An unmanned cluster abnormal behavior detection method and device based on a lightweight blockchain consensus, a storage medium, and an electronic device

Abstract

The application provides an unmanned cluster abnormal behavior detection method and device based on a lightweight blockchain consensus, a storage medium and an electronic device, and relates to the technical field of network security. The method comprises the following steps: firstly, analyzing the state data of unmanned equipment in a single coding grouping group by using a neural network model to preliminarily identify the abnormal behavior of a certain unmanned equipment; then, other unmanned equipment in the coding group reconstructs the correct data of the suspicious unmanned equipment based on a local repair code, and compares the actual data of the suspicious unmanned equipment, so as to determine the abnormal behavior of the suspicious unmanned equipment; finally, the blockchain consensus algorithm is used to reach a consensus on the abnormal behavior of the suspicious unmanned equipment in the local repair group, and the credit value of the suspicious unmanned equipment is adjusted by calling an intelligent contract. The application realizes rapid and effective abnormal behavior detection in a decentralized environment, reduces the communication overhead, and effectively improves the security of the unmanned cluster in the confrontation environment.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method, device, storage medium, and electronic device for detecting abnormal behavior of unmanned clusters based on lightweight blockchain consensus. Background Technology

[0002] As a core development direction of intelligent systems, unmanned swarm technology has shown great application potential in disaster relief, logistics distribution, and agricultural plant protection through collaborative operations among unmanned devices. However, the open working environment and inherent complexity of unmanned swarms pose serious security threats. On the one hand, unmanned devices may malfunction due to non-malicious reasons such as hardware failures, software errors, or communication interference; on the other hand, they may be subject to malicious attacks, such as GPS spoofing, spoofed node injection, and Sybil attacks, leading to the hijacking of unmanned devices and malicious behavior. Therefore, real-time and reliable detection and handling of abnormal behavior of unmanned devices in the swarm are crucial prerequisites for ensuring the safe and reliable operation of unmanned swarms. Currently, anomaly detection methods for unmanned swarms mainly include centralized detection methods and distributed collaborative detection methods. For centralized detection methods, once the central node is compromised or malfunctions, the entire detection system will be paralyzed; for distributed collaborative detection methods, there is usually a problem of huge communication overhead and significant latency in multi-hop wireless networks.

[0003] Chinese invention patent CN120197103A discloses an unsupervised anomaly detection method for unmanned aerial vehicles (UAVs). This method uses PA (Automatic Anomaly Detection) LSTM The AE model combines parallel LSTM with an attention mechanism, introduces a random drop-out layer, and sets a dynamic anomaly threshold to achieve real-time detection of subtle anomalies in UAV flight data. However, this method is limited to anomaly detection itself, failing to address security vulnerabilities in the transmission of detection results and lacking an effective mechanism for handling anomalous UAVs.

[0004] Chinese invention patent CN115085898B discloses a method for detecting anomalies in UAV data based on homomorphic encryption. This method ensures that UAV data remains encrypted throughout transmission and processing, effectively preventing malicious hijacking and tampering. However, this method relies on the data processing capabilities of a cloud platform, resulting in excessive centralization. If the network is interfered with or malfunctions, the entire detection system will come to a standstill.

[0005] Chinese invention patent CN118332899A discloses a method for recovering multi-point failure data in UAV swarms. This method establishes a Markov model based on RS erasure coding and measures whether UAV data has failed and repairs it based on the average multi-point failure time. However, RS erasure coding is a global repair code, meaning that recovering a single data block requires obtaining all the remaining data in the swarm. This global dependency leads to large data transmission and computational overhead, resulting in low efficiency and difficulty in meeting real-time requirements. Summary of the Invention

[0006] The embodiments of this application provide a method, apparatus, storage medium, and electronic device for detecting abnormal behavior of unmanned clusters based on lightweight blockchain consensus, so as to improve the security of unmanned clusters in adversarial environments.

[0007] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0008] According to a first aspect of the embodiments of this application, a method for detecting abnormal behavior of unmanned clusters based on lightweight blockchain consensus is provided, including: Step S100: Connect the cluster of unmanned devices to the same blockchain network, wherein an arbitration smart contract is deployed in the blockchain network; Step S200: Divide the unmanned equipment cluster into several local repair groups according to the local repair code; In step S300, the unmanned equipment being tested uses a neural network model to perform a suspicion calculation to determine whether the behavior of other unmanned equipment within the same local repair group is abnormal. Step S400: If a suspicious unmanned device is determined to be abnormal, the correct data of the suspicious unmanned device is restored using the local repair code and compared with the actual data. In step S500, if the comparison is inconsistent, other unmanned devices in the same local repair group use the blockchain consensus algorithm to reach a consensus on the anomaly of the suspected unmanned device, and at the same time call the arbitration smart contract to reduce the reputation value of the suspected unmanned device.

[0009] In some embodiments of this application, based on the foregoing scheme, before step S100, the following steps are further included: Integrating pre-trained neural network models into unmanned devices; The neural network model is pre-trained using historical normal data, and the training data consists of time-series sequences extracted according to time windows.

[0010] In some embodiments of this application, based on the foregoing scheme, step S200 includes: Determine the encoding parameters of the local repair code, including the number of data devices, the number of local groups, the number of local check devices, and the number of global check devices; Based on the coding parameters, the unmanned equipment is divided into several local repair groups. Within each local repair group, a corresponding number of unmanned equipment are selected as data devices, local verification devices, and global verification devices.

[0011] In some embodiments of this application, based on the foregoing scheme, step S300 includes: The unmanned equipment conducting the inspection collects status data from other unmanned equipment through a blockchain network; The state data is extracted according to a preset time window and constructed into a multi-dimensional feature vector; The multidimensional feature vector is input into a neural network model for suspicion calculation, and the output is the suspicion result for other unmanned devices; the suspicion result for other unmanned devices is calculated according to the following formula: ; in, The computation function representing the neural network model. Represents a multidimensional feature vector. Expressing doubt about the result; when At that time, it is determined that the unmanned equipment being tested has an anomaly. At that time, it was determined that the unmanned equipment being tested had no abnormalities.

[0012] In some embodiments of this application, based on the foregoing scheme, step S400 includes: If a suspicious unmanned device is determined to be abnormal, the unmanned device performing the inspection requests data fragments from other unmanned devices in the same local repair group. Based on the data fragment, the data devices, local verification devices, and global verification devices within the same local repair group use the local repair code to recover the correct data of the suspected unmanned device; Compare the correct data with the actual data.

[0013] In some embodiments of this application, based on the foregoing scheme, the step of invoking the arbitration smart contract to reduce the reputation value of a suspicious unmanned device includes: The arbitration smart contract is invoked to reduce the reputation value of suspicious unmanned devices using the following formula; ; in, Indicates the penalty coefficient. This indicates the updated reputation value. This indicates the reputation value before the update; If the reputation value of a suspicious unmanned device is lower than the reputation value threshold, the arbitration smart contract broadcasts an instruction to the blockchain to isolate the suspicious unmanned device from the current blockchain network and add it to the blacklist.

[0014] In some embodiments of this application, based on the aforementioned scheme, the arbitration smart contract stores the identity identifiers of all registered unmanned devices and their corresponding reputation values, and includes the reputation value update logic, a random number generator, and threshold logic for triggering consensus verification.

[0015] According to a second aspect of the embodiments of this application, a device for detecting abnormal behavior of unmanned clusters based on lightweight blockchain consensus is provided, comprising: An initialization unit is used to connect a cluster of unmanned devices to the same blockchain network, wherein an arbitration smart contract is deployed in the blockchain network; Grouping unit, used to divide the unmanned equipment cluster into several local repair groups according to the local repair code; The computing unit, used by unmanned equipment for detection, uses a neural network model to perform suspicion calculations to determine whether the behavior of other unmanned equipment within the same local repair group is abnormal; The data recovery and comparison unit is used to recover the correct data of a suspicious unmanned device when it is determined to be abnormal, using local repair codes and comparing it with the actual data. The grouping and adjudication unit is used to reach a consensus on the anomaly of the suspicious unmanned device when there is a discrepancy in the comparison, using the blockchain consensus algorithm, and at the same time calling the arbitration smart contract to reduce the reputation value of the suspicious unmanned device.

[0016] According to a third aspect of the embodiments of this application, a computer-readable storage medium is provided, the storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the method as described in the first aspect.

[0017] According to a fourth aspect of the embodiments of this application, an electronic device is provided, including: a memory and a processor; The memory is used to store computer instructions; The processor is configured to invoke computer instructions stored in the memory, causing the electronic device to execute the method described in the first aspect.

[0018] The technical solution of this application improves the security of unmanned clusters in adversarial environments by introducing local repair codes to encode and group unmanned clusters, thereby achieving fast and low-overhead data recovery.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings: Figure 1 A flowchart illustrating an abnormal behavior detection method for unmanned clusters based on lightweight blockchain consensus according to an embodiment of this application is shown. Figure 2 A schematic diagram of several local repair groups divided according to local repair codes is shown for an unmanned equipment node according to an embodiment of this application; Figure 3 The illustration shows an unmanned device node suspecting an abnormal unmanned device, collecting data for verification, and uploading the verification results to the blockchain to reach a consensus according to an embodiment of this application; Figure 4 A block diagram of an unmanned cluster abnormal behavior detection device based on lightweight blockchain consensus according to an embodiment of this application is shown; Figure 5 A block diagram of an electronic device according to one embodiment of this application is shown; Figure 6 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0021] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0022] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0023] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0024] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0025] It should be noted that "multiple" in this article refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0027] The following detailed description of some embodiments of this application will be provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0028] See Figure 1 The diagram illustrates a flowchart of an abnormal behavior detection method for unmanned clusters based on lightweight blockchain consensus according to an embodiment of this application.

[0029] See Figure 2 The diagram illustrates a plurality of local repair groups of an unmanned equipment node according to an embodiment of the present application, divided according to local repair codes.

[0030] See Figure 3 The diagram illustrates an embodiment of the present application whereby an unmanned device node suspects an abnormal unmanned device, collects data for verification, and uploads the verification results to the blockchain to reach a consensus.

[0031] like Figure 1As shown, a method for detecting abnormal behavior of unmanned clusters based on lightweight blockchain consensus is presented, specifically including steps S100 to S500.

[0032] refer to Figure 1 Step S100: Connect the cluster of unmanned devices to the same blockchain network, wherein an arbitration smart contract is deployed in the blockchain network.

[0033] In some feasible embodiments, based on the foregoing scheme, before step S100, the method further includes: Integrating pre-trained neural network models into unmanned devices; The neural network model is pre-trained using historical normal data, and the training data consists of time-series sequences extracted according to time windows.

[0034] For example, the extracted time series is divided into training, validation and test sets in an 8:1:1 ratio to train the neural network model and ensure that the accuracy of the test is above 95%; mean squared error is selected as the loss function and Adam is selected as the optimizer.

[0035] In some feasible embodiments, based on the aforementioned scheme, the arbitration smart contract stores the identity identifiers of all registered unmanned devices and their corresponding reputation values, and includes the update logic for the reputation values, a random number generator, and the threshold logic for triggering consensus verification.

[0036] Continue to refer to Figure 1 Step S200: Divide the unmanned equipment cluster into several local repair groups according to the local repair code.

[0037] like Figure 2 As shown, in some feasible embodiments, based on the foregoing scheme, step S200 includes: Step S210: Determine the encoding parameters of the local repair code, including the number of data devices, the number of local groups, the number of local verification devices, and the number of global verification devices.

[0038] It should be noted that in this embodiment, the number of each type of equipment and the number of local groups will need to be adjusted accordingly based on the number of unmanned devices, but the number of local repair codes can repair and the lower limit of the group must be met.

[0039] Step S220: Divide the unmanned equipment into several local repair groups according to the coding parameters, and select a corresponding number of unmanned equipment in each local repair group as data equipment, local verification equipment and global verification equipment.

[0040] It should be noted that during the grouping process, all unmanned equipment was divided into groups... They are grouped into several local repair groups; among them Each stores the original state data. Each storage local group verifies data. Each storage unit contains global verification data, which satisfies... and will The unmanned equipment that stores raw state data is divided into several categories. Group.

[0041] Continue to refer to Figure 1 In step S300, the unmanned equipment being tested uses a neural network model to perform a suspicion calculation to determine whether the behavior of other unmanned equipment within the same local repair group is abnormal.

[0042] In some feasible embodiments, based on the foregoing scheme, step S300 includes: Step S310: The unmanned device conducting the detection collects status data from other unmanned devices through the blockchain network; Step S320: Extract the state data according to a preset time window and construct a multi-dimensional feature vector; Step S330: Input the multi-dimensional feature vector into the neural network model for suspicion calculation, and output the suspicion result for other unmanned devices; wherein, the suspicion result for other unmanned devices is calculated according to the following formula: ; in, The computation function representing the neural network model. Represents a multidimensional feature vector. Expressing doubt about the result; Step S340, when At that time, it is determined that the unmanned equipment being tested has an anomaly. At that time, it was determined that the unmanned equipment being tested had no abnormalities.

[0043] It should be noted that the status data collected in this embodiment includes spatial location data, behavioral data, communication data, and device data of the unmanned device. Spatial location data includes the relative distance, relative orientation, and relative speed to the target unmanned device; behavioral data includes CPU and memory usage, energy consumption patterns, etc.; communication data includes signal strength and channel status with the target unmanned device, etc.; and device data includes battery level and sensor health status, etc.

[0044] It should be noted that, in this embodiment, the specific construction process of the multidimensional feature vector includes: The collected state data is extracted according to a preset time window, and the statistical characteristics of each data point within the window are calculated, including mean, variance, maximum value, minimum value, etc. The corresponding statistical characteristics of the state data are then used to construct a multidimensional feature vector. .

[0045] It should be noted that in this embodiment, the neural network model adopts binary classification output, which greatly simplifies the subsequent data processing logic; at the same time, the model completes the entire process calculation from feature extraction to decision-making, which enhances the cohesion of the module and is conducive to the independent upgrading and replacement of the model.

[0046] Continue to refer to Figure 1 In step S400, if a suspicious unmanned device is determined to be abnormal, the correct data of the suspicious unmanned device is restored using the local repair code and compared with the actual data.

[0047] In some feasible embodiments, based on the foregoing scheme, step S400 includes: Step S410: If a suspicious unmanned device is determined to be abnormal, the unmanned device performing the detection requests data fragments from other unmanned devices in the same local repair group.

[0048] It should be noted that, in this embodiment, the data segment in step S410 is the status data of other unmanned devices within a certain period of time when the suspected unmanned device is suspected.

[0049] Step S420: Based on the data fragment, the data device, local verification device and global verification device within the same local repair group use the local repair code to recover the correct data of the suspected unmanned device.

[0050] Because of the repair capabilities of the local repair code, interference in network communication can also be resisted, thereby further increasing the robustness of the system.

[0051] For example, for the current group, there are An unmanned device, simply needs to receive... The correct data can be recovered from the correct data of the unmanned equipment.

[0052] Step S430: Compare the correct data with the actual data.

[0053] Continue to refer to Figure 1 In step S500, if the comparison is inconsistent, other unmanned devices in the same local repair group use the blockchain consensus algorithm to reach a consensus on the anomaly of the suspected unmanned device, and at the same time call the arbitration smart contract to reduce the reputation value of the suspected unmanned device.

[0054] In some feasible embodiments, based on the foregoing scheme, the invocation of the arbitration smart contract to reduce the reputation value of suspicious unmanned devices includes: The arbitration smart contract is invoked to reduce the reputation value of suspicious unmanned devices using the following formula; ; in, Indicates the penalty coefficient. This indicates the updated reputation value. This indicates the reputation value before the update; If the reputation value of a suspicious unmanned device is lower than the reputation value threshold, the arbitration smart contract broadcasts an instruction to the blockchain to isolate the suspicious unmanned device from the current blockchain network and add it to the blacklist.

[0055] It should be noted that in this embodiment, by implementing a reputation value update mechanism for suspicious unmanned devices, rather than directly isolating them from the blockchain, misjudgments caused by factors such as communication failures or interference, errors in correct data recovery, or calculation errors in the neural network model can be effectively prevented. When the reputation value of an unmanned device falls below a threshold, it is then isolated from the current network, ensuring that the vast majority of devices in the unmanned cluster always maintain honest behavior.

[0056] In summary, this method has the following beneficial effects: (1) By using blockchain networks and smart contracts, detection, judgment, verification, and adjudication functions are deployed throughout the cluster. The failure of a single unmanned device will not cause the collapse of the entire abnormal behavior detection system, thereby improving the security and robustness of the system.

[0057] (2) A lightweight neural network model is used to analyze the behavior of unmanned equipment, ensuring the accuracy and real-time performance of anomaly detection.

[0058] (3) The correct data of the suspicious unmanned equipment is restored based on the local repair code and then compared with its actual data, which effectively reduces the probability of misjudgment when only using the neural network model for detection.

[0059] (4) The detection process is carried out only in the local repair group where the suspected unmanned equipment is located, avoiding the need for network-wide consensus and saving communication bandwidth.

[0060] The following describes an embodiment of the apparatus described in this application, which can be used to execute a method for detecting abnormal behavior in unmanned clusters based on lightweight blockchain consensus as described in the above embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in the above embodiments of this application.

[0061] Reference Figure 4 As shown, a device 400 for detecting abnormal behavior of an unmanned cluster based on lightweight blockchain consensus according to an embodiment of this application includes: An initialization unit 401 is used to connect a cluster of unmanned devices to the same blockchain network, wherein an arbitration smart contract is deployed in the blockchain network; Grouping unit 402 is used to divide the unmanned equipment cluster into several local repair groups according to the local repair code; The calculation unit 403 is used for the detection unmanned equipment to perform suspicion calculation using a neural network model to determine whether the behavior of other unmanned equipment in the same local repair group is abnormal; The data recovery and comparison unit 404 is used to recover the correct data of a suspicious unmanned device by using local repair codes and compare it with the actual data when a suspicious unmanned device is judged to have malfunctioned. Grouping and adjudication unit 405 is used to reach a consensus on the anomaly of the suspicious unmanned device when the comparison is inconsistent, using the blockchain consensus algorithm, and at the same time calling the arbitration smart contract to reduce the reputation value of the suspicious unmanned device.

[0062] like Figure 5 As shown, this application embodiment also provides an electronic device 500, including a memory 510, a processor 520, and a computer program 511 stored in the memory 510 and executable on the processor. When the processor 520 executes the computer program 511, it implements the steps of the above-mentioned method for detecting abnormal behavior of unmanned clusters based on lightweight blockchain consensus.

[0063] Since the electronic device described in this embodiment is the device used to implement the unmanned cluster abnormal behavior detection device based on lightweight blockchain consensus in this application embodiment, those skilled in the art can understand the specific implementation method and its various variations of the electronic device in this embodiment based on the method described in this application embodiment. Therefore, how the electronic device implements the method in this application embodiment will not be described in detail here. Any device used by those skilled in the art to implement the method in this application embodiment is within the scope of protection of this application.

[0064] In practice, when the computer program 511 is executed by the processor, it can implement any of the embodiments corresponding to the first aspect.

[0065] Figure 6 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0066] It should be noted that, Figure 6 The computer system 600 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0067] like Figure 6As shown, the computer system 600 includes a Central Processing Unit (CPU) 601, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 602 or programs loaded from storage portion 608 into Random Access Memory (RAM) 603, such as performing the methods described in the above embodiments. The Random Access Memory 603 also stores various programs and data required for system operation. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An Input / Output (I / O) interface 605 is also connected to the bus 604.

[0068] The following components are connected to the input / output interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0069] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by central processing unit 601, it performs various functions defined in the system of this application.

[0070] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0071] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0072] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0073] In another aspect, this application also provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the unmanned cluster abnormal behavior detection method based on lightweight blockchain consensus described in the above embodiments.

[0074] In another aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to implement the method for detecting abnormal behavior of an unmanned cluster based on lightweight blockchain consensus described in the above embodiments.

[0075] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0076] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0077] Other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. It should be understood that this application is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for detecting abnormal behavior in unmanned clusters based on lightweight blockchain consensus, characterized in that, include: Step S100: Connect the cluster of unmanned devices to the same blockchain network, wherein an arbitration smart contract is deployed in the blockchain network; Step S200: Divide the unmanned equipment cluster into several local repair groups according to the local repair code; In step S300, the unmanned equipment being tested uses a neural network model to perform a suspicion calculation to determine whether the behavior of other unmanned equipment within the same local repair group is abnormal. Step S400: If a suspicious unmanned device is determined to be abnormal, the correct data of the suspicious unmanned device is restored using the local repair code and compared with the actual data. Step S500: If the comparison is inconsistent, other unmanned devices in the same local repair group use the blockchain consensus algorithm to reach a consensus on the anomaly of the suspected unmanned device, and at the same time call the arbitration smart contract to reduce the reputation value of the suspected unmanned device. Step S300 includes: The unmanned equipment conducting the inspection collects status data from other unmanned equipment through a blockchain network; The state data is extracted according to a preset time window and constructed into a multi-dimensional feature vector; The multidimensional feature vector is input into a neural network model for suspicion calculation, and the output is the suspicion result for other unmanned devices; the suspicion result for other unmanned devices is calculated according to the following formula: ； in, The computation function representing the neural network model. Represents a multidimensional feature vector. Expressing doubt about the result; when At that time, it is determined that the unmanned equipment being tested has an anomaly. At that time, it was determined that the unmanned equipment being tested had no abnormalities; The invocation of the arbitration smart contract to reduce the reputation value of suspicious unmanned devices includes: The arbitration smart contract is invoked to reduce the reputation value of suspicious unmanned devices using the following formula; ； in, Indicates the penalty coefficient. This indicates the updated reputation value. This indicates the reputation value before the update; If the reputation value of a suspicious unmanned device is lower than the reputation value threshold, the arbitration smart contract broadcasts an instruction to the blockchain to isolate the suspicious unmanned device from the current blockchain network and add it to the blacklist.

2. The method according to claim 1, characterized in that, Before step S100, the method further includes: Integrating pre-trained neural network models into unmanned devices; The neural network model is pre-trained using historical normal data, and the training data consists of time-series sequences extracted according to time windows.

3. The method according to claim 1, characterized in that, Step S200 includes: Determine the encoding parameters of the local repair code, including the number of data devices, the number of local groups, the number of local check devices, and the number of global check devices; Based on the coding parameters, the unmanned equipment is divided into several local repair groups. Within each local repair group, a corresponding number of unmanned equipment are selected as data devices, local verification devices, and global verification devices.

4. The method according to claim 3, characterized in that, Step S400 includes: If a suspicious unmanned device is determined to be abnormal, the unmanned device performing the inspection requests data fragments from other unmanned devices in the same local repair group. Based on the data fragment, the data devices, local verification devices, and global verification devices within the same local repair group use the local repair code to recover the correct data of the suspected unmanned device; Compare the correct data with the actual data.

5. The method according to claim 1, characterized in that, The arbitration smart contract stores the identity identifiers of all registered unmanned devices and their corresponding reputation values, and includes the update logic for the reputation values, a random number generator, and the threshold logic for triggering consensus verification.

6. A device for detecting abnormal behavior in unmanned clusters based on lightweight blockchain consensus, applied to the method as described in any one of claims 1-5, characterized in that, include: An initialization unit is used to connect a cluster of unmanned devices to the same blockchain network, wherein an arbitration smart contract is deployed in the blockchain network; Grouping unit, used to divide the unmanned equipment cluster into several local repair groups according to the local repair code; The computing unit, used by unmanned equipment for detection, uses a neural network model to perform suspicion calculations to determine whether the behavior of other unmanned equipment within the same local repair group is abnormal; The data recovery and comparison unit is used to recover the correct data of a suspicious unmanned device when it is determined to be abnormal, using local repair codes and comparing it with the actual data. The grouping and adjudication unit is used to reach a consensus on the anomaly of the suspicious unmanned device when there is a discrepancy in the comparison, using the blockchain consensus algorithm, and at the same time calling the arbitration smart contract to reduce the reputation value of the suspicious unmanned device.

7. A computer-readable storage medium, characterized in that, The storage medium stores computer instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-5.

8. An electronic device, characterized in that, include: Memory and processor; The memory is used to store computer instructions; The processor is configured to invoke computer instructions stored in the memory, causing the electronic device to perform the method as described in any one of claims 1-5.

Images