An elephant flow identification and processing method in a distributed energy safety data acquisition device

Abstract

The application discloses a kind of elephant flow identification and processing method in distributed energy security data acquisition device, it is related to data stream transmission technical field, and the network traffic data is obtained by flow acquisition equipment, and the characteristic value of data packet in unit time is counted by sliding window, data stream coefficient is calculated according to data packet characteristic value to judge to generate first elephant flow processing signal, simultaneously, CPU usage rate prediction model is constructed based on convolutional neural network, and real-time CPU usage rate is substituted into CPU usage rate prediction model to output expected CPU usage rate, to judge to generate second elephant flow processing signal, and the hierarchical result is obtained by hierarchical response mechanism to elephant flow, and differential processing strategy is executed according to hierarchical result, wherein, multi-channel shunt transmission is used to primary elephant flow, dynamic encryption transmission is started to secondary elephant flow, local cache is triggered to tertiary elephant flow, and security early warning signal is generated to execute security early warning mechanism.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data stream transmission, in particular to a method for identifying and processing elephant flows in a distributed energy safety data acquisition device. BACKGROUND

[0002] Traffic in the network is usually divided into two types, namely elephant flow and mouse flow. Elephant flow has large number of bytes, large rate, long duration, and high bandwidth requirement. Mouse flow has small number of bytes, small rate, short duration, and is sensitive to latency. In actual data center network traffic, the number of elephant flows is not large, but they occupy a large amount of traffic, and the number of mouse flows is large, but they only occupy a small amount of traffic.

[0003] The distributed energy safety data acquisition device is a device for data acquisition, monitoring, transmission and processing in a distributed energy system. The distributed energy system includes small and scattered energy devices such as solar energy, wind energy, energy storage and gas power generation. In order to ensure the safe and efficient operation of these distributed energy systems, it is necessary to monitor and transmit data of key parameters and devices in real time through data acquisition devices. The distributed energy safety data acquisition device deployed in the network carries a variety of services, and the distribution of service flow is bursty and uneven, which will increase the latency in the device processing process and cannot allocate resources such as bandwidth as needed, resulting in network congestion and reducing network performance.

[0004] In the gateway device, for a large number of data flows, the device will directly process according to the priority of the message. Once the processing capacity is exceeded, random packet loss and increased latency will occur. The data flow is not classified, and when performing message processing and discarding operations, it can only be executed according to the message order, and cannot guarantee the robustness of the network and the reliability of the service.

[0005] In view of the above technical defects, the present application provides a solution. SUMMARY

[0006] The purpose of the present application is to obtain a hierarchical result by classifying elephant flow through a hierarchical response mechanism, and to execute a differentiated processing strategy according to the hierarchical result, wherein the first-level elephant flow adopts multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, the third-level elephant flow triggers local cache, and a safety warning signal is generated to execute a safety warning mechanism. The present application has little effect on the processing of normal service traffic in the system, and can achieve the predetermined effect, which guarantees the safety of the network and improves the robustness.

[0007] In order to achieve the above purpose, the present application adopts the following technical scheme: a method for identifying and processing elephant flow in a distributed energy safety data acquisition device, comprising the following steps:

[0008] Step one, get elephant flow identification basis:

[0009] In the distributed energy security data acquisition device, a plurality of energy nodes are selected, a flow acquisition device is arranged at the energy node, network flow data is acquired through the flow acquisition device, the network flow data is analyzed, and analyzed network flow data is obtained;

[0010] Meanwhile, a monitoring system for CPU in the distributed energy security data acquisition device is constructed based on Prometheus and Grafana, which is used for real-time monitoring and visual display of CPU usage;

[0011] Step two, identify elephant flow:

[0012] The analyzed network flow data is acquired, the data packet characteristic value in unit time is counted through a sliding window, the data flow coefficient is calculated according to the data packet characteristic value, the first elephant flow processing signal is generated when the data flow coefficient exceeds the preset judgment threshold, and the preset hierarchical response mechanism is triggered at the same time;

[0013] The historical CPU usage data is acquired, a CPU usage rate prediction model is constructed based on a convolutional neural network, the real-time CPU usage rate is substituted into the CPU usage rate prediction model to output the expected CPU usage rate, the burst packet loss probability is judged according to the preset usage rate judgment threshold, the second elephant flow processing signal is generated, and the preset hierarchical response mechanism is triggered;

[0014] Step three, process elephant flow:

[0015] The hierarchical response mechanism is used to grade the elephant flow to obtain a grading result, and a differentiated processing strategy is executed according to the grading result, wherein the first-level elephant flow adopts multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, the third-level elephant flow triggers local caching, and a safety warning signal is generated to execute a safety warning mechanism;

[0016] Step four, record the key operation nodes in the above process through a block chain storage module, form a traceable audit chain and cache to a database.

[0017] Further, the specific process of analyzing the network flow data is as follows:

[0018] S101, the flow acquisition device is NetFlow, network flow data is acquired according to a preset frequency, and the network flow data includes the source, destination IP address, port number, protocol type, flow size and timestamp of the network packet;

[0019] S102, filtering irrelevant network traffic data according to a preset analysis requirement, dividing the captured network traffic data into flow data packets according to flow, and one flow is a communication uniquely determined by a source address, a source port, a destination address, a destination port and a protocol in a specific time period;

[0020] S103, decoding the flow data packets according to the UDP protocol, specifically including analyzing IP addresses, port numbers and UDP header information, and extracting metadata information from each flow data packet, including source addresses, target addresses, protocols, transmission byte numbers, packet lengths and timestamps;

[0021] S104, classifying the flow data packets according to different protocol types to obtain a packet classification result.

[0022] Further, the specific process of generating the first elephant flow processing signal is as follows:

[0023] S201, obtaining a packet characteristic value, the packet characteristic value including a packet header characteristic code, a transmission rate V, an effective load entropy value Q and a data volume, wherein the data volume includes an absolute data value A and a relative data value B;

[0024] S202, the packet header characteristic code includes a protocol type and a key header field, a window data C and a sequence number increment AD are obtained according to a leakage type, and a data flow coefficient Ki is calculated according to the following formula: wherein e1, e2, e3 and e4 are preset weight coefficients, is a standard value of the transmission rate, is a standard value of the effective load entropy value, is a normal value of the window data, the data flow coefficient is used to evaluate the duration of the network flow data and the comprehensive performance of the data flow, the greater the data flow coefficient, the longer the duration of the network flow data and the greater the data flow, and vice versa, the smaller the data flow coefficient, the shorter the duration of the network flow data and the smaller the data flow;

[0025] S203, obtaining a preset judgment threshold, and generating the first elephant flow processing signal when the data flow coefficient is greater than or equal to the judgment threshold.

[0026] Further, the specific process of generating the second elephant flow processing signal is as follows:

[0027] S301, obtaining historical CPU usage data as a training sample, the historical CPU usage data including historical user state usage rate, historical kernel state usage rate, idle time, waiting time and process processing time, and the generated sample is divided into a training set, a validation set and a test set in a ratio of 7:2:1, and a CPU usage rate prediction model is established based on a convolutional neural network;

[0028] S302, download the weight file and load it to the corresponding network for initializing the migration network parameter;

[0029] S303, modify the last fully connected layer of the network, keep the input unchanged, set the output to the expected CPU usage, initialize the weight of the last layer, use gradient descent algorithm for learning, and adopt fixed step attenuation to optimize the training parameters, retrain the whole network to obtain the CPU usage prediction model;

[0030] S304, randomly and repeatedly extract small batches of samples from the training set for training during the training process, extract all training samples as a training cycle, iterate to a certain cycle to complete the training, and obtain the CPU usage prediction model;

[0031] S305, input the CPU usage into the CPU usage prediction model to obtain the expected CPU usage, and if the expected CPU usage is greater than or equal to the preset usage judgment threshold, a second elephant flow processing signal is generated.

[0032] Further, the hierarchical response mechanism includes a dynamic threshold adjustment unit, a traffic feature learning unit and a hierarchical decision unit, wherein:

[0033] The dynamic threshold adjustment unit is used to correct the feature threshold in real time according to the network load rate;

[0034] The traffic feature learning unit uses an improved LSTM neural network model for traffic pattern recognition;

[0035] The hierarchical decision unit determines the elephant flow level based on the fuzzy comprehensive evaluation method.

[0036] Further, the security warning mechanism includes:

[0037] A threat prediction model is constructed based on a knowledge graph, and flow data of the three-level elephant flow is substituted into the threat prediction model to generate an attack path prediction result;

[0038] After obtaining the warning signal, it is transmitted to the control center through a quantum key distribution channel;

[0039] Start the trapping mode to collect attack evidence.

[0040] Further, the blockchain storage module includes a node collection unit, a feature extraction unit, a trusted execution unit and a data integration unit;

[0041] The node collection unit is used for setting corresponding data collection nodes at key operation nodes in the above process, the data collection nodes follow a P2P network protocol, support multicast routing and new node identification, and ensure efficient data propagation between distributed nodes, and each edge collection node is used for acquiring operation records and sending to the feature extraction unit;

[0042] The feature extraction unit is used for acquiring and analyzing operation records, performing high-speed traffic feature extraction, obtaining traffic feature data, and maintaining a block chain data structure in memory, and persistently storing the traffic feature data to a distributed database;

[0043] The trusted execution unit is used for a trusted execution environment to ensure the security of key computing processes, and supports SM9 algorithm to realize dynamic key negotiation between nodes;

[0044] The data integration unit is used for packing traffic feature data that passes verification into blocks according to the arrangement order of timestamps, adding a Merkle root and a previous block hash, verifying the legality of the block through an eplica node, adding the block to the end of the chain, updating the global state to obtain a new block, broadcasting the new block through a P2P network, updating a local ledger after verification by other nodes, and ensuring data final consistency.

[0045] As described above, due to the adoption of the above technical solutions, the present application has the following advantages:

[0046] The elephant flow identification and processing method of the distributed energy safety data collection device acquires network flow data through a flow collection device, and calculates a data flow coefficient according to the data packet characteristic value to generate a first elephant flow processing signal, and a CPU usage rate prediction model is constructed based on a convolutional neural network, the real-time CPU usage rate is substituted into the CPU usage rate prediction model to output the expected CPU usage rate, and then a second elephant flow processing signal is generated, the elephant flow is graded through a hierarchical response mechanism to obtain a grading result, and a differentiated processing strategy is executed according to the grading result, wherein the first-level elephant flow adopts multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, and the third-level elephant flow triggers local caching, and a safety warning signal is generated to execute a safety warning mechanism, the present application has little influence on the processing of normal business flow in the system, and can achieve the predetermined effect, which ensures the safety of the network and improves the robustness. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 The overall method flowchart of the present application is shown. DETAILED DESCRIPTION

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Example:

[0050] like Figure 1 As shown, a method for identifying and processing elephant flows in a distributed energy security data acquisition device includes the following steps:

[0051] Step 1: Obtain the basis for elephant flow recognition:

[0052] In the distributed energy security data acquisition device, multiple energy nodes are selected, and traffic acquisition devices are set up at the energy nodes. Network traffic data is acquired through the traffic acquisition devices, and the network traffic data is parsed to obtain the parsed network traffic data.

[0053] The specific process of parsing network traffic data is as follows:

[0054] S101. The traffic acquisition device is specifically NetFlow, which acquires network traffic data at a preset frequency. The network traffic data includes the source and destination IP address, port number, protocol type, traffic size, and timestamp of the network packets.

[0055] S102. Filter irrelevant network traffic data according to the preset parsing requirements, and divide the captured network traffic data into flow data packets. A flow is a communication that is uniquely determined by the source address, source port, destination address, destination port and protocol within a specific time period.

[0056] S103. According to the UDP protocol, decode the stream data packets, specifically including parsing the IP address, port number and UDP header information, and extracting metadata information from each stream data packet, including source address, destination address, protocol, number of bytes transmitted, data packet length and timestamp;

[0057] S104. Classify the stream data packets according to different protocol types to obtain the data packet classification results;

[0058] Meanwhile, a monitoring system for CPUs in distributed energy security data acquisition devices was built based on Prometheus and Grafana to monitor and visualize CPU utilization in real time.

[0059] Step 2: Identify the elephant flow:

[0060] The parsed network flow data is acquired, the feature values of the data packets in a unit time are counted through a sliding window, a data flow coefficient is calculated according to the feature values of the data packets, a first elephant flow processing signal is generated when the data flow coefficient exceeds a preset judgment threshold, and a preset hierarchical response mechanism is triggered at the same time;

[0061] The specific process of generating the first elephant flow processing signal is as follows:

[0062] S201, acquiring a data packet feature value, the data packet feature value including a data packet header characteristic code, a transmission rate V, a payload entropy value Q and a data volume, wherein the data volume includes an absolute data value A and a relative data value B;

[0063] S202, the data packet header characteristic code including a protocol type and a key header field, window data C and a sequence number increment ΔD are acquired according to a leakage type, and a data flow coefficient Ki is calculated according to the following formula: wherein e1, e2, e3 and e4 are preset weight coefficients, is a standard value of the transmission rate, is a standard value of the payload entropy value, is a normal value of the window data, the data flow coefficient being used to evaluate the duration of the network flow data and the comprehensive performance of the data traffic, the greater the data flow coefficient, the longer the duration of the network flow data and the greater the data traffic, and vice versa, the smaller the data flow coefficient, the shorter the duration of the network flow data and the smaller the data traffic;

[0064] S203, acquiring a preset judgment threshold, and generating a first elephant flow processing signal when the data flow coefficient is greater than or equal to the judgment threshold;

[0065] Acquiring historical CPU usage data, constructing a CPU usage rate prediction model based on a convolutional neural network, substituting real-time CPU usage rate into the CPU usage rate prediction model to output expected CPU usage rate, judging burst packet loss probability according to a preset usage rate judgment threshold to generate a second elephant flow processing signal, and triggering a preset hierarchical response mechanism;

[0066] The specific process of generating the second elephant flow processing signal is as follows:

[0067] S301, acquiring historical CPU usage data as a training sample, the historical running data including historical user state usage rate, historical kernel state usage rate, idle time, waiting time and process processing time, the generated sample being divided into a training set, a validation set and a test set in a ratio of 7:2:1, and a CPU usage rate prediction model being established based on a convolutional neural network;

[0068] S302, downloading a weight file and loading it onto a corresponding network for initializing migration network parameters;

[0069] S303, modify the last fully connected layer of the network, keep the input unchanged, set the output to the expected CPU usage, initialize the weights of the last layer, use the gradient descent algorithm for learning, and use fixed step attenuation to optimize the training parameters, retrain the entire network, and obtain a CPU usage prediction model;

[0070] S304, randomly and repeatedly extract small batches of samples from the training set during training, and extract all training samples as a training period. After a certain period of iteration, the training is completed, and a CPU usage prediction model is obtained;

[0071] S305, input the CPU usage into the CPU usage prediction model to obtain the expected CPU usage, and if the expected CPU usage is greater than or equal to the preset usage judgment threshold, a second elephant flow processing signal is generated;

[0072] The hierarchical response mechanism includes a dynamic threshold adjustment unit, a flow feature learning unit, and a hierarchical decision unit, wherein:

[0073] The dynamic threshold adjustment unit is used to correct the feature threshold in real time according to the network load rate;

[0074] The flow feature learning unit uses an improved LSTM neural network model for flow pattern recognition;

[0075] The hierarchical decision unit determines the elephant flow level based on the fuzzy comprehensive evaluation method.

[0076] Step three, process the elephant flow:

[0077] The hierarchical response mechanism is used to grade the elephant flow to obtain a grading result, and a differential processing strategy is executed according to the grading result, wherein the first-level elephant flow uses multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, and the third-level elephant flow triggers local caching and generates a security warning signal to execute a security warning mechanism;

[0078] The security warning mechanism includes:

[0079] A threat prediction model is constructed based on a knowledge graph, and the flow data of the third-level elephant flow is substituted into the threat prediction model to generate an attack path prediction result;

[0080] After obtaining the warning signal, it is transmitted to the control center through a quantum key distribution channel;

[0081] Start the trapping mode to collect attack evidence.

[0082] Step four, record the key operation nodes in the above process through a blockchain storage module to form a traceable audit chain and cache to a database;

[0083] The blockchain storage module comprises a node collection unit, a feature extraction unit, a trusted execution unit and a data integration unit.

[0084] The node collection unit is configured to set corresponding data collection nodes at key operation nodes in the above process, and the data collection nodes follow a P2P network protocol, support multicast routing and new node identification, and ensure efficient data propagation between distributed nodes.

[0085] The feature extraction unit is configured to obtain operation records and analyze them to extract high-speed traffic features, obtain traffic feature data, and maintain a block chain data structure in memory and persistently store the traffic feature data to a distributed database.

[0086] The trusted execution unit is configured to ensure the security of key computing processes in a trusted execution environment, and support dynamic key negotiation between nodes based on the SM9 algorithm.

[0087] The data integration unit is configured to package traffic feature data that passes verification into blocks in the order of timestamp arrangement, add a Merkle root and a previous block hash, verify the legality of the block through an eplica node, add the block to the end of the chain, update the global state to obtain a new block, broadcast the new block through a P2P network, update the local ledger after verification by other nodes, and ensure data final consistency.

[0088] The application obtains network traffic data through a traffic collection device, and calculates a data flow coefficient according to the data packet characteristic value within a unit time to generate a first elephant flow processing signal, and constructs a CPU usage rate prediction model based on a convolutional neural network, and substitutes the real-time CPU usage rate into the CPU usage rate prediction model to output the expected CPU usage rate, and then generates a second elephant flow processing signal, and obtains a hierarchical result through a hierarchical response mechanism, and executes a differential processing strategy according to the hierarchical result, wherein the first-level elephant flow adopts multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, and the third-level elephant flow triggers local caching and generates a safety warning signal to execute a safety warning mechanism.

[0089] The size of the threshold is set for easy comparison, and the size of the threshold depends on the number of sample data and the number of base set by the skilled person for each group of sample data.

[0090] The above formulas are all dimensionless values calculated, the formulas are obtained by collecting a large amount of data to simulate a formula of the most recent real situation, and preset parameters in the formulas are set by a person skilled in the art according to actual conditions;

[0091] The above merely describes a preferred specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can make equivalent replacement or change according to the technical scheme and the inventive concept of the present application within the technical range disclosed by the present application, which should be covered in the protection scope of the present application.

Claims

1. A method for identifying and processing elephant flows in a distributed energy security data acquisition device, characterized in that, Includes the following steps: Step 1: Obtain the basis for elephant flow recognition: Multiple energy nodes are selected in the distributed energy security data acquisition device, and traffic acquisition devices are set up at the energy nodes. Network traffic data is acquired through the traffic acquisition devices, and the network traffic data is parsed to obtain parsed network traffic data. Meanwhile, a monitoring system for the CPU in distributed energy security data acquisition devices was built based on Prometheus and Grafana to monitor and visualize CPU utilization in real time. Step 2: Identify the elephant flow: The parsed network flow data is obtained, and the characteristic value of the data packets per unit time is statistically analyzed through a sliding window. The data flow coefficient is calculated based on the data packet characteristic value. When the data flow coefficient exceeds the preset judgment threshold, the first elephant flow processing signal is generated, and the preset hierarchical response mechanism is triggered at the same time. The specific process of generating the first elephant stream processing signal is as follows: S201. Obtain data packet feature values, wherein the data packet feature values ​​include data packet header feature code, transmission rate V, payload entropy value Q, and data volume, wherein the data volume includes absolute data value A and relative data value B. S202. The data packet header signature includes the protocol type and key header fields. Based on the leakage type, window data C and sequence number increment ΔD are obtained. The data flow coefficient Ki is calculated using the following formula: Where e1, e2, e3, and e4 are preset weighting coefficients. This is the standard value for transmission rate. The standard value of the payload entropy. The data flow coefficient is a normal value for window data. It is used to evaluate the overall performance of network data flow duration and data flow. The larger the data flow coefficient, the longer the network data flow duration and the larger the data flow. Conversely, the smaller the data flow coefficient, the shorter the network data flow duration and the smaller the data flow. S203. Obtain a preset judgment threshold, and generate a first elephant stream processing signal when the data stream coefficient is greater than or equal to the judgment threshold. Historical CPU usage data is acquired, and a CPU utilization prediction model is built based on a convolutional neural network. The real-time CPU utilization is then substituted into the CPU utilization prediction model to output the expected CPU utilization. The probability of sudden packet loss is determined based on a preset utilization threshold to generate a second elephant stream processing signal, which also triggers a preset hierarchical response mechanism. Step 3: Handling the Elephant Flow: The elephant stream is classified into different levels through a hierarchical response mechanism to obtain the classification results. Differentiated processing strategies are executed based on the classification results. The first-level elephant stream adopts multi-channel split transmission, the second-level elephant stream starts dynamic encrypted transmission, and the third-level elephant stream triggers local caching and generates a security warning signal to execute the security warning mechanism. The security early warning mechanism includes: A threat prediction model is built based on knowledge graphs, and the flow data of the three-level elephant flow is substituted into the threat prediction model to generate attack path prediction results. After receiving the early warning signal, it is transmitted to the control center through the quantum key distribution channel; Activate the trapping mode to collect evidence of the attack; Step 4: Record the key operation nodes in the above process through the blockchain evidence storage module to form a traceable audit chain and cache it in the database.

2. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1, characterized in that, The specific process of parsing the network traffic data is as follows: S101. The traffic acquisition device is specifically NetFlow, which acquires network traffic data at a preset frequency. The network traffic data includes the source, destination IP address, port number, protocol type, traffic size, and timestamp of the network packets. S102. Filter irrelevant network traffic data according to the preset parsing requirements, and divide the captured network traffic data into flow data packets. A flow is a communication that is uniquely determined by the source address, source port, destination address, destination port and protocol within a specific time period. S103. According to the UDP protocol, decode the stream data packets, specifically including parsing the IP address, port number and UDP header information, and extracting metadata information from each stream data packet, including source address, destination address, protocol, number of bytes transmitted, data packet length and timestamp; S104. Classify the stream data packets according to different protocol types to obtain the data packet classification results.

3. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1, characterized in that, The specific process for generating the second elephant stream signal is as follows: S301. Obtain historical CPU usage data as training samples. The historical CPU usage data includes historical user mode usage rate, historical kernel mode usage rate, idle time, waiting time, and process processing time. The generated samples are divided into training set, validation set, and test set in a ratio of 7:2:

1. A CPU usage prediction model is established based on a convolutional neural network. S302. Download the weight file and load it onto the corresponding network to initialize the migration network parameters; S303. Modify the last fully connected layer of the network, keep the input unchanged, set the output to the expected CPU utilization, initialize the weights of the last layer, use the gradient descent algorithm for learning, and use fixed step size decay to optimize the training parameters. Retrain the entire network to obtain the CPU utilization prediction model. S304. During the training process, small batches of samples are randomly and non-repeatedly drawn from the training set for training. One training cycle is completed after all training samples are drawn. The training is completed after a certain number of cycles, and the CPU utilization prediction model is obtained. S305. Input the CPU utilization rate into the CPU utilization rate prediction model to obtain the expected CPU utilization rate. If the expected CPU utilization rate is greater than or equal to the preset utilization rate judgment threshold, then generate the second elephant stream processing signal.

4. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1, characterized in that, The hierarchical response mechanism includes a dynamic threshold adjustment unit, a traffic feature learning unit, and a hierarchical decision-making unit, wherein: The dynamic threshold adjustment unit is used to correct the feature threshold in real time according to the network load rate; The traffic feature learning unit uses an improved LSTM neural network model for traffic pattern recognition; The hierarchical decision-making unit determines the elephant flow level based on the fuzzy comprehensive evaluation method.

5. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1, characterized in that, The blockchain evidence storage module includes a node acquisition unit, a feature extraction unit, a trusted execution unit, and a data integration unit; The node acquisition unit is used to set up corresponding data acquisition nodes based on the key operation nodes in the above process. The data acquisition nodes follow the P2P network protocol, support multicast routing and new node identification, and ensure efficient data propagation between distributed nodes. Each edge acquisition node is used to acquire operation records and send them to the feature extraction unit. The feature extraction unit is used to acquire and parse operation records, perform high-speed traffic feature extraction, obtain traffic feature data, maintain a block chain data structure in memory, and persistently store the traffic feature data to a distributed database. Trusted execution units are used in trusted execution environments to ensure the security of critical computing processes, while also supporting the SM9 algorithm to achieve dynamic key negotiation between nodes; The data integration unit is used to package the verified traffic feature data into blocks according to the timestamp arrangement, add the Merkle root and the previous block hash, verify the legality of the blocks through the eplica nodes, add the blocks to the end of the chain, update the global state to obtain new blocks, and broadcast the new blocks through the P2P network. Other nodes verify the blocks and update their local ledgers to ensure eventual data consistency.

Images