Network information security detection method, system and device based on block chain, and medium

Abstract

The invention provides a network information security detection method, system and device based on a block chain, and a medium, and the method comprises the steps: determining the traffic offset of each block chain transmission node according to all communication traffic, determining event response information through all traffic offsets, and transmitting the event response information to a server; screening all response nodes of the network emergency from the information transmission network according to the event response information; determining a logical relationship of behavior conflicts between the network emergency and the communication behavior mode according to all the communication event records, and performing risk assessment on information threats in the network emergency based on the logical relationship of the behavior conflicts to obtain an information risk index; and carrying out risk mapping on the network information security of the network emergency through the information risk index to obtain an early warning risk level of the network emergency in the information transmission network. Based on the scheme, dynamic safety early warning of network emergencies in the information transmission network can be realized, so that the event response efficiency of the information transmission network can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology. More specifically, the present application relates to a network information security detection method, system, device and medium based on blockchain. Background Art

[0002] As a decentralized distributed ledger system, blockchain is highly secure and transparent and is widely used in finance, supply chain, medical and other fields. In terms of blockchain's network information security, blockchain provides strong protection for information transmission through its unique consensus mechanism, encryption algorithm and data immutability. Specifically, blockchain protects data integrity and privacy through encrypted hash functions, ensuring that the generation and linking of each block complies with predetermined rules to prevent tampering and forgery.

[0003] In blockchain, traditional network information security detection relies on historical data and fixed rules for detection, and relies on manual monitoring responses and preset static rules and patterns. It is impossible to adjust detection strategies in real time or respond to new attacks. It is difficult to achieve automatic identification and early warning of sudden security incidents, resulting in failure to detect or respond to attacks in a timely manner. When the network environment changes or unknown attack types appear, the existing system often lacks flexibility, resulting in failure to detect or respond to attacks in a timely manner. Therefore, how to achieve dynamic security early warning of network emergencies in information transmission networks, thereby improving the event response efficiency of information transmission networks, is a difficult problem faced by the industry. Summary of the invention

[0004] The present application provides a blockchain-based network information security detection method, system, device and medium, which can realize dynamic security early warning of network emergencies in information transmission networks, thereby improving the event response efficiency of information transmission networks.

[0005] In a first aspect, the present application provides a network information security detection method based on blockchain, comprising: Construct a blockchain security detection network in the information transmission network to monitor network emergencies in the information transmission network. When network emergencies trigger basic warning rules, use each probe node in the blockchain security detection network to collect the communication traffic of network emergencies. Determine the flow offset of each blockchain transmission node in the information transmission network according to all communication flows, determine the event response information of the information transmission network to the network emergency through all flow offsets and the baseline flow of the blockchain in the blockchain security detection network, and then filter out all the response nodes of the network emergency from the information transmission network according to the event response information; Obtain the communication event records of each response node in the information transmission network, determine the logical relationship of the behavior conflict between the network emergency and the communication behavior pattern based on all the communication event records and the off-chain attack characteristics of the network emergency, and conduct a risk assessment of the information threat in the network emergency based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict to obtain the information risk index of the network emergency; The information risk index is used to perform risk mapping on the network information security of network emergencies, and the early warning risk level of network emergencies in the information transmission network is obtained.

[0006] In some embodiments, determining the traffic offset of each blockchain transmission node in the information transmission network based on all communication traffic specifically includes: For each blockchain transmission node in the information transmission network, obtain the intra-chain communication traffic of the blockchain transmission node; Filter the probe communication traffic of blockchain transmission nodes from all communication traffic; The traffic offset of the blockchain transmission node is determined according to the intra-chain communication traffic and the probe communication traffic, and then the traffic offset of each blockchain transmission node in the information transmission network is obtained.

[0007] In some embodiments, the event response information of the information transmission network to the network emergency is determined by all the traffic offsets and the baseline traffic of the blockchain in the blockchain security detection network, specifically including: Obtain the baseline traffic of blockchain in the blockchain security detection network; Performing event comparison on the communication behavior in the information transmission network according to the baseline traffic of the blockchain and the traffic offset of each blockchain transmission node to obtain the event response value of each blockchain transmission node; The event response information of the information transmission network to the network emergency is determined according to all the event response values.

[0008] In some embodiments, filtering out all response nodes of the network emergency event from the information transmission network by the event response information specifically includes: Obtain response thresholds for network emergencies; The blockchain transmission node corresponding to the event response value greater than the response threshold in the event response information is taken as the response node, and all the response nodes are obtained.

[0009] In some embodiments, determining the logical relationship of the behavior conflict between the network emergency event and the communication behavior pattern based on all communication event records and the off-chain attack characteristics of the network emergency event specifically includes: Determine the abnormal conflict characteristics of network emergencies based on all communication event records; Through the off-chain attack characteristics of network emergencies, the communication behavior patterns of network emergencies are compared to obtain the attack behavior characteristics of the communication behavior patterns; The behavior relationship between the network emergency event and the communication behavior pattern is logically associated according to the abnormal conflict characteristics and the attack behavior characteristics, so as to obtain the logical relationship of the behavior conflict between the network emergency event and the communication behavior pattern.

[0010] In some embodiments, based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict, the information threat in the network emergency is evaluated, and the information risk index of the network emergency is obtained, which specifically includes: Based on the pattern recognition algorithm, the information threat in the network emergency is preliminarily evaluated to obtain the information threat value of the network emergency; Determine the logical deviation value of the information threat in the network emergency through the logical relationship of the behavior conflict; An information risk index of a network emergency is determined according to the information threat value and the logic deviation value.

[0011] In some embodiments, the blockchain security detection network is a decentralized security monitoring network composed of multiple blockchain nodes.

[0012] In the second aspect, the present application provides a network information security detection system based on blockchain, comprising: The monitoring and collection module is used to build a blockchain security detection network in the information transmission network, monitor network emergencies in the information transmission network, and use each probe node in the blockchain security detection network to collect the communication traffic of network emergencies when the network emergencies trigger the basic early warning rules; A processing module is used to determine the flow offset of each blockchain transmission node in the information transmission network according to all communication flows, determine the event response information of the information transmission network to the network emergency through all flow offsets and the baseline flow of the blockchain in the blockchain security detection network, and then filter out all response nodes of the network emergency from the information transmission network according to the event response information; The processing module is also used to obtain the communication event records of each response node in the information transmission network, determine the logical relationship of the behavior conflict between the network emergency and the communication behavior pattern based on all the communication event records and the off-chain attack characteristics of the network emergency, and conduct risk assessment on the information threat in the network emergency based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict to obtain the information risk index of the network emergency; The execution module is used to perform risk mapping on the network information security of network emergencies through the information risk index to obtain the early warning risk level of the network emergencies in the information transmission network.

[0013] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the above-mentioned blockchain-based network information security detection method.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium, which stores instructions or codes. When the instructions or codes are run on a computer, the computer implements the above-mentioned blockchain-based network information security detection method when executed.

[0015] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects: In a blockchain-based network information security detection method, system, device and medium provided by the present application, a blockchain security detection network is constructed in the information transmission network to monitor network emergencies in the information transmission network. When the network emergencies trigger the basic early warning rules, the communication traffic of the network emergencies is collected using each probe node in the blockchain security detection network; the traffic offset of each blockchain transmission node in the information transmission network is determined according to all the communication traffic, and the event response information of the information transmission network to the network emergencies is determined by all the traffic offsets and the baseline traffic of the blockchain in the blockchain security detection network, and then all the response nodes of the network emergencies are screened out from the information transmission network by the event response information; the communication event records of each response node in the information transmission network are obtained, and the logical relationship of the behavior conflict between the network emergencies and the communication behavior patterns is determined according to all the communication event records and the off-chain attack characteristics of the network emergencies, and the information threat in the network emergencies is risk assessed based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict to obtain the information risk index of the network emergencies; the network information security of the network emergencies is risk mapped by the information risk index to obtain the early warning risk level of the network emergencies in the information transmission network.

[0016] It can be seen that in this application, the network information security of network emergencies is risk mapped through information risk indicators to obtain the early warning risk level of network emergencies in the information transmission network; first, the response node is determined to obtain the blockchain node that responds quickly to the network emergency, thereby reflecting the propagation path and impact range of the network emergency. By quickly identifying the response node, the central control console of the information transmission network can understand the dynamic changes of network emergencies in real time, enhance the timeliness and accuracy of event processing, ensure that network information security is not affected by emergencies, and minimize the damage to the information transmission network by potential threats, thereby improving the overall security and stability of the network; then, the information risk indicator is determined to obtain the quantitative value of the potential risk of network emergencies to network security. By comprehensively considering the communication events, the information transmission network can be quickly identified and the network information security can be effectively protected. The logical relationship between the event record, off-chain attack characteristics and behavioral conflicts is used to assign a quantitative risk value to each type of network event, which can clearly indicate the severity and potential impact of the event. When a network emergency occurs, the information risk indicator provides a clear judgment standard for the security management system, which helps the central console of the information transmission network to identify and respond to security threats, and then facilitates real-time evaluation and dynamic mapping of information risks. The central console of the information transmission network can provide real-time warnings for network management personnel, thereby effectively preventing further damage to the information transmission network, ensuring the efficient response capability and security of the information transmission network in the face of emergencies, and improving the efficiency of network event response. In summary, based on the above scheme, dynamic security warnings for network emergencies in the information transmission network can be realized, thereby improving the event response efficiency of the information transmission network. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0018] Figure 1 is an exemplary flow chart of a blockchain-based network information security detection method according to some embodiments of the present application; Figure 2 It is a cross-chain interaction logic diagram of the blockchain shown in some embodiments of the present application; Figure 3 is a schematic diagram of a process for determining information risk indicators according to some embodiments of the present application; Figure 4 It is a structural diagram of a network information security detection system based on blockchain according to some embodiments of the present application; Figure 5It is a structural diagram of a computer device for implementing a blockchain-based network information security detection method as shown in some embodiments of the present application. DETAILED DESCRIPTION

[0019] In order to better understand the technical solution of the present application, the technical solution of the present application will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0020] refer to Figure 1 , which is an exemplary flow chart of a network information security detection method based on blockchain according to some embodiments of the present application. The network information security detection method based on blockchain mainly includes the following steps: In step 101, a blockchain security detection network is constructed in the information transmission network to monitor network emergencies in the information transmission network. When a network emergency triggers a basic warning rule, each probe node in the blockchain security detection network is used to collect the communication traffic of the network emergency.

[0021] It should be noted that in the present application, communication traffic refers to the transmission information between each blockchain transmission node in the information transmission network, and the communication traffic includes data volume, data packet size and transmission delay; network emergencies refer to abnormal behaviors caused by failures, attacks or other external factors in the information transmission network; information transmission network refers to the network for data transmission between blockchain transmission nodes in the blockchain, and the blockchain security detection network is a decentralized security monitoring network composed of multiple blockchain nodes, wherein the blockchain nodes include regular nodes and probe nodes, and the probe nodes are blockchain nodes used to collect and transmit network communication traffic information; basic warning rules are rules used to determine whether network emergencies meet the warning standards, and the basic warning rules can be preset on the blockchain console of the information transmission network in combination with network traffic models, attack pattern recognition and anomaly detection algorithms.

[0022] In specific implementation, regular nodes and probe nodes are arranged in the information transmission network to ensure that the communication traffic of each network node can be monitored and recorded in real time. Specifically, the probe node, as a distributed monitoring device, is responsible for collecting communication traffic data from the network transmission link. Once the probe node captures abnormal traffic or abnormal network behavior, the blockchain console of the information transmission network determines whether the event meets the characteristics of an emergency based on the preset basic warning rules (such as traffic anomalies, behavioral deviations, etc.). When a network emergency triggers the basic warning rules, the blockchain console of the information transmission network will collect the communication traffic it monitors from all relevant probe nodes.

[0023] In some embodiments, reference Figure 2As described, the figure is a cross-chain interaction logic diagram of the blockchain shown in some embodiments of the present application. The figure describes in detail the logical structure of the cross-chain interaction of the blockchain. The figure shows a cross-chain platform, which acts as a central hub to enable different blockchain networks to achieve interoperability. Specifically, the figure contains two main blockchain networks: chain A and chain B, each chain is composed of multiple blocks (from block 1 to block N). On the left side of the cross-chain platform, chain A and chain B interact through the cross-chain platform. The dotted arrow in the figure indicates that chain A and chain B do not interact directly, but use the cross-chain platform as an intermediary. The intermediary of the cross-chain platform helps to maintain the independence and security of each chain, while allowing cross-chain blocks to communicate when needed.

[0024] Inside the cross-chain platform, the blocks of chain A and chain B can interact directly, as indicated by the solid arrows. The cross-chain platform provides a mechanism that enables blocks on different chains to directly exchange information or assets. In addition, the figure introduces a "third-party" component, which is located at the center of the cross-chain platform and is connected to both chain A and chain B. This third-party component may represent an additional service or protocol, which provides another way for chain A and chain B to interact, increasing the flexibility and scalability of the system.

[0025] Finally, blockchain cross-chain interaction also supports multi-chain interaction with more blockchain networks (chain 1 to chain N). Multi-chain interaction is represented by the solid arrows at the bottom of the figure, showing that the cross-chain platform can establish connections with multiple different blockchain networks to form a broad, interconnected blockchain ecosystem. Overall, the figure shows a complex, multi-level cross-chain interaction system, which realizes interoperability between different blockchain networks through the cross-chain platform, providing a broader space for the application of blockchain technology.

[0026] In step 102, the traffic offset of each blockchain transmission node in the information transmission network is determined based on all communication traffic, and the event response information of the information transmission network to the network emergency is determined by all traffic offsets and the baseline traffic of the blockchain in the blockchain security detection network, and then all response nodes of the network emergency are filtered out from the information transmission network by the event response information.

[0027] In some embodiments, determining the traffic offset of each blockchain transmission node in the information transmission network based on all communication traffic can be implemented by the following steps: For each blockchain transmission node in the information transmission network, obtain the intra-chain communication traffic of the blockchain transmission node; Filter the probe communication traffic of blockchain transmission nodes from all communication traffic; The traffic offset of the blockchain transmission node is determined according to the intra-chain communication traffic and the probe communication traffic, and then the traffic offset of each blockchain transmission node in the information transmission network is obtained.

[0028] It should be noted that, in the present application, the traffic offset refers to the difference between the actual communication traffic of the blockchain transmission node and the benchmark traffic collected by the probe node; in specific implementation, first, for each blockchain transmission node in the information transmission network, the intra-chain communication traffic of the blockchain transmission node can be obtained from the blockchain console of the information transmission network, wherein the intra-chain communication traffic refers to the communication traffic carried by the blockchain transmission node; then, the set of all communication traffic involving the blockchain transmission node is screened out from all communication traffic as the probe communication traffic, wherein the probe communication traffic refers to the network traffic of the probe node in the blockchain security detection network; finally, the absolute value of the difference between the mean of all communication traffic in the probe communication traffic and the intra-chain communication traffic can be used as the traffic offset of the blockchain transmission node. The traffic offset of each blockchain transmission node in the information transmission network can be obtained in the above manner.

[0029] In some embodiments, the following steps may be used to determine the event response information of the information transmission network to the network emergency event through all the traffic offsets and the baseline traffic of the blockchain in the blockchain security detection network: Obtain the baseline traffic of blockchain in the blockchain security detection network; Performing event comparison on the communication behavior in the information transmission network according to the baseline traffic of the blockchain and the traffic offset of each blockchain transmission node to obtain the event response value of each blockchain transmission node; The event response information of the information transmission network to the network emergency is determined according to all the event response values.

[0030] It should be noted that in this application, event response information is an indicator to measure the severity of network emergencies; the baseline traffic of the blockchain refers to the standard traffic value of each blockchain transmission node in the information transmission network under normal working conditions; the event response value is used to reflect the impact of network emergencies on each blockchain transmission node. The larger the event response value, the greater the traffic deviation of the blockchain transmission node, and the greater the impact of the blockchain transmission node on the network emergency.

[0031] In the specific implementation, first, the network transmission traffic in the blockchain security detection network under normal operating conditions can be collected for a long time through network traffic monitoring tools (for example: NetFlow), and the average of all network transmission traffic can be used as the baseline traffic of the blockchain in the blockchain security detection network; then, for each blockchain transmission node, the ratio of the traffic offset of the blockchain transmission node to the baseline traffic of the blockchain can be used as the event response value of the blockchain transmission node, and the event response value of each blockchain transmission node can be obtained through the above method; finally, the collection of all event response values ​​can be used as the event response information of the information transmission network to network emergencies.

[0032] In some embodiments, filtering out all response nodes of the network emergency event from the information transmission network using the event response information can be implemented by the following steps: Obtain response thresholds for network emergencies; The blockchain transmission node corresponding to the event response value greater than the response threshold in the event response information is taken as the response node, and all the response nodes are obtained.

[0033] It should be noted that, in the present application, the response node refers to a node that is significantly affected by a network emergency; in specific implementation, first, the response threshold of the network emergency can be obtained from the central control console of the information transmission network. In order to ensure the reasonable adaptability of the response threshold, in other embodiments, the response threshold of the network emergency can be adjusted by dynamically combining the historical traffic data in the information transmission network and the standard deviation of the network traffic through a machine learning algorithm. There is no limitation here. The response threshold is used to determine whether the response value of the blockchain transmission node deviates from the normal range; then, the blockchain transmission node corresponding to the event response value greater than the response threshold in the event response information is used as the response node, and all response nodes of the network emergency can be obtained.

[0034] In step 103, the communication event records of each response node in the information transmission network are obtained, and the logical relationship of the behavior conflict between the network emergency and the communication behavior pattern is determined based on all the communication event records and the off-chain attack characteristics of the network emergency. Based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict, a risk assessment of the information threat in the network emergency is performed to obtain the information risk index of the network emergency.

[0035] It should be noted that, in the present application, communication event records refer to the historical records of all communication activities in which the response nodes in the information transmission network participate; in specific implementation, the communication event records of each response node within a specified time period (the default is the last 1 month) can be obtained from the central control database of the information transmission network.

[0036] In some embodiments, determining the logical relationship of the behavior conflict between the network emergency event and the communication behavior pattern based on all communication event records and the off-chain attack characteristics of the network emergency event can be implemented by the following steps: Determine the abnormal conflict characteristics of network emergencies based on all communication event records; Through the off-chain attack characteristics of network emergencies, the communication behavior patterns of network emergencies are compared to obtain the attack behavior characteristics of the communication behavior patterns; The behavior relationship between the network emergency event and the communication behavior pattern is logically associated according to the abnormal conflict characteristics and the attack behavior characteristics, so as to obtain the logical relationship of the behavior conflict between the network emergency event and the communication behavior pattern.

[0037] It should be noted that, in the present application, the logical relationship of behavioral conflict represents the causal correlation between the behavioral conflict between the communication behavior pattern and the network emergency; the abnormal conflict feature refers to the feature that is inconsistent with the normal communication behavior caused by the network emergency; the off-chain attack feature refers to those attack behavior features that can be detected from angles other than the network layer, and the off-chain attack features can be obtained from the attack database in the external monitoring system, and the attack behavior features are used to identify the behavioral features in the communication behavior pattern that have an impact on the network emergency.

[0038] In specific implementation, first, an anomaly detection algorithm (for example, Z-score) can be used to identify abnormal behaviors that deviate from normal communication patterns from all communication event records, and then a feature extraction algorithm can be used to extract the features of the abnormal behaviors as abnormal conflict features of network emergencies, where typical abnormal behaviors include traffic surges, abnormal connection frequencies, and packet losses; then, a neural network-based contrastive learning model is initialized, and the off-chain attack features are used as input features in the contrastive learning model, and the communication behavior patterns of network emergencies are used as output patterns in the contrastive learning model. The contrastive learning model is used to compare attack patterns, and the results of the attack pattern comparison can be used as attack behavior features of the communication behavior patterns; finally, the abnormal conflict features and attack behavior features can be associated and combined through logical association technology (for example, logistic regression analysis algorithm), so as to identify the causal correlation of conflicting behaviors between network emergencies and communication behavior patterns, and the identified causal correlation can be used as the logical relationship of the behavioral conflict between network emergencies and communication behavior patterns.

[0039] In some embodiments, based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict, the information threat in the network emergency is evaluated to obtain the information risk index of the network emergency, and the information risk index of the network emergency is obtained. Figure 3The figure is a schematic diagram of the process of determining information risk indicators in some embodiments of the present application. In this embodiment, determining the information risk indicator can be achieved by using the following steps: In step 1031, a preliminary assessment is performed on the information threat in the network emergency based on a pattern recognition algorithm to obtain an information threat value of the network emergency; In step 1032, a logical deviation value of information threat in a network emergency is determined through the logical relationship of the behavior conflict; In step 1033, the information risk index of the network emergency is determined according to the information threat value and the logical deviation value.

[0040] It should be noted that in this application, the information risk index refers to the quantitative value of the potential risk of network emergencies to network security; the information threat value indicates the degree of threat posed by network emergencies to network security in information transmission networks; and the logical deviation value indicates the degree of difference between the behavior pattern in network emergencies and the normal behavior pattern.

[0041] In the specific implementation, first, a simulation environment for network emergencies is constructed based on a pattern recognition algorithm, and the simulation environment is used to perform a large number of simulations on the event responses of network emergencies to obtain the information risk value after each simulation. The average of all information risk values ​​can be used as the information threat value of the network emergency; then, the Bayesian reasoning probability model can be used to quantify the deviation effect of the logical relationship of the behavioral conflict on the information threat in the network emergency, and the quantified value of the deviation effect of the Bayesian reasoning probability model can be used as the logical deviation value of the information threat in the network emergency; finally, the product of the information threat value and the logical deviation value can be used as the information risk indicator of the network emergency.

[0042] It should be noted that when using the Bayesian reasoning probability model to quantify information threats, the Bayesian reasoning probability model can update the posterior probability by combining the prior probability, likelihood probability and observed communication behavior data, thereby quantifying the threat level of network emergencies. First, the prior probability is defined based on the historical data of normal communication patterns and abnormal events, and then the likelihood probability of newly observed abnormal behaviors (such as traffic surges, abnormal connections, etc.) is calculated. The posterior probability is updated through the Bayesian theorem to obtain the possibility of the event, thereby quantifying the logical deviation value of the information threat.

[0043] In step 104, risk mapping of network information security of network emergencies is performed using the information risk index to obtain a warning risk level of the network emergencies in the information transmission network.

[0044] In some embodiments, risk mapping of network information security of network emergencies is performed through the information risk indicators to obtain a warning risk level of network emergencies in the information transmission network. This can be achieved in the following way, namely: a risk level mapping table can be obtained from the central control console of the information transmission network, thereby obtaining the risk level of the information risk indicator in the risk level mapping table as the warning risk level of the network emergency in the information transmission network.

[0045] It should be noted that in the present application, the warning risk level is a level that characterizes the degree of threat posed by network emergencies to information transmission networks; the risk level mapping table is a data table that normalizes the relationship between information risk indicators of network emergencies and predetermined risk levels. The risk level mapping table classifies and maps the threat levels of events based on different risk assessment methods.

[0046] In the present application, firstly, the network information security of network emergencies is risk mapped through information risk indicators to obtain the early warning risk level of network emergencies in the information transmission network; firstly, the response node is determined to obtain the blockchain node that responds quickly to the network emergency, thereby reflecting the propagation path and impact range of the network emergency. By quickly identifying the response node, the central control console of the information transmission network can understand the dynamic changes of network emergencies in real time, enhance the timeliness and accuracy of event processing, ensure that network information security is not affected by emergencies, minimize the damage of potential threats to the information transmission network, and thus improve the overall security and stability of the network; then, the information risk indicator is determined to obtain the quantitative value of the potential risk of network emergencies to network security. By comprehensively considering the communication event record, the information risk index of the network emergency can be used to obtain the potential risk of network emergency to network security. The logical relationship between the recording, off-chain attack characteristics and behavioral conflicts is used to assign a quantitative risk value to each type of network event, which can clearly indicate the severity and potential impact of the event. When a network emergency occurs, the information risk indicator provides a clear judgment standard for the security management system, which helps the central console of the information transmission network to identify and respond to security threats, and then facilitates real-time evaluation and dynamic mapping of information risks. The central console of the information transmission network can provide real-time warnings for network management personnel, thereby effectively preventing further damage to the information transmission network, ensuring the efficient response capability and security of the information transmission network in the face of emergencies, and improving the efficiency of network event response. In summary, based on the above scheme, dynamic security warnings for network emergencies in the information transmission network can be realized, thereby improving the event response efficiency of the information transmission network.

[0047] In addition, in another aspect of the present application, in some embodiments, the present application provides a network information security detection system based on blockchain, referring to Figure 4, which is a schematic diagram of the structure of a network information security detection system based on blockchain according to some embodiments of the present application. The network information security detection system based on blockchain includes: a monitoring and collection module 201, a processing module 202 and an execution module 203, which are respectively described as follows: Monitoring and collection module 201. In this application, the monitoring and collection module 201 is mainly used to build a blockchain security detection network in the information transmission network, monitor network emergencies in the information transmission network, and use each probe node in the blockchain security detection network to collect the communication traffic of the network emergencies when the network emergencies trigger the basic warning rules; Processing module 202, in the present application, is used to determine the flow offset of each blockchain transmission node in the information transmission network according to all communication flows, determine the event response information of the information transmission network to the network emergency through all flow offsets and the baseline flow of the blockchain in the blockchain security detection network, and then filter out all response nodes of the network emergency from the information transmission network according to the event response information; It should be noted that the processing module 202 is also used to obtain the communication event records of each response node in the information transmission network, determine the logical relationship of the behavior conflict between the network emergency and the communication behavior pattern based on all the communication event records and the off-chain attack characteristics of the network emergency, and conduct a risk assessment on the information threat in the network emergency based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict to obtain the information risk index of the network emergency; Execution module 203, in the present application, execution module 203 is mainly used to perform risk mapping on the network information security of network emergencies through the information risk indicators, and obtain the early warning risk level of network emergencies in the information transmission network.

[0048] The above describes in detail the examples of the network information security detection method, system, device and medium based on blockchain provided by the embodiments of the present application. It can be understood that the corresponding device includes a hardware structure and / or software module corresponding to each function in order to realize the above functions. It should be easily appreciated by those skilled in the art that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0049] In some embodiments, the present application also provides a computer device, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the above-mentioned blockchain-based network information security detection method.

[0050] In some embodiments, reference Figure 5 , the dotted line in the figure indicates that the unit or module is optional. The figure is a schematic diagram of the structure of a computer device for implementing a blockchain-based network information security detection method according to an embodiment of the present application. The blockchain-based network information security detection method described in the above embodiment can be Figure 5 The computer device shown in the figure is implemented, and the computer device includes at least one processor 301, a memory 302 and at least one communication unit 305. The computer device can be a terminal device, a server or a chip.

[0051] The processor 301 may be a general-purpose processor or a special-purpose processor. For example, the processor 301 may be a central processing unit (CPU), which may be used to control the computer device, execute software programs, and process data of the software programs. The computer device may also include a communication unit 305 to implement signal input (reception) and output (transmission).

[0052] For example, the computer device may be a chip, the communication unit 305 may be an input and / or output circuit of the chip, or the communication unit 305 may be a communication interface of the chip, and the chip may be a component of a terminal device, a network device, or other devices.

[0053] For another example, the computer device may be a terminal device or a server, and the communication unit 305 may be a transceiver of the terminal device or the server, or the communication unit 305 may be a transceiver circuit of the terminal device or the server.

[0054] The computer device may include one or more memories 302, on which a program 304 is stored. The program 304 can be executed by the processor 301 to generate instructions 303, so that the processor 301 performs the method described in the above method embodiment according to the instructions 303. Optionally, data (such as a target audit model) can also be stored in the memory 302. Optionally, the processor 301 can also read the data stored in the memory 302, and the data can be stored at the same storage address as the program 304, or the data can be stored at a different storage address from the program 304.

[0055] The processor 301 and the memory 302 may be provided separately or integrated together, for example, integrated on a system on chip (SOC) of the terminal device.

[0056] It should be understood that each step of the above method embodiment can be completed by a hardware-based logic circuit or software-based instructions in the processor 301. The processor 301 can be a CPU, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, such as discrete gates, transistor logic devices, or discrete hardware components.

[0057] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0058] For example, in some embodiments, the present application also provides a computer-readable storage medium, in which instructions or codes are stored. When the instructions or codes are run on a computer, the computer implements the above-mentioned blockchain-based network information security detection method when executed.

[0059] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0060] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network information security detection method based on blockchain, characterized in that: The steps include: Construct a blockchain security detection network in the information transmission network to monitor network emergencies in the information transmission network. When network emergencies trigger basic warning rules, use each probe node in the blockchain security detection network to collect the communication traffic of network emergencies. Determine the flow offset of each blockchain transmission node in the information transmission network according to all communication flows, determine the event response information of the information transmission network to the network emergency through all flow offsets and the baseline flow of the blockchain in the blockchain security detection network, and then filter out all the response nodes of the network emergency from the information transmission network according to the event response information; Obtain the communication event records of each response node in the information transmission network, determine the logical relationship of the behavior conflict between the network emergency and the communication behavior pattern based on all the communication event records and the off-chain attack characteristics of the network emergency, and conduct a risk assessment of the information threat in the network emergency based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict to obtain the information risk index of the network emergency; The information risk index is used to perform risk mapping on the network information security of network emergencies, and the early warning risk level of network emergencies in the information transmission network is obtained.

2. The method according to claim 1, characterized in that Determining the traffic offset of each blockchain transmission node in the information transmission network based on all communication traffic specifically includes: For each blockchain transmission node in the information transmission network, obtain the intra-chain communication traffic of the blockchain transmission node; Filter the probe communication traffic of blockchain transmission nodes from all communication traffic; The traffic offset of the blockchain transmission node is determined according to the intra-chain communication traffic and the probe communication traffic, and then the traffic offset of each blockchain transmission node in the information transmission network is obtained.

3. The method according to claim 1, characterized in that The event response information of the information transmission network to network emergencies is determined through all traffic offsets and the baseline traffic of the blockchain in the blockchain security detection network, including: Obtain the baseline traffic of blockchain in the blockchain security detection network; Performing event comparison on the communication behavior in the information transmission network according to the baseline traffic of the blockchain and the traffic offset of each blockchain transmission node to obtain the event response value of each blockchain transmission node; The event response information of the information transmission network to the network emergency is determined according to all the event response values.

4. The method according to claim 1, characterized in that All response nodes of network emergencies screened out from the information transmission network by the event response information specifically include: Obtain response thresholds for network emergencies; The blockchain transmission node corresponding to the event response value greater than the response threshold in the event response information is taken as the response node, and all the response nodes are obtained.

5. The method according to claim 1, characterized in that Based on all communication event records and the off-chain attack characteristics of network emergencies, the logical relationship between the behavior conflict between network emergencies and communication behavior patterns is determined, including: Determine the abnormal conflict characteristics of network emergencies based on all communication event records; Through the off-chain attack characteristics of network emergencies, the communication behavior patterns of network emergencies are compared to obtain the attack behavior characteristics of the communication behavior patterns; The behavior relationship between the network emergency event and the communication behavior pattern is logically associated according to the abnormal conflict characteristics and the attack behavior characteristics, so as to obtain the logical relationship of the behavior conflict between the network emergency event and the communication behavior pattern.

6. The method according to claim 1, characterized in that Based on the pattern recognition algorithm and the logical relationship of the behavior conflict, the information threat in the network emergency is evaluated, and the information risk indicators of the network emergency are obtained, which specifically include: Based on the pattern recognition algorithm, the information threat in the network emergency is preliminarily evaluated to obtain the information threat value of the network emergency; Determine the logical deviation value of the information threat in the network emergency through the logical relationship of the behavior conflict; An information risk index of a network emergency is determined according to the information threat value and the logic deviation value.

7. The method according to claim 1, characterized in that The blockchain security detection network is a decentralized security monitoring network composed of multiple blockchain nodes.

8. A network information security detection system based on blockchain, characterized in that: include: The monitoring and collection module is used to build a blockchain security detection network in the information transmission network, monitor network emergencies in the information transmission network, and use each probe node in the blockchain security detection network to collect the communication traffic of network emergencies when the network emergencies trigger the basic early warning rules; A processing module is used to determine the flow offset of each blockchain transmission node in the information transmission network according to all communication flows, determine the event response information of the information transmission network to the network emergency through all flow offsets and the baseline flow of the blockchain in the blockchain security detection network, and then filter out all response nodes of the network emergency from the information transmission network according to the event response information; The processing module is also used to obtain the communication event records of each response node in the information transmission network, determine the logical relationship of the behavior conflict between the network emergency and the communication behavior pattern based on all the communication event records and the off-chain attack characteristics of the network emergency, and conduct risk assessment on the information threat in the network emergency based on the pattern recognition algorithm combined with the logical relationship of the behavior conflict to obtain the information risk index of the network emergency; The execution module is used to perform risk mapping on the network information security of network emergencies through the information risk index to obtain the early warning risk level of the network emergencies in the information transmission network.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the blockchain-based network information security detection method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions or codes, and when the instructions or codes are executed on a computer, the computer implements the blockchain-based network information security detection method as described in any one of claims 1 to 7.

Images