change task feature vector list set A = (A1, A2, ..., A i , …, A n ); where A i A is the data change task feature vector list corresponding to the i-th task distributor; i =(A i，1 , A i，2 , …, A i，j , …, A i，m )、j=1,2,…,m;A i，j is the jth preset time period TQ of the i-th task dispatcher in the most recent m preset time periods j The data change task feature vector within A i，j =(A i，j _tag1, A i，j _tag2, A i，j _tag3, A i，j _tag4, A i，j _tag5, A i，j _tag6);A i，j _tag1 is TQ j Corresponding date; A i，j _tag2 is TQ j The corresponding identification within the preset period; A i，j _tag3 is TQ j The corresponding first type of time stamp, A i，j _tag3 is used to characterize TQ j Belong to working time or non-working time; A i，j _tag4 is TQ j The corresponding second type of time mark, A i，j _tag4 is used to characterize TQ j The peak period or non-peak period of the data change task; A i，j _tag5 is TQ j The corresponding network-wide active index group; A i，j _tag6 is TQ j The corresponding data change feature group, A i，j _tag6 includes the i-th task dispatcher in TQ j The total number of sender addresses corresponding to all data change tasks, the average change data, and the volatility of the change data; S120, A i Input to the target LSTM model to obtain the i-th task distributor at T next Prediction data B for executing data change tasks i =(B i，1 , B i，2 , B i，3 ); where B i，1 For the i-th task dispatcher in T next The total number of prediction requests for data change tasks received within B i，2 For the i-th task dispatcher in T next The predicted total number of sender addresses corresponding to the data change task requests received within B i，3 For the i-th task dispatcher in T next The predicted average change data corresponding to the data change tasks received within.

3. The abnormal task detection method based on blockchain according to claim 2 is characterized in that: λ i Determine by following these steps: S310, obtaining the i-th task distributor in T next The actual data C that performs the data change task i =(C i，1 , C i，2 , C i，3 ); Among them, C i，1 For the i-th task dispatcher in T next The actual total number of data change task requests received within C i，2 For the i-th task dispatcher in T next The actual total number of sender addresses corresponding to the data change task requests received within C i，3 For the i-th task dispatcher in T next The actual average change data corresponding to the data change tasks received; S311, according to B i and C i , determine λ i =α1×|B i，1 -C i，1 | / C i，1 +α2×|B i，2 -C i，2 | / C i，2 +α3×|B i，3 -C i，3 | / C i，3 ; Among them, α1 is the first preset weight, α2 is the second preset weight, and α3 is the third preset weight; α1+α2+α3=1.

4. The abnormal task detection method based on blockchain according to claim 2 is characterized in that: λ i Determine by following these steps: S320, obtain the i-th task distributor in T next The actual data C that performs the data change task i =(C i，1 , C i，2 , C i，3 ); Among them, C i，1 For the i-th task dispatcher in T next The actual total number of data change task requests received within C i，2 For the i-th task dispatcher in T next The actual total number of sender addresses corresponding to the data change task requests received within C i，3 For the i-th task dispatcher in T next The actual average change data corresponding to the data change tasks received; S321, according to B i and C i , determine the first deviation value β corresponding to the i-th task distributor i , and then get the first deviation value list β = (β1, β2, ..., β i , …, β n ); where β i =α1×|B i，1 -C i，1 | / C i，1 +α2×|B i，2 -C i，2 | / C i，2 +α3×|B i，3 -C i，3 | / C i，3 ; Wherein, α1 is the first preset weight, α2 is the second preset weight, and α3 is the third preset weight; α1+α2+α3=1; S322, according to β, determine the second deviation value γ corresponding to the i-th task distributor i =|β i -(1 / n)×∑ n i=1 β i | / ((1 / n)×∑ n i=1 β i ); S323, according to β i and γ i , determine λ i =α4×β i +α5×γ i ; Among them, α4 is the fourth preset weight, α5 is the fifth preset weight; α4+α5=1.

5. The abnormal task detection method based on blockchain according to claim 1 is characterized in that: Step S600 includes the following steps: S610, obtaining each first initial entity corresponding to each abnormal task distributor in T next The first eigenvector in the eigenvector is obtained to obtain the first eigenvector list set D = (D1, D2, ..., D x , …, D y ), x=1, 2, …, y; where D x is the first feature vector list corresponding to the xth abnormal task distributor, y is the number of abnormal task distributors; D x =(D x，1 , D x，2 , …, D x，u , …, D x，f（x） ), u=1, 2,…, f(x); D x，u The uth first initial entity ST corresponding to the xth abnormal task distributor x，u In T next The first eigenvector in, f(x) is the number of the first initial entity corresponding to the x-th abnormal task distributor; D x，u Including ST x，u In T next The total number of sender addresses, the total number of receiver addresses, the average change data, and the volatility of the change data; S620, obtain D x，u With D x，u 'The similarity between XD x，u ; Among them, D x，u 'For ST x，u The historical average feature vector within a certain historical preset time period; D x，u 'Including ST x，u The average total number of sender addresses, the average total number of receiver addresses, the average change data, and the average volatility of the change data within a certain historical preset time period; S630, if XD x，u <XD' and NUM next / NUM>σ, then ST x，u Confirmed as the first anomalous entity; otherwise, ST x，u Determined as a normal entity; where XD' is the preset similarity threshold; NUM next For ST x，u In T next The number of data change task requests initiated, NUM is ST x，u The average number of data change task requests initiated within a number of historical preset time periods, σ is a preset threshold value for the change rate of the number of data change task requests; σ>1.

6. The abnormal task detection method based on blockchain according to claim 2 is characterized in that: The target LSTM model is obtained by the following steps: S131, obtaining a number of data change task feature vectors corresponding to each type of task distributor; S132, using a number of data change task feature vectors corresponding to each type of task distributor to train the initial LSTM model to obtain the target LSTM model.

7. The abnormal task detection method based on blockchain according to claim 1 is characterized in that: Step S800 includes the following steps: S810, if the number of the second initial entities is less than a preset second initial entity number threshold, obtaining all data change tasks corresponding to the first abnormal entity and all data change tasks corresponding to the second initial entity; S820, perform deduplication processing on all data change tasks corresponding to the first abnormal entity and all data change tasks corresponding to the second initial entity to obtain abnormal tasks.

8. A non-transitory computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, characterized in that: The at least one instruction or the at least one program is loaded and executed by the processor to implement the blockchain-based abnormal task detection method as described in any one of claims 1-7.

9. An electronic device, characterized in that: Includes a processor and the non-transitory computer-readable storage medium of claim 8.

Images