Network interaction information security monitoring system based on block chain

Abstract

The invention discloses a network interaction information security monitoring system based on a block chain, and relates to the field of data security, the system comprises a monitoring center, the monitoring center is in communication connection with a data acquisition module, a block chain construction module, an integrity detection module, an anomaly detection module and a feedback module; the method comprises the following steps: acquiring network interaction information data, constructing a network data block chain, mapping the acquired network interaction information data into the constructed network data block chain, detecting the integrity of the network interaction information data in the network data block chain, and judging whether the network interaction information data is tampered or not in an interaction process; according to the method, the network interaction information data in the network data block chain is subjected to anomaly detection, whether the network interaction information data is abnormal or not is judged, feedback is performed according to integrity detection and anomaly detection results, integrity detection and anomaly detection are performed, and the security of network data interaction is further improved.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a network interactive information security monitoring system based on blockchain. Background Art

[0002] With the popularization and application of the Internet, network interaction has become an important part of daily life and business activities. However, the accompanying information security issues have also become increasingly prominent. Traditional network security measures are stretched to the limit in dealing with increasingly complex and diverse network attacks. The emergence of blockchain technology provides a new approach to solving these problems.

[0003] How to perform integrity detection and anomaly detection on the network data after interaction, and provide feedback based on the results of integrity detection and anomaly detection, so as to determine whether the network data after interaction has been tampered with or is abnormal, and further improve the security of network data interaction, is a problem we need to solve. To this end, we now provide a network interaction information security monitoring system based on blockchain. Summary of the invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide a network interaction information security monitoring system based on blockchain.

[0005] The object of the present invention can be achieved by the following technical solutions: a network interactive information security monitoring system based on blockchain, comprising a monitoring center, wherein the monitoring center is communicatively connected with a data acquisition module, a blockchain construction module, an integrity detection module, an anomaly detection module, and a feedback module;

[0006] The data collection module is used to collect network interaction information data;

[0007] The blockchain construction module is used to construct a network data blockchain and map the collected network interaction information data into the constructed network data blockchain;

[0008] The integrity detection module is used to detect the integrity of the network interaction information data in the network data blockchain to determine whether the network interaction information data has been tampered with during the interaction process;

[0009] The anomaly detection module is used to perform anomaly detection on the network interaction information data in the network data blockchain to determine whether the network interaction information data is abnormal;

[0010] The feedback module is used to provide feedback based on the results of integrity detection and anomaly detection.

[0011] Furthermore, the process of the data collection module collecting network interaction information data includes:

[0012] The network interaction information data includes network data before the interaction and network data after the interaction;

[0013] The data acquisition module is composed of several data acquisition terminals. The data acquisition terminals are configured to generate corresponding configuration channels. The corresponding network data interaction server is linked through the generated configuration channels. The network data interaction server is used for interaction personnel to interact with network data. The data acquisition terminals obtain the network data before the interaction and the network data after the interaction in the network data interaction server through the generated corresponding configuration channels.

[0014] Furthermore, the process in which the blockchain construction module constructs a network data blockchain and maps the collected network interaction information data to the constructed network data blockchain includes:

[0015] The network data blockchain is composed of an initial network data node and a plurality of interactive network data nodes;

[0016] Connecting the initial network data node with the corresponding interactive network data node, and connecting the interactive network data node with the corresponding remaining interactive network data nodes;

[0017] The network data before the first interaction is mapped to the initial network data node, the network data after the first interaction is mapped to the corresponding interactive network data node, the network data after the second interaction is mapped to the corresponding interactive network data node, and so on, the corresponding network data is mapped to the corresponding interactive network data node.

[0018] Furthermore, the process of the integrity detection module detecting the integrity of the network interaction information data in the network data blockchain includes:

[0019] Decomposing the network data before the first interaction in the initial network data node into a plurality of data blocks, and recording the data blocks decomposed by the network data before the first interaction as standard data blocks;

[0020] Obtaining a start time of a first interaction and a time spent on the first interaction, and obtaining a first check factor according to the obtained start time of the first interaction, the time spent on the first interaction, and the standard data block;

[0021] XORing the first check factor with each standard data block to obtain a first check code for each standard data block;

[0022] Decomposing the network data after the first interaction in the interactive network data node connected to the initial network data node into a plurality of data blocks, and recording the data blocks decomposed from the network data after the first interaction as first data blocks;

[0023] XORing the first check factor with each first data block to obtain a first check code for each first data block;

[0024] Compare the first check code of the standard data block with the first check code of the corresponding first data block. If the comparison results are the same, the network data in the initial network data node is the same as the network data after the first interaction. During the first interaction, the network data has not been tampered with. If the comparison results are different, the network data in the initial network data node is different from the network data after the first interaction. During the first interaction, the network data has been tampered with.

[0025] Obtaining the start time of the second interaction and the time spent on the second interaction, and obtaining a second check factor according to the obtained start time of the second interaction, the time spent on the second interaction, and the standard data block;

[0026] XORing the second check factor with each standard data block to obtain a second check code for each standard data block;

[0027] Decomposing the network data after the second interaction in the second interactive network data node into a plurality of data blocks, and recording the data blocks decomposed from the network data after the second interaction as second data blocks;

[0028] XORing the second check factor with each second data block to obtain a second check code for each second data block;

[0029] Compare the second check code of the standard data block with the second check code of the corresponding second data block. If the comparison results are the same, the network data in the initial network data node and the network data after the second interaction are the same, and the network data has not been tampered with during the second interaction. If the comparison results are different, the network data in the initial network data node and the network data after the second interaction are different, and the network data has been tampered with during the second interaction.

[0030] And so on, the result of whether the network data in the remaining interactive network data nodes has been tampered with is obtained.

[0031] Furthermore, the process of decomposing the network data before the first interaction in the initial network data node into a plurality of data blocks includes:

[0032] Arrange characters in the network data before the first interaction in the initial network data node into a character string, convert each character in the character string into a corresponding ASCII code representation, convert the ASCII code of each character into a binary representation, combine the binary representations of all characters to form a binary data stream, obtain the data length of the binary data stream, and determine whether the binary data stream needs to be filled according to the obtained data length of the binary data stream;

[0033] If the binary data stream does not need to be filled, the binary data stream is decomposed into several data blocks;

[0034] If the binary data stream needs to be padded, the padding length is obtained, and a corresponding number of padding bytes are added to the end of the binary data stream according to the obtained padding length, and the padded binary data stream is decomposed into a number of data blocks.

[0035] Furthermore, the process of obtaining the first check factor according to the acquired start time of the first interaction, the time spent in the first interaction, and the standard data block includes:

[0036] Construct an empty matrix, map the corresponding parts of the corresponding standard data blocks to the corresponding positions of the empty matrix, and obtain a first matrix;

[0037] The first matrix is ​​shifted according to the acquired start time of the first interaction and the time spent in the first interaction, and a first check factor is obtained according to the shift result.

[0038] Furthermore, the process of the anomaly detection module performing anomaly detection on the network interaction information data in the network data blockchain includes:

[0039] A network data anomaly detection model is constructed in the anomaly detection module, the network data anomaly detection model is trained according to historical network data, and the historical network data is input into the network data anomaly detection model. If the historical network data is normal, the network data anomaly detection model outputs a normal signal; if the historical network data is abnormal, the network data anomaly detection model outputs an abnormal signal;

[0040] The network data after the first interaction in the first interactive network data node is input into the network data anomaly detection model, and the network data anomaly detection model outputs. If a normal signal is output, the network data after the first interaction is normal; if an abnormal signal is output, the network data after the first interaction is abnormal;

[0041] The network data after the second interaction in the second interactive network data node is input into the network data anomaly detection model, and the network data anomaly detection model outputs. If a normal signal is output, the network data after the second interaction is normal; if an abnormal signal is output, the network data after the second interaction is abnormal;

[0042] And so on, the results of whether the network data in the remaining interactive network data nodes are abnormal are obtained.

[0043] Furthermore, the process of the feedback module providing feedback according to the results of integrity detection and anomaly detection includes:

[0044] If the network data is not tampered with during the interaction and the network data after the interaction is normal, the network data interaction is safe;

[0045] If the network data is tampered with during the interaction or the network data after the interaction is abnormal, the network data interaction is unsafe and relevant personnel are dispatched to handle it.

[0046] Compared with the prior art, the beneficial effects of the present invention are: collecting network interaction information data, constructing a network data blockchain, and mapping the collected network interaction information data to the constructed network data blockchain, detecting the integrity of the network interaction information data in the network data blockchain, judging whether the network interaction information data has been tampered with during the interaction process, performing anomaly detection on the network interaction information data in the network data blockchain, judging whether the network interaction information data is abnormal, providing feedback based on the results of the integrity detection and the anomaly detection, performing integrity detection and anomaly detection, further improving the security of network data interaction, and providing protection for the next network data interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a schematic diagram of the present invention. DETAILED DESCRIPTION

[0048] like Figure 1 As shown, a blockchain-based network interactive information security monitoring system includes a monitoring center, which is communicatively connected to a data acquisition module, a blockchain construction module, an integrity detection module, an anomaly detection module, and a feedback module;

[0049] The data collection module is used to collect network interaction information data;

[0050] It should be further explained that, in a specific implementation process, the process of the data collection module collecting network interaction information data includes:

[0051] The network interaction information data includes network data before the interaction and network data after the interaction;

[0052] The data acquisition module is composed of a plurality of data acquisition terminals, and the data acquisition terminals are used to collect network data before interaction and network data after interaction;

[0053] The data acquisition terminal is configured to generate a corresponding configuration channel, and the corresponding network data interaction server is linked through the generated configuration channel. The network data interaction server is used for interaction personnel to interact with network data. The data acquisition terminal obtains the network data before the interaction and the network data after the interaction in the network data interaction server through the generated corresponding configuration channel.

[0054] The blockchain construction module is used to construct a network data blockchain and map the collected network interaction information data into the constructed network data blockchain;

[0055] It should be further explained that, in the specific implementation process, the blockchain construction module constructs a network data blockchain, and the process of mapping the collected network interaction information data to the constructed network data blockchain includes:

[0056] The network data blockchain is composed of an initial network data node and a plurality of interactive network data nodes, and the interactive network data nodes are numbered as i, i=1, 2, 3, ..., n, where n is a positive integer;

[0057] Connect the initial network data node with the interactive network data node labeled “1”, connect the interactive network data node labeled “1” with the interactive network data node labeled “2”, connect the interactive network data node labeled “2” with the interactive network data node labeled “3”, …, connect the interactive network data node labeled “n-2” with the interactive network data node labeled “n-1”, and connect the interactive network data node labeled “n-1” with the interactive network data node labeled “n”;

[0058] Map the network data before the first interaction to the initial network data node, map the network data after the first interaction to the interactive network data node labeled "1", map the network data after the second interaction to the interactive network data node labeled "2", map the network data after the third interaction to the interactive network data node labeled "3", and so on, map the corresponding network data to the corresponding interactive network data nodes;

[0059] In an embodiment of the present invention, the network data before the interaction and the network data after the interaction are mapped to the corresponding interactive network data nodes, thereby ensuring that the network data before the interaction and the network data after the interaction will not be tampered with, thereby providing a guarantee for the subsequent integrity detection and anomaly detection, and ensuring the accuracy of the integrity detection and anomaly detection.

[0060] The integrity detection module is used to detect the integrity of the network interaction information data in the network data blockchain to determine whether the network interaction information data has been tampered with during the interaction process;

[0061] It should be further explained that, in the specific implementation process, the process in which the integrity detection module detects the integrity of the network interaction information data in the network data blockchain includes:

[0062] Arrange the characters in the network data before the first interaction in the initial network data node into a string, convert each character in the string into a corresponding ASCII code representation, convert the ASCII code of each character into a binary representation, combine the binary representations of all characters to form a binary data stream, obtain the data length of the binary data stream, if the data length of the binary data stream is a multiple of 256, decompose the binary data stream into a number of data blocks with a data length of 256, if the data length of the binary data stream is not a multiple of 256, pad the binary data stream to obtain the padding length, divide the data length of the binary data stream by 256 to obtain the remainder of the division, subtract the remainder of the division from 256 to obtain the padding length, add a corresponding number of padding bytes at the end of the binary data stream according to the obtained padding length, the value of the padding byte is binary 0, decompose the padded binary data stream into a number of data blocks with a data length of 256, and record the data blocks decomposed by the network data before the first interaction as standard data blocks;

[0063] Obtaining a start time of a first interaction and a time spent on the first interaction, and obtaining a first check factor according to the obtained start time of the first interaction, the time spent on the first interaction, and the standard data block;

[0064] It should be further explained that, in a specific implementation process, the process of obtaining the first check factor according to the obtained start time of the first interaction, the time spent on the first interaction, and the standard data block includes:

[0065] Construct an 8×32 empty matrix, map the first 32 bits of the first standard data block to the first row of the empty matrix, map bits 33 to 64 of the second standard data block to the second row of the empty matrix, map bits 65 to 96 of the third standard data block to the third row of the empty matrix, ..., map bits 225 to 256 of the eighth standard data block to the eighth row of the empty matrix, to obtain a first matrix;

[0066] Shifting the first matrix according to the acquired start time of the first interaction and the time spent on the first interaction, and obtaining a first check factor according to the shift result;

[0067] For example: the start time of the first interaction is 11:34:23 on May 23, 2024, and the corresponding number is 20240523113423. Replace 0 and 9 with 1, and the corresponding number is 21241523113423. The time spent on the first interaction is 2 hours, 36 minutes and 28 seconds, and the corresponding number is 23628. According to the number corresponding to the time spent on the first interaction, the number corresponding to the start time of the first interaction is exchanged, the second number is exchanged with the third number, the third number is exchanged with the sixth number, the sixth number is exchanged with the second number, and the second number is exchanged with the eighth number. The number after exchange is 23541221113423;

[0068] Shift the first matrix according to the exchanged numbers, circularly shift the second row of the first matrix right by three bits, circularly shift the third row left by two bits, XOR the second row with the third row to obtain the first part of the first check factor, circularly shift the fifth row of the first matrix right by four bits, circularly shift the fourth row left by five bits, XOR the fifth row with the fourth row to obtain the second part of the first check factor, circularly shift the first row of the first matrix right by two bits, circularly shift the second row left by one bit, XOR the first row with the second row to obtain the third part of the first check factor, and so on, shift the first matrix to obtain the fourth part, the fifth part, the sixth part and the seventh part of the first check factor, XOR the first row of the shifted first matrix with the eighth row to obtain the eighth part of the first check factor;

[0069] XORing the first check factor with each standard data block to obtain a first check code for each standard data block;

[0070] Decompose the network data after the first interaction in the interactive network data node labeled "1" into a plurality of data blocks with a data length of 256, and record the data block decomposed by the network data after the first interaction as the first data block;

[0071] XORing the first check factor with each first data block to obtain a first check code for each first data block;

[0072] Compare the first check code of the standard data block with the first check code of the corresponding first data block. If the comparison results are the same, the network data in the initial network data node is the same as the network data after the first interaction. During the first interaction, the network data has not been tampered with. If the comparison results are different, the network data in the initial network data node is different from the network data after the first interaction. During the first interaction, the network data has been tampered with.

[0073] Obtaining the start time of the second interaction and the time spent on the second interaction, and obtaining a second check factor according to the obtained start time of the second interaction, the time spent on the second interaction, and the standard data block;

[0074] XORing the second check factor with each standard data block to obtain a second check code for each standard data block;

[0075] Decomposing the network data after the second interaction in the interactive network data node labeled "2" into a plurality of data blocks with a data length of 256, and recording the data blocks decomposed from the network data after the second interaction as second data blocks;

[0076] XORing the second check factor with each second data block to obtain a second check code for each second data block;

[0077] Compare the second check code of the standard data block with the second check code of the corresponding second data block. If the comparison results are the same, the network data in the initial network data node and the network data after the second interaction are the same, and the network data has not been tampered with during the second interaction. If the comparison results are different, the network data in the initial network data node and the network data after the second interaction are different, and the network data has been tampered with during the second interaction.

[0078] And so on, the result of whether the network data in the remaining interactive network data nodes has been tampered with is obtained.

[0079] The anomaly detection module is used to perform anomaly detection on the network interaction information data in the network data blockchain to determine whether the network interaction information data is abnormal;

[0080] It should be further explained that, in the specific implementation process, the process of the anomaly detection module performing anomaly detection on the network interaction information data in the network data blockchain includes:

[0081] A network data anomaly detection model is constructed in the anomaly detection module, the network data anomaly detection model is trained according to historical network data, and the historical network data is input into the network data anomaly detection model. If the historical network data is normal, the network data anomaly detection model outputs a normal signal; if the historical network data is abnormal, the network data anomaly detection model outputs an abnormal signal;

[0082] The network data after the first interaction in the interactive network data node labeled "1" is input into the network data anomaly detection model, and the network data anomaly detection model outputs. If a normal signal is output, the network data after the first interaction is normal; if an abnormal signal is output, the network data after the first interaction is abnormal;

[0083] The network data after the second interaction in the interactive network data node labeled "2" is input into the network data anomaly detection model, and the network data anomaly detection model outputs. If a normal signal is output, the network data after the second interaction is normal; if an abnormal signal is output, the network data after the second interaction is abnormal;

[0084] And so on, the results of whether the network data in the remaining interactive network data nodes are abnormal are obtained.

[0085] The feedback module is used to provide feedback based on the results of integrity detection and anomaly detection;

[0086] It should be further explained that, in the specific implementation process, the process in which the feedback module provides feedback based on the results of integrity detection and anomaly detection includes:

[0087] If the network data is not tampered with during the interaction and the network data after the interaction is normal, the network data interaction is safe;

[0088] If the network data is tampered with during the interaction or the network data after the interaction is abnormal, the network data interaction is unsafe and relevant personnel are dispatched to handle it.

[0089] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A network interactive information security monitoring system based on blockchain, including a monitoring center, characterized in that: The monitoring center is communicatively connected to a data acquisition module, a blockchain construction module, an integrity detection module, an anomaly detection module, and a feedback module; The data collection module is used to collect network interaction information data; The blockchain construction module is used to construct a network data blockchain and map the collected network interaction information data into the constructed network data blockchain; The integrity detection module is used to detect the integrity of the network interaction information data in the network data blockchain to determine whether the network interaction information data has been tampered with during the interaction process; The anomaly detection module is used to perform anomaly detection on the network interaction information data in the network data blockchain to determine whether the network interaction information data is abnormal; The feedback module is used to provide feedback based on the results of integrity detection and anomaly detection.

2. The blockchain-based network interactive information security monitoring system according to claim 1 is characterized in that: The process of the data collection module collecting network interaction information data includes: The network interaction information data includes network data before the interaction and network data after the interaction; The data acquisition module is composed of several data acquisition terminals. The data acquisition terminals are configured to generate corresponding configuration channels. The corresponding network data interaction server is linked through the generated configuration channels. The network data interaction server is used for interaction personnel to interact with network data. The data acquisition terminals obtain the network data before the interaction and the network data after the interaction in the network data interaction server through the generated corresponding configuration channels.

3. The blockchain-based network interactive information security monitoring system according to claim 2 is characterized in that: The process of the blockchain construction module constructing a network data blockchain and mapping the collected network interaction information data to the constructed network data blockchain includes: The network data blockchain is composed of an initial network data node and a plurality of interactive network data nodes; Connecting the initial network data node with the corresponding interactive network data node, and connecting the interactive network data node with the corresponding remaining interactive network data nodes; The network data before the first interaction is mapped to the initial network data node, the network data after the first interaction is mapped to the corresponding interactive network data node, the network data after the second interaction is mapped to the corresponding interactive network data node, and so on, the corresponding network data is mapped to the corresponding interactive network data node.

4. The blockchain-based network interactive information security monitoring system according to claim 3 is characterized in that: The process of the integrity detection module detecting the integrity of the network interaction information data in the network data blockchain includes: Decomposing the network data before the first interaction in the initial network data node into a plurality of data blocks, and recording the data blocks decomposed by the network data before the first interaction as standard data blocks; Obtaining a start time of a first interaction and a time spent on the first interaction, and obtaining a first check factor according to the obtained start time of the first interaction, the time spent on the first interaction, and the standard data block; XORing the first check factor with each standard data block to obtain a first check code for each standard data block; Decomposing the network data after the first interaction in the interactive network data node connected to the initial network data node into a plurality of data blocks, and recording the data blocks decomposed from the network data after the first interaction as first data blocks; XORing the first check factor with each first data block to obtain a first check code for each first data block; Compare the first check code of the standard data block with the first check code of the corresponding first data block. If the comparison results are the same, the network data in the initial network data node is the same as the network data after the first interaction. During the first interaction, the network data has not been tampered with. If the comparison results are different, the network data in the initial network data node is different from the network data after the first interaction. During the first interaction, the network data has been tampered with. Obtaining the start time of the second interaction and the time spent on the second interaction, and obtaining a second check factor according to the obtained start time of the second interaction, the time spent on the second interaction, and the standard data block; XORing the second check factor with each standard data block to obtain a second check code for each standard data block; Decomposing the network data after the second interaction in the second interactive network data node into a plurality of data blocks, and recording the data blocks decomposed from the network data after the second interaction as second data blocks; XORing the second check factor with each second data block to obtain a second check code for each second data block; Compare the second check code of the standard data block with the second check code of the corresponding second data block. If the comparison results are the same, the network data in the initial network data node and the network data after the second interaction are the same, and the network data has not been tampered with during the second interaction. If the comparison results are different, the network data in the initial network data node and the network data after the second interaction are different, and the network data has been tampered with during the second interaction. And so on, the result of whether the network data in the remaining interactive network data nodes has been tampered with is obtained.

5. The blockchain-based network interactive information security monitoring system according to claim 4 is characterized in that: The process of decomposing the network data before the first interaction in the initial network data node into several data blocks includes: Arrange characters in the network data before the first interaction in the initial network data node into a character string, convert each character in the character string into a corresponding ASCII code representation, convert the ASCII code of each character into a binary representation, combine the binary representations of all characters to form a binary data stream, obtain the data length of the binary data stream, and determine whether the binary data stream needs to be filled according to the obtained data length of the binary data stream; If the binary data stream does not need to be filled, the binary data stream is decomposed into several data blocks; If the binary data stream needs to be padded, the padding length is obtained, and a corresponding number of padding bytes are added to the end of the binary data stream according to the obtained padding length, and the padded binary data stream is decomposed into a number of data blocks.

6. The blockchain-based network interactive information security monitoring system according to claim 5 is characterized in that: The process of obtaining the first check factor according to the acquired start time of the first interaction, the time spent in the first interaction, and the standard data block includes: Construct an empty matrix, map the corresponding parts of the corresponding standard data blocks to the corresponding positions of the empty matrix, and obtain a first matrix; The first matrix is ​​shifted according to the acquired start time of the first interaction and the time spent in the first interaction, and a first check factor is obtained according to the shift result.

7. The blockchain-based network interactive information security monitoring system according to claim 6 is characterized in that: The process of the anomaly detection module performing anomaly detection on the network interaction information data in the network data blockchain includes: A network data anomaly detection model is constructed in the anomaly detection module, the network data anomaly detection model is trained according to historical network data, and the historical network data is input into the network data anomaly detection model. If the historical network data is normal, the network data anomaly detection model outputs a normal signal; if the historical network data is abnormal, the network data anomaly detection model outputs an abnormal signal; The network data after the first interaction in the first interactive network data node is input into the network data anomaly detection model, and the network data anomaly detection model outputs. If a normal signal is output, the network data after the first interaction is normal; if an abnormal signal is output, the network data after the first interaction is abnormal; The network data after the second interaction in the second interactive network data node is input into the network data anomaly detection model, and the network data anomaly detection model outputs. If a normal signal is output, the network data after the second interaction is normal; if an abnormal signal is output, the network data after the second interaction is abnormal; And so on, the results of whether the network data in the remaining interactive network data nodes are abnormal are obtained.

8. The blockchain-based network interactive information security monitoring system according to claim 7 is characterized in that: The process of the feedback module providing feedback according to the results of integrity detection and anomaly detection includes: If the network data is not tampered with during the interaction and the network data after the interaction is normal, the network data interaction is safe; If the network data is tampered with during the interaction or the network data after the interaction is abnormal, the network data interaction is unsafe and relevant personnel are dispatched to handle it.

Images