Blockchain data hidden transmission detection method and system based on multi-feature fusion
By constructing a multi-feature fusion blockchain data covert transmission detection model, this paper solves the problem that existing technologies cannot effectively detect specific data covert transmission stored in encrypted fields. Through text feature and association feature detection models, and using deep learning technology, feature detection is performed, achieving the technical effect of blockchain data covert transmission detection. In particular, the technical problem of blockchain data covert transmission detection based on multi-feature fusion is solved by performing feature detection through a text feature detection model to obtain the final detection result.
Patent Information
- Application Number
- CN202411735633.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-11-07
- Estimated Expiration
- 2044-11-29
AI Technical Summary
Existing blockchain data covert transmission detection algorithms cannot effectively detect special data stored in encrypted fields and ignore the correlation characteristics between multiple blockchain transactions, making it difficult to identify new data covert transmission schemes.
A blockchain data covert transmission detection model based on multi-feature fusion is constructed. Through text feature detection model and association feature detection model, including text feature detection model and fusion feature detection model, feature detection and classification are performed by convolution and pooling operations and deep learning technology to obtain the final detection result.
It improves the accuracy of detecting covert transmission of blockchain data. By fusing text features and association features, it can more effectively capture multiple features in the data and improve detection results.
Smart Images
Figure CN119853947B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of blockchains, in particular to a blockchain data covert transmission detection method and system based on multi-feature fusion. BACKGROUND
[0002] The rapid development and application of computer networks have brought convenience and speed to data transmission, but there have also been more and more phenomena of using networks to build data covert transmission channels for illegal criminal activities. By hiding special data in normal network traffic and using methods such as confusion and encryption to improve concealment, such data covert transmission behavior can bypass traditional network traffic detection algorithms and achieve data covert transmission with anti-supervision capabilities.
[0003] A data covert transmission detection method is a method for detecting data covert transmission behavior from network traffic. By collecting and analyzing the characteristic parameters of normal network traffic, it can be used to detect whether the characteristic values in specific traffic are abnormal, thereby identifying data covert transmission behavior. However, with the development of network technology, the proportion of encrypted data in network traffic continues to increase, and the special features of data covert transmission behavior are hidden in the encryption process and confused in ordinary encrypted traffic, posing a great challenge to data covert transmission detection technology.
[0004] Blockchain is a ledger technology built on a distributed network, with properties such as data tamper-proofing, traffic flooding transmission, and user identity anonymity, making it very suitable for building data covert transmission channels. By embedding data in the fields of blockchain transactions and using the blockchain network to transmit data, it has good anti-detection and anti-tracing capabilities. In particular, the large number of encryption parameters inherent in blockchain transaction fields provide multiple ciphertext carriers for data covert transmission, making it more conducive to building data covert transmission schemes that resist feature statistical detection algorithms. In order to detect data covert transmission schemes based on blockchains, researchers have designed targeted detection algorithms based on blockchain transaction features, and have constructed a variety of detection schemes using deep learning technology.
[0005] However, existing schemes mostly face two problems:
[0006] 1) Existing detection algorithms mainly detect special data by statistical character statistical features, and cannot detect special data stored in encrypted fields. By embedding the information to be transmitted in the encrypted field, the character features of the special data will be confused in the encryption process, and it will be impossible to distinguish between ordinary encrypted data and encrypted data carrying covert information from the perspective of statistical features. In particular, in the context of blockchains, the multiple encryption fields inherent in blockchain transactions provide a natural sanctuary for covert information embedding based on encryption algorithms.
[0007] 2) The existing detection algorithm only considers the statistical characteristics in single blockchain transaction, ignores the correlation characteristics between multiple blockchain transactions, and is difficult to detect new blockchain data covert transmission scheme. SUMMARY
[0008] The purpose of the present application is to provide a blockchain data covert transmission detection method and system based on multi-feature fusion, to improve the accuracy of blockchain data covert transmission detection.
[0009] A blockchain data covert transmission detection method based on multi-feature fusion, comprising:
[0010] Constructing a blockchain data covert transmission detection model; the blockchain data covert transmission detection model includes a text feature detection model, a correlation feature detection model and a fusion feature detection model;
[0011] The text feature detection model includes a first input layer, a first embedding layer, a first convolutional layer, a second convolutional layer, a pooling layer and a fully connected layer;
[0012] The first input layer extracts the input blockchain data to obtain a text feature sequence;
[0013] The first embedding layer performs numerical processing on the text feature sequence to obtain a first numerical index sequence, and converts the first numerical index sequence into a vector space representation to obtain a first embedding matrix;
[0014] The first convolutional layer includes a first convolutional unit, a second convolutional unit and a third convolutional unit;
[0015] The first convolutional unit performs convolutional processing on the first embedding matrix based on a first convolutional kernel to obtain a first convolutional feature map; the second convolutional unit performs convolutional processing on the first embedding matrix based on a second convolutional kernel to obtain a second convolutional feature map; the third convolutional unit performs convolutional processing on the first embedding matrix based on a third convolutional kernel to obtain a third convolutional feature map;
[0016] The second convolutional layer includes a fourth convolutional unit, a fifth convolutional unit and a sixth convolutional unit;
[0017] The fourth convolutional unit performs convolutional processing on the first convolutional feature map based on a fourth convolutional kernel to obtain a fourth convolutional feature map; the fifth convolutional unit performs convolutional processing on the second convolutional feature map based on a fifth convolutional kernel to obtain a fifth convolutional feature map; the sixth convolutional unit performs convolutional processing on the third convolutional feature map based on a sixth convolutional kernel to obtain a sixth convolutional feature map;
[0018] The pooling layer includes a first pooling unit, a second pooling unit and a third pooling unit;
[0019] The first pooling unit performs maximum value pooling processing on the fourth convolution feature map to obtain a first pooled feature map; the second pooling unit performs maximum value pooling processing on the fifth convolution feature map to obtain a second pooled feature map; and the third pooling unit performs maximum value pooling processing on the sixth convolution feature map to obtain a third pooled feature map.
[0020] The full connection layer cascades the first pooled feature map, the second pooled feature map and the third pooled feature map after filtering to obtain a first feature vector, and classifies the first feature vector based on an activation function to obtain a text feature classification result.
[0021] The association feature detection model is used for classifying the input blockchain data based on association features to obtain an association feature classification result.
[0022] The fusion feature detection model performs weighted fusion on the text feature classification result and the association feature classification result to obtain a final classification result.
[0023] The blockchain data covert transmission detection model is trained to obtain a trained blockchain data covert transmission detection model.
[0024] The trained blockchain data covert transmission detection model is used for blockchain data covert transmission detection.
[0025] Optionally, the association feature detection model comprises a second input layer, a second embedding layer, a recurrent layer and an output layer.
[0026] The second input layer extracts the input blockchain data to obtain an association feature sequence.
[0027] The second embedding layer performs numerical value processing on the association feature sequence to obtain a second numerical index sequence, and converts the second numerical index sequence into a vector space representation to obtain a second embedding matrix.
[0028] The recurrent layer extracts features from the second embedding matrix to obtain a plurality of association feature maps.
[0029] The output layer cascades each of the association feature maps to obtain a second feature vector, and classifies the second feature vector based on an activation function to obtain the association feature classification result.
[0030] Optionally, the recurrent layer adopts a bidirectional long short-term memory network.
[0031] Optionally, the size of the first convolution kernel is 3, the size of the second convolution kernel is 4, the size of the third convolution kernel is 5, the size of the fourth convolution kernel is 6, the size of the fifth convolution kernel is 7, and the size of the sixth convolution kernel is 8.
[0032] Optionally, the expression of the fusion feature detection model is:
[0033]
[0034] In the formula: represents the final classification result, f1(X text ) represents the text feature classification result, f2(X related ) represents the association feature classification result, and f fusion represents a weighted fusion function.
[0035] Optionally, in the training process, the loss function is selected as a cross-entropy loss function.
[0036] Optionally, the expression of the cross-entropy loss function is:
[0037] L = -(ylog(p) + (1-y)log(1-p));
[0038] In the formula: L is the loss value, y is the real label, and p is the probability of being predicted as a positive class by the blockchain data hidden transmission detection model.
[0039] The application also provides a blockchain data hidden transmission detection system based on multi-feature fusion, which comprises:
[0040] A model construction module is configured to construct a blockchain data hidden transmission detection model; the blockchain data hidden transmission detection model comprises a text feature detection model, an association feature detection model, and a fusion feature detection model.
[0041] The text feature detection model comprises a first input layer, a first embedding layer, a first convolution layer, a second convolution layer, a pooling layer, and a full connection layer.
[0042] The first input layer extracts the input blockchain data to obtain a text feature sequence.
[0043] The first embedding layer performs numerical value processing on the text feature sequence to obtain a first numerical index sequence, and converts the first numerical index sequence into a vector space representation to obtain a first embedding matrix.
[0044] The first convolution layer comprises a first convolution unit, a second convolution unit, and a third convolution unit.
[0045] The first convolution unit performs convolution processing on the first embedding matrix based on a first convolution kernel to obtain a first convolution feature map; the second convolution unit performs convolution processing on the first embedding matrix based on a second convolution kernel to obtain a second convolution feature map; and the third convolution unit performs convolution processing on the first embedding matrix based on a third convolution kernel to obtain a third convolution feature map.
[0046] The second convolution layer includes a fourth convolution unit, a fifth convolution unit and a sixth convolution unit.
[0047] The fourth convolution unit performs convolution processing on the first convolution feature map based on a fourth convolution kernel to obtain a fourth convolution feature map; the fifth convolution unit performs convolution processing on the second convolution feature map based on a fifth convolution kernel to obtain a fifth convolution feature map; and the sixth convolution unit performs convolution processing on the third convolution feature map based on a sixth convolution kernel to obtain a sixth convolution feature map.
[0048] The pooling layer includes a first pooling unit, a second pooling unit and a third pooling unit.
[0049] The first pooling unit performs maximum value pooling processing on the fourth convolution feature map to obtain a first pooling feature map; the second pooling unit performs maximum value pooling processing on the fifth convolution feature map to obtain a second pooling feature map; and the third pooling unit performs maximum value pooling processing on the sixth convolution feature map to obtain a third pooling feature map.
[0050] The full connection layer cascades the first pooling feature map, the second pooling feature map and the third pooling feature map after filtering to obtain a first feature vector, and classifies the first feature vector based on an activation function to obtain a text feature classification result.
[0051] The association feature detection model is used for classifying the input blockchain data based on association features to obtain an association feature classification result.
[0052] The fusion feature detection model performs weighted fusion on the text feature classification result and the association feature classification result to obtain a final classification result.
[0053] A model training module is configured to train the blockchain data covert transmission detection model to obtain a trained blockchain data covert transmission detection model.
[0054] A detection module is configured to perform blockchain data covert transmission detection based on the trained blockchain data covert transmission detection model.
[0055] Effects of the present application are as follows:
[0056] The application is based on a multi-feature fusion blockchain data covert transmission detection method, which combines text feature classification results and associated feature classification results, can more effectively capture multiple types of features in data, and improves the detection effect of blockchain covert transactions. BRIEF DESCRIPTION OF DRAWINGS
[0057] Figure 1 is a flowchart of the blockchain data covert transmission detection method based on multi-feature fusion of the application.
[0058] Figure 2 is a structural diagram of the blockchain data covert transmission detection model of the application. DETAILED DESCRIPTION
[0059] Hereinafter, embodiments of the application will be described with reference to the accompanying drawings.
[0060] Figure 1 is a flowchart of the blockchain data covert transmission detection method based on multi-feature fusion of the application. As shown in Figure 1 , the application provides a blockchain data covert transmission detection method based on multi-feature fusion, which comprises:
[0061] S1, constructing a blockchain data covert transmission detection model. The blockchain data covert transmission detection model comprises a text feature detection model TextCNN, an associated feature detection model TextRNN and a fusion feature detection model.
[0062] As shown in Figure 2 , the text feature detection model comprises a first input layer, a first embedding layer, a first convolutional layer, a second convolutional layer, a pooling layer and a fully connected layer.
[0063] The first input layer extracts the input blockchain data to obtain a text feature sequence.
[0064] Specifically, the first input layer extracts the required text features from the input blockchain data. The text feature sequence S is: {total, fees, inputs.addresses, inputs.value, outputs.addresses, outputs.value, outputs.script, outputs.data_string, outputs.number, tx_size, address_repeat}. The feature set is represented as: T=t1, t2,..., ti, where ti represents the i-th feature, and the feature subset of the text feature includes 11 features. The actual meaning of each feature is shown in Table 1. 11 i , where ti represents the i-th feature, and the feature subset of the text feature includes 11 features. The actual meaning of each feature is shown in Table 1.
[0065] Table 1: Text features of blockchain transactions
[0066] Type Feature Description Text Feature total Total transaction amount Text Feature fees Transaction fee Text Feature inputs.addresses Input addresses Text Feature inputs.value Input amount Text Feature outputs.addresses Output addresses Text Feature outputs.Value Output amount Text Feature outputs.script Output script Text Feature outputs.data_string OP_RETURN output data Text Feature outputs.number Number of outputs Text Feature tx_size Transaction size Text Feature address_repeat Number of address repeats
[0067] The first embedding layer performs numerical processing on the text feature sequence to obtain a first numerical index sequence, and converts the first numerical index sequence into a vector space representation to obtain a first embedding matrix. Specifically, the first embedding layer uses a vocabulary construction technique to convert the text feature sequence into a numerical feature representation that can be understood by the model. The present application adopts a character-level text processing method, divides the long text sequence character by character, and maps each character to a numerical index using a character dictionary, thereby achieving numerical conversion of the text data to obtain the first numerical index sequence.
[0068] The output dimension k = 128, and padding operation is performed on the original text sentence to maintain the consistency of the vector length. The first embedding matrix is an n*k matrix, where n is the number of characters in a piece of data, the length ranges from 1000 to 1400, k is the dimension of the word vector corresponding to each character, and each row is a 128-dimensional word vector corresponding to a piece of data. The word vector of the i-th character in a row is represented as: The text data with a length of n is represented as: wherein, is a connection operator.
[0069] The first convolutional layer includes a first convolutional unit, a second convolutional unit, and a third convolutional unit. The first convolutional layer captures word sequence information and local patterns through local perception to extract word group patterns and local context information.
[0070] The first convolutional unit performs convolutional processing on the first embedding matrix based on a first convolutional kernel to obtain a first convolutional feature map; the second convolutional unit performs convolutional processing on the first embedding matrix based on a second convolutional kernel to obtain a second convolutional feature map; and the third convolutional unit performs convolutional processing on the first embedding matrix based on a third convolutional kernel to obtain a third convolutional feature map. Preferably, the size of the first convolutional kernel is 3, the size of the second convolutional kernel is 4, and the size of the third convolutional kernel is 5.
[0071] Specifically, the feature map after each convolution is represented as:
[0072] c i = f(ω·x i:i+h-1 +b);
[0073] wherein f represents a nonlinear function, Relu activation function is selected, b is a bias term, h refers to the window size of convolution, and the convolution kernel is an h*k weight matrix.
[0074] The first convolutional feature map is represented as:
[0075] C = {c1, c2,..., c n-h+1}.
[0076] The second convolutional layer includes a fourth convolutional unit, a fifth convolutional unit and a sixth convolutional unit.
[0077] The fourth convolutional unit performs convolutional processing on the first convolutional feature map based on a fourth convolutional kernel to obtain a fourth convolutional feature map; the fifth convolutional unit performs convolutional processing on the second convolutional feature map based on a fifth convolutional kernel to obtain a fifth convolutional feature map; and the sixth convolutional unit performs convolutional processing on the third convolutional feature map based on a sixth convolutional kernel to obtain a sixth convolutional feature map. Preferably, the size of the fourth convolutional kernel is 6, the size of the fifth convolutional kernel is 7, and the size of the sixth convolutional kernel is 8.
[0078] The pooling layer includes a first pooling unit, a second pooling unit and a third pooling unit.
[0079] The first pooling unit performs maximum value pooling processing on the fourth convolutional feature map to obtain a first pooling feature map; the second pooling unit performs maximum value pooling processing on the fifth convolutional feature map to obtain a second pooling feature map; and the third pooling unit performs maximum value pooling processing on the sixth convolutional feature map to obtain a third pooling feature map.
[0080] The full connection layer cascades the first pooling feature map, the second pooling feature map and the third pooling feature map after filtering to obtain a first feature vector, and classifies the first feature vector based on an activation function to obtain a text feature classification result.
[0081] The association feature detection model is used for classifying the input blockchain data based on association features to obtain an association feature classification result.
[0082] Specifically, as shown in Figure 2 , the association feature detection model includes a second input layer, a second embedding layer, a recurrent layer and an output layer.
[0083] The second input layer extracts the input blockchain data to obtain an association feature sequence. The association feature sequence S2 is: {art_num, total_received, total_sent, final_balance, input_proportion, output_proportion}. The feature set is represented as: T = t1, t2,..., t6, where t i represents the i-th feature, and the feature subset of the association feature includes 6 features, and the actual meaning of each feature is shown in Table 2.
[0084] Table 2: Blockchain transaction association features
[0085]
[0086] The second embedding layer performs numerical processing on the associated feature sequence to obtain a second numerical index sequence, and converts the second numerical index sequence into a vector space representation to obtain a second embedding matrix.
[0087] The recurrent layer extracts features from the second embedding matrix to obtain a plurality of associated feature maps.
[0088] The output layer cascades each associated feature map to obtain a second feature vector, and classifies the second feature vector based on an activation function to obtain an associated feature classification result.
[0089] The fusion feature detection model weights and fuses the text feature classification result and the associated feature classification result to obtain a final classification result.
[0090] The expression of the fusion feature detection model is:
[0091]
[0092] In the formula: represents the final classification result, f1(X text ) represents the text feature classification result, f2(X related ) represents the associated feature classification result, and f fusion represents a weighted fusion function.
[0093] S2, training the blockchain data covert transmission detection model to obtain a trained blockchain data covert transmission detection model.
[0094] Specifically, in the training process, the loss function is selected as a cross-entropy loss function. The expression of the cross-entropy loss function is:
[0095] L = -(ylog(p) + (1-y)log(1-p));
[0096] In the formula: L is the loss value, y is the true label, and p is the probability of the blockchain data covert transmission detection model predicting as a positive class.
[0097] S3, based on the trained blockchain data covert transmission detection model, performing blockchain data covert transmission detection.
[0098] The application also provides a blockchain data covert transmission detection system based on multi-feature fusion, which comprises:
[0099] The model construction module is configured to construct a blockchain data covert transmission detection model. The blockchain data covert transmission detection model comprises a text feature detection model, an association feature detection model, and a fusion feature detection model.
[0100] The text feature detection model comprises a first input layer, a first embedding layer, a first convolutional layer, a second convolutional layer, a pooling layer, and a fully connected layer.
[0101] The first input layer extracts the input blockchain data to obtain a text feature sequence.
[0102] The first embedding layer performs numerical processing on the text feature sequence to obtain a first numerical index sequence, and converts the first numerical index sequence into a vector space representation to obtain a first embedding matrix.
[0103] The first convolutional layer comprises a first convolutional unit, a second convolutional unit, and a third convolutional unit.
[0104] The first convolutional unit performs convolutional processing on the first embedding matrix based on a first convolutional kernel to obtain a first convolutional feature map; the second convolutional unit performs convolutional processing on the first embedding matrix based on a second convolutional kernel to obtain a second convolutional feature map; and the third convolutional unit performs convolutional processing on the first embedding matrix based on a third convolutional kernel to obtain a third convolutional feature map.
[0105] The second convolutional layer comprises a fourth convolutional unit, a fifth convolutional unit, and a sixth convolutional unit.
[0106] The fourth convolutional unit performs convolutional processing on the first convolutional feature map based on a fourth convolutional kernel to obtain a fourth convolutional feature map; the fifth convolutional unit performs convolutional processing on the second convolutional feature map based on a fifth convolutional kernel to obtain a fifth convolutional feature map; and the sixth convolutional unit performs convolutional processing on the third convolutional feature map based on a sixth convolutional kernel to obtain a sixth convolutional feature map.
[0107] The pooling layer comprises a first pooling unit, a second pooling unit, and a third pooling unit.
[0108] The first pooling unit performs maximum value pooling processing on the fourth convolutional feature map to obtain a first pooled feature map; the second pooling unit performs maximum value pooling processing on the fifth convolutional feature map to obtain a second pooled feature map; and the third pooling unit performs maximum value pooling processing on the sixth convolutional feature map to obtain a third pooled feature map.
[0109] The fully connected layer cascades the first pooled feature map, the second pooled feature map, and the third pooled feature map after filtering to obtain a first feature vector, and classifies the first feature vector based on an activation function to obtain a text feature classification result.
[0110] The association feature detection model is used for association feature classification on the input blockchain data, to obtain an association feature classification result.
[0111] The fusion feature detection model fuses the text feature classification result and the association feature classification result by weighting, to obtain a final classification result.
[0112] The model training module is configured to train the blockchain data covert transmission detection model, to obtain a trained blockchain data covert transmission detection model.
[0113] The detection module is configured to perform blockchain data covert transmission detection based on the trained blockchain data covert transmission detection model.
[0114] The above-described embodiments merely describe the preferred embodiments of the present application, and do not limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements to the technical solutions of the present application made by those of ordinary skill in the art shall fall within the protection scope of the present application as defined by the claims.
Claims
1. A method for detecting blockchain data covert transmission based on multi-feature fusion, characterized in that, It comprises: The blockchain data covert transmission detection model comprises a text feature detection model, an association feature detection model and a fusion feature detection model; The text feature detection model comprises a first input layer, a first embedding layer, a first convolutional layer, a second convolutional layer, a pooling layer and a fully connected layer; The first input layer extracts the input blockchain data to obtain a text feature sequence; The first embedding layer performs numerical processing on the text feature sequence to obtain a first numerical index sequence, and converts the first numerical index sequence into a vector space representation to obtain a first embedding matrix; The first convolutional layer comprises a first convolutional unit, a second convolutional unit and a third convolutional unit; The first convolutional unit performs convolutional processing on the first embedding matrix based on a first convolutional kernel to obtain a first convolutional feature map; the second convolutional unit performs convolutional processing on the first embedding matrix based on a second convolutional kernel to obtain a second convolutional feature map; and the third convolutional unit performs convolutional processing on the first embedding matrix based on a third convolutional kernel to obtain a third convolutional feature map; The second convolutional layer comprises a fourth convolutional unit, a fifth convolutional unit and a sixth convolutional unit; The fourth convolutional unit performs convolutional processing on the first convolutional feature map based on a fourth convolutional kernel to obtain a fourth convolutional feature map; the fifth convolutional unit performs convolutional processing on the second convolutional feature map based on a fifth convolutional kernel to obtain a fifth convolutional feature map; and the sixth convolutional unit performs convolutional processing on the third convolutional feature map based on a sixth convolutional kernel to obtain a sixth convolutional feature map; The pooling layer comprises a first pooling unit, a second pooling unit and a third pooling unit; The first pooling unit performs maximum value pooling processing on the fourth convolutional feature map to obtain a first pooling feature map; the second pooling unit performs maximum value pooling processing on the fifth convolutional feature map to obtain a second pooling feature map; and the third pooling unit performs maximum value pooling processing on the sixth convolutional feature map to obtain a third pooling feature map; The fully connected layer cascades the first pooling feature map, the second pooling feature map and the third pooling feature map after filtering to obtain a first feature vector, and classifies the first feature vector based on an activation function to obtain a text feature classification result; The association feature detection model is used for association feature classification of the input blockchain data to obtain an association feature classification result; The fusion feature detection model performs weighted fusion on the text feature classification result and the association feature classification result to obtain a final classification result; The blockchain data covert transmission detection model is trained to obtain a trained blockchain data covert transmission detection model; Based on the trained blockchain data covert transmission detection model, blockchain data covert transmission detection is performed.
2. The multi-feature fusion-based blockchain data covert transmission detection method according to claim 1, characterized in that, The association feature detection model comprises a second input layer, a second embedding layer, a recurrent layer and an output layer; The second input layer extracts the input blockchain data to obtain an association feature sequence; The second embedding layer performs numerical value processing on the correlation feature sequence to obtain a second numerical index sequence, and converts the second numerical index sequence into a vector space representation to obtain a second embedding matrix; The cycle layer extracts features from the second embedding matrix to obtain a plurality of correlation feature maps; The output layer performs cascade processing on each of the correlation feature maps to obtain a second feature vector, and classifies the second feature vector based on an activation function to obtain the correlation feature classification result. 3.The method of claim 2, wherein, The cycle layer adopts a bidirectional long short-term memory network.
4. The multi-feature fusion-based blockchain data covert transmission detection method according to claim 1, characterized in that, The size of the first convolution kernel is 3, the size of the second convolution kernel is 4, the size of the third convolution kernel is 5, the size of the fourth convolution kernel is 6, the size of the fifth convolution kernel is 7, and the size of the sixth convolution kernel is 8.
5. The multi-feature fusion based blockchain data covert transmission detection method according to claim 1, characterized in that, The expression of the fusion feature detection model is: In the formula: represents the final classification result, f1(X text ) represents the text feature classification result, f2(X related ) represents the association feature classification result, f fusion represents a weighted fusion function. 6.The method of claim 1, wherein, In the training process, a cross-entropy loss function is selected as the loss function.
7. The multi-feature fusion based blockchain data covert transmission detection method according to claim 6, characterized in that, The expression of the cross-entropy loss function is: L = -(ylog(p) + (1-y)log(1-p)); In the formula, L is a loss value, y is a real label, and p is a probability of being predicted as a positive class by the blockchain data hidden transmission detection model.
8. A multi-feature fusion-based blockchain data covert transmission detection system, characterized in that, It comprises: A model construction module is configured to construct a blockchain data hidden transmission detection model; the blockchain data hidden transmission detection model comprises a text feature detection model, a correlation feature detection model, and a fusion feature detection model; The text feature detection model comprises a first input layer, a first embedding layer, a first convolution layer, a second convolution layer, a pooling layer, and a full connection layer; The first input layer extracts input blockchain data to obtain a text feature sequence; The first embedding layer performs numerical value processing on the text feature sequence to obtain a first numerical index sequence, and converts the first numerical index sequence into a vector space representation to obtain a first embedding matrix; The first convolution layer comprises a first convolution unit, a second convolution unit, and a third convolution unit; The first convolution unit performs convolution processing on the first embedding matrix based on a first convolution kernel to obtain a first convolution feature map; the second convolution unit performs convolution processing on the first embedding matrix based on a second convolution kernel to obtain a second convolution feature map; and the third convolution unit performs convolution processing on the first embedding matrix based on a third convolution kernel to obtain a third convolution feature map; The second convolution layer comprises a fourth convolution unit, a fifth convolution unit, and a sixth convolution unit; The fourth convolution unit performs convolution processing on the first convolution feature map based on a fourth convolution kernel to obtain a fourth convolution feature map; the fifth convolution unit performs convolution processing on the second convolution feature map based on a fifth convolution kernel to obtain a fifth convolution feature map; and the sixth convolution unit performs convolution processing on the third convolution feature map based on a sixth convolution kernel to obtain a sixth convolution feature map; The pooling layer comprises a first pooling unit, a second pooling unit, and a third pooling unit; The first pooling unit performs maximum value pooling processing on the fourth convolution feature map to obtain a first pooled feature map; the second pooling unit performs maximum value pooling processing on the fifth convolution feature map to obtain a second pooled feature map; and the third pooling unit performs maximum value pooling processing on the sixth convolution feature map to obtain a third pooled feature map. The full connection layer cascades the first pooled feature map, the second pooled feature map and the third pooled feature map after filtering to obtain a first feature vector, and classifies the first feature vector based on an activation function to obtain a text feature classification result; The association feature detection model is used for classifying association features of input blockchain data to obtain an association feature classification result; The fusion feature detection model performs weighted fusion on the text feature classification result and the association feature classification result to obtain a final classification result; A model training module is configured to train the blockchain data covert transmission detection model to obtain a trained blockchain data covert transmission detection model; A detection module is configured to perform blockchain data covert transmission detection based on the trained blockchain data covert transmission detection model.
Citation Information
Patent Citations
A CNN and RNN fusion model-based network heterogeneous concurrent steganography channel detection method
CN109729070A
Covert communication method based on block chain
CN117955687A