Switch security management and data integrity method based on block chain technology

Abstract

The invention discloses a blockchain technology-based switch security management and data integrity method, which comprises the following steps of S1, deploying blockchain nodes in a network, and accessing each switch as a node to the blockchain network; s2, using a chain structure to store configuration data and operation log information of the switch, and generating a digital signature; s3, configuring an adaptive consensus mechanism; s4, training the threat prediction model by using a support vector machine algorithm, and detecting and identifying known abnormal behaviors and potential threats; s5, performing clustering analysis on the data in the switch network in combination with a density-based clustering algorithm and an improved isolated forest algorithm, identifying unknown abnormal behaviors and potential security threats, and triggering an early warning mechanism; s6, deploying a smart contract for switch authority management and configuration recovery operation; and S7, providing a user visual interface. According to the invention, a self-adaptive consensus mechanism and an intelligent contract are utilized, so that switch security management and data integrity are realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a switch security management and data integrity method based on blockchain technology. Background Art

[0002] In the modern network environment, switches, as core components of network infrastructure, undertake key tasks such as data transmission, network traffic management, and multi-device interconnection. With the continuous expansion of network scale and the growing demand for data transmission, switch management and security issues have become particularly important. Traditional switch management mainly relies on centralized control and manual configuration, which is inadequate to cope with increasingly complex network threats and dynamically changing network environments.

[0003] First, traditional switch management systems usually adopt a centralized architecture, with all management and configuration operations handled by a central controller. This centralized management approach has an obvious single point failure risk. Once a problem occurs in the central controller, the management function of the entire network may be paralyzed. In addition, as the scale of the network expands, the performance bottleneck and resource consumption problems of the centralized controller become more prominent, making it difficult to adapt to the needs of large-scale distributed network environments.

[0004] Secondly, data integrity protection in traditional switch management systems relies on trust mechanisms and simple encryption technologies. However, with the continuous evolution of network attack methods, security threats such as man-in-the-middle attacks, data tampering and forgery are increasing, and existing security mechanisms can no longer effectively cope with these challenges. Especially in a distributed network environment, data consistency and immutability are difficult to fully guarantee, which provides more opportunities for network attackers.

[0005] In terms of threat detection, traditional switch management systems usually rely on predefined rules and static security policies. This approach may be effective for known threats, but in the face of ever-changing network attack patterns and new threats, traditional rule engines are difficult to respond and adjust in a timely manner. Especially in the face of zero-day attacks and advanced persistent threats, traditional detection methods show obvious lags and limitations.

[0006] In order to improve the ability of threat detection, some network security systems have begun to introduce machine learning technology in recent years, trying to predict potential threats by learning and analyzing historical data. However, most existing machine learning applications are limited to simple models and lack the ability to deeply analyze multi-dimensional data in complex network environments. In addition, existing machine learning models are usually based on a single algorithm and cannot effectively adapt to dynamically changing network environments and diverse security needs.

[0007] Smart contract technology has been widely used in the blockchain field in recent years. Its automation, transparency and non-tamperability provide new ideas for network security management. However, the application of existing smart contracts in network switch management is still in the initial exploration stage, and most of them are limited to simple permission management or operation records, and the potential of smart contracts in dynamic response and automatic recovery has not been fully utilized. In addition, due to the irreversibility of smart contract execution, once there are defects in the contract design or trigger errors, it may lead to irreparable losses. The existing smart contract design still needs to be further improved in terms of security and reliability.

[0008] Decentralized management based on blockchain technology provides a new architectural approach for switch management systems. Through distributed ledgers and chain data structures, blockchain technology can ensure the data consistency and immutability of each node in the network, avoid the risk of single point failure, and provide higher security. However, existing blockchain-based management systems still have some shortcomings in terms of performance and flexibility. In particular, in the selection of consensus mechanisms, traditional blockchain systems usually use a single consensus algorithm, such as proof of work or proof of stake. These algorithms show different advantages and disadvantages under different network conditions and are difficult to meet diverse security and performance requirements.

[0009] In terms of data integrity protection, although blockchain technology can provide a certain degree of tamper-proof capabilities, it is still a challenge to efficiently store and verify this data when faced with high-frequency configuration changes and large amounts of log data. In addition, existing blockchain systems are prone to performance bottlenecks when processing a large number of transactions, especially in large-scale network environments. This bottleneck will slow down the consensus process, thereby affecting the overall system response speed and user experience.

[0010] In summary, when facing complex network environments and new security threats, the existing switch management and data security systems have many problems, such as the risk of single point failure of centralized management, insufficient data integrity protection, delayed threat detection and slow response, insufficient application of smart contracts, and insufficient performance of blockchain systems. These shortcomings limit the application of existing systems in large-scale distributed networks and cannot effectively cope with the increasingly complex network security challenges.

[0011] Therefore, how to provide a switch security management and data integrity method based on blockchain technology is an urgent problem that technicians in this field need to solve. Summary of the invention

[0012] One purpose of the present invention is to propose a switch security management and data integrity method based on blockchain technology. The present invention makes full use of blockchain technology, adaptive consensus mechanism, machine learning algorithm and smart contract to systematically solve the switch security management and data integrity problems in complex network environments. The decentralized distributed ledger ensures that data cannot be tampered with, combines real-time monitoring and dynamic consensus mechanism to achieve a balance between performance and security, and automates permission management and configuration recovery through smart contracts, significantly improving the security, flexibility and response speed of the system. At the same time, the user visualization interface makes management more intuitive, and improves the reliability and efficiency of the system as a whole.

[0013] A switch security management and data integrity method based on blockchain technology according to an embodiment of the present invention includes the following steps:

[0014] S1. Deploy blockchain nodes in the network and connect each switch to the blockchain network as a node. Each node maintains a complete distributed ledger to record the switch's configuration data and operation logs.

[0015] S2. Use a chain structure to store the switch configuration data and operation log information. Each block contains the hash value of the previous block and generates a digital signature.

[0016] S3. Configure an adaptive consensus mechanism to monitor network load, number of nodes, transaction frequency, and computing resource consumption in real time, and dynamically switch consensus algorithms based on the current network environment and security requirements;

[0017] S4. Use the support vector machine algorithm to train the threat prediction model based on the historical operation data of the switch, and analyze the network traffic data in real time to detect and identify known abnormal behaviors and potential threats;

[0018] S5. Combine the density-based clustering algorithm and the improved isolation forest algorithm to perform cluster analysis on the data in the switch network, identify unknown abnormal behaviors and potential security threats, and trigger an early warning mechanism;

[0019] S6. Deploy smart contracts for switch permission management and configuration recovery operations. When abnormal behavior is detected, the smart contracts automatically trigger the recovery mechanism to reconfigure the affected switches or isolate the affected nodes.

[0020] S7. Provide a user visualization interface to visualize the system's operating status, detected abnormal behaviors, and executed defense measures in real time.

[0021] Furthermore, the S2 specifically includes:

[0022] S21, the configuration data and operation log information of each switch are processed in block order in time to form several data blocks, each of which is recorded as B i , where i represents the sequence number of the data block;

[0023] S22, data block B i Perform hash processing and use the SHA-256 algorithm to generate a fixed-length hash value H(B i ), H(B i ) represents the i-th data block B i The hash value of

[0024] S23, the hash value H(B i ) and the content of the current data block Data i+1 Concatenate to form the current data block B i+1 Storage structure:

[0025] B i+1 ={H(B i )⊕Data i+1};

[0026] Among them, ⊕ indicates the connection operation between the hash value and the data content to ensure the relevance of the current data block with the previous data block;

[0027] S24, digitally sign the concatenated data block structure, and use the private key of the switch to sign the concatenated data H(B i )⊕Data i+1 Encrypt and generate digital signature Sig i+1 :

[0028] Sig i+1 =Encrypt PrivateKey (H(B i )⊕Data i+1 );

[0029] Among them, Encrypt PrivateKey (x) indicates that the data x is asymmetrically encrypted using the private key PrivateKey;

[0030] S25, the generated digital signature Sig i+1 Append to current data block B i+1 On the chain, a complete data block structure is formed, and the data block B i+1 Stored in the distributed ledger of the blockchain:

[0031] B i+1 ={H(B i )⊕Data i+1 ,Sigi+1};

[0032] S26. Synchronize and verify data block B among all blockchain nodes in the network i+1 , by verifying the digital signature Sig i+1 The correctness of the data block is used to confirm its integrity and authenticity. The verification process is expressed as:

[0033] Verify PublicKey (Sig i+1 )=H(B i )⊕Data i+1 ;

[0034] Among them, Verify PublicKey (x) indicates the use of the switch's public key PublicKey to digitally sign Sig i+1 Verification is performed to ensure that the data has not been tampered with.

[0035] Furthermore, the S3 specifically includes:

[0036] S31. Real-time monitoring of key parameters in the network, including network load L(t), number of nodes N(t), transaction frequency F(t) and computing resource consumption C(t), to form a time series data set Where t represents the time variable;

[0037] S32. Calculate the security requirement index S(t) and performance requirement index P(t) of the current network based on the monitored network parameters:

[0038]

[0039] Among them, α1, α2, α3, β1, β2 and β3 represent weight coefficients, δ1 and δ2 represent adjustment coefficients, and λ1 represents the adjustment parameter of computing resource consumption;

[0040] S33. When the security requirement index S(t) is high, the Practical Byzantine Fault Tolerant algorithm is preferred as the consensus algorithm. The selection conditions of the Practical Byzantine Fault Tolerant algorithm are:

[0041] PBFT if S(t)>γ1 and L(t)>γ2;

[0042] Among them, γ1 and γ2 represent preset threshold parameters, which are used to judge the current security requirements and network load of the system;

[0043] S34. When the computing resource consumption C(t) is large and the performance requirement index P(t) is high, the proof-of-stake algorithm is selected as the consensus algorithm. The selection conditions of the proof-of-stake algorithm are:

[0044] PoS if C(t)>γ3 and P(t)>γ4;

[0045] Among them, γ3 and γ4 represent the threshold parameters of performance requirements and computing resource consumption, which are used to ensure that high system performance is maintained under limited resources;

[0046] S35. When the network load L(t) is low and the security requirement index S(t) is low, the proof-of-work algorithm is selected as the consensus algorithm. The selection conditions of the proof-of-work algorithm are:

[0047] PoW if S(t)≤γ1 and L(t)≤γ2;

[0048] S36. In each time interval Δt, the system automatically re-evaluates the current network parameters L(t+Δt), N(t+Δt), F(t+Δt) and C(t+Δt), and dynamically optimizes the consensus algorithm selection to ensure that the system always runs in the best state under different network conditions:

[0049]

[0050] Among them, θ1 and θ2 represent weight coefficients, T switch represents the time consumption required to switch the consensus algorithm, and ε represents the adjustment parameter, which is used to balance the relationship between the cost of algorithm switching and system performance. By introducing T switch , ensuring that when the system switches the consensus algorithm, the performance loss caused by switching can be minimized.

[0051] S37. Record the conditions, time, selected algorithm, network status, and performance changes caused by each consensus algorithm switch, and store this information in the distributed ledger of the blockchain using the following formula:

[0052] Record information = {t, selected algorithm, S(t), P(t), L(t), N(t), F(t), C(t), ΔP(t), ΔS(t)};

[0053] Among them, ΔP(t) represents the change in performance caused by algorithm switching, and ΔS(t) represents the change in security caused by algorithm switching.

[0054] Furthermore, the S4 specifically includes:

[0055] S41, collect historical operation data of the switch, including network flow data X, switch configuration change log L and abnormal event record E, where the network flow data X is composed of multiple feature vectors X i Composition, each feature vector X i Indicates that at time t i Traffic data on:

[0056] X={X1,X2,…,X n},X i ={x i1 ,x i2 ,…,x im};

[0057] S42, preprocessing the collected historical operation data, including normalization, denoising, feature selection and label generation. The normalization process is expressed as:

[0058]

[0059] Among them, x ij represents the jth feature of the i-th sample, μ(x j ) represents the mean of the jth feature, σ(x j )

[0060] represents the standard deviation of the jth feature, x ij Represents the standardized value;

[0061] S43, after preprocessing data X ′ The kernel method is extended on the basis of the kernel function, and the data is mapped to a high-dimensional feature space using the kernel function. The radial basis function is selected as the kernel function and is defined as:

[0062] K(X i ,X j ) = exp(-γ3·∥X i -X j ∥ 2 );

[0063] Among them, γ3 represents the parameter of the kernel function, ∥X i -X j ∥ 2 Represents sample X i and sample X j The square of the Euclidean distance between them;

[0064] S44, based on the kernel function K(X i ,X j ), train the support vector machine algorithm model, optimize the objective function, and find the hyperplane with the maximum classification interval:

[0065]

[0066] Among them, w represents the weight vector, b represents the bias term, φ(X i ) represents the feature vector mapped to the high-dimensional space by the kernel function, y i represents the label, ξ i represents the relaxation amount, C represents the penalty coefficient, X irepresents the input feature vector of the i-th sample, and n represents the number of samples;

[0067] S45. Real-time network traffic data X new Perform classification prediction and predict the classification result of the function f(X new ) is defined as:

[0068]

[0069] Among them, α i represents the Lagrange multiplier, which represents the weight of the support vector;

[0070] S46, according to the prediction result f(X new ) sign to determine whether the new sample belongs to normal behavior or abnormal behavior;

[0071] S47. Based on the classification results, the detected abnormal behavior is recorded in the distributed ledger and the corresponding security response mechanism is triggered. The recorded information includes the timestamp t new , eigenvector X new 、Kernel function value K(X i ,X new ) and classification results f(X new ), recorded as:

[0072] Record information = {t new ,X new ,K(X i ,X new ),f(X new )}.

[0073] Furthermore, the S5 specifically includes:

[0074] S51, collecting the flow data and operation logs of all nodes in the switch network, and expressing them as a feature vector set;

[0075] S52. Perform a preliminary clustering analysis on the feature vector set using a density-based clustering algorithm. The density-based clustering algorithm performs clustering according to the density of the data points. The condition for defining the core point p is:

[0076] core(p)={p||N ∈ (p)|≥MinPts};

[0077] Among them, N ∈ (p) represents the set of points contained in the neighborhood with radius ∈, and MinPts represents the minimum threshold of the number of points contained in the neighborhood;

[0078] S53, according to the conditions of S52, classify the feature vector set, identify the core points, boundary points and noise points, and generate multiple clusters C1, C2, ..., Cm , where each cluster C j Includes a set of similar network behavior characteristics;

[0079] S54, for each cluster C in the density-based clustering algorithm result j The improved isolation forest algorithm is used to identify potential abnormal behaviors. The improved isolation forest algorithm improves the accuracy of anomaly detection by introducing distance weighting and path weighting mechanisms. The improved anomaly score s(x) is calculated:

[0080]

[0081] Where M represents the number of decision trees in the forest, h t (x) represents the path length of sample x in the tth tree, w t represents the weight of the tth tree, Represents sample x and cluster C j The centroid The distance between them, c(n) represents the normalization factor, and n represents the number of samples;

[0082] S55. According to the anomaly score of the improved isolation forest algorithm, the abnormal behavior is marked as a high-risk event and an early warning mechanism is triggered, which includes sending an alert to the administrator and recording detailed information of the abnormal behavior on the blockchain;

[0083] S56. Record the relevant information of each abnormal behavior detected in the distributed ledger of the blockchain:

[0084] Record information = {t x ,X x ,C j ,s(x)};

[0085] Among them, t x Indicates the timestamp, X x represents a feature vector.

[0086] Furthermore, the S6 specifically includes:

[0087] S61. Write a permission management smart contract to control the access rights and configuration modification rights of the switch. The permission management smart contract defines a set of permission levels P i and Operation O j , expressed as:

[0088] P i = {O j |j∈{1,2,…,m}};

[0089] Among them, P i represents the i-th permission level, O jIndicates executable operations, the permission level is assigned according to the user or system role, and the user identity is verified in an encrypted manner;

[0090] S62. Configure the smart contract for automatic recovery operations. When abnormal behavior is detected, the recovery smart contract performs configuration rollback or isolates the affected switch according to a preset recovery strategy;

[0091] S63. Smart contracts are deployed in the blockchain network and use a distributed consensus mechanism to ensure that the execution results of the contract are consistent. The execution of smart contracts is completed through multiple transactions, each of which includes contract call, parameter transfer, status update and result storage:

[0092] Transaction n ={Invoke n (Contract),Params n ,State n+1};

[0093] Among them, Transaction n Indicates the nth transaction, Invoke n (Contract) indicates the smart contract called for the nth time, Params n Indicates the parameter set passed, State n+1 Indicates the result after the status is updated;

[0094] S64. When the system detects a configuration anomaly, the smart contract automatically triggers a configuration recovery operation or isolates the affected switch;

[0095] S65. The operation log, execution results and recovery status of the smart contract are all recorded in the distributed ledger of the blockchain. The information recorded for each recovery operation includes the timestamp T, the configuration before recovery Config(t), the configuration after recovery Config(t+1) and the related risk assessment R(t), expressed as:

[0096] RecoveryLog={T,Config(t),Config(t+1),R(t)}.

[0097] The beneficial effects of the present invention are:

[0098] The present invention successfully overcomes many deficiencies in existing switch security management and data integrity systems by introducing blockchain technology, adaptive consensus mechanism, machine learning algorithm and smart contracts, and significantly improves the security, reliability and flexibility of the system. First, by using each switch as a node in the blockchain network, a distributed ledger system is constructed, so that network management no longer relies on a single central controller, thereby effectively avoiding the risk of single point failure. This decentralized architecture not only improves the overall stability of the system, but also ensures the consistency and immutability of the data, and enhances the security of the data.

[0099] In terms of data storage and protection, the present invention uses chain structure and digital signature technology to store and encrypt the switch configuration data and operation log in blocks, and each data block contains the hash value of the previous data block, thus forming a tamper-proof chain data structure. This design ensures the integrity and authenticity of data during storage and transmission, further improves the system's defense capabilities, and effectively resists common network attacks such as man-in-the-middle attacks and data tampering.

[0100] The present invention also introduces an adaptive consensus mechanism, which dynamically selects the most suitable consensus algorithm based on the real-time monitored network parameters, thus achieving a balance between security and performance. By selecting a practical Byzantine fault-tolerant algorithm when security requirements are high, a proof-of-stake algorithm when resource consumption is high, and a proof-of-work algorithm when network load is low, the present invention can always maintain the best operating state under different network environments. This adaptive consensus mechanism improves the flexibility of the system, ensures optimal performance under different load and security requirements, and reduces resource waste in the consensus process.

[0101] In terms of threat detection, the present invention combines the support vector machine (SVM) algorithm and the improved isolation forest algorithm, and realizes efficient identification of known and unknown threats by learning historical data and analyzing real-time data. The SVM algorithm is used to train the threat prediction model, which can detect known abnormal behaviors in the network in a timely manner, while the improved isolation forest algorithm improves the detection accuracy of unknown abnormal behaviors by introducing path weighting and distance weighting mechanisms. The application of this dual algorithm enables the system to respond more quickly and accurately when dealing with zero-day attacks and advanced persistent threats, significantly enhancing the security protection capabilities of the system.

[0102] Another significant advantage of the present invention is the application of smart contracts. Smart contracts can be used to automate switch authority management and configuration recovery operations. When the system detects abnormal behavior, smart contracts can automatically trigger recovery mechanisms to reconfigure affected switches or isolate affected nodes. This automated processing method reduces the time and errors of human intervention and improves the response speed and security of the system. At the same time, all operations and recovery processes are recorded in the distributed ledger of the blockchain, ensuring the transparency and traceability of operations and providing reliable data support for subsequent audits and analysis.

[0103] In addition, the user visualization interface provided by the present invention enables real-time display of the system's operating status, detected abnormal behaviors, and executed defense measures, greatly improving the user's control over the system and management efficiency. Through this intuitive visualization, users can more clearly understand the security situation in the network and take corresponding management measures in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0104] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0105] Figure 1 This is a flow chart of a switch security management and data integrity method based on blockchain technology proposed by the present invention;

[0106] Figure 2 This is a flow chart of dynamic switching of an adaptive consensus mechanism for a switch security management and data integrity method based on blockchain technology proposed by the present invention;

[0107] Figure 3 This is a schematic diagram of the system architecture of a switch security management and data integrity method based on blockchain technology proposed in the present invention. DETAILED DESCRIPTION

[0108] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0109] refer to Figure 1-3 , a switch security management and data integrity method based on blockchain technology, comprising the following steps:

[0110] S1. Deploy blockchain nodes in the network and connect each switch to the blockchain network as a node. Each node maintains a complete distributed ledger to record the switch's configuration data and operation logs.

[0111] S2. Use a chain structure to store the switch configuration data and operation log information. Each block contains the hash value of the previous block and generates a digital signature.

[0112] S3. Configure an adaptive consensus mechanism to monitor network load, number of nodes, transaction frequency, and computing resource consumption in real time, and dynamically switch consensus algorithms based on the current network environment and security requirements;

[0113] S4. Use the support vector machine algorithm to train the threat prediction model based on the historical operation data of the switch, and analyze the network traffic data in real time to detect and identify known abnormal behaviors and potential threats;

[0114] S5. Combine the density-based clustering algorithm and the improved isolation forest algorithm to perform cluster analysis on the data in the switch network, identify unknown abnormal behaviors and potential security threats, and trigger an early warning mechanism;

[0115] S6. Deploy smart contracts for switch permission management and configuration recovery operations. When abnormal behavior is detected, the smart contracts automatically trigger the recovery mechanism to reconfigure the affected switches or isolate the affected nodes.

[0116] S7. Provide a user visualization interface to visualize the system's operating status, detected abnormal behaviors, and executed defense measures in real time.

[0117] In this implementation, S2 specifically includes:

[0118] S21, the configuration data and operation log information of each switch are processed in block order in time to form several data blocks, each of which is recorded as B i , where i represents the sequence number of the data block;

[0119] S22, data block B i Perform hash processing and use the SHA-256 algorithm to generate a fixed-length hash value H(B i ), H(B i ) represents the i-th data block B i The hash value of

[0120] S23, the hash value H(B i ) and the content of the current data block Data i+1 Concatenate to form the current data block B i+1 Storage structure:

[0121] B i+1 ={H(B i )⊕Data i+1};

[0122] Among them, ⊕ indicates the connection operation between the hash value and the data content to ensure the relevance of the current data block with the previous data block;

[0123] S24, digitally sign the concatenated data block structure, and use the private key of the switch to sign the concatenated data H(B i )⊕Data i+1 Encrypt and generate digital signature Sig i+1 :

[0124] Sig i+1 =Encrypt PrivateKey (H(B i )⊕Data i+1 );

[0125] Among them, Encrypt PrivateKey (x) indicates that the data x is asymmetrically encrypted using the private key PrivateKey;

[0126] S25, the generated digital signature Sig i+1 Append to current data block B i+1 On the chain, a complete data block structure is formed, and the data block B i+1 Stored in the distributed ledger of the blockchain:

[0127] B i+1 ={H(B i )⊕Data i+1 ,Sig i+1};

[0128] S26. Synchronize and verify data block B among all blockchain nodes in the network i+1 , by verifying the digital signature Sig i+1 The correctness of the data block is used to confirm its integrity and authenticity. The verification process is expressed as:

[0129] Verify PublicKey (Sig i+1 )=H(B i )⊕Data i+1 ;

[0130] Among them, Verify PublicKey (x) indicates the use of the switch's public key PublicKey to digitally sign Sig i+1 Verification is performed to ensure that the data has not been tampered with.

[0131] In this implementation, S3 specifically includes:

[0132] S31. Real-time monitoring of key parameters in the network, including network load L(t), number of nodes N(t), transaction frequency F(t) and computing resource consumption C(t), to form a time series data set Where t represents the time variable;

[0133] S32. Calculate the security requirement index S(t) and performance requirement index P(t) of the current network based on the monitored network parameters:

[0134]

[0135] Among them, α1, α2, α3, β1, β2 and β3 represent weight coefficients, δ1 and δ2 represent adjustment coefficients, and λ1 represents the adjustment parameter of computing resource consumption;

[0136] S33. When the security requirement index S(t) is high, the Practical Byzantine Fault Tolerant algorithm is preferred as the consensus algorithm. The selection conditions of the Practical Byzantine Fault Tolerant algorithm are:

[0137] PBFT if S(t)>γ1 and L(t)>γ2;

[0138] Among them, γ1 and γ2 represent preset threshold parameters, which are used to judge the current security requirements and network load of the system;

[0139] S34. When the computing resource consumption C(t) is large and the performance requirement index P(t) is high, the proof-of-stake algorithm is selected as the consensus algorithm. The selection conditions of the proof-of-stake algorithm are:

[0140] PoS if C(t)>γ3 and P(t)>γ4;

[0141] Among them, γ3 and γ4 represent the threshold parameters of performance requirements and computing resource consumption, which are used to ensure that high system performance is maintained under limited resources;

[0142] S35. When the network load L(t) is low and the security requirement index S(t) is low, the proof-of-work algorithm is selected as the consensus algorithm. The selection conditions of the proof-of-work algorithm are:

[0143] PoW if S(t)≤γ1 and L(t)≤γ2;

[0144] S36. In each time interval Δt, the system automatically re-evaluates the current network parameters L(t+Δt), N(t+Δt), F(t+Δt) and C(t+Δt), and dynamically optimizes the consensus algorithm selection to ensure that the system always runs in the best state under different network conditions:

[0145]

[0146] Among them, θ1 and θ2 represent weight coefficients, T switch represents the time consumption required to switch the consensus algorithm, and ε represents the adjustment parameter, which is used to balance the relationship between the cost of algorithm switching and system performance. By introducing T switch , ensuring that when the system switches the consensus algorithm, the performance loss caused by switching can be minimized.

[0147] S37. Record the conditions, time, selected algorithm, network status, and performance changes caused by each consensus algorithm switch, and store this information in the distributed ledger of the blockchain using the following formula:

[0148] Record information = {t, selected algorithm, S(t), P(t), L(t), N(t), F(t), C(t), ΔP(t), ΔS(t)};

[0149] Among them, ΔP(t) represents the change in performance caused by algorithm switching, and ΔS(t) represents the change in security caused by algorithm switching.

[0150] In this implementation, S4 specifically includes:

[0151] S41, collect historical operation data of the switch, including network flow data X, switch configuration change log L and abnormal event record E, where the network flow data X is composed of multiple feature vectors X i Composition, each feature vector X i Indicates that at time t i Traffic data on:

[0152] X={X1,X2,…,X n},X i ={x i1 ,x i2 ,…,x im};

[0153] S42, preprocessing the collected historical operation data, including normalization, denoising, feature selection and label generation. The normalization process is expressed as:

[0154]

[0155] Among them, x ij represents the jth feature of the i-th sample, μ(x j ) represents the mean of the jth feature, σ(x j ) represents the standard deviation of the jth feature, x′ ij Represents the standardized value;

[0156] S43, perform kernel method expansion on the preprocessed data X′, use kernel function to map the data to high-dimensional feature space, select radial basis function as kernel function, and define it as:

[0157] K(X i ,X j ) = exp(-γ3·∥X i -X j ∥ 2 );

[0158] Among them, γ3 represents the parameter of the kernel function, ∥X i -X j ∥ 2 Represents sample X i and sample X j The square of the Euclidean distance between them;

[0159] S44, based on the kernel function K(X i ,X j ), train the support vector machine algorithm model, optimize the objective function, and find the hyperplane with the maximum classification interval:

[0160]

[0161] Among them, w represents the weight vector, b represents the bias term, φ(X i ) represents the feature vector mapped to the high-dimensional space by the kernel function, y i represents the label, ξ i represents the relaxation amount, C represents the penalty coefficient, X i represents the input feature vector of the i-th sample, and n represents the number of samples;

[0162] S45. Real-time network traffic data X new Perform classification prediction and predict the classification result of the function f(X new ) is defined as:

[0163]

[0164] Among them, α i represents the Lagrange multiplier, which represents the weight of the support vector;

[0165] S46, according to the prediction result f(X new ) sign to determine whether the new sample belongs to normal behavior or abnormal behavior;

[0166] S47. Based on the classification results, the detected abnormal behavior is recorded in the distributed ledger and the corresponding security response mechanism is triggered. The recorded information includes the timestamp t new , eigenvector X new 、Kernel function value K(X i,X new ) and classification results f(X new ), recorded as:

[0167] Record information = {t new ,X new ,K(X i ,X new ),f(X new )}.

[0168] In this implementation manner, S5 specifically includes:

[0169] S51, collecting the flow data and operation logs of all nodes in the switch network, and expressing them as a feature vector set;

[0170] S52. Perform a preliminary clustering analysis on the feature vector set using a density-based clustering algorithm. The density-based clustering algorithm performs clustering according to the density of the data points. The condition for defining the core point p is:

[0171] core(p)={p||N ∈ (p)|≥MinPts};

[0172] Among them, N ∈ (p) represents the set of points contained in the neighborhood with radius ∈, and MinPts represents the minimum threshold of the number of points contained in the neighborhood;

[0173] S53, according to the conditions of S52, classify the feature vector set, identify the core points, boundary points and noise points, and generate multiple clusters C1, C2, ..., C m , where each cluster C j Includes a set of similar network behavior characteristics;

[0174] S54, for each cluster C in the density-based clustering algorithm result j The improved isolation forest algorithm is used to identify potential abnormal behaviors. The improved isolation forest algorithm improves the accuracy of anomaly detection by introducing distance weighting and path weighting mechanisms. The improved anomaly score s(x) is calculated:

[0175]

[0176] Where M represents the number of decision trees in the forest, h t (x) represents the path length of sample x in the tth tree, w t represents the weight of the tth tree, ∥x-μ Cj ∥ represents sample x and cluster C j The center of mass μ Cj The distance between them, c(n) represents the normalization factor, and n represents the number of samples;

[0177] S55. According to the anomaly score of the improved isolation forest algorithm, the abnormal behavior is marked as a high-risk event and an early warning mechanism is triggered, which includes sending an alert to the administrator and recording detailed information of the abnormal behavior on the blockchain;

[0178] S56. Record the relevant information of each abnormal behavior detected in the distributed ledger of the blockchain:

[0179] Record information = {t x ,X x ,C j ,s(x)};

[0180] Among them, t x Indicates the timestamp, X x represents a feature vector.

[0181] In this implementation manner, S6 specifically includes:

[0182] S61. Write a permission management smart contract to control the access rights and configuration modification rights of the switch. The permission management smart contract defines a set of permission levels P i and Operation O j , expressed as:

[0183] P i = {O j |j∈{1,2,…,m}};

[0184] Among them, P i represents the i-th permission level, O j Indicates executable operations, the permission level is assigned according to the user or system role, and the user identity is verified in an encrypted manner;

[0185] S62. Configure the smart contract for automatic recovery operations. When abnormal behavior is detected, the recovery smart contract performs configuration rollback or isolates the affected switch according to a preset recovery strategy;

[0186] S63. Smart contracts are deployed in the blockchain network and use a distributed consensus mechanism to ensure that the execution results of the contract are consistent. The execution of smart contracts is completed through multiple transactions, each of which includes contract call, parameter transfer, status update and result storage:

[0187] Transaction n ={Invoke n (Contract),Params n ,State n+1};

[0188] Among them, Transaction nIndicates the nth transaction, Invoke n (Contract) indicates the smart contract called for the nth time, Params n Indicates the parameter set passed, State n+1 Indicates the result after the status is updated;

[0189] S64. When the system detects a configuration anomaly, the smart contract automatically triggers a configuration recovery operation or isolates the affected switch;

[0190] S65. The operation log, execution results and recovery status of the smart contract are all recorded in the distributed ledger of the blockchain. The information recorded for each recovery operation includes the timestamp T, the configuration before recovery Config(t), the configuration after recovery Config(t+1) and the related risk assessment R(t), expressed as:

[0191] RecoveryLog={T,Config(t),Config(t+1),R(t)}.

[0192] Embodiment 1:

[0193] In order to verify the feasibility of the present invention in implementation, the present invention is applied to the network infrastructure of a large multinational company A, which has thousands of switches distributed in multiple data centers and branches around the world. The switches in each data center need to exchange data frequently, and branches around the world also rely on these switches for cross-border communications. Therefore, how to ensure the security of switch management and data integrity while ensuring data transmission efficiency has become a major challenge facing the company.

[0194] First, the company deployed blockchain nodes on switches in all its data centers and branches around the world to form a distributed blockchain network. Each switch, as a blockchain node, participates in the consensus mechanism of the entire network and maintains a complete distributed ledger to record the configuration data and operation logs of all switches. This decentralized management method effectively solves the risk of single point failure in traditional centralized management and ensures high availability of the entire network.

[0195] In daily operations, the network traffic of company A's data center and branches is very busy, especially during peak periods such as data backup, software updates, and cross-border file transfers, the network load increases significantly. In this case, the adaptive consensus mechanism of the present invention comes into play. The system monitors key parameters such as network load, number of nodes, transaction frequency, and computing resource consumption in real time, and dynamically switches consensus algorithms according to the current network environment and security requirements. For example, when the network load and security requirements are high, the system gives priority to the Practical Byzantine Fault Tolerance algorithm (PBFT) for consensus to ensure data consistency and security; when resource consumption is large but security requirements are relatively low, the system switches to the Proof of Stake algorithm to optimize the use of computing resources.

[0196] In a major security incident, the company discovered that a switch in its European data center exhibited abnormal network traffic characteristics. Through the threat detection mechanism of the present invention, the support vector machine (SVM) model analyzed historical operation data and monitored the network traffic of the switch in real time. The system quickly identified that the switch was suffering from a distributed denial of service attack. Then, the system further analyzed the abnormal behavior using the improved isolation forest algorithm, and accurately located the source of the abnormal traffic and the affected switch by introducing path weighting and distance weighting mechanisms.

[0197] In response to the attack, smart contracts were automatically activated. First, the permission management smart contract was immediately executed to isolate the attacked switch from the network and restrict its configuration change permissions to prevent the attacker from using the switch to further expand the scope of the attack. Subsequently, the configuration recovery smart contract was activated to roll back the configuration of the affected switch to the last time point of normal operation, thereby restoring its normal function. The entire response process was completed in just a few seconds, ensuring the stability and security of the network. After this incident, all operation logs and recovery records are stored in the distributed ledger of the blockchain for subsequent audit and analysis.

[0198] In this incident, through the deployment of the present invention, Company A achieved a rapid response when a network attack occurred, avoided the spread of the attack, and restored the normal operation of the network in a very short time. In contrast, traditional switch management methods often take minutes or even hours to detect attacks and perform manual intervention, while the present invention significantly shortens the response time, thereby effectively reducing potential losses.

[0199] Table 1 Performance comparison of the traditional system and the system of the present invention in terms of key indicators

[0200]

[0201]

[0202] Table 1 compares the performance of the conventional system and the system of the present invention in terms of multiple key performance indicators, demonstrating the significant improvements of the present invention in terms of switch security management and data integrity.

[0203] First, in terms of detection time, traditional systems usually take an average of 5 minutes to detect abnormal behavior in the network, while the system of the present invention shortens the detection time to 15 seconds through an adaptive consensus mechanism and an improved threat detection algorithm, reducing the response delay by 99.5%. This significant time optimization is crucial for responding to real-time network threats and can effectively prevent the spread of attacks.

[0204] In terms of abnormality recognition accuracy, the recognition accuracy of the traditional system is 85%, while the system of the present invention achieves a recognition accuracy of 97% by combining the support vector machine (SVM) and the improved isolation forest algorithm, which is an increase of 12%. This shows that the present invention can more accurately identify abnormal behaviors in the network, reduce false positives and false negatives, and improve the reliability of the overall system.

[0205] Traditional systems cannot provide similar functions for automatic configuration recovery, but the system of the present invention can automatically complete configuration recovery within 8 seconds. Through the automatic execution mechanism of smart contracts, the present invention achieves rapid response and recovery, effectively reduces the need for human intervention, and improves the automation level of the system.

[0206] In terms of the total time from attack detection to network recovery, traditional systems usually take several minutes to several hours, while the system of the present invention can complete the entire process from detection to recovery in just 23 seconds. This significant improvement enables the present invention to quickly restore normal operation when responding to emergency network threats, reducing potential losses and business interruptions.

[0207] In terms of the ability to process abnormal data packets, although the traditional system and the system of the present invention are roughly equivalent in processing capacity (both exceeding 500 per second), the system of the present invention ensures the stability and accuracy of processing through a distributed ledger and a dynamic consensus mechanism, further improving the ability to cope with large-scale attacks.

[0208] In terms of data tampering incidents, traditional systems occasionally tamper with data, but the system of the present invention completely eliminates the occurrence of data tampering incidents through the immutability of blockchain. This improvement is of great significance to data integrity and system security, ensuring the reliability of operation logs and configuration data.

[0209] Operational consistency during operation is also an important indicator. In traditional systems, some operations may be inconsistent, especially in large-scale network environments. The system of the present invention ensures the consistency and transparency of all operations through a decentralized ledger and consensus mechanism, significantly improving operational consistency.

[0210] In terms of network security, traditional systems face the risk of single point failure, which challenges the overall stability and security of the system. The system of the present invention eliminates the risk of single point failure through a distributed blockchain network, thereby improving the security and fault tolerance of the overall network.

[0211] Finally, the response time and stability of the system have also been greatly improved. When dealing with network threats, the traditional system usually takes several minutes to several hours to respond, and occasionally management failures occur. However, the system of the present invention can respond within seconds and maintain stable operation of the system, ensuring high availability of the network.

[0212] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A switch security management and data integrity method based on blockchain technology, characterized in that: The steps include: S1. Deploy blockchain nodes in the network and connect each switch to the blockchain network as a node. Each node maintains a complete distributed ledger to record the switch's configuration data and operation logs. S2. Use a chain structure to store the switch configuration data and operation log information. Each block contains the hash value of the previous block and generates a digital signature. S3. Configure an adaptive consensus mechanism to monitor network load, number of nodes, transaction frequency, and computing resource consumption in real time, and dynamically switch consensus algorithms based on the current network environment and security requirements; S4. Use the support vector machine algorithm to train the threat prediction model based on the historical operation data of the switch, and analyze the network traffic data in real time to detect and identify known abnormal behaviors and potential threats; S5. Combine the density-based clustering algorithm and the improved isolation forest algorithm to perform cluster analysis on the data in the switch network, identify unknown abnormal behaviors and potential security threats, and trigger an early warning mechanism; S6. Deploy smart contracts for switch permission management and configuration recovery operations. When abnormal behavior is detected, the smart contracts automatically trigger the recovery mechanism to reconfigure the affected switches or isolate the affected nodes. S7. Provide a user visualization interface to visualize the system's operating status, detected abnormal behaviors, and executed defense measures in real time.

2. According to a method for switch security management and data integrity based on blockchain technology according to claim 1, it is characterized in that: The S2 specifically includes: S21, the configuration data and operation log information of each switch are processed in block order in time to form several data blocks, each of which is recorded as B i , where i represents the sequence number of the data block; S22, data block B i Perform hash processing and use the SHA-256 algorithm to generate a fixed-length hash value H(B i ), H(B i ) represents the i-th data block B i The hash value of S23, the hash value H(B i ) and the content of the current data block Data i+1 Concatenate to form the current data block B i+1 Storage structure: B i+1 ={H(B i )⊕Data i+1 }; Among them, ⊕ indicates the connection operation between the hash value and the data content; S24, digitally sign the concatenated data block structure, and use the private key of the switch to sign the concatenated data H(B i )⊕Data i+1 Encrypt and generate digital signature Sig i+1 : Sig i+1 =Encrypt PrivateKey (H(B i )⊕Data i+1 ); Among them, Encrypt PrivateKey (x) indicates that the data x is asymmetrically encrypted using the private key PrivateKey; S25, the generated digital signature Sig i+1 Append to current data block B i+1 On the chain, a complete data block structure is formed, and the data block B i+1 Stored in the distributed ledger of the blockchain: S26. Synchronize and verify data block B among all blockchain nodes in the network i+1 , by verifying the digital signature Sig i+1 The correctness of the data block is used to confirm its integrity and authenticity. The verification process is expressed as: Among them, Verify PublicKey (x) indicates the use of the switch's public key PublicKey to digitally sign Sig i+1 to verify.

3. According to a method for switch security management and data integrity based on blockchain technology according to claim 1, it is characterized in that: The S3 specifically includes: S31. Real-time monitoring of key parameters in the network, including network load L(t), number of nodes N(t), transaction frequency F(t) and computing resource consumption C(t), to form a time series data set Where t represents the time variable; S32. Calculate the security requirement index S(t) and performance requirement index P(t) of the current network based on the monitored network parameters: Among them, α1, α2, α3, β1, β2 and β3 represent weight coefficients, δ1 and δ2 represent adjustment coefficients, and λ1 represents the adjustment parameter of computing resource consumption; S33. When the security requirement index S(t) is high, the Practical Byzantine Fault Tolerant algorithm is preferred as the consensus algorithm. The selection conditions of the Practical Byzantine Fault Tolerant algorithm are: PBFT if S(t)>γ1 and L(t)>γ2; Among them, γ1 and γ2 represent preset threshold parameters, which are used to judge the current security requirements and network load of the system; S34. When the computing resource consumption C(t) is large and the performance requirement index P(t) is high, the proof-of-stake algorithm is selected as the consensus algorithm. The selection conditions of the proof-of-stake algorithm are: PoS if C(t)>γ3 and P(t)>γ4; Among them, γ3 and γ4 represent the threshold parameters of performance requirements and computing resource consumption; S35. When the network load L(t) is low and the security requirement index S(t) is low, the proof-of-work algorithm is selected as the consensus algorithm. The selection conditions of the proof-of-work algorithm are: PoW if S(t)≤γ1 and L(t)≤γ2; S36. Within each time interval Δt, the system automatically re-evaluates the current network parameters L(t+Δt), N(t+Δt), F(t+Δt) and C(t+Δt), and dynamically optimizes the consensus algorithm selection: Among them, θ1 and θ2 represent weight coefficients, T switch It represents the time consumption required to switch the consensus algorithm, and ε represents the adjustment parameter, which is used to balance the relationship between the cost of algorithm switching and system performance; S37. Record the conditions, time, selected algorithm, network status, and performance changes caused by each consensus algorithm switch, and store them in the distributed ledger of the blockchain: Record information = {t, selected algorithm, S(t), P(t), L(t), N(t), F(t), C(t), ΔP(t), ΔS(t)}; Among them, ΔP(t) represents the change in performance caused by algorithm switching, and ΔS(t) represents the change in security caused by algorithm switching.

4. According to a method for switch security management and data integrity based on blockchain technology according to claim 1, it is characterized in that: The S4 specifically includes: S41, collect historical operation data of the switch, including network flow data X, switch configuration change log L and abnormal event record E, where the network flow data X is composed of multiple feature vectors X i Composition, each feature vector X i Indicates that at time t i Traffic data on: X={X1,X2,…,X n },X i {x i1 , x i2 ,…,x im }; S42, preprocessing the collected historical operation data, including normalization, denoising, feature selection and label generation. The normalization process is expressed as: Among them, x ij represents the jth feature of the i-th sample, μ(x j ) represents the mean of the jth feature, σ(x j ) represents the standard deviation of the jth feature, x′ ij Represents the standardized value; S43, perform kernel method expansion on the preprocessed data X′, use kernel function to map the data to high-dimensional feature space, select radial basis function as kernel function, and define it as: K(X i ,X j )=exp(-γ3·∥X i -X j ∥ 2 ); Among them, γ3 represents the parameter of the kernel function, ∥X i -X j ∥ 2 Represents sample X i and sample X j The square of the Euclidean distance between them; S44, based on the kernel function K(X i ,X j ), train the support vector machine algorithm model, optimize the objective function, and find the hyperplane with the maximum classification interval: Among them, w represents the weight vector, b represents the bias term, φ(X i ) represents the feature vector mapped to the high-dimensional space by the kernel function, y i represents the label, ξ i represents the relaxation amount, C represents the penalty coefficient, X i represents the input feature vector of the i-th sample, and n represents the number of samples; S45. Real-time network traffic data X new Perform classification prediction and predict the classification result of the function f(X new ) is defined as: Among them, α i represents the Lagrange multiplier, which represents the weight of the support vector; S46, according to the prediction result f(X new ) sign to determine whether the new sample belongs to normal behavior or abnormal behavior; S47. Based on the classification results, the detected abnormal behavior is recorded in the distributed ledger and the corresponding security response mechanism is triggered. The recorded information includes the timestamp t new , eigenvector X new 、Kernel function value K(X i ,X new ) and classification results f(X new ), recorded as: Record information = {t new ,X new ,K(X i ,X new ),f(X new )}.

5. According to a method for switch security management and data integrity based on blockchain technology according to claim 1, it is characterized in that: The S5 specifically includes: S51, collecting the flow data and operation logs of all nodes in the switch network, and expressing them as a feature vector set; S52. Perform a preliminary clustering analysis on the feature vector set using a density-based clustering algorithm. The density-based clustering algorithm performs clustering according to the density of the data points. The condition for defining the core point p is: core(p)={p||N ∈ (p)|≥MinPts}; Among them, N ∈ (p) represents the set of points contained in the neighborhood with radius ∈, and MinPts represents the minimum threshold of the number of points contained in the neighborhood; S53, according to the conditions of S52, classify the feature vector set, identify the core points, boundary points and noise points, and generate multiple clusters C1, C2, ..., C m , where each cluster C j Includes a set of similar network behavior characteristics; S54, for each cluster C in the density-based clustering algorithm result j Use the improved isolation forest algorithm to identify potential abnormal behaviors and calculate the improved anomaly score s(x): Where M represents the number of decision trees in the forest, h t (x) represents the path length of sample x in the tth tree, w t represents the weight of the tth tree, ∥x-μ Cj ∥ represents sample x and cluster C j The center of mass μ Cj The distance between them, c(n) represents the normalization factor, and n represents the number of samples; S55. According to the anomaly score of the improved isolation forest algorithm, the abnormal behavior is marked as a high-risk event and an early warning mechanism is triggered, which includes sending an alert to the administrator and recording detailed information of the abnormal behavior on the blockchain; S56. Record the relevant information of each abnormal behavior detected in the distributed ledger of the blockchain: Record information = {t x ,X x ,C j ,s(x)}; Among them, t x Indicates the timestamp, X x represents a feature vector.

6. A switch security management and data integrity method based on blockchain technology according to claim 1, characterized in that: The S6 specifically includes: S61. Write a permission management smart contract to control the access rights and configuration modification rights of the switch. The permission management smart contract defines a set of permission levels P i and Operation O j , expressed as: P i ={O j ∣j∈{1,2,…,m}}; Among them, P i represents the i-th permission level, O j Indicates executable operations, the permission level is assigned according to the user or system role, and the user identity is verified in an encrypted manner; S62. Configure the smart contract for automatic recovery operations. When abnormal behavior is detected, the recovery smart contract performs configuration rollback or isolates the affected switch according to a preset recovery strategy; S63. Smart contracts are deployed in the blockchain network and use a distributed consensus mechanism to ensure that the execution results of the contract are consistent. The execution of smart contracts is completed through multiple transactions, each of which includes contract call, parameter transfer, status update and result storage: Transaction n ={Invoke n (Contract),Params n ,State n+1 }; Among them, Transaction n Indicates the nth transaction, Invoke n (Contract) indicates the smart contract called for the nth time, Params n Indicates the set of parameters passed, State n+1 Indicates the result after the status is updated; S64. When the system detects a configuration anomaly, the smart contract automatically triggers a configuration recovery operation or isolates the affected switch; S65. The operation log, execution results and recovery status of the smart contract are all recorded in the distributed ledger of the blockchain. The information recorded for each recovery operation includes the timestamp T, the configuration before recovery Config(t), the configuration after recovery Config(t+1) and the related risk assessment R(t), expressed as: Recovery Log={T,Config(t),Config(t+1),R(t)}.

Images