Automotive financial transaction security management method, system and device based on blockchain technology

Abstract

The present invention discloses a method, system and device for managing automobile financial transaction security based on blockchain technology, which relates to the field of data processing technology. The method comprises: obtaining automobile financial transaction data and automobile financial transaction network, matching a first time interval, the automobile financial transaction network comprising a plurality of blockchain nodes; obtaining a first blockchain node, obtaining a first data flow, obtaining a second data flow, obtaining a first suspicious flow, obtaining a first security indicator; obtaining a second time point, obtaining a third data flow, obtaining a fourth data flow, obtaining a second suspicious flow, obtaining a second security indicator; obtaining a preset threshold, obtaining a difference indicator, if the difference indicator exceeds the preset threshold, then correcting the first time interval and forming a second time interval matching the automobile financial transaction data, and starting an early warning, and obtaining an early warning strategy according to the first security indicator and the second security indicator. The present invention has the advantages of accuracy and timeliness, dynamic adjustment and high resource utilization.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, system and device for secure management of automobile financial transactions based on blockchain technology. Background Art

[0002] With the rapid development of the auto finance industry, the scale and complexity of transaction data are also increasing. Auto finance transactions involve multiple sensitive areas such as capital flow, vehicle information, and customer information. Their security is crucial to protecting the interests of all parties and maintaining market order. However, traditional auto finance transaction security management methods often rely on centralized management systems, which have problems such as data tampering risks, single point failure risks, and high trust costs. Blockchain technology, as a decentralized and tamper-proof distributed ledger technology, provides a new approach to the security management of auto finance transactions; it ensures the integrity, authenticity, and traceability of data through technical means such as encryption algorithms, consensus mechanisms, and timestamps, effectively reducing the trust costs and security risks in the transaction process.

[0003] However, existing blockchain security management methods often focus on static analysis of a single node, ignoring the dynamic changes in data traffic between nodes and the potential impact of these changes on transaction security. In the automobile financial transaction network, each blockchain node is responsible for storing and transmitting transaction data, and the change in node data traffic is an important indicator reflecting the network status and security; at the same time, existing methods cannot capture abnormal fluctuations in data traffic between nodes in a timely manner. For example, a large amount of suspicious traffic suddenly appears at a node, which may be caused by malicious attacks, data leakage or system failure. There is also a lack of a mechanism to dynamically adjust the frequency of traffic acquisition, and it is impossible to optimize security management strategies according to the actual transaction data type and risk environment. Summary of the invention

[0004] In view of the defects in the prior art, the present invention provides a method, system and device for secure management of automobile financial transactions based on blockchain technology.

[0005] A method for managing automobile financial transaction security based on blockchain technology, comprising: obtaining automobile financial transaction data, obtaining an automobile financial transaction network for circulating automobile financial transaction data, and matching a first time interval according to the automobile financial transaction data, wherein the automobile financial transaction network includes multiple blockchain nodes; obtaining a blockchain node with data transmission traffic and serving it as a first blockchain node, obtaining a first data traffic of the first blockchain node at a first time point, and obtaining a second data traffic of a blockchain node adjacent to the first blockchain node at the first time point, obtaining a first suspicious traffic according to the first data traffic and the second data traffic, and obtaining a first security indicator based on a security indicator model and the first suspicious traffic; obtaining a first suspicious traffic corresponding to the first time point; obtaining a first suspicious traffic corresponding to the first suspicious traffic ... A second time point is determined at a time point that is an interval between the first time interval and the second time point, and a third data flow of the first blockchain node is obtained at the second time point, and a fourth data flow of a blockchain node adjacent to the first blockchain node is obtained at the second time point, a second suspicious flow is obtained according to the third data flow and the fourth data flow, and a second security indicator is obtained based on the security indicator model and the second suspicious flow; a preset threshold is obtained, and a difference indicator is obtained based on the suspicious indicator model, the first time interval, the first suspicious flow and the second suspicious flow. If the difference indicator exceeds the preset threshold, the first time interval is corrected according to the difference indicator and a second time interval matching the automobile financial transaction data is formed, and an early warning is started, and an early warning strategy is obtained according to the first security indicator and the second security indicator.

[0006] Optionally, correcting the first time interval according to the difference indicator and forming a second time interval matching the automobile financial transaction data includes: obtaining a correction ratio according to the difference indicator and a preset threshold; and obtaining a second time interval matching the automobile financial transaction data according to the correction ratio and the first time interval.

[0007] Optionally, the correction ratio is obtained based on the difference indicator and the preset threshold value as follows: ;in, To correct the ratio, is the standard ratio, is the difference indicator, is the preset threshold.

[0008] Optionally, obtaining a warning strategy based on the first security indicator and the second security indicator includes: obtaining a capture time based on the first security indicator and the second security indicator; capturing the traffic data of the first blockchain node within the capture time and packaging it to form a threat data packet, attaching a timestamp to the threat data packet, and issuing a warning.

[0009] Optionally, obtaining the first security indicator based on the security indicator model and the first suspicious traffic includes: obtaining a preset additional traffic threshold of the first blockchain node; obtaining the first security indicator based on the security indicator model, the preset additional traffic threshold and the first suspicious traffic.

[0010] Optionally, the security indicator model in obtaining the first security indicator based on the security indicator model, the preset additional traffic threshold and the first suspicious traffic is expressed as: ;in, The first safety indicator, To preset the additional flow threshold, is the first data flow, The second data flow.

[0011] Optionally, the suspicious indicator model in obtaining the difference indicator based on the suspicious indicator model, the first time interval, the first suspicious flow, and the second suspicious flow is expressed as: ;in, is the difference indicator, is the first data flow, is the second data flow, For the third data flow, is the fourth data flow, is the first time interval.

[0012] An automobile financial transaction security management system based on blockchain technology is also provided, the system comprising: an acquisition module, used to acquire automobile financial transaction data, and acquire an automobile financial transaction network for circulating automobile financial transaction data, and match a first time interval according to the automobile financial transaction data, wherein the automobile financial transaction network comprises a plurality of blockchain nodes; a first data acquisition and processing module, used to acquire a blockchain node with data transmission traffic and use it as a first blockchain node, and acquire a first data traffic of the first blockchain node at a first time point, and acquire a second data traffic of a blockchain node adjacent to the first blockchain node at the first time point, acquire a first suspicious traffic according to the first data traffic and the second data traffic, and acquire a first security indicator based on a security indicator model and the first suspicious traffic; a second data acquisition and processing module, used to acquire a first suspicious traffic according to the first data traffic and the second data traffic, and acquire a first security indicator based on a security indicator model and the first suspicious traffic; a second data acquisition and processing module, used to acquire a first suspicious traffic according to the first data traffic and the second data traffic, and acquire a first security indicator based on the ... suspicious traffic according to the first suspicious traffic. A set processing module, used to obtain a second time point separated from the first time point by the first time interval, and obtain a third data flow of the first blockchain node at the second time point, and obtain a fourth data flow of a blockchain node adjacent to the first blockchain node at the second time point, obtain a second suspicious flow according to the third data flow and the fourth data flow, and obtain a second security indicator based on the security indicator model and the second suspicious flow; an analysis and early warning module, used to obtain a preset threshold, obtain a difference indicator based on the suspicious indicator model, the first time interval, the first suspicious flow and the second suspicious flow, if the difference indicator exceeds the preset threshold, then correct the first time interval according to the difference indicator and form a second time interval matching the automobile financial transaction data, and start an early warning, and obtain an early warning strategy according to the first security indicator and the second security indicator.

[0013] An electronic device is also provided, comprising: a memory on which a computer program is stored; and a processor for executing the computer program in the memory to implement the above-mentioned automobile financial transaction security management method based on blockchain technology.

[0014] A non-temporary computer-readable storage medium is also provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned automobile financial transaction security management method based on blockchain technology is implemented.

[0015] The beneficial effects of the present invention are embodied in:

[0016] In the entire automobile financial transaction security management method based on blockchain technology, by obtaining automobile financial transaction data and matching the corresponding time intervals, it is ensured that the monitoring frequency is adapted to the type and scale of transaction data, which not only avoids excessive network load caused by too frequent monitoring, but also ensures that changes in data traffic can be captured in a timely manner; further, by selecting blockchain nodes with data transmission traffic as monitoring objects, and calculating the suspicious traffic between them and adjacent nodes, and using the security indicator model to evaluate the security of the nodes, it is possible to achieve key monitoring of key nodes in the network. By obtaining data traffic at different time points and calculating changes in suspicious traffic, it can dynamically reflect the changing trends of network status and security; more importantly, The key point is that the solution introduces a comparison mechanism between the difference indicator and the preset threshold. When the difference indicator exceeds the preset threshold, it means that the change in data traffic has exceeded the normal range, and there may be security risks or abnormal behavior. At this time, the solution will dynamically adjust the time interval for obtaining data traffic according to the difference between the difference indicator and the preset threshold, and form a new time interval that is more in line with the current automobile financial transaction data. This dynamic adjustment mechanism ensures that the system can capture abnormal fluctuations in data traffic in a timely manner and optimize security management strategies for different risk environments. It considers appropriately increasing the time interval to optimize network performance when the network load is low or the data traffic changes are relatively stable, reflecting the solution's efficient use of network resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0018] Figure 1 This is a schematic diagram of the steps of the automobile financial transaction security management method based on blockchain technology of the present invention;

[0019] Figure 2It is a schematic diagram of some steps of S4 in the automobile financial transaction security management method based on blockchain technology of the present invention;

[0020] Figure 3 This is another schematic diagram of steps S4 in the automobile financial transaction security management method based on blockchain technology of the present invention;

[0021] Figure 4 This is a schematic diagram of some steps of S2 in the automobile financial transaction security management method based on blockchain technology of the present invention;

[0022] Figure 5 The present invention is a block diagram of an electronic device according to an embodiment of the present invention.

[0023] Reference numerals:

[0024] 700 - electronic device, 701 - processor, 702 - memory, 703 - multimedia component, 704 - I / O interface, 705 - communication component. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0026] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. In addition, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0028] like Figure 1 As shown, a method for secure management of automobile financial transactions based on blockchain technology is provided, including:

[0029] S1. Acquire automobile finance transaction data, acquire an automobile finance transaction network for circulating the automobile finance transaction data, and match a first time interval according to the automobile finance transaction data, wherein the automobile finance transaction network includes a plurality of blockchain nodes;

[0030] S2. Obtain a blockchain node with data transmission traffic and use it as a first blockchain node, obtain a first data traffic of the first blockchain node at a first time point, and obtain a second data traffic of a blockchain node adjacent to the first blockchain node at the first time point, obtain a first suspicious traffic according to the first data traffic and the second data traffic, and obtain a first security indicator based on the security indicator model and the first suspicious traffic;

[0031] S3, obtaining a second time point separated from the first time point by the first time interval, obtaining a third data flow of the first blockchain node at the second time point, and obtaining a fourth data flow of a blockchain node adjacent to the first blockchain node at the second time point, obtaining a second suspicious flow according to the third data flow and the fourth data flow, and obtaining a second security indicator based on the security indicator model and the second suspicious flow;

[0032] S4. Obtain a preset threshold, and obtain a difference indicator based on the suspicious indicator model, the first time interval, the first suspicious flow, and the second suspicious flow. If the difference indicator exceeds the preset threshold, correct the first time interval according to the difference indicator and form a second time interval that matches the automobile financial transaction data, start warning, and obtain a warning strategy based on the first safety indicator and the second safety indicator.

[0033] In this embodiment, it should be noted that in S1, automobile financial transaction data is first obtained, which includes but is not limited to transaction amount, transaction time, information of both parties to the transaction, vehicle information, etc. They are the core content of automobile financial transactions and the basis for subsequent security management. At the same time, the present invention also obtains an automobile financial transaction network for circulating these transaction data, which is composed of multiple blockchain nodes, and each node is responsible for storing and transmitting transaction data. In order to more accurately monitor and analyze the changes in data flow in the network, the present invention also matches the first time interval according to the obtained automobile financial transaction data. The setting of this time interval is not arbitrary, but is determined based on the type and scale of transaction data and the actual situation of the network. For example, for automobile financial transactions with high data confidentiality requirements, high data importance and high network security requirements, a relatively short time interval may be set to capture changes in data flow more promptly.

[0034] For example, assume that the transaction data on a certain automobile financial transaction platform mainly includes vehicle loans, insurance purchases, and leasing services. Then, when setting the first time interval, the present invention may take into account the peak and trough periods of these transaction activities, as well as the overall scale of transaction data and the processing capacity of the network. For example, in the morning and afternoon periods when transaction activities are more frequent, a shorter time interval may be set, such as obtaining data traffic every 1 second; and in the night period when transaction activities are relatively less, a longer time interval may be set, such as obtaining data traffic every 30 seconds. In this way, it can ensure that abnormal fluctuations in data traffic are captured in a timely manner, and avoid obtaining data traffic too frequently when the network load is high, thereby ensuring the overall performance and stability of the network.

[0035] In S2, a blockchain node with data transmission traffic is first determined, and it is monitored as the first blockchain node; in the automobile financial transaction network, the change of data traffic often directly reflects the state and security of the network, and the node with data transmission traffic is a key node in the network, and the abnormal fluctuation of its data traffic may indicate a potential security risk. Then, at a first time point, the first data traffic of the first blockchain node is obtained, and the second data traffic of the blockchain node adjacent to the first blockchain node is obtained at the same time. The first time point here is a relative time concept, which can be a time point set when the network is initialized, or a time point automatically matched according to the first time interval. By comparing the first data traffic and the second data traffic, the present invention can calculate the first suspicious traffic, that is, the degree of difference between the first data traffic and the second data traffic; this degree of difference represents the traffic difference between two adjacent blockchain nodes, and the greater the difference, the more likely it is that there is a large amount of suspicious traffic in the first blockchain node. Finally, the present invention calculates the first security index based on the security index model and the first suspicious traffic; the first security index is a quantitative index used to evaluate the security of the first blockchain node at the current time point.

[0036] For example, suppose that in an automobile financial transaction network, a blockchain node A has a data flow of 100MB / s at a first point in time, while the data flow of the adjacent blockchain node B is 50MB / s. Then, the first suspicious flow is obtained based on the first data flow and the second data flow. Next, the present invention uses a pre-built security index model, takes the first suspicious flow as input, and calculates a first security index. Assuming that the output range of the security index model is between 0 and 1, the larger the value, the higher the security. If the calculated first security index is 1, it means that at the current point in time, the security of blockchain node A is relatively high and needs to continue to be monitored. If the first security index is low, such as lower than 1, then it is necessary to further analyze and process the suspicious traffic to ensure the security of the network.

[0037] In S3, the data flow of the first blockchain node continues to be monitored, and at a second time point separated from the first time point by a first time interval, the data flow of the first blockchain node is obtained again, which is called the third data flow. At the same time, the data flow of the blockchain node adjacent to the first blockchain node is also obtained at the second time point, which is called the fourth data flow. The purpose of this step is to further analyze the data flow change trend of the first blockchain node and its adjacent nodes, and whether there are abnormal fluctuations by comparing the data flow at different time points. By calculating the degree of difference between the third data flow and the fourth data flow, the present invention obtains the second suspicious flow. This second suspicious flow reflects the difference in the change of data flow between the first blockchain node and its adjacent nodes within the first time interval. Similar to step S2, the second suspicious flow is also one of the important indicators for evaluating network security. Finally, the present invention calculates a second security index based on the security index model and the second suspicious flow. This second security index is used to evaluate the security of the first blockchain node at the current time point after the first time interval.

[0038] For example, suppose that in an automobile financial transaction network, the data flow of a blockchain node A at the first time point is 100MB / s, and the data flow of its adjacent blockchain node B is 50MB / s. After a first time interval (such as 1s), at the second time point, the data flow of node A becomes 120MB / s, and the data flow of node B becomes 40MB / s. At this time, the calculated third data flow and the second suspicious flow of the fourth data flow. Using the security index model, the second suspicious flow is taken as input to calculate the second security index, which is assumed to be 0.9. By comparing the first security index and the second security index, it can be found that the security of node A has decreased. This may mean that node A or its adjacent nodes have some abnormal behavior, such as being attacked by malicious means. Therefore, it is necessary to further analyze and process this suspicious flow to ensure the security of the network.

[0039] In S4, the frequency of obtaining data traffic is optimized through a dynamic adjustment mechanism to better adapt to the actual risk environment in the automobile financial transaction network. First, the system will set a preset threshold, which is determined based on historical data, network conditions and security policies, and is used to measure the normal range of data traffic changes. Then, the system will use the suspicious indicator model to combine the first suspicious traffic and the second suspicious traffic obtained in the first time interval to calculate a difference indicator. This difference indicator actually reflects the degree of change of abnormal data traffic within the set time interval. If the difference indicator exceeds the preset threshold, it means that the degree of change of abnormal data traffic exceeds the suspicious range, and it is directly determined that there is a security risk or abnormal behavior; at this time, on the one hand, the system will dynamically adjust the time interval for obtaining data traffic according to the difference between the difference indicator and the preset threshold, forming a second time interval that is more matched with the current automobile financial transaction data, and realizing more reliable monitoring of blockchain nodes with abnormalities. On the other hand, it starts to warn, and obtains specific warning strategies based on the first security indicator and the second security indicator. Different first security indicators and second security indicators adopt different ways of blocking data, etc. At the same time, in some environments, if the difference indicator does not exceed the preset threshold, the time interval is appropriately increased. This adjustment mechanism not only ensures that the system can capture data traffic in a timely manner, but also avoids obtaining data too frequently when the network load is high. It improves the overall performance and stability of the network while ensuring security.

[0040] For example, suppose that in an automobile financial transaction network, the preset threshold is 0.5, and the calculated difference index is 0.6, which exceeds the preset threshold. This means that within the first time interval, there is a significant anomaly in the change of data flow between the first blockchain node and its adjacent nodes. Assuming that according to the difference index and the preset threshold, the present invention calculates a correction ratio of 0.5, and applies this correction ratio to the first time interval. Assuming that the first time interval was originally 1s, the adjusted second time interval is 0.5s. In this way, the monitoring frequency is adjusted from obtaining data flow once every 1 second to obtaining it once every 0.5 seconds, so as to capture abnormal fluctuations in data flow more timely. At the same time, once the difference index exceeds the preset threshold, the present invention will also start an early warning, triggering the acquisition process of the early warning strategy, that is, obtaining the early warning strategy according to the first security indicator and the second security indicator, and notifying the network administrator or the relevant security system to take further countermeasures.

[0041] In summary, in the entire automobile financial transaction security management method based on blockchain technology, by obtaining automobile financial transaction data and matching the corresponding time intervals, it is ensured that the monitoring frequency is adapted to the type and scale of transaction data, which not only avoids excessive network load caused by too frequent monitoring, but also ensures that changes in data traffic can be captured in a timely manner; further, by selecting blockchain nodes with data transmission traffic as monitoring objects, and calculating the suspicious traffic between them and adjacent nodes, and using the security indicator model to evaluate the security of the nodes, it is possible to achieve key monitoring of key nodes in the network, and by obtaining data traffic at different time points and calculating changes in suspicious traffic, it can dynamically reflect the changing trends of network status and security. More importantly, the solution introduces a comparison mechanism between the difference indicator and the preset threshold. When the difference indicator exceeds the preset threshold, it means that the change in data traffic exceeds the normal range, and there may be security risks or abnormal behavior. At this time, the solution will dynamically adjust the time interval for obtaining data traffic according to the difference between the difference indicator and the preset threshold, forming a new time interval that better matches the current auto financial transaction data. This dynamic adjustment mechanism ensures that the system can capture abnormal fluctuations in data traffic in a timely manner and optimize security management strategies for different risk environments. It considers appropriately increasing the time interval to optimize network performance when the network load is low or the data traffic changes are relatively stable, reflecting the solution's efficient use of network resources.

[0042] like Figure 2 As shown, in one embodiment, in S4, correcting the first time interval according to the difference indicator and forming a second time interval matching the automobile financial transaction data includes:

[0043] S41. Obtaining a correction ratio according to the difference index and a preset threshold;

[0044] S42: Acquire a second time interval matching the automobile financial transaction data according to the correction ratio and the first time interval.

[0045] In this embodiment, it should be noted that in S41, the difference indicator is calculated within the first time interval by combining the first suspicious flow and the second suspicious flow through the suspicious indicator model, which reflects the abnormal degree of data flow change. The preset threshold is a benchmark value determined based on historical data, network conditions and security policies, which is used to measure the normal range of data flow changes. The correction ratio indicates the degree of deviation of the abnormal data flow change from the normal range. This correction ratio will serve as the basis for subsequent adjustment of the time interval for obtaining data flow, ensuring that the monitoring frequency can be dynamically adjusted according to the actual network risk environment.

[0046] In S42, a second time interval matching the automobile financial transaction data is obtained according to the correction ratio and the first time interval. The purpose of this step is to optimize the frequency of obtaining data traffic according to the real-time risk status of the network to improve the efficiency and accuracy of security management. Specifically, if the correction ratio is large, it means that the degree of change in data traffic exceeds the normal range by a large amount, and the network may have a high security risk. Therefore, it is necessary to shorten the time interval for obtaining data traffic in order to capture abnormal fluctuations more timely. On the contrary, if the correction ratio is small, it means that the degree of change in data traffic is within the normal range and the network is relatively safe. At this time, the time interval for obtaining data traffic can be appropriately extended to reduce the network load. For example, if the first time interval is originally 1 second and the correction ratio is 0.5, then the second time interval is multiplied by the correction ratio, and the second time interval obtained is 0.5 seconds, so as to ensure that the changes in data traffic can be monitored more frequently and potential security risks can be responded to in a timely manner. Through this dynamic adjustment mechanism, the security management strategy can be more in line with the actual transaction data type and risk environment.

[0047] In one embodiment, the correction ratio is obtained according to the difference index and the preset threshold in S41 and is expressed as:

[0048] ;in,

[0049] To correct the ratio, is the standard ratio, is the difference indicator, is the preset threshold.

[0050] In this embodiment, it should be noted that It is sensitive in dealing with differences or changes, especially when the difference value is small or large, and can provide smoother and more significant differentiation. Specifically, when Exceed When , start to obtain the correction ratio. If When smaller, The change is more significant, as long as When the difference index reaches a certain value, the logarithmic function will convert it into a relatively large correction ratio, so that the correction ratio can quickly respond to abnormal traffic changes. When larger, The change of will slow down, that is, the change speed of the correction ratio will not be further reduced, so as to match the subsequent correction of the first time interval. As a standard ratio, it is used to adjust the scale of the correction ratio to adapt it to different network environments and security requirements; by adjusting The value of can control the sensitivity and response speed of the correction ratio. .

[0051] For example, assuming the difference indicator =0.6, preset threshold =0.5, standard ratio =1, calculate the correction ratio , so the correction ratio About 0.9.

[0052] like Figure 3 As shown, in one embodiment, obtaining an early warning strategy according to the first safety indicator and the second safety indicator in S4 includes:

[0053] S43, obtaining a capture duration according to the first safety indicator and the second safety indicator;

[0054] S44, capturing the traffic data of the first blockchain node within the capture time and packaging it into a threat data packet, attaching a timestamp to the threat data packet, and issuing an early warning.

[0055] In this embodiment, it should be noted that in S43, the determination of the capture duration is based on the relative size of the first security indicator and the second security indicator and the network security status reflected by them; specifically, multiple numerical ranges are pre-set, and each numerical range corresponds to a specific capture duration; these numerical ranges are artificially set according to the historical traffic and security requirements of specific blockchain nodes. First, after obtaining the first security indicator and the second security indicator, the smaller value of the two indicators will be compared, because this smaller value often represents the weakest or most risky link in the network at the current time point. Then, the numerical range into which this smaller value falls will be found, and the capture duration will be determined accordingly. For example, if the first security indicator is 0.7 and the second security indicator is 0.6, and in the preset numerical range, 0.5 to 0.6 corresponds to a capture duration of 10S, and 0.70 to 0.8 corresponds to a capture duration of 5S, then since the smaller value 0.6 falls within the range of 0.5 to 0.6, the capture duration is set to 10S.

[0056] In S44, once the capture duration is determined, the system will start monitoring and capturing all traffic data of the first blockchain node within the duration. This process is real-time, ensuring that any possible abnormal or suspicious behavior can be captured. The captured data includes, but is not limited to, the source address, destination address, transmission protocol, packet size, and timestamp of the data packet, which is critical for subsequent security analysis and incident response. After the capture is completed, the system will package the data into a threat data packet and attach a timestamp when the capture starts to record the specific time when the event occurred. Subsequently, the system will issue an early warning to notify the network administrator or related security system, indicating that there is a potential security risk or abnormal behavior, and attach a threat data packet for further analysis. For example, if the data traffic of the first blockchain node has an abnormal surge during the capture duration, accompanied by a large number of unknown or suspicious external connection attempts, the system will package this information into a threat data packet and issue an early warning to alert the administrator that there may be a risk of DDoS attack or data leakage.

[0057] like Figure 4 As shown, in one embodiment, obtaining the first security indicator based on the security indicator model and the first suspicious traffic in S2 includes:

[0058] S21. Obtaining a preset additional traffic threshold of the first blockchain node;

[0059] S22. Obtain a first security indicator based on a security indicator model, a preset additional traffic threshold, and a first suspicious traffic.

[0060] In this embodiment, it should be noted that, in S21, obtaining the preset additional traffic threshold of the first blockchain node is a key step, and this threshold is set comprehensively based on the historical data traffic pattern of the first blockchain node and the security policy; specifically, the historical data traffic pattern is also an important basis for setting the threshold. By analyzing the data traffic changes of the node in the past period of time, its normal traffic fluctuation range can be understood, so as to set a threshold that defines normal and abnormal; in addition, the security policy reflects the overall requirements for network security. For networks with higher security requirements, a lower additional traffic threshold may be set in order to more sensitively capture potential abnormal traffic. For example, for core nodes that process high-value automotive financial transactions, historical traffic is considered, and then a relatively low preset additional traffic threshold is set, such as 25MB / s of additional traffic.

[0061] In S22, the first security indicator is obtained based on the security indicator model, the preset additional traffic threshold and the first suspicious traffic. This process is the core of evaluating the security of the first blockchain node at the current time point. The security indicator model is a pre-built mathematical model that is used to calculate the suspicious traffic with the preset threshold to output a quantitative security indicator, which is a numerical value. Then, this comparison result and other relevant security factors are used as inputs to the security indicator model, and the model calculates the first security indicator based on these inputs. For example, if the first suspicious traffic is 30MB / s, close to the preset 25MB / s threshold, and the traffic change rate is fast and the duration is short, then the security indicator model may output a relatively low security indicator, such as 0.9, indicating that the first blockchain node has certain security risks at the current time point and needs to be further monitored and analyzed.

[0062] In one embodiment, the security indicator model in obtaining the first security indicator based on the security indicator model, the preset additional traffic threshold and the first suspicious traffic in S22 is expressed as:

[0063] ;in,

[0064] The first safety indicator, To preset the additional flow threshold, is the first data flow, The second data flow.

[0065] In this embodiment, it should be noted that Calculate the absolute difference between the first data flow and the second data flow, that is, the first suspicious flow. This difference reflects the degree of flow imbalance between two adjacent blockchain nodes. The absolute value is used to ensure that the difference value is always positive, which is convenient for subsequent calculations. For the comparison between the difference and the threshold, the first suspicious flow is compared with the preset additional flow threshold to evaluate whether the flow difference is within the normal range. If the difference is less than the threshold, then If the difference is greater than 1, it means that the traffic change is within the normal range and the security is high; if the difference is greater than the threshold, then If it is less than 1, it means that the traffic change exceeds the normal range and there may be a security risk. The average value of the first data flow and the second data flow is calculated as the denominator, and the average value is taken as the denominator to realize the normalization process; this average value reflects the overall scale of the data flow of adjacent nodes; using the average value as the denominator can eliminate the impact of the scale of data flow to a certain extent, so that the security indicator can have a certain adaptability to the change of flow scale; when the flow scale is large, more flow differences can affect security; and when the flow scale is small, only a certain flow difference may affect security. The comparison result between the difference and the threshold is converted into a safety indicator, which can be used in Provides a sensitive response when approaching the threshold; When it is less than the threshold, is greater than 1, and when When gradually approaching and exceeding the threshold, It will drop rapidly, reflecting that the safety index model is highly sensitive to changes in traffic differences.

[0066] For example, assuming that the first data flow =100MB / s, second data flow =150MB / s, preset additional traffic threshold =25MB / s. Substitute this into the expression and calculate: .but .

[0067] It should also be noted that the process of obtaining the second security indicator based on the security indicator model and the second suspicious traffic is the same as the process of obtaining the first security indicator.

[0068] In one embodiment, the suspicious indicator model in obtaining the difference indicator based on the suspicious indicator model, the first time interval, the first suspicious flow, and the second suspicious flow in S4 is expressed as:

[0069] ;in,

[0070] is the difference indicator, is the first data flow, is the second data flow, For the third data flow, is the fourth data flow, is the first time interval.

[0071] In this embodiment, it should be noted that the ratio of the absolute difference to the average flow rate is: and They represent the absolute difference in data traffic between the first blockchain node and its adjacent nodes at the first time point and the second time point, respectively. This difference reflects the imbalance in traffic changes between adjacent nodes. The absolute value is used to ensure that the difference is always positive. and They are the average values ​​of the data flow of the first blockchain node and its adjacent nodes at the first time point and the second time point, respectively. These average values ​​are used to normalize the flow difference and eliminate the influence of the data flow scale on the difference comparison. Specifically, by calculating the relative difference (i.e., the ratio of the difference to the average flow), the model can adapt to data flows of different scales, so that at different flow levels, the same degree of flow change has the same impact on the difference indicator.

[0072] In the expression The partial calculation of the change in the relative difference between two time points reflects the abnormal trend of data traffic changes; by comparing the relative differences at different time points, the model can capture the dynamic characteristics of data traffic changes and detect abnormal fluctuations in a timely manner; abnormal changes in the rate of difference may indicate security risks or malicious behaviors in the network, such as DDoS attacks, data leaks, etc.

[0073] Part of the difference is divided by the time interval to form a rate of change, and then a logarithmic transformation is performed. The logarithmic function provides a nonlinear response, which makes the model more sensitive when the difference is small, and the response is gradually flat when the difference is large, avoiding excessive fluctuations in the indicator; at the same time, by dividing by the time interval, the model can automatically adjust the scale of the difference indicator according to the adjustment of the monitoring frequency (that is, the change of the time interval), ensuring the comparability of the indicator under different monitoring frequencies.

[0074] For example, suppose that in the first time interval =1s, =100MB / s, =150MB / s, =120MB / s, =160MB / s. Substitute it into the expression of the suspicious indicator model and calculate it, and we get ≈0.108.

[0075] A blockchain-based automobile financial transaction security management system is also provided, the system comprising:

[0076] an acquisition module, configured to acquire automobile financial transaction data, acquire an automobile financial transaction network for circulating the automobile financial transaction data, and match a first time interval according to the automobile financial transaction data, wherein the automobile financial transaction network includes a plurality of blockchain nodes;

[0077] A first data collection and processing module is used to obtain a blockchain node with data transmission traffic and use it as a first blockchain node, obtain a first data traffic of the first blockchain node at a first time point, obtain a second data traffic of a blockchain node adjacent to the first blockchain node at the first time point, obtain a first suspicious traffic according to the first data traffic and the second data traffic, and obtain a first security indicator based on a security indicator model and the first suspicious traffic;

[0078] A second data collection and processing module is used to obtain a second time point separated from the first time point by the first time interval, and obtain a third data flow of the first blockchain node at the second time point, and obtain a fourth data flow of a blockchain node adjacent to the first blockchain node at the second time point, obtain a second suspicious flow according to the third data flow and the fourth data flow, and obtain a second security indicator based on the security indicator model and the second suspicious flow;

[0079] The analysis and early warning module is used to obtain a preset threshold value, obtain a difference indicator based on a suspicious indicator model, a first time interval, a first suspicious flow, and a second suspicious flow. If the difference indicator exceeds the preset threshold value, the first time interval is corrected according to the difference indicator and a second time interval matching the automobile financial transaction data is formed, and an early warning is started, and an early warning strategy is obtained according to the first safety indicator and the second safety indicator.

[0080] The analysis and early warning module is further used to obtain a correction ratio according to the difference index and a preset threshold; and to obtain a second time interval matching the automobile financial transaction data according to the correction ratio and the first time interval.

[0081] The first data collection and processing module is also used to obtain a preset additional traffic threshold of the first blockchain node; and obtain a first security indicator based on the security indicator model, the preset additional traffic threshold and the first suspicious traffic.

[0082] In this embodiment, it should be noted that regarding the above-mentioned automobile financial transaction security management system based on blockchain technology, the specific method of performing operations has been described in detail in the implementation method of the automobile financial transaction security management method based on blockchain technology, and will not be elaborated here.

[0083] Figure 5 is a block diagram of an electronic device for a method for managing automobile financial transactions securely based on blockchain technology according to an exemplary embodiment. Figure 5 As shown, the electronic device 700 may include: a processor 701 , a memory 702 . The electronic device 700 may also include one or more of a multimedia component 703 , an I / O interface 704 (input / output interface), and a communication component 705 .

[0084] The processor 701 is used to control the overall operation of the electronic device 700 to complete all or part of the steps in the above-mentioned automobile financial transaction security management method based on blockchain technology. The memory 702 is used to store various types of data to support the operation of the electronic device 700, and these data may include, for example, instructions for any application or method used to operate on the electronic device 700, and application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 702 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk. The multimedia component 703 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone, which is used to receive external audio signals. The received audio signal may be further stored in the memory 702 or sent through the communication component 705. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 704 provides an interface between the processor 701 and other interface modules, and the above-mentioned other interface modules may be keyboards, mice, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 705 is used for wired or wireless communication between the electronic device 700 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IOT, eMTC or other 5G, etc., or a combination of one or more of them, is not limited here. Therefore, the corresponding communication component 705 may include: Wi-Fi module, Bluetooth module, NFC module, etc.

[0085] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned automobile financial transaction security management method based on blockchain technology.

[0086] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the above-mentioned automobile financial transaction security management method based on blockchain technology are implemented. For example, the computer-readable storage medium can be the above-mentioned memory 702 including program instructions, and the above-mentioned program instructions can be executed by the processor 701 of the electronic device 700 to complete the above-mentioned automobile financial transaction security management method based on blockchain technology.

[0087] In another exemplary embodiment, a computer program product is also provided, which includes a computer program that can be executed by a programmable device, and the computer program has a code portion for executing the above-mentioned automobile financial transaction security management method based on blockchain technology when executed by the programmable device.

[0088] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings; however, the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, a variety of simple modifications can be made to the technical solution of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0089] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0090] In addition, various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A method for managing automobile financial transactions security based on blockchain technology, characterized in that: include: Acquire automobile financial transaction data, acquire an automobile financial transaction network for circulating the automobile financial transaction data, and match a first time interval according to the automobile financial transaction data, wherein the automobile financial transaction network includes a plurality of blockchain nodes; Obtain a blockchain node with data transmission traffic as a first blockchain node, obtain a first data traffic of the first blockchain node at a first time point, obtain a second data traffic of a blockchain node adjacent to the first blockchain node at the first time point, obtain a first suspicious traffic according to the first data traffic and the second data traffic, and obtain a first security indicator based on a security indicator model and the first suspicious traffic; Wherein, obtaining the first security indicator based on the security indicator model and the first suspicious traffic includes: obtaining a preset additional traffic threshold of the first blockchain node; obtaining the first security indicator based on the security indicator model, the preset additional traffic threshold and the first suspicious traffic; The security indicator model in obtaining the first security indicator based on the security indicator model, the preset additional traffic threshold and the first suspicious traffic is expressed as: ;in, The first safety indicator, To preset the additional flow threshold, is the first data flow, is the second data flow; Obtain a second time point separated from the first time point by the first time interval, obtain a third data flow of the first blockchain node at the second time point, obtain a fourth data flow of a blockchain node adjacent to the first blockchain node at the second time point, obtain a second suspicious flow according to the third data flow and the fourth data flow, and obtain a second security indicator based on the security indicator model and the second suspicious flow; Obtaining a preset threshold, obtaining a difference indicator based on a suspicious indicator model, a first time interval, a first suspicious flow, and a second suspicious flow, and if the difference indicator exceeds the preset threshold, correcting the first time interval according to the difference indicator and forming a second time interval matching the automobile financial transaction data, and starting an early warning, and obtaining an early warning strategy according to the first safety indicator and the second safety indicator; The suspicious indicator model in obtaining the difference indicator based on the suspicious indicator model, the first time interval, the first suspicious flow, and the second suspicious flow is expressed as: ;in, is the difference indicator, is the first data flow, is the second data flow, For the third data flow, is the fourth data flow, is the first time interval; The step of correcting the first time interval according to the difference indicator and forming a second time interval matching the automobile financial transaction data comprises: obtaining a correction ratio according to the difference indicator and a preset threshold; obtaining a second time interval matching the automobile financial transaction data according to the correction ratio and the first time interval; The correction ratio obtained according to the difference index and the preset threshold is expressed as: ;in, To correct the ratio, is the standard ratio, is the difference indicator, is the preset threshold.

2. The automobile financial transaction security management method based on blockchain technology according to claim 1 is characterized in that: The obtaining of the early warning strategy according to the first safety indicator and the second safety indicator comprises: Obtaining a capture duration according to a first safety indicator and a second safety indicator; The traffic data of the first blockchain node within the capture time is captured and packaged into a threat data packet, and the threat data packet is timestamped and an early warning is issued.

3. An automobile financial transaction security management system based on blockchain technology, characterized in that: The system is used to implement the automobile financial transaction security management method based on blockchain technology as claimed in claim 1 or claim 2, and the system includes: an acquisition module, configured to acquire automobile financial transaction data, acquire an automobile financial transaction network for circulating the automobile financial transaction data, and match a first time interval according to the automobile financial transaction data, wherein the automobile financial transaction network includes a plurality of blockchain nodes; A first data collection and processing module is used to obtain a blockchain node with data transmission traffic and use it as a first blockchain node, obtain a first data traffic of the first blockchain node at a first time point, obtain a second data traffic of a blockchain node adjacent to the first blockchain node at the first time point, obtain a first suspicious traffic according to the first data traffic and the second data traffic, and obtain a first security indicator based on a security indicator model and the first suspicious traffic; A second data collection and processing module is used to obtain a second time point separated from the first time point by the first time interval, and obtain a third data flow of the first blockchain node at the second time point, and obtain a fourth data flow of a blockchain node adjacent to the first blockchain node at the second time point, obtain a second suspicious flow according to the third data flow and the fourth data flow, and obtain a second security indicator based on the security indicator model and the second suspicious flow; The analysis and early warning module is used to obtain a preset threshold value, obtain a difference indicator based on a suspicious indicator model, a first time interval, a first suspicious flow, and a second suspicious flow. If the difference indicator exceeds the preset threshold value, the first time interval is corrected according to the difference indicator and a second time interval matching the automobile financial transaction data is formed, and an early warning is started, and an early warning strategy is obtained according to the first safety indicator and the second safety indicator.

4. The automobile financial transaction security management system based on blockchain technology according to claim 3 is characterized in that: The analysis and early warning module is also used for: Obtain the correction ratio based on the difference indicator and the preset threshold; A second time interval matching the automobile financial transaction data is acquired according to the correction ratio and the first time interval.

5. An electronic device, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the automobile financial transaction security management method based on blockchain technology as described in claim 1 or claim 2.

Images