A malicious deletion traceability method of a blockchain-based distributed file system

Abstract

The application relates to a malicious deletion traceability method based on a blockchain-based distributed file system and belongs to the technical field of data security, and solves the problems of inaccurate positioning and low traceability efficiency of an existing malicious deletion operation. When a write deletion operation is performed, the behavior characteristics of the current deletion operation are extracted, and a risk level is obtained by using a deletion behavior identification model; the deletion behavior identification model is a neural network model combined with a CNN network and an LSTM network and introducing a self-attention mechanism; according to the risk levels of the current deletion operation and the previous deletion operation, a detection anchor point is created or updated, and the detection anchor point to which the current deletion operation belongs is set; each detection anchor point is written into a detection stack with a corresponding priority; when a malicious deletion operation occurs, the deletion operations contained in each detection anchor point in the detection stack are checked according to the malicious deletion file identifier and the priority of the detection stack until the malicious deletion operation is found. The rapid traceability of the malicious deletion operation is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a malicious deletion traceability method of a distributed file system based on a block chain. BACKGROUND

[0002] In the distributed file system based on the block chain, the malicious deletion operation can bring a serious threat to the integrity of the file and the security of the data, therefore, how to accurately identify the malicious deletion behavior and effectively trace the starting position and the influence range thereof becomes a key problem to be solved.

[0003] The prior art lacks a real-time risk assessment mechanism for the operation behavior, so that the risk level of the deletion operation is difficult to be dynamically evaluated, some high-risk malicious operations are difficult to be identified and processed in time, and the low-risk regular operation can waste the traceability resources and slow down the traceability process. In addition, some static detection rules cannot adapt to the dynamic change of the operation environment, resulting in the lag and inaccuracy of the detection result.

[0004] In addition, when the traditional malicious deletion behavior traceability is performed, the operation records are often scanned and compared one by one, resulting in low traceability efficiency, especially in the distributed system with massive data storage, the operation records are very much, such processing mode not only has large calculation cost, but also can cause serious decline of the system performance. SUMMARY

[0005] In view of the above analysis, the embodiments of the present application aim to provide a malicious deletion traceability method of a distributed file system based on a block chain, so as to solve the problem of inaccurate positioning of the existing malicious deletion operation and low traceability efficiency.

[0006] The embodiments of the present application provide a malicious deletion traceability method of a distributed file system based on a block chain, comprising the following steps:

[0007] When the file operation log of the block chain writes the deletion operation, the behavior characteristics of the current deletion operation are extracted, and the risk level of the current deletion operation is obtained by using a deletion behavior identification model; the deletion behavior identification model is a neural network model combined with a CNN network and an LSTM network and introducing a self-attention mechanism;

[0008] According to the risk levels of the current deletion operation and the previous deletion operation, a detection anchor point is created or updated, and the detection anchor point to which the current deletion operation belongs is set; according to the risk levels of the detection anchor points, the detection anchor points are written into the detection stack of the corresponding priority;

[0009] When the malicious deletion operation occurs, the deletion operations contained in each detection anchor point in the detection stack are verified according to the malicious deletion file identifier and the priority of the detection stack, until the malicious deletion operation is found.

[0010] Based on the further improvement of the above method, the behavior characteristics of the current deletion operation include: deletion mode, number of deleted files, size of deleted files, highest category of deleted files, deletion interval time and node reputation; the node reputation is the reputation of the node initiating the deletion operation in the distributed file system, which is based on the initial reputation value and dynamically updated according to the stability score, contribution score and compliance score of the node after each round of consensus cycle is completed.

[0011] Based on the further improvement of the above method, the risk level of the current deletion operation is obtained by using the deletion behavior identification model, including:

[0012] The behavior characteristics of the current deletion operation are received by the CNN network, and the first feature vector of the current deletion operation is output;

[0013] The first feature vectors of a plurality of historical deletion operations are taken out from the feature queue and combined with the first feature vector of the current deletion operation to form a first feature vector sequence which is input into the LSTM network, and the hidden state corresponding to each first feature vector is output and input into the attention layer;

[0014] The attention layer calculates the weight of each hidden state by using the self-attention mechanism and weightedly sums to obtain the second feature vector which is input into the fully connected layer;

[0015] The fully connected layer maps the second feature vector to the probabilities of a plurality of risk levels, and takes the risk level corresponding to the maximum probability as the risk level of the current deletion operation.

[0016] Based on the further improvement of the above method, the risk level includes high risk, medium risk and low risk; the detection anchor point contains one or more deletion operations with medium risk or high risk.

[0017] Based on the further improvement of the above method, according to the risk levels of the current deletion operation and the last deletion operation, the detection anchor point is created or updated, and the detection anchor point to which the current deletion operation belongs is set, including:

[0018] If the risk level of the current deletion operation is high risk or medium risk, and the risk level of the last deletion operation is low risk, a new detection anchor point is created, and the current deletion operation is set as the starting operation of the new detection anchor point;

[0019] If the risk level of the current deletion operation is low risk, and the risk level of the last deletion operation is high risk or medium risk, the last deletion operation is set as the end operation of the last created detection anchor point;

[0020] If the risk level of the current deletion operation is high risk or medium risk, and the risk level of the previous deletion operation is also high risk or medium risk, then the current deletion operation is set to be a deletion operation in the last detection anchor point created;

[0021] If the risk level of the current deletion operation and the previous deletion operation are both low risk, they do not belong to any detection anchor point.

[0022] Based on the further improvement of the above method, each detection anchor point contains all deletion operations within the time range of its starting operation and its ending operation. The highest risk level of all the deletion operations it contains is taken as the risk level of the detection anchor point, and the time of the ending operation is taken as the time of the detection anchor point.

[0023] Based on the further improvement of the above method, according to the malicious deletion file identification and the priority of the detection stack, the deletion operations contained in each detection anchor point in the detection stack are verified until the malicious deletion operation is found, including:

[0024] Obtaining a deletion operation including the deleted file identifier according to the deleted file identifier, and then determining the detection anchor point to which it belongs as the first candidate anchor point;

[0025] Respectively obtaining other detection anchor points within a preset period before the time of the first candidate anchor point from the high-priority and low-priority detection stacks as the second candidate anchor point and the third candidate anchor point;

[0026] Deletion operations with a low risk level within a preset time period before the time of the anchor point to be verified are taken as the fourth candidate anchor point;

[0027] The deletion operations in the first candidate anchor point, the second candidate anchor point, the third candidate anchor point and the fourth candidate anchor point are verified in sequence. If a malicious deletion operation is found, the verification is terminated.

[0028] Based on a further improvement of the above method, malicious deletion operations are verified from three dimensions: file content integrity, file permission matching, and compliance of associated log operations. If any dimension has an anomaly, it is determined to be a malicious deletion operation.

[0029] Based on further improvements to the above method, file content integrity means that the content hash value of the deleted file is consistent with the content hash value of its backup file; file permission matching includes: the user who deleted the file has file deletion permission, and the file permissions have not been changed before deletion; associated log operation compliance includes: the associated log timestamps are continuous in a short period of time after the file is deleted, and there are no batch deletion and creation operations.

[0030] Based on the further improvement of the above method, the deletion behavior recognition model calculates the loss function value and updates the model parameters during the training process using the following formula:

[0031] ,

[0032] in, Represents the loss function value of each batch in the training sample set, represents the number of samples in a batch, Indicates the The category of samples The category weights, Represents the category in the training sample set The proportion of the total number of Indicates the first The proportion of the number of categories to the total number, Indicates the total number of categories, Indicates the The probability that a sample belongs to the true category, represents the adjustment weight of difficult and easy samples, represents the basic weight of difficult and easy samples, Represents the adjustment coefficient.

[0033] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0034] 1. By combining deep learning, detection anchors, and a detection stack mechanism, this approach addresses existing shortcomings in identifying and tracing malicious deletion operations, improving the data security and traceability response speed of distributed file systems.

[0035] 2. Utilizing a neural network model combining CNN and LSTM, we fully analyze the multi-dimensional behavioral characteristics of deletion operations, conduct real-time risk assessments on deletion operations, accurately label risk levels, and significantly improve the accuracy of identifying malicious deletion operations, reducing missed detections and false positives.

[0036] 3. Deletion operations of different risk levels are assigned to detection anchors of different risk levels. This facilitates rapid location of the malicious operation during malicious deletion tracing. The detection order is implemented through the priority of the detection stack, avoiding a global scan of all operation records. While reducing unnecessary calculations and verification, it focuses on the context-related operations of malicious deletion, thereby achieving efficient and rapid tracing.

[0037] In the present invention, the above-mentioned technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of the present invention will be described in the following description, and some advantages will become apparent from the description or be learned through practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the contents particularly pointed out in the description and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0038] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and are meant to explain the principles of the application, but are not intended to limit the scope of the application.

[0039] Figure 1 A malicious deletion traceability method for a blockchain-based distributed file system in an embodiment of the application. DETAILED DESCRIPTION

[0040] The preferred embodiments of the present application will be described in detail below with reference to the drawings, in which the same reference numerals denote the same components throughout the drawings, and the principles of the present application are explained with the embodiments of the present application, but are not intended to limit the scope of the present application.

[0041] One specific embodiment of the present application discloses a malicious deletion traceability method for a blockchain-based distributed file system, as shown in Figure 1 The method comprises the following steps:

[0042] S1, when a file operation log of a blockchain writes a deletion operation, the behavior features of the current deletion operation are extracted, and a deletion behavior recognition model is used to obtain the risk level of the current deletion operation; the deletion behavior recognition model is a neural network model combining a CNN network and an LSTM network and introducing a self-attention mechanism.

[0043] This embodiment uses the file operation log of the blockchain to record the operation of each node in the distributed file system, so as to accurately analyze the starting position and influence range of the malicious deletion operation, and to perform real-time analysis and monitoring on the deletion operation.

[0044] It should be noted that the original information recorded in the file operation log for the deletion operation includes: deletion mode, number of deleted files, size of deleted files, name of each deleted file, category of each deleted file, content hash value of each deleted file, request node identifier, node reputation, operation user identifier, and deletion time. Among them, the deletion mode includes: single file deletion and batch deletion; the size of the deleted file is the total size of the file deleted at one time; the category of the deleted file is set by the distributed file system, such as personal files, temporary files, backup files, and system files, etc., each category corresponds to a corresponding level; the request node identifier is the node that initiates the deletion operation in the distributed file system; the node reputation is the reputation of the node that initiates the deletion operation in the distributed file system, which is based on the initial reputation value and dynamically updated according to the stability score, contribution score and compliance score of the node after each completed consensus cycle.

[0045] It should be noted that a consensus cycle refers to the process from the submission of the transaction corresponding to the file operation to the blockchain network, to the packaging of the transaction into the block, and the final confirmation of the block by the network through the consensus algorithm.

[0046] Node stability score Based on the packet loss rate and network delay variance The calculation formula is as follows:

[0047] .

[0048] Node contribution score It is obtained by weighting the node's storage contribution rate and response rate. The node's storage contribution rate is the ratio of the node's storage capacity to the maximum storage capacity, and the response rate is the ratio of the node's response times within a preset time period to the total number of responses.

[0049] The compliance score of a node is the score rewarded by calculating the number of consecutive times without malicious deletion behavior, or the score punished by malicious deletion behavior.

[0050] When performing dynamic updates, the scores of each part are compared with the corresponding thresholds, and the initial credibility value is increased or deducted according to the value exceeded or lowered.

[0051] According to the original information of the deletion operation record, the extracted behavioral features include: deletion mode, number of deleted files, size of deleted files, highest category of deleted files, deletion interval time and node reputation.

[0052] Furthermore, this embodiment uses the deletion behavior recognition model to identify the risk level of the deletion operation, where the risk level includes high risk, medium risk, and low risk.

[0053] It should be noted that the deletion behavior recognition model includes: CNN network, LSTM network, attention layer and fully connected layer in sequence; among them, the CNN network is used to extract the spatial features of the deletion operation, the LSTM network is used to extract the temporal features of the deletion operation, the attention mechanism layer is used to increase the weight of the key features, and finally a fully connected layer is connected. The features output by the self-attention mechanism are mapped to the classification space through the softmax activation function, and the predicted probabilities of different risk levels are output.

[0054] When training the deletion behavior recognition model, a sliding window (window size T, step size S) is used to obtain the behavioral features of deletion operations from historical file operation logs to generate each sample sequence. That is, the behavioral features of every T deletion operations are extracted according to a fixed length and step size as a sample. The actual risk level of the last deletion operation in each sample is taken as the label for the entire sample sequence, and N samples are considered a batch.

[0055] The CNN network then sequentially processes the D-dimensional behavioral features of each deletion operation in each sample, convolving them to convert them into a high-dimensional first eigenvector, such as D'. This outputs N × T D'-dimensional first eigenvectors. The LSTM network sequentially processes the T D'-dimensional feature vectors in each sample, calculating an H-dimensional hidden state for each. The attention layer processes the T H-dimensional hidden states output by the LSTM network for each sample, calculating the weights for each hidden state and performing a weighted sum to obtain an H-dimensional second eigenvector representing each sample. The fully connected layer maps each H-dimensional second eigenvector of each sample to the probabilities of three risk levels. Ultimately, for each batch, it outputs N 3-dimensional vectors, each corresponding to the probability of one of the three risk levels for a sample. The risk level corresponding to the highest probability is taken as the predicted risk level.

[0056] Considering that there are relatively few samples corresponding to malicious file deletion operations in actual scenarios, this embodiment adopts an improved Focal Loss as the loss function, dynamically adjusts the weights of samples of each category, reduces the contribution of easy-to-classify samples, and guides the learning focus of the model to malicious samples that are difficult to classify, thereby improving the detection accuracy of malicious file deletion behavior.

[0057] Specifically, during the training process, the deletion behavior recognition model calculates the loss function value and updates the model parameters using the following formula:

[0058] ,

[0059] in, Represents the loss function value of each batch in the training sample set, represents the number of samples in a batch, Indicates the The category of samples The category weights, Represents the category in the training sample set The proportion of the total number of Indicates the first The proportion of the number of categories to the total number, Indicates the total number of categories, Indicates the The probability that a sample belongs to the true category, represents the adjustment weight of difficult and easy samples, represents the basic weight of difficult and easy samples, , represents the adjustment coefficient, .

[0060] From the above formula, we can see that the category weight is calculated based on the ratio of the number of categories. The fewer the number of categories, the greater the weight. The difficulty sample adjustment weight is dynamically calculated based on the average prediction confidence of the current batch of samples. If the average prediction confidence is low, it means that the overall difficulty of the current batch of samples is high and a larger Focus on difficult samples, otherwise reduce And avoid excessive attention.

[0061] After the deletion behavior recognition model is trained, in actual application, in order to improve processing efficiency, the CNN network only processes the behavioral features of the newly collected deletion operation, and the input of the LSTM is a sequence. Therefore, this embodiment maintains a feature queue with a length of T-1, and saves the first feature vector output by the CNN network of the behavioral features of the most recent T-1 deletion operations. When the deletion behavior recognition model predicts the risk level of the current deletion operation, the first feature vector output by the CNN network of the current deletion operation is added to the feature queue, and the oldest first feature vector in the feature queue is removed, and the length of the feature queue is kept at T-1.

[0062] Specifically, the deletion behavior recognition model is used to obtain the risk level of the current deletion operation through the following steps:

[0063] Receive the behavioral features of the current deletion operation through the CNN network and output the first feature vector of the current deletion operation;

[0064] The first feature vectors of multiple historical deletion operations are taken from the feature queue and combined with the first feature vector of the current deletion operation to form a first feature vector sequence and input it into the LSTM network. The hidden state corresponding to each first feature vector is output and input into the attention layer.

[0065] The attention layer uses the self-attention mechanism to calculate the weight of each hidden state and the weighted sum is used to obtain the second eigenvector, which is then passed to the fully connected layer.

[0066] The fully connected layer maps the second eigenvector to the probabilities of multiple risk levels, and takes the risk level corresponding to the maximum probability as the risk level of the current deletion operation.

[0067] This step fully utilizes the characteristics of file operation logs, which have both spatial behavioral characteristics and time series characteristics. It uses CNN networks and LSTM networks and introduces an attention mechanism to focus on the most suspicious operations, significantly improving the ability to identify the risk level of deletion operations.

[0068] S2. If the risk level of the current deletion operation is different from that of the previous deletion operation, create or update a detection anchor point and set the detection anchor point to which the current deletion operation belongs; and write each detection anchor point into the detection stack of the corresponding priority according to the risk level of each detection anchor point.

[0069] It should be noted that according to the risk level of the current deletion operation and the last deletion operation, the detection anchor point is created or updated, and the detection anchor point to which the current deletion operation belongs is set, including:

[0070] If the risk level of the current deletion operation is high risk or medium risk, and the risk level of the last deletion operation is low risk, a new detection anchor point is created, and the current deletion operation is set as the starting operation of the new detection anchor point;

[0071] If the risk level of the current deletion operation is low risk, and the risk level of the last deletion operation is high risk or medium risk, the last deletion operation is set as the end operation of the last created detection anchor point;

[0072] If the risk level of the current deletion operation is high risk or medium risk, and the risk level of the last deletion operation is high risk or medium risk, the current deletion operation is set as one of the deletion operations in the last created detection anchor point;

[0073] If the risk level of the current deletion operation and the last deletion operation are both low risk, it does not belong to any detection anchor point.

[0074] Based on the above, the detection anchor point of the embodiment contains one or more deletion operations with medium risk or high risk. When there are multiple, the detection anchor point is equivalent to a detection interval, and there are clear starting operation and end operation. The deletion operation in the time range of the starting operation and the end operation belongs to the detection anchor point, and the highest risk level of all the deletion operations contained is taken as the risk level of the detection anchor point, and the time of the end operation is taken as the time of the detection anchor point. That is, the high-risk detection anchor point contains at least one deletion operation with high risk, and the medium-risk detection anchor point contains only deletion operations with medium risk.

[0075] The relevant information (starting operation, end operation, all contained deletion operations, risk level and time) of each detection anchor point is organized in JSON format and stored in a NoSQL database to obtain the identification of each detection anchor point.

[0076] From the perspective of deleting files, the relevant information of the deletion operation with medium risk and high risk is recorded in the deletion index record, and the deletion index record includes: deletion file identification, risk level, last deletion time, identification of the detection anchor point to which it belongs; The deletion index record is stored in a data relational database or a NoSQL database, which facilitates subsequent quick retrieval according to the deletion file identification, without the need to traverse the file operation logs of each node of the blockchain, greatly improving the retrieval efficiency.

[0077] Considering that some files perform logical deletion, and it is possible to be deleted again after recovery, each time a record is added to the deletion index record, it is first determined whether a deletion index record exists according to the deletion file identifier, if it exists, the information is updated, if it does not exist, a new record is added.

[0078] Further, the priority of the detection stack includes a high priority and a low priority; the identifier of the high-risk detection anchor point in the database is stored in the high-priority detection stack, and the identifier of the medium-risk detection anchor point in the database is stored in the low-priority detection stack.

[0079] S3, when the malicious deletion operation occurs, according to the malicious deletion file identifier and the priority of the detection stack, the deletion operation contained in each detection anchor point in the detection stack is verified until the malicious deletion operation is found.

[0080] The embodiment considers that when the malicious deletion operation occurs, if only the malicious deletion file identifier is used, the source of the malicious deletion operation will be ignored, and the vulnerability existing in the distributed system cannot be accurately located, and the occurrence of similar events is effectively prevented. Therefore, the malicious deletion file identifier is used to quickly locate the detection anchor point, and the high-risk and medium-risk deletion operations in the corresponding range are verified, unnecessary calculation and verification are reduced, and efficient and rapid tracing is realized.

[0081] Specifically, according to the malicious deletion file identifier and the priority of the detection stack, the deletion operation contained in each detection anchor point in the detection stack is verified until the malicious deletion operation is found, including:

[0082] According to the deletion file identifier, the deletion operation containing the deletion file identifier is obtained, and the detection anchor point belonging to the deletion operation is determined as a first candidate anchor point;

[0083] The other detection anchor points in a preset time period before the time of the first candidate anchor point are obtained from the high-priority and low-priority detection stacks as second candidate anchor points and third candidate anchor points;

[0084] The deletion operation with a low-risk level in a preset time before the time of the to-be-verified anchor point is taken as a fourth candidate anchor point;

[0085] The deletion operations in the first candidate anchor point, the second candidate anchor point, the third candidate anchor point and the fourth candidate anchor point are sequentially verified in order, and if the malicious deletion operation is found, the verification is ended.

[0086] It should be noted that according to the deletion file identifier, the deletion operation containing the deletion file identifier is quickly obtained from the deletion index record, and the first candidate anchor point belonging to the deletion operation is obtained. When the deletion operation of each candidate anchor point is verified, it is sequentially verified from the starting operation.

[0087] Malicious deletion operations are verified from three dimensions: file content integrity, file permission matching, and compliance of associated log operations. If any dimension is abnormal, it is determined to be a malicious deletion operation and submitted for manual review.

[0088] File content integrity means that the content hash value of the deleted file is consistent with the content hash value of its backup file, indicating that the deleted file's content has not been tampered with or lost. If multiple backup versions exist, the content hash value of only one of the backup versions is sufficient.

[0089] File permission matching includes: the user who deletes the file has the file deletion permission, and the file permissions are unchanged before deletion. Among them, the user who deletes the file has the file deletion permission, which includes the user being authorized to delete the file by a specific user group, or being directly granted the deletion permission for the file. The file permissions are unchanged before deletion to avoid the permissions being suddenly relaxed shortly before the deletion operation.

[0090] Compliance with associated log operations includes ensuring that the associated log timestamps are continuous within a short period after file deletion, and that there are no batch deletion, creation, or modification operations. Associated logs include key logs such as system logs, audit logs, and operation tracking logs. The purpose of ensuring that timestamps are continuous and there are no batch deletion or creation operations is to avoid the possibility of missing records through deletion, falsified records through creation, or tampering with records through modification to conceal malicious activity.

[0091] Through verification in the above three dimensions, malicious deletion operations can be comprehensively and accurately identified, providing solid and reliable support and basis for subsequent in-depth security incident investigations, responsibility tracing and system recovery work.

[0092] Compared with the existing technology, the present embodiment provides a method for tracing the malicious deletion of a distributed file system based on blockchain. By combining deep learning, detection anchors and detection stack mechanisms, it solves the existing deficiencies in malicious operation identification and tracing efficiency, and improves the data security and traceability response speed of the distributed file system. By using a neural network model combining CNN and LSTM, the multi-dimensional behavioral characteristics of the deletion operation are fully analyzed, and a real-time risk assessment of the deletion operation is performed. The risk level is accurately marked, which significantly improves the accuracy of identifying malicious deletion operations and reduces the occurrence of missed detections and false alarms. Deletion operations of different risk levels are assigned to detection anchors of different risk levels, which facilitates the rapid positioning of the area where the malicious operation is located when tracing the malicious deletion, and the detection order is achieved through the priority of the detection stack, avoiding a global scan of all operation records. While reducing unnecessary calculations and verifications, attention is paid to the context-related operations of malicious deletion, thereby achieving efficient and rapid tracing.

[0093] Those skilled in the art will appreciate that all or part of the process steps of the above-described embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, such as a magnetic disk, an optical disk, a read-only memory, or a random access memory.

[0094] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of protection of the present invention.

Claims

1. A method for tracing malicious deletions in a distributed file system based on blockchain, characterized in that: The following steps are involved: When a deletion operation is recorded in the blockchain's file operation log, the behavioral characteristics of the current deletion operation are extracted, and the risk level of the current deletion operation is determined using a deletion behavior recognition model. The deletion behavior recognition model is a neural network model that combines a CNN network and an LSTM network and introduces a self-attention mechanism. The method of using the deletion behavior recognition model to obtain the risk level of the current deletion operation includes: receiving the behavioral features of the current deletion operation through a CNN network and outputting a first feature vector of the current deletion operation; extracting the first feature vectors of multiple historical deletion operations from a feature queue and the first feature vector of the current deletion operation to form a first feature vector sequence, which is input into an LSTM network, and outputting the hidden state corresponding to each first feature vector, which is input into an attention layer; the attention layer uses a self-attention mechanism to calculate the weight of each hidden state and performs weighted summation to obtain a second feature vector, which is input into a fully connected layer; the fully connected layer maps the second feature vector to the probabilities of multiple risk levels, and takes the risk level corresponding to the maximum probability as the risk level of the current deletion operation; Create or update a detection anchor point based on the risk levels of the current and previous deletion operations, and set the detection anchor point to which the current deletion operation belongs. This includes: if the risk level of the current deletion operation is high or medium risk, and the risk level of the previous deletion operation is low risk, then create a new detection anchor point and set the current deletion operation as the starting operation of the new detection anchor point. If the risk level of the current deletion operation is low risk and the risk level of the previous deletion operation is high risk or medium risk, then set the previous deletion operation as the end operation of the last detection anchor point created; if the risk level of the current deletion operation is high risk or medium risk and the risk level of the previous deletion operation is high risk or medium risk, then set the current deletion operation as a deletion operation in the last detection anchor point created; if the risk level of both the current deletion operation and the previous deletion operation is low risk, then they do not belong to any detection anchor point; according to the risk level of each detection anchor point, write each detection anchor point into the detection stack of the corresponding priority; When a malicious deletion operation occurs, the deletion operations contained in each detection anchor point in the detection stack are verified according to the malicious deletion file identifier and the priority of the detection stack until the malicious deletion operation is found, including: obtaining the deletion operation containing the deletion file identifier according to the deletion file identifier, and then determining the detection anchor point to which it belongs as the first candidate anchor point; obtaining other detection anchor points within a preset time period before the time of the first candidate anchor point from the high-priority and low-priority detection stacks respectively as the second candidate anchor point and the third candidate anchor point; taking the deletion operation with a low risk level within the preset time before the time of the verification anchor point as the fourth candidate anchor point; verifying the deletion operations in the first candidate anchor point, the second candidate anchor point, the third candidate anchor point and the fourth candidate anchor point in sequence. If a malicious deletion operation is found, the verification is ended.

2. The method for tracing malicious deletions in a distributed file system based on blockchain according to claim 1, characterized in that: The behavioral characteristics of the current deletion operation include: deletion mode, number of deleted files, size of deleted files, highest category of deleted files, deletion interval time and node reputation; the node reputation is the reputation of the node that initiates the deletion operation in the distributed file system, which is based on the initial reputation value and is dynamically updated according to the node's stability score, contribution score and compliance score after each consensus cycle is completed.

3. The method for tracing malicious deletions in a distributed file system based on blockchain according to claim 1, characterized in that: The risk levels include high risk, medium risk and low risk; the detection anchor points include one or more deletion operations with a risk level of medium risk or high risk.

4. The method for tracing malicious deletions in a distributed file system based on blockchain according to claim 3 is characterized in that: Each detection anchor point contains all deletion operations within the time range of its start operation and its end operation. The highest risk level of all the deletion operations it contains is taken as the risk level of the detection anchor point, and the time of the end operation is taken as the time of the detection anchor point.

5. The method for tracing malicious deletions in a distributed file system based on blockchain according to claim 1 or 3, characterized in that: The malicious deletion operation is verified in three dimensions: file content integrity, file permission matching, and compliance of associated log operations. If any dimension has an abnormality, it is determined to be a malicious deletion operation.

6. The method for tracing malicious deletions in a distributed file system based on blockchain according to claim 5, characterized in that: The file content integrity is that the content hash value of the deleted file is consistent with the content hash value of its backup file; The file permission matching includes: the user who deletes the file has the file deletion permission, and the file permission has not been changed before deletion; the associated log operation compliance includes: the associated log timestamps are continuous within a short period after the file is deleted, and there are no batch deletion and creation operations.

7. The method for tracing malicious deletions in a distributed file system based on blockchain according to claim 1, characterized in that: The deletion behavior recognition model calculates the loss function value and updates the model parameters using the following formula during the training process: ， in, Represents the loss function value of each batch in the training sample set, represents the number of samples in a batch, Indicates the The category of samples The category weights, Represents the category in the training sample set The proportion of the total number of Indicates the first The proportion of the number of categories to the total number, Indicates the total number of categories, Indicates the The probability that a sample belongs to the true category, represents the adjustment weight of difficult and easy samples, represents the basic weight of difficult and easy samples, Represents the adjustment coefficient.

Images