Data query method, device, electronic device and readable storage medium

Abstract

The present application discloses a data query method, device, electronic device and readable storage medium, the method comprising: obtaining historical operation data and operation data to be queried; determining candidate historical data segments that match each of the data segments to be queried based on multiple historical data segments corresponding to the historical operation data and multiple data segments to be queried corresponding to the operation data to be queried; determining a causal association graph based on the operation type and operation account characteristics of each of the candidate historical data segments, and the operation type and operation account characteristics of associated historical data segments associated with the candidate historical data segments; querying a target causal path that meets preset conditions from the causal association graph; wherein the target causal path includes multiple target operation events.

Description

Technical Field

[0001] The present application belongs to the field of artificial intelligence technology, and specifically relates to a data query method, device, electronic device and readable storage medium. Background Art

[0002] With the rapid development of enterprises, there are more and more internal systems, and the unified management of accounts faces many challenges: (1) Account information is flooded: the information of various types of accounts used by users in different systems is complicated, and the lack of unified management leads to redundant account information. (2) There is a risk of privacy information leakage: the user's privacy information is scattered and stored in various systems, lacking an effective privacy protection mechanism. (3) It is difficult to correlate and analyze the user's operation behavior in different systems, resulting in the inability to discover and trace suspicious behavior in real time, and it is difficult to confirm responsibility. In related technologies, joint identity authentication can be used to achieve mutual authentication of account identities on multiple platforms based on protocols such as Security Assertion Markup Language (SAML) and Open Authorization (OAuth), thereby simplifying the user login process. It is also possible to establish a centralized account information library through a centralized user directory to achieve unified management of accounts across platforms.

[0003] Although the traditional blockchain evidence storage method records the historical data of each operation, it lacks intelligent analysis and anomaly detection of the historical operation data behavior, making it difficult to accurately determine responsibility when an anomaly occurs. Summary of the invention

[0004] The embodiments of the present application provide a data query method, device, electronic device and readable storage medium, which can solve the problem that traditional blockchain evidence storage methods lack intelligent analysis and anomaly detection of historical operation data behaviors, making it difficult to accurately determine responsibility when an anomaly occurs.

[0005] In a first aspect, an embodiment of the present application provides a data query method, which includes: obtaining historical operation data and operation data to be queried; determining candidate historical data segments that match each of the data segments to be queried based on multiple historical data segments corresponding to the historical operation data and multiple data segments to be queried corresponding to the operation data to be queried; determining a causal association graph based on the operation type and operation account characteristics of each of the candidate historical data segments, and the operation type and operation account characteristics of the associated historical data segments associated with the candidate historical data segments; wherein the nodes of the causal association graph are used to represent each operation event in the candidate historical data segments or the associated historical data segments, and the edges of the causal association graph are used to represent the causal relationship between the operation events; querying a target causal path that meets preset conditions from the causal association graph; wherein the target causal path includes multiple target operation events.

[0006] In a second aspect, an embodiment of the present application provides a data query device, which includes: an acquisition module, used to acquire historical operation data and operation data to be queried; a first determination module, used to determine a candidate historical data segment that matches each data segment to be queried based on multiple historical data segments corresponding to the historical operation data and multiple data segments to be queried corresponding to the operation data to be queried; a second determination module, used to determine a causal association graph based on the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of the associated historical data segment associated with the candidate historical data segment; wherein the nodes of the causal association graph are used to represent each operation event in the candidate historical data segment or the associated historical data segment, and the edges of the causal association graph are used to represent the causal relationship between the operation events; a query module, used to query a target causal path that meets preset conditions from the causal association graph; wherein the target causal path includes multiple target operation events.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0009] In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the steps of the method described in the first aspect.

[0010] In a sixth aspect, an embodiment of the present application provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises a program or instructions, and when the program or instructions are executed, the steps of the method described in the first aspect are implemented.

[0011] In an embodiment of the present application, by acquiring historical operation data and operation data to be queried, a candidate historical data segment that matches each of the data segments to be queried is determined based on multiple historical data segments corresponding to the historical operation data and multiple data segments to be queried corresponding to the operation data to be queried. The candidate historical data segment has similarities with the data segment to be queried in part or all of the features, thereby determining an accurate and smaller query range for further querying the operation data to be queried, thereby improving the query speed. Then, according to the operation type and operation account characteristics of each candidate historical data fragment, and the operation type and operation account characteristics of the associated historical data fragment associated with the candidate historical data fragment, a causal association graph is determined, wherein the nodes of the causal association graph are used to represent the individual operation events in the candidate historical data fragment or the associated historical data fragment, and the edges of the causal association graph are used to represent the causal relationship between the operation events. The causal association graph can clearly express the various causal relationships of the candidate historical data fragments, and can know the various associated historical data fragments that have a causal relationship with each candidate historical data fragment, so as to query the target causal path that meets the preset conditions from the causal association graph based on the causal relationship, and the target causal path includes multiple target operation events, that is, each target operation event with a causal relationship including the operation event of the candidate historical data fragment is queried, thereby realizing the tracing of each responsible subject involved in the queried operation data. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a flowchart of a data query method provided in an embodiment of the present application; Figure 2 It is a flowchart of another data query method provided in an embodiment of the present application; Figure 3 It is a flowchart of another data query method provided in an embodiment of the present application; Figure 4a It is a flowchart of another data query method provided in an embodiment of the present application; Figure 4b It is a flowchart of another data query method provided in an embodiment of the present application; Figure 5 It is a structural schematic diagram of a data query device provided in an embodiment of the present application; Figure 6 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0013] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0014] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0015] The data query method, device, electronic device and readable storage medium provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0016] Figure 1 A schematic diagram of a data query method provided in an embodiment of the present application is shown, and the method can be executed by an electronic device. Figure 1 , the method may include the following steps.

[0017] Step 102: Acquire historical operation data and operation data to be queried.

[0018] Among them, historical operation data refers to the relevant data on operations performed by the operating account in various systems or platforms during the historical period, and the operation data to be queried refers to operation data with suspicious or abnormal characteristics, which needs to be reviewed.

[0019] Step 104 : determining a candidate historical data segment that matches each of the data segments to be queried based on the multiple historical data segments corresponding to the historical operation data and the multiple data segments to be queried corresponding to the operation data to be queried.

[0020] Among them, the amount of historical operation data is large. By dividing the historical operation data into multiple historical data segments, and dividing the operation data to be queried into multiple data segments to be queried for analysis, the characteristics of the historical operation data and the characteristics of the operation data to be queried can be more clearly understood.

[0021] Step 106, determine a causal association graph based on the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of the associated historical data segment associated with the candidate historical data segment; wherein the nodes of the causal association graph are used to represent each operation event in the candidate historical data segment or the associated historical data segment, and the edges of the causal association graph are used to represent the causal relationship between the operation events.

[0022] Among them, the causal relationship diagram can clearly express the causal relationships of each candidate historical data fragment, so as to obtain each associated historical data fragment that has a causal relationship with each candidate historical data fragment, and provide a basis for tracing the various responsible entities involved in the operation data to be queried.

[0023] Step 108: query the target causal path that meets the preset conditions from the causal association graph.

[0024] Among them, based on the causal relationship between each node, it can be known that the causal relationship graph is a directed acyclic graph, that is, the occurrence of each operation event represented by each node has a certain order, and a path from the starting point to the end point can be obtained with a certain node as the starting point and another node as the end point, and the path constitutes the implementation process of a certain operation. For the target causal path that meets the preset conditions, it includes multiple target operation events, and the target operation event is each operation event with a causal relationship including the operation event of the candidate historical data segment, that is, each responsible subject involved in the operation data to be queried. For example, an abnormal operation event may be a target operation event, and an abnormal operation may be performed by the operation user corresponding to the target operation event.

[0025] In an embodiment of the present application, by acquiring historical operation data and operation data to be queried, a candidate historical data segment that matches each of the data segments to be queried is determined based on multiple historical data segments corresponding to the historical operation data and multiple data segments to be queried corresponding to the operation data to be queried. The candidate historical data segment has similarities with the data segment to be queried in part or all of the features, thereby determining an accurate and smaller query range for further querying the operation data to be queried, thereby improving the query speed. Then, based on the operation type and operation account characteristics of each candidate historical data fragment, as well as the operation type and operation account characteristics of the associated historical data fragments associated with the candidate historical data fragment, a causal association graph is determined, which can clearly express the causal relationships of each candidate historical data fragment, and can obtain each associated historical data fragment that has a causal relationship with each candidate historical data fragment, so as to query the target causal path that meets the preset conditions from the causal association graph based on the causal relationship, and the target causal path includes multiple target operation events, that is, each target operation event with a causal relationship including the operation event of the candidate historical data fragment is queried, and these target operation events are operation events with suspicious or abnormal characteristics, thereby realizing the tracing of each responsible subject involved in the queried operation data.

[0026] In one implementation, the above-mentioned step 104 determines the candidate historical data segment matching each of the data segments to be queried according to the multiple historical data segments corresponding to the historical operation data and the multiple data segments to be queried corresponding to the operation data to be queried, and may include the following steps.

[0027] Step 1041: divide the historical operation data into the multiple historical data segments according to time windows of different levels, and divide the operation data to be queried into the multiple data segments to be queried according to time windows of different levels.

[0028] The historical operation data may have a long historical time span. The historical operation data and the operation data to be queried are divided based on time to reduce the complexity of analyzing the operation data. Divide into time windows of levels, each level The length of the time window is:

[0029] Among them, the time windows of each level present a pyramid-like hierarchical structure. The closer to the upper level, the coarser the granularity of the time windows and the smaller the number, and the closer to the lower level, the finer the granularity of the time windows and the larger the number.

[0030] Step 1042: extracting a first feature vector corresponding to each of the historical data segments, and extracting a second feature vector corresponding to each of the to-be-queried data segments.

[0031] The first feature vector corresponding to each historical data segment and the second feature vector corresponding to each data segment to be queried may include three key indicators: operation frequency, operation type, and operation account association graph. The Bag of Words (BoW) model can be used to map the operation type to a One-Hot vector and add and sum to obtain the indicator corresponding to the operation type. The operation account association graph is composed of the association relationship between each operation account and can be represented by a vector.

[0032] Step 1043: Determine, based on the encoded first feature vector and the second feature vector, a historical data segment corresponding to the first feature vector having the same encoding as the second feature vector.

[0033] Among them, the first feature vector and the second feature vector both include multiple feature components and are high-dimensional feature vectors. By encoding the first feature vector and the second feature vector, the high-dimensional feature vector is mapped to a low-dimensional hash code, so that the matching between the first feature vector and the second feature vector can be quickly determined according to the hash code. An inverted index is established for the encoded first feature vector, the hash code is the index, and each first feature vector corresponding to the index is the value, so that by matching the index, each first feature vector corresponding to the same index is determined, and the first feature vector with the same encoding as the second feature vector can be obtained.

[0034] Among them, an optional encoding method is as follows:

[0035] in, is the operation frequency, is the operation type, To operate the account association diagram, , , is a randomly generated hyperplane normal vector used to map the feature vector to the binary encoding space.

[0036] Step 1044: Select a first preset number of historical data segments from the historical data segments corresponding to the first feature vector as the candidate historical data segments.

[0037] In the embodiment of the present application, by dividing the historical operation data into the multiple historical data segments according to different levels of time windows, and dividing the operation data to be queried into the multiple data segments to be queried according to different levels of time windows, the characteristics of the historical operation data at different levels are retained. Then, by extracting the first feature vector of the refined historical data segment and the second feature vector of the data segment to be queried, and performing fast matching based on the encoded first feature vector and the second feature vector, the historical data segment corresponding to the first feature vector with the same encoding as the second feature vector is determined, and then from the historical data segment corresponding to the first feature vector, the first preset number of the historical data segments are selected as the candidate historical data segments, so as to determine an accurate and smaller query range for further querying the operation data to be queried, which can improve the query speed, and use the candidate historical data segment as the key clue for querying the operation data to be queried.

[0038] In one implementation, the first feature vector includes a first operation frequency vector, a first operation type vector, and a first operation account association vector; the second feature vector includes a second operation frequency vector, a second operation type vector, and a second operation account association vector. The above step 1044 selects a first preset number of historical data segments from the historical data segments corresponding to the first feature vector as the candidate historical data segments, which may include the following steps.

[0039] Step 10441, respectively determine a first similarity between the first operation frequency vector and the second operation frequency vector, a second similarity between the first operation type vector and the second operation type vector, and a third similarity between the first operation account association vector and the second operation account association vector.

[0040] Wherein, based on the features of the three dimensions included in the feature vector, the similarity of the features of each dimension is determined respectively, so as to achieve a more detailed feature analysis of the first feature vector and the second feature vector.

[0041] Step 10442: Determine a target similarity between the historical data segment and the data segment to be queried based on the first similarity, the second similarity, and the third similarity.

[0042] Among them, the target similarity integrates the similarity of the features of the first feature vector and the second feature vector in each dimension, that is, it integrates the similarity of the features of the historical data fragment and the data fragment to be queried in each dimension, and can comprehensively and accurately measure the similarity between the historical data fragment and the data fragment to be queried.

[0043] Among them, an optional method for determining target similarity is as follows:

[0044] in, represents cosine similarity (first similarity, second similarity), Represents the alignment similarity (third similarity) between graph structures, which can be achieved through the graph neural network model. , , are three weight coefficients, S represents the data segment to be queried, Indicates Layer i-th historical time window The operation frequency feature vector within. Indicates Layer i-th historical time window The operation type distribution feature vector within. Indicates Layer i-th historical time window Account association diagram within.

[0045] Step 10443: Select the first preset number of historical data segments as the candidate historical data segments in descending order of the target similarity.

[0046] In an embodiment of the present application, by respectively determining the first similarity between the first operation frequency vector and the second operation frequency vector, the second similarity between the first operation type vector and the second operation type vector, and the third similarity between the first operation account association vector and the second operation account association vector, and then determining the target similarity between the historical data segment and the data segment to be queried based on the first similarity, the second similarity, and the third similarity, thereby based on the target similarity that can comprehensively and accurately measure the similarity between the historical data segment and the data segment to be queried, the first preset number of historical data segments are selected as the candidate historical data segments in order from large to small according to the target similarity, and the similarity between the candidate historical data segment and the data segment to be queried is relatively greater, thereby improving the query accuracy on the basis of reducing the analysis complexity.

[0047] In one implementation, the above-mentioned step 106 determines the causal relationship graph based on the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of the associated historical data segment associated with the candidate historical data segment, and may include the following steps.

[0048] Step 1061, construct a sub-causal association graph corresponding to each candidate historical data segment based on the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of the associated historical data segment associated with the candidate historical data segment.

[0049] Among them, the associated historical data fragments associated with the candidate historical data fragment may include a causal historical data fragment before the candidate historical data fragment on a time scale, which can characterize the causal operations that led to the candidate historical data fragment, and may include a consequence historical data fragment after the candidate historical data fragment, which can characterize the consequence operations caused by the candidate historical data fragment. The three have a causal relationship.

[0050] Step 1062: merge the sub-causal association graphs corresponding to the candidate historical data segments to obtain the causal association graph.

[0051] In an embodiment of the present application, based on each candidate historical data fragment and its associated associated historical data fragments, a sub-causal association graph with the candidate historical data fragment as the core can be obtained, and since there may also be causal relationships between the candidate historical data fragments and the associated historical data fragments, the sub-causal association graphs can be merged based on the causal relationship to obtain a global causal association graph corresponding to the candidate historical data fragment, which reflects the various operation events and their causal relationships in the candidate historical data fragment or the associated historical data fragment, so that based on a certain node, multiple nodes that have a causal relationship with it can be obtained, that is, multiple target operation events that can be traced back.

[0052] In one implementation, the above-mentioned step 1061 constructs a sub-causal relationship graph corresponding to each candidate historical data segment based on the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of the associated historical data segment associated with the candidate historical data segment, and may include the following steps.

[0053] Step 10611: Determine a first association strength between the candidate historical data segment and the associated historical data segment according to the operation type of the candidate historical data segment and the operation type of the associated historical data segment.

[0054] An optional method for determining the first correlation strength is as follows:

[0055] in, represents the frequency of operation type i from the candidate historical data segment to operation type j of the associated historical data segment, The transition probability from operation type i to j and the uniqueness of j are comprehensively considered.

[0056] Step 10612: Determine a second correlation strength between the candidate historical data segment and the associated historical data segment based on the operation account characteristics of the candidate historical data segment and the operation account characteristics of the associated historical data segment.

[0057] An optional method for determining the second correlation strength is as follows:

[0058] in, Indicates the interaction frequency between the operating account feature a of the candidate historical data segment and the operating account feature b of the associated historical data segment. The interaction probability from operating account feature a to b and the activity of b are taken into consideration.

[0059] Step 10613 determines the edge weight of the sub-causal association graph according to the first association strength and the second association strength.

[0060] Among them, an optional way to determine the edge weight is: The edge weight reflects the causal strength of the causal relationship between the candidate historical data segment and the associated historical data segment. The greater the causal strength, the greater the impact of the operation type or operation account characteristics of the previous window on the next window.

[0061] Step 10614: construct the sub-causal association graph based on each operation event in the candidate historical data segment or the associated historical data segment and the edge weight.

[0062] In an embodiment of the present application, the construction of a sub-causal association graph includes nodes and edges, wherein the nodes are composed of each operation event in the candidate historical data segment or the associated historical data segment, and the edges are composed of the causal relationship between each operation event in the candidate historical data segment or the associated historical data segment. The edge weight is determined based on the operation type and operation account characteristics of the candidate historical data segment or the associated historical data segment, thereby constructing a sub-causal association graph that can reflect the each operation event and its causal relationship in the candidate historical data segment or the associated historical data segment, which can be used as a local graph for constructing a causal association graph.

[0063] In one implementation, the above step 108 of searching the causal relationship graph for a target causal path that meets a preset condition may include the following steps.

[0064] Step 1081 : query the candidate causal paths with each operation event of the candidate historical data segment as the query start point and the query end point from the causal association graph.

[0065] The candidate causal paths include multiple operation events with an operation event of a candidate historical data segment as the query starting point, an operation event of another candidate historical data segment as the query end point, and operation events of other candidate historical data segments or operation events of related historical data segments as intermediate nodes. Different operation events constitute different candidate causal paths.

[0066] Step 1082, determining the total weight of the candidate causal path according to the weights of each edge of the candidate causal path.

[0067] Among them, different candidate causal paths include different operation events, and the edge weights between different operation events are also different.

[0068] Step 1083: determine the candidate causal path with the largest sum of weights as the target causal path.

[0069] Among them, in this embodiment, the preset condition satisfied by the target causal path is that the sum of the weights of the entire path is the largest. In another implementation, the preset condition satisfied by the target causal path can be that the sum of the weights of the entire path is greater than a preset weight threshold, in which case multiple target causal paths are obtained. An optional method for determining the target causal path is as follows:

[0070] in, Represents the target causal path to the final output. Representing a causal relationship diagram A candidate path in . Representing a causal relationship diagram The set of all possible paths in . e represents the path An edge of . Represents edge The weight of . Indicates the path The sum of the weights of all edges on . Represents the value of the independent variable that maximizes the objective function.

[0071] In an embodiment of the present application, for the candidate causal paths in the causal association graph that use the various operation events of the candidate historical data fragments as the query starting point and query end point, the sum of the weights of different candidate causal paths is calculated, and the size of the sum of the weights is used as the judgment condition for selecting the target causal path. In this embodiment, the candidate causal path with the largest sum of weights is determined as the target causal path. The target causal path reflects the target operation events that are most similar or relevant to the operation data to be queried with suspicious or abnormal characteristics, thereby determining the various responsible entities involved in the operation data to be queried in the historical operation data.

[0072] In an optional implementation, the above-mentioned data query method may further include: determining the overall abnormality of the causal association graph based on the causal association graph.

[0073] The overall abnormality score can be determined by the following formula to measure the overall abnormality of the causal relationship diagram:

[0074] in, Represents sampling of suspicious events from random walks in the causal relationship graph The probability of suspicious operation events intuitively measures the abnormality of suspicious operation events in normal historical patterns. Indicates suspicious operation data within a period of time, consisting of multiple consecutive operation events composition. The higher the abnormality score, the more significantly the suspicious operation data deviates from normal operations, and the greater the possibility of illegal operations.

[0075] In one implementation, the above step 102 of acquiring historical operation data may include the following steps.

[0076] Step 1021, determining the sampling probability of the sampled data according to the operation frequency, operation type weight, operation account weight, and sampling function of the sampled data.

[0077] Among them, an optional sampling function is as follows:

[0078] Among them, , is a hyperparameter that controls the rate of change of the function at the threshold. is a custom threshold. The input of the sampling function is determined by the operating frequency , Operation type weight , Operation account weight The weighted sum of the three factors is: , among which , , are weight coefficients of the three factors, which can be adjusted according to actual business. The output of the sampling function is the sampling probability of the sampled data, which is used to reflect the importance of each sampled data, so as to determine whether to select the historical operation data for subsequent processing according to the importance of the sampled data. The closer the sampling probability is to 1, the greater the importance of the sampled data is, and the closer the sampling probability is to 0, the less important the sampled data is, and it can be discarded.

[0079] Step 1022: extract a second preset number of the sampled data whose sampling probability is greater than a preset probability threshold from the sampled data as the historical operation data.

[0080] In an embodiment of the present application, a sampling function is introduced to measure the importance of the sampled data according to the sampling probability determined by the operation frequency of the sampled data, the operation type weight, and the operation account weight, and differentiated sampling processing is adopted for sampled data of different importance, and the second preset sampled data whose sampling probability is greater than the preset probability threshold is extracted as the historical operation data. Compared with the high cost and large storage redundancy caused by treating all sampled data equally in the related art, the embodiment of the present application balances the storage cost and saves storage space to the maximum extent while ensuring that key data is not missed.

[0081] Figure 2 A flowchart of another data query method provided by an embodiment of the present application is shown in FIG. Figure 2 After acquiring the historical operation data in the above step 102, the above data query method may further include the following steps.

[0082] Step 202: Perform hash processing on the historical operation data and the attribute information of the historical operation data to obtain a leaf node corresponding to the historical operation data.

[0083] Among them, the leaf nodes of the first hash tree constructed in the embodiment of the present application introduce attribute information of historical operation data to enrich the semantic information contained in the leaf nodes.

[0084] Among them, an optional hash processing method is as follows:

[0085] in, The i-th leaf node after hash processing, historical operation data The attribute information includes the operation type , Operation time , Related information And other attributes.

[0086] Step 204: construct a first hash tree according to the leaf nodes corresponding to each of the historical operation data and determine a first root node of the first hash tree.

[0087] The first hash tree includes leaf nodes and a first root node, and the first root node is determined according to each leaf node.

[0088] Step 206: store the first root node in the blockchain.

[0089] In an embodiment of the present application, a first hash tree is constructed based on historical operation data and attribute information of the historical operation data, and a first root node is determined based on all leaf nodes, and the first root node is stored in the blockchain. The first hash tree is stored in a storage space off-chain, which can not only save the storage space of the blockchain, but also verify the authenticity of the leaf nodes stored off-chain based on the first root node stored on the blockchain.

[0090] In one implementation, after the first root node is stored in the blockchain in the above step 206, the method further includes the following steps.

[0091] Step 208: Obtain the constructed first hash tree and determine the second root node of the first hash tree.

[0092] Among them, the constructed first hash tree is stored in the storage space under the chain, which may be subject to the risk of tampering, loss, etc. When the leaf node of the first hash tree is tampered with, lost, etc., the first root node of the first hash tree will change. When the leaf node of the first hash tree is not tampered with, lost, etc., the first root node of the first hash tree will not change, thereby using this feature to verify the first hash tree.

[0093] Step 210: compare the second root node with the first root node to obtain a comparison result.

[0094] The comparison result may include two types: the second root node is consistent with the first root node, and the second root node is inconsistent with the first root node. Comparing the second root node with the first root node may be comparing the hash value of the second root node ( ) and the hash value of the first root node ( ), can be expressed by the following formula:

[0095] Step 212: When the comparison result is that the second root node is consistent with the first root node, the comparison record is stored in the blockchain; wherein the comparison record includes the comparison result and a timestamp corresponding to the comparison result.

[0096] In an embodiment of the present application, a new second root node is calculated for the first hash tree, and the second root node is compared with the first root node stored on the blockchain. When the comparison result is that the second root node is consistent with the first root node, a comparison record including the comparison result and the timestamp is stored in the blockchain. For example, it can be stored in an existing verification record sequence in the blockchain, thereby forming a verification evidence chain for verifying the first hash tree, so as to determine the authenticity and continuity of each historical operation data corresponding to the first hash tree through the verification evidence chain, thereby improving the efficiency of verification.

[0097] In one implementation, when the comparison result is that the second root node is inconsistent with the first root node, the method further includes the following steps.

[0098] Step 214: for the abnormal historical operation data, obtain copy data of the normal historical operation data corresponding to the abnormal historical operation data.

[0099] The historical operation data is also backed up and stored in other backup storage spaces to cope with abnormal situations. In this embodiment, the abnormal situation is that some historical operation data is damaged.

[0100] Step 216: Replace the abnormal historical operation data in the historical operation data with the copy data, construct a second hash tree and determine a third root node of the second hash tree.

[0101] The abnormal historical operation data is replaced with the copy data, and the second hash tree is rebuilt through the same construction operation as above to cope with the abnormal situation.

[0102] Step 218: Update the first root node to the third root node.

[0103] In an embodiment of the present application, in the event that certain historical operation data is damaged, it can be determined that the comparison result is that the second root node is inconsistent with the first root node. At this time, copy data of the normal historical operation data corresponding to the abnormal historical operation data is obtained to make up for the damaged historical operation data through the copy data, and then the second hash tree is reconstructed and the third root node is determined. The first root node corresponding to the first hash tree stored on the blockchain is updated to the third root node corresponding to the second hash tree, thereby realizing the maintenance of historical operation data under abnormal circumstances and ensuring the storage security and recoverability of historical operation data.

[0104] Figure 3 A flowchart of another data query method provided by an embodiment of the present application is shown in FIG. Figure 3After acquiring the historical operation data in the above step 102, the above data query method may further include the following steps.

[0105] Step 302: For the operation account corresponding to the historical operation data, attribute information of the operation account is encrypted according to the attribute public key corresponding to the operation account to obtain first encrypted data.

[0106] Among them, for the operation account corresponding to the historical operation data, the account public key and account private key corresponding to the operation account, as well as the attribute public key and attribute private key corresponding to each type of attribute information of the operation account will be generated according to the encryption requirements, which are used for encryption requirements of different levels. The various types of attribute information of the operation account include name, phone number, etc.

[0107] Step 304: encrypt the first encrypted data according to the account public key corresponding to the operation account to obtain second encrypted data.

[0108] The secondary encryption process can be expressed by the following formula:

[0109] in, For operating account The corresponding second encrypted data, For operating account No. The attribute public key corresponding to the type attribute information, For operating account No. Type attribute information, For operating account The corresponding account public key.

[0110] In the embodiment of the present application, the privacy information of the operation account corresponding to the historical operation data needs to be encrypted twice. The first encryption is to encrypt the attribute information of the operation account. The attribute information of the operation account is encrypted according to the attribute public key corresponding to the operation account to obtain the first encrypted data. The second encryption is to encrypt the first encrypted data as a whole again. The first encrypted data is encrypted according to the account public key corresponding to the operation account to obtain the second encrypted data. Multi-layer encryption of the privacy information of the operation account corresponding to the historical operation data is achieved, and different attributes can be shared with different data users respectively, making data sharing more flexible and secure.

[0111] In one implementation, after the first encrypted data is encrypted according to the account public key corresponding to the operation account in the above step 304 to obtain the second encrypted data, the method may further include the following steps.

[0112] Step 306: divide the second encrypted data into a third preset number of data fragments according to a preset mathematical model.

[0113] The preset mathematical model includes: Lagrange interpolation polynomial. Therefore, the data sharding can be achieved in the following way: , , .

[0114] in, Indicates the operating account The corresponding second encrypted data data shards, is a large prime number, are the coefficients of the interpolation polynomial, for The number of data shards selected from the data shards. For operating account The corresponding second encrypted data, other coefficients Generated randomly.

[0115] Step 308: Store the third preset data shards in third preset storage nodes respectively.

[0116] In an embodiment of the present application, by dividing the second encrypted data into a third preset data shards and storing the third preset data shards respectively in a third preset storage node, each storage node stores only one data shard, and the complete second encrypted data cannot be restored based on the data shards of a single storage node, thereby further improving the security of the privacy information of the operation account corresponding to the historical operation data.

[0117] In one implementation, the above data query method may further include the following steps.

[0118] Step 310, generating an authorization token; wherein the authorization token is used to instruct the operating account to authorize the to-be-shared operating account to read the attribute information; the authorization token includes the attribute information and access conditions.

[0119] When the owner of the operating account needs to share certain attribute information with a third party (the owner of the operating account to be shared), the generated authorization token is used to instruct the operating account to authorize the operating account to be shared to read the attribute information.

[0120] Step 312: The authorization token is signed according to the account private key corresponding to the operation account to obtain a signed authorization token.

[0121] The security of the authorization token is ensured by transmitting the signed authorization token.

[0122] Step 314: blind the authorization token according to the account private key corresponding to the operation account to be shared to obtain a blinded authorization token.

[0123] The disclosure of the content of the authorization token is avoided by using a blinded authorization token.

[0124] Step 316, generating a zero-knowledge proof based on the signed authorization token, the blinded authorization token, the account public key corresponding to the operation account to be shared, and the account private key corresponding to the operation account to be shared; wherein the zero-knowledge proof is used to prove that the operation account authorizes the operation account to be shared to read the attribute information.

[0125] Among them, the generation of zero-knowledge proof can be expressed by the following formula: , , , .

[0126] in, For operating account The i-th attribute information of For operating account Instructions to the operating account An authorization token that authorizes reading attribute information. For operating account The corresponding account private key, For the signed authorization token, To blind the authorization token, It is a zero-knowledge proof.

[0127] Step 318: Authorize the account to be shared to read the attribute information based on the zero-knowledge proof.

[0128] In an embodiment of the present application, a signed authorization token is obtained by signing the generated authorization token, and a blinded authorization token is obtained by blinding the token. Then, based on the signed authorization token, the blinded authorization token, the account public key corresponding to the operation account to be shared, and the account private key corresponding to the operation account to be shared, a zero-knowledge proof is generated to prove that the operation account authorizes the operation account to be shared to read the attribute information. The generation process is encrypted and blinded, so that the content of the authorization token is not exposed, thereby ensuring the security of the authorization token.

[0129] In one implementation, when the to-be-shared operating account needs to share certain attribute information with other operating accounts, a new authorization token is generated to instruct the to-be-shared operating account to authorize other operating accounts to read the attribute information. The new authorization token includes the information of the above authorization token, that is, , the shared operation account adds its own signature to the new authorization token, that is .

[0130] In one implementation, when the operating account needs to revoke the authorization for the shared operating account, an authorization revocation statement is published on the blockchain, so that when obtaining data shards from each storage node, it is first queried on the blockchain whether there is an authorization revocation statement, so as to determine whether to allow or prohibit access to the data shards.

[0131] In one implementation, after the above step 318 authorizes the to-be-shared operation account to read the attribute information according to the zero-knowledge proof, the above method may further include the following steps.

[0132] Step 320: decrypt the second encrypted data according to the account private key corresponding to the account to be shared, to obtain encrypted attribute information.

[0133] Step 322: decrypt the attribute private key ciphertext according to the account private key corresponding to the account to be shared, and obtain the attribute private key corresponding to the attribute information.

[0134] The attribute private key ciphertext is obtained by encrypting the attribute private key corresponding to the attribute information according to the preset public key corresponding to the operation account; the attribute private key ciphertext and the attribute public key are correspondingly stored on the blockchain.

[0135] Step 324: decrypt the encrypted attribute information according to the attribute private key corresponding to the attribute information to obtain the attribute information.

[0136] The attribute information obtained by decrypting the second encrypted data twice can be expressed by the following formula: , , , .

[0137] in, The attribute private key ciphertext, which is determined by the operating account The corresponding preset public key The attribute private key corresponding to the attribute information is encrypted to obtain, is the attribute private key corresponding to the attribute information, Account to be shared The corresponding account private key, For operating account No. Type attribute information, For operating account No. The attribute public key corresponding to the attribute information of this type.

[0138] In the embodiment of the present application, after obtaining authorization, the first layer of decryption is performed on the obtained second encrypted data according to the account private key corresponding to the operation account to be shared, so as to obtain the encrypted attribute information. Then, the attribute private key ciphertext is decrypted according to the account private key corresponding to the operation account to be shared to obtain the attribute private key used to decrypt the attribute information, and then the encrypted attribute information is encrypted according to the attribute private key, so that the attribute information can be obtained while ensuring the security of the attribute information.

[0139] In one implementation, for the attribute information of multiple different operating accounts, the second encrypted data is encrypted for a third time according to the fully homomorphic public key to obtain the homomorphic ciphertext corresponding to each operating account, and then the homomorphic ciphertext corresponding to each operating account is weighted summed to obtain the fully homomorphic ciphertext. The fully homomorphic ciphertext obtained by encrypting the second encrypted data three times can be expressed by the following formula: , .

[0140] in, is a homomorphic ciphertext, is a fully homomorphic ciphertext, The weights corresponding to different operation accounts.

[0141] Furthermore, for the above-mentioned fully homomorphic ciphertext, the decrypted attribute information can only be obtained through collaborative decryption of each operating account, so that data analysis across operating accounts can be performed while protecting the attribute information of the operating account.

[0142] In an embodiment of the present application, by encrypting the attribute information of the operating account to different degrees or levels, fine-grained authorization is performed on the shared operating account and other operating accounts, and the encrypted attribute information is distributedly stored, thereby enhancing the protection of the attribute information and expanding the sharing capability of the attribute information.

[0143] Figure 4a and Figure 4b A schematic diagram showing another data query method provided in an embodiment of the present application is shown. Figure 4a and Figure 4b , the method comprises the following steps.

[0144] Step 401, deploying the account's smart contract on the preset blockchain. The smart contract is used to specify the rules for uploading the operation data corresponding to the account, operation data verification, fault tolerance and other strategies.

[0145] Step 402: extract core operation data from each operation data corresponding to the account.

[0146] Among them, each operation data can be stored and verified through the data storage and verification algorithm based on smart contracts. For details of the data storage and verification algorithm based on smart contracts, please refer to Figure 2 The embodiment shown.

[0147] Step 403, construct the core operation data into a hash tree and determine the first root hash corresponding to the hash tree, store the hash tree in the off-chain storage space and store the first root hash in the blockchain.

[0148] Among them, the hash tree can be stored in the off-chain storage space through a distributed data protection algorithm based on key management. The distributed data protection algorithm based on key management can be found in Figure 3 The embodiment shown.

[0149] Step 404, regularly check the hash tree stored in the off-chain storage space and compare the second root hash determined based on the hash tree with the first root hash. If they are consistent, the verification result is recorded and stored in the blockchain. If they are inconsistent, obtain the copy data from the backup storage space, rebuild the hash tree, and store the corresponding third root hash determined based on the rebuilt hash tree in the blockchain.

[0150] Step 405: For the operation data to be queried, the timeline data related to the operation data to be queried is generated by combining the data stored on the chain and off the chain.

[0151] Among them, the timeline data is used to represent the operation data that has a causal relationship with the data to be queried and is retrieved from the stored data, so as to clearly show the causes and consequences of the data to be queried, so that each responsible party can be traced back based on the timeline data. The operation data to be queried can be traced back and the responsibility can be determined by the operation data backtracking and responsibility determination algorithm based on the time window. For details, please refer to the following. Figure 1 The embodiment shown.

[0152] Step 406: Transmit the data stored on and off the chain through the Application Programming Interface (API).

[0153] When the external business system needs to obtain data and conduct analysis, it obtains on-chain data and encrypted off-chain data through the API interface, and summarizes the obtained data so that the management can make correct decisions based on the summarized data.

[0154] In the embodiments of the present application, the operation data of the operating user is processed through a data storage and verification algorithm based on smart contracts, a distributed data protection algorithm based on key management, and an operation data backtracking and responsibility determination algorithm based on a time window. This improves the efficiency of storage and verification of operation data, the scalability of sharing functions and the flexibility of authorization, and the security of privacy information, thereby achieving efficient backtracking of queried operation data and accurate responsibility determination.

[0155] It should be noted that the data query method provided in the embodiment of the present application can be executed by a data query device or a control module in the data query device for executing the data query method. In the embodiment of the present application, the data query device provided in the embodiment of the present application is described by taking the data query method executed by the data query device as an example.

[0156] Figure 5 FIG. 1 shows a schematic diagram of the structure of a data query device provided in an embodiment of the present application. Figure 5 As shown, the data query device 500 includes: an acquisition module 51 , a first determination module 52 , a second determination module 53 and a query module 54 .

[0157] Among them, the acquisition module 51 is used to acquire historical operation data and operation data to be queried; the first determination module 52 is used to determine the candidate historical data fragments that match each of the data fragments to be queried according to the multiple historical data fragments corresponding to the historical operation data and the multiple data fragments to be queried corresponding to the operation data to be queried; the second determination module 53 is used to determine the causal association graph according to the operation type and operation account characteristics of each of the candidate historical data fragments, and the operation type and operation account characteristics of the associated historical data fragments associated with the candidate historical data fragments; wherein the nodes of the causal association graph are used to represent each operation event in the candidate historical data fragments or the associated historical data fragments, and the edges of the causal association graph are used to represent the causal relationship between the operation events; the query module 54 is used to query the target causal path that meets the preset conditions from the causal association graph; wherein the target causal path includes multiple target operation events.

[0158] In one implementation, the above-mentioned first determination module 52 can be used to divide the historical operation data into the multiple historical data segments according to time windows of different levels, and divide the operation data to be queried into the multiple data segments to be queried according to time windows of different levels; extract the first feature vector corresponding to each of the historical data segments, and extract the second feature vector corresponding to each of the data segments to be queried; determine the historical data segment corresponding to the first feature vector with the same encoding as the second feature vector based on the encoded first feature vector and the second feature vector; and select the first preset number of historical data segments from the historical data segments corresponding to the first feature vector as the candidate historical data segments.

[0159] In one implementation, the first feature vector includes a first operation frequency vector, a first operation type vector, and a first operation account association vector; the second feature vector includes a second operation frequency vector, a second operation type vector, and a second operation account association vector; the above-mentioned first determination module 52 can be used to respectively determine the first similarity between the first operation frequency vector and the second operation frequency vector, the second similarity between the first operation type vector and the second operation type vector, and the third similarity between the first operation account association vector and the second operation account association vector; determine the target similarity between the historical data segment and the data segment to be queried based on the first similarity, the second similarity, and the third similarity; select the first preset number of the historical data segments as the candidate historical data segments in order of the target similarity from large to small.

[0160] In one implementation, the above-mentioned second determination module 53 can be used to construct a sub-causal association graph corresponding to each candidate historical data segment based on the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of the associated historical data segment associated with the candidate historical data segment; and merge the sub-causal association graphs corresponding to each of the candidate historical data segments to obtain the causal association graph.

[0161] In one implementation, the above-mentioned second determination module 53 can be used to determine the first association strength between the candidate historical data segment and the associated historical data segment based on the operation type of the candidate historical data segment and the operation type of the associated historical data segment; determine the second association strength between the candidate historical data segment and the associated historical data segment based on the operation account characteristics of the candidate historical data segment and the operation account characteristics of the associated historical data segment; determine the edge weight of the sub-causal association graph based on the first association strength and the second association strength; construct the sub-causal association graph based on each operation event in the candidate historical data segment or the associated historical data segment, and the edge weight.

[0162] In one implementation, the query module 54 can be used to query candidate causal paths with the operation events of the candidate historical data segments as the query starting point and query end point from the causal association graph; determine the sum of the weights of the candidate causal paths based on the edge weights of the candidate causal paths; and determine the candidate causal path with the largest sum of weights as the target causal path.

[0163] In one implementation, the above-mentioned acquisition module 51 can be used to determine the sampling probability of the sampling data based on the operation frequency, operation type weight, operation account weight, and sampling function of the sampling data; and extract a second preset number of the sampling data whose sampling probability is greater than a preset probability threshold from the sampling data as the historical operation data.

[0164] In one implementation, the above-mentioned data query device may also include a storage module, which is used to perform hash processing on the historical operation data and the attribute information of the historical operation data to obtain leaf nodes corresponding to the historical operation data; construct a first hash tree and determine the first root node of the first hash tree according to the leaf nodes corresponding to each of the historical operation data; and store the first root node in the blockchain.

[0165] In one implementation, the above-mentioned data query device may also include a verification module, which is used to obtain the constructed first hash tree and determine the second root node of the first hash tree; compare the second root node with the first root node to obtain a comparison result; when the comparison result is that the second root node is consistent with the first root node, store the comparison record in the blockchain; wherein the comparison record includes the comparison result and the timestamp corresponding to the comparison result.

[0166] In one implementation, the above-mentioned verification module can also be used to obtain, for abnormal historical operation data, copy data of normal historical operation data corresponding to the abnormal historical operation data when the comparison result is that the second root node is inconsistent with the first root node; replace the abnormal historical operation data in the historical operation data with the copy data, build a second hash tree and determine the third root node of the second hash tree; and update the first root node to the third root node.

[0167] In one implementation, the above-mentioned data query device may also include an encryption module, which is used to encrypt the attribute information of the operation account corresponding to the historical operation data according to the attribute public key corresponding to the operation account to obtain first encrypted data; and encrypt the first encrypted data according to the account public key corresponding to the operation account to obtain second encrypted data.

[0168] In one implementation, the above-mentioned storage module can also be used to divide the second encrypted data into a third preset number of data slices according to a preset mathematical model; and store the third preset number of data slices in a third preset number of storage nodes respectively.

[0169] In one implementation, the above-mentioned data query device may also include an authorization module for generating an authorization token; wherein, the authorization token is used to indicate that the operating account authorizes the operating account to be shared to read the attribute information; the authorization token includes the attribute information and access conditions; the authorization token is signed according to the account private key corresponding to the operating account to obtain a signed authorization token; the authorization token is blinded according to the account private key corresponding to the operating account to be shared to obtain a blinded authorization token; a zero-knowledge proof is generated according to the signed authorization token, the blinded authorization token, the account public key corresponding to the operating account to be shared, and the account private key corresponding to the operating account to be shared; wherein, the zero-knowledge proof is used to prove that the operating account authorizes the operating account to be shared to read the attribute information; according to the zero-knowledge proof, the operating account to be shared is authorized to read the attribute information.

[0170] In one implementation, the above-mentioned data query device may also include a decryption module, which is used to decrypt the second encrypted data according to the account private key corresponding to the operation account to be shared to obtain the encrypted attribute information; decrypt the attribute private key ciphertext according to the account private key corresponding to the operation account to be shared to obtain the attribute private key corresponding to the attribute information; wherein the attribute private key ciphertext is obtained by encrypting the attribute private key corresponding to the attribute information according to the preset public key corresponding to the operation account; and decrypting the encrypted attribute information according to the attribute private key corresponding to the attribute information to obtain the attribute information.

[0171] The data query device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device, and for example, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc., and the embodiment of the present application does not specifically limit it.

[0172] The data query device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0173] The data query device provided in the embodiment of the present application can achieve Figures 1 to 4b To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0174] Based on the same technical concept, an embodiment of the present application further provides an electronic device, which is used to execute the above data query method. Figure 6A schematic diagram of the structure of an electronic device for implementing various embodiments of the present application. The electronic device may have relatively large differences due to different configurations or performances, and may include a processor (processor) 601, a communication interface (Communications Interface) 602, a memory (memory) 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604. The processor 601 can call a computer program stored in the memory 603 and can be run on the processor 601 to execute the various steps of the above-mentioned data query method embodiment, and can achieve the same technical effect, so it will not be repeated here to avoid repetition.

[0175] It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals, or other devices except terminals.

[0176] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0177] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0178] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0179] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned data query method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0180] The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0181] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned data query method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0182] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0183] An embodiment of the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes a program or instructions. When the program or instructions are executed, the various processes of the above-mentioned data query method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0184] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0185] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0186] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A data query method, characterized in that: include: Obtain historical operation data and operation data to be queried; Determine, according to the multiple historical data segments corresponding to the historical operation data and the multiple data segments to be queried corresponding to the operation data to be queried, a candidate historical data segment matching each of the data segments to be queried; Determine a causal association graph according to the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of an associated historical data segment associated with the candidate historical data segment; wherein the nodes of the causal association graph are used to represent each operation event in the candidate historical data segment or the associated historical data segment, and the edges of the causal association graph are used to represent the causal association relationship between the operation events; A target causal path that meets preset conditions is queried from the causal association graph; wherein the target causal path includes multiple target operation events.

2. The method according to claim 1, characterized in that The determining, according to the multiple historical data segments corresponding to the historical operation data and the multiple to-be-queried data segments corresponding to the to-be-queried operation data, a candidate historical data segment matching each to-be-queried data segment comprises: Dividing the historical operation data into the multiple historical data segments according to time windows at different levels, and dividing the operation data to be queried into the multiple data segments to be queried according to time windows at different levels; Extracting a first feature vector corresponding to each of the historical data segments, and extracting a second feature vector corresponding to each of the to-be-queried data segments; Determine, according to the encoded first feature vector and the second feature vector, a historical data segment corresponding to the first feature vector having the same encoding as the second feature vector; From the historical data segments corresponding to the first feature vector, a first preset number of the historical data segments are selected as the candidate historical data segments.

3. The method according to claim 2, characterized in that The first feature vector includes a first operation frequency vector, a first operation type vector, and a first operation account association vector; the second feature vector includes a second operation frequency vector, a second operation type vector, and a second operation account association vector; the selecting, from the historical data segments corresponding to the first feature vector, a first preset number of the historical data segments as the candidate historical data segments includes: respectively determining a first similarity between the first operation frequency vector and the second operation frequency vector, a second similarity between the first operation type vector and the second operation type vector, and a third similarity between the first operation account association vector and the second operation account association vector; Determining a target similarity between the historical data segment and the data segment to be queried according to the first similarity, the second similarity, and the third similarity; The first preset number of the historical data segments are selected as the candidate historical data segments in descending order of the target similarities.

4. The method according to claim 1, characterized in that Determining a causal association graph according to the operation type and operation account characteristics of each candidate historical data segment and the operation type and operation account characteristics of an associated historical data segment associated with the candidate historical data segment includes: Constructing a sub-causal association graph corresponding to each candidate historical data segment according to the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of the associated historical data segment associated with the candidate historical data segment; The sub-causal association graphs corresponding to the candidate historical data segments are merged to obtain the causal association graph.

5. The method according to claim 4, characterized in that The constructing a sub-causal association graph corresponding to each candidate historical data segment according to the operation type and operation account characteristics of each candidate historical data segment and the operation type and operation account characteristics of the associated historical data segment associated with the candidate historical data segment includes: Determining a first association strength between the candidate historical data segment and the associated historical data segment according to the operation type of the candidate historical data segment and the operation type of the associated historical data segment; determining a second association strength between the candidate historical data segment and the associated historical data segment according to the operation account characteristics of the candidate historical data segment and the operation account characteristics of the associated historical data segment; Determining an edge weight of the sub-causal association graph according to the first association strength and the second association strength; The sub-causal association graph is constructed based on each operation event in the candidate historical data segment or the associated historical data segment and the edge weight.

6. The method according to claim 1, characterized in that The step of querying a target causal path that meets a preset condition from the causal association graph includes: From the causal association graph, query candidate causal paths with each operation event of the candidate historical data segment as a query start point and a query end point; Determining the sum of the weights of the candidate causal paths according to the weights of the edges of the candidate causal paths; The candidate causal path with the largest sum of weights is determined as the target causal path.

7. The method according to claim 1, characterized in that: The obtaining of historical operation data includes: Determine the sampling probability of the sampled data according to the operation frequency, operation type weight, operation account weight, and sampling function of the sampled data; A second preset number of the sampled data whose sampling probability is greater than a preset probability threshold is extracted from the sampled data as the historical operation data.

8. The method according to claim 1, characterized in that After acquiring the historical operation data, the method further includes: Performing hash processing on the historical operation data and the attribute information of the historical operation data to obtain a leaf node corresponding to the historical operation data; Constructing a first hash tree according to leaf nodes corresponding to each of the historical operation data and determining a first root node of the first hash tree; The first root node is stored in the blockchain.

9. The method according to claim 8, characterized in that After storing the first root node in the blockchain, the method further includes: Obtaining the constructed first hash tree and determining a second root node of the first hash tree; Compare the second root node with the first root node to obtain a comparison result; When the comparison result is that the second root node is consistent with the first root node, the comparison record is stored in the blockchain; wherein the comparison record includes the comparison result and a timestamp corresponding to the comparison result.

10. The method according to claim 9, characterized in that When the comparison result is that the second root node is inconsistent with the first root node, the method further includes: For the abnormal historical operation data, obtaining copy data of the normal historical operation data corresponding to the abnormal historical operation data; Replace the abnormal historical operation data in the historical operation data with the copy data, construct a second hash tree and determine a third root node of the second hash tree; The first root node is updated to the third root node.

11. The method according to claim 1, characterized in that: After acquiring the historical operation data, the method further includes: For the operation account corresponding to the historical operation data, encrypt the attribute information of the operation account according to the attribute public key corresponding to the operation account to obtain first encrypted data; The first encrypted data is encrypted according to the account public key corresponding to the operation account to obtain second encrypted data.

12. The method according to claim 11, characterized in that After encrypting the first encrypted data according to the account public key corresponding to the operation account to obtain the second encrypted data, the method further includes: Dividing the second encrypted data into a third preset number of data fragments according to a preset mathematical model; The third preset data slices are stored in third preset storage nodes respectively.

13. The method according to claim 11, characterized in that The method further comprises: Generate an authorization token; wherein the authorization token is used to instruct the operating account to authorize the shared operating account to read the attribute information; the authorization token includes the attribute information and access conditions; Sign the authorization token according to the account private key corresponding to the operation account to obtain a signed authorization token; Blind the authorization token according to the account private key corresponding to the operation account to be shared, to obtain a blinded authorization token; Generate a zero-knowledge proof based on the signed authorization token, the blinded authorization token, the account public key corresponding to the operation account to be shared, and the account private key corresponding to the operation account to be shared; wherein the zero-knowledge proof is used to prove that the operation account authorizes the operation account to be shared to read the attribute information; According to the zero-knowledge proof, the account to be shared is authorized to read the attribute information.

14. The method according to claim 13, characterized in that After authorizing the to-be-shared operation account to read the attribute information according to the zero-knowledge proof, the method further includes: Decrypting the second encrypted data according to the account private key corresponding to the to-be-shared operation account to obtain encrypted attribute information; The attribute private key ciphertext is decrypted according to the account private key corresponding to the operation account to be shared, so as to obtain the attribute private key corresponding to the attribute information; wherein the attribute private key ciphertext is obtained by encrypting the attribute private key corresponding to the attribute information according to the preset public key corresponding to the operation account; The encrypted attribute information is decrypted according to the attribute private key corresponding to the attribute information to obtain the attribute information.

15. A data query device, characterized in that: include: The acquisition module is used to obtain historical operation data and operation data to be queried; A first determination module, configured to determine a candidate historical data segment matching each of the data segments to be queried based on the multiple historical data segments corresponding to the historical operation data and the multiple data segments to be queried corresponding to the operation data to be queried; A second determination module is used to determine a causal association graph according to the operation type and operation account characteristics of each candidate historical data segment, and the operation type and operation account characteristics of an associated historical data segment associated with the candidate historical data segment; wherein the nodes of the causal association graph are used to represent each operation event in the candidate historical data segment or the associated historical data segment, and the edges of the causal association graph are used to represent the causal association relationship between the operation events; A query module is used to query a target causal path that meets preset conditions from the causal association graph; wherein the target causal path includes multiple target operation events.

16. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the data query method as described in any one of claims 1 to 14.

17. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the data query method according to any one of claims 1 to 14 are implemented.

18. A computer program product, characterized in that The computer program product comprises a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises a program or instructions, and when the program or instructions are executed, the steps of the data query method according to any one of claims 1 to 14 are implemented.

Images