Radio spectrum anomaly monitoring apparatus based on cnn and blockchain

Abstract

The present application relates to the field of network security, in particular to a wireless spectrum anomaly monitoring device based on CNN and block chain, the system includes five modules of spectrum sensing, feature processing, anomaly detection, lightweight inference and block chain storage, first, the spectrum sensing module collects multi-band signals to generate an energy density matrix; then, the feature processing module applies adaptive wavelet transform to reduce noise and construct a two-dimensional feature topology graph. The anomaly detection module uses dynamic convolution kernel and frequency domain attention mechanism to deeply extract features and generate an anomaly probability distribution graph; the lightweight inference module integrates expert knowledge and deep learning results to accurately determine the attack type and confidence; finally, the block chain storage module records the determination results, ensures data security through distributed consensus verification, and stores and updates parameters. This device uses multi-modal perception, combines network traffic and spectrum features, and improves attack detection difficulty.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity, and in particular to a radio spectrum anomaly monitoring device based on CNN and blockchain. Background Technology

[0002] Blockchain, as a decentralized trust system construction technology, has rapidly expanded from the financial sector to various industries. However, blockchain technology also faces increasing security challenges, among which eclipse attacks are a serious threat to blockchain network security. An eclipse attack can allow the attacking node to seize all external network connections of the victim node, preventing the victim node from receiving correct block and transaction information. The ability to detect and defend against eclipse attacks in a timely manner has become an important indicator of blockchain reliability.

[0003] In existing technologies, such as CN 115065502B, a CNN-based method for detecting and defending against blockchain eclipse attacks is disclosed. This method collects traffic data, converts one-dimensional traffic features into two-dimensional feature images, and uses a CNN model to detect blockchain eclipse attacks. However, this technology has the following shortcomings: First, the feature extraction lacks adaptability, using a fixed feature extraction method, making it difficult to cope with changes in attack patterns and new types of attacks; second, it has high computational resource requirements, as the CNN model requires a large amount of computational resources, making it unsuitable for resource-constrained nodes; third, the defense measures are too aggressive, taking measures such as cutting off all connections and restarting nodes, causing nodes to temporarily disconnect from the network; fourth, the two-dimensional feature image size is fixed, which may lead to information loss; and fifth, it lacks a distributed collaboration mechanism, failing to utilize the distributed characteristics of the blockchain network for collaborative defense.

[0004] Furthermore, existing technologies primarily focus on attack characteristics at the network logic layer, neglecting the additional security information that physical layer signal characteristics may provide. In wireless network environments, attacks often manifest simultaneously at both the network traffic and radio spectrum levels, making it difficult to comprehensively identify complex attack behaviors using only a single-dimensional detection method. Summary of the Invention

[0005] To address the shortcomings of the existing technologies, this invention provides a radio spectrum anomaly monitoring device based on CNN and blockchain. By integrating physical layer spectrum sensing with network layer deep learning analysis, and combining blockchain distributed storage and consensus mechanisms, a high-precision, low-resource-consumption, and adaptive anomaly monitoring system is achieved.

[0006] This invention proposes a radio spectrum anomaly monitoring device based on CNN and blockchain, comprising:

[0007] The spectrum sensing module is used to collect multi-band radio signals and generate a spectrum energy density matrix;

[0008] The feature processing module is communicatively connected to the spectrum sensing module and is used to receive the spectrum energy density matrix, apply adaptive wavelet transform for signal denoising, and generate a two-dimensional feature topology map.

[0009] An anomaly detection module, which is communicatively connected to the feature processing module, is used to receive the two-dimensional feature topology map, extract deep features based on a dynamic convolutional kernel structure and a frequency domain attention mechanism, and generate a region anomaly probability distribution map.

[0010] The lightweight inference module is communicatively connected to the anomaly detection module and is used to receive the regional anomaly probability distribution map, fuse expert knowledge residuals and deep learning results, and determine the attack type and confidence score.

[0011] The blockchain storage module is connected in communication with the lightweight inference module. It is used to record the attack type and confidence score, verify the attack judgment result based on distributed consensus, and store the verified model update parameters.

[0012] Preferably, the spectrum sensing module includes:

[0013] Multi-band sampling unit for parallel acquisition of radio signals in 2.4GHz, 5GHz and custom frequency bands;

[0014] The signal preprocessing unit is used to perform noise reduction and standardization on the acquired signals.

[0015] The differential spectrum analysis unit is used to calculate the deviation between the current spectrum and the historical baseline.

[0016] Preferably, the feature processing module includes:

[0017] Wavelet basis function selection unit, used to dynamically select the best wavelet basis function from the Haar, Daubechies, Symlets and Coiflets wavelet function sets;

[0018] Self-organizing map network units are used to reduce high-dimensional spectral features to a two-dimensional topological graph.

[0019] An adaptive threshold noise suppression unit is used to dynamically adjust the noise suppression threshold based on signal characteristics.

[0020] Preferably, the anomaly detection module includes:

[0021] A dynamic kernel generation unit is used to adaptively adjust the kernel size according to the spectral complexity;

[0022] Frequency domain attention unit, used to automatically focus on frequency bands with high anomaly probability;

[0023] Multi-scale convolutional branch network units, including small, medium and large convolutional branches, are used to detect anomalous features at different scales.

[0024] Preferably, the small branches of the multi-scale convolutional branch network unit adopt a parameter configuration of 3×3 convolutional kernel and stride of 1, the medium branches adopt a parameter configuration of 5×5 convolutional kernel and stride of 2, and the large branches adopt a parameter configuration of 7×7 convolutional kernel and stride of 3.

[0025] Preferably, the lightweight inference module includes:

[0026] Residual knowledge injection unit, used to integrate expert experience with learning outcomes;

[0027] Depthwise separable convolutional units are used to reduce computational complexity;

[0028] The quantization-aware training unit is used to quantize model parameters into 4-bit integer representations.

[0029] Preferably, the blockchain storage module includes:

[0030] Distributed verification unit, used to verify attack judgment results based on multi-node signatures;

[0031] Federated reinforcement learning units are used to aggregate model gradient updates from multiple nodes.

[0032] An adaptive retraining trigger unit is used to initiate model retraining when a new attack feature is detected.

[0033] Preferably, the system also includes a defense execution module, which is communicatively connected to the lightweight inference module, for executing a tiered defense strategy based on the attack type and confidence score.

[0034] Preferably, the defense execution module includes:

[0035] Early warning unit, used to increase monitoring intensity in cases of low-confidence anomalies;

[0036] Light defense unit, used to limit bandwidth for suspicious connections in cases of moderate confidence anomalies;

[0037] A robust defense unit is used to suspend suspicious connections in cases of high-confidence anomalies.

[0038] Preferably, a multi-level caching module is also included, which is communicatively connected to the spectrum sensing module and the feature processing module, for storing raw spectrum data, feature map data and detection results in layers to optimize data flow efficiency.

[0039] The beneficial effects of this invention are:

[0040] 1. Multimodal perception mechanism: Integrating network traffic and radio spectrum characteristics to construct a multi-dimensional perception system, significantly improving the difficulty of attack detection;

[0041] 2. Adaptive feature extraction: Dynamically select the optimal wavelet basis function and parameters based on signal characteristics to reduce reliance on prior knowledge;

[0042] 3. Resource efficiency optimization: Through frequency domain attention mechanism and lightweight model design, computational resource requirements are reduced by 78% and memory usage is reduced by 65%;

[0043] 4. Progressive defense strategy: Implement defense measures of varying intensities based on the threat level to minimize the impact on normal services;

[0044] 5. Distributed evolutionary learning: Combining blockchain and federated learning to form a self-organizing secure knowledge network, improving the overall robustness of the system;

[0045] 6. Significant performance improvements: 15% higher accuracy in detecting known attacks and 23% higher accuracy in detecting unknown attacks; adaptation time for new attacks reduced from an average of 72 hours to 4 hours. Attached Figure Description

[0046] Figure 1 This is a system architecture diagram according to an embodiment of the present invention;

[0047] Figure 2 This is a schematic diagram of the spectrum sensing module in an embodiment of the present invention;

[0048] Figure 3 This is a flowchart of the feature processing module in an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the anomaly detection module in an embodiment of the present invention;

[0050] Figure 5 This is a schematic diagram of the dynamic convolution kernel structure in an embodiment of the present invention;

[0051] Figure 6 This is a schematic diagram of the lightweight inference module in an embodiment of the present invention;

[0052] Figure 7 This is a schematic diagram of the data structure of the blockchain storage module in an embodiment of the present invention;

[0053] Figure 8 This is a flowchart illustrating the hierarchical defense strategy of the defense execution module in this embodiment of the invention.

[0054] Figure 9 This is a schematic diagram of the cache hierarchy of the multi-level cache module in an embodiment of the present invention. Detailed Implementation

[0055] Please refer to the attached document. Figure 1-9 The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0056] Example 1

[0057] like Figure 1 As shown, the radio spectrum anomaly monitoring device based on CNN and blockchain provided by the present invention includes a spectrum sensing module 1, a feature processing module 2, an anomaly detection module 3, a lightweight inference module 4, a blockchain storage module 5, a defense execution module 6, and a multi-level cache module 7.

[0058] The spectrum sensing module 1 acquires multi-band radio signals through an RF interface and converts them into a standardized spectral energy density matrix. This module is connected to the feature processing module 2 via a data bus, transmitting the generated spectral energy density matrix to the feature processing module 2.

[0059] Feature processing module 2 receives the spectral energy density matrix from spectrum sensing module 1, applies adaptive wavelet transform for signal denoising and feature extraction, and generates a two-dimensional feature topology map. The processed feature map is transmitted to anomaly detection module 3 via a high-speed data channel.

[0060] Anomaly detection module 3 receives the two-dimensional feature topology map generated by feature processing module 2, performs deep feature extraction based on dynamic convolutional kernel structure and frequency domain attention mechanism, and generates a region anomaly probability distribution map. This module is connected to lightweight inference module 4 through a secure communication channel.

[0061] The lightweight inference module 4 receives the regional anomaly probability distribution map generated by the anomaly detection module 3, integrates expert knowledge residuals and deep learning results, and determines the attack type and confidence score. This module is connected to the blockchain storage module 5 and the defense execution module 6 via a secure encrypted link.

[0062] The blockchain storage module 5 receives the attack type and confidence score output by the lightweight inference module 4, verifies the attack determination result through distributed consensus, and stores the verified model update parameters. This module adopts a distributed storage architecture, forming a secure and reliable blockchain network with corresponding modules on other nodes in the network.

[0063] Defense Execution Module 6 executes a tiered defense strategy based on the attack type and confidence score output by Lightweight Inference Module 4. It takes defense measures from light to heavy according to the threat level to ensure system security while minimizing the impact on normal services.

[0064] The multi-level caching module 7 is communicatively connected to the spectrum sensing module 1 and the feature processing module 2, storing raw spectrum data, feature map data, and detection results in a hierarchical manner to optimize data flow efficiency. This module adopts a hierarchical storage strategy to accelerate system response speed.

[0065] The modules interact with each other through standardized interfaces, forming a complete data flow loop. The entire system adopts a modular design, and each functional module can be upgraded or replaced independently, exhibiting good scalability and compatibility.

[0066] Example 2

[0067] like Figure 2 As shown, the spectrum sensing module 1 includes a multi-band sampling unit 11, a signal preprocessing unit 12, and a differential spectrum analysis unit 13.

[0068] The multi-band sampling unit 11 employs software-defined radio technology to acquire radio signals in parallel from 2.4 GHz, 5 GHz, and a user-defined frequency band. Preferably, this unit uses a sampling interval of 10 ms and a frequency resolution of 50 kHz to ensure the capture of rapidly changing anomalous signal characteristics.

[0069] The signal preprocessing unit 12 performs noise reduction and standardization processing on the acquired raw signal, including operations such as signal amplification, filtering, digitization, and standardization. Preferably, this unit uses a bandpass filter to remove out-of-band noise and uses adaptive gain control to keep the signal within a suitable dynamic range.

[0070] Differential spectrum analysis unit 13 calculates the deviation between the current spectrum and the historical baseline, constructing a spectral energy density matrix (SEDM). The SEDM is a three-dimensional data structure containing information in three dimensions: time, frequency, and energy. The differential spectrum calculation uses the following formula:

[0071] DiffSEDM[t,f]=SEDM current [t,f]-SEDM baseline [t,f],

[0072] Where DiffSEDM[t,f] represents the differential spectrum values ​​corresponding to time t and frequency f, and SEDM current [t,f] represents the current spectral energy density value, SEDM baseline [t,f] represents the historical baseline frequency spectrum energy density value. The historical baseline is dynamically updated using an exponential moving average method to ensure that the system can adapt to slow changes in normal network behavior.

[0073] The output of the spectrum sensing module 1 is a standardized spectrum energy density matrix, which contains both the original spectrum information and the deviation information from the historical baseline, providing a rich multidimensional data foundation for subsequent feature processing.

[0074] Example 3

[0075] like Figure 3 As shown, the feature processing module 2 includes a wavelet basis function selection unit 21, a self-organizing map network unit 22, and an adaptive threshold noise suppression unit 23.

[0076] Wavelet basis function selection unit 21 dynamically selects the optimal wavelet basis function from the Haar, Daubechies, Symlets, and Coiflets wavelet function sets for time-frequency analysis of the spectral signal. The selection of the optimal wavelet basis is based on the following optimization criteria:

[0077]

[0078] Where OptimalWavelet represents the selected optimal wavelet basis function, W j Let represent the j-th wavelet function in the candidate wavelet function set, and SEDM represent the spectral energy density matrix. This unit evaluates the reconstruction error of different wavelet basis functions on the signal, selects the wavelet basis function most suitable for the current signal characteristics, and improves the accuracy of subsequent processing.

[0079] Self-Organizing Map (SOM) network unit 22 uses the SOM algorithm to reduce high-dimensional spectral features to a two-dimensional topological graph. This unit achieves a nonlinear mapping from high-dimensional spectral data to a two-dimensional feature space, ensuring that similar patterns in the spectrum maintain their similarity in the two-dimensional space. Preferably, the SOM network uses a 32×32 two-dimensional grid, and the network weights are trained through competitive learning to form a topology-preserving mapping of spectral features.

[0080] The adaptive threshold noise suppression unit 23 dynamically adjusts the noise suppression threshold based on signal characteristics to filter random noise in the spectrum. This unit employs a wavelet threshold-based denoising method, and the adaptive threshold is calculated as follows:

[0081]

[0082] Where, λ adaptive Let σ represent the adaptive threshold, σ represent the noise standard deviation (estimated by the median absolute deviation of the wavelet coefficients), and N represent the number of sampling points. In this way, the system can automatically adjust the threshold parameter according to the noise level of the current signal, effectively suppressing noise interference while preserving useful information.

[0083] The output of feature processing module 2 is a denoised two-dimensional feature topology map. This feature map contains the key features of the original spectrum data, but significantly reduces the dimensionality and noise level, providing high-quality input data for the anomaly detection module.

[0084] Example 4

[0085] like Figure 4 As shown, the anomaly detection module 3 includes a dynamic convolution kernel generation unit 31, a frequency domain attention unit 32, and a multi-scale convolution branch network unit 33.

[0086] The dynamic convolutional kernel generation unit 31 adaptively adjusts the convolutional kernel size based on spectral complexity. This unit first calculates the complexity score of the input feature map, and then dynamically determines the size of the convolutional kernel based on the complexity. The specific calculation method is as follows:

[0087] KernelSize=base_size+α·ComplexityScore,

[0088] Here, KernelSize represents the dynamically generated convolutional kernel size, base_size represents the base convolutional kernel size (usually 3), α represents the adjustment coefficient (usually 0.5-2), and ComplexityScore represents the complexity score calculated based on spectral entropy. In this way, the system can automatically select the most suitable receptive field size for spectral features of different complexities, improving the adaptability of feature extraction.

[0089] The frequency domain attention unit 32 automatically focuses on frequency bands with high anomaly probability using an attention mechanism. This unit calculates the anomaly probability for each frequency band, generates an attention weight map, and uses it to enhance the feature representation of suspicious frequency bands. The attention weight calculation formula is as follows:

[0090] AttentionMap[f]=softmax(W·F abnormal [f]),

[0091] Where AttentionMap[f] represents the attention weights at frequency f, softmax represents the softmax normalization function, W represents the learnable weight matrix, and F abnormal [f] represents the anomalous feature at frequency 6. The feature enhancement process is element-wise multiplication: F enhanced =F original ⊙AttentionMap, where ⊙ represents the Hadamard product (element-wise multiplication). This mechanism allows the model to focus limited computational resources on the frequency bands most likely to contain anomalies, improving detection efficiency and accuracy.

[0092] The multi-scale convolutional branch network unit 33 includes three convolutional branches: small, medium, and large, each used to detect anomalous features at different scales. The small branch uses a 3×3 convolutional kernel with a stride of 1, focusing on detecting fine-grained local anomalies; the medium branch uses a 5×5 convolutional kernel with a stride of 2, focusing on medium-scale feature patterns; and the large branch uses a 7×7 convolutional kernel with a stride of 3, capturing large-scale global features. The outputs of the three branches are combined through a feature fusion layer to form a multi-scale feature representation. This multi-scale architecture enables the system to simultaneously focus on anomalous features at different spatiotemporal scales, improving the comprehensiveness of detection.

[0093] The output of the anomaly detection module 3 is a regional anomaly probability distribution map, which identifies the anomaly probability of each frequency band and time window, providing basic information for subsequent inference.

[0094] Example 5

[0095] like Figure 5 As shown, the multi-scale convolutional branch network unit 33 employs three parallel convolutional branches, each configured with different convolutional parameters, focusing on feature extraction at different scales.

[0096] The small branch 331 uses a 3×3 convolutional kernel with a stride of 1 and contains three convolutional layers, each followed by batch normalization and a ReLU activation function. This branch has a smaller receptive field, focusing on capturing local detailed features, making it suitable for detecting fine-grained anomaly patterns. Preferably, the number of channels in the convolutional layers of this branch is 32, 64, and 128 respectively, achieving a layer-by-layer expansion of the feature dimension.

[0097] The medium-sized branch 332 employs a 5×5 convolutional kernel with a stride of 2, containing two convolutional layers, each followed by batch normalization and a ReLU activation function. This branch has a moderately sized receptive field, capable of capturing regional feature patterns, and is suitable for detecting medium-sized anomalies. Preferably, the number of channels in the convolutional layers of this branch is 48 and 96 respectively, which expands the feature dimension while reducing spatial resolution.

[0098] The large branch 333 employs a 7×7 convolutional kernel with a stride of 3, containing one convolutional layer followed by batch normalization and a ReLU activation function. This branch has a large receptive field, capable of capturing global feature patterns, and is suitable for detecting large-scale anomalous behaviors. Preferably, the convolutional layer of this branch has 64 channels, directly mapping the input features to a high-dimensional feature space.

[0099] The output features of the three branches are first adjusted to the same spatial dimension through upsampling or downsampling, and then integrated through a feature fusion layer 334. Feature fusion adopts an attention-weighted approach, dynamically adjusting the weights according to the importance of features from different branches to generate the final multi-scale feature representation. Specifically, the fusion layer first calculates the importance score of each branch feature, then generates fusion weights based on the scores, and finally combines the features from each branch in a weighted manner.

[0100] This multi-scale convolutional branch architecture enables the system to simultaneously focus on anomalous patterns at different scales, capturing both subtle local anomalous signals and identifying complex attack patterns spanning a large spatiotemporal range, greatly improving the comprehensiveness and accuracy of detection.

[0101] Example 6

[0102] like Figure 6 As shown, the lightweight inference module 4 includes a residual knowledge injection unit 41, a depthwise separable convolution unit 42, and a quantization-aware training unit 43.

[0103] The residual knowledge injection unit 41 integrates expert experience and learning results to enhance the model's ability to identify known attack patterns. This unit employs a weighted fusion method, dynamically adjusting the weights of expert knowledge and learning results based on the model's confidence level. The fusion calculation formula is as follows:

[0104] F final =α·F learned +(1-α)·F expert ,

[0105] Among them, F final F represents the final feature representation. learned F represents the features generated by the deep learning model. expert This represents features built upon expert knowledge, and α represents the dynamic equilibrium coefficient, which is automatically adjusted based on the model's confidence level. When the model has high confidence in the current sample, the α value is close to 1, mainly relying on the learning results; when the confidence level is low, the α value decreases, increasing the influence of expert knowledge. This mechanism combines data-driven learning capabilities with the guidance of prior knowledge to improve the system's generalization ability against various attacks.

[0106] The depthwise separable convolutional unit 42 employs a depthwise separable convolution structure, significantly reducing computational complexity. Compared to traditional convolution, depthwise separable convolution decomposes standard convolution into two steps: depthwise convolution and pointwise convolution, significantly reducing computational cost and the number of parameters. For an input feature map of size D... f ×D f The number of input channels is M, the number of output channels is N, and the kernel size is D.k ×D k The computational complexity is compared as follows:

[0107] The computational complexity of ordinary convolution is O(D). f ·D f ·M·N·D k ·D k ),

[0108] Depthwise separable convolution: O(D) f ·D f ·M·D k ·D k +M·N),

[0109] This structural optimization reduces computational complexity by 8-9 times while maintaining model expressiveness, enabling the system to run efficiently on resource-constrained devices.

[0110] The quantization-aware training unit 43 implements low-bit quantization representation of model parameters, further reducing storage and computational overhead. This unit simulates the effects of quantization operations during training, enabling the model to learn to adapt to the accuracy loss caused by quantization. The quantization process uses the following formula:

[0111] W quantized =round(W float / scale)*scale,

[0112] scale = (max(W) - min(W)) / (2 bits -1),

[0113] Among them, W quantized W represents the quantized weights. float This indicates floating-point weights, `round` indicates rounding, `scale` indicates the quantization scaling factor, and `bits` indicates the number of quantization bits (4 bits in this example). By using 4-bit integer quantization, the model size is reduced by 8 times, while the inference speed is also significantly improved, with only a loss of less than 2% in detection accuracy.

[0114] The output of the lightweight inference module 4 is an attack type determination and a confidence score. This result comprehensively considers the inference results of the deep learning model and the guidance of expert knowledge, and has high reliability and interpretability. Meanwhile, the lightweight design enables the model to be efficiently deployed on edge devices, achieving real-time anomaly detection.

[0115] Example 7

[0116] like Figure 7 As shown, the blockchain storage module 5 includes a distributed verification unit 51, a federated reinforcement learning unit 52, and an adaptive retraining triggering unit 53.

[0117] Distributed verification unit 51 verifies the attack determination results based on multi-node signature verification, ensuring that the information stored on the blockchain is reliable and tamper-proof. This unit organizes information using a block data structure, with each block containing fields such as model hash, performance metrics, verification signature, and timestamp.

[0118] Block structure: {Model hash: SHA-256(ModelParameters)}

[0119] Performance metrics: {accuracy, precision, recall, F1}

[0120] Signature Verification: Multi-signature of Network Nodes

[0121] Timestamp: UTC_timestamp

[0122] Blocks are linked by hashes to form a blockchain, ensuring that data cannot be tampered with once written. Nodes use a lightweight consensus mechanism based on Proof-of-Performance (PoP) to verify model performance rather than computational power, avoiding the resource waste problem of traditional Proof-of-Work mechanisms.

[0123] Federated reinforcement learning unit 52 aggregates model gradient updates from multiple nodes, achieving distributed knowledge sharing while protecting data privacy. This unit uses a weighted average method to aggregate distributed gradients.

[0124] G=∑(w i ·G i ) / ∑w i ,

[0125] Where G represents the global gradient, G i w represents the local gradient provided by node i. i The weight of node i is dynamically adjusted based on model performance and trust level. In this way, the system can collaboratively optimize the detection model without sharing the original data, protecting privacy while improving model training efficiency.

[0126] The adaptive retraining trigger unit 53 initiates model retraining upon detecting a new attack feature. This unit determines whether a model update needs to be triggered by comparing the similarity between the newly discovered attack feature and known patterns.

[0127] if(NewAttackFeatures.similarityKnownPatterns <threshold):TriggerRetraining(ModelParams,NewFeatures)

[0128] The similarity function calculates the cosine similarity of feature vectors, and threshold represents the similarity threshold that triggers retraining (usually set to 0.7). When a new attack that differs significantly from known patterns is detected, the system automatically initiates the model retraining process, adding new features to the training set and updating the model parameters, enabling the system to quickly adapt to attack variants.

[0129] Blockchain storage module 5 constructs a transparent, trustworthy, and tamper-proof secure knowledge base through distributed consensus and secure storage mechanisms, recording attack detection history and model evolution trajectories. Simultaneously, the federated learning mechanism enables network nodes to evolve collaboratively, forming collective intelligence and significantly improving the system's adaptability to new types of attacks.

[0130] Example 8

[0131] like Figure 8 As shown, the defense execution module 6 includes an early warning unit 61, a light defense unit 62, and a strong defense unit 63.

[0132] The early warning unit 61 increases monitoring intensity when it detects low-confidence anomalies, preparing for defense in advance. When the anomaly confidence level is between 0.3 and 0.5, this unit activates and performs the following actions: increases the spectrum sampling rate from the standard 10ms to 5ms; expands the monitoring frequency band range to cover more potential anomaly bands; and initiates additional anomaly feature analysis tasks to delve deeper into possible attack signs. These early warning measures do not affect the system's normal communication functions but provide a more sensitive early warning capability.

[0133] The light defense unit 62 limits the bandwidth of suspicious connections when it detects anomalies with a moderate confidence level, reducing the impact of potential attacks. When the anomaly confidence level is between 0.5 and 0.8, this unit activates and performs the following actions: bandwidth limiting is applied to suspicious IP addresses, reducing their communication rate to 30% of normal; the proportion of trusted nodes connected is increased to ensure network connectivity diversity; and comprehensive logging is activated to record all network activity in detail for subsequent analysis. These measures effectively limit the scope of potential attacks while maintaining basic communication capabilities.

[0134] The robust defense unit 63 suspends suspicious connections and completely blocks attack paths when it detects high-confidence anomalies. When the anomaly confidence level exceeds 0.8, this unit activates and performs the following actions: temporarily disconnecting from suspicious nodes; clearing potentially contaminated entries from the routing table; requesting a new list of trusted nodes from the DNS seed server; and rebuilding a healthy network of connections. Compared to existing technologies, this robust defense is more targeted, isolating only confirmed malicious nodes rather than severing all connections, thus minimizing the impact on normal network functionality.

[0135] The tiered defense strategy of Module 6 employs different levels of defense measures based on threat level, achieving a precise match between defense strength and threat intensity. This ensures system security while minimizing impact on normal services. Furthermore, different levels of defense measures can transition smoothly, dynamically adjusting based on changes in anomaly confidence, making the defense response more flexible and efficient.

[0136] Example 9

[0137] like Figure 9 As shown, the multi-level caching module stores the original spectrum data, feature map data, and detection results in seven layers, optimizing data flow efficiency.

[0138] The multi-level cache module 7 adopts a three-level cache architecture: L1 cache 71 is used to store the raw spectrum data of the most recent 10 seconds, adopting a circular buffer structure to support high-speed writing and reading; L2 cache 72 is used to store the feature map data of the most recent 1 hour, adopting a time-series index structure to facilitate quick querying of features in a specific time window; L3 cache 73 is used to store the detection results of the most recent 24 hours, adopting a compressed storage method to save storage space while retaining key information.

[0139] Cache management employs an LRU (Least Recently Used) strategy, automatically evicting data that has not been accessed for a long time to ensure efficient use of cache space. Data flows between the three levels of cache according to the following rules: frequently accessed L2 and L3 data will be temporarily promoted to higher-level caches; infrequently accessed L1 data will be demoted to L2 cache; expired data will be automatically cleaned up or archived.

[0140] The multi-level caching module 7 significantly improves system response speed by rationally allocating memory resources to keep frequently accessed data in the cache. Tests show that compared with a single storage structure, the multi-level caching scheme reduces average data access latency by 78% and increases overall system throughput by 3.2 times.

[0141] In addition, the caching module implements a data prefetching mechanism, which predicts data that may be needed in the future based on historical access patterns and loads it into a higher-level cache in advance, further optimizing access performance. The prefetching algorithm is based on a simple Markov prediction model, predicting the next possible access data based on the most recent access sequence, with a prefetching accuracy of over 65%.

[0142] The optimized design of the multi-level cache module 7 enables the system to efficiently process large amounts of spectrum and feature data, providing a solid data management foundation for real-time anomaly detection.

[0143] Example 10

[0144] The workflow of the radio spectrum anomaly monitoring device based on CNN and blockchain according to an embodiment of the present invention is as follows:

[0145] 1. Spectrum Data Acquisition: Spectrum sensing module 1 acquires radio signals from multiple frequency bands in parallel, generating a spectral energy density matrix. The sampling process employs a non-periodic random sampling strategy to prevent attackers from predicting the sampling pattern.

[0146] 2. Feature Extraction and Processing: Feature processing module 2 receives the spectral energy density matrix and performs signal denoising and feature extraction using adaptive wavelet transform and self-organizing map algorithms to generate a two-dimensional feature topology map. During processing, the system dynamically selects the optimal wavelet basis function based on signal characteristics to ensure the accuracy of feature extraction.

[0147] 3. Multi-scale anomaly detection: Anomaly detection module 3 receives the feature topology map, performs deep feature extraction based on dynamic convolutional kernel structure and frequency domain attention mechanism, and generates a region anomaly probability distribution map. The detection process utilizes convolutional branches of small, medium and large scales in parallel to capture anomaly features at different scales.

[0148] 4. Lightweight Inference Decision Making: The lightweight inference module 4 integrates expert knowledge residuals and deep learning results to determine the attack type and confidence score. The inference process employs depthwise separable convolution and 4-bit quantization technology, significantly reducing computational resource requirements while maintaining high-precision inference capabilities.

[0149] 5. Blockchain Verification and Storage: Blockchain storage module 5 records the attack determination results, verifies the reliability of the attack determination through distributed consensus, and stores the updated model parameters after verification. The verification process adopts a lightweight consensus mechanism based on performance proof to avoid resource waste.

[0150] 6. Tiered Defense Response: Based on the attack confidence level, defense execution module 6 adopts different levels of defense measures. For low-confidence anomalies, monitoring intensity is increased; for medium-confidence anomalies, bandwidth for suspicious connections is restricted; for high-confidence anomalies, suspicious connections are suspended and a healthy network is rebuilt.

[0151] 7. Federated Learning Evolution: Based on detection results and defense effectiveness, the system updates model parameters through federated reinforcement learning. This update process protects the privacy of the original data while achieving distributed knowledge sharing and improving the overall robustness of the system.

[0152] The entire workflow forms a closed-loop system, from spectrum perception to defense execution and model evolution, building an adaptive, efficient, and reliable anomaly monitoring and defense system.

[0153] Example 11

[0154] To verify the practical effectiveness of this invention, we deployed the system in a real blockchain network environment and tested it against various abnormal behaviors, including eclipse attacks. The test network consisted of 100 normal nodes and 20 attack nodes, with the attack nodes simulating various attack behaviors such as eclipse attacks, Sybil attacks, and abnormal spectrum interference.

[0155] Compared with the benchmark system (CN115065502B), this invention shows significant advantages in several key indicators:

[0156] 1. Detection accuracy: The detection accuracy for known attacks reaches 98.7%, which is 15.3 percentage points higher than the baseline system; the detection accuracy for unknown attack variants reaches 87.4%, which is 23.6 percentage points higher than the baseline system.

[0157] 2. Resource Consumption: Under the same hardware conditions, CPU utilization is reduced by 78.2%, memory usage by 65.4%, and power consumption by 53.8%. The lightweight design enables the system to run efficiently on resource-constrained devices; a single-core ARM processor (1GHz) with 512MB of RAM is sufficient to meet the operating requirements in lightweight mode.

[0158] 3. Adaptation Speed: For new attack variants, the system's adaptation cycle has been reduced from an average of 72 hours for the baseline system to 4.2 hours, a 17-fold improvement. The blockchain's distributed learning mechanism enables the system to quickly distribute new attack characteristics and defense strategies, significantly shortening the time required to respond to new threats.

[0159] 4. Defense Effectiveness: Even with 30% of nodes under attack, the system still maintains a 95.3% detection capability, while the baseline system's detection capability drops to 62.4% under the same conditions. The tiered defense strategy enables the system to take appropriate defensive measures based on the threat level, minimizing the impact on normal services.

[0160] Furthermore, the multimodal perception mechanism of this system also demonstrates unique advantages. In situations where pure logic layer attacks are difficult to identify, spectrum perception can capture abnormal patterns at the physical layer, providing an additional dimension for detection. Tests show that approximately 18% of attack behaviors appear normal in logic layer analysis but exhibit significant anomalies in spectrum analysis, proving the practical value of multimodal perception.

[0161] In summary, the radio spectrum anomaly monitoring device based on CNN and blockchain provided by this invention integrates physical layer spectrum perception and network layer deep learning analysis, combined with blockchain distributed storage and consensus mechanism, to achieve a high-precision, low-resource-consumption, and adaptive anomaly monitoring system. It effectively solves the problems of lack of adaptability in feature extraction, high computational resource requirements, and overly aggressive defense measures in existing technologies, and provides more comprehensive and efficient protection for blockchain network security.

[0162] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A radio spectrum anomaly monitoring device based on CNN and blockchain, characterized in that, include: The spectrum sensing module is used to collect multi-band radio signals and generate a spectrum energy density matrix; The feature processing module is communicatively connected to the spectrum sensing module and is used to receive the spectrum energy density matrix, apply adaptive wavelet transform for signal denoising, and generate a two-dimensional feature topology map. An anomaly detection module, which is communicatively connected to the feature processing module, is used to receive the two-dimensional feature topology map, extract deep features based on a dynamic convolutional kernel structure and a frequency domain attention mechanism, and generate a region anomaly probability distribution map. The lightweight inference module is communicatively connected to the anomaly detection module and is used to receive the regional anomaly probability distribution map, fuse expert knowledge residuals and deep learning results, and determine the attack type and confidence score. The blockchain storage module is communicatively connected to the lightweight inference module and is used to record the attack type and confidence score, verify the attack judgment result based on distributed consensus, and store the verified model update parameters. The anomaly detection module includes: A dynamic kernel generation unit is used to adaptively adjust the kernel size according to the spectral complexity; Frequency domain attention unit, used to automatically focus on frequency bands with high anomaly probability; Multi-scale convolutional branch network units, including small, medium and large convolutional branches, are used to detect anomalous features at different scales.

2. The apparatus according to claim 1, characterized in that, The spectrum sensing module includes: Multi-band sampling unit for parallel acquisition of radio signals in 2.4GHz, 5GHz and custom frequency bands; The signal preprocessing unit is used to perform noise reduction and standardization on the acquired signals. The differential spectrum analysis unit is used to calculate the deviation between the current spectrum and the historical baseline.

3. The apparatus according to claim 1, characterized in that, The feature processing module includes: Wavelet basis function selection unit, used to dynamically select the best wavelet basis function from the Haar, Daubechies, Symlets and Coiflets wavelet function sets; Self-organizing map network units are used to reduce high-dimensional spectral features to a two-dimensional topological graph. An adaptive threshold noise suppression unit is used to dynamically adjust the noise suppression threshold based on signal characteristics.

4. The apparatus according to claim 1, characterized in that, The multi-scale convolutional branch network unit uses a 3×3 convolutional kernel and a stride of 1 for small branches, a 5×5 convolutional kernel and a stride of 2 for medium branches, and a 7×7 convolutional kernel and a stride of 3 for large branches.

5. The apparatus according to claim 1, characterized in that, The lightweight inference module includes: Residual knowledge injection unit, used to integrate expert experience with learning outcomes; Depthwise separable convolutional units are used to reduce computational complexity; The quantization-aware training unit is used to quantize model parameters into 4-bit integer representations.

6. The apparatus according to claim 1, characterized in that, The blockchain storage module includes: Distributed verification unit, used to verify attack judgment results based on multi-node signatures; Federated reinforcement learning units are used to aggregate model gradient updates from multiple nodes. An adaptive retraining trigger unit is used to initiate model retraining when a new attack feature is detected.

7. The apparatus according to claim 1, characterized in that, It also includes a defense execution module, which is communicatively connected to the lightweight inference module, and is used to execute a graded defense strategy based on the attack type and confidence score.

8. The apparatus according to claim 7, characterized in that, The defense execution module includes: Early warning unit, used to increase monitoring intensity in cases of low-confidence anomalies; Light defense unit, used to limit bandwidth for suspicious connections in cases of moderate confidence anomalies; A robust defense unit is used to suspend suspicious connections in cases of high-confidence anomalies.

9. The apparatus according to claim 1, characterized in that, It also includes a multi-level caching module, which is communicatively connected to the spectrum sensing module and the feature processing module, for storing raw spectrum data, feature map data and detection results in layers to optimize data flow efficiency.

Images