Block chain network flow data analysis method and system based on graph structure

Abstract

The invention discloses a block chain network flow data analysis method and system based on a graph structure, and relates to the field of network flow data analysis, and the method comprises the steps: collecting network data from a plurality of network devices through employing an oracle machine technology, and uploading the network data to a block chain; according to data preprocessing, original information is coded into node features, edges and link information, a graph structure is constructed, an embedded matrix is initialized, and edge weights can be adjusted in real time based on historical data of a block chain so as to enhance the graph structure; node embedding representation learning is performed through a graph structure, and embedding learning tasks are distributed to a plurality of block chain nodes, so that the distinguishing capability and the operation efficiency of the model are improved; calculating each statistic based on a node embedding vector, generating a new feature column, and generating a multi-dimensional fusion feature set through screening and dimensionality reduction; calling and then configuring classification model parameters to carry out model training on the feature set and carrying out result analysis; an analysis result is uploaded to the block chain, it is ensured that the analysis result is not tampered, and data tracing and auditing are supported.

Description

Technical Field

[0001] The present invention relates to the field of network traffic data analysis, and in particular to a graph-based blockchain network traffic data analysis method and system. Background Art

[0002] With the rapid development of information technology, blockchain technology and graph-structured data processing methods have been widely used in many fields. However, the scale and complexity of network traffic data continue to increase, and traditional analysis methods are unable to cope with the challenges of high-dimensional, unstructured data. Existing network traffic analysis methods have the following problems:

[0003] (1) Data silos: Data isolation between different network devices or data centers limits cross-platform data sharing and analysis. Network traffic data held by various industries is difficult to share, limiting data sharing and innovation. For example, an organization deployed multiple network security systems. Due to inconsistent data formats and a lack of a unified interface between systems, when an APT attack occurred, the manifestations of the attack in different systems could not be promptly correlated, ultimately leading to delayed defense and resulting in economic losses.

[0004] (2) Data security and privacy issues: Network traffic data often contains sensitive information, such as user behavior patterns, device interaction records, etc. Traditional centralized storage methods are prone to data leakage or tampering, especially when it comes to RWA (Real World Assets) projects, the authenticity and security of data are particularly important. RWA projects need to map physical assets in the real world (such as IoT devices, supply chain nodes, etc.) to the digital world for management, and network traffic is an important reflection of the operating status of these assets. Once the data is tampered with or leaked, it may lead to serious deviations in asset management and decision-making processes. For example, in smart city projects, a large number of IoT devices transmit status information through the network, and this information constitutes a key digital mapping of urban operations. If an attacker tampered with the communication records of a certain type of device, it may cause the traffic dispatch system to misjudge the road conditions, which may cause the trust of the entire system to collapse.

[0005] (3) Lack of efficient feature extraction methods: Existing methods have difficulty in capturing high-order relationships between nodes when processing complex relational data, resulting in limited accuracy of analysis results. How to extract valuable features from complex network traffic data is directly related to the effectiveness of asset value assessment, risk prediction, and decision support. For example, existing network traffic analysis systems usually use rule-based matching or shallow statistical methods for feature extraction, judge by setting fixed thresholds, or use statistical indicators for classification. However, these methods are difficult to capture the complex relationships between nodes. In an attack, the attacker transmitted malicious data through a legitimate DNS request channel. Its single field features were not significant, but there were complex interaction patterns with other nodes. Traditional methods cannot effectively model such high-order semantic relationships, resulting in low detection rates and high false alarm rates.

[0006] (4) Insufficient real-time performance and traceability: Traditional network traffic analysis systems usually lack the ability to effectively trace historical data, making it difficult to support the needs of real-time monitoring and dynamic adjustment. Real-time and traceability are key requirements, especially in scenarios such as asset trading, supply chain management, and smart contract execution. For example, in a certain attack, the attacker adopted a progressive camouflage strategy, gradually increasing the request frequency over a few days to bypass the threshold detection mechanism. Because the system only makes judgments based on the current batch data and fails to make dynamic adjustments based on historical traffic patterns, it fails to provide timely warnings in the early stages of the attack. In addition, in the subsequent investigation, there is a lack of unified timestamps and change records, and investigators cannot accurately restore the evolution of network behavior over the past period of time, making it difficult to determine responsibility and unable to accurately restore the judgment basis of the model at the time.

[0007] To address these issues, blockchain technology and graph analysis offer new solutions for network traffic data analysis. As a decentralized, secure, and reliable technology, blockchain effectively addresses data silos and security issues. Graph analysis, on the other hand, extracts meaningful, low-dimensional representations from complex relational data, improving analytical performance. However, combining blockchain technology with graph analysis to achieve efficient and secure network traffic data analysis remains a pressing challenge. In particular, ensuring data authenticity and transparency while simultaneously improving analytical efficiency and accuracy remains a key challenge. Summary of the Invention

[0008] The purpose of this application is to propose a graph-based blockchain network traffic data analysis method to address the above-mentioned technical problems. While ensuring data security and privacy, it significantly improves the accuracy and timeliness of network traffic behavior identification.

[0009] On the one hand, a blockchain network traffic data analysis method based on a graph structure includes:

[0010] S101, receiving raw network data collected from multiple network devices or data centers through oracle technology and pre-processing it on multiple blockchain nodes;

[0011] S102, based on the pre-processed traffic data, construct an embedding matrix of node features, edges and links, and dynamically adjust edge weights in combination with blockchain historical data records to generate a suitable undirected graph;

[0012] S103, based on the generated graph structure, uses a deep embedding learning model to learn low-dimensional representations of nodes in network traffic; uses a dot-product attention mechanism to calculate the similarity between nodes, generates training samples through negative sampling, and optimizes the loss function to generate node embedding vectors; wherein, the embedding learning task is distributed and calculated on multiple blockchain nodes;

[0013] S104, load the node embedding vector, calculate the cosine similarity between nodes, and generate a new feature column. Then, through multi-stage feature screening and dimensionality reduction, generate a multi-dimensional fusion feature set;

[0014] S105, configure the classification model parameters to perform classification model training and performance evaluation on the fusion feature set, and upload the performance evaluation analysis results to the blockchain.

[0015] Preferably, in S101, the preprocessing includes format verification, integrity check, encryption and digital signature processing of the collected original network data to ensure the authenticity and non-tamperability of the data; and also includes cleaning and normalization processing of the collected original network data.

[0016] Preferably, the S102 specifically includes:

[0017] Based on the pre-processed traffic data, key information that can reflect network behavior and the timestamp of the record on the chain are extracted as features. Then, a unique node identifier is generated by concatenating each feature value with the feature name, and a node-to-ID mapping dictionary is constructed.

[0018] Each event is regarded as a central event unit, and all possible node feature combination pairs are extracted from them. These combination pairs are converted into edges in the graph. Each edge contains a node pair, edge type, and the timestamp of occurrence. The edge type and weight are counted, and the weight of each edge is calculated according to the time decay formula. The edge weight is dynamically adjusted based on the historical weight data recorded by the blockchain and the real-time network status. After the above processing, an undirected graph structure is constructed to ensure the directional consistency of the edges, and an embedding matrix of nodes and edges is generated.

[0019] Preferably, the weight of each edge is calculated according to the time decay formula, specifically including:

[0020] Suppose an edge (i, j) at historical time t h If an interaction has occurred and the current time is t, then the time decay weight of the edge is w i,j Defined as:

[0021]

[0022] Where b is the attenuation coefficient, which controls the decay rate over time; T1 is the time unit.

[0023] Preferably, the edge weights are dynamically adjusted based on the historical weight data recorded in the blockchain and the real-time network status, as shown below:

[0024]

[0025] Among them, w new Represents the dynamically adjusted edge weight; avgWeight represents the average of the historical edge weight; T2 is the decay time unit; Δt is the time difference from the last update to the present.

[0026] Preferably, the S103 specifically includes:

[0027] In the initialization phase, a preset dimension vector is assigned to each node, and the similarity score between two nodes is calculated through the dot product attention mechanism;

[0028] During the model training process, positive and negative samples are generated through a negative sampling strategy, and the corresponding loss function is calculated and optimized to generate high-quality embedding vectors. The loss function consists of two parts: one part measures the difference between positive and negative samples; the other part is an attribute-based regularization term used to maintain the consistency of node embeddings and their attributes.

[0029] Preferably, the embedding learning task is distributed and calculated on multiple blockchain nodes, specifically including:

[0030] The tasks are divided according to the edge list, and a sharding strategy based on feature combination is adopted to distribute the node pairs and corresponding relationships in the graph structure to multiple blockchain nodes for parallel calculation; each blockchain node independently completes local embedding updates and aggregates gradient information through smart contracts to achieve global parameter synchronization; task allocation and result aggregation are triggered by on-chain events to ensure the security and consistency of the training process.

[0031] Preferably, the S104 specifically includes:

[0032] Loading node embedding vectors and calculating the cosine similarity between nodes as new features; these similarity features together with other statistics constitute a new feature column; the other statistics include maximum similarity, minimum similarity and standard deviation;

[0033] The new feature columns are cleaned and standardized, and the most valuable features for the target variable are gradually extracted through multi-stage feature screening; then SVD dimensionality reduction is used to reduce the feature dimensions, and the main components in the data are extracted as new feature columns to capture the potential structure in the data and generate a multi-dimensional fusion feature set.

[0034] Preferably, the S105 specifically includes: configuring the classification model parameters to perform model training and performance evaluation on the fusion feature set, and uploading the performance evaluation analysis results to the blockchain to ensure that they are not tampered with and support data traceability and auditing.

[0035] Call the embedded learning results and features for analysis, configure the classification model parameters, train and evaluate the classification model, and output classification performance indicators; upload the evaluation results to the blockchain through smart contracts to ensure that the analysis results have not been tampered with and support data traceability;

[0036] Among them, the performance evaluation task is distributed to multiple blockchain nodes, each node independently calculates the performance indicators and uploads them to the blockchain; the evaluation results of all nodes are aggregated through smart contracts to calculate global performance indicators; based on the evaluation results, the model parameters are dynamically adjusted through smart contracts.

[0037] On the other hand, a blockchain network traffic data analysis system based on a graph structure includes:

[0038] The data acquisition and preprocessing module is used to receive raw network data collected from multiple network devices or data centers through oracle technology and preprocess it on multiple blockchain nodes;

[0039] The graph structure generation module is used to construct an embedding matrix of node features, edges, and links based on preprocessed traffic data, and dynamically adjust edge weights in combination with blockchain historical data records to generate a suitable undirected graph;

[0040] The embedding learning module is used to learn low-dimensional representations of nodes in network traffic using a deep embedding learning model based on the generated graph structure. The module uses a dot-product attention mechanism to calculate the similarity between nodes, generates training samples through negative sampling, and optimizes the loss function to generate node embedding vectors. The embedding learning task is distributed across multiple blockchain nodes.

[0041] The feature fusion and dimensionality reduction calculation module is used to load node embedding vectors, calculate the cosine similarity between nodes, and generate new feature columns. It also generates a multi-dimensional fusion feature set through multi-stage feature screening and dimensionality reduction.

[0042] The model evaluation and performance analysis module is used to configure the classification model parameters to perform classification model training and performance evaluation on the fusion feature set, and upload the performance evaluation analysis results to the blockchain.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] (1) The present invention achieves distributed storage and tamper-proofing of network traffic data through blockchain technology, ensuring the authenticity and integrity of the data. It utilizes a distributed computing architecture to optimize large-scale matrix operations and gradient update processes, significantly reducing the computational burden of individual nodes and improving training efficiency and robustness. At the same time, the blockchain's smart contract mechanism supports automated data processing and analysis processes, improving efficiency and reliability.

[0045] (2) This paper uses graph structure embedding learning techniques (such as dot product attention mechanism, negative sampling optimization, etc.) to extract high-quality node and edge embedding vectors from complex relational data, significantly improving the feature representation ability of network traffic data and providing a more accurate data foundation for downstream tasks (such as anomaly detection, classification or prediction);

[0046] (3) The present invention realizes the dynamic adjustment of edge weights. By combining the time decay formula with the historical data recording function of the blockchain, the deep embedding learning model can better adapt to the dynamic changing characteristics of network traffic data, thereby improving the real-time performance and accuracy of the analysis results.

[0047] (4) While ensuring data security and privacy, the present invention significantly improves the accuracy and timeliness of network traffic behavior identification. It is highly scalable and practical and can be widely used in network security monitoring, anomaly detection, threat identification and other fields, providing new technical paths and solutions for intelligent network management. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 This is a flowchart of a graph-structured blockchain network traffic data analysis method according to an embodiment of the invention;

[0050] Figure 2 This is a schematic diagram of the overall processing of the blockchain network traffic data analysis method based on a graph structure according to an embodiment of the present invention;

[0051] Figure 3 Schematic diagram of the implementation of the multi-source feature fusion and dimensionality reduction mechanism of an embodiment of the present invention;

[0052] Figure 4Schematic diagram of a blockchain network traffic data analysis system based on a graph structure according to an embodiment of the present invention. DETAILED DESCRIPTION

[0053] To make the objectives, technical solutions, and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings. It is apparent that the embodiments described are only some, not all, of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0054] This graph-based blockchain network traffic data analysis method, introduced in this paper, utilizes blockchain, an oracle, and other technical tools to achieve secure sharing and efficient analysis of network traffic data. This method provides strong support for network security monitoring and anomaly detection, ensuring the immutability and transparency of network data. The method comprises multiple blockchain nodes. The devices represented by these nodes use an oracle as a bridge for off-chain data exchange, uploading corresponding network traffic, weights, and features to the blockchain to ensure data reliability. Smart contracts invoke corresponding modules to perform operations such as preprocessing the collected data, graph structure generation, embedding learning, feature fusion and calculation, and storage of analysis results. This method leverages the immutability, distributed storage, and automated execution of smart contracts in blockchain to achieve secure sharing and efficient analysis of network traffic data. Finally, smart contracts update the analysis results to the blockchain in real time, enabling data traceability and auditing, and providing strong support for network security monitoring, threat detection, and other fields.

[0055] like Figure 1 and Figure 2 As shown, this embodiment provides a blockchain network traffic data analysis method based on a graph structure, which includes the following steps.

[0056] S101 receives raw network data collected from multiple network devices or data centers through oracle technology and pre-processes it on multiple blockchain nodes.

[0057] Specifically, network traffic analysis first uses oracles and other technologies to collect raw traffic data from multiple network devices or data centers and upload it to the blockchain. This newly added data is then preprocessed, including format verification, integrity checks, encryption, and digital signatures to ensure authenticity and immutability. The collected raw network data is also cleaned and normalized to ensure uniformity and integrity. Timestamps are also uploaded to facilitate subsequent dynamic weight calculations.

[0058] The embodiment of the present invention introduces oracle technology and smart contract mechanism in the process of network traffic data processing, and constructs a decentralized data collection architecture. Through this mechanism, multiple network devices or data centers can securely upload raw network traffic data to the blockchain platform. Specifically, the oracle node is responsible for receiving raw data requests from users and performing integrity verification and format standardization on the data. After verification, the data will be encrypted and digitally signed to ensure its privacy and security. Storing data on the blockchain through smart contracts can not only prevent data from being tampered with, but also when auditing or tracing responsibilities is required, users can query the data status and operation records at any time through block hash or transaction ID, ensuring that all processes are transparent and reliable. This process makes full use of the distributed ledger technology and immutability of the blockchain to ensure data security and reliability.

[0059] The pseudocode of the smart contract is shown in Table 1. NetworkDataUploader implements a blockchain-based network data upload and verification mechanism. The overall logic can be divided into two main parts: the data upload and verification process, and the event notification and external interaction mechanism.

[0060] Table 1 Smart contract pseudo code;

[0061]

[0062] First, in terms of initialization and constant definition, the contract declares a fixed value, ORACLE_PAYMENT, representing the oracle service fee (1 unit) that users must pay when uploading data. A mapping, uploadedDataHashes, is used to record the hash values ​​of all uploaded data to prevent duplicate submission. In the data upload phase, the raw network data string, rawData, and its timestamp, are uploaded by calling the uploadRawData function. A value at least equal to the oracle service fee must also be sent with the transaction. The contract first verifies that the payment requirements have been met and hashes the raw data and timestamp using the keccak256 algorithm to ensure data integrity and uniqueness. It then checks whether the data has been uploaded before. If not, its hash is recorded in a state variable. Finally, an on-chain event, named DataUploadedEvent, is triggered, passing in the data hash, timestamp, and uploader address to notify external systems (such as oracles) to begin subsequent processing. The entire design decouples on-chain data upload from off-chain service processing through an event-driven approach, providing an interface foundation for the subsequent introduction of oracle verification or analysis.

[0063] S102, based on the preprocessed traffic data, constructs an embedding matrix of node features, edges and links, and combines the blockchain historical data records to dynamically adjust the edge weights to generate a suitable undirected graph.

[0064] Specifically, the graph structure generation module is called through the smart contract, and the embedding matrix of node features, edges and links is constructed based on the preprocessed raw traffic data. The edge weights are dynamically adjusted in combination with the blockchain historical records to generate a suitable undirected graph.

[0065] In order to extract complex relational structures from network traffic data, an embodiment of the present invention proposes a graph structure generation method, which converts the node features in each traffic record into entity nodes in the graph, and generates edge relationships by combining different feature fields. For example, for a traffic record containing fields such as source IP, target IP, protocol type, port number, etc., it is disassembled into multiple edges to construct an undirected graph structure. Furthermore, a time-attenuated weight calculation formula is used to measure the importance difference of traffic behavior in different time periods. Suppose an edge (i, j) is at a historical moment t h If an interaction has occurred and the current time is t, then the time decay weight of the edge is w i,j Defined as:

[0066]

[0067] Where b is the decay coefficient, which controls the decay rate over time, and T1 is the time unit (which can be set to one week or another). This formula gives higher weight to recent interactions, thereby increasing the model's sensitivity to dynamic network behavior.

[0068] In addition to considering the impact of time, blockchain technology is also considered to adjust the weight of each edge based on historical weight information in past records, realizing a dynamic learning mechanism. The pseudo code of the smart contract is shown in Table 2. The overall logic can be divided into three main parts: graph data representation and initialization, weight calculation and update strategy, and history recording and query functions.

[0069] First, in terms of data structure definition, the contract defines the basic properties of the edges in the graph through the Edge structure, including two node IDs (nodeId1 and nodeId2), edge type (edgeType), current weight (weight), and last update time (lastUpdated); all edges are stored in the dynamic array edges, and a mapping historyWeights is used to maintain the historical weight record of each edge to support subsequent weight update logic. In the weight update mechanism, when the updateEdgeWeight function is called, the historical weight record of the edge on the chain is read, combined with the time decay formula:

[0070]

[0071] Among them, w new represents the dynamically adjusted edge weight; avgWeight is the average of the edge's past weights; T2 is the decay time unit (e.g., one week); and Δt is the time difference since the last update. A weighted approach is used to update the current weight, ensuring that older history has a smaller impact on the current weight. The final output graph structure is used by the subsequent embedding learning module.

[0072] Table 2 Pseudo code for dynamic weight adjustment;

[0073]

[0074] S103, based on the generated graph structure, uses a deep embedding learning model to learn low-dimensional representations of nodes in network traffic; uses the dot product attention mechanism to calculate the similarity between nodes, generates training samples through negative sampling and optimizes the loss function to generate node embedding vectors; wherein, the embedding learning task is distributed and calculated on multiple blockchain nodes.

[0075] Specifically, the learning task is distributed across multiple blockchain nodes, with each node responsible for a portion of the computation. A dot-product attention mechanism is used to optimize the embedding space, placing nodes with similar contexts close together in the embedding space. This helps distinguish normal from abnormal behavior. During this process, negative sampling is used to generate training samples and optimize the loss function, ultimately resulting in high-quality embedding vectors. These embedding vectors capture high-order features in complex relational data, supporting subsequent analysis tasks. The loss function consists of two parts: one measures the difference between positive and negative samples; the other is an attribute-based regularization term to ensure consistency between node embeddings and their attributes. However, random sampling can result in low sample quality, impacting model performance. Instead, the blockchain records the global distribution of nodes and edges, prioritizing nodes with significant differences from positive samples as negative samples. Smart contracts enforce rules to filter out higher-quality negative samples. For example, filtering can be based on node feature similarity or historical interaction frequency.

[0076] Embedding learning involves large-scale matrix operations. Tasks can be divided according to edge lists. A sharding strategy based on feature combinations is adopted to distribute node pairs and corresponding relationships in the graph structure to multiple blockchain nodes for parallel calculation. Each node independently completes local embedding updates and aggregates gradient information through smart contracts to achieve global parameter synchronization. Task allocation and result aggregation are triggered by on-chain events to ensure the security and consistency of the training process.

[0077] After obtaining the graph structure, the present invention uses a deep embedding learning framework model to learn low-dimensional representations of nodes in network traffic and uses a dot product attention mechanism to calculate the similarity between nodes. The core idea is to make nodes with similar contextual features close to each other in the embedding space. Specifically, in the initialization phase, each node v is assigned a d-dimensional vector e v ∈R d , and calculate the similarity score between nodes through the dot product attention mechanism. Let the embedding vectors of two nodes i and j be e i and e j , the similarity between them is s ij Defined as:

[0078]

[0079] In order to improve the distinguishing ability of the model, a negative sampling strategy is used in the training process. The training samples are generated by negative sampling, and the loss function is optimized by combining the optimization algorithm. That is, for each positive sample edge (i, j), k negative sample nodes {n1, n2, ..., nk} are randomly selected to construct the negative sample {i, n k}, and minimize the following loss function:

[0080] L=-log σ(s ij )-∑ k log σ(-s ik ) (4)

[0081] Here, σ(·) is the Sigmoid function, used to map scores to probability space. The loss function design comprehensively considers the distribution of positive and negative samples, while also introducing a regularization term to prevent overfitting. Backpropagation continuously optimizes the embedding matrix, ultimately obtaining high-quality node embedding vectors that can be used for downstream tasks. Through this stage of learning, complex relational data is converted into a low-dimensional representation, laying the foundation for subsequent feature fusion and dimensionality reduction.

[0082] Considering that it involves large-scale matrix operations, the learning task can be distributed across multiple blockchain nodes, with each node responsible for a portion of the computation. The pseudocode is shown in Table 3, and it mainly includes three parts: graph data management, distributed computing scheduling, and gradient aggregation mechanism.

[0083] Table 3 Distribution calculation pseudo code;

[0084]

[0085] During the training startup phase, the user calls the startTraining function to pass in the graph edge data, and divides the complete graph data into multiple sub-batches. The computeEmbeddingBatch function of the external interface IEmbeddingWorker is called separately to distribute the computing tasks to each worker node. When the worker completes the local calculation, it uploads the calculated gradient results by calling the collectAndUpdateGradients function. The contract verifies the caller's identity, records the gradients, and marks the worker's task as completed. Once all workers have completed their tasks, the aggregate function (not shown) is automatically triggered to perform global gradient aggregation. This achieves the coordination of on-chain scheduling and off-chain computing, supporting a decentralized graph neural network training process.

[0086] S104, load the node embedding vector, calculate the cosine similarity between nodes, and generate a new feature column, and generate a multi-dimensional fusion feature set through multi-stage feature screening and dimensionality reduction.

[0087] Specifically, by loading embedding vectors, calculating the cosine similarity between nodes, and combining statistics (such as mean and variance) to generate new feature columns, we further utilize multi-stage feature filtering, including variance filtering and model-based filtering, as well as SVD dimensionality reduction techniques, to clean and reduce the features, effectively capturing the underlying structure in the data. Finally, we combine the blockchain to record the feature distribution of different nodes or devices, promoting the fusion of multi-source features and generating a multi-dimensional fused feature set.

[0088] It generates complementary features through a variety of feature extraction methods to improve the accuracy of classification or detection tasks, reduce redundant information and enhance semantic expression capabilities. It does not simply splice features, but combines multimodal information such as graph embedding, statistical features, dimensionality reduction methods, and uses modern machine learning technology and blockchain to record multi-source feature distribution to achieve data fusion and quality assessment across nodes / devices. The specific implementation block diagram is as follows: Figure 3 shown.

[0089] First, the input is the cross-feature matrix after preprocessing and graph structure construction. These cross-features capture the multi-dimensional relationship in network traffic behavior. Then the trained node embedding vector is loaded. In order to improve the semantic expression ability of the embedding vector, the present invention introduces a similarity calculation module to measure the similarity between any two nodes. Let the embedding vectors of nodes i and j be e i and e j , then their cosine similarity is defined as:

[0090]

[0091] On this basis, further calculate the statistical features of the similarity distribution, including the mean, standard deviation, and maximum / minimum values, to form a new set of high-order feature columns F stat ={μ,σ,s max ,s min}. These features and the original embedding features together constitute the fused feature set. For the fused high-dimensional feature space, the embodiments of the present invention introduce a two-stage feature dimensionality reduction mechanism to reduce redundant information and improve the model generalization ability. The first stage is variance screening, and its core idea is: if the value of a certain feature changes very little (i.e., the variance is low) on all samples, it means that the discriminative ability of this feature for the classification or prediction task is weak and can be regarded as a redundant feature and removed. Specifically, let the original fused feature set be F fusion , by setting a preset threshold θ, retain those features with variances greater than θ to form a new feature subset:

[0092] F filtered ={f∈F fusion | Var(f)>θ} (6)

[0093] This step effectively removes the noise features with low variability and reduces the subsequent computational complexity. The second stage is singular value decomposition (dimensionality reduction). For the feature matrix X∈R n×m′ (where n is the number of samples and m′<m is the dimension of the features after screening), perform SVD decomposition:

[0094]

[0095] where, U∈R n×k is the left singular vector matrix, representing the sample feature representation after dimensionality reduction; Σ is a diagonal matrix containing singular values, indicating the importance of each principal component; is the right singular vector matrix, representing the mapping relationship from the original feature space to the low-dimensional space. Finally, select the matrix U composed of the left singular vectors corresponding to the first k largest singular values as the feature matrix after dimensionality reduction (k<m′), to achieve the conversion from the high-dimensional feature space to the low-dimensional compact representation, and use this method to extract the main components in the data as new features, effectively capturing the potential structure in the data. To solve the problem of possible neglect of the potential relationships between features, the feature distributions of different nodes or devices can be recorded through the blockchain to promote the fusion of multi-source features. And use smart contracts to score and screen the features, retaining the most representative features. Its pseudocode is shown in Table 4,

[0096] Table 4 Pseudocode for multi-source feature fusion;

[0097]

[0098] First, the contract records the frequency of occurrence of each feature (feature) on different data source addresses (source) through nested mapping, which is used for subsequent statistical support and coverage. At the same time, it defines a Quality structure to store three key indicators of each feature: support (global occurrence count), coverage (number of different entities covered), and confidence (accurate prediction ratio). Users or oracles can submit the statistical number of a feature in a specific source, thereby updating its source distribution information. On this basis, the contract provides the getFeatureScore function to calculate the comprehensive score of the feature in a weighted manner and determine whether the feature reaches the preset threshold, thereby realizing automatic screening and quality control of high-value features.

[0099] S105, configure the classification model parameters to perform classification model training and performance evaluation on the fusion feature set, and upload the performance evaluation analysis results to the blockchain.

[0100] Specifically, the embedded learning results and features are analyzed, the classification model parameters are configured, the model is trained and performance evaluated, and classification performance indicators (such as ROC-AUC, PRC-AUC, optimal F1 threshold, etc.) are output. The analysis results are uploaded to the blockchain via a smart contract to ensure that the analysis results have not been tampered with and support data traceability. To reduce evaluation time and improve the objectivity and accuracy of model evaluation, the evaluation task is distributed across multiple blockchain nodes, each of which independently calculates performance indicators and uploads them to the blockchain. The evaluation results of all nodes are aggregated through smart contracts to calculate global performance indicators. Based on the evaluation results, the model parameters are dynamically adjusted through smart contracts. The analysis results are uploaded to the blockchain to ensure that they have not been tampered with and support data traceability and auditing.

[0101] After obtaining the reduced feature set, the smart contract monitors data update events. Once new feature data is written to the blockchain, a model evaluation request is triggered. When the evaluation request is triggered, the external inference service receives the notification and loads the latest embedding vectors and feature matrix from the blockchain. The service then trains and validates the latest data using the XGBoost classifier to generate model performance metrics. The model's objective function is defined as follows:

[0102]

[0103] part Represents the prediction loss term, which measures the model prediction value and the true label y i The error between the two. Part II represents the regularization term, which is used to control the complexity of the model and prevent overfitting. k) represents the complexity of the kth decision tree, typically composed of the number of leaf nodes and the L2 norm of their scores. By minimizing the objective function L, XGBoost effectively improves generalization while maintaining model accuracy. After model evaluation, the system outputs multiple key performance indicators (such as ROC-AUC, PRC-AUC, and optimal F1 threshold) as well as the node structure identified as threatening. This information is then stored in an on-chain state variable, ensuring that the results are tamper-proof and publicly accessible.

[0104] like Figure 4 As shown, this embodiment also discloses a blockchain network traffic data analysis system based on a graph structure, including:

[0105] Data acquisition and preprocessing module 401, used to receive raw network data collected from multiple network devices or data centers through oracle technology and preprocess it on multiple blockchain nodes;

[0106] Graph structure generation module 402, used to construct an embedding matrix of node features, edges, and links based on pre-processed traffic data, and dynamically adjust edge weights in combination with blockchain historical data records to generate a suitable undirected graph;

[0107] Embedding learning module 403 is used to learn low-dimensional representations of nodes in network traffic using a deep embedding learning model based on the generated graph structure; uses a dot-product attention mechanism to calculate the similarity between nodes, generates training samples through negative sampling, and optimizes the loss function to generate node embedding vectors; wherein the embedding learning task is distributed and calculated on multiple blockchain nodes;

[0108] The feature fusion and dimensionality reduction calculation module 404 is used to load the node embedding vector, calculate the cosine similarity between nodes, and generate a new feature column. It also generates a multi-dimensional fusion feature set through multi-stage feature screening and dimensionality reduction;

[0109] The model evaluation and performance analysis module 405 is used to configure the classification model parameters to perform classification model training and performance evaluation on the fusion feature set, and upload the performance evaluation analysis results to the blockchain.

[0110] The specific implementation of each module of a blockchain network traffic data analysis system based on a graph structure is the same as the blockchain network traffic data analysis method based on a graph structure, and this embodiment will not be repeated.

[0111] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some or all of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A blockchain network traffic data analysis method based on graph structure, characterized in that: include: S101, receiving raw network data collected from multiple network devices or data centers through oracle technology and pre-processing it on multiple blockchain nodes; S102, based on the pre-processed traffic data, construct an embedding matrix of node features, edges and links, and dynamically adjust edge weights in combination with blockchain historical data records to generate a suitable undirected graph; S103, based on the generated graph structure, a deep embedding learning model is used to learn low-dimensional representations of nodes in network traffic; The dot-product attention mechanism is used to calculate the similarity between nodes. Training samples are generated through negative sampling and the loss function is optimized to generate node embedding vectors. The embedding learning task is distributed and calculated on multiple blockchain nodes. S104, load the node embedding vector, calculate the cosine similarity between nodes, and generate a new feature column. Then, through multi-stage feature screening and dimensionality reduction, generate a multi-dimensional fusion feature set; S105, configure the classification model parameters to perform classification model training and performance evaluation on the fusion feature set, and upload the performance evaluation analysis results to the blockchain.

2. The blockchain network traffic data analysis method based on graph structure according to claim 1 is characterized in that: In S101, the preprocessing includes format verification, integrity check, encryption and digital signature processing of the collected original network data to ensure the authenticity and non-tamperability of the data; and also includes cleaning and normalization of the collected original network data.

3. The blockchain network traffic data analysis method based on graph structure according to claim 1 is characterized in that: The S102 specifically includes: Based on the pre-processed traffic data, key information that can reflect network behavior and the timestamp of the record on the chain are extracted as features. Then, a unique node identifier is generated by concatenating each feature value with the feature name, and a node-to-ID mapping dictionary is constructed. Each event is regarded as a central event unit, and all possible node feature combination pairs are extracted from them. These combination pairs are converted into edges in the graph. Each edge contains a node pair, edge type, and the timestamp of occurrence. The edge type and weight are counted, and the weight of each edge is calculated according to the time decay formula. The edge weight is dynamically adjusted based on the historical weight data recorded by the blockchain and the real-time network status. After the above processing, an undirected graph structure is constructed to ensure the directional consistency of the edges, and an embedding matrix of nodes and edges is generated.

4. The blockchain network traffic data analysis method based on graph structure according to claim 3 is characterized in that: The weight of each edge is calculated according to the time decay formula, including: Suppose an edge (i, j) at historical time t h If an interaction has occurred and the current time is t, then the time decay weight of the edge is w i,j Defined as: Where b is the attenuation coefficient, which controls the decay rate over time; T1 is the time unit.

5. The blockchain network traffic data analysis method based on graph structure according to claim 3 is characterized in that: The historical weight data recorded by the blockchain is combined with the real-time network status to dynamically adjust the edge weight, as shown below: Among them, w new Represents the dynamically adjusted edge weight; avgWeight represents the average of the historical edge weight; T2 is the decay time unit; Δt is the time difference from the last update to the present.

6. The blockchain network traffic data analysis method based on graph structure according to claim 1 is characterized in that: The S103 specifically includes: In the initialization phase, a preset dimension vector is assigned to each node, and the similarity score between two nodes is calculated through the dot product attention mechanism; During the model training process, positive and negative samples are generated through a negative sampling strategy, and the corresponding loss function is calculated and optimized to generate high-quality embedding vectors. The loss function consists of two parts: one part measures the difference between positive and negative samples; the other part is an attribute-based regularization term used to maintain the consistency of node embeddings and their attributes.

7. The blockchain network traffic data analysis method based on graph structure according to claim 1 is characterized in that: The embedding learning task is distributed and calculated on multiple blockchain nodes, specifically including: The tasks are divided according to the edge list, and a sharding strategy based on feature combination is adopted to distribute the node pairs and corresponding relationships in the graph structure to multiple blockchain nodes for parallel calculation; each blockchain node independently completes local embedding updates and aggregates gradient information through smart contracts to achieve global parameter synchronization; task allocation and result aggregation are triggered by on-chain events to ensure the security and consistency of the training process.

8. The blockchain network traffic data analysis method based on graph structure according to claim 1 is characterized in that: The S104 specifically includes: Loading node embedding vectors and calculating the cosine similarity between nodes as new features; these similarity features together with other statistics constitute a new feature column; the other statistics include maximum similarity, minimum similarity and standard deviation; The new feature columns are cleaned and standardized, and the most valuable features for the target variable are gradually extracted through multi-stage feature screening; then SVD dimensionality reduction is used to reduce the feature dimensions, and the main components in the data are extracted as new feature columns to capture the potential structure in the data and generate a multi-dimensional fusion feature set.

9. The blockchain network traffic data analysis method based on graph structure according to claim 1 is characterized in that: S105 specifically includes: configuring the classification model parameters to perform model training and performance evaluation on the fusion feature set, and uploading the performance evaluation analysis results to the blockchain to ensure that they are not tampered with and support data traceability and auditing. Call the embedded learning results and features for analysis, configure the classification model parameters, train and evaluate the classification model, and output classification performance indicators; upload the evaluation results to the blockchain through smart contracts to ensure that the analysis results have not been tampered with and support data traceability; Among them, the performance evaluation task is distributed to multiple blockchain nodes, each node independently calculates the performance indicators and uploads them to the blockchain; the evaluation results of all nodes are aggregated through smart contracts to calculate global performance indicators; based on the evaluation results, the model parameters are dynamically adjusted through smart contracts.

10. A blockchain network traffic data analysis system based on graph structure, characterized in that: include: The data acquisition and preprocessing module is used to receive raw network data collected from multiple network devices or data centers through oracle technology and preprocess it on multiple blockchain nodes; The graph structure generation module is used to construct an embedding matrix of node features, edges, and links based on preprocessed traffic data, and dynamically adjust edge weights in combination with blockchain historical data records to generate a suitable undirected graph; Embedding learning module, which is used to learn low-dimensional representations of nodes in network traffic using a deep embedding learning model based on the generated graph structure; The dot-product attention mechanism is used to calculate the similarity between nodes. Training samples are generated through negative sampling and the loss function is optimized to generate node embedding vectors. The embedding learning task is distributed and calculated on multiple blockchain nodes. The feature fusion and dimensionality reduction calculation module is used to load node embedding vectors, calculate the cosine similarity between nodes, and generate new feature columns. It also generates a multi-dimensional fusion feature set through multi-stage feature screening and dimensionality reduction. The model evaluation and performance analysis module is used to configure the classification model parameters to perform classification model training and performance evaluation on the fusion feature set, and upload the performance evaluation analysis results to the blockchain.

Images