Intelligent contract abnormal calling mode detection method based on dynamic threshold value

Abstract

The invention provides an intelligent contract abnormal calling mode detection method based on a dynamic threshold value, and the method comprises the steps: monitoring and capturing a calling request pointing to a target intelligent contract in real time, and extracting the multi-dimensional behavior characteristics of the calling request; maintaining a dynamic threshold for each multi-dimensional behavior feature, and periodically calculating and updating the dynamic threshold by adopting a preset dynamic threshold algorithm based on corresponding historical data of each feature in the recent time window; judging whether each multi-dimensional behavior feature of the calling request exceeds the dynamic threshold range of the corresponding moment or not, and if yes, judging that the calling request is abnormal calling; when abnormal calling is detected, an early warning mechanism is triggered, and a preset response measure is executed; the invention aims to solve the problems of poor adaptability of a fixed threshold value and high cost of a machine learning model by dynamically adjusting the abnormality judgment standard and fusing multi-dimensional feature analysis, realize accurate and real-time detection of contract abnormal calling, and reduce security risk and operation and maintenance cost.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, and in particular to a method for detecting abnormal call patterns in smart contracts based on dynamic thresholds. Background Technology

[0002] Blockchain technology has developed rapidly worldwide due to its decentralized and immutable characteristics. As its core component, smart contracts enable automatic execution without third-party intervention, driving innovation in scenarios such as financial transactions, asset ownership confirmation, and supply chain traceability. Early smart contracts were mainly implemented with simple logic, and the need for anomaly detection was low. However, with the rise of complex applications such as DeFi and NFTs, the frequency of contract interactions has surged and business logic has become increasingly complex. Security incidents caused by abnormal calls have occurred frequently, making anomaly detection technology a research hotspot.

[0003] Existing smart contract anomaly detection methods have mainly gone through three stages of development. The first stage is static analysis methods, which use formal verification, code auditing, and other means to check for vulnerabilities before contract deployment. This was once the mainstream detection method, but it can only cover known vulnerability types and cannot deal with unknown anomalies generated by complex interactions after deployment. It also suffers from path explosion problems and has limited detection depth. The second stage is dynamic monitoring methods based on fixed thresholds. Static thresholds are set for indicators such as call frequency and gas consumption to achieve real-time monitoring. However, the normal behavior of smart contracts is dynamically affected by factors such as business cycles and network congestion. Fixed thresholds are prone to generating a large number of false alarms during peak periods and are difficult to detect low-frequency, slow attacks, resulting in a high false negative rate. The third stage is machine learning-driven detection methods, which use supervised or unsupervised models to learn anomaly patterns. The detection accuracy has improved, but it relies on large-scale labeled data training, which has high model update costs and computational overhead, making it difficult to meet the real-time response requirements of blockchain.

[0004] Currently, the industry has increasingly higher requirements for the real-time performance, adaptability, and accuracy of smart contract anomaly detection. Existing methods suffer from high false positive and false negative rates, poor adaptability, and high deployment costs, which have become key bottlenecks restricting the secure development of blockchain applications. Therefore, there is an urgent need in this field for a smart contract anomaly call pattern detection method based on dynamic thresholds to solve the above problems. Summary of the Invention

[0005] This invention provides a method for detecting abnormal call patterns in smart contracts based on dynamic thresholds. It aims to solve the problems of poor adaptability of fixed thresholds and high cost of machine learning models by dynamically adjusting the anomaly judgment criteria and integrating multi-dimensional feature analysis, thereby achieving accurate and real-time detection of abnormal contract calls and reducing security risks and operation and maintenance costs.

[0006] This invention provides a method for detecting abnormal call patterns in smart contracts based on dynamic thresholds, comprising the following steps:

[0007] Step 1: Monitor and capture call requests pointing to the target smart contract in real time, and extract the multi-dimensional behavioral features of the call requests;

[0008] Step 2: Maintain a dynamic threshold for each of the multidimensional behavioral features. Based on the historical data corresponding to each feature within the recent time window, periodically calculate and update the dynamic threshold using a preset dynamic threshold algorithm.

[0009] Step 3: Determine whether the multi-dimensional behavioral characteristics of the call request exceed the dynamic threshold range at the corresponding time. If they do, it is determined to be an abnormal call.

[0010] Step 4: When an abnormal call is detected, trigger the early warning mechanism and execute the preset response measures.

[0011] Compared with the prior art, the beneficial effects of this application are as follows:

[0012] 1. This invention adapts to the fluctuations in normal contract behavior through dynamic thresholds and combines multi-dimensional features for joint judgment, effectively reducing false positives and false negatives caused by fixed thresholds.

[0013] 2. This invention updates thresholds periodically based on recent historical data, enabling rapid response to changes in contract business models without frequent manual rule adjustments. It adapts to behavioral fluctuations in different scenarios such as peak and off-peak periods, significantly reducing operation and maintenance costs and meeting the real-time detection needs of blockchain.

[0014] 3. This invention uses statistical computing as its core, avoiding the high training and computational costs of complex machine learning models. It consumes few resources, can be flexibly deployed on blockchain nodes or peripheral monitoring services, and is suitable for smart contract applications of different scales.

[0015] 4. The detection results of this invention are based on clear statistical logic and feature correlation, which makes it easier for security personnel to understand the causes of anomalies and trace attack paths, providing clear guidance for subsequent security protection optimization and further improving the security protection capabilities of blockchain applications.

[0016] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention, but do not constitute a limitation thereof; in the drawings:

[0018] Figure 1 This is a flowchart illustrating a method for detecting abnormal smart contract call patterns based on dynamic thresholds, provided by the present invention. Detailed Implementation

[0019] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0020] Example 1:

[0021] This invention provides a method for detecting abnormal smart contract call patterns based on dynamic thresholds. Please refer to [link to relevant documentation]. Figure 1 This includes the following steps:

[0022] Step 1: Monitor and capture call requests pointing to the target smart contract in real time, and extract multi-dimensional behavioral features of the call requests;

[0023] Step 2: Maintain dynamic thresholds for each multidimensional behavioral feature. Based on the historical data corresponding to each feature within the recent time window, use a preset dynamic threshold algorithm to periodically calculate and update the dynamic thresholds.

[0024] Step 3: Determine whether the multi-dimensional behavioral characteristics of the call request exceed the dynamic threshold range at the corresponding time. If they do, it is determined to be an abnormal call.

[0025] Step 4: When an abnormal call is detected, trigger the early warning mechanism and execute the preset response measures.

[0026] Specifically, in this embodiment, the system acquires all transaction requests, i.e., call requests, to the target contract in real time through blockchain nodes or a listening service. For each request, the system extracts multi-dimensional behavioral data, i.e., multi-dimensional behavioral features. Secondly, the system maintains a dynamic threshold for each monitored feature (e.g., the number of calls per hour). This threshold is not a fixed value but is periodically recalculated and updated using a specific algorithm based on data from the feature within a recent historical period (e.g., the past 24 hours), thus adapting to fluctuations in normal contract activity. The system compares the feature values ​​extracted from the real-time requests with the updated dynamic threshold. If the feature value exceeds the normal range defined by the threshold (usually above an upper bound), the call behavior is considered abnormal. Once an abnormality is determined, the system immediately initiates an early warning process and can automatically execute predetermined security responses, such as delaying or rejecting the transaction.

[0027] In one implementation, the multidimensional behavioral features in step one include at least one of call frequency features, resource consumption features, call sequence features, and numerical features.

[0028] Invocation frequency characteristics include the number of times a specific function is invoked within a unit time window;

[0029] Resource consumption characteristics include the amount of Gas consumed by the call request;

[0030] Call sequence characteristics include the sequential pattern of specific function calls;

[0031] Numerical characteristics include at least one of the following: the transaction amount involved in the call request and the number of transfer addresses.

[0032] Specifically, in this embodiment, the call frequency characteristic refers to the call density of a specific function, using a unit time window (e.g., 1 hour, 12 hours) as the statistical period, and counting the total number of times the function is called within that period, such as "the number of times the withdraw() function is called per hour"; the resource consumption characteristic refers to the amount of Gas consumed by the call request in the blockchain network. Gas is the unit for measuring computing resource consumption in the blockchain network. Every function call, data storage, and other operation of a smart contract consumes a certain amount of Gas, and its consumption is positively correlated with the complexity of the operation, reflecting the resource occupation of the call behavior; the call sequence characteristic refers to the sequential pattern of multiple function calls when a user or other contract calls the target smart contract, such as the fixed order of "calling the approve() function first and then calling the transfer() function". Normal calls in different business scenarios usually have specific sequence patterns, and abnormal sequences may indicate malicious operations; the numerical characteristic refers to the quantitative data involved in the call request, including but not limited to the transaction amount (e.g., the transfer amount when calling the transfer function) and the number of transfer addresses (e.g., the total number of receiving addresses involved in a single call).

[0033] In one implementation, the preset dynamic threshold algorithm includes at least one of a weighted quantile-based dynamic threshold algorithm and a multi-scale prediction-based dynamic threshold algorithm.

[0034] Specifically, the weighted quantile-based dynamic threshold algorithm is based on the quantiles of historical feature data. It highlights the reference value of recent data by assigning time decay weights to historical data and introduces a correlation adjustment factor between features, so that the threshold can adapt to the time characteristics of the data and the correlation characteristics of the features. The multi-scale prediction-based dynamic threshold algorithm constructs three types of prediction models: short-term, medium-term and long-term. It integrates the multi-scale prediction results and adjusts the detection sensitivity according to the prediction consistency, so that the threshold can accurately capture the time series patterns of the data (such as periodic fluctuations and trend changes).

[0035] In one implementation, the dynamic thresholding algorithm based on weighted quantiles includes:

[0036] Assign time decay weights to the feature values ​​at each moment within the historical time window;

[0037] Calculate weighted quantiles ;

[0038] Introduce a correlation adjustment factor between features;

[0039] The obtained dynamic threshold is :

[0040]

[0041] In the formula, For preset quantile values, The weighted average is calculated based on the time decay weight. quantiles; Features Features of the current dynamic threshold to be calculated Historical correlation coefficient; Features Rate of change within the recent time window, , Features The feature values ​​in the current time window, Features Average value within a historical time window; This is the time difference between the current moment and the most recent abnormal moment. If there are no abnormal records in the past, the maximum duration of the historical time window is taken. To adjust the strength coefficient, For smoothing parameters.

[0042] Specifically, The final dynamic threshold based on this algorithm, i.e., the feature. The anomaly detection criteria are dynamically updated based on historical data, feature correlation, and time factors. For weighted Quantiles reflect the vast majority of recent historical data for feature k. The upper limit of normal behavior (proportion) is determined by characteristics within a historical time window. The data is calculated by combining the time decay weight. The preset quantile value represents the coverage ratio of normal behavior data. It is set by experience and the value range is usually 0.95-0.99. For example, 0.95 means that 95% of the normal data is covered. It can be adjusted according to the strictness of the detection. The historical correlation coefficient between feature j and feature k measures the degree of synchronization between the changes of the two features. It is calculated based on the complete sequence data of features j and k within the historical time window using the Pearson correlation coefficient formula (the Pearson correlation coefficient formula is existing technology and will not be described in this embodiment). The value range is [-1, 1], where 1 represents a perfect positive correlation, -1 represents a perfect negative correlation, and 0 represents no correlation. The recent rate of change of feature j reflects the fluctuation range of feature j within the current time window, as shown by the formula. The calculation shows that, among which This represents the real-time feature value of feature j within the current time window (real-time acquisition). This is the average value of feature j within a historical time window (calculated from historical data statistics). The time difference between the current time and the most recent abnormal time reflects the temporal correlation of abnormal events and is extracted from the system abnormal log. When there are historical abnormalities, the time difference is "current system time - timestamp of the most recent abnormal record". When there are no historical abnormalities, the time difference is the maximum duration of the historical time window (e.g., 72 hours). To adjust the intensity coefficient and control the impact of feature correlation on the threshold, the value is set empirically and adapted to business needs. The preferred value range is [0.1, 0.5]. When contract behavior fluctuates greatly, a smaller value is used (to reduce the impact of correlation), and when the behavior is stable, a larger value is used (to enhance the effect of correlation adjustment). To smooth the parameters and avoid drastic fluctuations in the adjustment term due to an excessively small denominator, the value range is set empirically, preferably [0.5, 2.0], to balance the sensitivity and stability of the adjustment term. This is a hyperbolic tangent function used to map the calculation result within the parentheses to the interval [-1, 1], avoiding excessive threshold adjustment due to extreme values ​​and ensuring smooth threshold changes. This represents the total contribution of cross-feature correlation, reflecting the linkage effect of fluctuations in other features on the current threshold of feature k. It is obtained by iterating through all non-k features j, calculating "correlation between feature j and k × recent rate of change of feature j", and then summing the results. The square root of the time difference makes the effect of the time difference on the adjustment term decay non-linearly, weakening the interference of long-term anomalies on the current threshold and strengthening the warning effect of recent anomalies.

[0043] The formula uses historical normal behavior benchmarks and cross-feature linkage adjustments as its core logic. First, As a baseline, it ensures coverage of most normal behaviors through quantile characteristics and highlights the reference value of recent data through time decay weights. Secondly, the sum of cross-feature correlation contributions captures the impact of fluctuations in other related features on the current feature; for example, when the call frequency, which is highly correlated with gas consumption, surges, the gas consumption threshold needs to be adaptively increased. Furthermore, through… The function smoothly adjusts the amplitude, combined with and Control the intensity and stability of the adjustment to avoid frequent threshold oscillations; finally, introduce a time difference. This allows the threshold to respond to the temporal correlation of abnormal events. When an anomaly has occurred recently, the threshold is tightened appropriately, while when there is no recent anomaly, the threshold remains robust, ultimately achieving the adaptation of the threshold to the dynamic changes in contract behavior.

[0044] In one implementation, weighted quantiles The calculation formula is:

[0045]

[0046] In the formula, For the first Time decay weights for historical data Representing the current moment, For the first The recording moment of each historical data point; This is a time decay constant that is adaptively adjusted based on the frequency of business fluctuations in the smart contract. The candidate feature value represents any one of the historical feature values. Represents candidate values ​​less than or equal to The sum of the weights of all historical data. This represents the sum of the weights of all historical data.

[0047] Specifically, The time decay weight of the i-th historical data reflects the reference value of the historical data. Recent data has a higher weight, while older data has a lower weight. The current time represents the time reference point for threshold calculation, i.e., the system's real-time timestamp. The record time of the i-th historical data is the collection time of this feature data, the timestamp recorded synchronously during data collection, and is stored in the historical database. This is a time decay constant used to control the rate of weight decay. It is set by business adaptation, and the preferred value range is [12, 72] hours. When the contract business fluctuates frequently, a smaller value is used (e.g., 12 hours, to quickly forget old data), and a larger value is used when the business is stable (e.g., 72 hours, to retain more historical references). The candidate feature value is any original data of feature k within the historical time window, which is taken from the original call data of feature k collected within the historical time window. The sum of weights for all historical data less than or equal to the candidate value x is calculated by sorting the historical feature values ​​in ascending order and then accumulating all data less than or equal to x. The sum is obtained.

[0048] The core logic of this formula is to assign higher weights to recent normal behaviors, accurately extract the boundaries of normal behaviors under the current business model, and first calculate the time decay weights. Through the exponential function accomplish The closer (The more recent the data) The smaller, The closer to 1, the higher the weight. The further away (The older the data) The closer to 0 (lower weight, gradually forgotten), the greater the impact of recent data on the threshold; filter weighted quantiles. The historical feature values ​​are sorted in ascending order, and each candidate value is calculated sequentially. The corresponding "less than or equal to" "The ratio of the sum of the weights to the total weights", find the first value that satisfies "ratio". "of ,Should That is , representing the vast majority of recent ( The characteristic value of the ratio will not exceed this limit during normal calls, providing a benchmark for dynamic thresholds that fits the current business.

[0049] In one implementation, the dynamic threshold algorithm based on multi-scale prediction in step two includes:

[0050] Predictive models were developed for short-term, medium-term, and long-term historical sequences to obtain short-term, medium-term, and long-term prediction models.

[0051] By fusing the feature predictions from the multi-scale prediction model, a multi-scale prediction fusion value is obtained. ;

[0052] Sensitivity is adjusted based on prediction consistency;

[0053] The obtained dynamic threshold is :

[0054]

[0055] In the formula, the multi-scale prediction fusion value , , , These are the feature prediction values ​​output by the short-term, medium-term, and long-term prediction models, respectively. , , These are the fusion weights for short-term, medium-term, and long-term forecasts, respectively. + + =1; The standard deviation of the historical forecast residuals. The mean of the historical forecast residuals. The variance of the feature predictions output by the short-term, medium-term, and long-term prediction models; As the baseline confidence coefficient, It is an extremely small parameter for preventing division by zero;

[0056] The short-term, medium-term, and long-term forecasting models all employ the LSTM time series forecasting model.

[0057] Specifically, in this embodiment, the short-term model inputs historical data of [6,12] hours, the medium-term model inputs historical data of [12,24] hours, and the long-term model inputs historical data of [24,48] hours. All data are collected in real time and stored historically. , , The weights represent the fusion of short-term, medium-term, and long-term forecasts; the higher the forecast accuracy, the greater the weight. The standard deviation of the historical prediction residuals reflects the degree of error fluctuation in the prediction model and is calculated based on the validation set data. The mean of the historical prediction residuals reflects the systematic bias of the prediction model. It is obtained by averaging the historical residual sequence of the validation set. If the mean is close to 0, it indicates that the model has no obvious bias. This represents variance; the smaller the variance, the higher the predictive consistency. The baseline confidence coefficient controls the tolerance range of normal fluctuations and is set by statistical standards. The preferred values ​​are 1.96 for a 95% confidence level and 2.58 for a 99% confidence level. This represents the adaptive sensitivity adjustment term, which dynamically adjusts the error tolerance range based on prediction consistency. It is determined by both the prediction model error and prediction consistency; the more consistent the prediction, the smaller the adjustment term and the stricter the threshold.

[0058] This formula captures behavioral patterns across different time dimensions using three LSTM models: short-term, medium-term, and long-term, representing short-term sudden fluctuations, medium-term cyclicality, and long-term trends, respectively. These patterns are then fused using adaptive weights. This ensures that the predicted values ​​best reflect actual normal behavior. Reflecting the historical error fluctuations of the prediction model, combined with the baseline confidence coefficient This establishes a basic error tolerance range to ensure that normal fluctuations are not misjudged as anomalies. The error tolerance range is adjusted by the variance of multi-scale predicted values. High prediction consistency (small variance) indicates a stable behavioral pattern, so the adjustment term is reduced and the threshold is tightened (improving detection sensitivity). Low prediction consistency (large variance) indicates an unstable behavioral pattern, so the adjustment term is increased and the threshold is relaxed (reducing false alarms). Finally... Adding this to the adjusted error tolerance range yields the upper bound of the dynamic threshold. .

[0059] It should be noted that LSTM (Long Short-Term Memory) is a variant of Recurrent Neural Network (RNN) specifically designed for processing time-series data. Its core principle is to address the gradient vanishing or exploding problems of traditional RNNs through gating mechanisms (input gate, forget gate, output gate), effectively capturing long-term dependencies in time-series data. In this method, the construction logic of the short-term, medium-term, and long-term LSTM models is consistent; only the length of the input historical sequence differs.

[0060] 1. Data preprocessing: Divide historical feature data into continuous sequence segments in chronological order. The length of each sequence segment corresponds to the input length of the model (the short-term model input length corresponds to [6, 12] hours of data, the medium-term model corresponds to [12, 24] hours, and the long-term model corresponds to [24, 48] hours). Construct a training dataset in the form of input sequence - target value (e.g., predicting the next hour's data from the previous 12 hours of data).

[0061] 2. Model Structure: The model adopts a network structure that includes an input layer, an LSTM layer, and a fully connected layer. The LSTM layer is used to extract time series features, and the fully connected layer is used to output a single predicted value (the feature value of the next time window).

[0062] 3. Training and optimization: The model is trained using historical normal call data, with mean squared error (MSE) as the loss function. The model parameters are adjusted using the Adam optimizer until the prediction error (such as MAPE) of the model on the validation set meets the preset requirements.

[0063] 4. Predictive Inference: During real-time operation, the latest historical sequence data is input, and the model outputs the feature prediction values ​​for the corresponding time window. , , ).

[0064] This model belongs to the existing technology. This embodiment combines it with multi-scale fusion and adaptive sensitivity adjustment, and applies it to the dynamic threshold calculation of smart contracts.

[0065] In one implementation, multi-scale prediction fusion weights , , Determined in the following ways:

[0066]

[0067] In the formula, This represents the mean absolute percentage error of the corresponding scale prediction model on the recent validation set. , No. The true value of a validation sample. For the corresponding scaling model, the first The predicted value for each sample, To verify the number of samples.

[0068] Specifically, The mean absolute percentage error measures the prediction accuracy of the model at the i-th scale. The smaller the value, the higher the accuracy. Calculated based on recent validation set data, MAPE is a commonly used metric for evaluating the accuracy of prediction models. This formula quantifies the recent prediction accuracy of the model at each scale using MAPE. MAPE is calculated as a percentage of error, avoiding the influence of the magnitude of feature values ​​on error assessment, and objectively reflects the model's prediction accuracy. Perform a conversion to minimize MAPE (higher accuracy) → The larger the base (the larger the weight), the more the accuracy advantage is transformed into a weight advantage; by summing the denominators, the weights are normalized to ensure that the sum of the weights of the three scales is 1, and the fusion result is a reasonable weighted average.

[0069] In one implementation, the length of the time window in step two is based on the fluctuation coefficient of the smart contract's call frequency. Dynamic adjustment, fluctuation coefficient for:

[0070]

[0071] in, The standard deviation of historical feature values ​​within the current time window. This represents the average of historical feature values ​​within the current time window.

[0072] The adjustment logic is as follows: when When the value is greater than 0.8, the time window length is shortened to 70% of the current length; when it is 0.3... When, keep the time window length unchanged; when When the value is less than 0.3, the time window length is extended to 130% of the current length.

[0073] Specifically, when When the threshold is >0.8, it indicates drastic fluctuations in contract call behavior (such as during promotional periods or sudden business peaks). In this case, shortening the time window to 70% of the current length can quickly eliminate interference from outdated data, making historical data more closely reflect the current fluctuation pattern and ensuring that the threshold can keep up with behavioral changes in a timely manner; when 0.3 ≤ When the value is ≤0.8, it indicates that the contract call behavior fluctuates moderately and is within a stable and controllable range. Maintaining the current time window length balances the reference value of historical data with the stability of the threshold. When the value is less than 0.3, it indicates that the contract call behavior is very stable (such as during daily off-peak periods). In this case, extending the time window length to 130% of the current value can increase the amount of historical data, improve the reliability of threshold calculation, and avoid threshold fluctuations due to insufficient data.

[0074] In one implementation, the logic for judging abnormal calls in step three includes:

[0075] When at least two different behavioral features simultaneously exceed their corresponding dynamic thresholds, and the proportion of a single feature exceeding the threshold is... When this happens, it is determined to be an abnormal call;

[0076] The proportion exceeding the threshold The calculation formula is:

[0077]

[0078] in, For the current eigenvalue, This is a dynamic threshold.

[0079] Specifically, for example, exceeding the threshold for "Gas consumption" alone is insufficient to determine an anomaly. However, when both "Gas consumption" and "call frequency" exceed the threshold simultaneously, the anomaly's reliability significantly increases. The excess ratio constraint requires that a single feature exceed the threshold by a certain percentage; that is, the feature value must deviate from the normal range to be considered an anomaly, excluding normal fluctuations with slight excesses (e.g., if the threshold is 100, a feature value of 110 is not considered an anomaly; a feature value of 120 is considered an anomaly). Through this dual constraint, both the comprehensiveness of anomaly detection (multi-feature linkage) and the rigor of the detection (excess ratio) are ensured, effectively reducing the false alarm rate and accurately identifying genuine abnormal call behavior.

[0080] In one implementation, the early warning mechanism in step four includes sending an alert message to the contract administrator. The alert message includes the name of the abnormal feature, the current value of the abnormal feature, the corresponding dynamic threshold, the time of the abnormal occurrence, the source address of the abnormal call, and the proportion of the feature exceeding the limit. The alert message can be sent via SMS, email, or at least one of the following: internal blockchain messages.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting abnormal smart contract call patterns based on dynamic thresholds, characterized in that, Includes the following steps: Step 1: Monitor and capture call requests pointing to the target smart contract in real time, and extract the multi-dimensional behavioral features of the call requests; Step 2: Maintain a dynamic threshold for each of the multidimensional behavioral features. Based on the historical data corresponding to each feature within the recent time window, periodically calculate and update the dynamic threshold using a preset dynamic threshold algorithm. Step 3: Determine whether the multi-dimensional behavioral characteristics of the call request exceed the dynamic threshold range at the corresponding time. If they do, it is determined to be an abnormal call. Step 4: When an abnormal call is detected, trigger the early warning mechanism and execute the preset response measures.

2. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 1, characterized in that, The multidimensional behavioral features mentioned in step one include at least one of the following: call frequency features, resource consumption features, call sequence features, and numerical features; The call frequency characteristic includes the number of times a specific function is called within a unit time window; The resource consumption characteristics include the amount of Gas consumed by the call request; The call sequence characteristics include the sequential pattern of specific function calls; The numerical characteristics include at least one of the transaction amount and the number of transfer addresses involved in the call request.

3. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 1, characterized in that, The preset dynamic threshold algorithm includes at least one of a weighted quantile-based dynamic threshold algorithm and a multi-scale prediction-based dynamic threshold algorithm.

4. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 3, characterized in that, The dynamic threshold algorithm based on weighted quantiles includes: Assign time decay weights to the feature values ​​at each moment within the historical time window; Calculate weighted quantiles ; Introduce a correlation adjustment factor between features; The obtained dynamic threshold is : ； In the formula, For preset quantile values, The weighted average is calculated based on the time decay weight. quantiles; Features Features of the current dynamic threshold to be calculated Historical correlation coefficient; Features Rate of change within the recent time window, , Features The feature values ​​in the current time window, Features Average value within a historical time window; This is the time difference between the current moment and the most recent abnormal moment. If there are no abnormal records in the past, the maximum duration of the historical time window is taken. To adjust the strength coefficient, For smoothing parameters.

5. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 4, characterized in that, The weighted quantile The calculation formula is: ； In the formula, For the first Time decay weights for historical data Representing the current moment, For the first The recording moment of each historical data point; This is a time decay constant that is adaptively adjusted based on the frequency of business fluctuations in the smart contract. The candidate feature value represents any one of the historical feature values. Represents candidate values ​​less than or equal to The sum of the weights of all historical data. This represents the sum of the weights of all historical data.

6. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 3, characterized in that, The dynamic threshold algorithm based on multi-scale prediction described in step two includes: Predictive models were developed for short-term, medium-term, and long-term historical sequences to obtain short-term, medium-term, and long-term prediction models. By fusing the feature predictions from the multi-scale prediction model, a multi-scale prediction fusion value is obtained. ; Sensitivity is adjusted based on prediction consistency; The obtained dynamic threshold is : ； In the formula, the multi-scale prediction fusion value , , , These are the feature prediction values ​​output by the short-term, medium-term, and long-term prediction models, respectively. , , These are the fusion weights for short-term, medium-term, and long-term forecasts, respectively. + + =1; The standard deviation of the historical forecast residuals. The mean of the historical forecast residuals. The variance of the feature predictions output by the short-term, medium-term, and long-term prediction models; As the baseline confidence coefficient, It is an extremely small parameter for preventing division by zero; The short-term, medium-term, and long-term forecasting models all employ the LSTM time series forecasting model.

7. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 6, characterized in that, Multi-scale prediction fusion weights , , Determined in the following ways: ； In the formula, This represents the mean absolute percentage error of the corresponding scale prediction model on the recent validation set. , No. The true value of a validation sample. For the corresponding scaling model, the first The predicted value for each sample, To verify the number of samples.

8. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 1, characterized in that, The length of the time window mentioned in step two is based on the fluctuation coefficient of the smart contract's call frequency. The fluctuation coefficient is dynamically adjusted. for: ； in, The standard deviation of historical feature values ​​within the current time window. This represents the average of historical feature values ​​within the current time window. The adjustment logic is as follows: when When the value is greater than 0.8, the time window length is shortened to 70% of the current length; when it is 0.3... When, keep the time window length unchanged; when When the value is less than 0.3, the time window length is extended to 130% of the current length.

9. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 1, characterized in that, The exception call judgment logic described in step three includes: When at least two different behavioral features simultaneously exceed their corresponding dynamic thresholds, and the proportion of a single feature exceeding the threshold is... When this happens, it is determined to be an abnormal call; The proportion exceeding the threshold The calculation formula is: ； in, For the current eigenvalue, This is a dynamic threshold.

10. The method for detecting abnormal smart contract call patterns based on dynamic thresholds according to claim 1, characterized in that, The early warning mechanism described in step four includes sending alarm information to the contract administrator. The alarm information includes the name of the abnormal feature, the current value of the abnormal feature, the corresponding dynamic threshold, the time of the abnormal occurrence, the source address of the abnormal call, and the proportion of the feature exceeding the limit. The alarm information is sent in at least one of the following methods: SMS, email, and internal blockchain messages.

Images