A detection method and system for parasitic chains in IOTA network

Abstract

The invention discloses a detection method and system for parasitic chains in an IOTA network, belonging to the field of decentralized security technology of the Internet of Things. The method comprises: randomly generating a first IOTA network structure, encoding it, and obtaining a first node label, a first adjacency matrix and a first node feature matrix of each node; improving and optimizing an original GCN model, and training the improved GCN model by using the first node label, the first adjacency matrix and the first node feature matrix to obtain an initial detection model; randomly generating a second IOTA network structure, and extracting a second node label, a second adjacency matrix and a second node feature matrix therefrom; inputting the second adjacency matrix and the second node feature matrix into the initial detection model to obtain a label prediction result, and then comparing and evaluating the label prediction result with the second node label to obtain a parasitic chain detection model; and performing detection by using the parasitic chain detection model.

Description

Technical Field

[0001] The present invention belongs to the technical field of decentralized security of the Internet of Things, and in particular relates to a detection method and system for parasitic chains in an IOTA network. Background Art

[0002] Since most of the existing detection or prevention methods in the IOTA network will affect the normal development of the network, it is crucial to prevent parasitic chain attacks without affecting the development of the network.

[0003] In 2020, Andreas Penzkofer et al. classified parasitic chains into three categories based on the random shapes and characteristics of different parasitic chains, and analyzed their different characteristics and the effectiveness of attacks. P. Ferraro et al. proposed the structure of a k-order parasitic chain and analyzed its structure and the probability of attack success. Ma Hongchao proposed a method to improve the security of the IOTA network at various stages by adjusting the parameter size of the walker in the MCMC algorithm, but this would affect the normal development of the initial network. Y. Chen introduced a method to split a large transaction price into multiple smaller transaction prices to combat IOTA parasitic chain attacks, effectively preventing small-scale, low-cost parasitic chain attacks. However, for attackers with high computing power or willing to invest high costs, they can still attack the IOTA network by publishing a large number of large transactions. Miri A et al. proposed a scoring function-based method to detect specific types of parasitic chains, identifying the existence of parasitic chains by evaluating the importance of transactions in the IOTA network and monitoring the changes in the first-order and second-order derivatives of the scoring function. However, this method is limited to detecting fixed types of parasitic chain structures, and has limited effect on the diverse parasitic chain forms in practice.

[0004] The above research shows that most of the existing methods for resisting parasitic chain attacks are methods of modifying network operation rules by changing the tips selection algorithm of walkers, adjusting algorithm parameters, or modifying the transaction publishing method. Although these methods can reduce the occurrence of parasitic chain attacks to a certain extent, they also bring potential impacts on the normal operation of the network. In addition, attackers can design new attack methods based on the modified network rules to further improve the success rate of the attack. Once the attack is successful, it is difficult for existing methods to detect and identify parasitic chain transactions that sneak into the network in a timely manner, thereby failing to effectively ensure the security of transactions. The present invention provides a new solution to these challenges. Summary of the invention

[0005] The present invention aims to solve the deficiencies of the prior art and provides the following solutions:

[0006] A method for detecting parasitic chains in an IOTA network comprises the following steps:

[0007] Randomly generate a first IOTA network structure, and encode the first IOTA network structure to obtain a first node label, a first adjacency matrix, and a first node feature matrix of each node in the network structure;

[0008] Improving and optimizing the original GCN model to obtain an improved GCN model, and training the improved GCN model using the first node labels, the first adjacency matrix, and the first node feature matrix to obtain an initial detection model;

[0009] Randomly generate a second IOTA network structure, and extract a second node label, a second adjacency matrix, and a second node feature matrix of each node in the second IOTA network structure;

[0010] Inputting the second adjacency matrix and the second node feature matrix into the initial detection model to obtain a label prediction result, then comparing and evaluating the label prediction result with the second node label, and adjusting the parameters of the initial detection model according to the evaluation result to obtain a parasitic chain detection model;

[0011] The parasitic chain detection model is used to detect the parasitic chain in the IOTA network to obtain the detection result.

[0012] Preferably, the first node characteristic matrix and the second node characteristic matrix both include four characteristic values ​​of the transaction nodes: the cumulative weight of each transaction, the in-degree of each transaction, the unauthenticated transaction ID of each transaction, and the number of unauthenticated transactions of each transaction;

[0013] The cumulative weight of each transaction is used to record the cumulative weight of the transaction node in the network;

[0014] The in-degree of each transaction is used to indicate the number of predecessor nodes authenticated by the transaction node;

[0015] The unauthenticated transaction ID of each transaction is used to record the unauthenticated transaction node;

[0016] The number of unauthenticated transactions for each transaction is used to indicate the number of transactions that are not authenticated by the transaction node.

[0017] Preferably, the method for obtaining the improved GCN model includes: obtaining the improved GCN model by improving and optimizing the graph signal transmission formula of each node in the original GCN model:

[0018] In the original GCN model, the graph signal transmission formula of each node can be expressed as:

[0019] ,

[0020] in, is the representation of the transaction node at the lth layer, σ is a nonlinear activation function in GCN, is the set of neighbor nodes of the transaction node, is the degree of the transaction node, is the representation of the neighbor node at layer l, is the weight matrix of the lth layer;

[0021] In the IOTA network, except for the genesis transaction, each transaction needs to authenticate two transactions to join the network. The out-degree of each transaction is the degree of practical significance for each transaction in the IOTA network. At the same time, based on the transactions newly added to the network, the degree calculation rules in the graph signal transmission formula are improved, and the improved graph signal transmission formula is obtained:

[0022] ;

[0023] Based on the improved graph signal transfer formula, the improved GCN model is obtained.

[0024] The present invention also provides a detection system for parasitic chains in an IOTA network, wherein the detection system applies any of the above detection methods, including: a first extraction module, a model training module, a second extraction module, a model adjustment module and a detection module;

[0025] The first extraction module is used to randomly generate a first IOTA network structure, and encode the first IOTA network structure to obtain a first node label, a first adjacency matrix, and a first node feature matrix of each node in the network structure;

[0026] The model training module is used to improve and optimize the original GCN model to obtain an improved GCN model, and train the improved GCN model using the first node label, the first adjacency matrix and the first node feature matrix to obtain an initial detection model;

[0027] The second extraction module is used to randomly generate a second IOTA network structure, and extract a second node label, a second adjacency matrix, and a second node feature matrix of each node in the second IOTA network structure;

[0028] The model adjustment module is used to input the second adjacency matrix and the second node feature matrix into the initial detection model to obtain a label prediction result, then compare and evaluate the label prediction result with the second node label, and adjust the parameters of the initial detection model according to the evaluation result to obtain a parasitic chain detection model;

[0029] The detection module detects the parasitic chain in the IOTA network using the parasitic chain detection model to obtain a detection result.

[0030] Preferably, the first node characteristic matrix and the second node characteristic matrix both include four characteristic values ​​of the transaction nodes: the cumulative weight of each transaction, the in-degree of each transaction, the unauthenticated transaction ID of each transaction, and the number of unauthenticated transactions of each transaction;

[0031] The cumulative weight of each transaction is used to record the cumulative weight of the transaction node in the network;

[0032] The in-degree of each transaction is used to indicate the number of predecessor nodes authenticated by the transaction node;

[0033] The unauthenticated transaction ID of each transaction is used to record the unauthenticated transaction node;

[0034] The number of unauthenticated transactions for each transaction is used to indicate the number of transactions that are not authenticated by the transaction node.

[0035] Preferably, in the model training module, the process of obtaining the improved GCN model includes: obtaining the improved GCN model by improving and optimizing the graph signal transmission formula of each node in the original GCN model:

[0036] In the original GCN model, the graph signal transmission formula of each node can be expressed as:

[0037] ,

[0038] in, is the representation of the transaction node at the lth layer, σ is a nonlinear activation function in GCN, is the set of neighbor nodes of the transaction node, is the degree of the transaction node, is the representation of the neighbor node at layer l, is the weight matrix of the lth layer;

[0039] In the IOTA network, except for the genesis transaction, each transaction needs to authenticate two transactions to join the network. The out-degree of each transaction is the degree of practical significance for each transaction in the IOTA network. At the same time, based on the transactions newly added to the network, the degree calculation rules in the graph signal transmission formula are improved, and the improved graph signal transmission formula is obtained:

[0040] ;

[0041] Based on the improved graph signal transfer formula, the improved GCN model is obtained.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] (1) Through the hierarchical propagation mechanism of GCN, these features can effectively affect the relationship between nodes after being transmitted through the network, so that the model can more accurately learn the difference between parasitic chains and regular transactions; (2) By improving the calculation formula of the degree, the zero division error generated when the in-degree is 2 is avoided, ensuring the stability of the model when processing the IOTA transaction network. This improvement not only solves potential calculation errors, but also maintains the consistency and reliability of the model in different transaction environments; (3) By analyzing the hidden behavior patterns of the parasitic chain, the model can learn the difference between parasitic chain transactions and regular transactions in authentication selection during training. The introduction of unauthenticated transaction IDs and quantities can capture the characteristics of parasitic chain transactions in complex attacks, making the model adaptable to more covert attacks; (4) Through continuous optimization of the model, the present application can timely discover and process parasitic chain transactions while ensuring the smooth operation of regular network transactions, ensuring the normal operation and security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0045] Figure 1 A schematic diagram of a method flow of an embodiment of the present invention;

[0046] Figure 2 is a flowchart of a method according to an embodiment of the present invention;

[0047] Figure 3 Schematic diagram of a malicious node attack method according to an embodiment of the present invention, wherein (a) is a transaction that is attacked without authentication, (b) is a transaction that is attacked with authentication, and (c) is a transaction that is attacked with indirect authentication. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] Embodiment 1

[0051] In this embodiment, if Figure 1 , Figure 2 As shown, a detection method for parasitic chains in an IOTA network includes the following steps:

[0052] S1. Randomly generate a first IOTA network structure A, and encode the first IOTA network structure to obtain the first node label Label of each node in the network structure [A] , the first adjacency matrix and the first node feature matrix.

[0053] The first node feature matrix includes four feature values ​​of the transaction node: the cumulative weight cw of each transaction (vi) , the in-degree of each transaction (vi) , Unauthenticated transaction ID of each transaction: u (vi) =[u i1 ,u i2 ,...,u im ] and the number of unauthenticated transactions for each transaction μ (vi) ; The cumulative weight of each transaction is used to record the cumulative weight of the transaction node in the network; the in-degree of each transaction is used to indicate the number of predecessor nodes authenticated by the transaction node; the unauthenticated transaction ID of each transaction is used to record the unauthenticated transaction node; the unauthenticated transaction number of each transaction is used to indicate the number of transactions that are not authenticated by the transaction node.

[0054] In this embodiment, the reasons for selecting the above four eigenvalues ​​are:

[0055] 1) Cumulative weight and in-degree of each transaction: Since walkers tend to choose transactions with larger cumulative weights for authentication, in order to increase the probability of being selected by walkers, attackers will control the parasitic chain to centrally authenticate transactions with higher cumulative weights in the IOTA network. This strategy causes the in-degree and cumulative weight of the authenticated transactions to increase sharply, and a large gap with its neighboring nodes.

[0056] In the GCN model, the propagation of node attributes affects adjacent nodes. As the number of training rounds increases, this propagation effect will have a significant impact on the characteristics of other nodes. In addition, He, Peilin, and others found in their study of the IOTA network that in-degree and cumulative weight are key indicators for evaluating network health and robustness, and can be used to distinguish between regular transactions and malicious activities. Therefore, the experiment selects the in-degree and cumulative weight of the node as a characteristic value attribute to distinguish node types, which can more accurately distinguish different types of nodes and improve the performance of the model in detecting malicious activities.

[0057] 2) The ID and number of unauthenticated transactions for each transaction: In a complex parasitic chain structure, relying only on in-degree and cumulative weight as feature values ​​for model training is not enough to deal with more hidden attack modes. Through in-depth analysis of the behavioral characteristics of the parasitic chain, it is found that when the parasitic chain does not centrally authenticate a single transaction, it can make the parasitic chain more hidden. In addition, considering the limited computing power of the attacker, in order to improve the efficiency of the attack, the parasitic chain transaction will not authenticate transactions related to the attacked transaction. Figure 3 The attack method of malicious nodes in IOTA is shown. The numbers on the nodes represent the cumulative weight of each transaction. The marked nodes represent the attacked transactions. The nodes with a cumulative weight of 6 represent the transactions created by the attacker for double-spending attacks. The nodes in the circle are normal transactions created by the attacker in the parasitic chain. The remaining nodes are normal transactions. The purpose is to increase the cumulative weight of the nodes with a cumulative weight of 6 to obtain a higher probability of being selected by the walker.

[0058] Figure 3 Figure 1 is a schematic diagram of malicious node attack methods, where the numbers represent the cumulative weight of each node. Figure 3 In (a) of the above, the attacker’s published transaction did not authenticate the attacked transaction, but chose to authenticate other transactions that were unrelated to the attacked transaction, thereby increasing the weight of these unrelated transactions. This strategy has two main advantages: on the one hand, it reduces the probability of the walker selecting the attacked transaction; on the other hand, it increases the probability of the walker selecting the malicious transaction. Figure 3 In (b) and (c) of Figure 2, the transactions with a weight of 3 in the parasitic chain directly or indirectly authenticate the attacked transactions, which leads to Figure 3 The cumulative weight of the marked nodes in (b) and (c) is much larger than Figure 3 This method not only reduces the probability of successful attack, but also increases the cost of attack, which does not meet the attacker's expected goal. Therefore, the attacker will not sacrifice the originally low attack efficiency to authenticate transactions related to the attacked transaction, resulting in different preferences between parasitic chain transactions and regular transactions when selecting authentication objects. Therefore, the unauthenticated transaction ID and its number of each transaction are introduced as feature value attributes to distinguish parasitic chain nodes from regular nodes.

[0059] S2. Improve and optimize the original GCN model to obtain an improved GCN model, and use the first node label, the first adjacency matrix and the first node feature matrix to train the improved GCN model to obtain an initial detection model.

[0060] The method for obtaining the improved GCN model includes: obtaining the improved GCN model by improving and optimizing the graph signal transmission formula of each node in the original GCN model:

[0061] In the original GCN model, the graph signal transmission formula of each node can be expressed as:

[0062] ,

[0063] in, is the representation of the transaction node at the lth layer, σ is a nonlinear activation function ReLU (Rectified Linear Unit) in GCN, is the set of neighbor nodes of the transaction node, is the degree of the transaction node, is the representation of the neighbor node at layer l, is the weight matrix of the lth layer;

[0064] In the IOTA network, except for the genesis transaction, each transaction needs to authenticate two transactions to join the network. The out-degree of each transaction is the degree that has practical significance for each transaction in the IOTA network. Therefore, making some changes to the degree calculation rules in the above formula can make more efficient use of the GCN model. The formula becomes:

[0065] ,

[0066] At the same time, considering the transactions newly added to the network, the operation rules in the graph signal transmission formula are improved, and the improved graph signal transmission formula is obtained as follows:

[0067] ;

[0068] Based on the improved graph signal transmission formula, the improved GCN model is obtained.

[0069] S3. Randomly generate a second IOTA network structure and extract the second node label Label of each node in the second IOTA network structure [B ] , the second adjacency matrix, and the second node feature matrix.

[0070] The eigenvalues ​​in the second node feature matrix are the same as those in the first node feature matrix.

[0071] S4. Input the second adjacency matrix and the second node feature matrix into the initial detection model to obtain a label prediction result Label [T] , and then the label prediction result Label [T] The second node is labeled [B] A comparative evaluation is performed, and parameters of the initial detection model are adjusted according to the evaluation result to obtain a parasitic chain detection model.

[0072] S5. Use the parasitic chain detection model to detect the parasitic chain in the IOTA network to obtain a detection result.

[0073] Embodiment 2

[0074] In this embodiment, a detection system for parasitic chains in an IOTA network includes: a first extraction module, a model training module, a second extraction module, a model adjustment module and a detection module.

[0075] The first extraction module is used to randomly generate a first IOTA network structure, and encode the first IOTA network structure to obtain a first node label, a first adjacency matrix, and a first node feature matrix of each node in the network structure.

[0076] The model training module is used to improve and optimize the original GCN model to obtain an improved GCN model, and train the improved GCN model using the first node label, the first adjacency matrix and the first node feature matrix to obtain an initial detection model.

[0077] The second extraction module is used to randomly generate a second IOTA network structure, and extract a second node label, a second adjacency matrix, and a second node feature matrix of each node in the second IOTA network structure;

[0078] The model adjustment module is used to input the second adjacency matrix and the second node feature matrix into the initial detection model to obtain a label prediction result, then compare and evaluate the label prediction result with the second node label, and adjust the parameters of the initial detection model according to the evaluation result to obtain a parasitic chain detection model;

[0079] The detection module uses the parasitic chain detection model to detect the parasitic chain in the IOTA network and obtain the detection results.

[0080] Furthermore, the first node feature matrix and the second node feature matrix both include four eigenvalues ​​of the transaction nodes: the cumulative weight of each transaction, the in-degree of each transaction, the unauthenticated transaction ID of each transaction, and the number of unauthenticated transactions of each transaction; the cumulative weight of each transaction is used to record the cumulative weight of the transaction node in the network; the in-degree of each transaction is used to indicate the number of predecessor nodes authenticated by the transaction node; the unauthenticated transaction ID of each transaction is used to record the unauthenticated transaction node; the number of unauthenticated transactions of each transaction is used to indicate the number of transactions unauthenticated by the transaction node.

[0081] Furthermore, in the model training module, the process of obtaining the improved GCN model includes: obtaining the improved GCN model by improving and optimizing the graph signal transmission formula of each node in the original GCN model: In the original GCN model, the graph signal transmission formula of each node can be expressed as:

[0082] ,

[0083] in, is the representation of the transaction node at the lth layer, σ is a nonlinear activation function in GCN, is the set of neighbor nodes of the transaction node, is the degree of the transaction node, is the representation of the neighbor node at layer l, is the weight matrix of the lth layer; in the IOTA network, except for the genesis transaction, each transaction needs to authenticate two transactions to join the network. The out-degree of each transaction is the degree of practical significance for each transaction in the IOTA network. At the same time, based on the transactions newly added to the network, the degree calculation rules in the graph signal transmission formula are improved, and the improved graph signal transmission formula is obtained:

[0084] ;

[0085] Based on the improved graph signal transmission formula, the improved GCN model is obtained.

[0086] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A method for detecting parasitic chains in an IOTA network, characterized in that: The following steps are involved: Randomly generate a first IOTA network structure, and encode the first IOTA network structure to obtain a first node label, a first adjacency matrix, and a first node feature matrix of each node in the network structure; Improving and optimizing the original GCN model to obtain an improved GCN model, and training the improved GCN model using the first node label, the first adjacency matrix, and the first node feature matrix to obtain an initial detection model; Randomly generate a second IOTA network structure, and extract a second node label, a second adjacency matrix, and a second node feature matrix of each node in the second IOTA network structure; Inputting the second adjacency matrix and the second node feature matrix into the initial detection model to obtain a label prediction result, then comparing and evaluating the label prediction result with the second node label, and adjusting the parameters of the initial detection model according to the evaluation result to obtain a parasitic chain detection model; Using the parasitic chain detection model to detect the parasitic chain in the IOTA network, and obtaining the detection result; The method for obtaining the improved GCN model includes: obtaining the improved GCN model by improving and optimizing the graph signal transmission formula of each node in the original GCN model: In the original GCN model, the graph signal transmission formula of each node is expressed as: ， in, is the representation of the transaction node at the lth layer, σ is a nonlinear activation function in GCN, is the set of neighbor nodes of the transaction node, is the degree of the transaction node, is the representation of the neighbor node at layer l, is the weight matrix of the lth layer; In the IOTA network, except for the genesis transaction, each transaction needs to authenticate two transactions to join the network. The out-degree of each transaction is the degree of practical significance for each transaction in the IOTA network. At the same time, based on the transactions newly added to the network, the degree calculation rules in the graph signal transmission formula are improved, and the improved graph signal transmission formula is obtained: ； Based on the improved graph signal transmission formula, the improved GCN model is obtained.

2. A method for detecting parasitic chains in an IOTA network according to claim 1, characterized in that: The first node feature matrix and the second node feature matrix both include four feature values ​​of the transaction nodes: the cumulative weight of each transaction, the in-degree of each transaction, the unauthenticated transaction ID of each transaction, and the number of unauthenticated transactions of each transaction; The cumulative weight of each transaction is used to record the cumulative weight of the transaction node in the network; The in-degree of each transaction is used to indicate the number of predecessor nodes authenticated by the transaction node; The unauthenticated transaction ID of each transaction is used to record the unauthenticated transaction node; The number of unauthenticated transactions for each transaction is used to indicate the number of transactions that are not authenticated by the transaction node.

3. A detection system for parasitic chains in an IOTA network, wherein the detection system applies the detection method according to any one of claims 1 to 2, characterized in that: include: A first extraction module, a model training module, a second extraction module, a model adjustment module and a detection module; The first extraction module is used to randomly generate a first IOTA network structure, and encode the first IOTA network structure to obtain a first node label, a first adjacency matrix, and a first node feature matrix of each node in the network structure; The model training module is used to improve and optimize the original GCN model to obtain an improved GCN model, and train the improved GCN model using the first node label, the first adjacency matrix and the first node feature matrix to obtain an initial detection model; The second extraction module is used to randomly generate a second IOTA network structure, and extract a second node label, a second adjacency matrix, and a second node feature matrix of each node in the second IOTA network structure; The model adjustment module is used to input the second adjacency matrix and the second node feature matrix into the initial detection model to obtain a label prediction result, then compare and evaluate the label prediction result with the second node label, and adjust the parameters of the initial detection model according to the evaluation result to obtain a parasitic chain detection model; The detection module detects the parasitic chain in the IOTA network using the parasitic chain detection model to obtain a detection result.

4. A detection system for parasitic chains in an IOTA network according to claim 3, characterized in that: The first node feature matrix and the second node feature matrix both include four feature values ​​of the transaction nodes: the cumulative weight of each transaction, the in-degree of each transaction, the unauthenticated transaction ID of each transaction, and the number of unauthenticated transactions of each transaction; The cumulative weight of each transaction is used to record the cumulative weight of the transaction node in the network; The in-degree of each transaction is used to indicate the number of predecessor nodes authenticated by the transaction node; The unauthenticated transaction ID of each transaction is used to record the unauthenticated transaction node; The number of unauthenticated transactions for each transaction is used to indicate the number of transactions that are not authenticated by the transaction node.

5. A detection system for parasitic chains in an IOTA network according to claim 3, characterized in that: In the model training module, the process of obtaining the improved GCN model includes: obtaining the improved GCN model by improving and optimizing the graph signal transmission formula of each node in the original GCN model: In the original GCN model, the graph signal transmission formula of each node is expressed as: ， in, is the representation of the transaction node at the lth layer, σ is a nonlinear activation function in GCN, is the set of neighbor nodes of the transaction node, is the degree of the transaction node, is the representation of the neighbor node at layer l, is the weight matrix of the lth layer; In the IOTA network, except for the genesis transaction, each transaction needs to authenticate two transactions to join the network. The out-degree of each transaction is the degree of practical significance for each transaction in the IOTA network. At the same time, based on the transactions newly added to the network, the degree calculation rules in the graph signal transmission formula are improved, and the improved graph signal transmission formula is obtained: ； Based on the improved graph signal transfer formula, the improved GCN model is obtained.

Images