Intrusion behavior early warning method and device based on machine learning

Abstract

The invention provides an intrusion behavior early warning method and device based on machine learning, and relates to the field of network security. The method comprises the following steps: acquiring network security monitoring data in response to a monitoring operation of a user for a network intrusion behavior; obtaining a first intrusion behavior feature in the network security monitoring data through static feature engineering extraction; obtaining a second intrusion behavior feature in the network security monitoring data through dynamic feature engineering extraction; performing feature fusion on the first intrusion behavior feature and the second intrusion behavior feature, and outputting a target intrusion behavior feature after feature fusion; and constructing an intrusion behavior early warning model, and outputting an early warning result according to the intrusion behavior early warning model by inputting the target intrusion behavior characteristics. According to the method, the problems that a traditional intrusion early warning method based on simple machine learning only depends on static or local features for judgment, so that a complex and multi-dimensional behavior mode in a block chain cannot be captured, and the false alarm rate and the missing report rate are relatively high are solved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to an intrusion behavior early warning method and device based on machine learning. Background Art

[0002] In recent years, blockchain technology has been widely used in finance, healthcare, the Internet of Things, and supply chain management due to its decentralization, immutability, and transparency. However, the rapid development of the blockchain ecosystem has also brought about a significant increase in network security issues. Attackers have threatened the security of blockchain networks through smart contract vulnerabilities, malicious node behaviors, double-spending attacks, and other means. Therefore, real-time and accurate early warning of intrusions in blockchain networks has become one of the core tasks to ensure the security of the blockchain ecosystem.

[0003] However, the current traditional intrusion warning methods based on simple machine learning have significant technical defects. First, most of these methods use a single learning method, such as classification or regression models based on specific features. However, the above methods fail to fully consider the complex interactions and potential dynamic changes between different features, and only rely on static or local features for judgment, thus failing to capture the complex and multi-dimensional behavior patterns in the blockchain, and there are problems with high false positive and false negative rates.

[0004] Therefore, there is an urgent need for an intrusion behavior early warning method and device based on machine learning. Summary of the invention

[0005] The present application provides an intrusion behavior warning method and device based on machine learning, which solves the problem that the traditional intrusion warning method based on simple machine learning only relies on static or local features for judgment, thereby failing to capture the complex and multi-dimensional behavior patterns in the blockchain, and has high false alarm and missed alarm rates.

[0006] In a first aspect of the present application, a machine learning-based intrusion behavior warning method is provided, the method comprising: obtaining network security monitoring data in response to a user's monitoring operation on network intrusion behavior, the network security monitoring data including blockchain transaction data, smart contract code data, and execution event log data; obtaining a first intrusion behavior feature in the network security monitoring data through static feature engineering extraction; obtaining a second intrusion behavior feature in the network security monitoring data through dynamic feature engineering extraction; performing feature fusion on the first intrusion behavior feature and the second intrusion behavior feature, and outputting a target intrusion behavior feature after feature fusion; constructing an intrusion behavior warning model, and outputting a warning result according to the intrusion behavior warning model by inputting the target intrusion behavior feature.

[0007] Optionally, a first intrusion behavior feature in the network security monitoring data is obtained through static feature engineering extraction, specifically including: obtaining contract state change data in the network security monitoring data, the contract state change data including memory state quantity change data, stack state quantity change data and register state quantity change data; determining whether there is state variable data in the contract state change data; if there is state variable data in the contract state change data, obtaining a first intrusion behavior feature in the network security monitoring data through static feature engineering extraction, the first intrusion behavior feature including contract modification features, execution path features and rollback behavior features.

[0008] Optionally, a second intrusion behavior feature in the network security monitoring data is obtained through dynamic feature engineering extraction, specifically including: constructing an interactive network based on the network security monitoring data, the nodes of the interactive network are multiple transaction contracts in the blockchain, and the edges of the interactive network are call relationships between the multiple transaction contracts; judging whether there is a call chain in the interactive network that attacks the transaction contract; if there is a call chain in the interactive network that attacks the transaction contract, obtaining the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering extraction.

[0009] Optionally, the first intrusion behavior feature and the second intrusion behavior feature are feature fused, and a target intrusion behavior feature after feature fusion is output: a fusion layer weight matrix and a target bias term are constructed, and a weighted sum of the first intrusion behavior feature and the second intrusion behavior feature is performed through the fusion layer weight matrix and the target bias term; the intrusion behavior feature after weighted sum is used as the target intrusion behavior feature, and the target intrusion behavior feature is output through the following formula:

[0010]

[0011] Among them, F fusion is the target intrusion behavior feature, σ is the activation function, W fusion is the fusion layer weight matrix, v n (t) is the nth first intrusion behavior feature, F1(t) is the first feature vector corresponding to the first intrusion behavior feature, F2 is the second feature vector corresponding to the second intrusion behavior feature, λ1 is the weighting coefficient corresponding to the first intrusion behavior feature, λ2 is the weighting coefficient corresponding to the second intrusion behavior feature, b fusion is the target bias term, and b fusion =b1+b2, b1 is the dimension corresponding to the first intrusion behavior feature, b2 is the dimension corresponding to the second intrusion behavior feature, w m (h v (k) ) is the mth second intrusion behavior feature, h v (k)is the feature representation of the vth trading contract after the kth layer of graph convolution, is the set of adjacent points of the vth transaction contract, u is any transaction contract in the set of adjacent points, W (k) is the weight matrix of the graph convolutional network, h u (k-1) represents the feature representation of the u-th trading contract after the k-1th layer of graph convolution, b k is the bias term of the k-th layer of graph convolution.

[0012] Optionally, constructing a fusion layer weight matrix and a target bias term specifically includes: setting an initial fusion layer weight matrix and an initial bias term, and constructing a loss function; calculating a first gradient of the loss function relative to the fusion layer weight matrix, and calculating a second gradient of the loss function relative to the target bias term; updating the initial fusion layer weight matrix and the initial bias term by gradient descent according to the first gradient and the second gradient; and using the updated initial fusion layer weight matrix and the initial bias term that meet preset convergence conditions as the fusion layer weight matrix and the target bias term.

[0013] Optionally, constructing an intrusion behavior warning model specifically includes: obtaining historical network security monitoring data, the historical network security monitoring data includes historical blockchain transaction data, historical smart contract code data, and historical execution event log data; obtaining intrusion behavior feature training data in the historical network security monitoring data through feature extraction engineering; and constructing an intrusion behavior warning model through the intrusion behavior feature training data.

[0014] Optionally, by inputting the target intrusion behavior characteristics, the warning result is output according to the intrusion behavior warning model, specifically including: by inputting the target intrusion behavior characteristics, the target warning threshold is output according to the intrusion behavior warning model; judging whether the target warning threshold is greater than the preset warning threshold; if the target warning threshold is greater than the preset warning threshold, confirming that the warning result is that the network intrusion behavior is encountered; if the target warning threshold is less than or equal to the preset warning threshold, confirming that the warning result is that the network intrusion behavior is not encountered.

[0015] In a second aspect of the present application, a machine learning-based intrusion behavior early warning device is provided, the device comprising an acquisition module and a processing module, wherein:

[0016] The acquisition module is used to obtain network security monitoring data in response to the user's monitoring operation on network intrusion behavior, and the network security monitoring data includes blockchain transaction data, smart contract code data and execution event log data; obtain the first intrusion behavior feature in the network security monitoring data through static feature engineering extraction; obtain the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering extraction.

[0017] The processing module is used to fuse the first intrusion behavior feature and the second intrusion behavior feature, and output the target intrusion behavior feature after the feature fusion; construct an intrusion behavior warning model, and output the warning result according to the intrusion behavior warning model by inputting the target intrusion behavior feature.

[0018] In the third aspect of the present application, an electronic device is provided, including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes any one of the methods described above.

[0019] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to perform any of the above methods.

[0020] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0021] 1. When the user performs monitoring operations on network intrusion behaviors, network security monitoring data is obtained, and the first intrusion behavior feature in the network security monitoring data is obtained through static feature engineering extraction, and the second intrusion behavior feature in the network security monitoring data is obtained through dynamic feature engineering extraction, so as to fuse the first intrusion behavior feature and the second intrusion behavior feature, and output the target intrusion behavior feature after feature fusion, build an intrusion behavior warning model, and output the warning result according to the intrusion behavior warning model by inputting the target intrusion behavior feature, and then realize the accurate identification and real-time warning of potential intrusion behaviors in the blockchain network through multi-feature fusion, which greatly improves the accuracy of network security intrusion behavior warning, and solves the problem that the traditional intrusion warning method based on simple machine learning only relies on static or local features for judgment, and thus cannot capture the complex and multi-dimensional behavior patterns in the blockchain, and has high false alarm rate and missed alarm rate.

[0022] 2. By constructing the fusion layer weight matrix and the target bias term, and according to the fusion layer weight matrix and the target bias term, the first intrusion behavior feature and the second intrusion behavior feature are weighted and summed, so that the intrusion behavior feature after the weighted sum is used as the target intrusion behavior feature, thereby fully integrating the advantages of static features and dynamic features, enhancing the expression ability of the target intrusion behavior feature, and providing a high-quality data foundation for the prediction of the intrusion behavior warning model.

[0023] 3. Set the initial fusion layer weight matrix and initial bias term, and construct the loss function, calculate the first gradient of the loss function relative to the fusion layer weight matrix, calculate the second gradient of the loss function relative to the target bias term, and update the initial fusion layer weight matrix and initial bias term by gradient descent according to the first gradient and the second gradient, so that the updated initial fusion layer weight matrix and initial bias term that meet the preset convergence conditions are used as the fusion layer weight matrix and target bias term, thereby ensuring that the feature fusion process can dynamically adjust the weights and biases, maximize the expressiveness of the target intrusion behavior characteristics, and optimize the correlation between features. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flow chart of an intrusion behavior early warning method based on machine learning provided in an embodiment of the present application;

[0025] Figure 2 It is a module schematic diagram of an intrusion behavior early warning device based on machine learning provided in an embodiment of the present application;

[0026] Figure 3 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0027] Explanation of the reference numerals: 21, acquisition module; 22, processing module; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0028] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0029] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to and includes any or all possible combinations of one or more listed items.

[0030] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0031] In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0032] Please refer to Figure 1 , which shows a flow chart of an intrusion behavior early warning method based on machine learning provided in an embodiment of the present application, and the flow chart mainly includes the following steps: S101 to S105.

[0033] Step S101, in response to the user's monitoring operation on network intrusion behavior, obtain network security monitoring data, the network security monitoring data includes blockchain transaction data, smart contract code data and execution event log data.

[0034] Specifically, real-time monitoring is carried out on network security intrusion behaviors in the blockchain, and network security monitoring data is obtained in real time. The network security monitoring data specifically includes three types of core data collected in real time from the blockchain system, among which blockchain transaction data includes but is not limited to: the initiator address, recipient address, transaction amount, timestamp, transaction hash value and its associated block height of each transaction; smart contract code data includes but is not limited to: the source code and bytecode of the smart contract, the functions defined in the contract and their calling relationships, the status of global variables, and the account information of the deployed contract; execution event log data includes but is not limited to: recording the event log generated during the execution of the smart contract, including the time of event triggering, event type (such as exception throwing, status update, asset transfer), call stack information and the corresponding contract address.

[0035] Step S102: obtaining a first intrusion behavior feature in network security monitoring data through static feature engineering extraction.

[0036] Specifically, for blockchain transaction data, smart contract code data and execution event log data, static analysis methods are applied to extract features: for blockchain transaction data, the behavior patterns of accounts on the chain are analyzed by statistically analyzing features such as transaction frequency, amount distribution, transaction address diversity and transaction graph topology characteristics; for smart contract code data, code parsing and syntax analysis techniques are used to extract static features such as function call hierarchy, logic complexity, code dependencies and initial state of variables to mine potential vulnerabilities and non-compliant operations; for execution event log data, key event matching and abnormal event pattern mining are used to extract features such as the distribution of triggered event types, call chain depth and execution path pattern to locate possible abnormal behaviors. The above features are processed through feature standardization and dimensionality reduction to generate the first intrusion behavior features, which provide static feature support for subsequent analysis.

[0037] In a possible implementation, step S102 also includes: obtaining contract state change data in the network security monitoring data, the contract state change data including memory state quantity change data, stack state quantity change data and register state quantity change data; determining whether there is state variable data in the contract state change data; if there is state variable data in the contract state change data, obtaining the first intrusion behavior feature in the network security monitoring data through static feature engineering extraction, the first intrusion behavior feature including contract modification feature, execution path feature and rollback behavior feature.

[0038] Specifically, firstly, the contract state change data in the network security monitoring data is obtained, and the contract state change data includes memory state quantity change data, stack state quantity change data and register state quantity change data; then, it is determined whether there is state variable data in the contract state change data. If there is state variable data, the first intrusion behavior feature related to it is further extracted through static feature engineering. Specifically, for the contract modification feature, the addition, deletion and rewriting operations of the state variables are analyzed, and the modification frequency, variable dependency and modification range involved are extracted; for the execution path feature, the path distribution, path coverage and path complexity of the contract execution are extracted through static analysis of the contract bytecode; for the rollback behavior feature, the rollback frequency, the function call chain involved in the rollback and the exception type triggered by the rollback are extracted by analyzing the state rollback caused by the transaction failure.

[0039] Step S103, extracting through dynamic feature engineering, obtaining the second intrusion behavior feature in the network security monitoring data.

[0040] Specifically, for blockchain transaction data, smart contract code data, and execution event log data in network security monitoring data, dynamic behavior analysis and real-time monitoring technology are combined to extract features: for blockchain transaction data, dynamic behavior features such as transaction explosiveness, frequent cross-account calls, and abnormal transfer behaviors within the time window are extracted by analyzing the address behavior sequence, transaction trigger mode, and associated transaction links in the real-time transaction flow; for smart contract code data, real-time call stack depth, dynamic variable usage frequency, and contract running time distribution are extracted by monitoring the state changes during contract execution; for execution event log data, dynamic event sequence, abnormal event duration, and event correlation features are extracted by recording the event stream triggered during the execution process. In addition, the dynamic feature extraction process introduces a time window mechanism to segment the monitoring data, and combines sliding window analysis with feature aggregation to form a dynamic feature set. Through the above dynamic feature engineering, a second intrusion behavior feature that reflects real-time behavior is generated to provide data support for early warning and tracking of intrusion behavior.

[0041] In a possible implementation, step S103 also includes: constructing an interactive network based on network security monitoring data, where the nodes of the interactive network are multiple transaction contracts in the blockchain, and the edges of the interactive network are call relationships between the multiple transaction contracts; determining whether there is a call chain in the interactive network that attacks the transaction contract; if there is a call chain in the interactive network that attacks the transaction contract, extracting the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering.

[0042] Specifically, based on network security monitoring data, an interactive network is constructed, in which the nodes of the interactive network represent transaction contracts in the blockchain, and the edges represent the calling relationships between transaction contracts, including direct calling and indirect calling paths. After the interactive network is constructed, the network structure characteristics are analyzed through anomaly detection algorithms, such as a detection method based on a graph attention mechanism or an algorithm based on subgraph pattern mining, to determine whether there is an abnormal call chain in the interactive network. The abnormal call chain characteristics may include abnormal call chain length, abnormal node weights in the call chain, or a call sequence that does not meet expectations. If an abnormal call chain is detected, the second intrusion behavior characteristics related to the abnormal call chain are extracted in combination with dynamic feature engineering, including attack path characteristics (such as high-frequency call paths and call chain aggregation points), dynamic state characteristics of abnormal call contracts (such as high-frequency state changes or function abuse behaviors), and trigger characteristics of abnormal call chains (such as deviations between the trigger event timing and expected events).

[0043] Step S104: perform feature fusion on the first intrusion behavior feature and the second intrusion behavior feature, and output a target intrusion behavior feature after feature fusion.

[0044] Specifically, a weight matrix for feature fusion is constructed, that is, a fusion layer weight matrix is ​​constructed. The matrix determines the relative importance of the first intrusion behavior feature and the second intrusion behavior feature in the fusion process. The weight value can be assigned through historical data training or based on the correlation of specific features. At the same time, a target bias item is set. The bias item is used to correct the fusion result so that it can more accurately reflect the target feature distribution. The first intrusion behavior feature and the second intrusion behavior feature are weighted and summed through the fusion layer weight matrix and the target bias item, and the accumulation operation is performed in combination with the target bias item; the intrusion behavior feature after weighted summation is used as the target intrusion behavior feature, and the target intrusion behavior feature is output through the following formula:

[0045]

[0046] Among them, F fusion is the target intrusion behavior feature, σ is the activation function, W fusion is the fusion layer weight matrix, v n (t) is the nth first intrusion behavior feature, F1(t) is the first feature vector corresponding to the first intrusion behavior feature, F2 is the second feature vector corresponding to the second intrusion behavior feature, λ1 is the weighting coefficient corresponding to the first intrusion behavior feature, λ2 is the weighting coefficient corresponding to the second intrusion behavior feature, b fusion is the target bias term, and b fusion =b1+b2, b1 is the dimension corresponding to the first intrusion behavior feature, b2 is the dimension corresponding to the second intrusion behavior feature, w m (h v (k) ) is the mth second intrusion behavior feature, h v (k) is the feature representation of the vth trading contract after the kth layer of graph convolution, is the set of adjacent points of the vth transaction contract, u is any transaction contract in the set of adjacent points, W (k) is the weight matrix of the graph convolutional network, h u (k-1) represents the feature representation of the u-th trading contract after the k-1th layer of graph convolution, b k is the bias term of the k-th layer of graph convolution.

[0047] In a possible implementation, step S104 also includes: setting an initial fusion layer weight matrix and an initial bias term, and constructing a loss function; calculating a first gradient of the loss function relative to the fusion layer weight matrix, and calculating a second gradient of the loss function relative to a target bias term; updating the initial fusion layer weight matrix and the initial bias term by gradient descent according to the first gradient and the second gradient; and using the updated initial fusion layer weight matrix and the initial bias term that meet preset convergence conditions as the fusion layer weight matrix and the target bias term.

[0048] Specifically, the fusion layer weight matrix and the target bias term are first initialized, that is, the initial fusion layer weight matrix and the initial bias term are set. For the fusion layer weight matrix, it can be initialized by random initialization, that is, initialized by normal distribution or uniform distribution. For example, the initial fusion layer weight matrix is ​​set to satisfy Among them, W first is the initial fusion layer weight matrix, σ only represents a preset standard deviation here, that is, represents a normal distribution with a standard deviation of σ; the initial bias term is usually set to 0. Further, a loss function is set, which is usually a cross entropy loss or a mean square error. This application takes the cross loss function as an example and assumes that the cross loss function is represented by the following formula:

[0049]

[0050] in, is the cross loss function, v i (t) is the first intrusion behavior feature of the i-th intrusion, w j (h v (k) ) is the jth second intrusion behavior feature, ω ij represents the feature relationship weight between the i-th first intrusion behavior feature and the j-th second intrusion behavior feature, which can be assigned according to the feature importance or the feature correlation in the interaction network. i (t),w j (h v (k) ) represents the relationship between the i-th first intrusion behavior feature and the j-th second intrusion behavior feature, and its form can be defined according to the requirements. For example, when φ(v i (t),w j (h v (k) ) is the Euclidean distance, φ(v i (t),w j (h v (k) )=‖v i (t)-w j (h v (k) ‖ 2 , when φ(v i (t),w j (h v (k) ) is the correlation coefficient, φ(v i (t),w j (h v (k) )=1-corr(vi (t),w j (h v (k) ). After that, the first gradient of the loss function relative to the fusion layer weight matrix is ​​calculated, and the second gradient of the loss function relative to the target bias term is calculated. Through multiple forward propagation and back propagation, the initial fusion layer weight matrix and initial bias term of the fusion layer are gradually optimized by gradient descent until the loss function reaches the minimum value, that is, the convergence condition is met, and the initial fusion layer weight matrix and initial bias term at this time are used as the fusion layer weight matrix and target bias term.

[0051] Step S105: construct an intrusion behavior warning model, and output a warning result according to the intrusion behavior warning model by inputting target intrusion behavior characteristics.

[0052] Specifically, historical network security monitoring data is obtained, including historical blockchain transaction data, historical smart contract code data, and historical execution event log data; through feature extraction engineering, intrusion behavior feature training data in historical network security monitoring data is obtained, including the historical first intrusion behavior feature and the historical second intrusion behavior feature; an intrusion behavior warning model is constructed through the intrusion behavior feature training data: the extracted training data is preprocessed, including feature standardization, dimensionality reduction processing, and outlier removal operations to ensure data consistency and quality; then, based on the processed intrusion behavior feature training data, an intrusion behavior warning model is constructed using supervised learning methods or unsupervised learning methods. In the process of model construction, cross-validation and hyperparameter optimization techniques are introduced to ensure the adaptability and robustness of the model to multiple intrusion behavior patterns; finally, the trained model receives the input target intrusion behavior features, outputs the warning results of whether there is intrusion behavior, and provides decision support for further defense measures. Afterwards, based on the intrusion behavior warning model, the target intrusion behavior features are input, and the warning results are output according to the intrusion behavior warning model.

[0053] In a possible implementation, step S105 also includes: by inputting the target intrusion behavior characteristics, outputting the target warning threshold according to the intrusion behavior warning model; judging whether the target warning threshold is greater than the preset warning threshold; if the target warning threshold is greater than the preset warning threshold, confirming the warning result as encountering network intrusion behavior; if the target warning threshold is less than or equal to the preset warning threshold, confirming the warning result as not encountering network intrusion behavior.

[0054] Specifically, the target warning threshold represents the risk probability or confidence score that the model determines the current input feature as a network intrusion behavior. Subsequently, it is determined whether the target warning threshold is greater than the preset warning threshold. It should be noted that the preset threshold is set based on historical data statistics or business security requirements, such as a 95% confidence level. The embodiments in this application do not limit the setting of this threshold. If the target warning threshold is greater than the preset warning threshold, the warning result is confirmed to be a network intrusion behavior, and the corresponding defense mechanism or security review process is triggered; if the target warning threshold is less than or equal to the preset warning threshold, the warning result is confirmed to be no network intrusion behavior, and the result is recorded for further analysis. Through the above operations, an accurate quantitative evaluation of the target intrusion behavior characteristics is achieved, and a flexible intrusion behavior judgment mechanism is provided according to the dynamic changes of the output threshold of the warning model, which helps to reduce false alarms and missed alarms and improve the system's warning response efficiency.

[0055] The present application adopts the above method, when the user performs a monitoring operation on network intrusion behavior, obtains network security monitoring data, and obtains the first intrusion behavior feature in the network security monitoring data through static feature engineering extraction, and obtains the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering extraction, thereby performing feature fusion on the first intrusion behavior feature and the second intrusion behavior feature, and outputs the target intrusion behavior feature after feature fusion, constructs an intrusion behavior warning model, and outputs a warning result according to the intrusion behavior warning model by inputting the target intrusion behavior feature, and then realizes accurate identification and real-time warning of potential intrusion behaviors in the blockchain network through multi-feature fusion, greatly improving the accuracy of network security intrusion behavior warning, and solving the problem that the traditional intrusion warning method based on simple machine learning only relies on static or local features for judgment, thereby failing to capture the complex and multi-dimensional behavior patterns in the blockchain, and having high false alarm rate and missed alarm rate.

[0056] Please refer to Figure 2 , which shows a module schematic diagram of an intrusion behavior warning device based on machine learning provided in an embodiment of the present application, the device includes an acquisition module 21 and a processing module 22, wherein:

[0057] The acquisition module 21 is used to obtain network security monitoring data in response to the user's monitoring operation on network intrusion behavior, and the network security monitoring data includes blockchain transaction data, smart contract code data and execution event log data; obtain the first intrusion behavior feature in the network security monitoring data through static feature engineering extraction; obtain the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering extraction.

[0058] The processing module 22 is used to fuse the first intrusion behavior feature and the second intrusion behavior feature, and output the target intrusion behavior feature after the feature fusion; construct an intrusion behavior warning model, and output a warning result according to the intrusion behavior warning model by inputting the target intrusion behavior feature.

[0059] In one possible implementation, the acquisition module 21 is used to obtain a first intrusion behavior feature in the network security monitoring data through static feature engineering extraction, specifically including: obtaining contract state change data in the network security monitoring data, the contract state change data including memory state quantity change data, stack state quantity change data and register state quantity change data; determining whether there is state variable data in the contract state change data; if there is state variable data in the contract state change data, obtaining a first intrusion behavior feature in the network security monitoring data through static feature engineering extraction, the first intrusion behavior feature including a contract modification feature, an execution path feature and a rollback behavior feature.

[0060] In a possible implementation, the acquisition module 21 is used to obtain the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering extraction, specifically including: constructing an interactive network based on the network security monitoring data, the nodes of the interactive network are multiple transaction contracts in the blockchain, and the edges of the interactive network are call relationships between multiple transaction contracts; judging whether there is a call chain in the interactive network that attacks the transaction contract; if there is a call chain in the interactive network that attacks the transaction contract, extracting the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering.

[0061] In a possible implementation, the processing module 22 is used to perform feature fusion on the first intrusion behavior feature and the second intrusion behavior feature, and output the target intrusion behavior feature after the feature fusion: construct a fusion layer weight matrix and a target bias term, and perform weighted summation on the first intrusion behavior feature and the second intrusion behavior feature through the fusion layer weight matrix and the target bias term; use the intrusion behavior feature after the weighted summation as the target intrusion behavior feature, and output the target intrusion behavior feature through the following formula:

[0062]

[0063] Among them, F fusion is the target intrusion behavior feature, σ is the activation function, W fusion is the fusion layer weight matrix, v n (t) is the nth first intrusion behavior feature, F1(t) is the first feature vector corresponding to the first intrusion behavior feature, F2 is the second feature vector corresponding to the second intrusion behavior feature, λ1 is the weighting coefficient corresponding to the first intrusion behavior feature, λ2 is the weighting coefficient corresponding to the second intrusion behavior feature, bfusion is the target bias term, and b fusion =b1+b2, b1 is the dimension corresponding to the first intrusion behavior feature, b2 is the dimension corresponding to the second intrusion behavior feature, w m (h v (k) ) is the mth second intrusion behavior feature, h v (k) is the feature representation of the vth trading contract after the kth layer of graph convolution, is the set of adjacent points of the vth transaction contract, u is any transaction contract in the set of adjacent points, W (k) is the weight matrix of the graph convolutional network, h u (k-1) represents the feature representation of the u-th trading contract after the k-1th layer of graph convolution, b k is the bias term of the k-th layer of graph convolution.

[0064] In one possible implementation, the processing module 22 is used to construct a fusion layer weight matrix and a target bias term, specifically including: setting an initial fusion layer weight matrix and an initial bias term, and constructing a loss function; calculating a first gradient of the loss function relative to the fusion layer weight matrix, and calculating a second gradient of the loss function relative to the target bias term; updating the initial fusion layer weight matrix and the initial bias term by gradient descent according to the first gradient and the second gradient; and using the updated initial fusion layer weight matrix and the initial bias term that meet preset convergence conditions as the fusion layer weight matrix and the target bias term.

[0065] In one possible implementation, the processing module 22 is used to construct an intrusion behavior warning model, which specifically includes: obtaining historical network security monitoring data, the historical network security monitoring data includes historical blockchain transaction data, historical smart contract code data, and historical execution event log data; obtaining intrusion behavior feature training data in the historical network security monitoring data through feature extraction engineering; and constructing an intrusion behavior warning model through the intrusion behavior feature training data.

[0066] In a possible implementation, the processing module 22 is used to output a warning result according to an intrusion behavior warning model by inputting target intrusion behavior characteristics, specifically including: outputting a target warning threshold according to an intrusion behavior warning model by inputting target intrusion behavior characteristics; determining whether the target warning threshold is greater than a preset warning threshold; if the target warning threshold is greater than the preset warning threshold, confirming that the warning result is that a network intrusion behavior has been encountered; if the target warning threshold is less than or equal to the preset warning threshold, confirming that the warning result is that no network intrusion behavior has been encountered.

[0067] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0068] The present application also provides an electronic device. Figure 3 , Figure 3 30 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include: at least one processor 301, at least one communication bus 302, a user interface 303, at least one network interface 304, and a memory 305.

[0069] The communication bus 302 is used to realize the connection and communication between these components.

[0070] The user interface 303 may include a display screen (Display) and a camera (Camera). The optional user interface 303 may also include a standard wired interface and a wireless interface.

[0071] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0072] Among them, the processor 301 may include one or more processing cores. The processor 301 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 301 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 301, and it can be implemented separately through a chip.

[0073] Among them, the memory 305 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may optionally also be at least one storage device located away from the aforementioned processor 301. Refer to Figure 3 , the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an intrusion behavior warning application based on machine learning.

[0074] exist Figure 3In the electronic device shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 301 can be used to call the intrusion behavior warning application based on machine learning stored in the memory 305. When executed by one or more processors 301, the electronic device executes one or more of the methods described in the above embodiments. It should be noted that for the aforementioned method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited to the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0075] The present application also provides a computer-readable storage medium, which stores instructions. When executed by one or more processors, the electronic device executes one or more of the methods described in the above embodiments.

[0076] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0078] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0079] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0080] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: various media that can store program codes, such as USB flash drives, mobile hard drives, magnetic disks or optical disks.

[0081] The above are only exemplary embodiments disclosed in this application, and cannot be used to limit the scope of the disclosure of this application. That is, any equivalent changes and modifications made according to the teachings disclosed in this application are still within the scope of the disclosure of this application.

[0082] This application is intended to cover any modifications, uses or adaptive changes disclosed in this application, which follow the general principles disclosed in this application and include common knowledge or customary technical means in the technical field not recorded in this application.

Claims

1. A machine learning-based intrusion behavior early warning method, characterized in that: The method comprises: In response to a user's monitoring operation on network intrusion behavior, obtaining network security monitoring data, wherein the network security monitoring data includes blockchain transaction data, smart contract code data, and execution event log data; Extracting the first intrusion behavior feature in the network security monitoring data through static feature engineering; Extracting the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering; Performing feature fusion on the first intrusion behavior feature and the second intrusion behavior feature, and outputting a target intrusion behavior feature after feature fusion; An intrusion behavior warning model is constructed, and by inputting the target intrusion behavior characteristics, a warning result is output according to the intrusion behavior warning model.

2. The method according to claim 1, characterized in that The step of extracting the first intrusion behavior feature in the network security monitoring data through static feature engineering specifically includes: Acquire contract state change data in the network security monitoring data, wherein the contract state change data includes memory state quantity change data, stack state quantity change data, and register state quantity change data; Determine whether there is state variable data in the contract state change data; If the state variable data exists in the contract state change data, the first intrusion behavior feature in the network security monitoring data is obtained through the static feature engineering extraction, and the first intrusion behavior feature includes a contract modification feature, an execution path feature, and a rollback behavior feature.

3. The method according to claim 1, characterized in that The step of extracting the second intrusion behavior feature in the network security monitoring data through dynamic feature engineering specifically includes: According to the network security monitoring data, an interactive network is constructed, wherein the nodes of the interactive network are multiple transaction contracts in the blockchain, and the edges of the interactive network are call relationships between the multiple transaction contracts; Determining whether there is a call chain in the interactive network that attacks the transaction contract; If the call chain that attacks the transaction contract exists in the interactive network, the second intrusion behavior feature in the network security monitoring data is obtained through the dynamic feature engineering extraction.

4. The method according to claim 3, characterized in that The first intrusion behavior feature and the second intrusion behavior feature are subjected to feature fusion, and a target intrusion behavior feature after feature fusion is output: Constructing a fusion layer weight matrix and a target bias term, and performing a weighted summation of the first intrusion behavior feature and the second intrusion behavior feature through the fusion layer weight matrix and the target bias term; The weighted sum of the intrusion behavior features is used as the target intrusion behavior features, and the target intrusion behavior features are output through the following formula: Among them, F fusion is the target intrusion behavior feature, σ is the activation function, W fusion is the fusion layer weight matrix, v n (t) is the nth first intrusion behavior feature, F1(t) is the first feature vector corresponding to the first intrusion behavior feature, F2 is the second feature vector corresponding to the second intrusion behavior feature, λ1 is the weighting coefficient corresponding to the first intrusion behavior feature, λ2 is the weighting coefficient corresponding to the second intrusion behavior feature, b fusion is the target bias term, and b fusion =b1+b2, b1 is the dimension corresponding to the first intrusion behavior feature, b2 is the dimension corresponding to the second intrusion behavior feature, w m (h v (k) ) is the mth second intrusion behavior feature, h v (k) is the feature representation of the vth transaction contract after the kth layer of graph convolution, is the set of adjacent points of the vth transaction contract, u is any transaction contract in the set of adjacent points, W (k) is the weight matrix of the graph convolutional network, h u (k-1) represents the feature representation of the u-th transaction contract after the k-1th layer of graph convolution, b k is the bias term of the k-th layer of graph convolution.

5. The method according to claim 4, characterized in that The construction of the fusion layer weight matrix and the target bias term specifically includes: Set the initial fusion layer weight matrix and initial bias term, and construct the loss function; Calculating a first gradient of the loss function relative to the fusion layer weight matrix, and calculating a second gradient of the loss function relative to the target bias term; According to the first gradient and the second gradient, updating the initial fusion layer weight matrix and the initial bias term by gradient descent; The updated initial fusion layer weight matrix and the initial bias term that meet the preset convergence condition are used as the fusion layer weight matrix and the target bias term.

6. The method according to claim 1, characterized in that The construction of the intrusion behavior early warning model specifically includes: Obtaining historical network security monitoring data, wherein the historical network security monitoring data includes historical blockchain transaction data, historical smart contract code data, and historical execution event log data; Obtaining intrusion behavior feature training data from the historical network security monitoring data through feature extraction engineering; The intrusion behavior early warning model is constructed through the intrusion behavior feature training data.

7. The method according to claim 1, characterized in that The step of inputting the target intrusion behavior characteristics and outputting the warning result according to the intrusion behavior warning model specifically includes: By inputting the target intrusion behavior characteristics, outputting the target warning threshold according to the intrusion behavior warning model; Determine whether the target warning threshold is greater than a preset warning threshold; If the target warning threshold is greater than the preset warning threshold, then the warning result is confirmed to be a network intrusion behavior; If the target warning threshold is less than or equal to the preset warning threshold, the warning result is confirmed to be that no network intrusion behavior is encountered.

8. An intrusion behavior early warning device based on machine learning, characterized in that: The device comprises an acquisition module and a processing module, wherein: The acquisition module is used to obtain network security monitoring data in response to a user's monitoring operation on network intrusion behavior, wherein the network security monitoring data includes blockchain transaction data, smart contract code data, and execution event log data; obtain a first intrusion behavior feature in the network security monitoring data through static feature engineering extraction; and obtain a second intrusion behavior feature in the network security monitoring data through dynamic feature engineering extraction; The processing module is used to perform feature fusion on the first intrusion behavior feature and the second intrusion behavior feature, and output the target intrusion behavior feature after feature fusion; construct an intrusion behavior warning model, and output a warning result according to the intrusion behavior warning model by inputting the target intrusion behavior feature.

9. An electronic device, characterized in that: It includes a processor, a communication bus, a user interface, a network interface and a memory, wherein the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is performed.

Images