Blockchain security protection system, method and electronic device

Abstract

The present disclosure provides a blockchain security protection system, method and electronic device, comprising a presentation layer, an application layer, a service layer, a data layer, a data collection layer and a function module layer; the data collection layer is used for collecting local resource data of a to-be-detected blockchain and monitoring target security events of the to-be-detected blockchain; the data layer is used for storing the local resource data uploaded by the data collection layer and / or the target security events; the application layer is used for providing a plurality of business microservices; the presentation layer is used for submitting an interactive interface for a user and generating display content, and displaying the display content through the interactive interface; and the function module layer is used for providing function services for the to-be-detected blockchain. The system realizes all-round, real-time and intelligent security protection of the blockchain system, significantly improves the security, availability, compliance and operability of the system, and provides a solid and reliable security base for the large-scale landing of the blockchain in high-value scenarios such as finance, government affairs and supply chain.

Description

Technical Field

[0001] This disclosure relates to the field of blockchain technology, and in particular to a blockchain security protection system, method, and electronic device. Background Technology

[0002] Blockchain technology, with its core characteristics of decentralization, data immutability, and operational traceability, has achieved large-scale application in several key areas such as financial payments, digital government, supply chain traceability, and evidence storage and authentication. However, with the increasing complexity of application scenarios and the evolution of attack methods, blockchain systems have exposed a series of deep-seated security risks during actual operation, urgently requiring the construction of a proactive monitoring and response mechanism that covers the entire stack and runs throughout the entire process. Summary of the Invention

[0003] This disclosure aims to at least partially address one of the technical problems in the related art.

[0004] Therefore, one purpose of this disclosure is to propose a blockchain security protection system.

[0005] The second objective of this disclosure is to propose a method for blockchain security protection.

[0006] The third objective of this disclosure is to propose an electronic device.

[0007] The fourth objective of this disclosure is to provide a non-transitory computer-readable storage medium.

[0008] The fifth objective of this disclosure is to provide a computer program product.

[0009] To achieve the above objectives, a first aspect of this disclosure proposes a blockchain security protection system, comprising: a presentation layer, an application layer, a service layer, a data layer, a data acquisition layer, and a functional module layer; wherein, the data acquisition layer is used to collect local resource data of the blockchain under test and monitor target security events of the blockchain under test; the data layer is used to store the local resource data and / or target security events uploaded by the data acquisition layer; the application layer is used to provide various business microservices, and the microservices are used to perform corresponding microservice processing on the local resource data and / or target security events uploaded by the data acquisition layer; the presentation layer is used to receive user instructions, provide an interactive interface for the user, and generate display content based on the local resource data and / or target security events uploaded by the data acquisition layer, and display the display content through the interactive interface; the functional module layer is used to provide functional services for the blockchain under test, and the service layer is used to provide a blockchain SDK adapter and a Prometheus data collector.

[0010] According to one embodiment of this disclosure, the business microservices include a node monitoring service, a transaction analysis service, a contract security service, a strategy management service, and a data statistics service. The node monitoring service is used to monitor the health status, malicious behavior, and illegal connections of the blockchain under test. The transaction analysis service is used to perform compliance checks, transaction risk identification, and authorization verification on the blockchain under test. The contract security service is used to scan for vulnerabilities in the smart contracts of the blockchain under test and monitor the execution results. The strategy management service is used to provide dynamic configuration and management of different types of monitoring thresholds. The data statistics service is used to aggregate and analyze the on-chain and off-chain data of the blockchain under test and generate visual reports.

[0011] According to one embodiment of this disclosure, the application layer is further configured to provide an API gateway for providing proxying, routing, authentication, rate limiting, and logging for external requests.

[0012] According to one embodiment of this disclosure, the functional module layer includes a hardware risk warning module, a network risk warning module, a transaction content compliance module, a node malicious behavior monitoring module, and an attack event recording module; wherein, the hardware risk warning module is used to monitor the CPU, memory, and disk usage of the blockchain under test; the network risk warning module is used to monitor the uplink / downlink packet loss rate of the blockchain under test; the transaction content compliance module is used to match sensitive words and illegal words in the on-chain transaction content of the blockchain under test to determine whether there are any illegal transactions; the node malicious behavior monitoring module is used to detect node malicious behavior through bottom-chain embedding; and the attack event recording module is used to identify on-chain attack behavior of the blockchain under test.

[0013] According to one embodiment of this disclosure, the hardware risk warning module is further configured to: generate warning information in response to the CPU and / or memory and / or disk of the blockchain under test exceeding a threshold.

[0014] According to one embodiment of this disclosure, the network risk warning module is further configured to: generate alarm information in response to detecting an abnormality in the uplink / downlink packet loss rate of the blockchain to be detected.

[0015] According to one embodiment of this disclosure, the transaction content compliance module is further configured to: match the on-chain transaction content with a sensitive word database and an illegal word database; in response to a successful match, record the successfully matched portion of the on-chain transaction content and prevent subsequent reading of the on-chain transaction content.

[0016] According to one embodiment of this disclosure, the system is further configured to: in response to a successful match, obtain transaction object information corresponding to the on-chain transaction content; update the transaction object information to a blacklist, wherein the blacklist is used to store object information that is prohibited from being traded.

[0017] To achieve the above objectives, a second aspect of this disclosure proposes a blockchain security protection method, comprising: monitoring and protecting the blockchain to be tested through a blockchain security protection system, wherein the blockchain security protection system is the system described in the first aspect embodiment.

[0018] To achieve the above objectives, a third aspect of this disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to implement the blockchain security protection method as described in the second aspect of this disclosure.

[0019] To achieve the above objectives, a fourth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to implement the blockchain security protection method as described in the second aspect of this disclosure.

[0020] To achieve the above objectives, a fifth aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, is used to implement the blockchain security protection method as described in the second aspect of this disclosure.

[0021] This system effectively addresses the shortcomings of existing blockchain security solutions, such as single monitoring dimensions, delayed response, difficulty in expansion, and weak compliance, through a technical approach of layered decoupling, microservice governance, multi-source fusion, and dynamic response. It achieves comprehensive, real-time, and intelligent security protection for blockchain systems, significantly improving the system's security, availability, compliance, and maintainability. This provides a solid and reliable security foundation for the large-scale deployment of blockchain in high-value scenarios such as finance, government affairs, and supply chain. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of a blockchain security protection method according to one embodiment of the present disclosure;

[0023] Figure 2 This is a schematic diagram of the structure of a business microservice according to one embodiment of this disclosure; Figure 3 This is a schematic diagram of the structure of an application layer according to one embodiment of this disclosure; Figure 4This is a schematic diagram of the structure of a functional module layer according to one embodiment of this disclosure; Figure 5 This is a schematic diagram illustrating one embodiment of the present disclosure of periodically reporting hardware monitoring data to Prometheus via a blockchain node; Figure 6 This is a schematic diagram illustrating a node reporting network traffic data to Prometheus according to one embodiment of this disclosure; Figure 7 This is a schematic diagram illustrating a system that uses blockchain and SDK to subscribe to transaction data according to one embodiment of the present disclosure; Figure 8 This is a diagram illustrating a malicious node attempting to modify an account balance or initiate an illegal transaction, according to one embodiment of this disclosure. Figure 9 This is a schematic diagram illustrating a user-initiated contract call containing a random number, according to one embodiment of this disclosure; Figure 10 This is a schematic diagram of a blockchain security protection method according to one embodiment of the present disclosure. Figure 11 This is a schematic diagram of an electronic device according to one embodiment of the present disclosure. Detailed Implementation

[0024] Embodiments of this disclosure are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0025] The acquisition, storage, use, and processing of data in this disclosed technical solution all comply with the relevant provisions of relevant laws and regulations.

[0026] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0027] Current blockchain security threats mainly manifest in the following four aspects: (1) Node security risks: Malicious nodes may access the network by forging identities, launch Sybil Attacks, or disrupt consensus; legitimate nodes may also exhibit abnormal behavior due to resource overload, misconfiguration, or remote control, threatening the overall stability of the network.

[0028] (2) Contract security risks: Once deployed, smart contracts are difficult to modify. If their code has defects such as reentrancy vulnerabilities, integer overflow, or missing permission verification, they are easily exploited by attackers, leading to theft of assets or loss of control of business logic.

[0029] (3) Transaction security risks: On-chain transactions may carry sensitive information (such as personal identity, trade secrets) or illegal content, and there is a lack of effective verification mechanism for the authenticity of the identity and legality of the authorization of the transaction initiator.

[0030] (4) Network and hardware risks: The underlying infrastructure on which nodes rely (such as CPU, memory, and bandwidth) may suffer from DDoS attacks, resource depletion, or hardware failures, which may cause service interruptions or performance degradation, thereby affecting the availability of the entire chain.

[0031] To address the aforementioned issues, this disclosure proposes a blockchain security protection system. Figure 1 This is a schematic diagram of a blockchain security protection system according to one embodiment of the present disclosure, such as... Figure 1 As shown, the blockchain security protection system 100 includes: a presentation layer 110, an application layer 120, a service layer 130, a data layer 140, a data acquisition layer 150, and a functional module layer 160.

[0032] The data acquisition layer 150 is used to collect local resource data of the blockchain under test and monitor target security events of the blockchain under test.

[0033] In this embodiment of the disclosure, the data acquisition layer 150 serves as the perception front end of the system, responsible for actively collecting multi-dimensional raw data from the blockchain node to be detected and its operating environment, and monitoring predefined target security events in real time.

[0034] In one possible implementation, the data acquisition layer 150 may deploy a lightweight data acquisition agent on each node of the blockchain to be inspected. This agent may have one or more of the following capabilities: Local resource monitoring: Periodically collect system-level metrics such as CPU utilization, memory usage, disk I / O, network traffic, and process status.

[0035] On-chain behavior tracking: Through Hook or event subscription mechanisms, monitor key operations of the underlying blockchain engine, such as block generation failure, transaction verification anomalies, illegal P2P connection requests, and consensus voting anomalies.

[0036] Security event triggering mechanism: When a security event that meets the preset rules is detected (such as "a single node initiates a large number of invalid transactions in a short period of time" or "a non-whitelisted IP attempts to access the consensus group"), a structured event log is immediately generated and stamped with a timestamp and node identifier.

[0037] The data acquisition agent supports adaptation to various blockchain base chains (such as Chang'an Chain, Hyperledger Fabric, Ethereum, etc.) and achieves a unified data output format through a plug-in SDK.

[0038] The data layer 140 is used to store local resource data and / or target security events uploaded by the data acquisition layer 150.

[0039] It should be noted that the data layer 140, as the data hub of the system, is responsible for classifying, storing, indexing, and efficiently querying the local resource data and / or target security events uploaded by the data acquisition layer 150.

[0040] In one possible implementation, data layer 140 may employ a multi-model database collaborative architecture, for example as follows: Time-series databases (such as Prometheus + Thanos, InfluxDB).

[0041] Store local resource metrics with timestamps (such as CPU% and network throughput), supporting efficient time-range aggregation, downsampling, and trend analysis.

[0042] Relational databases (such as PostgreSQL and MySQL).

[0043] It stores structured business data, including node metadata, security event details, user configurations, monitoring policies, alarm records, etc., ensuring transaction consistency and the ability to perform complex relational queries.

[0044] Caching databases (such as Redis): Cache frequently accessed data (such as the current list of active nodes, the blacklist of sensitive addresses, and real-time risk scores) to significantly reduce application layer 120 response latency.

[0045] Application layer 120 is used to provide a variety of business microservices, which are used to process local resource data and / or target security events uploaded by data acquisition layer 150.

[0046] Application layer 120 serves as the intelligent processing core of the system, providing a set of highly cohesive and loosely coupled business microservices to perform professional analysis and processing of raw data from data layer 140. The microservice architecture supports independent iteration and elastic scaling, ensuring stable operation of the system under high load; services are decoupled through message queues (such as Kafka) or API gateways to improve overall robustness.

[0047] Presentation layer 110 is used to receive user instructions and provide interactive interfaces for users, and to generate display content based on local resource data and / or target security events uploaded by data acquisition layer 150, and display the display content through the interactive interface.

[0048] Presentation layer 110 serves as the sole interaction point between the system and the user, providing a visual operation interface and real-time situational awareness capabilities.

[0049] In one possible implementation, the presentation layer 110 may include the following functionalities: Unified user interface: Built on a web front-end framework (such as React, Vue) and supports access from multiple terminals.

[0050] Command reception: Receives user configuration commands for monitoring strategies, alarm thresholds, node grouping, etc., and forwards them to the application layer 120 through the API gateway.

[0051] Content generation and display.

[0052] It displays a real-time heatmap of the entire network's security situation and a topology diagram of node health status.

[0053] List the latest warning events (including time, time, event type, and risk level).

[0054] Provide multi-dimensional statistical reports (such as "Distribution of Contract Vulnerabilities in the Past 7 Days" and "Ranking of High-Frequency Abnormal IPs").

[0055] Supports drill-down analysis (click on a node to view its detailed resource curves and event flow).

[0056] Functional module layer 160 is used to provide functional services for the blockchain to be tested.

[0057] Service layer 130 is used to provide the blockchain SDK adapter and Prometheus data collector.

[0058] The blockchain SDK adapter encapsulates the underlying blockchain SDK, providing a unified interface for upper-layer applications to access chain data. It is responsible for subscribing to blocks and transaction events, querying on-chain information, and submitting transactions, thus decoupling the application layer from the underlying chain technology.

[0059] Prometheus Data Collector: Acting as a bridge between the system and the monitoring infrastructure. It periodically pulls hardware metrics, network metrics, and underlying blockchain data reported by blockchain nodes from Prometheus, such as malicious node activity and random number attack events. This proactive data retrieval mode ensures the real-time nature and proactivity of the monitoring data.

[0060] This system effectively addresses the shortcomings of existing blockchain security solutions, such as single monitoring dimensions, delayed response, difficulty in expansion, and weak compliance, through a technical approach of layered decoupling, microservice governance, multi-source fusion, and dynamic response. It achieves comprehensive, real-time, and intelligent security protection for blockchain systems, significantly improving the system's security, availability, compliance, and maintainability. This provides a solid and reliable security foundation for the large-scale deployment of blockchain in high-value scenarios such as finance, government affairs, and supply chain.

[0061] In one possible implementation, such as Figure 2 As shown, the business microservices include node monitoring service 210, transaction analysis service 220, contract security service 230, strategy management service 240, and data statistics service 250.

[0062] Among them, the node monitoring service 210 is used to monitor the health status, malicious behavior, and illegal connections of the blockchain to be tested.

[0063] It should be noted that the health status assessment is based on local resource indicators (such as CPU utilization, memory usage, disk space remaining, and network latency) reported by the data collection layer 150, combined with on-chain behavior (such as block synchronization delay and transaction pool backlog), to calculate a comprehensive health score for the node; when the score is below the threshold, it is marked as "sub-healthy" or "out of contact".

[0064] Malicious behavior identification involves analyzing node consensus behavior logs to identify typical malicious patterns, such as refusing to vote or casting contradictory votes in PoA / PBFT-type consensus mechanisms. Frequent broadcasting of invalid blocks or duplicate transactions, such as registering multiple nodes with similar identities within a short period of time, will be judged by the system based on a predefined rule base or a lightweight anomaly detection model (such as an isolated forest).

[0065] Unauthorized connection monitoring, such as listening to P2P network connection events, comparing whitelist / blacklist policies, and identifying connection requests from unauthorized IP ranges; triggering real-time alarms for high-frequency scanning, port brute-force attacks, and other behaviors.

[0066] Transaction analytics service 220 is used to perform compliance checks, transaction risk identification, and authorization verification on the blockchain under test.

[0067] It should be noted that the compliance check involves parsing the transaction payload and combining it with a built-in or user-defined sensitive word library and compliance rule engine to identify transactions containing political, pornographic, fraudulent, or personal privacy information (such as ID card numbers and bank card numbers); it supports regular expression matching, keyword fuzzy matching, and NLP semantic analysis.

[0068] Transaction risk identification involves analyzing fund flows based on transaction graphs to identify high-risk patterns, such as rapid fund aggregation followed by dispersed transfers (money laundering characteristics), interaction with known blacklisted addresses, unusually large transfers or frequent small-amount probing, and the use of graph neural networks (GNNs) or rule-based scoring cards to calculate risk scores.

[0069] Authorization verification verifies whether the transaction initiator has the necessary permissions, and may include: Does the smart contract call comply with the ACL (Access Control List)? Does the multi-signature transaction meet the signature threshold? Whether cross-chain transactions have undergone legitimate bridging verification, etc.

[0070] Contract Security Service 230 is used for vulnerability scanning and execution result monitoring of smart contracts on the blockchain under investigation.

[0071] The strategy management service 240 is used to provide dynamic configuration and management of different types of monitoring thresholds.

[0072] In the embodiments disclosed herein, such as Figure 3 As shown, the application layer 120 is also used to provide an API gateway, which is used to provide proxying, routing, authentication, rate limiting and logging for external requests.

[0073] Data statistics service 250 is used to aggregate and analyze on-chain and off-chain data of the blockchain under test and generate visual reports.

[0074] In this embodiment, the API gateway serves as the system's sole entry point, handling all external requests, including proxying, routing, authentication, rate limiting, and logging. It effectively shields the complex structure of the internal microservices, enhancing system security and manageability.

[0075] In the embodiments disclosed herein, such as Figure 4 As shown, the functional module layer 160 includes a hardware risk warning module 410, a network risk warning module 420, a transaction content compliance module 430, a node malicious monitoring module 440, and an attack event recording module 450.

[0076] Among them, the hardware risk warning module 410 is used to monitor the CPU, memory, and disk usage of the blockchain to be tested.

[0077] In the embodiments disclosed herein, such as Figure 5 As shown, hardware monitoring data can be reported to Prometheus on a regular basis through blockchain nodes, and the hardware risk warning module can pull data from Prometheus through a scheduled task.

[0078] In one possible implementation, the hardware risk warning module is also used to generate warning information in response to the CPU and / or memory and / or disk of the blockchain under test exceeding a threshold.

[0079] In one possible implementation, users can view the alert information through a web interface.

[0080] The network risk warning module 420 is used to monitor the uplink / downlink packet loss rate of the blockchain under test.

[0081] In the embodiments disclosed herein, such as Figure 6 As shown, nodes report network traffic data to Prometheus. The network risk warning module pulls the data and compares it with the threshold. If the traffic or packet loss rate is abnormal, a network warning is generated and the warning information is displayed in the management interface.

[0082] The transaction content compliance module 430 is used to match sensitive words with illegal words in the on-chain transaction content of the blockchain to be inspected, and to determine whether there are any illegal transactions.

[0083] In the embodiments disclosed herein, such as Figure 7 As shown, the system can subscribe to transaction data via the blockchain through the SDK, then parse the transaction input / output parameters into text, and then match them with sensitive word databases and illegal word databases. If a match is found, the illegal content is recorded and the transaction is blocked from being read further. The illegal transaction information is written into the transaction information table and the blacklist.

[0084] The node malicious behavior monitoring module 440 is used to detect malicious node behavior through bottom chain embedding.

[0085] In the embodiments disclosed herein, such as Figure 8 As shown, malicious nodes attempt to modify account balances or initiate illegal transactions. The underlying blockchain infrastructure captures this malicious activity and reports it to Prometheus. The node malicious monitoring module periodically pulls and parses the data, storing the malicious records in a node malicious table. Users can query the list of malicious nodes through the interface.

[0086] The attack event logging module 450 is used to identify on-chain attack behaviors on the blockchain to be detected.

[0087] In the embodiments disclosed herein, such as Figure 9 As shown, a user initiates a contract call containing a random number. The consensus nodes fail to reach a consensus due to the random number, triggering a data entry point. This data is reported to Prometheus, and the attack event recording module retrieves the data and records it in the random number attack record table. Users can query attack event details through the interface.

[0088] Figure 10 This is a schematic diagram of a blockchain security protection method according to one embodiment of the present disclosure, such as... Figure 10 As shown, the method includes: S1010 uses a blockchain security protection system to monitor and protect the blockchain under test.

[0089] It should be noted that the blockchain security protection system in this embodiment is... Figure 1-9 The blockchain security protection system shown in the embodiment.

[0090] To implement the above embodiments, this disclosure also proposes an electronic device 1100. Figure 11 This is a schematic diagram of an electronic device according to one embodiment of the present disclosure, such as... Figure 11 As shown, the electronic device 1100 includes: a processor 1101 and a memory 1102 communicatively connected to the processor. The memory 1102 stores instructions executable by at least one processor. The instructions are executed by at least one processor 1101 to implement the functions described in this disclosure. Figure 10 Blockchain security protection method of the embodiment.

[0091] To implement the above embodiments, this disclosure also proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to implement the present disclosure. Figure 10 Blockchain security protection method of the embodiment.

[0092] To implement the above embodiments, this disclosure also proposes a computer program product, including a computer program, which, when executed by a processor, implements the features of this disclosure. Figure 10 Blockchain security protection method of the embodiment.

[0093] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0094] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0095] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0096] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0097] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0098] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that contains, stores, communicates, propagates, or transmits programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0099] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0100] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0101] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0102] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A blockchain security protection system, characterized in that, include: Presentation layer, application layer, service layer, data layer, data acquisition layer, and functional module layer; The data acquisition layer is used to collect local resource data of the blockchain under test and monitor target security events of the blockchain under test. The data layer is used to store local resource data and / or target security events uploaded by the data acquisition layer; The application layer is used to provide a variety of business microservices, and the microservices are used to process the local resource data and / or target security events uploaded by the data acquisition layer. The presentation layer is used to receive user instructions, provide an interactive interface for the user, generate display content based on local resource data and / or target security events uploaded by the data acquisition layer, and display the display content through the interactive interface. The functional module layer is used to provide functional services for the blockchain to be tested; The service layer is used to provide a blockchain SDK adapter and a Prometheus data collector.

2. The system according to claim 1, characterized in that, The business microservices include node monitoring service, transaction analysis service, contract security service, strategy management service, and data statistics service; The node monitoring service is used to monitor the health status, malicious behavior, and illegal connections of the blockchain under test. The transaction analysis service is used to perform compliance checks, transaction risk identification, and authorization verification on the blockchain to be tested. The contract security service is used to scan for vulnerabilities in the smart contracts of the blockchain under test and monitor the execution results. The strategy management service is used to provide dynamic configuration and management of different types of monitoring thresholds; The data statistics service is used to aggregate and analyze the on-chain and off-chain data of the blockchain under test and generate visual reports.

3. The system according to claim 1, characterized in that, The application layer is also used to provide an API gateway, which is used to provide proxying, routing, authentication, rate limiting and logging for external requests.

4. The system according to claim 1, characterized in that, The functional module layer includes a hardware risk warning module, a network risk warning module, a transaction content compliance module, a node malicious monitoring module, and an attack event recording module. The hardware risk warning module is used to monitor the CPU, memory, and disk usage of the blockchain under test. The network risk early warning module is used to monitor the uplink / downlink packet loss rate of the blockchain under test; The transaction content compliance module is used to match sensitive words and illegal words in the on-chain transaction content of the blockchain to be tested to determine whether there are any illegal transactions. The node malicious behavior monitoring module is used to detect malicious behavior of nodes through bottom chain embedding. The attack event recording module is used to identify on-chain attack behaviors on the blockchain to be detected.

5. The system according to claim 4, characterized in that, The hardware risk warning module is also used for: A warning message is generated when the CPU and / or memory and / or disk of the blockchain under test exceed a threshold.

6. The system according to claim 4, characterized in that, The network risk early warning module is also used for: An alarm message is generated in response to the detection of an abnormal uplink / downlink packet loss rate of the blockchain under test.

7. The system according to claim 4, characterized in that, The transaction content compliance module is also used for: The on-chain transaction content is matched with sensitive word databases and illegal word databases; In response to a successful match, the successfully matched portion of the on-chain transaction content is recorded, and subsequent reading of the on-chain transaction content is prevented.

8. The system according to claim 7, characterized in that, The system is also used for: Upon successful matching, obtain the transaction object information corresponding to the on-chain transaction content; The transaction object information is updated to the blacklist, which is used to store information on prohibited transactions.

9. A blockchain security protection method, characterized in that, include: The blockchain security protection system monitors and protects the blockchain under test, and the blockchain security protection system is the system as described in any one of claims 1-8.

10. An electronic device, characterized in that, Including memory and processor; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in claim 9.

Images