Blockchain-based two-dimensional code data security detection method and system

Abstract

The application discloses a blockchain-based two-dimensional code data security detection method and system, relates to the technical field of data security detection, and is used for solving the problems that there is no fine storage hierarchy and dynamic management of access frequency in the prior art, data compliance and integrity verification usually depend on a single node or a centralized mode, the dynamic adaptation capability to data access frequency and risk is lacked, and the abnormal detection and response mechanism of most systems is passive; through a blockchain consensus mechanism and hash verification, the data is ensured to be non-tamperable and consistent, a hierarchical storage architecture and dynamic adjustment of a smart contract are used, the real-time detection and automatic response capability to potential threats is improved by combining an isolated forest algorithm with the smart contract, and the system can dynamically adjust strategies according to data access frequency and risk, and adapt to different demand changes.

Description

Technical Field

[0001] The present invention relates to the field of data security detection technology, and more specifically, to a blockchain-based QR code data security detection method and system. Background Art

[0002] Compared to traditional barcodes, QR codes offer advantages such as large information capacity and fast scanning speed, making them widely used in payment, identity authentication, and product traceability. Blockchain is a decentralized distributed ledger technology characterized by immutability, transparency, and high security. A blockchain-based QR code data security detection method and system, combining the advantages of both QR code technology and blockchain, can effectively enhance the security of QR codes, prevent counterfeiting and tampering, and ensure the credibility of QR code data during transmission and verification. This technology holds significant potential for application in financial payments, logistics traceability, and identity verification.

[0003] The existing technology has the following deficiencies:

[0004] Existing technologies typically lack granular dynamic management of storage hierarchies and access frequencies, which can easily lead to wasted storage resources or increased read latency. Data compliance and integrity verification often relies on a single node or centralized approach, making them vulnerable to single points of failure or malicious behavior. They lack the ability to dynamically adapt to data access frequency and risk, significantly reducing data storage efficiency once access patterns change. Most current systems' anomaly detection and response mechanisms are passive, relying on manual intervention or periodic inspections, resulting in slow responses to unexpected issues.

[0005] In view of the above problems, the present invention proposes a solution. Summary of the Invention

[0006] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present invention provide a blockchain-based QR code data security detection method and system to solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A blockchain-based QR code data security detection method and system includes the following steps:

[0009] Step S1: Parse the encoding format to generate a standardized data structure, split it into data units containing original information and checksums, use a hash algorithm to generate a unique identifier for the data unit, record the generation time of the timestamp, and verify the compliance of the data unit by combining the hash algorithm and timestamp. The verification result is broadcast to other nodes through the blockchain network to reach consensus;

[0010] Step S2: Add a new tiered storage architecture, divide data units into high-frequency access layer, medium-frequency access layer, and low-frequency access layer, use mutual information to measure the comparative dependency between data units and important data units, calculate the importance of data units based on their access frequency, and perform storage tiering.

[0011] Step S3: Based on the sudden change in data access frequency, the deviation of node behavior, and the throughput deviation of data units, anomaly detection is performed using Isolation Forest to determine whether a security alert is triggered. The smart contract automatically executes the isolation operation and, combined with the consensus mechanism of the blockchain, multi-node cross-validation is performed on the abnormal data units.

[0012] Step S4: Dynamically adjust the storage level of the data unit through the smart contract, and migrate the data between high, medium and low frequency access levels based on the access frequency mutation and the risk score of the data unit.

[0013] In a preferred embodiment, step S1 includes the following:

[0014] Parse the raw data, represent it in CSV encoding format, standardize it into a unified structure, and record each data unit in a structured data format, including the original information and a checksum. The raw data is the actual information to be transmitted or stored, while the checksum is usually a summary obtained by performing some kind of encryption or hashing on the raw data.

[0015] The check code is generated using a hash algorithm, and a unique identifier is generated for each data unit using the hash algorithm;

[0016] A timestamp is attached to each data unit to record the specific time of generation;

[0017] After generating the hash value and timestamp of the data unit, the data is verified to be complete and not tampered with by recalculating the hash value and comparing it with the stored hash value. The timestamp checks whether the data is generated within the expected time range. Together, they verify the compliance of the data unit. When the data does not conform to the specified time window or its hash value does not match, it means that the data has been tampered with.

[0018] After verification, the hash value and timestamp of the data unit are broadcast to other nodes through the blockchain network. The consensus mechanism ensures that all nodes reach an agreement on the validity of the data. After verifying and agreeing on the legitimacy of the data, the data is permanently recorded in the blockchain.

[0019] In a preferred embodiment, step S2 includes the following:

[0020] Entropy is used to measure the certainty of data units X and Y. The entropy of data units X and Y is expressed as: , ,in: is the probability that X takes a certain value x, It means to sum all possible values ​​of x. is the probability that Y takes a certain y, It represents the sum of all possible values ​​of y. The joint entropy of data units X and Y is expressed as: , where: P(x, y) is the joint probability of x and y when X and Y are taken at the same time, It means to sum all possible joint values ​​of X and Y;

[0021] Calculate the mutual information between each pair of data units to measure the dependence between two variables. The mutual information is calculated by the following formula: ,in: is the entropy of data unit X, is the entropy of data unit Y, is the joint entropy of data units X and Y;

[0022] By tracking the access records of data units, counting the specific number of accesses and recording them, the access frequency of each data unit is calculated by the ratio of the number of accesses to the total number of accesses, and using express;

[0023] The dependency between each pair of data units is calculated based on the mutual information, and the dependency matrix is ​​constructed. The elements of the matrix I ( , ) indicates a data unit and Mutual information between

[0024] The importance of a data unit is calculated by combining the dependency matrix and the access frequency, and is defined by the following formula: = here, Is a data unit and The mutual information between Is a data unit Frequency of visits;

[0025] Based on the importance of data units, data units are divided into three storage tiers: high-frequency access tier, medium-frequency access tier, and low-frequency access tier:

[0026] Access the historical database to obtain the importance data of multiple data units and merge them into an importance data set. Use the percentile method to set the storage level threshold based on the importance data set, arrange the data in the importance data set from small to large, and set %, % as the percentile ratio, and the importance data is concentrated in the % data value as the high-frequency access layer, in %and % as the medium frequency access layer, below % The data value of data serves as the underlying access layer.

[0027] In a preferred embodiment, step S3 includes the following:

[0028] Use Isolation Forest to detect anomalies in data. Use three parameters: access frequency, node behavior deviation, and throughput to build an Isolation Forest model. The steps are as follows:

[0029] Step A1: Calculate the access frequency mutation, node behavior deviation, and throughput standard deviation as feature values ​​to form a multidimensional data set;

[0030] Calculate the moving average and standard deviation of the access frequency, and calculate the deviation between the current time point and the moving average, which is expressed as the following formula: Access frequency mutation = ,in: Is a data unit Frequency of visits;

[0031] By calculating the standard deviation of the node behavior and the behavior of other nodes in the blockchain network, the mean of all nodes is calculated and recorded as μ, which is expressed as: ,in, is the standard deviation, is the behavior value of each node, μ is the mean of the behavior values ​​of all nodes, and N is the total number of nodes;

[0032] The abnormality of a path is analyzed based on throughput deviation, which is expressed as the ratio of the amount of data successfully transmitted to the time taken;

[0033] Isolation forest constructs multiple isolated trees by randomly selecting features and performing random splits on the features. The abnormality of the data point is calculated by analyzing the path length from the root node to the leaf node of the isolation tree to obtain the split depth, which is recorded as the anomaly score. The anomaly scores of all isolated trees are combined and a threshold is set. A score above the anomaly score threshold indicates data anomaly.

[0034] Step A2: Set dynamic thresholds based on the mean and standard deviation of historical data:

[0035] Abnormal threshold of access frequency: When the access frequency of the current data point deviates from the historical mean by a certain multiple of the standard deviation, it is considered that a mutation has occurred;

[0036] Abnormal threshold of node behavior deviation: When the behavior value of a node exceeds the standard deviation of the average behavior value of all nodes in the network by multiple times, it is marked as abnormal;

[0037] Throughput abnormality threshold: Use the historical mean and standard deviation of throughput to set a dynamic threshold. When the throughput is lower than the dynamic threshold, the path is considered abnormal. The degree of throughput fluctuation also needs to be considered. By calculating the historical mean of throughput and standard deviation , set the threshold to a certain multiple of the historical mean ± standard deviation. When the current throughput is lower than the dynamic threshold, the path is considered abnormal. The threshold is expressed as: , , where k is a constant lower than or higher When , it is marked as abnormal;

[0038] Step A3: If the parameter deviates from the preset threshold, it is marked as an anomaly, triggering a security alert. Anomaly detection is triggered, and a smart contract is designed to handle the actions triggered by the anomaly detection. The contract automatically isolates the data unit;

[0039] Multiple nodes are introduced for cross-validation. Each node will independently detect the data unit and decide whether to trigger the isolation operation based on the consensus mechanism on the blockchain. Multiple nodes will execute the same isolation forest algorithm on the same data unit to detect whether there is abnormal behavior. When more than a certain proportion of nodes are judged to be abnormal, the isolation operation is initiated.

[0040] In a preferred embodiment, step S4 includes the following:

[0041] The risk score is calculated for each data unit by combining the detection results of the three features. Assuming that the weight of each feature is 、 、 , corresponding to the sudden change in data access frequency, the deviation of node behavior and the throughput deviation of data units, the comprehensive risk score R can be expressed as: ,in: 、 and It is an anomaly score calculated based on the data access frequency mutation, node behavior deviation and data unit throughput deviation. 、 、 It is the weight set according to the importance of the feature;

[0042] When the access frequency mutation and risk score meet specific conditions, the data unit will be automatically migrated to the appropriate storage tier. The specific migration logic is as follows:

[0043] High-frequency data migration: When the access frequency of a data unit exceeds a threshold or the risk score exceeds a threshold, the smart contract will automatically migrate it to the high-frequency access layer;

[0044] Low-frequency data migration: When the access frequency of a data unit falls below a threshold, the smart contract can migrate it to a low-frequency storage layer to reduce storage costs.

[0045] The smart contract triggers a migration check after each data access or periodically. It checks the access frequency each time data is accessed and decides whether migration is required. It is set to trigger a migration check periodically.

[0046] The blockchain-based QR code data security detection method and system include: a parsing and verification module, a storage layering module, a dynamic detection module, and a storage optimization module, and the modules are signal-connected.

[0047] Parsing and Verification Module: Parses the encoding format to generate a standardized data structure, splits it into data units containing the original information and a checksum, uses a hash algorithm to generate a unique identifier for the data unit, records the generation time of the timestamp, and verifies the compliance of the data unit by combining the hash algorithm and timestamp. The verification results are broadcast to other nodes via the blockchain network to reach a consensus;

[0048] Storage tiering module: Adds a new tiered storage architecture that divides data units into high-frequency access layers, medium-frequency access layers, and low-frequency access layers. It uses mutual information to measure the comparative dependency between data units and important data units, calculates the importance of data units based on their access frequency, and performs storage tiering.

[0049] Dynamic Detection Module: This module uses isolation forests to detect anomalies based on sudden changes in data access frequency, deviations in node behavior, and data unit throughput deviations. This module determines whether a security alert has been triggered and automatically executes isolation operations through smart contracts. Furthermore, it integrates the blockchain consensus mechanism to perform multi-node cross-validation on abnormal data units.

[0050] Storage optimization module: Dynamically adjusts the storage level of data units through smart contracts, and migrates data between high, medium, and low frequency access levels based on access frequency mutations and data unit risk scores.

[0051] The technical effects and advantages of the blockchain-based QR code data security detection method and system of the present invention are as follows:

[0052] Data security and integrity are guaranteed. Blockchain consensus mechanisms and hash verification ensure data immutability and consistency. Storage optimization and efficiency improvements are achieved through a tiered storage architecture and dynamic adjustments using smart contracts, improving storage efficiency and data access speed. Intelligent anomaly detection and automated response: The combination of the isolation forest algorithm and smart contracts enhances real-time detection and automated response capabilities for potential threats. The system is flexible and scalable, dynamically adjusting policies based on data access frequency and risk to adapt to changing needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a schematic diagram of the structure of the blockchain-based QR code data security detection method of the present invention.

[0054] Figure 2 This is a schematic diagram of the structure of the blockchain-based QR code data security detection system of the present invention. DETAILED DESCRIPTION

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0056] In Example 1, the present invention discloses a QR code data security detection method and system based on blockchain, comprising the following steps:

[0057] Step S1: Parse the encoding format to generate a standardized data structure, split it into data units containing original information and checksums, use a hash algorithm to generate a unique identifier for the data unit, record the generation time of the timestamp, and verify the compliance of the data unit by combining the hash algorithm and timestamp. The verification result is broadcast to other nodes through the blockchain network to reach consensus;

[0058] Step S2: Add a new tiered storage architecture, divide data units into high-frequency access layer, medium-frequency access layer, and low-frequency access layer, use mutual information to measure the comparative dependency between data units and important data units, calculate the importance of data units based on their access frequency, and perform storage tiering.

[0059] Step S3: Based on the sudden change in data access frequency, the deviation of node behavior, and the throughput deviation of data units, anomaly detection is performed using Isolation Forest to determine whether a security alert is triggered. The smart contract automatically executes the isolation operation and, combined with the consensus mechanism of the blockchain, multi-node cross-validation is performed on the abnormal data units.

[0060] Step S4: Dynamically adjust the storage level of the data unit through the smart contract, and migrate the data between high, medium and low frequency access levels based on the access frequency mutation and the risk score of the data unit.

[0061] In step S1, the encoding format is parsed to generate a standardized data structure, which is then divided into data units containing the original information and a checksum. A hash algorithm is used to generate a unique identifier for the data unit, and a timestamp is recorded to mark the generation time. The compliance of the data unit is verified by combining the hash algorithm and the timestamp. The verification result is broadcast to other nodes via the blockchain network to reach a consensus. The specific contents include:

[0062] The raw data is parsed and represented using the CSV encoding format, standardized into a unified structure for easier processing and verification. Standardization means that all data has uniform fields, formats, and types, making it easier to process and verify. Each data unit is represented using a database record structured data format, containing the original information and a checksum. The original information is the core content of the data, while the checksum is used to ensure that the data has not been tampered with.

[0063] The data is divided into two parts: original data and checksum. The original data is the information actually to be transmitted or stored, while the checksum is usually a summary obtained by performing some kind of encryption or hashing on the original data, which is used to verify the integrity of the data.

[0064] A checksum is generated using a hash algorithm to ensure that the data has not been altered during transmission. If the original data is modified during transmission, the checksum will also change. The receiving end can verify the validity of the data by recalculating the hash value. By using a hash algorithm to generate a unique identifier for each data unit, the hash algorithm generates a fixed-length digest. Any slight change in the input will result in a significant change in the output hash value, thus ensuring the uniqueness and unforgeability of the data. The hash value of each data unit serves as a unique identifier, ensuring data integrity and tamper-proofing. Even if the data is modified, the hash value will remain unchanged, making it impossible to forge.

[0065] It's important to note that a hash algorithm maps data of arbitrary length to a fixed-length value. It's widely used in data processing, encryption, information verification, and other fields. In particular, hash algorithms play a crucial role in technologies such as blockchain, data integrity verification, and digital signatures. Regardless of the size of the input data, a hash algorithm generates a fixed-length output. Hash algorithms are one-way, meaning the original data cannot be deduced from the hash value. This makes them ideal for verifying data integrity without leaking the original data. Any slight change to the input data will result in a significant change in the hash value. Different inputs can produce different hash values. While hash algorithms cannot avoid collisions due to the limited output length, a good hash algorithm should minimize this probability. The hash algorithm should also be fast enough to generate hash values ​​quickly, especially when dealing with large amounts of data.

[0066] Each data unit is assigned a timestamp, recording the exact time of its generation. This timestamp can be obtained from the system clock or recorded in the blockchain using the block timestamp. This not only helps verify data sequence but also provides important time reference for subsequent compliance verification. Providing the data's generation time helps determine whether it was generated within the specified timeframe, ensuring compliance with specific time requirements. The timestamp can also be used as part of data validation to prevent replay attacks.

[0067] After generating the hash value and timestamp of the data unit, the recipient or verification system can verify that the data is complete and has not been tampered with by recalculating the hash value and comparing it with the stored hash value. The timestamp is used to check whether the data is generated within the expected time range and verify the compliance of the data unit, ensuring that the data has not been modified during transmission and that its generation time meets the compliance requirements. If the data does not meet the specified time window or its hash value does not match, it means that the data has been tampered with or illegally generated.

[0068] After verification, the data unit and its associated hash value and timestamp are broadcast to other nodes via the blockchain network. As a decentralized distributed ledger technology, blockchain ensures that data added to the network cannot be tampered with or deleted. In the blockchain network, a consensus mechanism ensures that all nodes reach agreement on the validity of the data. Once the data's legitimacy is verified and agreed upon, it is permanently recorded in the blockchain, and any future modifications are detectable. Through blockchain, all historical records of data generation, verification, and broadcast can be traced and audited, ensuring transparency and credibility throughout the entire process.

[0069] In step S2, a new tiered storage architecture is added, dividing data units into high-frequency access layers, medium-frequency access layers, and low-frequency access layers. Mutual information is used to measure the comparative dependency between data units and important data units. The importance of data units is calculated based on their access frequency, and storage tiers are then layered. The specific contents include:

[0070] Entropy measures the uncertainty of a random variable. Entropy is the expected amount of information about the probability distribution of all possible values ​​of this random variable. The larger the entropy, the more uncertain the value of the variable. For data units X and Y, the entropy of data units X and Y is expressed as: , ,in: is the probability that X takes a certain value x, It means to sum all possible values ​​of x. is the probability that Y takes a certain y, represents the sum of all possible values ​​of y. The joint entropy of data units X and Y is expressed as: , where: P(x,y) is the joint probability of x and y when X and Y are taken at the same time, It means to sum all possible joint values ​​of X and Y.

[0071] Calculate the mutual information between each pair of data units to measure the dependence between two variables. How much the uncertainty of another data unit can be reduced by the information of one data unit? The mutual information is calculated by the following formula: ,in: is the entropy of data unit X, is the entropy of data unit Y, is the joint entropy of data units X and Y.

[0072] By tracking the access records of data units, counting the specific number of accesses and recording them, the access frequency of each data unit is calculated by the ratio of the number of accesses to the total number of accesses, and using express.

[0073] Construct a dependency matrix, calculate the dependency between each pair of data units based on the mutual information, and construct a dependency matrix, the elements of the matrix I ( , ) indicates a data unit and The mutual information between them.

[0074] The importance of a data unit is calculated by combining the dependency matrix and the access frequency, and is defined by the following formula: = here, Is a data unit and The mutual information between Is a data unit The access frequency of the data unit The importance of a data unit is proportional to its dependencies on other data units and the access frequency of these units.

[0075] Based on the importance of data units, data units are divided into three storage tiers: high-frequency access tier, medium-frequency access tier, and low-frequency access tier:

[0076] Access the historical database to obtain the importance data of multiple data units and merge them into an importance data set. Use the percentile method to set the storage level threshold based on the importance data set, arrange the data in the importance data set from small to large, and set %, % as the percentile ratio, and the importance data is concentrated in the % data value as the high-frequency access layer, in %and % as the medium frequency access layer, below %The data value of the data is used as the underlying access layer;

[0077] For example, percentile %, If the % ratio is set to 20% and 60%, then the data values ​​exceeding 60% of the data values ​​in the importance data set are selected as the high-frequency access layer, the data values ​​between 20% and 60% are selected as the medium-frequency access layer, and the data values ​​below 20% are selected as the medium-frequency access layer. The specific settings can be made by professionals and will not be repeated here.

[0078] In step S3, based on the sudden change in data access frequency, the deviation of node behavior, and the throughput deviation of data units, anomaly detection is performed using Isolation Forest to determine whether a security alert is triggered. Isolation operations are automatically executed through smart contracts. In combination with the consensus mechanism of the blockchain, multi-node cross-validation is performed on the abnormal data units. The specific contents include:

[0079] Isolation forest is used to detect anomalies in data. Isolation forest is an effective anomaly detection method suitable for high-dimensional data and large-scale data sets. It "isolates" abnormal data points by randomly selecting features and randomly splitting data. It uses three parameters, access frequency, node behavior deviation, and throughput, to build an isolation forest model. The steps are as follows:

[0080] Step A1: Calculate the access frequency mutation, node behavior deviation, and throughput standard deviation as feature values ​​to form a multidimensional data set.

[0081] Calculate the moving average and standard deviation of the access frequency, and calculate the deviation between the current time point and the moving average. When the deviation exceeds the threshold, it is considered that a mutation has occurred, which is expressed as the following formula: Access frequency mutation = ,in: Is a data unit Frequency of visits.

[0082] The deviation of node behavior is measured by calculating the standard deviation of the node behavior and the behavior of other nodes in the blockchain network. The mean of all nodes is calculated and recorded as μ. The greater the deviation, the higher the standard deviation, indicating that the node behavior is more irregular, which is expressed as: ,in, is the standard deviation, is the behavior value of each node, μ is the mean of the behavior values ​​of all nodes, and N is the total number of nodes.

[0083] Throughput is used to analyze the severity of path anomalies. Throughput refers to the amount of data successfully transmitted per unit time. Low throughput often indicates path problems. Throughput is expressed as the ratio of successfully transmitted data to the elapsed time. Specifically, successfully transmitted data refers to the number of bytes or bits successfully transmitted per unit time, while elapsed time refers to the time taken to transmit data, typically measured in seconds.

[0084] When constructing each tree, the isolation forest algorithm randomly selects a feature from the dataset and then randomly chooses a split point on that feature to partition the data. This random selection process ensures high diversity in the generated trees. Each isolation tree recursively splits the data points until every data point is isolated, meaning it falls to a leaf node. Each split increases the path length of the data point. Data points with shorter path lengths are generally more likely to be isolated, indicating that their distribution differs from the majority of data points. The isolation forest algorithm assesses the anomaly of each data point by calculating the path length from the root node to a leaf node. The shorter the path length, the earlier the data point was isolated and the higher the likelihood of being an anomaly. The key to the isolation forest algorithm is to combine the path lengths of all isolation trees to calculate an anomaly score for each data point. Data points with high anomaly scores are generally outliers. Based on the anomaly scores of all data points, a threshold is set, and data points exceeding this threshold are considered outliers. Data points with high anomaly scores generally have a distribution that differs significantly from other data points, possibly due to noise or other special reasons.

[0085] Step A2: Set dynamic thresholds based on the mean and standard deviation of historical data:

[0086] Abnormal threshold of access frequency: When the access frequency of the current data point deviates from the historical mean by more than a certain multiple of the standard deviation, a mutation is considered to have occurred.

[0087] Abnormal threshold of node behavior deviation: When the behavior value of a node exceeds the standard deviation of the average behavior of all nodes in the entire network by multiple times, it can also be marked as abnormal.

[0088] Throughput abnormality threshold: Use the historical mean and standard deviation of throughput to set a dynamic threshold. When the throughput is lower than the dynamic threshold, the path is considered abnormal. The degree of throughput fluctuation also needs to be considered. If the throughput fluctuates, a looser threshold can be set; if the fluctuation is small, a stricter threshold can be set and the standard deviation of the throughput can be calculated. By calculating the historical mean of throughput and standard deviation , and then set the threshold to a certain multiple of the historical mean ± standard deviation. When the current throughput is lower than the dynamic threshold, the path is considered abnormal. The threshold is expressed as: , , where k is a constant. or higher , can be marked as abnormal.

[0089] Step A3: If a parameter deviates from a preset threshold, it is flagged as an anomaly, triggering a security alert. Once an anomaly detection is triggered, the smart contract automatically executes certain actions, enabling automated isolation and defense mechanisms. Smart contracts leverage the blockchain's consensus mechanism to ensure the immutability and consistency of operations. Smart contracts are designed to handle actions triggered by anomaly detection. Once an anomalous data unit is detected, the contract automatically isolates it.

[0090] Multiple nodes are introduced for cross-validation. Each node will independently detect the data unit and decide whether to trigger the isolation operation based on the consensus mechanism on the blockchain. Multiple nodes will execute the same isolation forest algorithm on the same data unit to detect whether there is abnormal behavior. If more than a certain proportion of nodes are judged to be abnormal, the isolation operation will be initiated.

[0091] In step S4, the storage level of the data unit is dynamically adjusted through the smart contract. The data is migrated between high, medium, and low frequency access levels based on the access frequency mutation and the risk score of the data unit. The specific contents include:

[0092] Based on the anomaly score and threshold, the risk score can be calculated for each data unit by combining the detection results of the three features. Assume that the weight of each feature is 、 、 , corresponding to the sudden change in data access frequency, the deviation of node behavior and the throughput deviation of data units, the comprehensive risk score R can be expressed as: ,in: 、 and It is an anomaly score calculated based on the data access frequency mutation, node behavior deviation and data unit throughput deviation. 、 、 It is the weight set according to the feature importance.

[0093] When the access frequency mutation and risk score meet specific conditions, the data unit will be automatically migrated to the appropriate storage tier. The specific migration logic is as follows:

[0094] High-frequency data migration: When the access frequency of a data unit exceeds a threshold or the risk score exceeds a threshold, the smart contract will automatically migrate it to the high-frequency access layer. If the change is rapid, a rapid migration can be triggered.

[0095] Low-frequency data migration: When the access frequency of a data unit is lower than a threshold, the smart contract can migrate it to a low-frequency storage layer to reduce storage costs.

[0096] Migration based on risk scoring: Based on risk scoring, high-risk data may need to be stored in a more secure and efficient storage tier, even if it is accessed less frequently. For example, important contract data or sensitive information, even if accessed less frequently, should be stored in a high-frequency storage tier to ensure fast access and high security.

[0097] To ensure that data migration is dynamic and real-time, the smart contract can trigger a migration check after each data access or periodically. It can check the access frequency each time the data is accessed and decide whether migration is needed. It can also set a migration check to be triggered periodically.

[0098] Example 2. The present invention discloses a blockchain-based QR code data security detection method and system, including: a parsing and verification module, a storage layering module, a dynamic detection module and a storage optimization module, and signal connections between each module.

[0099] Parsing and Verification Module: Parses the encoding format to generate a standardized data structure, splits it into data units containing the original information and a checksum, uses a hash algorithm to generate a unique identifier for the data unit, records the generation time of the timestamp, and verifies the compliance of the data unit by combining the hash algorithm and timestamp. The verification results are broadcast to other nodes via the blockchain network to reach a consensus;

[0100] Storage tiering module: Adds a new tiered storage architecture that divides data units into high-frequency access layers, medium-frequency access layers, and low-frequency access layers. It uses mutual information to measure the comparative dependency between data units and important data units, calculates the importance of data units based on their access frequency, and performs storage tiering.

[0101] Dynamic Detection Module: This module uses isolation forests to detect anomalies based on sudden changes in data access frequency, deviations in node behavior, and data unit throughput deviations. This module determines whether a security alert has been triggered and automatically executes isolation operations through smart contracts. Furthermore, it integrates the blockchain consensus mechanism to perform multi-node cross-validation on abnormal data units.

[0102] Storage optimization module: Dynamically adjusts the storage level of data units through smart contracts, and migrates data between high, medium, and low frequency access levels based on access frequency mutations and data unit risk scores.

[0103] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0104] The above embodiments may be implemented in whole or in part through software, hardware, firmware or any other combination. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product.

[0105] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application of the technical solution and the invention constraints. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0106] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0107] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0108] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A QR code data security detection method based on blockchain, characterized in that: Including steps: Step S1: Parse the encoding format to generate a standardized data structure, split it into data units containing original information and checksums, use a hash algorithm to generate a unique identifier for the data unit, record the generation time of the timestamp, and verify the compliance of the data unit by combining the hash algorithm and timestamp. The verification result is broadcast to other nodes through the blockchain network to reach consensus; Step S2: Add a new tiered storage architecture, divide data units into high-frequency access layer, medium-frequency access layer, and low-frequency access layer, use mutual information to measure the comparative dependency between data units and important data units, calculate the importance of data units based on their access frequency, and perform storage tiering. Step S3: Based on the sudden change in data access frequency, the deviation of node behavior, and the throughput deviation of data units, anomaly detection is performed using Isolation Forest to determine whether a security alert is triggered. The smart contract automatically executes the isolation operation and, combined with the consensus mechanism of the blockchain, multi-node cross-validation is performed on the abnormal data units. Step S4: Dynamically adjust the storage level of the data unit through the smart contract, and migrate the data between high, medium, and low frequency access levels based on the access frequency mutation and the risk score of the data unit; By tracking the access records of data units, counting the specific number of accesses and recording them, the access frequency of each data unit is calculated by the ratio of the number of accesses to the total number of accesses, and using express; The dependency between each pair of data units is calculated based on the mutual information, and the dependency matrix is ​​constructed. The elements of the matrix I ( , ) indicates a data unit and Mutual information between The importance of a data unit is calculated by combining the dependency matrix and the access frequency, and is defined by the following formula: ； here, Is a data unit and The mutual information between Is a data unit Frequency of visits.

2. The blockchain-based QR code data security detection method according to claim 1, characterized in that: Parse the raw data, represent the data in CSV encoding format, standardize it into a unified structure, and record each data unit in the structured data format, including the original information and checksum; The check code is generated using a hash algorithm, and a unique identifier is generated for each data unit using the hash algorithm; A timestamp is attached to each data unit to record the specific time of generation; After generating the hash value and timestamp of the data unit, the data is verified to be complete and not tampered with by recalculating the hash value and comparing it with the stored hash value. The timestamp checks whether the data is generated within the expected time range. Together, they verify the compliance of the data unit. When the data does not conform to the specified time window or its hash value does not match, it means that the data has been tampered with. After verification, the hash value and timestamp of the data unit are broadcast to other nodes through the blockchain network. The consensus mechanism ensures that all nodes reach an agreement on the validity of the data. After verifying and agreeing on the legitimacy of the data, the data is permanently recorded in the blockchain.

3. The blockchain-based QR code data security detection method according to claim 2, characterized in that: Entropy is used to measure the certainty of data units X and Y. The entropy of data units X and Y is expressed as: ， ； in: is the probability that X takes a certain value x, It means to sum all possible values ​​of x. is the probability that Y takes a certain y, It represents the sum of all possible values ​​of y. The joint entropy of data units X and Y is expressed as: , where: P(x, y) is the joint probability of x and y when X and Y are taken at the same time, Indicates the sum of all joint values ​​of X and Y; Calculate the mutual information between each pair of data units to measure the dependence between two variables. The mutual information is calculated by the following formula: ,in: is the entropy of data unit X, is the entropy of data unit Y, is the joint entropy of data units X and Y.

4. The blockchain-based QR code data security detection method and system according to claim 1, characterized in that: Based on the importance of data units, data units are divided into three storage tiers: high-frequency access tier, medium-frequency access tier, and low-frequency access tier: Access the historical database to obtain the importance data of multiple data units and merge them into an importance data set. Use the percentile method to set the storage level threshold based on the importance data set, arrange the data in the importance data set from small to large, and set %, % as the percentile ratio, and the importance data is concentrated in the % data value as the high-frequency access layer, in %and % as the medium frequency access layer, below % The data value of data serves as the underlying access layer.

5. The blockchain-based QR code data security detection method according to claim 4 is characterized in that ； Calculate access frequency mutation, node behavior deviation and throughput standard deviation as feature values ​​to form a multidimensional data set; Calculate the moving average and standard deviation of the access frequency, and calculate the deviation between the current time point and the moving average, which is expressed as the following formula: Access frequency mutation = ,in: Is a data unit Frequency of visits; By calculating the standard deviation of the node behavior and the behavior of other nodes in the blockchain network, the mean of all nodes is calculated and recorded as μ, which is expressed as: , among which: among which, is the standard deviation, is the behavior value of each node, μ is the mean of the behavior values ​​of all nodes, and N is the total number of nodes; The abnormality of a path is analyzed based on throughput deviation, which is expressed as the ratio of the amount of data successfully transmitted to the time taken; Isolation forest constructs multiple isolated trees by randomly selecting features and performing random splits on the features. The abnormality of the data point is calculated by analyzing the path length from the root node to the leaf node of the isolation tree to obtain the split depth, which is recorded as the anomaly score. The anomaly scores of all isolated trees are combined and a threshold is set for the anomaly score. A score above the anomaly score threshold indicates data anomaly.

6. The blockchain-based QR code data security detection method according to claim 5, characterized in that: Set dynamic thresholds based on the mean and standard deviation of historical data: Abnormal threshold of access frequency: When the access frequency of the current data point deviates from the historical mean by a certain multiple of the standard deviation, it is considered that a mutation has occurred; Abnormal threshold of node behavior deviation: When the behavior value of a node exceeds the standard deviation of the average behavior value of all nodes in the network by multiple times, it is marked as abnormal; Throughput abnormality threshold: Use the historical mean and standard deviation of throughput to set a dynamic threshold. When the throughput is lower than the dynamic threshold, the path is considered abnormal. The degree of throughput fluctuation also needs to be considered. By calculating the historical mean of throughput and standard deviation , set the threshold to a certain multiple of the historical mean ± standard deviation. When the current throughput is lower than the dynamic threshold, the path is considered abnormal. The threshold is expressed as: , , where k is a constant lower than or higher When , it is marked as abnormal; If a parameter deviates from the preset threshold, it is marked as an anomaly, triggering a security alert. Anomaly detection is triggered, and a smart contract is designed to handle the actions triggered by the anomaly detection. The contract automatically isolates the data unit. Multiple nodes are introduced for cross-validation. Each node will independently detect the data unit and decide whether to trigger the isolation operation based on the consensus mechanism on the blockchain. The same isolation forest algorithm is executed on the same data unit to detect whether there is abnormal behavior. When more than a certain proportion of nodes are judged to be abnormal, the isolation operation is initiated.

7. The blockchain-based QR code data security detection method according to claim 6, characterized in that: The risk score is calculated for each data unit by combining the detection results of the three features. Assuming that the weight of each feature is 、 、 , corresponding to the sudden change in data access frequency, the deviation of node behavior and the throughput deviation of data units, the comprehensive risk score R can be expressed as: ,in: 、 and It is an anomaly score calculated based on the data access frequency mutation, node behavior deviation and data unit throughput deviation. 、 、 It is the weight set according to the feature importance.

8. The blockchain-based QR code data security detection method according to claim 7, characterized in that: When the access frequency mutation and risk score meet specific conditions, the data unit will be automatically migrated to the appropriate storage tier. The specific migration logic is as follows: High-frequency data migration: When the access frequency of a data unit exceeds a threshold or the risk score exceeds a threshold, the smart contract will automatically migrate it to the high-frequency access layer; Low-frequency data migration: When the access frequency of a data unit falls below a threshold, the smart contract can migrate it to a low-frequency storage layer to reduce storage costs. The smart contract triggers a migration check after each data access or periodically. It checks the access frequency each time data is accessed and decides whether migration is required. It is set to trigger a migration check periodically.

9. A blockchain-based QR code data security detection system, used to implement the blockchain-based QR code data security detection method according to any one of claims 1 to 8, characterized in that: Parsing and Verification Module: Parses the encoding format to generate a standardized data structure, splits it into data units containing the original information and a checksum, uses a hash algorithm to generate a unique identifier for the data unit, records the generation time of the timestamp, and verifies the compliance of the data unit by combining the hash algorithm and timestamp. The verification results are broadcast to other nodes via the blockchain network to reach a consensus; Storage tiering module: Adds a new tiered storage architecture that divides data units into high-frequency access layers, medium-frequency access layers, and low-frequency access layers. It uses mutual information to measure the comparative dependency between data units and important data units, calculates the importance of data units based on their access frequency, and performs storage tiering. Dynamic Detection Module: This module uses isolation forests to detect anomalies based on sudden changes in data access frequency, deviations in node behavior, and data unit throughput deviations. This module determines whether a security alert has been triggered and automatically executes isolation operations through smart contracts. Furthermore, it integrates the blockchain consensus mechanism to perform multi-node cross-validation on abnormal data units. Storage optimization module: Dynamically adjusts the storage level of data units through smart contracts, and migrates data between high, medium, and low frequency access levels based on access frequency mutations and data unit risk scores.

Images