A switch security management and data integrity method based on blockchain technology

Abstract

The application discloses a kind of based on the security management and data integrity method of switch of blockchain technology, comprising the following steps: S1, in network deployment blockchain node, each switch is accessed as a node in blockchain network;S2, using chain structure stores the configuration data and operation log information of switch, and generates digital signature;S3, configure adaptive consensus mechanism;S4, using support vector machine algorithm, train threat prediction model, detect and identify known abnormal behavior and potential threat;S5, in combination with density-based clustering algorithm and improved isolated forest algorithm, the data in switch network is clustered analysis, identifies unknown abnormal behavior and potential security threat, and triggers early warning mechanism;S6, deploy smart contract, for switch permission management and configuration recovery operation;S7, provide user visual interface.The application realizes switch security management and data integrity by using adaptive consensus mechanism and smart contract.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a switch security management and data integrity method based on a blockchain technology. BACKGROUND

[0002] In modern network environments, switches serve as the core components of network infrastructure, undertaking key tasks such as data transmission, network traffic management, and multi-device interconnection. As network scales continue to expand and data transmission demands grow, switch management and security issues become particularly important. Traditional switch management relies mainly on centralized control and manual configuration, which is inadequate in dealing with increasingly complex network threats and dynamically changing network environments.

[0003] Firstly, traditional switch management systems usually adopt a centralized architecture, with all management and configuration operations handled by a central controller. This centralized management approach has obvious single-point failure risks, and if the central controller malfunctions, the entire network's management functions may be paralyzed. In addition, as network scales expand, the performance bottlenecks and resource consumption of centralized controllers become increasingly prominent, making it difficult to adapt to the needs of large-scale distributed network environments.

[0004] Secondly, data integrity protection in traditional switch management systems relies on trust mechanisms and simple encryption techniques. However, as network attack methods continue to evolve, security threats such as man-in-the-middle attacks, data tampering, and forgery are increasing, and existing security mechanisms have been unable to effectively address these challenges. In particular, in distributed network environments, data consistency and tamper resistance are difficult to fully guarantee, providing more opportunities for network attackers.

[0005] In terms of threat detection, traditional switch management systems usually rely on predefined rules and static security policies. This approach may be effective against known threats, but in the face of changing network attack patterns and new threats, traditional rule engines are difficult to respond and adjust in a timely manner. Especially in the face of zero-day attacks and advanced persistent threats, traditional detection methods show obvious lag and limitations.

[0006] In order to improve the ability of threat detection, in recent years some network security systems have begun to introduce machine learning technology, trying to predict potential threats through learning and analysis of historical data. However, existing machine learning applications are mostly limited to simple models, lacking the ability to analyze multi-dimensional data in complex network environments. In addition, existing machine learning models are usually based on a single algorithm, which cannot effectively adapt to dynamically changing network environments and diverse security needs.

[0007] In recent years, smart contract technology has been widely applied in the field of blockchain, and its automation, transparency and tamper-proof characteristics provide a new way of thinking for network security management. However, the existing smart contract in the application of network switch management is still in the initial exploration stage, mostly limited to simple permission management or operation record, and has not fully tapped the potential of smart contract in dynamic response and automatic recovery. In addition, due to the irreversibility of smart contract execution, once the contract design has defects or triggers errors, it may cause irreparable loss, and the existing smart contract design still needs to be further improved in terms of security and reliability.

[0008] The decentralized management based on blockchain technology provides a new architecture for the switch management system. Blockchain technology can ensure the consistency and tamper-proof of data in the network through distributed ledger and chain data structure, avoiding the risk of single point failure and providing higher security. However, the existing blockchain-based management system still has some deficiencies in performance and flexibility. In particular, in the selection of consensus mechanism, traditional blockchain systems usually use a single consensus algorithm, such as proof of work or proof of stake, which has different advantages and disadvantages under different network conditions, making it difficult to meet the diverse security requirements and performance requirements.

[0009] In terms of data integrity protection, although blockchain technology can provide a certain degree of tamper-proof ability, when facing high-frequency configuration changes and a large amount of log data, how to efficiently store and verify these data is still a challenge. In addition, the existing blockchain system is prone to performance bottlenecks when dealing with a large number of transactions, especially in large-scale network environments, which will slow down the consensus process and affect the overall system response speed and user experience.

[0010] In summary, the existing switch management and data security system has many problems in the face of complex network environment and new security threats, such as single point failure risk of centralized management, insufficient data integrity protection, threat detection lag and slow response, insufficient application of smart contract, and insufficient performance of blockchain system. These deficiencies limit the application of existing systems in large-scale distributed networks and cannot effectively cope with the current increasingly complex network security challenges.

[0011] Therefore, how to provide a switch security management and data integrity method based on blockchain technology is a problem that needs to be solved by those skilled in the art. SUMMARY

[0012] One objective of this invention is to propose a method for the security management and data integrity of switches based on blockchain technology. This invention fully utilizes blockchain technology, adaptive consensus mechanisms, machine learning algorithms, and smart contracts to systematically solve the problems of security management and data integrity of switches in complex network environments. By using a decentralized distributed ledger to ensure data immutability, and combining real-time monitoring and dynamic consensus mechanisms to achieve a balance between performance and security, and by automating permission management and configuration recovery through smart contracts, the system's security, flexibility, and response speed are significantly improved. Simultaneously, a user-friendly visual interface makes management more intuitive, thus improving the overall reliability and efficiency of the system.

[0013] A method for security management and data integrity of a switch based on blockchain technology according to an embodiment of the present invention includes the following steps:

[0014] S1. Deploy blockchain nodes in the network, connecting each switch as a node to the blockchain network. Each node maintains a complete distributed ledger, recording the switch's configuration data and operation logs.

[0015] S2. Use a chain structure to store the configuration data and operation log information of the switch. Each block contains the hash value of the previous block and generates a digital signature.

[0016] S3. Configure an adaptive consensus mechanism to monitor network load, number of nodes, transaction frequency and computing resource consumption in real time, and dynamically switch consensus algorithms according to the current network environment and security requirements.

[0017] S4. Using the support vector machine algorithm, based on the historical operation data of the switch, a threat prediction model is trained, and network traffic data is analyzed in real time to detect and identify known abnormal behaviors and potential threats.

[0018] S5. Combine density-based clustering algorithm and improved isolated forest algorithm to perform clustering analysis on data in switch network, identify unknown abnormal behavior and potential security threats, and trigger early warning mechanism;

[0019] S6. Deploy smart contracts for switch permission management and configuration recovery operations. When abnormal behavior is detected, the smart contract automatically triggers the recovery mechanism to reconfigure the affected switches or isolate the affected nodes.

[0020] S7. Provides a user-visual interface to display the system's operating status, detected abnormal behaviors, and implemented defense measures in real time.

[0021] Furthermore, S2 specifically includes:

[0022] S21. Divide the configuration data and operation log information of each switch into blocks according to time sequence to form several data blocks, each data block is denoted as B. i , where i represents the sequence number of the data block;

[0023] S22, For data block B i Perform hash processing using the SHA-256 algorithm to generate a fixed-length hash value H(B). i ), H(B i ) represents the i-th data block B i The hash value;

[0024] S23. Take the hash value H(B) of the previous data block. i ) and the content of the current data block. i+1 Concatenate the data to form the current data block B. i+1 Storage structure:

[0025] B i+1 ={H(B i )⊕Data i+1};

[0026] Here, ⊕ represents the operation of concatenating the hash value with the data content to ensure the association between the current data block and the previous data block;

[0027] S24. Digitally sign the concatenated data block structure using the switch's private key PrivateKey for the concatenated data H(B). i )⊕Data i+1 Encrypt and generate a digital signature Sig i+1 :

[0028] Sig i+1 =Encrypt PrivateKey (H(B i )⊕Data i+1 );

[0029] Among them, Encrypt PrivateKey (x) indicates that the data x is asymmetrically encrypted using the private key PrivateKey;

[0030] S25, Generate the digital signature Sig i+1 Append to current data block B i+1 Above, a complete chain-like data block structure is formed, and this data block B is... i+1 Stored in the distributed ledger of the blockchain:

[0031] B i+1 ={H(B i )⊕Data i+1 Sigi+1};

[0032] S26. Synchronize and verify data block B among all blockchain nodes in the network. i+1 By verifying the digital signature Sig i+1 The correctness of the data block is used to confirm its integrity and authenticity. The verification process is represented as follows:

[0033] Verify PublicKey (Sig i+1 )=H(B i )⊕Data i+1 ;

[0034] Among them, Verify PublicKey (x) indicates that the digital signature Sig is made using the exchange's public key, PublicKey. i+1 Verify to ensure the data has not been tampered with.

[0035] Furthermore, S3 specifically includes:

[0036] S31. Monitor key parameters in the network in real time, including network load L(t), number of nodes N(t), transaction frequency F(t), and computing resource consumption C(t), to form a time series dataset. Where t represents the time variable;

[0037] S32. Based on the monitored network parameters, calculate the current network security requirement index S(t) and performance requirement index P(t):

[0038]

[0039] Where α1, α2, α3, β1, β2 and β3 represent weighting coefficients, δ1 and δ2 represent adjustment coefficients, and λ1 represents the adjustment parameter for calculating resource consumption;

[0040] S33. When the security requirement index S(t) is high, the practical Byzantine fault-tolerant algorithm should be preferred as the consensus algorithm. The selection criteria for the practical Byzantine fault-tolerant algorithm are as follows:

[0041] PBFT if S(t)>γ1 and L(t)>γ2;

[0042] Wherein, γ1 and γ2 represent preset threshold parameters used to determine the current security requirements and network load of the system;

[0043] S34. When the computational resource consumption C(t) is large and the performance requirement index P(t) is high, the Proof-of-Stake algorithm is selected as the consensus algorithm. The selection criteria for the Proof-of-Stake algorithm are as follows:

[0044] PoS if C(t)>γ3 and P(t)>γ4;

[0045] Wherein, γ3 and γ4 represent threshold parameters for performance requirements and computational resource consumption, used to ensure that high system performance is maintained under limited resources;

[0046] S35. When the network load L(t) is low and the security requirement index S(t) is low, the Proof-of-Work algorithm is selected as the consensus algorithm. The selection criteria for the Proof-of-Work algorithm are as follows:

[0047] PoW if S(t)≤γ1 and L(t)≤γ2;

[0048] S36. Within each time interval Δt, the system automatically re-evaluates the current network parameters L(t+Δt), N(t+Δt), F(t+Δt), and C(t+Δt), and dynamically optimizes the consensus algorithm selection to ensure that the system always operates in the optimal state under different network conditions.

[0049]

[0050] Where θ1 and θ2 represent weighting coefficients, T switch T represents the time consumption required to switch consensus algorithms, and ε represents an adjustment parameter used to balance the relationship between the overhead of algorithm switching and system performance; by introducing T switch This ensures that the system can minimize the performance loss caused by switching consensus algorithms.

[0051] S37. Record the conditions, time, selected algorithm, network state, and performance changes brought about by each consensus algorithm switch, and store this information in the blockchain's distributed ledger using the following formula:

[0052] Record information = {t, selected algorithm, S(t), P(t), L(t), N(t), F(t), C(t), ΔP(t), ΔS(t)};

[0053] Where ΔP(t) represents the change in performance caused by algorithm switching, and ΔS(t) represents the change in security caused by algorithm switching.

[0054] Furthermore, S4 specifically includes:

[0055] S41. Collect historical operational data of the switch, including network traffic data X, switch configuration change log L, and abnormal event records E, wherein the network traffic data X consists of multiple feature vectors X i Composition, each feature vector X i Indicates time t i Traffic data on the platform:

[0056] X = {X1, X2, ..., X} n},X i ={x i1 ,x i2 ,…,x im};

[0057] S42. Preprocess the collected historical operation data, including normalization, noise reduction, feature selection, and label generation. The normalization process is expressed as follows:

[0058]

[0059] Where, x ij Let μ(x) represent the j-th feature of the i-th sample. j ) represents the mean of the j-th feature, σ(x) j )

[0060] Let x represent the standard deviation of the j-th feature. ij This represents the standardized value;

[0061] S43, in the preprocessed data X ′ The kernel method is extended by using a kernel function to map the data to a high-dimensional feature space. The radial basis function is chosen as the kernel function and is defined as follows:

[0062] K(X i ,X j )=exp(-γ3·∥X i -X j ∥ 2 );

[0063] Where γ3 represents the parameters of the kernel function, ∥X i -X j ∥ 2 Indicates sample X i and sample X j The square of the Euclidean distance between them;

[0064] S44, Based on kernel function K(X) i ,X j Train the support vector machine algorithm model, optimize the objective function, and find the hyperplane with the maximum classification margin:

[0065]

[0066] Where w represents the weight vector, b represents the bias term, and φ(X) i ) represents the feature vector mapped to a high-dimensional space through a kernel function, y i Indicates the label, ξ i X represents the relaxation amount, C represents the penalty coefficient, and X represents the penalty coefficient. iLet represent the input feature vector of the i-th sample, and n represent the number of samples;

[0067] S45, Real-time network traffic data X new Perform classification prediction, the prediction function is the classification result f(X) new ) is defined as:

[0068]

[0069] Where, α i Let represent the Lagrange multipliers, and represent the weights of the support vectors;

[0070] S46. Based on the prediction result f(X) new The sign of the new sample determines whether it belongs to normal or abnormal behavior;

[0071] S47. Based on the classification results, the detected abnormal behavior is recorded in the distributed ledger, and the corresponding security response mechanism is triggered. The recorded information includes a timestamp t. new eigenvector X new Kernel function value K(X) i ,X new ) and classification results f(X) new ), recorded as:

[0072] Record information = {t new ,X new ,K(X i ,X new ),f(X new )}.

[0073] Furthermore, S5 specifically includes:

[0074] S51. Collect traffic data and operation logs of all nodes in the switch network and represent them as a set of feature vectors.

[0075] S52. Perform preliminary clustering analysis on the feature vector set using a density-based clustering algorithm. The density-based clustering algorithm clusters data points based on their density. The condition for defining the core point p is as follows:

[0076] core(p) = {p||N ∈ (p)|≥MinPts};

[0077] Where, N ∈ (p) represents the set of points contained in the neighborhood of radius ∈, and MinPts represents the minimum threshold number of points contained in the neighborhood;

[0078] S53. Based on the conditions in S52, classify the feature vector set, identify core points, boundary points, and noise points, and generate multiple clusters C1, C2, ..., C6.m Each cluster C j Including a set of similar network behavioral characteristics;

[0079] S54. For each cluster C in the density-based clustering algorithm results j An improved Isolation Forest algorithm is used to identify potential anomalous behavior. This improved algorithm enhances anomaly detection accuracy by introducing distance-weighted and path-weighted mechanisms. The improved anomaly score s(x) is calculated as follows:

[0080]

[0081] Where M represents the number of decision trees in the forest, h t (x) represents the path length of sample x in the t-th tree, w t This represents the weight of the t-th tree. This indicates that sample x and cluster C j center of mass The distance between them, where c(n) represents the normalization factor and n represents the number of samples;

[0082] S55. Based on the anomaly score of the improved isolated forest algorithm, mark the abnormal behavior as a high-risk event and trigger an early warning mechanism, which includes sending an alert to the administrator and recording detailed information of the abnormal behavior on the blockchain.

[0083] S56. Record relevant information about each detected abnormal behavior in the distributed ledger of the blockchain:

[0084] Record information = {t x ,X x C j ,s(x)};

[0085] Among them, t x Represents a timestamp, X x This represents the eigenvector.

[0086] Furthermore, S6 specifically includes:

[0087] S61. Write a permission management smart contract to control the access permissions and configuration modification permissions of the switch. The permission management smart contract defines a set of permission levels P. i and operation O j , represented as:

[0088] P i ={O j |j∈{1,2,…,m}};

[0089] Among them, P i Represents the i-th permission level, O jThis indicates the executable operations, with permission levels assigned according to user or system roles, and user identity verified through encryption.

[0090] S62. Configure smart contracts for automatic recovery operations. When abnormal behavior is detected, the recovery smart contract executes configuration rollback or isolates the affected switches according to the preset recovery strategy.

[0091] S63. Smart contracts are deployed in a blockchain network and use a distributed consensus mechanism to ensure consistent execution results. The execution of a smart contract is completed through multiple transactions, each of which includes contract invocation, parameter passing, state updating, and result storage.

[0092] Transaction n ={Invoke n (Contract), Params n State n+1};

[0093] Among them, Transaction n Invoke represents the nth transaction. n (Contract) represents the smart contract invoked for the nth time, and Params n State represents the set of parameters passed. n+1 This indicates the result after the state update;

[0094] S64. When the system detects a configuration anomaly, the smart contract automatically triggers a configuration recovery operation or isolates the affected switch.

[0095] S65. The operation logs, execution results, and recovery status of smart contracts are all recorded in the distributed ledger of the blockchain. The information recorded for each recovery operation includes a timestamp T, the configuration before recovery Config(t), the configuration after recovery Config(t+1), and the relevant risk assessment R(t), represented as:

[0096] RecoveryLog={T,Config(t),Config(t+1),R(t)}.

[0097] The beneficial effects of this invention are:

[0098] This invention, by introducing blockchain technology, adaptive consensus mechanisms, machine learning algorithms, and smart contracts, successfully overcomes many shortcomings in existing switch security management and data integrity systems, significantly improving the system's security, reliability, and flexibility. First, by treating each switch as a node in the blockchain network, a distributed ledger system is constructed, freeing network management from reliance on a single central controller and effectively avoiding the risk of single points of failure. This decentralized architecture not only improves the overall stability of the system but also ensures data consistency and immutability, enhancing data security.

[0099] In terms of data storage and protection, this invention utilizes a chain structure and digital signature technology to store and encrypt the switch's configuration data and operation logs in blocks. Each data block contains the hash value of the previous data block, thus forming a tamper-proof chain data structure. This design ensures the integrity and authenticity of data during storage and transmission, further enhancing the system's defense capabilities and effectively resisting common network attack methods such as man-in-the-middle attacks and data tampering.

[0100] This invention also introduces an adaptive consensus mechanism, dynamically selecting the most suitable consensus algorithm based on real-time monitored network parameters, thus achieving a balance between security and performance. By selecting a practical Byzantine fault-tolerant algorithm when security requirements are high, a Proof-of-Stake algorithm when resource consumption is high, and a Proof-of-Work algorithm when network load is low, this invention can maintain optimal operation under different network environments. This adaptive consensus mechanism improves system flexibility, ensures optimal performance under different load and security requirements, and reduces resource waste during the consensus process.

[0101] In threat detection, this invention combines the Support Vector Machine (SVM) algorithm with an improved Isolation Forest algorithm. By learning from historical data and analyzing real-time data, it achieves efficient identification of both known and unknown threats. The SVM algorithm is used to train the threat prediction model, enabling timely detection of known anomalous behaviors in the network, while the improved Isolation Forest algorithm improves the detection accuracy of unknown anomalous behaviors by introducing path weighting and distance weighting mechanisms. The application of this dual algorithm allows the system to respond more quickly and accurately to zero-day attacks and advanced persistent threats, significantly enhancing the system's security protection capabilities.

[0102] Another significant advantage of this invention lies in the application of smart contracts. Smart contracts automate the management of switch permissions and configuration recovery operations. When the system detects abnormal behavior, the smart contract can automatically trigger a recovery mechanism to reconfigure the affected switches or isolate the affected nodes. This automated approach reduces the time and errors associated with human intervention, improving system responsiveness and security. Simultaneously, all operations and recovery processes are recorded in the distributed ledger of the blockchain, ensuring transparency and traceability, and providing reliable data support for subsequent auditing and analysis.

[0103] Furthermore, the user-friendly visual interface provided by this invention allows for real-time display of the system's operational status, detected abnormal behaviors, and implemented defensive measures, greatly enhancing the user's control over the system and management efficiency. Through this intuitive visualization, users can gain a clearer understanding of the network's security situation and take timely and appropriate management measures. Attached Figure Description

[0104] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0105] Fig. 1 This is a flowchart of a blockchain-based method for switch security management and data integrity proposed in this invention;

[0106] Fig. 2 This invention presents a flowchart of the adaptive consensus mechanism dynamic switching process for a blockchain-based method for switch security management and data integrity.

[0107] Fig. 3 This is a schematic diagram of the system architecture of a blockchain-based method for switch security management and data integrity proposed in this invention. Detailed Implementation

[0108] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0109] refer to Figs. 1-3 A method for security management and data integrity of a switch based on blockchain technology includes the following steps:

[0110] S1. Deploy blockchain nodes in the network, connecting each switch as a node to the blockchain network. Each node maintains a complete distributed ledger, recording the switch's configuration data and operation logs.

[0111] S2. Use a chain structure to store the configuration data and operation log information of the switch. Each block contains the hash value of the previous block and generates a digital signature.

[0112] S3. Configure an adaptive consensus mechanism to monitor network load, number of nodes, transaction frequency and computing resource consumption in real time, and dynamically switch consensus algorithms according to the current network environment and security requirements.

[0113] S4. Using the support vector machine algorithm, based on the historical operation data of the switch, a threat prediction model is trained, and network traffic data is analyzed in real time to detect and identify known abnormal behaviors and potential threats.

[0114] S5. Combine density-based clustering algorithm and improved isolated forest algorithm to perform clustering analysis on data in switch network, identify unknown abnormal behavior and potential security threats, and trigger early warning mechanism;

[0115] S6. Deploy smart contracts for switch permission management and configuration recovery operations. When abnormal behavior is detected, the smart contract automatically triggers the recovery mechanism to reconfigure the affected switches or isolate the affected nodes.

[0116] S7. Provides a user-visual interface to display the system's operating status, detected abnormal behaviors, and implemented defense measures in real time.

[0117] In this embodiment, S2 specifically includes:

[0118] S21. Divide the configuration data and operation log information of each switch into blocks according to time sequence to form several data blocks, each data block is denoted as B. i , where i represents the sequence number of the data block;

[0119] S22, For data block B i Perform hash processing using the SHA-256 algorithm to generate a fixed-length hash value H(B). i ), H(B i ) represents the i-th data block B i The hash value;

[0120] S23. Take the hash value H(B) of the previous data block. i ) and the content of the current data block. i+1 Concatenate the data to form the current data block B. i+1 Storage structure:

[0121] B i+1 ={H(B i )⊕Data i+1};

[0122] Here, ⊕ represents the operation of concatenating the hash value with the data content to ensure the association between the current data block and the previous data block;

[0123] S24. Digitally sign the concatenated data block structure using the switch's private key PrivateKey for the concatenated data H(B). i )⊕Data i+1 Encrypt and generate a digital signature Sig i+1 :

[0124] Sig i+1 =Encrypt PrivateKey (H(B i )⊕Data i+1 );

[0125] Among them, Encrypt PrivateKey (x) indicates that the data x is asymmetrically encrypted using the private key PrivateKey;

[0126] S25, Generate the digital signature Sig i+1 Append to current data block B i+1 Above, a complete chain-like data block structure is formed, and this data block B is... i+1 Stored in the distributed ledger of the blockchain:

[0127] B i+1 ={H(B i )⊕Data i+1 Sig i+1};

[0128] S26. Synchronize and verify data block B among all blockchain nodes in the network. i+1 By verifying the digital signature Sig i+1 The correctness of the data block is used to confirm its integrity and authenticity. The verification process is represented as follows:

[0129] Verify PublicKey (Sig i+1 )=H(B i )⊕Data i+1 ;

[0130] Among them, Verify PublicKey (x) indicates that the digital signature Sig is made using the exchange's public key, PublicKey. i+1 Verify to ensure the data has not been tampered with.

[0131] In this embodiment, S3 specifically includes:

[0132] S31. Monitor key parameters in the network in real time, including network load L(t), number of nodes N(t), transaction frequency F(t), and computing resource consumption C(t), to form a time series dataset. Where t represents the time variable;

[0133] S32. Based on the monitored network parameters, calculate the current network security requirement index S(t) and performance requirement index P(t):

[0134]

[0135] Where α1, α2, α3, β1, β2 and β3 represent weighting coefficients, δ1 and δ2 represent adjustment coefficients, and λ1 represents the adjustment parameter for calculating resource consumption;

[0136] S33. When the security requirement index S(t) is high, the practical Byzantine fault-tolerant algorithm should be preferred as the consensus algorithm. The selection criteria for the practical Byzantine fault-tolerant algorithm are as follows:

[0137] PBFT if S(t)>γ1 and L(t)>γ2;

[0138] Wherein, γ1 and γ2 represent preset threshold parameters used to determine the current security requirements and network load of the system;

[0139] S34. When the computational resource consumption C(t) is large and the performance requirement index P(t) is high, the Proof-of-Stake algorithm is selected as the consensus algorithm. The selection criteria for the Proof-of-Stake algorithm are as follows:

[0140] PoS if C(t)>γ3 and P(t)>γ4;

[0141] Wherein, γ3 and γ4 represent threshold parameters for performance requirements and computational resource consumption, used to ensure that high system performance is maintained under limited resources;

[0142] S35. When the network load L(t) is low and the security requirement index S(t) is low, the Proof-of-Work algorithm is selected as the consensus algorithm. The selection criteria for the Proof-of-Work algorithm are as follows:

[0143] PoW if S(t)≤γ1 and L(t)≤γ2;

[0144] S36. Within each time interval Δt, the system automatically re-evaluates the current network parameters L(t+Δt), N(t+Δt), F(t+Δt), and C(t+Δt), and dynamically optimizes the consensus algorithm selection to ensure that the system always operates in the optimal state under different network conditions.

[0145]

[0146] Where θ1 and θ2 represent weighting coefficients, T switch T represents the time consumption required to switch consensus algorithms, and ε represents an adjustment parameter used to balance the relationship between the overhead of algorithm switching and system performance; by introducing T switch This ensures that the system can minimize the performance loss caused by switching consensus algorithms.

[0147] S37. Record the conditions, time, selected algorithm, network state, and performance changes brought about by each consensus algorithm switch, and store this information in the blockchain's distributed ledger using the following formula:

[0148] Record information = {t, selected algorithm, S(t), P(t), L(t), N(t), F(t), C(t), ΔP(t), ΔS(t)};

[0149] Where ΔP(t) represents the change in performance caused by algorithm switching, and ΔS(t) represents the change in security caused by algorithm switching.

[0150] In this embodiment, S4 specifically includes:

[0151] S41. Collect historical operational data of the switch, including network traffic data X, switch configuration change log L, and abnormal event records E, wherein the network traffic data X consists of multiple feature vectors X i Composition, each feature vector X i Indicates time t i Traffic data on the platform:

[0152] X = {X1, X2, ..., X} n},X i ={x i1 ,x i2 ,…,x im};

[0153] S42. Preprocess the collected historical operation data, including normalization, noise reduction, feature selection, and label generation. The normalization process is expressed as follows:

[0154]

[0155] Where, x ij Let μ(x) represent the j-th feature of the i-th sample. j ) represents the mean of the j-th feature, σ(x) j ) represents the standard deviation of the j-th feature, x′ ij This represents the standardized value;

[0156] S43. Extend the kernel method on the preprocessed data X′, using a kernel function to map the data to a high-dimensional feature space. Choose the radial basis function as the kernel function, defined as:

[0157] K(X i ,X j )=exp(-γ3·∥X i -X j ∥ 2 );

[0158] Where γ3 represents the parameters of the kernel function, ∥X i -X j ∥ 2 Indicates sample X i and sample X j The square of the Euclidean distance between them;

[0159] S44, Based on kernel function K(X) i ,X j Train the support vector machine algorithm model, optimize the objective function, and find the hyperplane with the maximum classification margin:

[0160]

[0161] Where w represents the weight vector, b represents the bias term, and φ(X) i ) represents the feature vector mapped to a high-dimensional space through a kernel function, y i Indicates the label, ξ i X represents the relaxation amount, C represents the penalty coefficient, and X represents the penalty coefficient. i Let represent the input feature vector of the i-th sample, and n represent the number of samples;

[0162] S45, Real-time network traffic data X new Perform classification prediction, the prediction function is the classification result f(X) new ) is defined as:

[0163]

[0164] Where, α i Let represent the Lagrange multipliers, and represent the weights of the support vectors;

[0165] S46. Based on the prediction result f(X) new The sign of the new sample determines whether it belongs to normal or abnormal behavior;

[0166] S47. Based on the classification results, the detected abnormal behavior is recorded in the distributed ledger, and the corresponding security response mechanism is triggered. The recorded information includes a timestamp t. new eigenvector X new Kernel function value K(X) i,X new ) and classification results f(X) new ), recorded as:

[0167] Record information = {t new ,X new ,K(X i ,X new ),f(X new )}.

[0168] In this embodiment, S5 specifically includes:

[0169] S51. Collect traffic data and operation logs of all nodes in the switch network and represent them as a set of feature vectors.

[0170] S52. Perform preliminary clustering analysis on the feature vector set using a density-based clustering algorithm. The density-based clustering algorithm clusters data points based on their density. The condition for defining the core point p is as follows:

[0171] core(p) = {p||N ∈ (p)|≥MinPts};

[0172] Where, N ∈ (p) represents the set of points contained in the neighborhood of radius ∈, and MinPts represents the minimum threshold number of points contained in the neighborhood;

[0173] S53. Based on the conditions in S52, classify the feature vector set, identify core points, boundary points, and noise points, and generate multiple clusters C1, C2, ..., C6. m Each cluster C j Including a set of similar network behavioral characteristics;

[0174] S54. For each cluster C in the density-based clustering algorithm results j An improved Isolation Forest algorithm is used to identify potential anomalous behavior. This improved algorithm enhances anomaly detection accuracy by introducing distance-weighted and path-weighted mechanisms. The improved anomaly score s(x) is calculated as follows:

[0175]

[0176] Where M represents the number of decision trees in the forest, h t (x) represents the path length of sample x in the t-th tree, w t Let x-μ represent the weight of the t-th tree. Cj ∥ represents the relationship between sample x and cluster C. j The center of mass μ Cj The distance between them, where c(n) represents the normalization factor and n represents the number of samples;

[0177] S55. Based on the anomaly score of the improved isolated forest algorithm, mark the abnormal behavior as a high-risk event and trigger an early warning mechanism, which includes sending an alert to the administrator and recording detailed information of the abnormal behavior on the blockchain.

[0178] S56. Record relevant information about each detected abnormal behavior in the distributed ledger of the blockchain:

[0179] Record information = {t x ,X x C j ,s(x)};

[0180] Among them, t x Represents a timestamp, X x This represents the eigenvector.

[0181] In this embodiment, S6 specifically includes:

[0182] S61. Write a permission management smart contract to control the access permissions and configuration modification permissions of the switch. The permission management smart contract defines a set of permission levels P. i and operation O j , represented as:

[0183] P i ={O j |j∈{1,2,…,m}};

[0184] Among them, P i Represents the i-th permission level, O j This indicates the executable operations, with permission levels assigned according to user or system roles, and user identity verified through encryption.

[0185] S62. Configure smart contracts for automatic recovery operations. When abnormal behavior is detected, the recovery smart contract executes configuration rollback or isolates the affected switches according to the preset recovery strategy.

[0186] S63. Smart contracts are deployed in a blockchain network and use a distributed consensus mechanism to ensure consistent execution results. The execution of a smart contract is completed through multiple transactions, each of which includes contract invocation, parameter passing, state updating, and result storage.

[0187] Transaction n ={Invoke n (Contract), Params n State n+1};

[0188] Among them, Transaction nInvoke represents the nth transaction. n (Contract) represents the smart contract invoked for the nth time, and Params n State represents the set of parameters passed. n+1 This indicates the result after the state update;

[0189] S64. When the system detects a configuration anomaly, the smart contract automatically triggers a configuration recovery operation or isolates the affected switch.

[0190] S65. The operation logs, execution results, and recovery status of smart contracts are all recorded in the distributed ledger of the blockchain. The information recorded for each recovery operation includes a timestamp T, the configuration before recovery Config(t), the configuration after recovery Config(t+1), and the relevant risk assessment R(t), represented as:

[0191] RecoveryLog={T,Config(t),Config(t+1),R(t)}.

[0192] Example 1:

[0193] To verify the feasibility of this invention in practice, it was applied to the network infrastructure of a large multinational corporation, A. This company has thousands of switches distributed across multiple data centers and branch offices worldwide. The switches in each data center need to exchange data frequently, and branch offices around the world also rely on these switches for cross-border communication. Therefore, ensuring both data transmission efficiency and the security and integrity of switch management became a major challenge for the company.

[0194] First, the company deployed blockchain nodes on switches across all its data centers and branch offices globally, forming a distributed blockchain network. Each switch acts as a blockchain node, participating in the network's consensus mechanism and maintaining a complete distributed ledger that records all switch configuration data and operation logs. This decentralized management approach effectively addresses the risk of single points of failure in traditional centralized management, ensuring high availability across the entire network.

[0195] In daily operations, Company A's data center and branch offices experience extremely high network traffic, especially during peak periods such as data backups, software updates, and cross-border file transfers, where network load increases significantly. Under these circumstances, the adaptive consensus mechanism of this invention comes into play. The system monitors key parameters such as network load, number of nodes, transaction frequency, and computing resource consumption in real time, and dynamically switches consensus algorithms based on the current network environment and security requirements. For example, when network load and security requirements are high, the system prioritizes the Practical Byzantine Fault Tolerance (PBFT) algorithm for consensus to ensure data consistency and security; while when resource consumption is high but security requirements are relatively low, the system switches to the Proof-of-Stake algorithm to optimize the use of computing resources.

[0196] In a major security incident, the company discovered abnormal network traffic patterns on a switch in its European data center. Using the threat detection mechanism of this invention, a Support Vector Machine (SVM) model analyzed historical operational data and monitored the switch's network traffic in real time. The system quickly identified that the switch was under a distributed denial-of-service (DDoS) attack. Subsequently, the system further analyzed the abnormal behavior using an improved Isolation Forest algorithm, accurately locating the source of the abnormal traffic and the affected switch by introducing path-weighted and distance-weighted mechanisms.

[0197] In response to this attack, smart contracts were activated automatically. First, the access control smart contract executed immediately, isolating the attacked switch from the network and restricting its configuration change permissions to prevent attackers from further expanding the attack scope using the switch. Subsequently, the configuration recovery smart contract was activated, rolling back the affected switch's configuration to its last point in normal operation, thereby restoring its normal functionality. The entire response process was completed within seconds, ensuring network stability and security. Following this incident, all operation logs and recovery records were stored in the blockchain's distributed ledger for subsequent auditing and analysis.

[0198] In this incident, through the deployment of this invention, Company A achieved a rapid response when the network attack occurred, preventing the attack from spreading and restoring the network to normal operation in a very short time. In contrast, traditional switch management methods often require minutes or even hours to detect an attack and require manual intervention, while this invention significantly shortens the response time, thereby effectively reducing potential losses.

[0199] Table 1. Performance Comparison of Traditional System and Invention System in Key Indicators

[0200]

[0201]

[0202] Table 1 compares the performance of the traditional system and the system of the present invention on several key performance indicators, demonstrating the significant improvements of the present invention in switch security management and data integrity.

[0203] First, regarding detection time, traditional systems typically require an average of 5 minutes to detect abnormal behavior in the network. However, the system of this invention, through an adaptive consensus mechanism and an improved threat detection algorithm, reduces the detection time to 15 seconds, decreasing response latency by 99.5%. This significant time optimization is crucial for addressing real-time network threats and effectively prevents attack propagation.

[0204] Regarding anomaly detection accuracy, traditional systems achieve 85%, while the system of this invention, by combining Support Vector Machine (SVM) and an improved Isolation Forest algorithm, achieves 97% accuracy, representing a 12% improvement. This demonstrates that the present invention can more accurately identify abnormal behavior in the network, reduce false positives and false negatives, and improve the overall system reliability.

[0205] Traditional systems cannot provide similar functionality for automated configuration recovery, while the system of this invention can automatically complete configuration recovery within 8 seconds. Through the automatic execution mechanism of smart contracts, this invention achieves rapid response and recovery, effectively reducing the need for human intervention and improving the automation level of the system.

[0206] Traditional systems typically take anywhere from several minutes to several hours to complete the entire process from attack detection to network recovery, while the system of this invention can complete the entire process from detection to recovery in just 23 seconds. This significant improvement enables the system to quickly restore normal operation when dealing with urgent network threats, reducing potential losses and business interruptions.

[0207] Regarding the ability to handle abnormal data packets, although the traditional system and the system of this invention are roughly equivalent in processing capacity (both exceeding 500 packets / second), the system of this invention ensures the stability and accuracy of processing through distributed ledger and dynamic consensus mechanism, further improving the ability to cope with large-scale attacks.

[0208] Regarding data tampering, traditional systems occasionally experience data alteration, while the system of this invention completely eliminates such events through the immutability of blockchain. This improvement is significant for data integrity and system security, ensuring the reliability of operation logs and configuration data.

[0209] Operational consistency during operation is also an important indicator. In traditional systems, inconsistencies may exist in some operations, especially in large-scale network environments. However, the system of this invention, through a decentralized ledger and consensus mechanism, ensures the consistency and transparency of all operations, significantly improving operational consistency.

[0210] In terms of network security, traditional systems face the risk of single points of failure, which challenges the overall stability and security of the system. The system of this invention eliminates the risk of single points of failure through a distributed blockchain network, improving the overall network security and fault tolerance.

[0211] Finally, the system's response time and stability have also been greatly improved. Traditional systems typically take minutes to hours to respond to network threats and occasionally experience management failures, while the system of this invention can respond within seconds and maintain stable operation, ensuring high network availability.

[0212] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for security management and data integrity of a switch based on blockchain technology, characterized in that, Includes the following steps: S1. Deploy blockchain nodes in the network, connecting each switch as a node to the blockchain network. Each node maintains a complete distributed ledger, recording the switch's configuration data and operation logs. S2. Use a chain structure to store the configuration data and operation log information of the switch. Each block contains the hash value of the previous block and generates a digital signature. S3. Configure an adaptive consensus mechanism to monitor network load, number of nodes, transaction frequency and computing resource consumption in real time, and dynamically switch consensus algorithms according to the current network environment and security requirements. S4. Using the support vector machine algorithm, based on the historical operation data of the switch, a threat prediction model is trained, and network traffic data is analyzed in real time to detect and identify known abnormal behaviors and potential threats. S5. Combine density-based clustering algorithm and improved isolated forest algorithm to perform clustering analysis on data in switch network, identify unknown abnormal behavior and potential security threats, and trigger early warning mechanism; S6. Deploy smart contracts for switch permission management and configuration recovery operations. When the smart contract detects abnormal behavior, it automatically triggers the recovery mechanism to reconfigure the affected switches or isolate the affected nodes. S7. Provides a user-visual interface to display the system's operating status, detected abnormal behaviors, and implemented defense measures in real time.

2. The method for security management and data integrity of a switch based on blockchain technology according to claim 1, characterized in that, S2 specifically includes: S21. Divide the configuration data and operation log information of each switch into blocks according to time sequence to form several data blocks, each data block is denoted as B. i , where i represents the sequence number of the data block; S22, For data block B i Perform hash processing using the SHA-256 algorithm to generate a fixed-length hash value H(B). i ), H(B i ) represents the i-th data block B i The hash value; S23. The hash value H(B) of the previous data block... i ) and the content of the current data block i+1 Concatenate the data to form the current data block B. i+1 Storage structure: B i+1 ={H(B i )⊕Data i+1 }; Where ⊕ represents the concatenation operation between the hash value and the data content; S24. Digitally sign the concatenated data block structure using the switch's private key PrivateKey for the concatenated data H(B). i )⊕Data i+1 Encrypt and generate a digital signature Sig i+1 : Sig i+1 =Encrypt PrivateKey (H(B i )⊕Data i+1 ); Among them, Encrypt PrivateKey (x) indicates that the data x is asymmetrically encrypted using the private key PrivateKey; S25, Generate the digital signature Sig i+1 Append to current data block B i+1 Above, a complete chain-like data block structure is formed, and this data block B is... i+1 Stored in the distributed ledger of the blockchain: S26. Synchronize and verify data block B among all blockchain nodes in the network. i+1 By verifying the digital signature Sig i+1 The correctness of the data block is used to confirm its integrity and authenticity. The verification process is represented as follows: Among them, Verify PublicKey (x) indicates that the digital signature Sig is made using the exchange's public key, PublicKey. i+1 Verification is required.

3. The method for security management and data integrity of a switch based on blockchain technology according to claim 1, characterized in that, S3 specifically includes: S31. Monitor key parameters in the network in real time, including network load L(t), number of nodes N(t), transaction frequency F(t), and computing resource consumption C(t), to form a time series dataset. Where t represents the time variable; S32. Based on the monitored network parameters, calculate the current network security requirement index S(t) and performance requirement index P(t): Where α1, α2, α3, β1, β2 and β3 represent weighting coefficients, δ1 and δ2 represent adjustment coefficients, and λ1 represents the adjustment parameter for calculating resource consumption; S33. When the security requirement index S(t) is high, the practical Byzantine fault-tolerant algorithm should be preferred as the consensus algorithm. The selection criteria for the practical Byzantine fault-tolerant algorithm are as follows: PBFT if S(t)>γ1 and L(t)>γ2; Wherein, γ1 and γ2 represent preset threshold parameters used to determine the current security requirements and network load of the system; S34. When the computational resource consumption C(t) is large and the performance requirement index P(t) is high, the Proof-of-Stake algorithm is selected as the consensus algorithm. The selection criteria for the Proof-of-Stake algorithm are as follows: PoS if C(t)>γ3 and P(t)>γ4; Where γ3 and γ4 represent the threshold parameters for performance requirements and computing resource consumption; S35. When the network load L(t) is low and the security requirement index S(t) is low, the Proof-of-Work algorithm is selected as the consensus algorithm. The selection criteria for the Proof-of-Work algorithm are as follows: PoW if S(t)≤γ1 and L(t)≤γ2; S36. Within each time interval Δt, the system automatically re-evaluates the current network parameters L(t+Δt), N(t+Δt), F(t+Δt), and C(t+Δt), and dynamically optimizes the consensus algorithm selection: Where θ1 and θ2 represent weighting coefficients, T switch This represents the time required to switch consensus algorithms, and ε represents an adjustment parameter used to balance the relationship between the overhead of algorithm switching and system performance. S37. Record the conditions, time, selected algorithm, network state, and performance changes brought about by each consensus algorithm switch, and store them in the distributed ledger of the blockchain: Record information = {t, selected algorithm, S(t), P(t), L(t), N(t), F(t), C(t), ΔP(t), ΔS(t)}; Where ΔP(t) represents the change in performance caused by algorithm switching, and ΔS(t) represents the change in security caused by algorithm switching.

4. The method for security management and data integrity of a switch based on blockchain technology according to claim 1, characterized in that, S4 specifically includes: S41. Collect historical operational data of the switch, including network traffic data X, switch configuration change log L, and abnormal event records E, wherein the network traffic data X consists of multiple feature vectors X i Composition, each feature vector X i Indicates time t i Traffic data on the platform: X={X1,X2,…,X n },X i {x i1 ,x i2 ,…,x im }; S42. Preprocess the collected historical operation data, including normalization, noise reduction, feature selection, and label generation. The normalization process is expressed as follows: Where, x ij Let μ(x) represent the j-th feature of the i-th sample. j ) represents the mean of the j-th feature, σ(x) j ) represents the standard deviation of the j-th feature, x′ ij This represents the standardized value; S43. Extend the kernel method on the preprocessed data X′, using a kernel function to map the data to a high-dimensional feature space. Choose the radial basis function as the kernel function, defined as: K(X i ,X j )=exp(-γ3·∥X i -X j ∥ 2 ); Where γ3 represents the parameters of the kernel function, ∥X i -X j ∥ 2 Indicates sample X i and sample X j The square of the Euclidean distance between them; S44, Based on kernel function K(X) i ,X j Train the support vector machine algorithm model, optimize the objective function, and find the hyperplane with the maximum classification margin: Where w represents the weight vector, b represents the bias term, and φ(X) i ) represents the feature vector mapped to a high-dimensional space through a kernel function, y i Indicates the label, ξ i X represents the relaxation amount, C represents the penalty coefficient, and X represents the penalty coefficient. i Let represent the input feature vector of the i-th sample, and n represent the number of samples; S45, Real-time network traffic data X new Perform classification prediction, the prediction function is the classification result f(X) new ) is defined as: Where, α i Let represent the Lagrange multipliers, and represent the weights of the support vectors; S46. Based on the prediction result f(X) new The sign of the new sample determines whether it belongs to normal or abnormal behavior; S47. Based on the classification results, the detected abnormal behavior is recorded in the distributed ledger, and the corresponding security response mechanism is triggered. The recorded information includes a timestamp t. new eigenvector X new Kernel function value K(X) i ,X new ) and classification results f(X) new ), recorded as: Record information = {t new ,X new ,K(X i ,X new ),f(X new )}.

5. The method for security management and data integrity of a switch based on blockchain technology according to claim 1, characterized in that, S5 specifically includes: S51. Collect traffic data and operation logs of all nodes in the switch network and represent them as a set of feature vectors. S52. Perform preliminary clustering analysis on the feature vector set using a density-based clustering algorithm. The density-based clustering algorithm clusters data points based on their density. The condition for defining the core point p is as follows: core(p)={p||N ∈ (p)|≥MinPts}; Where, N ∈ (p) represents the set of points contained in the neighborhood of radius ∈, and MinPts represents the minimum threshold number of points contained in the neighborhood; S53. Based on the conditions in S52, classify the feature vector set, identify core points, boundary points, and noise points, and generate multiple clusters C1, C2, ..., C6. m Each cluster C j Including a set of similar network behavioral characteristics; S54. For each cluster C in the density-based clustering algorithm results j The improved Isolation Forest algorithm is used to identify potential anomalous behavior, and the improved anomaly score s(x) is calculated: Where M represents the number of decision trees in the forest, h t (x) represents the path length of sample x in the t-th tree, w t Let x-μ represent the weight of the t-th tree. Cj ∥ represents the relationship between sample x and cluster C. j The center of mass μ Cj The distance between them, where c(n) represents the normalization factor and n represents the number of samples; S55. Based on the anomaly score of the improved isolated forest algorithm, mark the abnormal behavior as a high-risk event and trigger an early warning mechanism, which includes sending an alert to the administrator and recording detailed information of the abnormal behavior on the blockchain. S56. Record relevant information about each detected abnormal behavior in the distributed ledger of the blockchain: Record information = {t x ,X x C j ,s(x)}; Among them, t x Represents a timestamp, X x This represents the eigenvector.

6. The method for security management and data integrity of a switch based on blockchain technology according to claim 1, characterized in that, S6 specifically includes: S61. Write a permission management smart contract to control the access permissions and configuration modification permissions of the switch. The permission management smart contract defines a set of permission levels P. i and operation O j , is represented as: P i ={O j ∣j∈{1,2,…,m}}; Among them, P i Represents the i-th permission level, O j This indicates the executable operations, with permission levels assigned according to user or system roles, and user identity verified through encryption. S62. Configure smart contracts for automatic recovery operations. When abnormal behavior is detected, the recovery smart contract executes configuration rollback or isolates the affected switches according to the preset recovery strategy. S63. Smart contracts are deployed in a blockchain network and use a distributed consensus mechanism to ensure consistent execution results. The execution of a smart contract is completed through multiple transactions, each of which includes contract invocation, parameter passing, state updating, and result storage. Transaction n ={Invoke n (Contract),Params n ,State n+1 }; Among them, Transaction n Invoke represents the nth transaction. n (Contract) represents the smart contract invoked for the nth time, and Params n State represents the set of parameters passed. n+1 This indicates the result after the state update; S64. When the system detects a configuration anomaly, the smart contract automatically triggers a configuration recovery operation or isolates the affected switch. S65. The operation logs, execution results, and recovery status of smart contracts are all recorded in the distributed ledger of the blockchain. The information recorded for each recovery operation includes a timestamp T, the configuration before recovery Config(t), the configuration after recovery Config(t+1), and the relevant risk assessment R(t), represented as: Recovery Log={T,Config(t),Config(t+1),R(t)}.

Images