Blockchain traceable communication data traceable processing method and system

Abstract

The application discloses a kind of communication data credible traceability processing method and system of blockchain traceability, its method includes the following steps: S1: communication data credible collection and on-chain evidence;S2: communication behavior association relationship construction;S3: abnormal communication behavior identification.The application realizes the whole-process closed-loop management of communication data from credible evidence, abnormal detection, propagation traceability, influence evaluation to risk early warning and intelligent disposal by constructing communication behavior association graph, abnormal propagation relationship model and risk evolution prediction model, not only can accurately locate abnormal source node, can restore abnormal formation process and analyze abnormal propagation path and influence range, but also can predict the development trend of communication network risk in advance, automatically generate disposal strategy and complete on-chain credible audit, so as to effectively improve the accuracy of communication data traceability, troubleshooting efficiency, risk early warning capability and the security, reliability and intelligent management level of communication network.

Description

Technical Field

[0001] This invention relates to the field of trusted traceability processing technology for communication data, and in particular to a trusted traceability processing method and system for communication data using blockchain traceability. Background Technology

[0002] With the rapid development of industrial internet, energy internet, smart cities and IoT communication networks, the scale of communication data has exploded. Existing blockchain-based communication data traceability solutions mainly achieve communication data source verification and responsibility traceability through hash storage, timestamp recording and on-chain tracking. The existing technology still has the following problems: 1. Most existing systems can only record the generation and flow of communication data. When data anomalies, data tampering or communication failures occur, they can only trace the abnormal nodes and cannot analyze the cause of abnormal data formation, propagation process and scope of impact. Existing blockchain traceability systems mainly adopt a post-event query mode, which lacks the ability to predict the evolution trend of abnormal behavior, makes it difficult to detect potential risks in a timely manner and automatically generate disposal strategies, and fails to achieve proactive defense. In summary, this application proposes a reliable traceability processing method and system for blockchain traceability communication data. Summary of the Invention

[0003] Based on the technical problems existing in the background technology, this invention proposes a reliable traceability processing method and system for blockchain traceability communication data.

[0004] This invention proposes a trusted traceability processing method for communication data in blockchain traceability, comprising the following steps: S1: Trusted collection and on-chain storage of communication data: Collect communication message data, device operation log data, network traffic data, node status data and link status data in the communication network, perform hash operation on the collected data to generate data fingerprints, and write the data fingerprints, timestamp information and node identity information into the blockchain to complete trusted storage. S2: Construction of Communication Behavior Relationships: Construct a communication behavior relationship graph based on the sending node, receiving node, communication protocol, data flow direction, and time relationship of the communication data, and establish a relationship model between nodes; S3: Abnormal Communication Behavior Identification: Based on the communication behavior association map, abnormal communication behavior is detected, the abnormal index of each communication node is calculated, and abnormal communication nodes are identified. S4: Anomaly formation process source tracing analysis: Starting from the abnormal communication node, an anomaly propagation relationship model is established in conjunction with the aforementioned communication behavior correlation graph. The propagation path, propagation direction and propagation contribution during the formation of abnormal data are analyzed to determine the anomaly source node and anomaly propagation link. S5: Assessment of the scope of impact of anomalies: Based on the anomaly propagation path, the contribution of anomaly propagation, and the distribution of anomaly nodes, the scope of impact of anomalies is assessed to obtain the anomaly impact level; S6: Risk Evolution Trend Prediction: Based on historical communication data, real-time anomaly index, anomaly propagation results, and anomaly impact levels, a risk evolution model is constructed to predict the future risk change trend of the communication network. S7: Comprehensive Risk Assessment and Early Warning Generation: Calculate the comprehensive risk index based on the anomaly index, the contribution of anomaly propagation, the level of anomaly impact, and the risk trend prediction results, and generate corresponding risk early warning information; S8: Intelligent Decision-Making and Trusted Audit: Generate intelligent handling strategies based on comprehensive risk index, abnormal propagation links and historical handling cases, and write the abnormal analysis results, risk warning results and handling strategies into the blockchain to form a trusted audit record.

[0005] Preferably, in step S3, the anomaly index is calculated by integrating multiple dimensions such as traffic anomaly, behavior deviation, node credibility, and link anomaly degree. The formula for calculating the comprehensive index is as follows: ; in This represents the anomaly index of the i-th communication node. Indicates the degree of traffic anomaly. Indicates the degree of deviation in communication behavior. This represents the node's credibility decay value. Indicates the link anomaly degree. , , , Represents the weighting coefficient, when If so, the node is determined to be an abnormal communication node, where Indicates the threshold for anomaly detection; The formula for calculating the flow anomaly degree is: ,in This represents the node's traffic at the current moment. This represents the historical average flow rate; the greater the deviation in flow rate, the higher the probability of an anomaly. The formula for calculating the deviation of communication behavior is: ,in Indicates the number of nodes associated in the current periodic communication. This indicates the number of communication-related nodes under normal historical conditions, used to identify abnormal scanning and connection behavior; The formula for calculating the node credibility decay value is as follows: The node credibility score is: This represents the number of normal communications. Indicates the number of abnormal communications; Credibility decay value: The lower the credibility, the higher the risk of anomalies. Link anomaly calculation: ;in Indicates the packet loss rate of the link. Indicates the maximum allowable packet loss rate. Indicates the link delay increment. Indicates the maximum delay increment. This represents the adjustment coefficient.

[0006] Preferably, the specific logical steps of S4 are as follows: S401: Extract the abnormal communication nodes identified in S3 and the nodes that have direct or indirect communication relationships with them, and construct an abnormal propagation analysis subgraph: ; in This represents a subgraph representing the anomaly propagation analysis. This represents the set of abnormally associated nodes and the set of abnormally associated edges. Simultaneously extract the anomaly index corresponding to each node: ; in This represents the anomaly index of node i; S402: Constructing an anomaly propagation relationship model: Construct anomaly propagation weights based on communication frequency, data traffic, and temporal correlation in the communication behavior correlation graph, where the propagation weights between nodes are defined as follows: ; in This represents the propagation weight from node i to node j. Indicates communication frequency weights. Indicates data flow weight. Indicates the time-related weight. , , These are the weighting coefficients; The propagation relationship model is represented as follows: ,in Represents the propagation weight matrix; S403: Calculate the anomaly propagation probability: Normalize the propagation weights to obtain the anomaly propagation probability matrix: , ; in This represents the probability that an anomaly propagates from node i to node j, where m represents the number of nodes associated with node i. An anomaly propagation probability network is obtained to reflect the probability of an anomaly spreading from one node to neighboring nodes; S404: Calculate Node Propagation Contribution: Calculate the node propagation contribution to analyze the role of each node in the anomaly formation process. The formula used is as follows: ; in This represents the propagation contribution of node j. This represents the anomaly index of node i. Indicates the probability of abnormal propagation. This indicates the number of nodes associated with the anomaly. The greater the contribution of the node to the propagation, the greater its influence on the spread of the anomaly. The contribution was then normalized. ,in Indicates the contribution of normalized propagation; S405: Reverse Tracing of Anomaly Propagation Path: A reverse search is performed based on the propagation probability matrix and the propagation contribution matrix to determine the source node of the anomaly. The formula used to define the credibility of the source node is as follows: ; in Indicates the credibility of the node source. Indicates an abnormality index. Indicates the contribution of normalized propagation. Indicates the frequency of historical anomalies. , , These are the weighting coefficients; Nodes that satisfy the following formula are selected as candidate anomaly source nodes: And trace back along the communication link in reverse: ; in Indicates the source node of the anomaly. Indicates the final abnormal node; A set of abnormal propagation paths is formed; S406: Generate anomaly formation process tracing results: Construct an anomaly propagation link tree based on the anomaly source node, propagation path, and propagation contribution. ; in Represents the anomaly propagation tree. Represents a set of abnormal propagation paths. Represents the set of contributions to the spread; Further calculation of the scope of the anomaly's impact: ,in Indicating the scope of the abnormal impact index. This indicates the number of nodes affected by the anomaly. Indicates the total number of nodes in the network; Final output: anomaly source node, key propagation node, anomaly propagation direction, anomaly propagation path, anomaly propagation contribution, and anomaly impact range.

[0007] Preferably, in step S5, when assessing the impact range of an abnormal event, an abnormal impact assessment model is constructed based on the abnormal propagation links, propagation contribution, and abnormal node distribution obtained in step S4. First, the proportion of affected nodes in the abnormal propagation links to the total number of network nodes is calculated to obtain the node impact factor N; then, the proportion of links covered by the abnormal propagation links to the total number of network links is calculated to obtain the link impact factor L; finally, the average propagation contribution value is calculated based on the propagation contribution of each node to obtain the propagation impact factor C; and finally, the topology impact factor T is calculated by combining the importance of the abnormal nodes in the network topology. Finally, a comprehensive abnormal impact index is calculated using the following formula: ; , , , ; in Indicates the abnormal impact index. Indicates the number of nodes affected by the anomaly. Indicates the total number of nodes in the network. Indicates the number of links affected by the anomaly. Indicates the total number of network links. This represents the normalized propagation contribution of the i-th node. Indicates the topological importance of nodes. Indicates the number of abnormal nodes. , ... Indicates the weighting coefficient; Finally, the levels are classified according to the abnormal impact index I. When it is judged to be of low impact level, when When it is determined to be of a general impact level, when When it is judged to be of a higher impact level, when The event is classified as having a significant impact level, thereby obtaining an assessment of the scope of the abnormal event's impact. The assessment results are then sent to S6 for risk evolution trend prediction.

[0008] Preferably, the specific logical steps of S6 are as follows: S601: Constructing a risk evolution analysis dataset: Obtain the anomaly index output by S3, the anomaly propagation results output by S4, and the anomaly impact level output by S5, and construct a risk evolution analysis dataset by combining it with historical communication data. ; in This represents a dataset for risk evolution analysis. Indicates the anomaly index at the current moment. Indicates the contribution to the spread at the current moment. This indicates the index of abnormal impact at the current moment. This represents historical risk status data; S602: Calculate the current comprehensive risk status value: The current comprehensive risk status value is obtained by integrating the anomaly index, the propagation contribution, and the impact index. The calculation formula is as follows: ; in This indicates the current overall risk status value. , , Indicates the weighting coefficient; S603: Establish a risk evolution trend model: Analyze the correlation between the current risk state and historical risk states to construct a risk evolution model. ; in This indicates the predicted risk value for the next moment. This indicates the current risk status value. This represents the historical average risk level. This represents the risk evolution adjustment coefficient; This model enables dynamic iterative prediction of risk status; S604: Calculate the rate of risk change: Calculate the rate of risk change between adjacent time points to determine the direction and speed of risk development. The calculation formula is as follows: ; in Indicates the rate of change of risk. This indicates the current risk value. Indicates the predicted risk value; when When this occurs, it indicates that the risk is trending upward. When this time, it indicates that the risk is trending downward; S605: Output Risk Evolution Trend Results: Generate risk evolution trend results based on the predicted risk value and the rate of risk change; when the following conditions are met... At that time, it was determined that the communication network exhibited a high-risk evolutionary trend; in Indicates the risk warning threshold; Final outputs: predicted risk value, rate of risk change, direction of risk development, and risk trend level; The prediction results will be sent to S7 for comprehensive risk assessment and early warning generation.

[0009] Preferably, the specific logical steps of S7 are as follows: S701: Constructing a Comprehensive Risk Assessment Dataset: Obtain data output from the anomaly detection, anomaly propagation analysis, impact assessment, and risk prediction stages to construct a comprehensive risk assessment dataset. ; in This represents a comprehensive risk assessment dataset. Indicates the current abnormal index. Indicates the current contribution to the spread. Indicates the abnormal impact index. This represents the predicted value of risk trends; S702: Calculate the comprehensive risk index: Perform a weighted fusion calculation on each risk factor to obtain the comprehensive risk index: ; in This represents the overall risk index. Indicates an abnormality index. Indicates contribution to dissemination. Indicates the abnormal impact index. This represents the predicted value of risk trends. , , , Indicates the weighting coefficient; S703: Calculating the Risk Growth Factor: The risk growth factor is calculated based on the current risk value and the predicted risk value to further reflect the risk development trend. The formula used is as follows: ; in Indicates risk growth factor, Indicates the predicted risk value. This represents the current comprehensive risk index; the larger the risk growth factor, the more obvious the risk evolution trend. S704: Determining the Risk Warning Level: The warning score is calculated based on the comprehensive risk index and risk growth factor, using the following formula: ; in Indicates the warning score. , This represents the weighting coefficient, used to classify risk levels based on the early warning score: Level 1 Low Risk It is classified as a level 2 general risk. Level 3, relatively high risk. It is classified as a Level 4 major risk; S705: Generate risk warning information: Generate corresponding risk warning information based on the warning level and output it. ; in Indicates the warning result, Indicates the warning level. Indicates the warning score. This represents the overall risk index. Indicates risk growth factor; Ultimately, an early warning message is generated, which includes the abnormal source node, key propagation path, scope of impact, risk level, and development trend, and is sent to S8 Intelligent Decision and Trusted Audit.

[0010] Preferably, the specific logical steps of S8 are as follows: S801: Constructing an intelligent decision analysis dataset: Obtain comprehensive risk index, anomaly propagation chain, anomaly source node, impact range, and historical handling case information to construct an intelligent decision analysis dataset. ; in This represents a decision analysis dataset. This represents the overall risk index. Indicates an abnormal propagation path. Indicates the source node of the anomaly. Indicates the level of impact of the anomaly. This represents a collection of historical cases. S802: Historical Case Matching and Similarity Calculation: Calculates the similarity between the current event and historical cases to filter the historical handling cases that best match the current abnormal event. The formula used is as follows: ; in Let represent the matching similarity of the i-th historical case. Indicates the similarity of risk characteristics. Indicates the similarity of propagation paths, Indicates the influence of similarity level. , , Indicates the weighting coefficient; The most similar historical cases were selected as candidate solutions; S803: Generating the Optimal Response Strategy: Calculate the overall benefit value of each response strategy based on the comprehensive risk index, case matching results, and the degree of dissemination impact. The formula used is as follows: ; in This represents the overall benefit value of the j-th disposal strategy. Indicates risk mitigation capability. Indicates the effectiveness of the disposal and implementation. Indicates the timeliness of the handling. , , Indicates the weighting coefficient; The optimal handling strategy is determined, and the generated strategies include: isolation of abnormal nodes, blocking of abnormal links, traffic rate limiting, switching to backup links, distribution of security policies, and notification of risk alarms. S804: Execution Result Evaluation and Credible Evidence Storage: Generate audit summary information for anomaly analysis results, risk warning results, and handling strategies to achieve credible auditing throughout the entire process. The formula used is as follows: ; in This indicates an audit summary. ( ) represents a hash function. Indicates the processing timestamp; || indicates data concatenation. The audit summary, handling results, and execution status are then written to the blockchain: ; in This indicates blockchain audit records. This serves as a unique identifier for the event, ultimately forming an immutable, verifiable, and traceable trusted audit chain.

[0011] This invention also proposes a blockchain-based trusted traceability processing system for communication data, including a data acquisition module, a blockchain evidence storage module, a communication behavior graph construction module, an anomaly detection module, an anomaly propagation traceability module, an impact assessment module, a risk prediction module, a risk warning module, an intelligent decision-making module, and an on-chain audit module. The data acquisition module is used to collect communication message data, device operation log data, network traffic data, node status data, and link status data. The blockchain evidence storage module is used to generate data fingerprints from communication data and complete trusted blockchain evidence storage. The communication behavior graph construction module is used to construct a communication behavior association graph; The anomaly detection module is used to identify abnormal communication nodes and calculate an anomaly index; The anomaly propagation tracing module is used to analyze the anomaly formation process, determine the anomaly source node, and the anomaly propagation path. The impact assessment module is used to assess the scope and level of impact of abnormal events. The risk prediction module is used to predict the evolution trend of communication network risks; The risk warning module is used to generate risk warning information; The intelligent decision-making module is used to generate anomaly handling strategies; The on-chain audit module is used to record anomaly analysis results, risk warning results, and handling results to form a trusted audit chain.

[0012] Compared with existing technologies, the beneficial effects of this invention are: By constructing a communication behavior correlation graph, an anomaly propagation relationship model, and an anomaly formation process tracing mechanism, we can perform full-link analysis on anomaly communication data. This not only allows us to locate anomaly nodes but also further identify anomaly source nodes, reconstruct anomaly propagation paths, analyze propagation direction and contribution, and assess the scope of anomaly impact. This enables a shift from traditional "anomaly result tracing" to "anomaly formation process tracing," thereby significantly improving the accuracy of locating communication data anomaly events, the efficiency of fault diagnosis, and the ability to trace responsibility. By integrating anomaly indices, anomaly propagation results, anomaly impact levels, and historical communication data to construct risk evolution prediction models and comprehensive risk assessment models, it is possible to predict the development trend of communication network risks in advance. Combined with historical handling cases, it can automatically generate the optimal handling strategy. At the same time, blockchain is used to reliably store the anomaly analysis results, risk warning results, and handling process, realizing proactive risk warning, intelligent decision-making, and full-process reliable auditing, effectively improving the proactive defense capability, security assurance capability, and intelligent management level of communication networks. This invention achieves closed-loop management of communication data throughout the entire process, from trusted storage, anomaly detection, propagation tracing, impact assessment to risk warning and intelligent handling, by constructing a communication behavior correlation graph, anomaly propagation relationship model, and risk evolution prediction model. It can not only accurately locate the anomaly source node, reconstruct the anomaly formation process, and analyze the anomaly propagation path and impact range, but also predict the development trend of communication network risks in advance, automatically generate handling strategies, and complete on-chain trusted audits. This effectively improves the accuracy of communication data tracing, the efficiency of fault diagnosis, the risk warning capability, and the security, reliability, and intelligent management level of the communication network. Attached Figure Description

[0013] Figure 1 This is a flowchart of a blockchain traceability communication data trusted traceability processing method proposed in this invention; Figure 2 This is a block diagram of a blockchain-based trusted traceability processing system for communication data, as proposed in this invention. Detailed Implementation

[0014] The present invention will be further explained below with reference to specific embodiments. Example

[0015] Reference Figure 1 This embodiment proposes a trusted traceability processing method for communication data in blockchain traceability, including the following steps: S1: Trusted collection and on-chain storage of communication data: Collect communication message data, device operation log data, network traffic data, node status data and link status data in the communication network, perform hash operation on the collected data to generate data fingerprints, and write the data fingerprints, timestamp information and node identity information into the blockchain to complete trusted storage. S2: Construction of Communication Behavior Relationships: Construct a communication behavior relationship graph based on the sending node, receiving node, communication protocol, data flow direction, and time relationship of the communication data, and establish a relationship model between nodes; S3: Abnormal Communication Behavior Identification: Based on the communication behavior correlation graph, abnormal communication behavior is detected, the abnormal index of each communication node is calculated, and abnormal communication nodes are identified. The anomaly index integrates multiple dimensions, including traffic anomalies, behavioral deviations, node credibility, and link anomaly levels, for comprehensive calculation. The formula for calculating the comprehensive index is as follows: ; in This represents the anomaly index of the i-th communication node. Indicates the degree of traffic anomaly. Indicates the degree of deviation in communication behavior. This represents the node's credibility decay value. Indicates the link anomaly degree. , , , Represents the weighting coefficient, when If so, the node is determined to be an abnormal communication node, where Indicates the threshold for anomaly detection; The formula for calculating the flow anomaly degree is: ,in This represents the node's traffic at the current moment. This represents the historical average flow rate; the greater the deviation in flow rate, the higher the probability of an anomaly. The formula for calculating the deviation of communication behavior is: ,in Indicates the number of nodes associated in the current periodic communication. This indicates the number of communication-related nodes under normal historical conditions, used to identify abnormal scanning and connection behavior; The formula for calculating the node credibility decay value is as follows: The node credibility score is: ,in Indicates the number of normal communications. Indicates the number of abnormal communications; Credibility decay value: The lower the credibility, the higher the risk of anomalies. Link anomaly calculation: ;in Indicates the link packet loss rate. Indicates the maximum allowable packet loss rate. Indicates the link delay increment. Indicates the maximum delay increment. Indicates the adjustment coefficient; S4: Anomaly formation process source tracing analysis: Starting from the abnormal communication node, an anomaly propagation relationship model is established by combining the communication behavior correlation map, analyzing the propagation path, propagation direction and propagation contribution in the process of abnormal data formation, and determining the anomaly source node and anomaly propagation link; S5: Assessment of the scope of impact of anomalies: Based on the anomaly propagation path, the contribution of anomaly propagation, and the distribution of anomaly nodes, the scope of impact of anomalies is assessed to obtain the anomaly impact level; When assessing the impact range of abnormal events, an abnormal impact assessment model is constructed based on the abnormal propagation links, propagation contributions, and abnormal node distribution obtained from S4. First, the proportion of affected nodes in the abnormal propagation links to the total number of network nodes is calculated to obtain the node impact factor N. Then, the proportion of links covered by the abnormal propagation links to the total number of network links is calculated to obtain the link impact factor L. The average propagation contribution value is calculated based on the propagation contribution of each node to obtain the propagation impact factor C. Simultaneously, the topology impact factor T is calculated by combining the importance of the abnormal nodes in the network topology. Finally, a comprehensive abnormal impact index is calculated, using the following formula: ; , , , ; in Indicates the abnormal impact index. Indicates the number of nodes affected by the anomaly. Indicates the total number of nodes in the network. Indicates the number of links affected by the anomaly. Indicates the total number of network links. This represents the normalized propagation contribution of the i-th node. Indicates the topological importance of nodes. Indicates the number of abnormal nodes. , , , Indicates the weighting coefficient; Finally, the levels are classified according to the abnormal impact index I. When it is judged to be of low impact level, when When it is determined to be of a general impact level, when When it is judged to be of a higher impact level, when When an event is classified as having a significant impact, an assessment of the scope of its impact is obtained, and the assessment results are sent to S6 for risk evolution trend prediction. S6: Risk Evolution Trend Prediction: Based on historical communication data, real-time anomaly index, anomaly propagation results, and anomaly impact levels, a risk evolution model is constructed to predict the future risk change trend of the communication network. S7: Comprehensive Risk Assessment and Early Warning Generation: Calculate the comprehensive risk index based on the anomaly index, the contribution of anomaly propagation, the level of anomaly impact, and the risk trend prediction results, and generate corresponding risk early warning information; S8: Intelligent Decision-Making and Trusted Audit: Generate intelligent handling strategies based on comprehensive risk index, abnormal propagation links and historical handling cases, and write the abnormal analysis results, risk warning results and handling strategies into the blockchain to form a trusted audit record.

[0016] In this embodiment, the specific logical steps of S4 are as follows: S401: Extract the abnormal communication nodes identified in S3 and the nodes that have direct or indirect communication relationships with them, and construct an abnormal propagation analysis subgraph: ; in This represents a subgraph representing the anomaly propagation analysis. Represents the set of abnormal associated nodes. Represents the set of abnormally associated edges; Simultaneously extract the anomaly index corresponding to each node: ; in This represents the anomaly index of node i; S402: Constructing an anomaly propagation relationship model: Construct anomaly propagation weights based on communication frequency, data traffic, and temporal correlation in the communication behavior correlation graph, where the propagation weights between nodes are defined as follows: ; in This represents the propagation weight from node i to node j. Indicates communication frequency weights. Indicates data flow weight. Indicates the time-related weight. , , These are the weighting coefficients; The propagation relationship model is represented as follows: ,in Represents the propagation weight matrix; S403: Calculate the anomaly propagation probability: Normalize the propagation weights to obtain the anomaly propagation probability matrix: , ; in This represents the probability that an anomaly propagates from node i to node j, where m represents the number of nodes associated with node i. An anomaly propagation probability network is obtained to reflect the probability of an anomaly spreading from one node to neighboring nodes; S404: Calculate Node Propagation Contribution: Calculate the node propagation contribution to analyze the role of each node in the anomaly formation process. The formula used is as follows: ; in This represents the propagation contribution of node j. This represents the anomaly index of node i. Indicates the probability of abnormal propagation. This indicates the number of nodes associated with the anomaly. The greater the contribution of the node to the propagation, the greater its influence on the spread of the anomaly. The contribution was then normalized. ,in Indicates the contribution of normalized propagation; S405: Reverse Tracing of Anomaly Propagation Path: A reverse search is performed based on the propagation probability matrix and the propagation contribution matrix to determine the source node of the anomaly. The formula used to define the credibility of the source node is as follows: ; in Indicates the credibility of the node source. Indicates an abnormality index. Indicates the contribution of normalized propagation. Indicates the frequency of historical anomalies. , , These are the weighting coefficients; Nodes that satisfy the following formula are selected as candidate anomaly source nodes: And trace back along the communication link in reverse: ; in Indicates the source node of the anomaly. Indicates the final abnormal node; A set of abnormal propagation paths is formed; S406: Generate anomaly formation process tracing results: Construct an anomaly propagation link tree based on the anomaly source node, propagation path, and propagation contribution. ; in Represents the anomaly propagation tree. Represents a set of abnormal propagation paths. Represents the set of contributions to the spread; Further calculation of the scope of the anomaly's impact: ,in Indicating the scope of the abnormal impact index. This indicates the number of nodes affected by the anomaly. Indicates the total number of nodes in the network; Final output: anomaly source node, key propagation node, anomaly propagation direction, anomaly propagation path, anomaly propagation contribution, and anomaly impact range.

[0017] In this embodiment, the specific logical steps of S6 are as follows: S601: Constructing a risk evolution analysis dataset: Obtain the anomaly index output by S3, the anomaly propagation results output by S4, and the anomaly impact level output by S5, and construct a risk evolution analysis dataset by combining it with historical communication data. ; in This represents a dataset for risk evolution analysis. Indicates the anomaly index at the current moment. Indicates the contribution to the spread at the current moment. This indicates the index of abnormal impact at the current moment. This represents historical risk status data; S602: Calculate the current comprehensive risk status value: The current comprehensive risk status value is obtained by integrating the anomaly index, the propagation contribution, and the impact index. The calculation formula is as follows: ; in This indicates the current overall risk status value. , , Indicates the weighting coefficient; S603: Establish a risk evolution trend model: Analyze the correlation between the current risk state and historical risk states to construct a risk evolution model. ; in This indicates the predicted risk value for the next moment. This indicates the current risk status value. This represents the historical average risk level. This represents the risk evolution adjustment coefficient; This model enables dynamic iterative prediction of risk status; S604: Calculate the rate of risk change: Calculate the rate of risk change between adjacent time points to determine the direction and speed of risk development. The calculation formula is as follows: ; in Indicates the rate of change of risk. This indicates the current risk value. Indicates the predicted risk value; when When this occurs, it indicates that the risk is trending upward. When this time, it indicates that the risk is trending downward; S605: Output Risk Evolution Trend Results: Generate risk evolution trend results based on the predicted risk value and the rate of risk change; when the following conditions are met... At that time, it was determined that the communication network exhibited a high-risk evolutionary trend; in Indicates the risk warning threshold; Final outputs: predicted risk value, rate of risk change, direction of risk development, and risk trend level; The prediction results will be sent to S7 for comprehensive risk assessment and early warning generation.

[0018] In this embodiment, the specific logical steps of S7 are as follows: S701: Constructing a Comprehensive Risk Assessment Dataset: Obtain data output from the anomaly detection, anomaly propagation analysis, impact assessment, and risk prediction stages to construct a comprehensive risk assessment dataset. ; S605: Output Risk Evolution Trend Results: Generate risk evolution trend results based on the predicted risk value and the rate of risk change; when the following conditions are met... At that time, it was determined that the communication network exhibited a high-risk evolutionary trend; in Indicates the risk warning threshold; Final outputs: predicted risk value, rate of risk change, direction of risk development, and risk trend level; The prediction results will be sent to S7 for comprehensive risk assessment and early warning generation.

[0019] In this embodiment, the specific logical steps of S7 are as follows: S701: Constructing a Comprehensive Risk Assessment Dataset: Obtain data output from the anomaly detection, anomaly propagation analysis, impact assessment, and risk prediction stages to construct a comprehensive risk assessment dataset. ; in This represents the overall risk index. Indicates an abnormality index. Indicates contribution to dissemination. Indicates the abnormal impact index. This represents the predicted value of risk trends. , , , Indicates the weighting coefficient; S703: Calculating the Risk Growth Factor: The risk growth factor is calculated based on the current risk value and the predicted risk value to further reflect the risk development trend. The formula used is as follows: ; in Indicates risk growth factor, Indicates the predicted risk value. This represents the current comprehensive risk index; the larger the risk growth factor, the more obvious the risk evolution trend. S704: Determining the Risk Warning Level: The warning score is calculated based on the comprehensive risk index and risk growth factor, using the following formula: ; in Indicates the warning score. , This represents the weighting coefficient, used to classify risk levels based on the early warning score: Level 1 Low Risk It is classified as a level 2 general risk. Level 3, relatively high risk. It is classified as a Level 4 major risk; S705: Generate risk warning information: Generate corresponding risk warning information based on the warning level and output it. ; in Indicates the warning result, Indicates the warning level. Indicates the warning score. This represents the overall risk index. Indicates risk growth factor; Ultimately, an early warning message is generated, which includes the abnormal source node, key propagation path, scope of impact, risk level, and development trend, and is sent to S8 Intelligent Decision and Trusted Audit.

[0020] In this embodiment, the specific logical steps of S8 are as follows: S801: Constructing an intelligent decision analysis dataset: Obtain comprehensive risk index, anomaly propagation chain, anomaly source node, impact range, and historical handling case information to construct an intelligent decision analysis dataset. ; in This represents a decision analysis dataset. This represents the overall risk index. Indicates an abnormal propagation path. Indicates the source node of the anomaly. Indicates the level of impact of the anomaly. This represents a collection of historical cases. S802: Historical Case Matching and Similarity Calculation: Calculates the similarity between the current event and historical cases to filter the historical handling cases that best match the current abnormal event. The formula used is as follows: ; in Let represent the matching similarity of the i-th historical case. Indicates the similarity of risk characteristics. Indicates the similarity of propagation paths, Indicates the influence of similarity level. , , Indicates the weighting coefficient; The most similar historical cases were selected as candidate solutions; S803: Generating the Optimal Response Strategy: Calculate the overall benefit value of each response strategy based on the comprehensive risk index, case matching results, and the degree of dissemination impact. The formula used is as follows: ; in This represents the overall benefit value of the j-th disposal strategy. Indicates risk mitigation capability. Indicates the effectiveness of the disposal and implementation. Indicates the timeliness of the handling. , , Indicates the weighting coefficient; The optimal handling strategy is determined, and the generated strategies include: isolation of abnormal nodes, blocking of abnormal links, traffic rate limiting, switching to backup links, distribution of security policies, and notification of risk alarms. S804: Execution Result Evaluation and Credible Evidence Storage: Generate audit summary information for anomaly analysis results, risk warning results, and handling strategies to achieve credible auditing throughout the entire process. The formula used is as follows: ; in This indicates an audit summary. ( ) represents a hash function. Indicates the processing timestamp; || indicates data concatenation. The audit summary, handling results, and execution status are then written to the blockchain: ; in This indicates blockchain audit records. This serves as a unique identifier for the event, ultimately forming an immutable, verifiable, and traceable trusted audit chain.

[0021] Reference Figure 2 This embodiment proposes a blockchain-based trusted traceability processing system for communication data, including a data acquisition module, a blockchain evidence storage module, a communication behavior graph construction module, an anomaly detection module, an anomaly propagation traceability module, an impact assessment module, a risk prediction module, a risk warning module, an intelligent decision-making module, and an on-chain audit module. The data acquisition module is used to collect communication message data, device operation log data, network traffic data, node status data, and link status data; The blockchain evidence storage module is used to generate data fingerprints from communication data and complete trusted blockchain evidence storage. The communication behavior graph construction module is used to construct a communication behavior association graph; The anomaly detection module is used to identify abnormal communication nodes and calculate anomaly indices; The anomaly propagation tracing module is used to analyze the anomaly formation process, determine the anomaly source node, and the anomaly propagation path. The impact assessment module is used to assess the scope and level of impact of abnormal events; The risk prediction module is used to predict the evolution trend of risks in communication networks; The risk warning module is used to generate risk warning information; The intelligent decision-making module is used to generate anomaly handling strategies; The on-chain audit module is used to record anomaly analysis results, risk warning results, and handling results to form a trusted audit chain; This embodiment achieves closed-loop management of communication data throughout the entire process, from trusted storage, anomaly detection, propagation tracing, impact assessment to risk warning and intelligent handling, by constructing a communication behavior association graph, an anomaly propagation relationship model, and a risk evolution prediction model. It can not only accurately locate the anomaly source node, reconstruct the anomaly formation process, and analyze the anomaly propagation path and impact range, but also predict the development trend of communication network risks in advance, automatically generate handling strategies, and complete on-chain trusted audits. This effectively improves the accuracy of communication data tracing, the efficiency of fault diagnosis, the risk warning capability, and the security, reliability, and intelligent management level of the communication network.

[0022] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for communication data trusted provenance processing with blockchain provenance, characterized in that, Includes the following steps: S1: Trusted collection and on-chain storage of communication data: Collect communication message data, device operation log data, network traffic data, node status data and link status data in the communication network, perform hash operation on the collected data to generate data fingerprints, and write the data fingerprints, timestamp information and node identity information into the blockchain to complete trusted storage. S2: Construction of Communication Behavior Relationships: Construct a communication behavior relationship graph based on the sending node, receiving node, communication protocol, data flow direction, and time relationship of the communication data, and establish a relationship model between nodes; S3: Abnormal Communication Behavior Identification: Based on the communication behavior association map, abnormal communication behavior is detected, the abnormal index of each communication node is calculated, and abnormal communication nodes are identified. S4: Anomaly formation process source tracing analysis: Starting from the abnormal communication node, an anomaly propagation relationship model is established in conjunction with the aforementioned communication behavior correlation graph. The propagation path, propagation direction and propagation contribution during the formation of abnormal data are analyzed to determine the anomaly source node and anomaly propagation link. S5: Assessment of the scope of impact of anomalies: Based on the anomaly propagation path, the contribution of anomaly propagation, and the distribution of anomaly nodes, the scope of impact of anomalies is assessed to obtain the anomaly impact level; S6: Risk Evolution Trend Prediction: Based on historical communication data, real-time anomaly index, anomaly propagation results, and anomaly impact levels, a risk evolution model is constructed to predict the future risk change trend of the communication network. S7: Comprehensive Risk Assessment and Early Warning Generation: Calculate the comprehensive risk index based on the anomaly index, the contribution of anomaly propagation, the level of anomaly impact, and the risk trend prediction results, and generate corresponding risk early warning information; S8: Intelligent Decision-Making and Trusted Audit: Generate intelligent handling strategies based on comprehensive risk index, abnormal propagation links and historical handling cases, and write the abnormal analysis results, risk warning results and handling strategies into the blockchain to form a trusted audit record.

2. The blockchain traceability communication data trusted traceability processing method according to claim 1, characterized in that, In S3, the anomaly index is calculated by integrating multiple dimensions such as traffic anomaly, behavior deviation, node credibility, and link anomaly degree. The formula for calculating the comprehensive index is as follows: ； in This represents the anomaly index of the i-th communication node. Indicates the degree of traffic anomaly. Indicates the degree of deviation in communication behavior. This represents the node's credibility decay value. Indicates the link anomaly degree. , , , Represents the weighting coefficient, when If so, the node is determined to be an abnormal communication node, where Indicates the threshold for anomaly detection; The formula for calculating the flow anomaly degree is: ,in This represents the node's traffic at the current moment. This represents the historical average flow rate; the greater the deviation in flow rate, the higher the probability of an anomaly. The formula for calculating the deviation of communication behavior is: ,in Indicates the number of nodes associated in the current periodic communication. This indicates the number of communication-related nodes under normal historical conditions, used to identify abnormal scanning and connection behavior; The formula for calculating the node credibility decay value is as follows: The node credibility score is: , where represents the number of normal communications. Indicates the number of abnormal communications; Credibility decay value: The lower the credibility, the higher the risk of anomalies. Link anomaly calculation: ;in Indicates the link packet loss rate. Indicates the maximum allowable packet loss rate. Indicates the link delay increment. Indicates the maximum delay increment. This represents the adjustment coefficient.

3. The blockchain traceability communication data trusted traceability processing method according to claim 2, characterized in that, The specific logical steps of S4 are as follows: S401: Extract the abnormal communication nodes identified in S3 and the nodes that have direct or indirect communication relationships with them, and construct an abnormal propagation analysis subgraph: ; in This represents a subgraph representing the anomaly propagation analysis. This represents the set of abnormally associated nodes and the set of abnormally associated edges. Simultaneously extract the anomaly index corresponding to each node: ; in This represents the anomaly index of node i; S402: Constructing an anomaly propagation relationship model: Construct anomaly propagation weights based on communication frequency, data traffic, and temporal correlation in the communication behavior correlation graph, where the propagation weights between nodes are defined as follows: ； in This represents the propagation weight from node i to node j. Indicates communication frequency weights. Indicates data flow weight. Indicates the time-related weight. , , These are the weighting coefficients; The propagation relationship model is represented as follows: ,in Represents the propagation weight matrix; S403: Calculate the anomaly propagation probability: Normalize the propagation weights to obtain the anomaly propagation probability matrix: , ; in This represents the probability that an anomaly propagates from node i to node j, where m represents the number of nodes associated with node i. An anomaly propagation probability network is obtained to reflect the probability of an anomaly spreading from one node to neighboring nodes; S404: Calculate Node Propagation Contribution: Calculate the node propagation contribution to analyze the role of each node in the anomaly formation process. The formula used is as follows: ； in This represents the propagation contribution of node j. This represents the anomaly index of node i. Indicates the probability of abnormal propagation. This indicates the number of nodes associated with the anomaly. The greater the contribution of the node to the propagation, the greater its influence on the spread of the anomaly. The contribution was then normalized. ,in Indicates the contribution of normalized propagation; S405: Reverse Tracing of Anomaly Propagation Path: A reverse search is performed based on the propagation probability matrix and the propagation contribution matrix to determine the source node of the anomaly. The formula used to define the credibility of the source node is as follows: ； in Indicates the credibility of the node source. Indicates an abnormality index. Indicates the contribution of normalized propagation. Indicates the frequency of historical anomalies. , , These are the weighting coefficients; Nodes that satisfy the following formula are selected as candidate anomaly source nodes: And trace back along the communication link in reverse: ; in Indicates the source node of the anomaly. Indicates the final abnormal node; A set of abnormal propagation paths is formed; S406: Generate anomaly formation process tracing results: Construct an anomaly propagation link tree based on the anomaly source node, propagation path, and propagation contribution. ; in Represents the anomaly propagation tree. Represents a set of abnormal propagation paths. Represents the set of contributions to the spread; Further calculation of the scope of the anomaly's impact: ,in Indicating the scope of the abnormal impact index, This indicates the number of nodes affected by the anomaly. Indicates the total number of nodes in the network; Final output: anomaly source node, key propagation node, anomaly propagation direction, anomaly propagation path, anomaly propagation contribution, and anomaly impact range.

4. The blockchain traceability communication data trusted traceability processing method according to claim 1, characterized in that, In step S5, when assessing the impact range of an abnormal event, an abnormal impact assessment model is constructed based on the abnormal propagation links, propagation contributions, and abnormal node distribution obtained in step S4. First, the proportion of affected nodes in the abnormal propagation links to the total number of network nodes is calculated to obtain the node impact factor N. Then, the proportion of links covered by the abnormal propagation links to the total number of network links is calculated to obtain the link impact factor L. Finally, the average propagation contribution value is calculated based on the propagation contribution of each node to obtain the propagation impact factor C. Simultaneously, the topology impact factor T is calculated by combining the importance of the abnormal nodes in the network topology. Finally, a comprehensive abnormal impact index is calculated using the following formula: ； ， ， ， ； in Indicates the abnormal impact index. Indicates the number of nodes affected by the anomaly. Indicates the total number of nodes in the network. Indicates the number of links affected by the anomaly. Indicates the total number of network links. This represents the normalized propagation contribution of the i-th node. Indicates the topological importance of nodes. Indicates the number of abnormal nodes. , ... Indicates the weighting coefficient; Finally, the levels are classified according to the abnormal impact index I. When it is judged to be of low impact level, when When it is determined to be of a general impact level, when When it is judged to be of a higher impact level, when The event is classified as having a significant impact level, thereby obtaining an assessment of the scope of the abnormal event's impact. The assessment results are then sent to S6 for risk evolution trend prediction.

5. The blockchain traceability communication data trusted traceability processing method according to claim 1, characterized in that, The specific logical steps of S6 are as follows: S601: Constructing a risk evolution analysis dataset: Obtain the anomaly index output by S3, the anomaly propagation results output by S4, and the anomaly impact level output by S5, and construct a risk evolution analysis dataset by combining it with historical communication data. ; in This represents a dataset for risk evolution analysis. Indicates the anomaly index at the current moment. Indicates the contribution to the spread at the current moment. This indicates the index of abnormal impact at the current moment. This represents historical risk status data; S602: Calculate the current comprehensive risk status value: The current comprehensive risk status value is obtained by integrating the anomaly index, the propagation contribution, and the impact index. The calculation formula is as follows: ； in This indicates the current overall risk status value. , , Indicates the weighting coefficient; S603: Establish a risk evolution trend model: Analyze the correlation between the current risk state and historical risk states to construct a risk evolution model. ; in This indicates the predicted risk value for the next moment. This indicates the current risk status value. This represents the historical average risk level. This represents the risk evolution adjustment coefficient; This model enables dynamic iterative prediction of risk status; S604: Calculate the rate of risk change: Calculate the rate of risk change between adjacent time points to determine the direction and speed of risk development. The calculation formula is as follows: ； in Indicates the rate of change of risk. This indicates the current risk value. Indicates the predicted risk value; when When this occurs, it indicates that the risk is trending upward. When this time, it indicates that the risk is trending downward; S605: Output Risk Evolution Trend Results: Generate risk evolution trend results based on the predicted risk value and the rate of risk change; when the following conditions are met... At that time, it was determined that the communication network exhibited a high-risk evolutionary trend; in Indicates the risk warning threshold; Final outputs: predicted risk value, rate of risk change, direction of risk development, and risk trend level; The prediction results will be sent to S7 for comprehensive risk assessment and early warning generation.

6. The blockchain traceability communication data trusted traceability processing method according to claim 5, characterized in that, The specific logical steps of S7 are as follows: S701: Constructing a Comprehensive Risk Assessment Dataset: Obtain data output from the anomaly detection, anomaly propagation analysis, impact assessment, and risk prediction stages to construct a comprehensive risk assessment dataset. ； in This represents a comprehensive risk assessment dataset. Indicates the current abnormal index. Indicates the current contribution to the spread. Indicates the abnormal impact index. This represents the predicted value of risk trends; S702: Calculate the comprehensive risk index: Perform a weighted fusion calculation on each risk factor to obtain the comprehensive risk index: ; in This represents the overall risk index. Indicates an abnormality index. Indicates contribution to dissemination. Indicates the abnormal impact index. This represents the predicted value of risk trends. , , , Indicates the weighting coefficient; S703: Calculating the Risk Growth Factor: The risk growth factor is calculated based on the current risk value and the predicted risk value to further reflect the risk development trend. The formula used is as follows: ； in Indicates risk growth factor, Indicates the predicted risk value. This represents the current comprehensive risk index; the larger the risk growth factor, the more obvious the risk evolution trend. S704: Determining the Risk Warning Level: The warning score is calculated based on the comprehensive risk index and risk growth factor, using the following formula: ； in Indicates the warning score. , This represents the weighting coefficient, used to classify risk levels based on the early warning score: Level 1 Low Risk It is classified as a level 2 general risk. It is classified as Level 3, which is considered relatively high risk. It is classified as a Level 4 major risk; S705: Generate risk warning information: Generate corresponding risk warning information based on the warning level and output it. ; in Indicates the warning result, Indicates the warning level. Indicates the warning score. This represents the overall risk index. Indicates risk growth factor; Ultimately, an early warning message is generated, which includes the abnormal source node, key propagation path, scope of impact, risk level, and development trend, and is sent to S8 Intelligent Decision and Trusted Audit.

7. The blockchain traceability communication data trusted traceability processing method according to claim 6, characterized in that, The specific logical steps of S8 are as follows: S801: Constructing an intelligent decision analysis dataset: Obtain comprehensive risk index, anomaly propagation chain, anomaly source node, impact range, and historical handling case information to construct an intelligent decision analysis dataset. ; in This represents a decision analysis dataset. This represents the overall risk index. Indicates an abnormal propagation path. Indicates the source node of the anomaly. Indicates the level of impact of the anomaly. This represents a collection of historical cases. S802: Historical Case Matching and Similarity Calculation: Calculates the similarity between the current event and historical cases to filter the historical handling cases that best match the current abnormal event. The formula used is as follows: ； in Let represent the matching similarity of the i-th historical case. Indicates the similarity of risk characteristics. Indicates the similarity of propagation paths, Indicates the influence of similarity level. , , Indicates the weighting coefficient; The most similar historical cases were selected as candidate solutions. S803: Generating the Optimal Response Strategy: Calculate the overall benefit value of each response strategy based on the comprehensive risk index, case matching results, and the degree of dissemination impact. The formula used is as follows: ； in This represents the overall benefit value of the j-th disposal strategy. Indicates risk mitigation capability. Indicates the effectiveness of the disposal and implementation. Indicates the timeliness of the handling. , , Indicates the weighting coefficient; The optimal handling strategy is determined, and the generated strategies include: isolation of abnormal nodes, blocking of abnormal links, traffic rate limiting, switching to backup links, distribution of security policies, and notification of risk alarms. S804: Execution Result Evaluation and Credible Evidence Storage: Generate audit summary information for anomaly analysis results, risk warning results, and handling strategies to achieve credible auditing throughout the entire process. The formula used is as follows: ； in This indicates an audit summary. ( ) represents a hash function. Indicates the processing timestamp; || indicates data concatenation. The audit summary, handling results, and execution status are then written to the blockchain: ; in This indicates blockchain audit records. This serves as a unique identifier for the event, ultimately forming an immutable, verifiable, and traceable trusted audit chain.

8. A blockchain-based trusted traceability processing system for communication data, used to implement the method described in any one of claims 1-7, characterized in that, It includes a data acquisition module, a blockchain evidence storage module, a communication behavior graph construction module, an anomaly detection module, an anomaly propagation tracing module, an impact assessment module, a risk prediction module, a risk warning module, an intelligent decision-making module, and an on-chain audit module; The data acquisition module is used to collect communication message data, device operation log data, network traffic data, node status data, and link status data. The blockchain evidence storage module is used to generate data fingerprints from communication data and complete trusted blockchain evidence storage. The communication behavior graph construction module is used to construct a communication behavior association graph; The anomaly detection module is used to identify abnormal communication nodes and calculate an anomaly index; The anomaly propagation tracing module is used to analyze the anomaly formation process, determine the anomaly source node, and the anomaly propagation path. The impact assessment module is used to assess the scope and level of impact of abnormal events. The risk prediction module is used to predict the evolution trend of communication network risks; The risk warning module is used to generate risk warning information; The intelligent decision-making module is used to generate anomaly handling strategies; The on-chain audit module is used to record anomaly analysis results, risk warning results, and handling results to form a trusted audit chain.

Images