Node anomaly identification and reputation evaluation method and device based on cross-chain behavior graph

Abstract

The invention relates to a node anomaly recognition and reputation evaluation method and device based on a cross-chain behavior graph. The method comprises the following steps: acquiring cross-chain behavior data on a block chain network through an acquisition tool; according to the cross-chain behavior data, a cross-chain behavior graph is constructed, and the cross-chain behavior graph is used for indicating a node behavior operation track in the whole process of the cross-chain transaction; performing path analysis and node behavior consistency verification on the cross-chain behavior map, and positioning a deviation node and an abnormal behavior of the deviation node; taking an abnormal sequential logic relationship in the cross-chain behavior graph as a core, extracting a key operation sequence of a cross-chain transaction and generating a verifiable behavior chain; in combination with the cross-chain behavior map, the verifiable behavior chain and the abnormal behavior, performing responsibility scoring on the deviation node; and determining a reputation score of each deviation node according to the responsibility score of each deviation node in multiple cross-chain transactions, and performing node governance according to the reputation score. According to the invention, the safety and reliability of the cross-chain system can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchains, and in particular to a method and device for identifying node abnormalities and evaluating reputations based on cross-chain behavior graphs. BACKGROUND

[0002] With the deep development of the digital economy, blockchain technology has been applied on a large scale in key fields such as digital governance, government collaboration, and supply chain finance, due to its decentralized and tamper-proof characteristics. In actual scenarios, the functionality and coverage of a single blockchain network are limited, and multi-chain collaboration has become an inevitable trend to meet complex business needs such as cross-institutional data sharing and cross-platform asset circulation. Cross-chain technology, as the core bridge connecting different blockchain networks, directly supports collaboration and value circulation between multiple chains and has become a key infrastructure for the development of the blockchain ecosystem.

[0003] However, existing multi-chain systems have significant differences in underlying architecture, and the transaction logic design, consensus mechanism, and communication protocol of different blockchains are naturally heterogeneous, resulting in multiple technical bottlenecks in the cross-chain interaction process, which seriously restricts the security and governability of cross-chain systems. Specifically, there is a lack of unified perception of node operations, behavior records are scattered and have different structures, making it difficult to form a complete audit link. After an abnormality occurs, it is difficult to trace back the behavior chain and identify the responsible node. It is also difficult to verify abnormalities such as fake operations, packet loss, or relay delays. Furthermore, there is a lack of reputation evaluation mechanisms based on behavior credibility, and the governance system lacks effective constraints and incentives for nodes.

[0004] In summary, the deficiencies of existing cross-chain technologies in behavior perception, abnormality tracing, security verification, and node governance directly result in a lack of effective protection of the security and reliability of cross-chain systems. SUMMARY

[0005] The present application provides a method and device for identifying node abnormalities and evaluating reputations based on cross-chain behavior graphs to solve the problem of a lack of effective protection of the security and reliability of cross-chain systems.

[0006] In a first aspect, the present application provides a method for identifying node abnormalities and evaluating reputations based on cross-chain behavior graphs, comprising: acquiring cross-chain behavior data on a blockchain network through a collection tool; constructing a cross-chain behavior graph based on the cross-chain behavior data, wherein the cross-chain behavior graph is used to indicate the node behavior operation trajectory in the whole process of cross-chain transactions; performing path analysis and node behavior consistency verification on the cross-chain behavior graph to locate deviating nodes and abnormal behaviors of the deviating nodes, wherein the deviating nodes are used to indicate suspicious behavior subjects; Taking the abnormal time sequence logical relationship in the cross-chain behavior graph as the core, a key operation sequence of the cross-chain transaction is extracted and a verifiable behavior chain is generated; In combination with the cross-chain behavior graph, the verifiable behavior chain and the abnormal behavior, a responsibility score of the deviation node is performed; A reputation score of the deviation node is determined according to the responsibility score of each deviation node in multiple cross-chain transactions, and node governance is performed according to the reputation score.

[0007] Optionally, collecting cross-chain behavior data on the blockchain network by the collection tool includes: By deploying an observer contract on the blockchain network, key events related to cross-chain transactions are listened to, wherein the key events include start point information of a source chain side initiation action, actual execution record of a target chain side, and return information of target chain side execution result to the source chain side; By deploying a collection component on the relay node side, link-in behaviors of the relay node side are parsed; The key events and the link-in behaviors are archived according to the preset requirements, and the preset cross-chain behavior attribute metadata is bound to form cross-chain behavior data in a unified format.

[0008] Optionally, constructing a cross-chain behavior graph according to the cross-chain behavior data includes: The cross-chain behavior data is parsed to determine entity nodes, behavior nodes and edges between nodes, wherein the entity nodes are used to indicate on-chain entities participating in cross-chain transactions, the behavior nodes are used to indicate behavior actions performed by the entity nodes, the edges are used to indicate time sequence logical relationships between the behavior actions, and node attributes are bound on the behavior nodes; The cross-chain behavior graph is constructed according to the entity nodes, the behavior nodes and the edges between nodes.

[0009] Optionally, path analysis and node behavior consistency verification are performed on the cross-chain behavior graph to locate deviation nodes and abnormal behaviors of the deviation nodes, including: In the case of abnormal cross-chain transactions, the node with an abnormal result in the cross-chain transaction is taken as an anchor point, the cross-chain behavior graph is traversed in reverse, the behavior full link of the cross-chain transaction is restored, and it is determined whether the cross-chain transaction is executed according to the expected full execution according to the behavior full link, and deviation nodes and abnormal behaviors of the deviation nodes are located according to the determination result; The multiple behavior nodes corresponding to the same cross-chain transaction in the cross-chain behavior graph are compared for behavior consistency to locate deviation nodes and abnormal behaviors of the deviation nodes, wherein the abnormal behaviors include behavior loss, process interruption and fake operation.

[0010] Optionally, based on the abnormal temporal logical relationships in the cross-chain behavior graph, the key operation sequences of cross-chain transactions are extracted and a verifiable behavior chain is generated, including: Based on the abnormal temporal logical relationships in the cross-chain behavior graph, the cross-chain operations of key nodes are sorted by dependency to generate a temporal execution chain for cross-chain transaction operations. Extract the node attributes during the execution process of each behavior node, and connect them in sequence according to the time-series execution chain to generate a structured certificate of the time-series execution chain; Each action node is bound to a signature and a signature verification mechanism to form a trustworthy structured credential; The trusted structured credentials are output according to a preset format to generate a standardized, verifiable chain of behaviors containing core node attributes.

[0011] Optionally, by combining the cross-chain behavior graph, the verifiable behavior chain, and the anomalous behavior, the responsibility scoring for the deviation node includes: Based on the cross-chain behavior graph and the verifiable behavior chain, the node attributes of the deviation nodes are verified, wherein verifying the node attributes is used to ensure the traceability of the verifiable behavior chain; After successful verification, a responsibility assessment function is constructed based on the behavior type of the abnormal behavior and the preset parameters of the deviation node. The responsibility score of the deviation node is evaluated using the aforementioned responsibility assessment function, wherein the responsibility score is used for arbitration to determine liability.

[0012] Optionally, the reputation score of the deviating node is determined based on the responsibility score of each deviating node in multiple cross-chain transactions, and node governance is performed based on the reputation score, including: By combining the responsibility scores and historical performance data of each deviation node in multiple cross-chain transactions, the reputation score of the deviation node is obtained. The reputation level of the deviation node is determined according to the reputation score; If the reputation level of the deviation node remains below the level threshold for a preset period of time, the deviation node will be managed according to a preset strategy.

[0013] Secondly, this application provides a node anomaly identification and reputation assessment device based on cross-chain behavior graphs, the device comprising: The data collection module is used to collect cross-chain behavioral data on the blockchain network using data collection tools. A construction module is used to construct a cross-chain behavior graph based on the cross-chain behavior data, wherein the cross-chain behavior graph is used to indicate the node behavior operation trajectory in the entire process of cross-chain transactions; The positioning module is used to perform path analysis and node behavior consistency verification on the cross-chain behavior graph, locate deviation nodes and the abnormal behavior of the deviation nodes, wherein the deviation nodes are used to indicate suspicious behavior entities; The generation module is used to extract the key operation sequence of cross-chain transactions and generate a verifiable behavior chain, with the abnormal temporal logic relationship in the cross-chain behavior graph as the core. The scoring module is used to score the responsibility of the deviation node by combining the cross-chain behavior graph, the verifiable behavior chain, and the abnormal behavior. The governance module is used to determine the reputation score of each deviation node based on its responsibility score in multiple cross-chain transactions, and to perform node governance based on the reputation score.

[0014] Thirdly, this application provides an electronic device, comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; and at least one memory connected to the at least one bus.

[0015] Fourthly, this application also provides a computer storage medium storing computer-executable instructions, which are used to execute the node anomaly identification and reputation assessment method based on cross-chain behavior graphs described in any of the above claims of this application.

[0016] Compared with existing technologies, the technical solution provided in this application has the following advantages: First, cross-chain behavior data is collected. Then, a cross-chain behavior graph is constructed based on the cross-chain behavior data, transforming scattered data into a visualized behavior chain, clearly presenting the entire cross-chain process node trajectory. Next, through path analysis and consistency verification, deviation nodes and abnormal behaviors are accurately located from the process and data dimensions, solving the problems of difficulty in anomaly tracing and ambiguity of responsibility nodes. Then, based on the abnormal temporal logical relationship in the cross-chain behavior graph, a verifiable behavior chain is generated, transforming abnormal behaviors into traceable and tamper-proof evidence. Combining the cross-chain behavior graph, verifiable behavior chain, and abnormal behaviors, the responsibility of deviation nodes is objectively quantified, avoiding subjective bias in assigning responsibility. Finally, based on multiple responsibility scores, when the reputation score is low, differentiated governance is implemented to constrain the risky behavior of low-reputation nodes. This application comprehensively solves the problems of weak observability, difficulty in anomaly tracing, insufficient security verification, and lack of node constraints in cross-chain systems, from data collection to governance closed loop, ultimately improving the security and reliability of cross-chain systems. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0020] Figure 1 A flowchart illustrating a node anomaly identification and reputation assessment method based on cross-chain behavior graphs, provided for embodiments of this application; Figure 2 A flowchart of a node anomaly identification and reputation assessment process based on cross-chain behavior graphs is provided for embodiments of this application; Figure 3 A schematic diagram of the structure of a node anomaly identification and reputation assessment device based on cross-chain behavior graph provided in this application embodiment; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0023] The following will describe in detail, with reference to specific implementation methods, a node anomaly identification and reputation assessment method based on cross-chain behavioral graphs provided in this application, taking its application to a server as an example, such as... Figure 1 As shown, the specific steps are as follows: Step 101: Collect cross-chain behavior data on the blockchain network using data collection tools; Step 102: Construct a cross-chain behavior graph based on cross-chain behavior data, whereby the cross-chain behavior graph is used to indicate the node behavior operation trajectory in the entire process of cross-chain transactions; Step 103: Perform path analysis and node behavior consistency verification on the cross-chain behavior graph to locate deviation nodes and their abnormal behavior. Deviation nodes are used to indicate suspicious entities. Step 104: Taking the abnormal temporal logical relationships in the cross-chain behavior graph as the core, extract the key operation sequence of cross-chain transactions and generate a verifiable behavior chain; Step 105: Combine cross-chain behavior graph, verifiable behavior chain, and anomalous behavior to assign responsibility to the deviation nodes; Step 106: Determine the reputation score of each deviation node based on its responsibility score in multiple cross-chain transactions, and conduct node governance based on the reputation score.

[0024] In step 101, in a multi-chain collaboration scenario, the server synchronously captures cross-chain transaction-related data using observer contracts deployed on various blockchain networks and data collection components on the relay node side. The observer contracts focus on key on-chain events, while the data collection components parse relay link behavior. Then, through unified archiving and attribute metadata binding, they form cross-chain behavior data with a unified format. This process covers the entire cross-chain process through dual-end data collection from both on-chain and relay nodes, avoiding the integration difficulties caused by data being scattered across different networks. It provides structurally sound and complete foundational data for subsequent cross-chain behavior graph construction and analysis, solving the problem of fragmented raw data in traditional cross-chain scenarios.

[0025] In step 102, the server parses the collected unified-format data, extracts the entity nodes participating in cross-chain transactions, the behaviors performed by the nodes, and the temporal logical relationships between the behaviors, and constructs a cross-chain behavior graph based on this. The cross-chain behavior graph transforms the originally linear and fragmented cross-chain data into a visualized behavioral chain, which can clearly indicate the node behavior operation trajectory in the entire process of cross-chain transactions, making the originally hidden cross-chain interaction process observable and traceable.

[0026] In step 103, when an anomaly occurs in a cross-chain transaction, the server uses two methods to troubleshoot the problem: on the one hand, it uses the abnormal result node as the anchor point to reverse the causal path of the cross-chain behavior graph to restore the entire chain of behavior and determine whether the process is complete; on the other hand, it compares the consistency of behavior of multiple nodes under the same cross-chain transaction to identify data or operation anomalies.

[0027] This dual verification method of path backtracking and node consistency comparison can identify anomalies from two dimensions: process integrity and node consistency. It can accurately locate deviation nodes (suspicious actors) and their abnormal behavior, greatly improving the accuracy of cross-chain anomaly identification and solving the problem of difficulty in locating responsible nodes after anomalies occur in traditional cross-chain scenarios.

[0028] In step 104, the server sorts the key nodes involved in the abnormal time sequence logical relationship based on the abnormal time sequence logical relationship in the cross-chain behavior graph, extracts the key operation sequence of cross-chain transactions as the time sequence execution chain, then integrates the node attributes to generate structured credentials, and then ensures the credibility of the credentials through signature binding and verification mechanisms, and finally outputs a standardized verifiable behavior chain.

[0029] Verifiable Behavior Chain transforms fragmented abnormal behavior data into structured and verifiable evidence through chronological sorting, certificate generation, signature anti-counterfeiting, and format standardization. It can not only clearly reconstruct the occurrence process of abnormal behavior, but also ensure the authenticity of data through signature verification mechanism, providing a reliable basis for subsequent cross-chain arbitration and liability determination, and filling the gap of lack of effective verification certificates for abnormal behavior in traditional cross-chain scenarios.

[0030] In step 105, the server, based on the behavioral association information of the cross-chain behavior graph and the reliable data of the verifiable behavior chain, first verifies the attributes of the deviation node to ensure the reliability of the scoring basis. Then, it constructs a responsibility assessment function by combining the anomaly type of the abnormal behavior and the preset parameters of the deviation node, and calculates the responsibility score of the deviation node. This responsibility score can be directly used for arbitration and determination of responsibility in cross-chain transactions. The responsibility score can objectively reflect the magnitude of the deviation node's responsibility in a single anomaly, avoiding the bias caused by subjective judgment in the traditional cross-chain responsibility determination process, making the determination of responsibility more fair and convincing.

[0031] In step 106, the server integrates the responsibility scores of deviating nodes in multiple cross-chain transactions, calculates reputation scores based on the historical performance data of these nodes, and classifies them into levels. Constraint policies are implemented for nodes with consistently low reputation, while incentives are provided for nodes with high reputation. This reputation assessment and governance model, based on historical responsibility accumulation and long-term level monitoring, can dynamically reflect the continuous behavioral performance of nodes. It can both constrain the risky behavior of low-reputation nodes through governance measures and guide the compliant operation of high-reputation nodes through incentive mechanisms, gradually improving the overall security and stability of the cross-chain network.

[0032] This application first collects cross-chain behavior data, then constructs a cross-chain behavior graph based on this data, transforming scattered data into a visualized behavioral chain, clearly presenting the entire cross-chain process node trajectory. Next, through path analysis and consistency verification, it accurately locates deviation nodes and abnormal behaviors from both process and data dimensions, solving the problems of difficult anomaly tracing and ambiguous responsibility nodes. Then, using the anomaly temporal logical relationships in the cross-chain behavior graph as the core, it generates a verifiable behavior chain, transforming abnormal behaviors into traceable and tamper-proof evidence. Combining the cross-chain behavior graph, verifiable behavior chain, and anomaly behavior, it objectively quantifies the responsibility of deviation nodes, avoiding subjective bias in assigning responsibility. Finally, based on multiple responsibility scoring, when a low reputation score is determined, differentiated governance is implemented to constrain the risky behavior of low-reputation nodes. This application, from data collection to governance closed loop, comprehensively addresses the problems of weak observability, difficulty in anomaly tracing, insufficient security verification, and lack of node constraints in cross-chain systems, ultimately improving the security and reliability of cross-chain systems.

[0033] As an optional implementation, in step 101, collecting cross-chain behavior data on the blockchain network using a data collection tool includes the following: Step S11: Listen to key events related to cross-chain transactions through observer contracts deployed on the blockchain network. Key events include the starting point information of the action initiated by the source chain, the actual execution record of the target chain, and the receipt information of returning the execution result of the target chain to the source chain. Step S12: Analyze the link relay behavior on the relay node side using the acquisition components deployed on the relay node side; Step S13: Archive key events and link relay behaviors according to preset requirements, and bind preset cross-chain behavior attribute metadata to form cross-chain behavior data in a unified format.

[0034] To achieve comprehensive awareness of node behavior throughout the entire cross-chain transaction process, the server deploys a targeted behavior collection mechanism in the multi-chain collaborative blockchain network to capture structured event data in the transaction execution path. The specific execution process is as follows.

[0035] In step S11, the server deploys a lightweight observer contract in each blockchain network participating in cross-chain interaction. This contract acts as an on-chain listening module, without intervening in the blockchain's native consensus process, focusing solely on real-time monitoring of key events directly related to cross-chain transactions. If a cross-chain transaction is initiated, the observer contract immediately captures the starting point information of the action initiated by the source chain, including the account identity of the transaction initiator, the corresponding transaction hash, and the target chain identifier, clarifying the source and basic information of the cross-chain request. If the cross-chain transaction is executed on the target chain, the observer contract records the actual execution record on the target chain, including details of the received contract call, execution result code, and state variable change data, reflecting the completion status of the transaction on the destination chain. If the cross-chain transaction enters the receipt stage, the observer contract also listens for receipt information returned from the target chain to the source chain, including state signature, execution digest comparison results, and consistency confirmation records, ensuring the traceability of the receipt process. These key events are all recorded in real time in the on-chain event log by the observer contract in a standard format, avoiding difficulties in subsequent data integration due to chaotic log formats, and providing standardized on-chain data support for the server to carry out cross-chain behavior analysis and verification.

[0036] In step S12, considering that relay nodes are the core hubs for cross-chain message transmission, relying solely on on-chain listening cannot fully capture the message flow data in the relay process. Therefore, the server deploys a collection component (such as a Relay Adapter) on all cross-chain relay nodes. This collection component works in conjunction with the message sending and receiving modules of the relay nodes. When a relay node receives a cross-chain message sent from the source chain, the collection component parses the message structure and extracts data such as the signature, hash, and reception time. When a relay node forwards a message to the target chain or sends a result back to the source chain, the collection component synchronously records key information about the relay behavior, such as the forwarding time, message digest hash, and node signature content.

[0037] In step S13, after the server completes the key event listening and link relay behavior parsing, it will centrally archive and establish a relationship between the two types of data according to preset requirements, such as using the cross-chain transaction ID as the core index or arranging them in timestamp order. If the server needs to verify the process of a certain cross-chain message later, it can quickly match the source chain initiation information, relay flow data, target chain execution record, and source chain receipt information through the transaction ID.

[0038] Meanwhile, to ensure data identifiability and subsequent analysis efficiency, the server binds pre-defined cross-chain behavioral attribute metadata to each archived dataset, including event type (such as relay execution receipt), chain identifier, behavioral node identity, and operation context summary. By binding key events and relay behaviors to cross-chain behavioral attribute metadata, the previously scattered data on the chain and relay nodes is ultimately integrated by the server into cross-chain behavioral data in a unified format, such as a structured cross-chain behavioral event log set, solving the problems of diverse data sources, heterogeneous formats, and difficulty in integration in traditional cross-chain scenarios.

[0039] In this application, the server captures key on-chain events such as source chain initiation, relay node relay behavior, target chain execution, and source chain receipts, improving the completeness of cross-chain behavior data collection. The server archives data in transaction ID or timestamp order and binds it to unified cross-chain behavior attribute metadata. This not only solves the problem of disorganized traditional cross-chain data formats but also establishes a correlation between data at each stage and the attribute metadata. During subsequent analysis, the server can quickly trace the complete data chain of a specific cross-chain transaction without incurring additional costs to integrate scattered data, thus improving the efficiency of cross-chain behavior analysis. During data collection, the server simultaneously acquires signatures, hashes, and execution result codes. If subsequent verification of the authenticity of cross-chain behavior is required, the server can directly verify it using the collected signatures and hashes, providing data support for the credibility of cross-chain behavior and helping to solve the problem of difficult behavior verification in cross-chain scenarios.

[0040] As an optional implementation, in step 102, constructing a cross-chain behavior graph based on cross-chain behavior data includes the following: Step S21: Parse the cross-chain behavior data to determine entity nodes, behavior nodes and edges between nodes. Entity nodes are used to indicate the on-chain entities participating in cross-chain transactions, behavior nodes are used to indicate the behavior actions performed by entity nodes, edges are used to indicate the temporal logical relationship between behavior actions, and node attributes are bound to behavior nodes. Step S22: Construct a cross-chain behavior graph based on entity nodes, behavior nodes, and the edges between nodes.

[0041] To clearly present the operational relationships and node interaction characteristics of the entire cross-chain transaction process, the server constructs a Cross-chain Behavior Graph (CBG) based on the collected cross-chain behavior data. The specific execution process is as follows.

[0042] In step S21, the server first performs structured parsing on the unified format cross-chain behavior data, extracting the core elements involved in the cross-chain operation from the data: First, it identifies entity nodes, which indicate the on-chain entities participating in the cross-chain transaction. These include the initiating account of the cross-chain transaction, the relay module responsible for message passing, and the contract execution node that performs the operation on the target chain. Each entity node has a unique identifier (such as account address, module ID) to ensure accurate identification of the operation subject later. Next, it extracts behavior nodes, which indicate the actions performed by entity nodes, such as initiating transactions, forwarding messages, and executing calls. Each behavior node is also bound with basic information such as a timestamp, its chain identifier (chain ID), and a summary of the operation content. Additional auxiliary node attributes such as operation credentials (such as signature digest, hash value), response time, and status code are also bound to these nodes, providing key data for subsequent verification and analysis. Finally, based on the temporal dependencies and causal logic between node behaviors, the edges between nodes are determined. These edges are used to indicate the temporal logical relationship between actions. Common relationships include initiation, relay, execution, and receipt. The server will also attach attributes such as delay time and confirmation relationship between actions to the edges to clarify the order and dependency of action nodes and ensure that the edge relationship can accurately reflect the flow logic of cross-chain transactions.

[0043] In step S22, based on the determination of entity nodes, behavior nodes, and edges, the server activates the graph construction module to integrate entity nodes, behavior nodes, and edges into a visualized cross-chain behavior graph. For example, in a cross-chain transaction, the initiating account (entity node) corresponds to the initiating transaction (behavior node). This behavior node is connected to the relay module (entity node)'s forwarding message (behavior node) through an edge marked with a 1.2s delay. The forwarding message (behavior node) is then connected to the contract execution node (entity node)'s execution call (behavior node) through an edge marked with confirmation, ultimately forming a complete transaction chain.

[0044] Meanwhile, the cross-chain behavior graph is updatable in real time. When a new cross-chain transaction occurs, the server will automatically parse the behavior data of the new transaction, add corresponding entity nodes, behavior nodes and edge relationships, dynamically expand the coverage of the cross-chain behavior graph, and gradually build a panoramic view of behavior and entity operation trajectory in the multi-chain environment, so as to realize the continuous recording and presentation of cross-chain ecosystem behavior.

[0045] This application utilizes a graph modeling approach based on entities, behaviors, and edges. The server transforms the originally linear and fragmented cross-chain data into an intuitive link structure, making the entire process of cross-chain transactions—from initiation and relay to execution feedback—clearly visible. This facilitates rapid tracing of the operational trajectory of any node, solving the problems of hidden behavior and ambiguous links in traditional cross-chain scenarios. Furthermore, the node attributes such as the operation credentials (signature digest, hash value), response time, and status code bound to the behavior node, as well as the information attached to the edges, such as latency and confirmation relationships, can directly serve as key evidence for subsequent anomaly verification. For example, by comparing whether the response time exceeds a normal threshold and whether the signature digest matches, it is possible to quickly determine whether the behavior is abnormal; edge relationships can help locate broken links in the process, laying the foundation for accurately identifying deviation nodes.

[0046] As an optional implementation, in step 103, path analysis and node behavior consistency verification are performed on the cross-chain behavior graph to locate deviation nodes and their abnormal behaviors, including the following: Step S31: In the event of an anomaly in a cross-chain transaction, take the node in the cross-chain transaction that has an abnormal result as the anchor point, traverse the causal path in the cross-chain behavior graph in reverse, restore the entire behavior chain of the cross-chain transaction, and determine whether the cross-chain transaction was executed completely as expected based on the entire behavior chain. Based on the judgment result, locate the deviation node and the abnormal behavior of the deviation node. Step S32: Perform a behavior consistency comparison on multiple behavior nodes corresponding to the same cross-chain transaction in the cross-chain behavior graph, locate the deviation nodes and the abnormal behavior of the deviation nodes, where abnormal behavior includes behavior missing, process interruption and forgery operation.

[0047] To accurately locate suspicious entities and abnormal operations during the cross-chain process, the server conducts dual verification based on the constructed cross-chain behavior graph through path analysis algorithms and node behavior consistency verification mechanisms. The specific execution process is as follows.

[0048] In step S31, when an abnormal feedback occurs in a cross-chain transaction (such as the source chain not receiving the execution receipt from the target chain, or the execution result not matching expectations), the server uses the node in the cross-chain transaction where the abnormal result occurred as the anchor point (e.g., the contract execution node that failed to execute on the target chain side, or the initiating account node that did not receive the receipt on the source chain side) to initiate a path analysis algorithm to traverse the causal path in the cross-chain behavior graph in reverse. Starting from the abnormal node, it traces its preceding associated behavior nodes and entity nodes in sequence, gradually reconstructing the entire behavioral chain of the cross-chain transaction from initiation, relay to the occurrence of the abnormality (e.g., the complete operation trajectory of the initiating account, relay module, and target chain contract execution node). The server will compare the restored behavior chain with the preset normal execution process (such as initiation, relay verification, target chain execution, and receipt feedback) to determine whether the transaction was executed completely as expected. If a missing link is found in the chain (such as the relay module not generating a forwarding message behavior node) or the operation order is disordered (such as receipt feedback being executed before the target chain), the corresponding deviation node (such as the relay module that did not forward the message) will be located based on these process deviations, and the abnormal behavior of the node (such as failure to forward on time) will be recorded.

[0049] In step S32, the server initiates a node behavior consistency verification mechanism to conduct horizontal comparison analysis for multiple behavior nodes corresponding to the same cross-chain transaction in the cross-chain behavior graph (such as the behavior records of the source chain initiating node, relay forwarding node, and target chain execution node under the same cross-chain transaction). This includes, but is not limited to: verifying event hash matching, comparing whether the hash values ​​of the same transaction recorded by different nodes are consistent (e.g., whether the hash of the message forwarded by the relay node is the same as the hash of the message initiated by the source chain); verifying signature validity, checking whether the signature digest in the operation credentials of each behavior node matches the node identity and whether it passes the legality verification; and confirming state consistency, comparing whether the transaction execution result code, state variable changes, and other data in the target chain execution record and the receipt information received by the source chain are consistent.

[0050] Through the above consistency checks, the server can accurately identify abnormal behavior, which includes the following: If the hash does not match or the signature is invalid, it is determined that a forgery operation has occurred; if a behavior node in a certain step is not shown in the cross-chain behavior graph, it is determined that a behavior is missing; if the state data is inconsistent and there is no reasonable reason, it is determined that the process has been interrupted. The server marks nodes exhibiting these abnormal behaviors as deviation nodes.

[0051] Through dual verification, the server can comprehensively identify typical abnormal behavior patterns in the cross-chain process, including but not limited to relay nodes failing to forward on time or signature mismatch, inconsistencies between the target chain status record and feedback receipt, and missing key operation credentials such as signatures, hashes, and execution logs for certain behaviors. All identified deviation nodes (suspicious actors) and their abnormal behavior information will be uniformly stored and archived by the server, providing accurate abnormal basis for subsequent responsibility assessment and reputation scoring.

[0052] In this application, the dual mechanism of path backtracking and consistency comparison not only investigates anomalies caused by broken links and disordered sequences from the perspective of process integrity, but also identifies forgery operations caused by hash mismatch and invalid signatures from the perspective of data authenticity. It covers the main types of cross-chain anomalies, avoids the limitations of a single verification method, and solves the problem of one-sided and easy omission in anomaly location in traditional cross-chain scenarios.

[0053] Furthermore, relying on the visualized links and structured data of the cross-chain behavior graph, the server does not need to manually sort through the scattered cross-chain logs. The algorithm can automatically complete path backtracking and consistency verification, quickly locate deviation nodes and abnormal behaviors, significantly shorten the investigation cycle of cross-chain anomalies, and reduce the operation and maintenance and traceability costs of the cross-chain system.

[0054] As an optional implementation, in step 104, based on the abnormal temporal logical relationships in the cross-chain behavior graph, the key operation sequences of cross-chain transactions are extracted and a verifiable behavior chain is generated, including the following: Step S41: Taking the abnormal temporal logical relationship in the cross-chain behavior graph as the core, perform dependency sorting on the cross-chain operations of key nodes to generate the temporal execution chain of cross-chain transaction operations; Step S42: Extract the node attributes during the execution process of each behavior node, and connect them in sequence according to the execution chain to generate a structured certificate of the execution chain. Step S43: Bind a signature and signature verification mechanism to the operation of each action node to form a trustworthy structured credential; Step S44: Output the trusted structured credentials in a preset format to generate a standardized, verifiable chain of behaviors containing core node attributes.

[0055] After identifying the deviation node, the server uses the abnormal temporal logical relationship in the cross-chain behavior graph as the core and generates a standardized Verifiable Behavior Chain (VBC) through multi-stage processing. The specific execution process is as follows.

[0056] In step S41, the server focuses on the temporal logical relationships corresponding to abnormal behaviors in the cross-chain behavior graph, and performs dependency sorting on the cross-chain operations of key nodes associated with the abnormal behaviors. Combining the causal relationships and timestamp information between nodes, it eliminates interference from branch operations and asynchronous interactions during the cross-chain process, and sorts out a clear sequence of transaction operations according to the transaction flow logic of initiation, relay, execution, and feedback, ultimately constructing a temporal execution chain for cross-chain transaction operations. This execution chain completely includes the sequential operation records of each key node from the initiation of the abnormal behavior to the feedback, such as the complete chain of the initiating account initiating the transaction, the relay module forwarding the message, the target chain contract execution node executing the operation, and the relay module feeding back the execution result, ensuring that subsequent credential integration has a clear temporal framework.

[0057] In step S42, the server extracts node attributes from the execution process of each behavior node in the time-series execution chain. These node attributes include key information such as operation content (e.g., transaction amount, contract address), signature information (e.g., node signature digest), message digest hash (e.g., transaction hash value), and block height (e.g., the on-chain block number when the behavior occurred). Then, these attribute information are sequentially linked and integrated according to the order of the time-series execution chain to form a structured credential corresponding to the time-series execution chain. This credential is presented in a composite format of behavior log + encrypted credentials + time stamp, recording both the specific content of the behavior operation and including encrypted information and time anchors to ensure data trustworthiness, avoiding fragmentation or missing credential information.

[0058] In step S43, to prevent the structured certificate from being tampered with or forged, the server binds the original signature of the corresponding node (such as the relay node's private key signature or the contract execution node's signature) to the operation of each action node in the time-series execution chain, and embeds a preset signature verification mechanism (such as a public key signature verification algorithm and hash comparison logic). If subsequent verification of the certificate's authenticity is required, the signature verification mechanism can quickly verify the signature's validity and data integrity. For example, the node's public key can be used to verify the signature's legitimacy, and the hash value can be compared to determine if the data has been modified. Through this process, ordinary structured certificates are upgraded to trusted structured certificates, ensuring their non-repudiation.

[0059] In step S44, the server standardizes the trustworthy structured credentials according to predefined format specifications (such as field order, data format, and encoding method), outputting a standardized behavior proof package containing core node attributes. The core node attributes specifically include node ID (such as the initiating account address and relay node number), behavior summary (such as a brief description of the transaction forwarding message), timestamp (such as the precise time the behavior occurred), and signature value (such as the node's original signature data). These standardized behavior proof packages are combined in an orderly manner to ultimately form a standardized, verifiable behavior chain, which can be directly used as the basic evidence for cross-chain arbitration, transaction replay, and liability determination.

[0060] In this application, the generation process of the verifiable behavior chain is achieved by constructing a time-series execution chain to clearly present the abnormal transaction flow. Combined with structured credentials to integrate key operational attributes, and further secured by signature binding and verification mechanisms to ensure data immutability and non-repudiation, the final output is a standardized proof package containing core node attributes. This solves the problems of chaotic formats and low credibility of traditional cross-chain abnormal evidence, forming a unified and non-repudiable evidence carrier. It also supports rapid replay of the abnormal transaction execution process and verification of the authenticity of each stage of the behavior, significantly improving the traceability and verifiability of cross-chain transactions. Simultaneously, the key information it contains, such as node IDs and signature values, can clearly identify the subject of abnormal behavior execution and eliminate disputes over data tampering. This provides an objective and undisputed basis for scoring the responsibility of deviation nodes and cross-chain node governance, effectively filling the gap in the standardization and credibility of abnormal evidence in cross-chain scenarios, and laying a solid evidentiary foundation for cross-chain arbitration, responsibility determination, and governance analysis.

[0061] As an optional implementation, in step 105, the responsibility scoring of the deviation node, combining the cross-chain behavior graph, verifiable behavior chain, and anomalous behavior, includes the following: Step S51: Based on the cross-chain behavior graph and verifiable behavior chain, verify the node attributes of the deviation nodes; Step S52: After verification, construct a responsibility assessment function based on the behavior type of the abnormal behavior and the preset parameters of the deviation node; Step S53: Use the responsibility assessment function to evaluate the responsibility score of the deviation node, where the responsibility score is used for arbitration to determine responsibility.

[0062] To ensure that the responsibility assessment of cross-chain abnormal nodes is objective and credible, and that the results can be used for arbitration and governance, the server conducts deviation node responsibility scoring through a three-step process of verification, modeling, and quantification after completing the cross-chain behavior graph backtracking and verifiable behavior chain extraction. At the same time, it supports the participation of third-party regulators or arbitrators in independence verification. The specific execution process is as follows.

[0063] In step S51, the server performs structured verification of the node attributes of the deviation nodes based on the link relationships in the cross-chain behavior graph and the structured data of the verifiable behavior chain. On one hand, it verifies the legality of the signature in the node attributes (e.g., verifying whether the deviation node's signature matches its identity using a public key) and the consistency of the message digest hash (e.g., comparing whether the transaction hash recorded by the deviation node is the same as that of other nodes), ensuring that the attribute data has not been tampered with. On the other hand, it verifies the reasonableness of the deviation node's association in the cross-chain link by combining the path logic in the cross-chain behavior graph, ensuring the integrity of the verifiable behavior chain's path. Through this verification process, the authenticity of the node attributes is ensured, a reliable data foundation is provided for subsequent liability assessment, and the need for independent verification of the transaction process by third-party regulatory nodes or arbitrators is met, ultimately achieving the non-repudiation and traceability of the verifiable behavior chain.

[0064] In step S52, after verification, the server first identifies the abnormal behavior type corresponding to the deviation node (such as relay packet loss, forged signature, process interruption, etc.), and assigns differentiated weights to different types of anomalies (such as forged signatures having a greater impact on cross-chain security and a higher weight than relay packet loss); then it extracts the preset parameters of the deviation node, including the structural centrality of the node in the cross-chain behavior graph (such as the difference in responsibility weight between core relay nodes and ordinary execution nodes), the timeliness of behavior (such as whether the response delay exceeds the preset threshold), etc., and integrates these parameters with the anomaly type to construct a multi-dimensional responsibility assessment function to ensure that the assessment logic covers key dimensions such as the impact of anomalies and the role of nodes, and avoids scoring bias caused by a single factor.

[0065] In step S53, the server substitutes the specific data of the deviation node (such as the weight value corresponding to the anomaly type of forged signature, the node structure centrality coefficient, etc.) into the responsibility assessment function to calculate the responsibility score of the deviation node (the score range is set to 0~1, where 0 represents no responsibility, intermediate values ​​such as 0.1, 0.2, 0.3, 0.4 represent the proportion of responsibility, and 1 represents full responsibility). Based on a preset threshold, the score is divided into three responsibility levels: severe, moderate, and minor. The server synchronously records the responsibility score and level in the deviation node's behavior profile, forming a standardized responsibility assessment report. This report can be directly used for arbitration and responsibility determination in cross-chain transactions, and can also serve as a reference for compliance record archiving or consortium blockchain governance. It also supports third-party arbitrators in retrieving the report for independent review.

[0066] This application employs a process that ensures data credibility through structured verification, guarantees objective assessment through multi-parameter modeling, and quantifies and clearly defines the level of responsibility. This approach not only addresses the issues of unreliable evidence and subjective assessment in traditional cross-chain responsibility determination, making responsibility scoring traceable and persuasive, but also provides a unified basis for arbitration, compliance, and governance through standardized assessment reports. Furthermore, it supports third-party verification, further enhancing the credibility of responsibility assessments. In addition, recording responsibility results in node behavior archives accumulates historical data for subsequent node reputation scoring, forming a closed-loop support system for anomaly identification, responsibility assessment, and reputation management, thus helping cross-chain systems establish a more comprehensive node control system.

[0067] As an optional implementation, in step 106, the reputation score of each deviating node is determined based on its responsibility score in multiple cross-chain transactions, and node governance is performed based on the reputation score, including the following: Step S61: Combine the responsibility scores and historical performance data of each deviation node in multiple cross-chain transactions to obtain the reputation score of the deviation node; Step S62: Determine the credit rating of the deviation node based on the credit score; Step S63: If the reputation level of the deviation node remains below the level threshold for a preset period of time, the deviation node shall be governed according to the preset strategy.

[0068] In step S61, the server retrieves the responsibility score records of each deviating node in multiple cross-chain transactions, and simultaneously collects the node's historical performance data, including indicators such as response latency, anomaly frequency, and operation success rate of cross-chain operations. This data is weighted and integrated according to preset weighting rules, and a reputation score for the deviating node is obtained through quantitative calculation. The reputation score comprehensively reflects the credibility of the deviating node's long-term cross-chain behavior, avoiding the bias caused by relying solely on a single responsibility score, and ensuring that the reputation assessment objectively reflects the node's continuous performance.

[0069] In step S62, the server classifies the reputation scores of the deviating nodes into different reputation levels according to preset scoring interval thresholds. For example, these levels include four categories: trustworthy, good, observation period, and untrustworthy. These different reputation levels not only provide a direct indicator of the trustworthiness of node behavior but also serve as an important basis for internal access control within the cross-chain system (such as whether participation in core transactions is permitted) and path selection (such as prioritizing high-reputation nodes for message forwarding), providing clear grading standards for subsequent differentiated governance.

[0070] In step S63, the server monitors the reputation level changes of deviation nodes in real time. If the reputation level of a deviation node remains below the level threshold (i.e., below the observation period, i.e., untrustworthy) for a preset period of time (e.g., 30 consecutive days), a preset governance mechanism is triggered to govern the node according to a preset strategy. Common strategies include rate limiting (limiting the frequency of nodes participating in cross-chain transactions), relay demotion (reducing the priority of nodes in cross-chain message forwarding), and task isolation (assigning only low-importance cross-chain tasks). In severe cases, a ban can be implemented (prohibiting nodes from participating in any cross-chain operations). Conversely, for high-reputation nodes with good trust levels, the server implements incentive strategies, such as prioritizing the scheduling of cross-chain tasks, allowing them to join cross-chain governance protocols, and granting them more system permissions and participation opportunities.

[0071] In this application, a reputation score is first calculated using multi-dimensional data weighting, then node credibility is clarified through level classification, and finally a differentiated strategy is implemented. This process of long-term monitoring and differentiated strategies to achieve dynamic governance not only solves the problem of traditional cross-chain systems lacking long-term evaluation and effective constraints on nodes, upgrading node governance from single-anomaly handling to long-term dynamic management, but also guides nodes to regulate cross-chain behavior by incentivizing high-reputation nodes and constraining low-reputation nodes, gradually improving the overall security and stability of the cross-chain network. At the same time, the reputation level, as the basis for access control and path selection, can also optimize the execution efficiency of cross-chain transactions and reduce the anomaly risks caused by low-reputation nodes, thus building a closed-loop management system for evaluation, classification, governance, and optimization of the cross-chain system.

[0072] This application provides a flowchart for node anomaly identification and reputation assessment based on cross-chain behavioral graphs, including the following steps: Figure 2 As shown.

[0073] I. Cross-chain behavior data collection.

[0074] Deploy data acquisition tools: Deploy observer contracts and relay adapters in the cross-chain system. Observer contracts are responsible for listening to on-chain transaction events, while relay adapters are used to capture the flow data of cross-chain messages in the relay stage.

[0075] Collect cross-chain transaction data: With the help of the deployed observer contract and relay adapter, collect transaction data from each stage of cross-chain transactions, from initiation and relay to execution, including transaction initiator information, relay node operation records, target chain execution results, etc.

[0076] Output standardized cross-chain behavior event logs: Process the collected raw data and output standardized cross-chain behavior event logs in a unified format to provide basic data for subsequent cross-chain behavior graph construction.

[0077] II. Construction of Cross-Chain Behavior Graph

[0078] Constructing the initial graph: Building a prototype of the cross-chain behavior graph.

[0079] Mapping Entities, Behaviors, and Edge Relationships: Based on standardized cross-chain behavior event logs, extract entity nodes (such as transaction initiating accounts, relay nodes, contract addresses, etc.), behavior nodes (such as initiating transactions, forwarding messages, executing contracts, etc.), and relationships between behaviors (such as the association between initiator and relay, the association between relay and execution, etc.).

[0080] Forming a Cross-Chain Behavior Graph (CBG): After the above steps, a complete cross-chain behavior graph is finally formed, which can clearly show the behavior and interrelationships of each node in cross-chain transactions.

[0081] III. Behavioral source analysis and anomaly identification.

[0082] Anomaly feedback trigger: When an anomaly occurs in the cross-chain system (such as transaction execution failure, data inconsistency, etc.), the anomaly feedback mechanism is triggered.

[0083] Conduct graph path backtracking analysis and node consistency verification: Based on the cross-chain behavior graph (CBG), backtracking analysis is performed on graph paths related to anomalies, while verifying the consistency of node data to investigate whether there are any issues with node data tampering or inconsistency.

[0084] Abnormal behavior identification: Abnormal behavior in cross-chain transactions is identified through graph path backtracking analysis and node consistency verification.

[0085] Mark deviation nodes: After identifying abnormal behavior, mark the deviation nodes that caused the abnormality and clarify the relevant clues of the responsible party for the abnormality.

[0086] IV. Generation of verifiable behavioral chains.

[0087] Constructing a time-series execution chain: Based on the temporal logical relationship of abnormal behaviors in the Cross-Chain Behavior Graph (CBG), the cross-chain operations of key nodes are ordered by dependency, eliminating interference from branching and asynchronous interleaving, and constructing a time-series execution chain that includes the sequential operation records of key nodes such as initiation, relay, execution, and feedback.

[0088] Sequential reconstruction of key node operations: Reconstruct the operation process of key nodes such as initiation, relay, execution, and feedback according to the constructed time-series execution chain.

[0089] Certificate structure integration: Extract the operation content, signature information, message digest hash and block height of each behavior node during execution, and generate a structured multi-segment certificate consisting of behavior log, encrypted credentials and time stamp according to the execution chain relationship.

[0090] Signature binding verification: The operation of each behavior node is bound to its original signature and signature verification mechanism to prevent the behavior chain from being tampered with or forged, forming a responsibility certificate that can be verified by a third party.

[0091] Standardized Output Verifiable Behavior Chain (VBC): Outputs a standardized behavior proof package containing fields such as node ID, behavior digest, timestamp, and signature value in a predefined format, generating a standardized verifiable behavior chain.

[0092] V. Responsibility Assessment and Governance Feedback.

[0093] Verify the validity of the Cross-Chain Behavior Graph (CBG) and Verifiable Behavior Chain (VBC): Verify the validity of the Cross-Chain Behavior Graph (CBG) and Verifiable Behavior Chain (VBC) to ensure their reliability in areas such as anomaly tracing and liability determination.

[0094] Building a reputation model: By combining the responsibility scores and historical performance data of each deviation node in multiple cross-chain transactions, a node reputation model is constructed, and the node's reputation score is calculated.

[0095] Rating system: Nodes are classified into different levels such as trustworthy, good, observation period, and untrustworthy based on their reputation scores.

[0096] Governance strategy implementation: If the reputation level of a deviation node remains below the level threshold for a preset period of time, governance operations such as rate limiting, relay demotion, task isolation, or banning will be carried out according to the preset strategy; for high-reputation nodes, incentive measures such as priority scheduling and allowing them to join the governance agreement will be implemented.

[0097] This application can achieve the following beneficial effects.

[0098] (1) Full-process trusted modeling and anomaly tracing: By deploying on-chain observer contracts and relay adapters, the original behavioral data of cross-chain transactions from initiation, relay to execution feedback are collected comprehensively, and a cross-chain behavior graph is constructed based on entities, behaviors, and edge relationships. The cross-chain behavior graph can completely restore the node operation trajectory of the entire transaction process and clearly present the causal path between behaviors. When an anomaly occurs in a cross-chain transaction, the responsible node can be quickly located by using the abnormal node as the anchor point. It effectively solves the problems of incomplete behavior chains caused by the dispersion of behavioral data and the fragmentation of transaction links in the existing cross-chain system, as well as the pain points of difficulty in tracing the root cause and the ambiguity of the responsible party after an anomaly occurs, providing a trusted visual analysis carrier for cross-chain transaction auditing and anomaly handling.

[0099] (2) Standardized generation of verifiable behavioral credentials: For abnormal causal paths in the cross-chain behavior graph, the operation sequences of key nodes are extracted, and the scattered operation data are structured into verifiable behavioral chains through temporal sorting and attribute integration; at the same time, the original node signature, accurate timestamp, and message encrypted digest are integrated to form a trusted behavioral credential with a unified standard format. The credential contains complete verification information, and third parties can independently verify the authenticity of the data through signature verification and hash comparison without relying on the endorsement of a single node. This process not only improves the data transparency of the cross-chain system, making node operations verifiable and traceable, but also provides standardized evidence support for cross-chain arbitration and liability determination, further strengthening the governance capabilities of the cross-chain system and filling the gap in the lack of a unified format and insufficient credibility of abnormal evidence in the existing technology.

[0100] (3) Dynamic Reputation Assessment and Governance Linkage: Based on the responsibility scores of nodes in multiple cross-chain transactions, combined with historical performance data such as response latency, anomaly frequency, and operation success rate, a quantitative reputation system is constructed through weighted scoring, and nodes are divided into different levels according to the scores; at the same time, a linkage mechanism between reputation and governance is established. High-reputation nodes can obtain incentives such as priority scheduling and participation in cross-chain governance, while low-reputation nodes, if they remain below the level threshold for a preset period of time, will trigger automated governance strategies such as rate limiting, relay demotion, and banning. This can realize a closed loop of cross-chain operation and maintenance where behavior affects reputation and reputation drives governance, which not only solves the problem of the lack of long-term evaluation and effective constraints on nodes in existing cross-chain systems, but also enhances the system's adaptive control capability for risky nodes through dynamic governance, and continuously improves the security and stability of the cross-chain network.

[0101] This application provides a node anomaly identification and reputation assessment device based on cross-chain behavioral graphs, such as... Figure 3 As shown, the device includes: The data acquisition module 301 is used to collect cross-chain behavior data on the blockchain network through the data acquisition tool; Module 302 is used to construct a cross-chain behavior graph based on cross-chain behavior data. The cross-chain behavior graph is used to indicate the node behavior operation trajectory in the entire process of cross-chain transactions. The positioning module 303 is used to perform path analysis and node behavior consistency verification on the cross-chain behavior graph, locate deviation nodes and abnormal behavior of deviation nodes, wherein deviation nodes are used to indicate suspicious behavior entities. The generation module 304 is used to extract the key operation sequence of cross-chain transactions and generate a verifiable behavior chain, with the abnormal temporal logical relationship in the cross-chain behavior graph as the core. The scoring module 305 is used to score the responsibility of deviation nodes by combining cross-chain behavior graphs, verifiable behavior chains, and abnormal behaviors. The governance module 306 is used to determine the reputation score of each deviation node based on its responsibility score in multiple cross-chain transactions, and to perform node governance based on the reputation score.

[0102] Optionally, the acquisition module 301 is used for: By deploying observer contracts on the blockchain network, key events related to cross-chain transactions are monitored. These key events include the starting point information of the action initiated by the source chain, the actual execution record of the target chain, and the receipt information of returning the execution result of the target chain to the source chain. By deploying acquisition components on the relay node side, the link relay behavior on the relay node side is analyzed; Key events and relay behaviors are archived according to preset requirements and bound to preset cross-chain behavior attribute metadata to form cross-chain behavior data in a unified format.

[0103] Optionally, the building module 302 is used for: Parse cross-chain behavior data to determine entity nodes, behavior nodes, and edges between nodes. Entity nodes are used to indicate on-chain entities participating in cross-chain transactions, behavior nodes are used to indicate the behavior actions performed by entity nodes, edges are used to indicate the temporal logical relationship between behavior actions, and node attributes are bound to behavior nodes. Construct a cross-chain behavior graph based on entity nodes, behavior nodes, and the edges between nodes.

[0104] Optionally, the positioning module 303 is used for: In the event of an anomaly in a cross-chain transaction, the node in the cross-chain transaction that has an abnormal result is used as the anchor point. The causal path in the cross-chain behavior graph is traversed in reverse to restore the entire behavior chain of the cross-chain transaction. Based on the entire behavior chain, it is determined whether the cross-chain transaction was executed completely as expected. Based on the determination result, the deviation node and the abnormal behavior of the deviation node are located. For multiple behavior nodes corresponding to the same cross-chain transaction in the cross-chain behavior graph, behavior consistency comparison is performed to locate deviation nodes and abnormal behaviors of deviation nodes. Abnormal behaviors include missing behaviors, process interruption, and forged operations.

[0105] Optionally, the generation module 304 is used for: Based on the abnormal temporal logical relationships in the cross-chain behavior graph, the cross-chain operations of key nodes are sorted by dependency to generate a temporal execution chain for cross-chain transaction operations. Extract the node attributes during the execution process of each behavior node, and connect them in sequence according to the execution chain to generate a structured certificate of the execution chain. Each action node's operation is bound to a signature and a signature verification mechanism to form a trustworthy structured credential; The trusted structured credentials are output in a preset format to generate a standardized and verifiable chain of behaviors containing core node attributes.

[0106] Optionally, the scoring module 305 is used for: Based on cross-chain behavior graphs and verifiable behavior chains, verify the node attributes of deviation nodes; After successful verification, a responsibility assessment function is constructed based on the behavior type of the abnormal behavior and the preset parameters of the deviation node. A responsibility assessment function is used to evaluate the responsibility score of deviation nodes, where the responsibility score is used for arbitration to determine liability.

[0107] Optionally, the governance module 306 is used for: By combining the responsibility scores and historical performance data of each deviation node in multiple cross-chain transactions, a reputation score for the deviation node is obtained. The credit rating of the deviation node is determined based on the credit score; If the reputation level of a deviation node remains below the level threshold for a preset period of time, the deviation node will be managed according to the preset strategy.

[0108] like Figure 4 As shown, this application provides an electronic device including a processor 401, a communication interface 402, a memory 403, and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404.

[0109] Memory 403 is used to store computer programs.

[0110] In one embodiment of this application, when the processor 401 executes the program stored in the memory 403, it implements the node anomaly identification and reputation assessment method based on cross-chain behavior graph provided in any of the foregoing method embodiments.

[0111] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the node anomaly identification and reputation assessment method based on cross-chain behavior graphs provided in any of the foregoing method embodiments.

[0112] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0113] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0114] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0115] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for node anomaly identification and reputation assessment based on cross-chain behavioral graphs, characterized in that, The method includes: Collect cross-chain behavior data on the blockchain network using data collection tools; A cross-chain behavior graph is constructed based on the cross-chain behavior data, wherein the cross-chain behavior graph is used to indicate the node behavior operation trajectory in the entire process of cross-chain transactions; The cross-chain behavior graph is subjected to path analysis and node behavior consistency verification to locate deviation nodes and their abnormal behavior. The deviation nodes are used to indicate suspicious entities. Based on the abnormal temporal logical relationships in the cross-chain behavior graph, the key operation sequences of cross-chain transactions are extracted and a verifiable behavior chain is generated. By combining the cross-chain behavior graph, the verifiable behavior chain, and the abnormal behavior, a responsibility score is assigned to the deviation node. The reputation score of each deviation node is determined based on its responsibility score in multiple cross-chain transactions, and node governance is carried out based on the reputation score.

2. The method according to claim 1, characterized in that, Data collection tools are used to collect cross-chain behavior data on blockchain networks, including: By deploying observer contracts on the blockchain network, key events related to cross-chain transactions are monitored. These key events include the starting point information of the action initiated by the source chain, the actual execution record of the target chain, and the receipt information of returning the execution result of the target chain to the source chain. The link relay behavior of the relay node is analyzed by the acquisition components deployed on the relay node side; The key events and the link relay behaviors are archived according to preset requirements and bound to preset cross-chain behavior attribute metadata to form cross-chain behavior data in a unified format.

3. The method according to claim 1, characterized in that, Constructing a cross-chain behavior graph based on the aforementioned cross-chain behavior data includes: The cross-chain behavior data is parsed to determine entity nodes, behavior nodes, and edges between nodes. The entity nodes are used to indicate the on-chain entities participating in the cross-chain transaction, the behavior nodes are used to indicate the behavior actions performed by the entity nodes, the edges are used to indicate the temporal logical relationship between the behavior actions, and the behavior nodes are bound to node attributes. The cross-chain behavior graph is constructed based on the entity nodes, the behavior nodes, and the edges between the nodes.

4. The method according to claim 1, characterized in that, Path analysis and node behavior consistency verification are performed on the cross-chain behavior graph to locate deviation nodes and their abnormal behaviors, including: In the event of an anomaly in a cross-chain transaction, the node in the cross-chain transaction that has an abnormal result is used as the anchor point to traverse the causal path in the cross-chain behavior graph in reverse, restore the entire behavior chain of the cross-chain transaction, and determine whether the cross-chain transaction was executed completely as expected based on the entire behavior chain. Based on the determination result, the deviation node and the abnormal behavior of the deviation node are located. For multiple behavior nodes corresponding to the same cross-chain transaction in the cross-chain behavior graph, a behavior consistency comparison is performed to locate the deviation nodes and the abnormal behavior of the deviation nodes. The abnormal behavior includes behavior missing, process interruption and forgery operation.

5. The method according to claim 1, characterized in that, Based on the abnormal temporal logical relationships in the aforementioned cross-chain behavior graph, the key operation sequences of cross-chain transactions are extracted and a verifiable behavior chain is generated, including: Based on the abnormal temporal logical relationships in the cross-chain behavior graph, the cross-chain operations of key nodes are sorted by dependency to generate a temporal execution chain for cross-chain transaction operations. Extract the node attributes during the execution process of each behavior node, and connect them in sequence according to the time-series execution chain to generate a structured certificate of the time-series execution chain; Each action node is bound to a signature and a signature verification mechanism to form a trustworthy structured credential; The trusted structured credentials are output according to a preset format to generate a standardized, verifiable chain of behaviors containing core node attributes.

6. The method according to claim 1, characterized in that, Combining the cross-chain behavior graph, the verifiable behavior chain, and the anomalous behavior, the responsibility scoring for the deviation node includes: Based on the cross-chain behavior graph and the verifiable behavior chain, verify the node attributes of the deviation node; After successful verification, a responsibility assessment function is constructed based on the behavior type of the abnormal behavior and the preset parameters of the deviation node. The responsibility score of the deviation node is evaluated using the aforementioned responsibility assessment function, wherein the responsibility score is used for arbitration to determine liability.

7. The method according to claim 1, characterized in that, The reputation score of each deviating node is determined based on its responsibility score in multiple cross-chain transactions, and node governance is carried out based on the reputation score, including: By combining the responsibility scores and historical performance data of each deviation node in multiple cross-chain transactions, the reputation score of the deviation node is obtained. The reputation level of the deviation node is determined according to the reputation score; If the reputation level of the deviation node remains below the level threshold for a preset period of time, the deviation node will be managed according to a preset strategy.

8. A node anomaly identification and reputation assessment device based on cross-chain behavioral graphs, characterized in that, The device includes: The data collection module is used to collect cross-chain behavioral data on the blockchain network using data collection tools. A construction module is used to construct a cross-chain behavior graph based on the cross-chain behavior data, wherein the cross-chain behavior graph is used to indicate the node behavior operation trajectory in the entire process of cross-chain transactions; The positioning module is used to perform path analysis and node behavior consistency verification on the cross-chain behavior graph, locate deviation nodes and the abnormal behavior of the deviation nodes, wherein the deviation nodes are used to indicate suspicious behavior entities; The generation module is used to extract the key operation sequence of cross-chain transactions and generate a verifiable behavior chain, with the abnormal temporal logic relationship in the cross-chain behavior graph as the core. The scoring module is used to score the responsibility of the deviation node by combining the cross-chain behavior graph, the verifiable behavior chain, and the abnormal behavior. The governance module is used to determine the reputation score of each deviation node based on its responsibility score in multiple cross-chain transactions, and to perform node governance based on the reputation score.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

Images