Mining process detection method, system and equipment, storage medium and product

Abstract

The invention provides a mining process detection method, system and device, a storage medium and a product, relates to the technical field of network security, is applied to a certification end, and comprises the following steps: obtaining the total number of host processes, and sending the total number of host processes to a third-party platform; based on the host process total number, a first proof constraint circuit is constructed, secret input is provided for the first proof constraint circuit, and the secret input is process data information of each process in the host; receiving an attestation key sent by the third-party platform, and generating a zero-knowledge attestation file by using a first attestation constraint circuit based on the attestation key and secret input; and sending the zero-knowledge proof file to a verification end. According to the method, on the premise that the system process data and the running state are not directly provided for a verification end and a third-party platform, detection of the mining process is achieved through the zero-knowledge proof file generated based on secret input, privacy and safety of user data are guaranteed, and normalization of user behaviors can be confirmed.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and specifically, to a mining process detection method, system, device, storage medium and product. Background Art

[0002] Mining is the main form of obtaining digital currency on the blockchain. Through mining nodes, one continuously consumes one's own computing power in exchange for virtual currency. However, virtual currency does not have the same legal status as legal currency and is not protected by Chinese law. All transactions or speculation related to virtual currency in China will be classified as illegal financial activities. Although all cloud providers have clearly required that cloud servers not be used for mining, there are still users who actively or passively use cloud computing power for mining. This behavior will disrupt the economic and financial order on the one hand, and on the other hand, it will also exhaust cloud computing power and other resources, bringing a bad experience to other users.

[0003] Currently, cloud providers usually use methods such as detecting processes, obtaining process names, comparing feature libraries, and traffic analysis to identify mining processes. This method requires user authorization and providing the privacy content of the tenant cloud host. Although existing detection methods can detect mining processes in cloud hosts, they all involve access to user privacy data. With the promulgation of the Data Security Law and the Personal Information Protection Law, users are more concerned about the security and confidentiality of their own privacy data, and are more sensitive to the authorization of running monitoring services, which poses a great challenge to mining detection solutions based on real-time process monitoring. Therefore, how to detect potential mining processes in cloud hosts without obtaining user privacy information has become a problem that needs to be solved urgently in this field. Summary of the invention

[0004] The embodiments of the present application provide a mining process detection method, system, device, storage medium and product, aiming to solve the problem of how to detect potential mining processes in a cloud host without obtaining user privacy information.

[0005] A first aspect of an embodiment of the present application provides a mining process detection method, which is applied to a certification end, and the method includes:

[0006] Obtaining the total number of host processes, and sending the total number of host processes to a third-party platform;

[0007] Based on the total number of host processes, construct a first proof constraint circuit, and provide a secret input to the first proof constraint circuit, wherein the secret input is process data information of each process in the host;

[0008] receiving a proof key sent by the third-party platform, and generating a zero-knowledge proof file using the first proof constraint circuit based on the proof key and the secret input;

[0009] The zero-knowledge proof document is sent to the verification end.

[0010] In an optional implementation manner, constructing a first proof constraint circuit based on the total number of host processes includes:

[0011] Based on the total number of host processes, construct a first breadboard;

[0012] Obtaining a process variable type of the host, wherein the process variable type includes at least a CPU usage rate of the process, a content usage rate of the process, and an upstream and downstream flow of the process;

[0013] The first proof constraint circuit is constructed based on the logical relationship between the multiple process variable types.

[0014] In an optional implementation, the generating a zero-knowledge proof file based on the proof key and the secret input using the first proof constraint circuit includes:

[0015] In response to the certification key, assigning values ​​to the process data information corresponding to each process variable type in the secret input to obtain assignment information, the assignment information is different from the process data information, and the process variable type at least includes a CPU usage rate occupied by the process, a content usage rate occupied by the process, and an upstream and downstream flow of the process;

[0016] Calling a certification document generation function based on the certification key;

[0017] The assignment information is processed based on the proof file generation function to obtain the zero-knowledge proof file.

[0018] A second aspect of an embodiment of the present application provides a mining process detection method, which is applied to a verification end, and the method includes:

[0019] Receive the verification key sent by the third-party platform;

[0020] Receiving a common input sent by the third-party platform, the common input including an alarm threshold corresponding to each process variable type, the process variable type including at least a CPU usage rate occupied by the process, a content usage rate occupied by the process, and an upstream and downstream flow of the process;

[0021] Receiving a zero-knowledge proof file sent by a proving end, and performing a mining process detection on a host of the proving end based on the zero-knowledge proof file, the public input, and the verification key;

[0022] When it is detected that a mining process exists on the host of the certification end, an alarm is issued.

[0023] In an optional implementation, the performing mining process detection on the host of the proving end based on the zero-knowledge proof file, the public input and the verification key includes:

[0024] Based on the common input, determining a plurality of detection conditions respectively for different process variable types;

[0025] Taking the multiple detection conditions as a judgment basis, calling a detection verification function based on the zero-knowledge proof file and the verification key, and verifying the process data information corresponding to each process variable type of the proving end;

[0026] When all detection conditions are met, a first detection result is generated, where the first detection result is used to indicate that a mining process exists on the host of the proving end;

[0027] When at least one detection condition is not met, a second detection result is generated, and the second detection result is used to indicate that there is no mining process on the host of the certification end.

[0028] A third aspect of the present application embodiment provides a mining process detection method, which is applied to a third-party platform. The method includes:

[0029] The total number of host processes sent by the receiving end;

[0030] Based on the total number of host processes, construct a second proof constraint circuit;

[0031] Based on the second proof constraint circuit, generate a proof key and a verification key corresponding to each other, and send the proof key to the proving end, and send the verification key to the verifying end;

[0032] Based on the second proof circuit, a public input is generated using an input setting function, and the public input is sent to the verification end, wherein the public input includes an alarm threshold corresponding to each process variable type, and the process variable type includes at least the CPU usage rate of the process, the content usage rate of the process, and the upstream and downstream traffic of the process.

[0033] A fourth aspect of an embodiment of the present application provides a mining process detection system, the system comprising a certification end, a verification end, and a third-party platform;

[0034] The proving end is used to obtain the total number of host processes and send the total number of host processes to the third-party platform; based on the total number of host processes, construct a first proof constraint circuit, and provide a secret input to the first proof constraint circuit, wherein the secret input is process data information of each process in the host; based on the proof key and the secret input, use the first proof constraint circuit to generate a zero-knowledge proof file and send it to the verification end;

[0035] The verification end is used to detect the mining process of the host of the proving end based on the zero-knowledge proof file, the public input and the verification key; and to perform alarm processing when it is detected that the host of the proving end has a mining process;

[0036] The third-party platform is used to construct a second proof constraint circuit based on the total number of host processes; based on the second proof constraint circuit, generate the corresponding proof key and the verification key, and send the proof key to the proof end, and send the verification key to the verification end; based on the second proof circuit, generate the public input using an input setting function, and send the public input to the verification end.

[0037] A fifth aspect of an embodiment of the present application provides a mining process detection device, which is applied to a certification end, and the device includes:

[0038] A process number acquisition module is used to acquire the total number of host processes and send the total number of host processes to a third-party platform;

[0039] A first circuit module, configured to construct a first proof constraint circuit based on the total number of host processes, and provide a secret input to the first proof constraint circuit, wherein the secret input is process data information of each process in the host;

[0040] a proof document generation module, configured to receive a proof key sent by the third-party platform, and generate a zero-knowledge proof document using the first proof constraint circuit based on the proof key and the secret input;

[0041] The proof document sending module is used to send the zero-knowledge proof document to the verification end.

[0042] In an optional implementation manner, the first circuit module includes:

[0043] A first breadboard submodule, configured to construct a first breadboard based on the total number of host processes;

[0044] A process variable type submodule, used to obtain the process variable type of the host, wherein the process variable type at least includes the CPU usage rate occupied by the process, the content usage rate occupied by the process, and the upstream and downstream traffic of the process;

[0045] The first circuit construction submodule is used to construct the first proof constraint circuit based on the logical relationship between the multiple process variable types.

[0046] In an optional implementation manner, the certification document generation module includes:

[0047] an assignment submodule, configured to assign values ​​to the process data information corresponding to each process variable type in the secret input in response to the certification key, to obtain assignment information, wherein the assignment information is different from the process data information, and the process variable type at least includes a CPU usage rate occupied by the process, a content usage rate occupied by the process, and an upstream and downstream traffic of the process;

[0048] A function calling submodule, used to call a certification file generation function based on the certification key;

[0049] The proof document generation submodule is used to process the assignment information based on the proof document generation function to obtain the zero-knowledge proof document.

[0050] A sixth aspect of an embodiment of the present application provides a mining process detection device, which is applied to a verification end, and the device includes:

[0051] A first receiving module, used to receive a verification key sent by a third-party platform;

[0052] A second receiving module is used to receive the common input sent by the third-party platform, wherein the common input includes the alarm threshold corresponding to each process variable type, and the process variable type includes at least the CPU usage rate occupied by the process, the content usage rate occupied by the process, and the uplink and downlink traffic of the process;

[0053] A detection module, configured to receive a zero-knowledge proof file sent by a proving end, and perform a mining process detection on a host of the proving end based on the zero-knowledge proof file, the public input, and the verification key;

[0054] The alarm module is used to perform alarm processing when it is detected that the host of the certification end has a mining process.

[0055] In an optional implementation, the detection module includes:

[0056] A detection condition determination submodule, for determining a plurality of detection conditions for different process variable types respectively based on the common input;

[0057] A verification submodule, configured to use the multiple detection conditions as a judgment basis, call a detection verification function based on the zero-knowledge proof file and the verification key, and verify the process data information corresponding to each process variable type of the proving end;

[0058] A first detection result submodule, configured to generate a first detection result when all detection conditions are met, wherein the first detection result is used to indicate that a mining process exists on the host of the certification end;

[0059] The second detection result submodule is used to generate a second detection result when at least one detection condition is not met, and the second detection result is used to indicate that there is no mining process on the host of the certification end.

[0060] A seventh aspect of the present application provides a mining process detection device, which is applied to a third-party platform. The device includes:

[0061] A third receiving module is used to receive the total number of host processes sent by the proving end;

[0062] A second circuit module, configured to construct a second proof constraint circuit based on the total number of host processes;

[0063] a key pair generation module, configured to generate a certification key and a verification key corresponding to each other based on the second certification constraint circuit, and send the certification key to the certification end, and send the verification key to the verification end;

[0064] A public input generation module is used to generate a public input based on the second proof circuit using an input setting function, and send the public input to the verification end, wherein the public input includes an alarm threshold corresponding to each process variable type, and the process variable type includes at least the CPU usage rate of the process, the content usage rate of the process, and the upstream and downstream traffic of the process.

[0065] An eighth aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory, wherein the processor executes the computer program to implement the steps of the mining process detection method described in any one of the first aspect of the embodiment of the present application, or the processor executes the computer program to implement the steps of the mining process detection method described in any one of the second aspect of the embodiment of the present application, or the processor executes the computer program to implement the steps of the mining process detection method described in the third aspect of the embodiment of the present application.

[0066] A ninth aspect of the embodiments of the present application provides a computer-readable storage medium having a computer program / instruction stored thereon. When the computer program / instruction is executed by a processor, the steps of the mining process detection method described in any one of the first aspect of the embodiments of the present application are implemented; or, when the computer program / instruction is executed by a processor, the steps of the mining process detection method described in any one of the second aspect of the embodiments of the present application are implemented; or, when the computer program / instruction is executed by a processor, the steps of the mining process detection method described in any one of the third aspect of the embodiments of the present application are implemented.

[0067] The tenth aspect of the embodiments of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the mining process detection method described in any one of the first aspects of the embodiments of the present application, or, when executed by a processor, implements the steps of the mining process detection method described in any one of the second aspects of the embodiments of the present application, or, when executed by a processor, implements the steps of the mining process detection method described in any one of the third aspects of the embodiments of the present application.

[0068] Beneficial effects:

[0069] The present application provides a mining process detection method, system, device, storage medium and product, which are applied to the proof end, and the method includes: obtaining the total number of host processes and sending the total number of host processes to a third-party platform; based on the total number of host processes, constructing a first proof constraint circuit, and providing a secret input to the first proof constraint circuit, wherein the secret input is the process data information of each process in the host; receiving the proof key sent by the third-party platform, and generating a zero-knowledge proof file using the first proof constraint circuit based on the proof key and the secret input; and sending the zero-knowledge proof file to the verification end. The present application generates a zero-knowledge proof file based on the secret input, and sends the zero-knowledge proof file to the verification end for detecting the mining process, thereby realizing the detection of the mining process through the zero-knowledge proof file without providing the system process data and running status to the verification end and the third-party platform, which not only ensures the privacy and security of user data, but also can confirm the standardization of user behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0071] Figure 1It is a flowchart of the execution steps of the proof end in a mining process detection method proposed in one embodiment of the present application;

[0072] Figure 2 It is a flow chart of the execution steps of the verification end in a mining process detection method proposed in an embodiment of the present application;

[0073] Figure 3 It is a flowchart of the execution steps of a third-party platform in a mining process detection method proposed in an embodiment of the present application;

[0074] Figure 4 It is a flowchart of the execution phase of a mining process detection method proposed in an embodiment of the present application;

[0075] Figure 5 This is a schematic diagram of a three-party verification process in a mining process detection method proposed in an embodiment of the present application;

[0076] Figure 6 It is a schematic diagram of an electronic device proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0077] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0078] In the drawings, the size of the constituent elements, the thickness of the layer or the area may be exaggerated for the sake of clarity. Therefore, any implementation of the present disclosure is not necessarily limited to the size shown in the drawings, and the shapes and sizes of the components in the drawings do not reflect the true proportions. In addition, the drawings schematically show ideal examples, and any implementation of the present disclosure is not limited to the shapes or values ​​shown in the drawings.

[0079] Mining is the main form of obtaining digital currency on the blockchain. Through mining nodes, one continuously consumes one's own computing power in exchange for virtual currency. However, virtual currency does not have the same legal status as legal currency and is not protected by Chinese law. All transactions or speculation related to virtual currency in China will be classified as illegal financial activities. Although all cloud providers have clearly required that cloud servers not be used for mining, there are still users who actively or passively use cloud computing power for mining. This behavior will disrupt the economic and financial order on the one hand, and on the other hand, it will also exhaust cloud computing power and other resources, bringing a bad experience to other users.

[0080] Currently, cloud providers usually use methods such as detecting processes, obtaining process names, comparing feature libraries, and traffic analysis to identify mining processes. This method requires user authorization and the provision of privacy content of tenant cloud hosts. Although existing detection methods can detect mining processes on cloud hosts, they all involve access to user privacy data. With the promulgation of the Data Security Law and the Personal Information Protection Law, users are more concerned about the security and confidentiality of their own privacy data, and are more sensitive to the authorization of operation monitoring services, which poses a great challenge to mining detection solutions based on real-time process monitoring.

[0081] In view of this, the present application embodiment proposes a mining process detection method, which is applied to the certification end. Figure 1 A flowchart of the execution steps of the proof end in a mining process detection method proposed in an embodiment of the present application is shown. Figure 1 As shown, the method comprises the following steps:

[0082] S101. Obtain the total number of host processes, and send the total number of host processes to a third-party platform.

[0083] S102: construct a first proof constraint circuit based on the total number of host processes, and provide a secret input to the first proof constraint circuit, where the secret input is process data information of each process in the host.

[0084] S103: Receive a proof key sent by the third-party platform, and generate a zero-knowledge proof file using the first proof constraint circuit based on the proof key and the secret input.

[0085] S104: Send the zero-knowledge proof file to the verification end.

[0086] In the embodiment of the present application, Figure 5 A schematic diagram of a three-party verification process in a mining process detection method proposed in an embodiment of the present application is shown. Figure 5 As shown, the proving end is a terminal to be detected whether there is a mining process, and the proving end is provided with a cloud host. By detecting the process of the cloud host, it is determined whether there is a mining process on the proving end; the verification end is a terminal used to detect whether there is a mining process on the cloud host of the proving end. Figure 5 For example, the certification end is the cloud host, and the verification end is the mining detection system.

[0087] In the embodiment of the present application, in order to ensure the privacy and security of user data, the proving end is not allowed to directly send the process data information of the cloud host to the third-party platform and the verification end. Therefore, the embodiment of the present application adopts a mining process detection method based on zero-knowledge proof. Without directly sending the process data information to the third-party platform and the verification end, it completes the detection of whether there is a mining process on the cloud host of the proving end, thereby ensuring the standardization of the mining process detection.

[0088] Zero-Knowledge Proof (ZKP) is a cryptographic tool that allows mutually untrusted communicating parties to prove the validity of a proposition without leaking any additional information. Zero-knowledge proof is essentially a protocol involving two or more parties, that is, a series of steps required for two or more parties to complete a task. Specifically, with respect to the mining process detection method described in the embodiment of the present application, the proving end proves to the verification end and makes it believe that it knows or owns the process data information, but the proving process cannot leak any of the process data information to the verification end.

[0089] Specifically, Figure 4 A flowchart of the execution phase of a mining process detection method proposed in an embodiment of the present application is shown. Figure 4 As shown, the mining process detection method includes an initialization phase, a proof phase, and a verification phase, which are performed in sequence. First, the mining process detection method is system-set up based on the third-party platform. The initialization phase is the setting phase of the mining process system. In the initialization phase, the proof end obtains the total number of host processes of the cloud host and sends the total number of host processes to the third-party platform. The total number of host processes is used to characterize the number of processes currently running on the cloud host of the proof end. The total number of host processes is used to construct a zero-knowledge proof constraint circuit located on the third-party platform in the initialization phase. Subsequently, the initialization phase is mainly performed by the third-party platform as the execution subject to construct a proof-verification key pair for the mining process detection process of the system running the zero-knowledge proof. For details, please refer to the content of the mining process detection method applied to the third-party platform described below in the embodiment of this application, and the embodiment of this application will not be repeated here.

[0090] In an embodiment of the present application, after the third-party platform constructs the proof-verification key pair, the proof phase is entered. First, the proving end constructs a first proof constraint circuit based on the total number of host processes. Among them, the first proof constraint circuit is the zero-knowledge proof constraint circuit (Constrained Circuit for Zero-Knowledge Proof) of the proving end, which is a virtual circuit structure for constructing and implementing zero-knowledge proof. The first proof constraint circuit is composed of a series of addition gates, multiplication gates and constants, and describes and verifies the authenticity of a proposition or calculation through specific constraint relationships. These constraint relationships ensure that the circuit works as expected and proves the correctness of a certain assertion to the verification end without leaking additional information.

[0091] Specifically, based on the total number of host processes (N), a first protoboard is constructed; a process variable type of the host is obtained, and the process variable type at least includes a CPU usage rate (R) occupied by the process. CPU ), the content usage rate of the process (R MEMORY ) and the upstream and downstream traffic of the process (including upstream traffic R UPLOAD and downstream traffic R DOWNLOAD ); wherein the process data information of the proving end corresponding to each process variable type is specifically represented as follows:

[0092] CPU usage of each process Content usage per process Upstream traffic per process is the upstream traffic of the nth process at time t and time t+1; the downstream traffic of each process in, is the downstream traffic of the nth process at time t and time t+1.

[0093] After obtaining multiple process variable types corresponding to multiple process data information of the proof end cloud host, the first proof constraint circuit is constructed based on the logical relationship between the multiple process variable types. The logical relationship between the multiple process variable types refers to the detection conditions that the process data information corresponding to each process variable type needs to meet when the mining process does not exist on the proof end cloud host. Optionally, the detection condition is that the process data information corresponding to each process variable type is greater than a preset detection threshold corresponding to each process variable type. Optionally, the detection condition is expressed according to the following formula:

[0094] Where n = 1, 2, ..., N

[0095] Where n = 1, 2, ..., N

[0096]

[0097] Where n = 1, 2, ..., N

[0098] Among them, R cpu-set is the preset detection threshold corresponding to the CPU usage of the process; R memory-set is a preset detection threshold corresponding to the content usage rate of the process; R traffix-set The preset detection threshold corresponding to the upstream and downstream traffic of the process.

[0099] It should be noted that, in the proof stage, there is no specific assignment for the preset detection thresholds corresponding to the multiple different process variable types in the detection conditions. Only the logical relationship between the preset process variable type and the preset detection threshold is required, and the constraints between the variables represented by the logical relationship are converted into a logic circuit in units of multiplication. The constraint generation function (generate_constraints() function) is used to connect the relationship between the variables to the breadboard to obtain the first proof constraint circuit.

[0100] In some optional implementations, process data information of each process in the cloud host of the proving end is obtained as a secret input, and the proving end provides the secret input to the first proof constraint circuit. The secret input is confidential information known only by the proving end, and the secret input is used to generate a corresponding proof file to prove to the verification end whether a mining process exists through the proof file.

[0101] In some optional implementations, after the secret input is sent to the first proof constraint circuit, a proof key (proving key) sent by the third-party platform is received, based on the proof key and the secret input, a zero-knowledge proof file is generated using the first proof constraint circuit, and the zero-knowledge proof file is sent to the verification end. Specifically, in response to the proof key sent by the third-party platform, a proof file authentication function (generate_witness() function) is called to assign values ​​to the process data information corresponding to each process variable type in the secret input, and obtain assignment information, which is different from the process data information, so as to ensure that the proof file generated based on the assignment information will not disclose the content of the process data information; a proof file generation function (generate_proof(proving key) function) is called based on the proof key; the assignment information is processed based on the proof file generation function to obtain a zero-knowledge proof file corresponding to the process data information, and the zero-knowledge proof file is sent to the verification end for verification.

[0102] The embodiment of the present application generates the zero-knowledge proof file corresponding to the process data information on the user side (i.e., the proof side where the cloud host is located), and can detect the process data information of the host without directly uploading it to the verification side where the cloud service provider is located, thereby ensuring the confidentiality of the customer's private data. The embodiment of the present application combines the zero-knowledge proof process with the mining process detection, and accurately locates the mining process through data such as process CPU usage, process content usage, and process traffic while ensuring that the user's cloud host privacy information is not leaked.

[0103] Based on the same inventive concept, the embodiment of the present application proposes a mining process detection method, which is applied to the verification end. Figure 2 A flowchart of the execution steps of the proof end in a mining process detection method proposed in an embodiment of the present application is shown. Figure 2 As shown, the method comprises the following steps:

[0104] S201, receiving a verification key sent by a third-party platform;

[0105] S202, receiving a common input sent by the third-party platform, wherein the common input includes an alarm threshold corresponding to each process variable type, and the process variable type includes at least a CPU usage rate occupied by the process, a content usage rate occupied by the process, and an upstream and downstream traffic of the process;

[0106] S203, receiving the zero-knowledge proof file sent by the proving end, and performing mining process detection on the host of the proving end based on the zero-knowledge proof file, the public input and the verification key;

[0107] S204: Perform an alarm process when it is detected that the host of the certification end has a mining process.

[0108] In an embodiment of the present application, after the proving end generates the zero-knowledge proof file and sends it to the verification end, the verification phase of the mining process detection method is entered. In the verification phase, the verification end is used as the execution subject to execute the detection process of the zero-knowledge proof file and output the corresponding detection result. Specifically, in the initialization phase, the verification end receives the verification key sent by the third-party platform and the public input sent by the third-party platform. The public input refers to the input information that can be accessed by the proving end, the third-party platform and the verification end. The verification end can use the public input to verify the validity of the zero-knowledge proof file provided by the proving end without knowing the secret input used by the proving end. Optionally, the public input includes the alarm threshold corresponding to each process variable type, that is, the specific numerical information of the preset detection threshold.

[0109] In some optional implementations, after the proving end sends the zero-knowledge proof file to the verification end, the verification phase is entered, and the verification end receives the zero-knowledge proof file sent by the proving end, and performs mining process detection on the host of the proving end based on the zero-knowledge proof file, the public input, and the verification key. Specifically, based on the public input, multiple detection conditions for different process variable types are determined, and the multiple detection conditions are specific numerical information of multiple predicted detection thresholds based on the public threshold, that is, the preset detection threshold R corresponding to the CPU usage rate of the process cpu-set The specific numerical information of the content usage rate of the process and the preset detection threshold R corresponding to the content usage rate of the process memory-set The specific numerical information of and the preset detection threshold R corresponding to the upstream and downstream traffic of the process traffic-set Specific numerical information.

[0110] Then, based on the multiple detection conditions as the judgment basis, the detection verification function is called based on the zero-knowledge proof file and the verification key. Function), verify the process data information corresponding to each process variable type of the proof end.

[0111] In an embodiment of the present application, when all detection conditions are met, a first detection result is generated, and the first detection result is used to characterize that a mining process exists on the host of the proof end; when at least one detection condition is not met, a second detection result is generated, and the second detection result is used to characterize that a mining process does not exist on the host of the proof end. Finally, an alarm is processed when it is detected that a mining process exists on the host of the proof end. Among them, the detection conditions are all met, which means that the CPU usage rate of the process, the content usage rate of the process, and the uplink and downlink traffic of the process are all greater than the specific numerical information of the corresponding preset detection thresholds; the case where at least one detection condition is not met means that at least one of the CPU usage rate of the process, the content usage rate of the process, and the uplink and downlink traffic of the process is less than or equal to the specific numerical information of the corresponding preset detection threshold.

[0112] In some optional implementations, after performing the mining process detection described in the embodiments of the present application on the process data information at a certain moment and outputting the corresponding detection result, in order to prevent the unreasonable setting of the alarm threshold of the detection condition from causing a false alarm, the alarm threshold is adaptively and dynamically adjusted in the following manner in the embodiments of the present application: obtaining the average process data information corresponding to the process variable types in the unit time, that is, the average CPU usage rate in the unit time, the average content usage rate in the unit time, and the average upstream and downstream traffic in the unit time. It is easy to understand that when adjusting the alarm threshold, a unit time that is too small may cause a false alarm due to a peak value that is too large in the unit time. Therefore, the larger the unit time, the lower the false alarm rate of the detection result; the larger the alarm threshold, the lower the false alarm rate; when the detection result output by the verification stage of the verification end in the last time is the second detection result, adjust the alarm threshold for the next detection. Optionally, the adjustment of the alarm threshold is performed according to the following formula:

[0113]

[0114]

[0115] R reset =R set *[1+α*S(x)]

[0116] Where S(·) is the Sigmod function, e is the natural logarithm; R reset is the adjusted alarm threshold corresponding to the target process variable type, R set is the alarm threshold before adjustment corresponding to the target process variable type, R is the process data information corresponding to the target process variable type; k is the weight of the portion of the peak value exceeding the alarm threshold; β is the weight of the duration of the peak value exceeding the alarm threshold; Tover is the duration that the peak value exceeds the alarm threshold; α is a parameter for controlling the adaptive amplitude, and the larger α is, the faster the adjustment of the alarm threshold is.

[0117] Based on the same inventive concept, the present application embodiment proposes a mining process detection method, which is applied to a third-party platform. Figure 3 A flowchart of the execution steps of a third-party platform in a mining process detection method proposed in an embodiment of the present application is shown. Figure 3 As shown, the method comprises the following steps:

[0118] S301. Receive the total number of host processes sent by the certification end.

[0119] S302: Construct a second proof constraint circuit based on the total number of host processes.

[0120] S303: Generate a corresponding certification key and verification key based on the second certification constraint circuit, and send the certification key to the certification end, and send the verification key to the verification end.

[0121] S304. Based on the second proof circuit, a public input is generated using an input setting function, and the public input is sent to the verification end. The public input includes an alarm threshold corresponding to each process variable type. The process variable type includes at least the CPU usage rate of the process, the content usage rate of the process, and the upstream and downstream traffic of the process.

[0122] In the embodiment of the present application, the third-party platform is used to generate a proof-verification key pair and a public input for performing a zero-knowledge proof process in the initialization phase. The third-party platform is a trusted processing platform. The third-party platform does not receive the process data information of the proof end, but only constructs a circuit according to the constraint relationship between the variable types, thereby generating the proof-verification key pair. Specifically, the third-party platform receives the total number of host processes sent by the proof end, and constructs a second breadboard based on the total number of host processes; obtains the process variable type of the host, and constructs the second proof constraint circuit based on the logical relationship between the multiple process variable types.

[0123] In an embodiment of the present application, after constructing the second proof constraint circuit, a proof key and a verification key corresponding to each other are generated by logic circuit calculation based on the second proof constraint circuit, and the proof key is sent to the proof end, and the verification key is sent to the verification end.

[0124] Subsequently, based on the second proof constraint circuit, the input setting function (set_input_sizes(x) function) is used to generate a public input, where x indicates that the first x of all process variable types are public inputs, and the public input is sent to the verification end. The public input includes the alarm threshold corresponding to each process variable type, and the process variable type includes at least the CPU usage rate occupied by the process, the content usage rate occupied by the process, and the uplink and downlink traffic of the process. Exemplarily, the public input can be the CPU usage rate occupied by the process, the content usage rate occupied by the process, and the uplink and downlink traffic of the process. The corresponding alarm thresholds are 0.8, 0.75, and 3072000, respectively. In addition, since the detection conditions in the embodiments of the present application are all value range conditions, the comparison device function (comparison_gadget() function) can be directly used to realize the construction of the public input when constructing the second proof constraint circuit.

[0125] The present application provides a mining process detection method, system, device, storage medium and product, which are applied to the proof end, and the method includes: obtaining the total number of host processes and sending the total number of host processes to a third-party platform; based on the total number of host processes, constructing a first proof constraint circuit, and providing a secret input to the first proof constraint circuit, wherein the secret input is the process data information of each process in the host; receiving the proof key sent by the third-party platform, and generating a zero-knowledge proof file using the first proof constraint circuit based on the proof key and the secret input; and sending the zero-knowledge proof file to the verification end. The present application generates a zero-knowledge proof file based on the secret input, and sends the zero-knowledge proof file to the verification end for detecting the mining process, thereby realizing the detection of the mining process through the zero-knowledge proof file without providing the system process data and running status to the verification end and the third-party platform, which not only ensures the privacy and security of user data, but also can confirm the standardization of user behavior.

[0126] Based on the same inventive concept, the embodiment of the present application discloses a mining process detection system, the system comprising a certification end, a verification end and a third-party platform;

[0127] The proving end is used to obtain the total number of host processes and send the total number of host processes to the third-party platform; based on the total number of host processes, construct a first proof constraint circuit, and provide a secret input to the first proof constraint circuit, wherein the secret input is process data information of each process in the host; based on the proof key and the secret input, use the first proof constraint circuit to generate a zero-knowledge proof file and send it to the verification end;

[0128] The verification end is used to detect the mining process of the host of the proving end based on the zero-knowledge proof file, the public input and the verification key; and to perform alarm processing when it is detected that the host of the proving end has a mining process;

[0129] The third-party platform is used to construct a second proof constraint circuit based on the total number of host processes; based on the second proof constraint circuit, generate the corresponding proof key and the verification key, and send the proof key to the proof end, and send the verification key to the verification end; based on the second proof circuit, generate the public input using an input setting function, and send the public input to the verification end.

[0130] Based on the same inventive concept, an embodiment of the present application provides a mining process detection device, which is applied to a certification end, and the device includes:

[0131] A process number acquisition module is used to acquire the total number of host processes and send the total number of host processes to a third-party platform;

[0132] A first circuit module, configured to construct a first proof constraint circuit based on the total number of host processes, and provide a secret input to the first proof constraint circuit, wherein the secret input is process data information of each process in the host;

[0133] a proof document generation module, configured to receive a proof key sent by the third-party platform, and generate a zero-knowledge proof document using the first proof constraint circuit based on the proof key and the secret input;

[0134] The proof document sending module is used to send the zero-knowledge proof document to the verification end.

[0135] In an optional implementation manner, the first circuit module includes:

[0136] A first breadboard submodule, configured to construct a first breadboard based on the total number of host processes;

[0137] A process variable type submodule, used to obtain the process variable type of the host, wherein the process variable type at least includes the CPU usage rate occupied by the process, the content usage rate occupied by the process, and the upstream and downstream traffic of the process;

[0138] The first circuit construction submodule is used to construct the first proof constraint circuit based on the logical relationship between the multiple process variable types.

[0139] In an optional implementation manner, the certification document generation module includes:

[0140] an assignment submodule, configured to assign values ​​to the process data information corresponding to each process variable type in the secret input in response to the certification key, to obtain assignment information, wherein the assignment information is different from the process data information, and the process variable type at least includes a CPU usage rate occupied by the process, a content usage rate occupied by the process, and an upstream and downstream traffic of the process;

[0141] A function calling submodule, used to call a certification file generation function based on the certification key;

[0142] The proof document generation submodule is used to process the assignment information based on the proof document generation function to obtain the zero-knowledge proof document.

[0143] Based on the same inventive concept, an embodiment of the present application provides a mining process detection device, which is applied to a verification end, and the device includes:

[0144] A first receiving module, used to receive a verification key sent by a third-party platform;

[0145] A second receiving module is used to receive the common input sent by the third-party platform, wherein the common input includes the alarm threshold corresponding to each process variable type, and the process variable type includes at least the CPU usage rate occupied by the process, the content usage rate occupied by the process, and the uplink and downlink traffic of the process;

[0146] A detection module, configured to receive a zero-knowledge proof file sent by a proving end, and perform a mining process detection on a host of the proving end based on the zero-knowledge proof file, the public input, and the verification key;

[0147] The alarm module is used to perform alarm processing when it is detected that the host of the certification end has a mining process.

[0148] In an optional implementation, the detection module includes:

[0149] A detection condition determination submodule, for determining a plurality of detection conditions for different process variable types respectively based on the common input;

[0150] A verification submodule, configured to use the multiple detection conditions as a judgment basis, call a detection verification function based on the zero-knowledge proof file and the verification key, and verify the process data information corresponding to each process variable type of the proving end;

[0151] A first detection result submodule, configured to generate a first detection result when all detection conditions are met, wherein the first detection result is used to indicate that a mining process exists on the host of the certification end;

[0152] The second detection result submodule is used to generate a second detection result when at least one detection condition is not met, and the second detection result is used to indicate that there is no mining process on the host of the certification end.

[0153] Based on the same inventive concept, an embodiment of the present application provides a mining process detection device, which is applied to a third-party platform. The device includes:

[0154] A third receiving module is used to receive the total number of host processes sent by the proving end;

[0155] A second circuit module, configured to construct a second proof constraint circuit based on the total number of host processes;

[0156] a key pair generation module, configured to generate a certification key and a verification key corresponding to each other based on the second certification constraint circuit, and send the certification key to the certification end, and send the verification key to the verification end;

[0157] A public input generation module is used to generate a public input based on the second proof circuit using an input setting function, and send the public input to the verification end, wherein the public input includes an alarm threshold corresponding to each process variable type, and the process variable type includes at least the CPU usage rate of the process, the content usage rate of the process, and the upstream and downstream traffic of the process.

[0158] A ninth aspect of the embodiments of the present application provides a computer-readable storage medium having a computer program / instruction stored thereon. When the computer program / instruction is executed by a processor, the steps of the mining process detection method described in any one of the first aspect of the embodiments of the present application are implemented; or, when the computer program / instruction is executed by a processor, the steps of the mining process detection method described in any one of the second aspect of the embodiments of the present application are implemented; or, when the computer program / instruction is executed by a processor, the steps of the mining process detection method described in any one of the third aspect of the embodiments of the present application are implemented.

[0159] The tenth aspect of the embodiments of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the mining process detection method described in any one of the first aspects of the embodiments of the present application, or, when executed by a processor, implements the steps of the mining process detection method described in any one of the second aspects of the embodiments of the present application, or, when executed by a processor, implements the steps of the mining process detection method described in any one of the third aspects of the embodiments of the present application.

[0160] Based on the same inventive concept, the present application embodiment discloses an electronic device, Figure 6 A schematic diagram of an electronic device proposed in an embodiment of the present application is shown, such as Figure 6 As shown, the electronic device 100 includes: a memory 110 and a processor 120, the memory 110 and the processor 120 are connected to each other via a bus communication, the memory 110 stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set can be loaded and run on the processor 120 to implement the steps of the mining process detection method applied to the certification end described in the embodiment of the present application, or to implement the steps of the mining process detection method applied to the verification end described in the embodiment of the present application, or to implement the steps of the mining process detection method applied to the third-party platform described in the embodiment of the present application.

[0161] Based on the same inventive concept, an embodiment of the present application discloses a computer-readable storage medium, on which is stored at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the steps of the mining process detection method applied to the proof end described in the embodiment of the present application, or to implement the steps of the mining process detection method applied to the verification end described in the embodiment of the present application, or to implement the steps of the mining process detection method applied to the third-party platform described in the embodiment of the present application.

[0162] Based on the same inventive concept, an embodiment of the present application discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the mining process detection method applied to the proof end described in the embodiment of the present application, or, when executed by a processor, implements the steps of the mining process detection method applied to the verification end described in the embodiment of the present application, or, when executed by a processor, implements the steps of the mining process detection method applied to the third-party platform described in the embodiment of the present application.

[0163] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0164] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, apparatuses, electronic devices, and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0165] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0166] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0167] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0168] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0169] The above is a detailed introduction to a mining process detection method, system, device, storage medium and product provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A mining process detection method, characterized in that: Applied to the proof end, the method includes: Obtaining the total number of host processes, and sending the total number of host processes to a third-party platform; Based on the total number of host processes, construct a first proof constraint circuit, and provide a secret input to the first proof constraint circuit, wherein the secret input is process data information of each process in the host; receiving a proof key sent by the third-party platform, and generating a zero-knowledge proof file using the first proof constraint circuit based on the proof key and the secret input; The zero-knowledge proof document is sent to the verification end.

2. The mining process detection method according to claim 1, characterized in that: The step of constructing a first proof constraint circuit based on the total number of host processes includes: Based on the total number of host processes, construct a first breadboard; Obtaining a process variable type of the host, wherein the process variable type includes at least a CPU usage rate of the process, a content usage rate of the process, and an upstream and downstream flow of the process; The first proof constraint circuit is constructed based on the logical relationship between the multiple process variable types.

3. The mining process detection method according to claim 1, characterized in that: The step of generating a zero-knowledge proof file based on the proof key and the secret input by using the first proof constraint circuit includes: In response to the certification key, assigning values ​​to the process data information corresponding to each process variable type in the secret input to obtain assignment information, the assignment information is different from the process data information, and the process variable type at least includes a CPU usage rate occupied by the process, a content usage rate occupied by the process, and an upstream and downstream flow of the process; Calling a certification document generation function based on the certification key; The assignment information is processed based on the proof file generation function to obtain the zero-knowledge proof file.

4. A mining process detection method, characterized in that: Applied to the verification end, the method includes: Receive the verification key sent by the third-party platform; Receiving a common input sent by the third-party platform, the common input including an alarm threshold corresponding to each process variable type, the process variable type including at least a CPU usage rate occupied by the process, a content usage rate occupied by the process, and an upstream and downstream flow of the process; Receiving a zero-knowledge proof file sent by a proving end, and performing a mining process detection on a host of the proving end based on the zero-knowledge proof file, the public input, and the verification key; When it is detected that a mining process exists on the host of the certification end, an alarm is issued.

5. The mining process detection method according to claim 4, characterized in that: The performing mining process detection on the host of the proving end based on the zero-knowledge proof file, the public input and the verification key includes: Based on the common input, determining a plurality of detection conditions respectively for different process variable types; Taking the multiple detection conditions as a judgment basis, calling a detection verification function based on the zero-knowledge proof file and the verification key, and verifying the process data information corresponding to each process variable type of the proving end; When all detection conditions are met, a first detection result is generated, where the first detection result is used to indicate that a mining process exists on the host of the proving end; When at least one detection condition is not met, a second detection result is generated, and the second detection result is used to indicate that there is no mining process on the host of the certification end.

6. A mining process detection method, characterized in that: Applied to a third-party platform, the method includes: The total number of host processes sent by the receiving end; Based on the total number of host processes, construct a second proof constraint circuit; Based on the second proof constraint circuit, generate a proof key and a verification key corresponding to each other, and send the proof key to the proving end, and send the verification key to the verifying end; Based on the second proof circuit, a public input is generated using an input setting function, and the public input is sent to the verification end, wherein the public input includes an alarm threshold corresponding to each process variable type, and the process variable type includes at least the CPU usage rate of the process, the content usage rate of the process, and the upstream and downstream traffic of the process.

7. A mining process detection system, characterized in that: The system includes a certification end, a verification end and a third-party platform; The proving end is used to obtain the total number of host processes and send the total number of host processes to the third-party platform; Based on the total number of host processes, construct a first proof constraint circuit, and provide a secret input to the first proof constraint circuit, wherein the secret input is process data information of each process in the host; Based on the proof key and the secret input, using the first proof constraint circuit to generate a zero-knowledge proof file and sending it to the verification end; The verification end is used to detect the mining process of the host of the proving end based on the zero-knowledge proof file, the public input and the verification key; and to perform alarm processing when it is detected that the host of the proving end has a mining process; The third-party platform is used to construct a second proof constraint circuit based on the total number of host processes; based on the second proof constraint circuit, generate the proof key and the verification key corresponding to each other, and send the proof key to the proving end, and send the verification key to the verifying end; Based on the second proof circuit, the public input is generated using an input setting function, and the public input is sent to the verification end.

8. An electronic device, characterized in that: It includes a memory, a processor and a computer program stored in the memory, the processor executes the computer program to implement the steps of the mining process detection method described in any one of claims 1 to 3, or the processor executes the computer program to implement the steps of the mining process detection method described in claim 4 or 5, or the processor executes the computer program to implement the steps of the mining process detection method described in claim 6.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instruction is executed by the processor, the steps of the mining process detection method described in any one of claims 1 to 3 are implemented; or, when the computer program / instruction is executed by the processor, the steps of the mining process detection method described in claim 4 or 5 are implemented; or, when the computer program / instruction is executed by the processor, the steps of the mining process detection method described in claim 6 are implemented.

10. A computer program product, characterized in that It includes a computer program / instruction, which, when executed by a processor, implements the steps of the mining process detection method described in any one of claims 1 to 3, or, when executed by a processor, implements the steps of the mining process detection method described in claim 4 or 5, or, when executed by a processor, implements the steps of the mining process detection method described in claim 6.

Images