Transaction information management method and related equipment

Abstract

The embodiment of the invention discloses a transaction information management method and related equipment, and relates to the field of information technology security. In the embodiment of the specification, a block chain node server obtains transaction information obtained by performing standardization processing and encryption processing on transaction information by electronic equipment, and when the source of the transaction information is detected to be a preset source and the format is detected to be a preset format through an intelligent contract, the transaction information is obtained. And linking the transaction information to a distributed account book for storage through a block chain technology. The electronic device may download the transactional intelligence from a distributed ledger to optimize the security system of the electronic device.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a transaction intelligence management method and related equipment. Background Art

[0002] Electronic devices usually identify suspicious events in the network environment through their security systems to protect themselves from attacks. However, attack methods are evolving at an alarming rate, and their complexity and concealment are constantly increasing. In order to meet this challenge, security systems need to have efficient intelligence collection, analysis, and response capabilities so that they can identify suspicious events at the first time and take appropriate defensive measures.

[0003] Threat intelligence can be understood as information that represents a threat to a system or device and is related to suspicious events, including the method of attack, the time of attack, the attacker's identification, and other information.

[0004] However, there are still many problems with the existing threat intelligence sharing mechanism. For example, there is an "information island" phenomenon between multiple electronic devices, and the threat data related to each electronic device stored on each electronic device is scattered, making it difficult for multiple electronic devices to reach a consensus on threat data. Secondly, sharing threat data may leak the privacy information of the device or system that is sharing it. It is difficult to establish a mutual trust mechanism when multiple electronic devices or systems share threat information, making each electronic device or system unwilling to actively share threat intelligence. Summary of the invention

[0005] The embodiments of this specification provide a transaction intelligence management method and related devices to solve the above problems. The technical solution is as follows:

[0006] In a first aspect, an embodiment of this specification provides a transaction intelligence management method, the method being applicable to a blockchain node server including a distributed ledger, the method comprising:

[0007] Acquire transaction intelligence obtained by standardizing and encrypting transaction information;

[0008] Detecting, by a smart contract, whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format;

[0009] When it is detected that the source of the transaction intelligence is the preset source and the format of the transaction intelligence is the preset format, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology.

[0010] In a second aspect, an embodiment of this specification provides an electronic device for communicating with a blockchain node server using the method, the method comprising:

[0011] Sending a query request for the transaction intelligence to the blockchain node server; wherein the blockchain server is used to execute the transaction intelligence management method as described in the first aspect;

[0012] Receiving the transaction intelligence sent by the blockchain node server in response to the query request; wherein the transaction intelligence is retrieved when the blockchain node server detects that the identity information and query parameters corresponding to the query request meet preset conditions;

[0013] A security system of the electronic device is optimized based on the transaction intelligence.

[0014] In a third aspect, an embodiment of the present specification provides a transaction intelligence management device, which is suitable for being set on a blockchain node server including a distributed ledger, and the transaction intelligence management device includes:

[0015] An intelligence acquisition module is used to obtain transaction intelligence obtained by standardizing and encrypting transaction information;

[0016] A contract detection module, used to detect whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format through a smart contract;

[0017] The on-chain storage module is used to link the transaction intelligence to the distributed ledger for storage through blockchain technology when it is detected that the source of the transaction intelligence is the preset source and the format of the transaction intelligence is the preset format.

[0018] In a fourth aspect, an embodiment of the present specification provides a transaction intelligence management device, which is suitable for being set on an electronic device that communicates with a blockchain node server, and the transaction intelligence management device includes:

[0019] A request sending module, used to send a query request for the transaction intelligence to the blockchain node server; wherein the blockchain server is used to execute the transaction intelligence management method as described in the first aspect;

[0020] An intelligence receiving module, used to receive the transaction intelligence sent by the blockchain node server in response to the query request; wherein the transaction intelligence is retrieved when the blockchain node server detects that the identity information and query parameters corresponding to the query request meet preset conditions;

[0021] A security optimization module is used to optimize the security system of the electronic device based on the transaction intelligence.

[0022] In a fifth aspect, an embodiment of the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0023] In a sixth aspect, an embodiment of the present specification provides a computer program product, wherein the computer program product stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0024] In a seventh aspect, an embodiment of the present specification provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0025] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:

[0026] The embodiments of this specification provide a safe, reliable, and real-time transaction intelligence management method, which is executed by a blockchain node server and an electronic device that can communicate with the blockchain node server.

[0027] Specifically, the blockchain node server obtains transaction intelligence obtained by the electronic device through standardized and encrypted processing of transaction information. For example, transaction information is information related to threat information generated based on suspicious events. Through encryption processing and anonymous submission mechanism, users as sharers are provided with the ability to share transaction intelligence without revealing their true identity, thereby solving the problem of privacy leakage on centralized platforms.

[0028] Furthermore, the blockchain node server detects whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format through a smart contract. For example, based on the source of the transaction intelligence, the identity corresponding to the source is determined to be an identity that has passed the blockchain authentication without leaking the identity information of the source, and the transaction intelligence is determined to be reliable.

[0029] Furthermore, when the source of the transaction intelligence detected by the blockchain node server smart contract is a preset source and the format is a preset format, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology. The embodiments of this specification not only ensure that the transaction intelligence stored on the chain cannot be changed or deleted through the inherent characteristics of the blockchain, thereby ensuring the authenticity and credibility of the transaction intelligence and reducing the risk of data tampering, but also eliminate the problem of single point failure by storing transaction intelligence on multiple blockchain nodes respectively. Even if a node server is attacked or crashes, other server nodes still retain complete transaction intelligence for electronic devices to download the transaction intelligence, thereby ensuring the elasticity and sustainability of the transaction intelligence management network composed of multiple blockchain node service systems and multiple electronic devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0031] Figure 1 It is a schematic diagram of the architecture of a transaction intelligence management method provided in an embodiment of this specification;

[0032] Figure 2 It is a flowchart of a transaction intelligence management method provided by an embodiment of this specification;

[0033] Figure 3 It is a schematic diagram of the structure of block data provided by an embodiment of this specification;

[0034] Figure 4 It is a schematic diagram of the structure of a distributed ledger provided in an embodiment of this specification;

[0035] Figure 5 It is a flowchart of a transaction intelligence management method provided by an embodiment of this specification;

[0036] Figure 6 It is a flowchart of a transaction intelligence management method provided by an embodiment of this specification;

[0037] Figure 7 It is a flowchart of a transaction intelligence management device provided by an embodiment of this specification;

[0038] Figure 8 It is a structural diagram of a transaction information management device provided in an embodiment of this specification;

[0039] Fig. 9This is a schematic diagram of the structure of a transaction information management device provided in the embodiment of this specification.

[0040] Fig.10 It is a structural schematic diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0042] In the description of this specification, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of this specification, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in this specification can be understood in specific circumstances. In addition, in the description of this specification, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are an "or" relationship.

[0043] The present specification is described in detail below with reference to specific embodiments.

[0044] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the features, information and data involved in this specification are all obtained with full authorization.

[0045] Electronic devices usually identify suspicious events in the network environment through their security systems to protect themselves from attacks. However, attack methods are evolving at an alarming rate, and their complexity and concealment are constantly increasing. In order to meet this challenge, security systems need to have efficient intelligence collection, analysis, and response capabilities so that they can identify suspicious events at the first time and take appropriate defensive measures.

[0046] Threat intelligence can be understood as information that represents a threat to a system or device and is related to suspicious events, including the method of attack, the time of attack, the attacker's identification, and other information.

[0047] However, there are still many problems with the existing threat intelligence sharing mechanism. For example, there is an "information island" phenomenon between multiple electronic devices, and the threat data related to each electronic device stored on each electronic device is scattered, making it difficult for multiple electronic devices to reach a consensus on threat data. Secondly, sharing threat data may leak the privacy information of the device or system that is sharing it. It is difficult to establish a mutual trust mechanism when multiple electronic devices or systems share threat information, making each electronic device or system unwilling to actively share threat intelligence.

[0048] Therefore, the present specification provides a transaction intelligence management method to solve the problem. Figure 1 As shown, Figure 1 It is a schematic diagram of the architecture of a transaction intelligence management method provided in an embodiment of this specification. Figure 1 At least multiple blockchain node servers storing distributed ledgers, and multiple electronic devices for uploading and sending transaction intelligence and / or query requests for transaction intelligence. The multiple blockchain node servers at least include server 1011, server 1012, server 1013 and server 1014, and the multiple electronic devices at least include electronic device 1021, electronic device 1022 and electronic device 1023. It can be understood that Figure 1 The number of servers and electronic devices shown in the figure is for illustration only, and this specification does not impose any limitation on this.

[0049] The above-mentioned blockchain node servers include but are not limited to physical or virtual processors, mobile stations (MobileStation, MS), mobile terminal equipment (Mobile Terminal), mobile phones (Mobile Telephone), mobile phones (handsets) and portable equipment (portable equipment), Bluetooth headsets, smart watches and other types. The electronic devices can communicate with one or more core networks via the Radio Access Network (Radio Access Network, RAN).

[0050] For example, the server is a plurality of physical servers, and the plurality of physical servers are independent in hardware. Or, the server is a plurality of virtual servers, and the plurality of virtual servers are deployed in the same hardware resource pool, and the deployment methods of the virtual servers include but are not limited to: VMware, Virtual Box and Virtual PC.

[0051] It is understandable that servers 1011, 1012, 1013, and 1014, which are blockchain node servers, also have other service capabilities and functions to complete the tasks in the following embodiments. For example, server 1011 also provides portal services, resource management services, and CI / CD services.

[0052] In the embodiments of the present specification, electronic devices such as electronic device 1021, electronic device 1022 and electronic device 1023 may also be equipped with display devices, and the display devices may be various devices capable of realizing display functions, for example, the display devices may be cathode ray tube display (Cathode ray tube display, referred to as CR), light-emitting diode display (Light-emitting diode display, referred to as LED), electronic ink screen, liquid crystal display (Liquid crystal display, referred to as LCD), plasma display panel (Plasma display panel, referred to as PDP), etc. For example, a user may use the display device on electronic device 1021 to send transaction intelligence or a query request for transaction intelligence to server 1011, or view the transaction intelligence sent by server 1011.

[0053] Multiple electronic devices and multiple servers can communicate through communication links established by communication protocols, such as the gRPC protocol. gRPC is a high-performance, general-purpose open source remote procedure call (RPC) framework, which is mainly designed for mobile application development and based on the HTTP / 2 protocol standard, based on the protocol buffer (PB) serialization protocol development, and supports many development languages. In addition, the communication link can also be a wireless communication link or a wired communication link, for example, a wired communication link includes an optical fiber, a twisted pair or a coaxial cable, and a wireless communication link includes a Bluetooth communication link, a wireless fidelity (WIreless-FIdelity, Wi-Fi) communication link or a microwave communication link.

[0054] In one embodiment, Figure 2, which is a schematic diagram of a transaction intelligence management method provided by an embodiment of this specification, and the method is applicable to a blockchain node server including a distributed ledger. The method can be implemented by a computer program and can be run on a transaction intelligence management device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0055] Specifically, the transaction intelligence management method includes:

[0056] S102: Acquire transaction intelligence obtained by standardizing and encrypting transaction information.

[0057] Transaction information can be understood as information related to a transaction activity when the transaction activity is detected in a certain environment. For example, in this embodiment, the transaction information can include threat information. Threat information can be understood as information related to a suspicious activity when a suspicious activity is detected in a certain environment. Suspicious activities can be some known attack behaviors, or some behaviors that are not within the permitted range.

[0058] For example, the following are some common suspicious activities and threat information related to the suspicious activities: detecting abnormal changes in network inbound and outbound traffic, threat information includes abnormal data packet size, frequency, source address, etc.; abnormal status of open ports and services, threat information includes data of unauthorized service startup or illegal port access; abnormal login attempts, threat information includes the number of failed logins and login addresses from unknown locations; behaviors that damage file integrity, threat information includes unauthorized file creation, modification or deletion, or information about malware implantation.

[0059] Transaction intelligence is obtained by standardizing and encrypting transaction information. For example, by standardizing threat information as transaction information, it can be understood that multiple threat information obtained based on different types of suspicious activities are unified into a standard format, which is convenient for subsequent cross-platform processing. For example, when other users obtain the threat intelligence through electronic devices, they can quickly understand the content of the threat intelligence.

[0060] Specifically, common transaction intelligence formats include plain text, JSON, XML, etc. In order to process uniformly, transaction information needs to be formatted in the same format, such as JSON. A standard JSON structure is preset, including fields such as timestamp, suspicious activity level, suspicious activity source, and suspicious activity content. First, field mapping is performed on the transaction information. If the fields of the original transaction information do not completely match the standard JSON structure, field mapping is required. That is, the original fields are mapped to the corresponding fields of the standard JSON structure. Further, data parsing is performed on the transaction information. For complex data structures (such as JSON arrays or objects) nested in the transaction information, parsing is required to extract the required fields. The JSON parsing library in the programming language (such as Python's json library) can be used to complete this task. Further, the timestamp included in the transaction information is processed to ensure that the transaction information contains the correct timestamp and convert it to a unified time zone or format. The timestamp is an important field in the transaction information, which is particularly important for time synchronization and sequential verification on the blockchain.

[0061] The standardized transaction information is further encrypted to ensure the confidentiality of the transaction information during transmission. The encryption method can be an asymmetric encryption technology such as RSA or digital signature or any other type of encryption method. It is understood that the encryption method for encrypting transaction information should be agreed upon among multiple electronic devices so that other electronic devices can decrypt the transaction information through the blockchain node server through the decryption process corresponding to the encryption method, thereby obtaining the transaction information corresponding to the transaction information.

[0062] In one embodiment, when a first suspicious event is detected in a target environment by a transaction detection system, first transaction information related to the first suspicious event is obtained; the first transaction information is standardized and encrypted to obtain transaction intelligence corresponding to the first transaction information.

[0063] In this embodiment, the target environment may be the network environment where the transaction detection system is located or the network environment where multiple blockchain node servers are located, or may be any other specified network environment.

[0064] Threat detection systems include various tools and technologies to detect whether suspicious events occur in the target environment. For example, a threat detection system can be a combination of any one or more of a number of systems or tools such as an intrusion detection system (IDS), an intrusion prevention system (IPS), a security information and event management (SIEM) system, anti-virus software, a firewall, and a network traffic analysis tool.

[0065] When the blockchain node server detects the occurrence of a first suspicious event in the target environment through the threat detection system, it obtains the first transaction information related to the first suspicious event. The first transaction information includes threat information. For example, the suspicious activity is an abnormal change in the network inflow and outflow traffic. The first transaction information includes the abnormal data packet size, frequency, source address, etc. Further, the first transaction information is standardized and encrypted to obtain the transaction intelligence corresponding to the first transaction information. The standardization and encryption processes are as described above and will not be repeated here.

[0066] In another embodiment, transaction intelligence obtained by standardizing and encrypting second transaction information sent by a first electronic device is received; wherein the second transaction information is acquired by a security system of the first electronic device.

[0067] The first electronic device may be Figure 1 Any one of the multiple electronic devices shown. For example, the first electronic device is electronic device 1021. The first electronic device obtains the second transaction information through the security system of the first electronic device or through the log data of the first electronic device, and performs standardization and encryption on the second transaction information to obtain transaction intelligence corresponding to the second transaction information. The standardization and encryption processes are as described above and will not be repeated here. It can be understood that the first transaction information and the second transaction information only characterize the types of suspicious activities related to the transaction information and the contents of the transaction information are different, and do not indicate the order of obtaining the transaction information or the difference in importance.

[0068] S104. Detect, through a smart contract, whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format.

[0069] A smart contract is a computer protocol signed and stored on a blockchain network that can automatically execute contract terms and related operations when preset conditions are met. In this embodiment, the smart contract is used to detect whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format, which is used to subsequently encrypt the transaction intelligence into block data and link the block data to the blockchain.

[0070] According to the source information of the transaction intelligence, it is detected whether the source of the transaction intelligence is a preset source. The source information of the transaction intelligence may include but is not limited to at least one of the application type, account type, account name, and device number. For example, if the transaction intelligence is an electronic device that has an abnormal login, the source of the transaction intelligence includes the device number of the electronic device, for example, the device number of the device is the device number of the electronic device 1021.

[0071] The preset source can be understood as a source that represents the source of the transaction intelligence as a pre-set source. The source of the transaction intelligence being a preset source represents that the source of the transaction intelligence is compliant. The preset source can be preset by the administrator, and can also be set by receiving information such as application type, account type, account name, device number, etc. sent by the electronic device. For example, the preset source is an electronic device number abc123def. When the transaction intelligence is received, it is detected whether the source of the transaction intelligence is the electronic device number abc123def. If so, it is determined that the source of the transaction intelligence is compliant.

[0072] Check whether the format of transaction intelligence is the preset format, that is, check whether the format of standardized transaction information is the preset format. For example, the preset format type of transaction intelligence is JSON, and a standard JSON structure is preset to include fields such as timestamp, suspicious activity level, suspicious activity source, and suspicious activity content. Check whether the format of transaction intelligence is the preset JSON structure, and whether it includes the fields shown in the above preset standard JSON and the data corresponding to each field.

[0073] S106. When it is detected that the source of the transaction intelligence is a preset source and the format of the transaction intelligence is a preset format, the transaction intelligence is linked to a distributed ledger for storage through blockchain technology.

[0074] When the source of the transaction intelligence is detected to be the preset source and the format of the transaction intelligence is the preset format, it is confirmed that the transaction data can be stored on the chain. The transaction intelligence is further encrypted through the smart contract to obtain the block data, and the block data corresponding to the transaction intelligence is linked to the distributed ledger for storage through the blockchain technology.

[0075] The ledger maintained by any node in the blockchain stores data in a connected data block structure. Each data block includes a block header and a block body. The block body stores multiple transaction intelligence obtained by packaging transaction intelligence and a binary Merkle tree consisting of hash values ​​obtained by encrypting each transaction intelligence. The block header generally includes a version number and the hash value (hash pointer) of the previous data block connected to the data block. Figure 3 It is a structural diagram of block data provided in an embodiment of this specification, which at least includes a hash value, data, a timestamp of generating data, a timestamp of generating a block (block version) and a hash pointer (the address of the previous block).

[0076] It is understandable that, according to different application requirements, the data items of the block header / body and the blockchain structure (such as single-chain and double-chain structures) may also be different, and this embodiment does not impose any restrictions on this. Figure 3 The structure of the block data shown is for illustration only.

[0077] Each node in the blockchain pre-stores a pair of public keys and secret keys. The secret key is used to encrypt the node identifier from plain text to cipher text, while the public key is used to decrypt the cipher text to plain text, thereby obtaining transaction intelligence.

[0078] The management of distributed ledgers is achieved through blockchain. Multiple nodes are set up on the blockchain. The blockchain is a decentralized distributed database that reflects the characteristics of being collectively maintained by multiple nodes that join the blockchain. Among them, each blockchain node server as a node stores data blocks arranged in chronological order. Each block stores several pieces of transaction intelligence. Cryptography methods are used to ensure that the transaction intelligence in the block is tamper-proof, unforgeable and verifiable. The consensus algorithm enables all nodes on the entire blockchain (theoretically all nodes) to complete the recognition of the block, and different nodes exchange data through a peer-to-peer network (Peer to Peer, P2P). The ledger maintained by any node in the blockchain stores data in a connected data block structure.

[0079] like Figure 4 As shown, Figure 4 2 is a schematic diagram of a distributed ledger structure provided in an embodiment of this specification, including multiple decentralized nodes, and the multiple nodes at least include node 201, node 202, node 203, node 204, node 205, node 206, node 207 and node 208. It can be understood that the number of nodes and the adjacent relationship shown in this embodiment are only for illustration, and this specification does not make any limitation on this, and also includes any other number of nodes and the adjacent relationship between multiple nodes.

[0080] Specifically, through blockchain technology, encrypted transaction intelligence is added as a new block to a target node included in a distributed ledger, and the new block is broadcast to multiple nodes included in the distributed ledger.

[0081] Taking the node 201 receiving the transaction intelligence as an example, the node 201 encrypts the transaction intelligence using the stored encryption parameters corresponding to the transaction data type of the transaction intelligence, signs the encrypted transaction intelligence using the node identifier of the reporting node 201, and writes the block data. The node 201 broadcasts the encrypted and reported node-signed block data to the target node 202 in the blockchain, and further synchronizes the encrypted transaction intelligence block data to other nodes in the blockchain through nodes 202, 204, 205, and 207, thereby completing the linking of the encrypted transaction intelligence to the distributed ledger for storage.

[0082] The embodiments of this specification provide a safe, reliable, and real-time transaction intelligence management method, which is executed by a blockchain node server and an electronic device that can communicate with the blockchain node server.

[0083] Specifically, the blockchain node server obtains transaction intelligence obtained by the electronic device through standardized and encrypted processing of transaction information. For example, transaction information is information related to transaction information generated based on suspicious events. Through encryption processing and anonymous submission mechanism, users as sharers are provided with the ability to share transaction intelligence without revealing their true identity, thereby solving the problem of privacy leakage on centralized platforms.

[0084] Furthermore, the blockchain node server detects whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format through a smart contract. For example, based on the source of the transaction intelligence, the identity corresponding to the source is determined to be an identity that has passed the blockchain authentication without leaking the identity information of the source, and the transaction intelligence is determined to be reliable.

[0085] Furthermore, when the source of the transaction intelligence detected by the blockchain node server smart contract is a preset source and the format is a preset format, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology. The embodiments of this specification not only ensure that the transaction intelligence stored on the chain cannot be changed or deleted through the inherent characteristics of the blockchain, thereby ensuring the authenticity and credibility of the transaction intelligence and reducing the risk of data tampering, but also eliminate the problem of single point failure by storing transaction intelligence on multiple blockchain nodes respectively. Even if a node server is attacked or crashes, other server nodes still retain complete transaction intelligence for electronic devices to download the transaction intelligence, thereby ensuring the elasticity and sustainability of the transaction intelligence management network composed of multiple blockchain node service systems and multiple electronic devices.

[0086] In one embodiment, Figure 2 As shown, it is a schematic diagram of a transaction intelligence management method provided by an embodiment of this specification. The method is applicable to a blockchain node server including a distributed ledger. The method can be implemented by a computer program and can be run on a transaction intelligence management device based on the von Neumann system. The computer program can be integrated in an application or run as an independent tool application.

[0087] Specifically, the transaction intelligence management method includes:

[0088] S202: Acquire transaction intelligence by standardizing and encrypting transaction information.

[0089] Refer to the above S102, which will not be repeated here.

[0090] S204. Detect, through a smart contract, whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format.

[0091] Refer to the above S104 and will not be repeated here.

[0092] S206: When it is detected that the source of the transaction intelligence is a preset source and the format of the transaction intelligence is a preset format, the transaction intelligence is linked to a distributed ledger through blockchain technology for storage.

[0093] Refer to S106 above, which will not be repeated here.

[0094] S208: Receive a query request for transaction intelligence sent by the second electronic device.

[0095] The second electronic device may be any electronic device that communicates with the blockchain node server. The query request may be understood as a request to instruct the blockchain node server to obtain the transaction intelligence stored in the distributed ledger and send the transaction intelligence to the second electronic device. The query request includes at least information such as the identification of the transaction intelligence, the device identification of the second electronic device, and the initiation time of the query request.

[0096] S210: Detect whether the identity information and query parameters corresponding to the query request meet preset conditions.

[0097] By detecting whether the identity information and query parameters corresponding to the query request meet the preset conditions, only after it is determined that the identity information and query parameters corresponding to the query request meet the preset conditions, that is, after it is determined that the identity information and query parameters corresponding to the query request are compliant, the transaction intelligence is sent to the receiving address specified in the query request, thereby protecting the transaction intelligence from being leaked and improving data security.

[0098] In one embodiment, it is detected whether the identity information corresponding to the query request is the preset identity information; when it is determined that the identity information corresponding to the query request is the preset identity information, it is detected whether the query parameters corresponding to the query request comply with the permission rules corresponding to the preset identity information; when it is determined that the identity information corresponding to the query request is the preset identity information, and the query parameters corresponding to the query request comply with the permission rules corresponding to the preset identity information, transaction intelligence is retrieved in the distributed ledger according to the permission rules.

[0099] The server receives the query request from the second electronic device, determines the identity information of the second electronic device according to the query request, and determines the transaction intelligence to be retrieved according to the query parameters corresponding to the query request.

[0100] S212: When it is detected that the identity information and query parameters corresponding to the query request meet the preset conditions, the transaction intelligence is retrieved from the distributed ledger.

[0101] Determine that the identity information of the second electronic device is the preset identity information, that is, the identity information is the identity information that is allowed to call the transaction intelligence. Then determine the security authority of the transaction intelligence that the identity information is allowed to call, compare the calling authority required for the query parameter with the security authority, and if the calling authority and the security authority are consistent, retrieve the transaction intelligence stored in the block data in the distributed ledger.

[0102] When retrieving transaction intelligence in a distributed ledger based on permission rules, the block data corresponding to the hash value associated with the query parameter can be matched in multiple block data through the query parameter according to the algorithm for encrypting the transaction intelligence. The transaction intelligence stored in the block data is the transaction intelligence required for the query request.

[0103] S214: Send the transaction information to the second electronic device.

[0104] According to any address carried in the query request, such as a MAC address, an email address, a mobile phone number, etc., the transaction intelligence is sent to the second electronic device corresponding to the address. The transaction intelligence is sent to the receiving address specified in the query request, and the second electronic device corresponding to the receiving address decrypts the transaction intelligence according to the agreed decryption method or key to obtain the transaction information. This embodiment ensures the privacy and security of the transaction intelligence during transmission by sending encrypted transaction intelligence.

[0105] In one embodiment, feedback information sent by the second electronic device is received, wherein the feedback information represents the defense effect of the security system of the second electronic device after optimization. Further, the blockchain node server associates the transaction intelligence with the feedback information and links it to the distributed ledger for storage.

[0106] In other words, the second electronic device obtains the transaction intelligence sent by the blockchain node server to optimize the security system of the second electronic device, and obtains feedback information based on the actual defense effect of the optimized security system and further analysis. The transaction information includes threat information, and the defense effect of the security system is related to the security system's ability to identify suspicious activities in the environment where the second electronic device is located, and the ability to analyze the threat information corresponding to the suspicious activities.

[0107] The second electronic device optimizes the security system of the second electronic device according to the threat intelligence serving as transaction intelligence. Based on information such as the types of suspicious activities characterized in the threat intelligence, detection criteria for suspicious activities, and response measures to suspicious activities, the security system can be optimized through a machine learning model or a deep learning algorithm to patch system vulnerabilities in the security system and improve the ability to identify suspicious activities, identification efficiency, and the efficiency of taking defensive measures.

[0108] Furthermore, the second electronic device generates feedback information based on the defense effect of the optimized security system against suspicious activities within a preset time period, and the feedback information represents the difference in the defense effect of the security system before and after optimization. The second electronic device resends the feedback information to the blockchain node server through the same submission and verification process as improving transaction intelligence.

[0109] The blockchain node server associates the transaction intelligence with the feedback information and links them to the distributed ledger for storage. For example, the feedback information is encrypted through a smart contract to obtain the block data corresponding to the feedback information, and the block data corresponding to the transaction intelligence is associated with the block data corresponding to the feedback information and then uploaded to the chain. For another example, the transaction intelligence is associated with the feedback information to obtain the transaction feedback information, the transaction feedback information is encrypted through a smart contract to obtain the block data corresponding to the transaction feedback information, and the block data corresponding to the transaction feedback information is uploaded to the chain.

[0110] In this embodiment, by encouraging the second electronic device to download transaction intelligence and optimizing the security system of the second electronic device based on the transaction intelligence, a continuous cooperative relationship is encouraged between multiple electronic devices, because each electronic device benefits from the transaction intelligence and feedback information provided by other electronic devices, and is motivated to maintain the healthy operation of the cooperative relationship. In short, by sharing transaction intelligence and allowing electronic devices to provide feedback information, through a reliable submission and verification process and using blockchain technology to ensure the integrity and transparency of transaction intelligence and feedback information, it is possible to effectively promote the collaboration of multiple electronic devices and improve the defense capabilities of the security systems of electronic devices.

[0111] S216: When it is detected that the identity information or query parameters corresponding to the query request do not meet the preset conditions, refuse to respond to the query request for transaction intelligence.

[0112] When it is determined that the identity information or query parameters corresponding to the query request do not meet the preset conditions, it indicates that the log review request attempts to call transaction intelligence that does not meet the authority rules. At this time, a warning message may be sent to the second electronic device, and the query request sent by the second electronic device may not be received.

[0113] S218. When it is detected that the source of the transaction intelligence is not a preset source or the format is not a preset format, refuse to store the transaction intelligence on the distributed ledger.

[0114] When it is detected that the source of the transaction intelligence is not the preset source or the format is not the preset format, the transaction intelligence is refused to be stored in the distributed ledger. Further, the transaction intelligence can be deleted, or warning measures such as notifying the electronic device that sent the transaction intelligence to complete the transaction intelligence can be taken.

[0115] In the embodiment of this specification, the blockchain node server obtains the transaction intelligence obtained by the electronic device performing standardized processing and encryption processing on the transaction information. In other words, through encryption processing and anonymous submission mechanism, the user as the sharer is provided with the ability to share transaction intelligence without exposing the true identity, thereby solving the problem of privacy leakage on the centralized platform. Furthermore, when the blockchain node server detects that the source of the transaction intelligence is a preset source and the format is a preset format through the smart contract, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology. In other words, the embodiment of this specification ensures that the transaction intelligence stored on the chain cannot be changed or deleted through the inherent characteristics of the blockchain, thereby ensuring the authenticity and credibility of the transaction intelligence, reducing the risk of data tampering, and also eliminating the problem of single point failure by storing the transaction intelligence separately on multiple blockchain nodes, thereby ensuring the elasticity and sustainability of the transaction intelligence management network composed of multiple blockchain node service systems and multiple electronic devices.

[0116] In one embodiment, Figure 7 As shown, it is a schematic diagram of a transaction intelligence management method provided by an embodiment of this specification. The method is applicable to an electronic device that communicates with a blockchain node server. The method can be implemented by a computer program and can be run on a transaction intelligence management device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0117] Specifically, the transaction intelligence management method includes:

[0118] S402. Send a query request for transaction intelligence to the blockchain node server.

[0119] The query request can be understood as a request to instruct the blockchain node server to obtain the transaction intelligence stored in the distributed ledger and send the transaction intelligence to the electronic device. The query request at least includes information such as the identification of the transaction intelligence, the device identification of the electronic device, and the initiation time of the query request.

[0120] S404. Receive transaction intelligence sent by the blockchain node server in response to the query request.

[0121] The transaction intelligence is retrieved when the blockchain node server detects that the identity information and query parameters corresponding to the query request meet the preset conditions. Specifically, the blockchain node server receives the query request of the electronic device, determines the identity information of the electronic device according to the query request, and determines the transaction intelligence to be retrieved according to the query parameters corresponding to the query request.

[0122] The blockchain node server determines that the identity information of the electronic device is the preset identity information, that is, the identity information is the identity information that is allowed to call the transaction intelligence. Then it determines the security authority of the transaction intelligence that the identity information is allowed to call, compares the calling authority required for the query parameter with the security authority, and if the calling authority and the security authority are consistent, retrieves the transaction intelligence stored in the block data in the distributed ledger, and sends the transaction intelligence to the electronic device.

[0123] S406. Optimize the security system of electronic equipment based on threat intelligence.

[0124] The electronic device obtains the transaction intelligence sent by the blockchain node server to optimize the security system of the electronic device. The security system includes various tools and technologies to detect whether suspicious events occur in the environment where the electronic device is located. For example, the security system can be any one or more combinations of multiple systems or tools such as an intrusion detection system IDS, an intrusion prevention system (IPS), a security information and event management (SIEM) system, anti-virus software, a firewall, and a network traffic analysis tool.

[0125] The defense effect of the security system is related to the security system's ability to identify suspicious activities in the environment where the second electronic device is located, and its ability to analyze transaction information corresponding to the suspicious activities.

[0126] Electronic devices optimize their security systems based on transaction intelligence. Based on information such as the types of suspicious activities represented in transaction intelligence, detection criteria for suspicious activities, and response measures for suspicious activities, they can optimize security systems through machine learning models or deep learning algorithms to patch system vulnerabilities in the security system and improve the ability to identify suspicious activities, identification efficiency, and the efficiency of taking defensive measures.

[0127] In one embodiment, feedback information is obtained based on the defense effect of the optimized security system; the feedback information is sent to the blockchain node server, so that the blockchain node server associates the transaction intelligence with the feedback information and links it to a distributed ledger for storage.

[0128] In this embodiment, the electronic device generates feedback information based on the defense effect of the optimized security system against suspicious activities within a preset time period, and the feedback information represents the difference in the defense effect of the security system before and after optimization. The electronic device resends the feedback information to the blockchain node server through the same submission and verification process as improving transaction intelligence, so that the blockchain node server associates the transaction intelligence with the feedback information and links it to the distributed ledger for storage.

[0129] In this embodiment, by encouraging electronic devices to download transaction intelligence and optimizing the security system of electronic devices based on transaction intelligence, a continuous cooperative relationship is encouraged between multiple electronic devices, because each electronic device benefits from the transaction intelligence and feedback information provided by other electronic devices, and is motivated to maintain the healthy operation of the cooperative relationship. In short, by sharing transaction intelligence and allowing electronic devices to provide feedback information, through a reliable submission and verification process and using blockchain technology to ensure the integrity and transparency of transaction intelligence and feedback information, it is possible to effectively promote the collaboration of multiple electronic devices and improve the defense capabilities of the security system of electronic devices.

[0130] In one embodiment, when the optimized security system detects that a second suspicious event occurs in the environment where the electronic device is located, third transaction information related to the second suspicious event is obtained; the third transaction information is standardized and encrypted to obtain transaction intelligence corresponding to the third transaction information; the transaction intelligence corresponding to the third transaction information is sent to the blockchain node server, so that when the blockchain node server detects that the source of the transaction intelligence corresponding to the third transaction information is a preset source and the format is a preset format, the transaction intelligence corresponding to the third transaction information is linked to the distributed ledger through blockchain technology for storage.

[0131] When the electronic device detects the occurrence of a second suspicious event in the environment where the electronic device is located through the optimized security system, the third transaction information related to the second suspicious event is obtained. The thirtieth transaction information includes threat information, for example, the suspicious activity is an abnormal change in the network inflow and outflow traffic, and the third transaction information includes the abnormal data packet size, frequency, source address, etc. Further, the third transaction information is standardized and encrypted to obtain the transaction intelligence corresponding to the third transaction information.

[0132] The electronic device performs standardized processing on the transaction intelligence corresponding to the third transaction information. The transaction intelligence includes threat intelligence. It can be understood that multiple transaction information obtained based on different types of suspicious activities are unified into a standard format to facilitate subsequent cross-platform processing, and the transaction intelligence corresponding to the third transaction information that has been standardized is further encrypted to ensure the confidentiality of the transaction intelligence corresponding to the third transaction information during transmission.

[0133] The blockchain node server receives transaction intelligence corresponding to the third transaction information sent by the electronic device, and when it detects through the smart contract that the source of the transaction intelligence corresponding to the three transaction information is a preset source, and the format of the transaction intelligence corresponding to the three transaction information is a preset format, the transaction intelligence corresponding to the three transaction information is linked to the distributed ledger through blockchain technology for storage.

[0134] In this embodiment, by encouraging electronic devices to download transaction intelligence and optimizing the security system of electronic devices based on threat intelligence as transaction intelligence, and encouraging electronic devices to obtain transaction intelligence based on the optimized security system and upload it to the blockchain node server to put the transaction intelligence on the chain, a continuous cooperative relationship is encouraged between multiple electronic devices, because each electronic device benefits from the transaction intelligence and feedback information provided by other electronic devices, and is motivated to maintain the healthy operation of the cooperative relationship.

[0135] In the embodiment of this specification, the blockchain node server obtains the transaction intelligence obtained by the electronic device performing standardized processing and encryption processing on the transaction information. In other words, through encryption processing and anonymous submission mechanism, the user as the sharer is provided with the ability to share transaction intelligence without exposing the true identity, thereby solving the problem of privacy leakage on the centralized platform. Furthermore, when the blockchain node server detects that the source of the transaction intelligence is a preset source and the format is a preset format through the smart contract, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology. In other words, the embodiment of this specification ensures that the transaction intelligence stored on the chain cannot be changed or deleted through the inherent characteristics of the blockchain, thereby ensuring the authenticity and credibility of the transaction intelligence, reducing the risk of data tampering, and also eliminating the problem of single point failure by storing the transaction intelligence separately on multiple blockchain nodes, thereby ensuring the elasticity and sustainability of the transaction intelligence management network composed of multiple blockchain node service systems and multiple electronic devices.

[0136] In one embodiment, Figure 7 As shown, it is a schematic diagram of a transaction intelligence management method provided by an embodiment of this specification. The method is applicable to an electronic device that communicates with a blockchain node server and a blockchain node server including a distributed ledger. The method can be implemented by a computer program and can be run on a transaction intelligence management device based on the von Neumann system. The computer program can be integrated in an application or run as an independent tool application.

[0137] Specifically, the transaction intelligence management method includes:

[0138] S402. The blockchain node server obtains transaction intelligence by standardizing and encrypting the transaction information.

[0139] Refer to the above S102, which will not be repeated here.

[0140] S404. The blockchain node server detects through a smart contract whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format.

[0141] Refer to the above S104 and will not be repeated here.

[0142] S406: When the blockchain node server detects that the source of the transaction intelligence is the preset source and the format of the transaction intelligence is the preset format, the transaction intelligence is linked to the distributed ledger through the blockchain technology for storage.

[0143] Refer to the above S106, which will not be repeated here.

[0144] S408. The electronic device sends a query request for transaction intelligence to the blockchain node server.

[0145] Refer to the above S402, which will not be repeated here.

[0146] S410. The blockchain node server receives a query request for transaction intelligence sent by the second electronic device.

[0147] Refer to the above S208 and will not be repeated here.

[0148] S412. The blockchain node server detects whether the identity information and query parameters corresponding to the query request meet the preset conditions.

[0149] Please refer to the above S210 and will not repeat it here.

[0150] S414. When the blockchain node server detects that the identity information and query parameters corresponding to the query request meet the preset conditions, it retrieves the transaction intelligence in the distributed ledger.

[0151] Refer to the above S212, which will not be repeated here.

[0152] S416. The blockchain node server sends the transaction intelligence to the second electronic device.

[0153] Refer to the above S214 and will not be repeated here.

[0154] S418. The electronic device receives transaction intelligence sent by the blockchain node server in response to the query request.

[0155] Refer to the above S404 and will not be repeated here.

[0156] S420. The electronic device optimizes the security system of the electronic device based on the transaction intelligence.

[0157] Refer to the above S406 and will not be repeated here.

[0158] In the embodiment of this specification, the blockchain node server obtains the transaction intelligence obtained by the electronic device performing standardized processing and encryption processing on the transaction information. In other words, through encryption processing and anonymous submission mechanism, the user as the sharer is provided with the ability to share transaction intelligence without exposing the true identity, thereby solving the problem of privacy leakage on the centralized platform. Furthermore, when the blockchain node server detects that the source of the transaction intelligence is a preset source and the format is a preset format through the smart contract, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology. In other words, the embodiment of this specification ensures that the transaction intelligence stored on the chain cannot be changed or deleted through the inherent characteristics of the blockchain, thereby ensuring the authenticity and credibility of the transaction intelligence, reducing the risk of data tampering, and also eliminating the problem of single point failure by storing the transaction intelligence separately on multiple blockchain nodes, thereby ensuring the elasticity and sustainability of the transaction intelligence management network composed of multiple blockchain node service systems and multiple electronic devices.

[0159] The following are device embodiments of this specification, which can be used to implement the method embodiments of this specification. For details not disclosed in the device embodiments of this specification, please refer to the method embodiments of this specification.

[0160] See also Figure 8 , which shows a schematic diagram of the structure of a transaction intelligence management device provided by an exemplary embodiment of this specification. The transaction intelligence management device is suitable for being set on a blockchain node server including a distributed ledger. The transaction intelligence management device can be implemented as all or part of the device through software, hardware or a combination of both. The transaction intelligence management device includes an intelligence acquisition module 501, a contract detection module 502 and an on-chain storage module 503.

[0161] The intelligence acquisition module 501 is used to acquire transaction intelligence obtained by standardizing and encrypting transaction information;

[0162] A contract detection module 502, used to detect whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format through a smart contract;

[0163] The on-chain storage module 503 is used to link the transaction intelligence to the distributed ledger for storage through blockchain technology when it is detected that the source of the transaction intelligence is the preset source and the format of the transaction intelligence is the preset format.

[0164] In one embodiment, the intelligence acquisition module 501 includes:

[0165] A first information acquisition module, configured to acquire first transaction information related to a first suspicious event when a first suspicious event occurs in a target environment through a transaction detection system;

[0166] The first information processing module is used to perform standardization and encryption processing on the first transaction information to obtain transaction intelligence corresponding to the first transaction information.

[0167] In one embodiment, the intelligence acquisition module 501 includes:

[0168] The third information processing module is used to receive transaction intelligence sent by the first electronic device that is obtained by standardizing and encrypting second transaction information; wherein the second transaction information is obtained by the security system of the first electronic device.

[0169] In one embodiment, the transaction information management device further includes:

[0170] A request receiving module, configured to receive a query request for the transaction intelligence sent by a second electronic device;

[0171] A request detection module, used to detect whether the identity information and query parameters corresponding to the query request meet preset conditions;

[0172] An intelligence retrieval module, configured to retrieve the transaction intelligence in the distributed ledger when it is detected that the identity information and query parameters corresponding to the query request meet the preset conditions;

[0173] The intelligence sending module is used to send the transaction intelligence to the second electronic device so that the second electronic device optimizes the security system of the second electronic device based on the transaction intelligence.

[0174] In one embodiment, the transaction information management device further includes:

[0175] The feedback information receiving module is used to receive feedback information sent by the second electronic device; wherein the feedback information represents the defense effect of the security system of the second electronic device after optimization.

[0176] An association storage module is used to associate the transaction intelligence with the feedback information and link them to the distributed ledger for storage.

[0177] See also Fig. 9 , which shows a schematic diagram of the structure of a transaction intelligence management device provided by an exemplary embodiment of this specification. The transaction intelligence management device is suitable for being set on an electronic device that communicates with a blockchain node server. The transaction intelligence management device can be implemented as all or part of the device through software, hardware, or a combination of both. The transaction intelligence management device includes a request sending module 601, an intelligence receiving module 602, and a security optimization module 603.

[0178] The request sending module 601 is used to send a query request for the transaction intelligence to the blockchain node server; wherein the blockchain server is used to execute the following Figure 1 - Figure 5 The transaction intelligence management method shown;

[0179] The intelligence receiving module 602 is used to receive the transaction intelligence sent by the blockchain node server in response to the query request; wherein the transaction intelligence is retrieved when the blockchain node server detects that the identity information and query parameters corresponding to the query request meet the preset conditions;

[0180] The security optimization module 603 is used to optimize the security system of the electronic device based on the transaction intelligence.

[0181] In one embodiment, the transaction information management device further includes:

[0182] An optimization feedback module, used to obtain feedback information according to the defense effect of the security system after optimization;

[0183] The feedback chain module is used to send the feedback information to the blockchain node server so that the blockchain node server associates the transaction intelligence with the feedback information and links them to the distributed ledger for storage.

[0184] In one embodiment, the transaction information management device further includes:

[0185] an optimized detection module, configured to obtain third transaction information related to the second suspicious event when the optimized security system detects that a second suspicious event occurs in the environment where the electronic device is located;

[0186] An information processing module, used for performing standardization and encryption processing on the third transaction information to obtain transaction intelligence corresponding to the third transaction information;

[0187] The intelligence chain module is used to send the transaction intelligence corresponding to the third transaction information to the blockchain node server, so that when the blockchain node server detects that the source of the transaction intelligence corresponding to the third transaction information is the preset source and the format is the preset format, the transaction intelligence corresponding to the third transaction information is linked to the distributed ledger through blockchain technology for storage.

[0188] In the embodiment of this specification, the blockchain node server obtains the transaction intelligence obtained by the electronic device performing standardized processing and encryption processing on the transaction information. In other words, through encryption processing and anonymous submission mechanism, the user as the sharer is provided with the ability to share transaction intelligence without exposing the true identity, thereby solving the problem of privacy leakage on the centralized platform. Furthermore, when the blockchain node server detects that the source of the transaction intelligence is a preset source and the format is a preset format through the smart contract, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology. In other words, the embodiment of this specification ensures that the transaction intelligence stored on the chain cannot be changed or deleted through the inherent characteristics of the blockchain, thereby ensuring the authenticity and credibility of the transaction intelligence, reducing the risk of data tampering, and also eliminating the problem of single point failure by storing the transaction intelligence separately on multiple blockchain nodes, thereby ensuring the elasticity and sustainability of the transaction intelligence management network composed of multiple blockchain node service systems and multiple electronic devices.

[0189] It should be noted that the transaction intelligence management device provided in the above embodiment only uses the division of the above functional modules as an example when executing the transaction intelligence management method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the transaction intelligence management device provided in the above embodiment and the transaction intelligence management method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0190] The serial numbers of the embodiments of this specification are for description only and do not represent the advantages or disadvantages of the embodiments.

[0191] The present specification also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1 - Figure 7 The transaction intelligence management method of the embodiment shown in the figure can be specifically executed by referring to Figure 1 - Figure 7 The specific description of the illustrated embodiment will not be repeated here.

[0192] The present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1 - Figure 7 The transaction intelligence management method of the embodiment shown in the figure can be specifically executed by referring to Figure 1 - Figure 7 The specific description of the illustrated embodiment will not be repeated here.

[0193] See also Fig.10 , is a schematic diagram of the structure of an electronic device provided in the embodiment of this specification. Figure 8 As shown, the electronic device 700 may include: at least one processor 701 , at least one network interface 704 , a user interface 703 , a memory 705 , and at least one communication bus 702 .

[0194] The communication bus 702 is used to realize the connection and communication between these components.

[0195] The user interface 703 may include a display screen (Display) and a camera (Camera), and the optional user interface 703 may also include a standard wired interface and a wireless interface.

[0196] The network interface 704 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0197] Among them, the processor 701 may include one or more processing cores. The processor 701 uses various interfaces and lines to connect various parts within the entire server 700, and executes various functions and processes data of the server 700 by running or executing instructions, programs, code sets or instruction sets stored in the memory 705, and calling data stored in the memory 705. Optionally, the processor 701 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 701 can integrate one or more combinations of processors (Central Processing Unit, CPU), image processors (Graphics Processing Unit, GPU) and modems. Among them, the CPU mainly processes operating systems, user interfaces, and applications; the GPU is responsible for rendering and drawing the content that needs to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 701, and it can be implemented separately through a chip.

[0198] Among them, the memory 705 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 705 includes a non-transitory computer-readable storage medium. The memory 705 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 705 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store data involved in the above-mentioned method embodiments, etc. The memory 705 may optionally be at least one storage device located away from the aforementioned processor 701. As Fig.10 As shown, the memory 705 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a transaction intelligence management application.

[0199] exist Fig.10 In the electronic device 700 shown, the user interface 703 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 701 can be used to call the transaction intelligence management application stored in the memory 705 and specifically perform the following operations:

[0200] Acquire transaction intelligence obtained by standardizing and encrypting transaction information;

[0201] Detecting, by a smart contract, whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format;

[0202] When it is detected that the source of the transaction intelligence is the preset source and the format of the transaction intelligence is the preset format, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology.

[0203] In one embodiment, the processor 701 executes the acquisition of transaction intelligence obtained by performing standardization and encryption processing on the transaction information, specifically performing:

[0204] When a first suspicious event occurs in the target environment, the transaction detection system is used to obtain first transaction information related to the first suspicious event;

[0205] The first transaction information is standardized and encrypted to obtain transaction intelligence corresponding to the first transaction information.

[0206] In one embodiment, the processor 701 executes the acquisition of transaction intelligence obtained by performing standardization and encryption processing on the transaction information, specifically performing:

[0207] Receive transaction intelligence sent by a first electronic device that is obtained by standardizing and encrypting second transaction information; wherein the second transaction information is acquired by a security system of the first electronic device.

[0208] In one embodiment, the processor 701 further executes:

[0209] receiving a query request for the transaction intelligence sent by a second electronic device;

[0210] Detecting whether the identity information and query parameters corresponding to the query request meet preset conditions;

[0211] When it is detected that the identity information and the query parameters corresponding to the query request meet the preset conditions, retrieving the transaction intelligence in the distributed ledger;

[0212] The transaction intelligence is sent to the second electronic device, so that the second electronic device optimizes the security system of the second electronic device based on the transaction intelligence.

[0213] In one embodiment, the processor 701 further executes:

[0214] Receive feedback information sent by the second electronic device; wherein the feedback information represents the defense effect of the security system of the second electronic device after optimization.

[0215] The transaction intelligence is associated with the feedback information and linked to the distributed ledger for storage.

[0216] In one embodiment, the processor 701 is used to call the transaction intelligence management application stored in the memory 705, and specifically perform the following operations:

[0217] Sending a query request for the transaction intelligence to the blockchain node server; wherein the blockchain server is used to execute Figure 1 - Figure 5 The transaction intelligence management method shown;

[0218] Receiving the transaction intelligence sent by the blockchain node server in response to the query request; wherein the transaction intelligence is retrieved when the blockchain node server detects that the identity information and query parameters corresponding to the query request meet preset conditions;

[0219] A security system of the electronic device is optimized based on the transaction intelligence.

[0220] In one embodiment, after the processor 701 executes the step of optimizing the security system of the electronic device based on the transaction intelligence, the processor 701 further executes:

[0221] Obtaining feedback information based on the defense effect of the optimized security system;

[0222] The feedback information is sent to the blockchain node server so that the blockchain node server associates the transaction intelligence with the feedback information and links them to the distributed ledger for storage.

[0223] In one embodiment, after the processor 701 executes the step of optimizing the security system of the electronic device based on the transaction intelligence, the processor 701 further executes:

[0224] When the optimized security system detects that a second suspicious event occurs in the environment where the electronic device is located, obtaining third transaction information related to the second suspicious event;

[0225] Performing standardization and encryption processing on the third transaction information to obtain transaction intelligence corresponding to the third transaction information;

[0226] The transaction intelligence corresponding to the third transaction information is sent to the blockchain node server, so that when the blockchain node server detects that the source of the transaction intelligence corresponding to the third transaction information is the preset source and the format is the preset format, the transaction intelligence corresponding to the third transaction information is linked to the distributed ledger through blockchain technology for storage.

[0227] In the embodiment of this specification, the blockchain node server obtains the transaction intelligence obtained by the electronic device performing standardized processing and encryption processing on the transaction information. In other words, through encryption processing and anonymous submission mechanism, the user as the sharer is provided with the ability to share transaction intelligence without exposing the true identity, thereby solving the problem of privacy leakage on the centralized platform. Furthermore, when the blockchain node server detects that the source of the transaction intelligence is a preset source and the format is a preset format through the smart contract, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology. In other words, the embodiment of this specification ensures that the transaction intelligence stored on the chain cannot be changed or deleted through the inherent characteristics of the blockchain, thereby ensuring the authenticity and credibility of the transaction intelligence, reducing the risk of data tampering, and also eliminating the problem of single point failure by storing the transaction intelligence separately on multiple blockchain nodes, thereby ensuring the elasticity and sustainability of the transaction intelligence management network composed of multiple blockchain node service systems and multiple electronic devices.

[0228] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0229] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0230] The above disclosure is only the preferred embodiment of this specification, which certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A transaction intelligence management method, the method being applicable to a blockchain node server including a distributed ledger, the method comprising: Acquire transaction intelligence obtained by standardizing and encrypting transaction information; Detecting, by a smart contract, whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format; When it is detected that the source of the transaction intelligence is the preset source and the format of the transaction intelligence is the preset format, the transaction intelligence is linked to the distributed ledger for storage through blockchain technology.

2. The transaction intelligence management method according to claim 1, wherein the step of obtaining transaction intelligence obtained by standardizing and encrypting transaction information comprises: When a first suspicious event occurs in the target environment, the threat detection system is used to obtain first transaction information related to the first suspicious event; The first transaction information is standardized and encrypted to obtain transaction intelligence corresponding to the first transaction information.

3. The transaction intelligence management method according to claim 1, wherein the step of obtaining transaction intelligence obtained by standardizing and encrypting transaction information comprises: Receive transaction intelligence sent by a first electronic device that is obtained by standardizing and encrypting second transaction information; wherein the second transaction information is acquired by a security system of the first electronic device.

4. The transaction information management method according to claim 1, further comprising: receiving a query request for the transaction intelligence sent by a second electronic device; Detecting whether the identity information and query parameters corresponding to the query request meet preset conditions; When it is detected that the identity information and the query parameters corresponding to the query request meet the preset conditions, retrieving the transaction intelligence in the distributed ledger; The transaction intelligence is sent to the second electronic device, so that the second electronic device optimizes the security system of the second electronic device based on the transaction intelligence.

5. The transaction information management method according to claim 4, further comprising: receiving feedback information sent by the second electronic device; wherein the feedback information represents the defense effect of the security system of the second electronic device after optimization; The transaction intelligence is associated with the feedback information and linked to the distributed ledger for storage.

6. A transaction intelligence management method, the method being applicable to an electronic device communicating with a blockchain node server, the method comprising: Sending a query request for the transaction intelligence to the blockchain node server; wherein the blockchain server is used to execute any one of the transaction intelligence management methods according to claims 1-5; Receiving the transaction intelligence sent by the blockchain node server in response to the query request; wherein the transaction intelligence is retrieved when the blockchain node server detects that the identity information and query parameters corresponding to the query request meet preset conditions; A security system of the electronic device is optimized based on the transaction intelligence.

7. The transaction intelligence management method according to claim 6, after optimizing the security system of the electronic device based on the transaction intelligence, further comprising: Obtaining feedback information based on the defense effect of the optimized security system; The feedback information is sent to the blockchain node server so that the blockchain node server associates the transaction intelligence with the feedback information and links them to the distributed ledger for storage.

8. The transaction intelligence management method according to claim 6, after optimizing the security system of the electronic device based on the transaction intelligence, further comprising: When the optimized security system detects that a second suspicious event occurs in the environment where the electronic device is located, obtaining third transaction information related to the second suspicious event; Performing standardization and encryption processing on the third transaction information to obtain transaction intelligence corresponding to the third transaction information; The transaction intelligence corresponding to the third transaction information is sent to the blockchain node server, so that when the blockchain node server detects that the source of the transaction intelligence corresponding to the third transaction information is the preset source and the format is the preset format, the transaction intelligence corresponding to the third transaction information is linked to the distributed ledger through blockchain technology for storage.

9. A transaction intelligence management device, the transaction intelligence management device being adapted to be arranged on a blockchain node server including a distributed ledger, the transaction intelligence management device comprising: An intelligence acquisition module is used to obtain transaction intelligence obtained by standardizing and encrypting transaction information; A contract detection module, used to detect whether the source of the transaction intelligence is a preset source and whether the format of the transaction intelligence is a preset format through a smart contract; The on-chain storage module is used to link the transaction intelligence to the distributed ledger for storage through blockchain technology when it is detected that the source of the transaction intelligence is the preset source and the format of the transaction intelligence is the preset format.

10. A transaction intelligence management device, the transaction intelligence management device being suitable for being arranged on an electronic device that communicates with a blockchain node server, the transaction intelligence management device comprising: A request sending module, used to send a query request for the transaction intelligence to the blockchain node server; wherein the blockchain server is used to execute any one of the transaction intelligence management methods according to claims 1-5; An intelligence receiving module, used to receive the transaction intelligence sent by the blockchain node server in response to the query request; wherein the transaction intelligence is retrieved when the blockchain node server detects that the identity information and query parameters corresponding to the query request meet preset conditions; A security optimization module is used to optimize the security system of the electronic device based on the transaction intelligence.

11. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 8.

12. A computer program product, wherein the computer program product stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 8.

13. An electronic device, comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 8.

Images