CN108566398B

CN108566398B - Block chain attack event sensing method and device and computer storage medium

Info

Publication number: CN108566398B
Application number: CN201810367367.5A
Authority: CN
Inventors: 蒋劭捷; 王伟波; 李明政
Original assignee: Beijing Qihoo Technology Co Ltd
Current assignee: Beijing Qihoo Technology Co Ltd
Priority date: 2018-04-23
Filing date: 2018-04-23
Publication date: 2020-10-27
Anticipated expiration: 2038-04-23
Also published as: CN108566398A

Abstract

The invention discloses a block chain attack event sensing method and device based on a timestamp, which comprises the following steps: reading the time stamp data of each block in the block chain; judging whether the timestamp data of each block accords with a timestamp auditing strategy or not; and if so, obtaining the perception result of the attack event. By utilizing the scheme of the invention, the timestamp data of each block is audited through the timestamp audit strategy, so that the attack event is automatically and timely sensed from the timestamp angle, and the block chain attack event is conveniently taken as a countermeasure, so that the loss of other miners caused by the fact that an attacker exclusively excavates the mine is avoided.

Description

Block chain attack event sensing method and device and computer storage medium

Technical Field

The invention relates to the technical field of block chains, in particular to a method and a device for sensing a block chain attack event and a computer storage medium.

Background

Generally speaking, a block chain is a public distributed account book system, account transaction information in a period of time is encrypted and packaged into a block, a timestamp is covered, blocks are sequentially linked to form an account book, and therefore the account book system which is centralized by one person and is jointly maintained by users in a network is formed.

The blocks are obtained by miners through an ore digging process, the ore digging process is essentially a process of searching for random numbers, and if a value after hash operation is smaller than a hash value of a preset difficulty value, ore digging is successful. Meanwhile, competition also exists among miners, who calculates the effective hash of the current block first and who can add the new block into the block chain first, so that all profits of the block can be enjoyed.

However, some attackers "cheat" by using their own computing power advantages, so that their own mining difficulty is continuously reduced, thereby ensuring the advantages of the longest chain, and further realize profit by exclusively mining, which brings serious losses to other miners. Moreover, there is no scheme in the prior art that can automatically sense the attack event of exclusive mining.

Disclosure of Invention

In view of the above, the present invention has been developed to provide a method, apparatus, and computer storage medium for blockchain attack event awareness that overcome, or at least partially address, the above-discussed problems.

According to an aspect of the present invention, there is provided a method for sensing a time stamp-based blockchain attack event, including:

reading the time stamp data of each block in the block chain;

judging whether the timestamp data of each block accords with a timestamp auditing strategy or not;

and if so, obtaining the perception result of the attack event.

According to another aspect of the present invention, there is provided a time stamp-based blockchain attack event awareness apparatus, including:

the first reading module is suitable for reading the time stamp data of each block in the block chain;

the first auditing module is suitable for judging whether the timestamp data of each block accords with a timestamp auditing strategy or not;

and the first sensing module is suitable for obtaining a sensing result of the attack event if the first sensing module is judged to be in accordance with the timestamp auditing strategy.

According to yet another aspect of the present invention, there is provided a computing device comprising: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;

the memory is used for storing at least one executable instruction, and the executable instruction enables the processor to execute the operation corresponding to the block chain attack event perception method based on the time stamp.

According to still another aspect of the present invention, a computer storage medium is provided, where at least one executable instruction is stored, and the executable instruction causes a processor to perform an operation corresponding to the above timestamp-based blockchain attack event awareness method.

According to the block chain attack event sensing method and device based on the timestamp, timestamp data of each block in a block chain is read; judging whether the timestamp data of each block accords with a timestamp auditing strategy or not; and if so, obtaining the perception result of the attack event. By utilizing the scheme of the invention, the timestamp data of each block is audited through the timestamp audit strategy, so that the attack event is automatically and timely sensed from the timestamp angle, and the block chain attack event is conveniently taken as a countermeasure, so that the loss of other miners caused by the fact that an attacker exclusively excavates the mine is avoided.

The foregoing description is only an overview of the technical solutions of the present invention, and the embodiments of the present invention are described below in order to make the technical means of the present invention more clearly understood and to make the above and other objects, features, and advantages of the present invention more clearly understandable.

Drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:

FIG. 1a shows a flow diagram of a method of perception of a blockchain attack event according to one embodiment of the invention;

FIG. 1b shows a flow chart of a method of perceiving attack events from the perspective of algorithm type;

FIG. 1c shows a flow diagram of a method of perceiving attack events from a timestamp perspective;

FIG. 1d shows a flow chart of a method of perceiving attack events from the point of view of transaction count;

FIG. 2 shows a flow diagram of a block chain attack event awareness method based on algorithm type according to another embodiment of the invention;

FIG. 3 illustrates a flow diagram of a method for time stamp-based blockchain attack event awareness in accordance with yet another embodiment of the present invention;

FIG. 4 illustrates a flow diagram of a blockchain attack event awareness method based on transaction counts according to yet another embodiment of the present invention;

FIG. 5 shows a flow diagram of a method of sensing a blockchain attack event according to yet another embodiment of the invention;

FIG. 6 shows a functional block diagram of a device for time stamp-based blockchain attack event awareness according to an embodiment of the present invention;

FIG. 7 shows a schematic structural diagram of a computing device according to an embodiment of the invention.

Detailed Description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

Fig. 1a shows a flow diagram of a method of perception of a blockchain attack event according to one embodiment of the invention. As shown in fig. 1a, the method comprises the steps of:

step S101: the data content of each block in the block chain is read.

The block is a data storage unit encrypted by using an asymmetric encryption algorithm, each block consists of a block head and a block body, and the block head is used for recording description information of the block and specifically comprises a version number, a hash value of a previous block, a Mercker root, a timestamp, a difficulty value and a random number; and the block is used for recording transaction information.

The data content of each block includes content of relevant information which can reflect mining processes, relevant information of block characteristics, and/or relevant information of transactions recorded by the block, and accordingly, the data content is derived from any position including the relevant information mentioned above, and optionally, the data content is derived from a block head and/or a block body.

Specifically, the related information mentioned above can be obtained by reading the data content of a plurality of consecutive blocks in the block chain. For example, time stamps are respectively read from the block headers of a plurality of continuous blocks, and the time stamps can reflect the block-out time interval of adjacent blocks in the mining process. Then, in the subsequent step, the relevant information is used for determining whether the corresponding block is dug by a malicious mining method. It should be noted that the present invention does not specifically limit the way of reading the data content of each block, and those skilled in the art can set the data content according to actual conditions, and optionally read the data content through a blockchain browser.

Step S102: and performing safety audit on the data content of each block according to one or more preset audit strategies to obtain an audit result meeting at least one preset audit strategy.

The one or more preset audit policies are policies for determining whether the data content of each block is data content corresponding to malicious mining behavior, and may be set according to practical or empirical data, or according to characteristics of block chains in different forms. Still taking the above block output time interval as an example, the normal block output time intervals of the blocks are different corresponding to the block chains of different currencies, for example, the normal block output time interval of the block chain of the verse (XVG) currency is 30 seconds, the normal block output time interval of the block chain of the bitcoin is 10 minutes, and therefore, a preset audit policy needs to be set according to the normal block output time intervals of the block chains corresponding to different currencies. However, the present invention is not limited to the above-mentioned manner of setting the preset design strategy, and in the specific implementation, a person skilled in the art may set the preset design strategy according to actual requirements.

Specifically, after the data content of each block is read, performing security audit on the data content of each block according to a corresponding preset audit strategy to obtain an audit result that the data content of each block conforms to at least one preset audit strategy. For example, the data content is a timestamp, and whether the timestamp of the adjacent block meets the characteristics of the block time interval corresponding to the abnormal mining behavior or not is audited according to a timestamp auditing strategy.

Step S103: and analyzing the audit result to obtain a perception result of the attack event.

Generally, if the data content of each block meets the auditing result of at least one preset auditing strategy, the existence of an attack event can be directly determined. However, in other embodiments of the present invention, in order to make the sensing result more accurate, whether an attack event exists is further determined according to the number of the at least one preset audit policy and/or the audit angle corresponding to the at least one preset audit policy. Optionally, if the number of the at least one preset audit policy exceeds a preset value, determining that an attack event exists; or if at least one preset auditing strategy is a specific auditing strategy, determining that an attack event exists, wherein the specific auditing strategy can be set according to currency. For example, if the specific audit policy corresponding to XVG coins is set as the algorithm type audit policy, it may be determined that an attack event exists when the at least one predetermined audit policy that is met includes the algorithm type audit policy.

The method for sensing the blockchain attack event provided by the embodiment can be widely applied to scenes of automatically sensing the blockchain attack event and timely discovering the blockchain attack event. By reading appropriate data content and setting different preset auditing strategies, attack events can be sensed from different angles, and in order to facilitate understanding of sensing the attack events from different angles, three more typical data contents are respectively selected below to explain the implementation steps of the embodiment:

first, algorithm type data. Fig. 1b shows a flow chart of a method of perceiving attack events from the perspective of algorithm type. As shown in fig. 1b, the method comprises:

step S111, corresponding to step S101 in fig. 1a, reads the algorithm type data of each block in the block chain. The algorithm type refers to the algorithm type of a mining algorithm (like a block-out algorithm in the following text), and corresponds to different currencies, and the number and the type of the algorithms are different; algorithms for digging different blocks for the same currency are different. In this step, the block output algorithm corresponding to the plurality of blocks linked in sequence can be obtained by reading the algorithm type data of each block in the block chain.

Step S112, corresponding to step S102 in fig. 1a, determines whether the algorithm type data of each block conforms to the algorithm type auditing policy. Generally, for a block chain with various currency types of algorithm types, the block-out algorithm of the blocks which are linked sequentially in normal condition should be alternate or more dispersed, and based on this, an algorithm type auditing strategy is set, namely: and setting a strategy for identifying the characteristics of the algorithm type data corresponding to the malicious mining behaviors. The algorithm type data for each block is then audited.

Step S113, corresponding to step S103 in fig. 1a, if the algorithm type data of each block conforms to the algorithm type audit policy, obtaining a sensing result of the attack event, and further implementing sensing of the attack event from the perspective of the algorithm type.

Second, time stamp data. FIG. 1c shows a flow chart of a method of perceiving attack events from a timestamp perspective. As shown in fig. 1c, the method comprises:

step S121, corresponding to step S101 in fig. 1a, reads the timestamp data of each block in the block chain. The time stamp records the time of generation of each block, and each new block is added with a corresponding time stamp every birth, and the blocks in the block chain are linked according to the time stamp sequence. The time stamp of the adjacent tile may reflect the out-of-tile time interval of the next tile relative to the previous tile.

Step S122, corresponding to step S102 in fig. 1a, determines whether the timestamp data of each block conforms to the timestamp auditing policy. Generally, the actual block-out time interval of the adjacent blocks should fluctuate within a reasonable range of the ideal block-out time interval, and when the actual block-out time interval of more than a preset number of consecutive blocks exceeds the reasonable range of the ideal block-out time interval, the abnormal condition is considered, and based on this, a timestamp auditing policy is set, that is: and setting a strategy for identifying the characteristics of the timestamp data corresponding to the malicious mining behaviors.

Step S123, corresponding to step S103 in fig. 1a, if the timestamp data of each block conforms to the timestamp audit policy, obtaining a sensing result of the attack event, and further implementing sensing of the attack event from the timestamp perspective.

Third, transaction count data. FIG. 1d shows a flow chart of a method of perceiving attack events from the point of view of transaction count. As shown in fig. 1d, the method comprises:

step S131 corresponds to step S101 in fig. 1a, and reads transaction count data of each block in the block chain. Wherein, the transaction number refers to the transaction number in the time of digging out each block, namely: the transaction number in the time between the timestamp of the next block and the timestamp of the last block which are sequentially linked is the transaction number of the next block.

Step S132, corresponding to step S102 in fig. 1a, determines whether the transaction count data of each block conforms to the transaction count auditing policy. The first transaction record is the reward transaction for the person who successfully digs the mine through the block dug by the normal mining action, besides, a plurality of transaction records generated in the time of digging the block are also generally existed; and when the transaction number data of the continuous blocks exceeding a certain number are all extremely small or even 1, the abnormal condition is considered, and based on the abnormal condition, a transaction number auditing strategy is set, namely: and setting the characteristics of the transaction stroke data corresponding to the malicious mining behaviors.

Step S133, corresponding to step S103 in fig. 1a, if the transaction number data of each block conforms to the transaction number auditing policy, obtaining a sensing result of the attack event, and further implementing sensing of the attack event from the transaction number perspective.

By reading the three data contents and setting a corresponding preset auditing strategy, attack events can be sensed from the angle of algorithm type, the angle of timestamp and the angle of transaction number respectively. However, it should be noted that, the present invention is not limited to this, and in specific implementation, other data contents may be read according to actual situations, and other preset auditing policies may be set, so as to implement the effect of performing security audit on corresponding data contents by using the preset auditing policies. In addition, different malicious mining manners may cause one or more different abnormal situations, and in order to comprehensively sense an attack event, various preset auditing strategies including but not limited to the above-mentioned preset auditing strategies may be combined for security auditing.

According to the sensing method of the block chain attack event provided by the embodiment, the data content of each block in the block chain is read; performing safety audit on the data content of each block according to one or more preset audit strategies to obtain an audit result meeting at least one preset audit strategy; and analyzing the audit result to obtain a perception result of the attack event. By using the scheme provided by the invention, the safety audit can be automatically carried out on the data content of each block through the preset audit strategy, and the block chain attack event can be timely found according to the audit result, so that the block chain attack event can be conveniently responded to, and the loss of other miners caused by the fact that an attacker exclusively excavates the mine can be avoided.

Fig. 2 shows a flowchart of a block chain attack event awareness method based on algorithm type according to another embodiment of the present invention. The embodiment is suitable for the currency supporting various ore digging algorithms. As shown in fig. 2, the method comprises the steps of:

step S201: acquiring algorithm type description data of a block chain; and generating an algorithm type auditing strategy according to the algorithm type description data of the block chain.

The algorithm type description data records a plurality of algorithm types supported by the block chain. Taking XVG as an example, the block-out algorithm of XVG blocks includes: scrypt, X17, lyra2rev2, MYR groestl, and blake2s, namely: the corresponding blockchain supports the above 5 algorithm types.

Specifically, after multiple algorithm types supported by the block chain are obtained, an algorithm type auditing strategy is generated according to the characteristics of the algorithm type corresponding to the normal mining behavior and/or the characteristics of the algorithm type corresponding to the malicious mining behavior. In some embodiments of the present invention, the algorithm type corresponding to the malicious mining behavior is characterized by: the block output algorithms of the continuous blocks with the number exceeding the preset number are all the same algorithm type, and correspondingly, the algorithm type evaluation strategy is as follows: and if the block outlet algorithms of the continuous blocks with the number exceeding the preset number are all of the same algorithm type, determining that malicious mining behaviors exist.

In other embodiments of the present invention, considering that in the initial stage of malicious mining, there may be a case where a block dug normally is added to the main chain, the type of the algorithm corresponding to the malicious mining behavior may also be characterized as: the ratio of the same block-out algorithm in the block-out algorithms of a plurality of continuous blocks exceeds a preset ratio, and correspondingly, the algorithm type evaluation strategy is as follows: if the ratio of the same block-out algorithm in the block-out algorithms of a plurality of continuous blocks exceeds a preset ratio, the malicious ore-digging behavior is determined to exist, and the algorithm type auditing strategy can avoid the condition that an attack event cannot be sensed in time at the initial stage of malicious ore-digging. Still taking XVG as an example, if the predetermined ratio is 90%, when the number of the consecutive 20 blocks corresponding to the block algorithm of Scrypt reaches 18, it is determined that malicious mining exists. However, the present invention is not limited to the above-mentioned features of the algorithm type corresponding to the malicious mining behavior, and in the specific implementation, a person skilled in the art may also generate the algorithm type auditing policy according to the features of other algorithm types by referring to practical data or theoretical calculation results.

Step S202: and reading the algorithm type data of each block in the block chain.

In the actual ore digging process, no matter normal ore digging or malicious ore digging, one block needs to be dug through one algorithm in algorithm types supported by a block chain, and therefore each dug block corresponds to one block-digging algorithm.

Step S203: and judging whether the algorithm type data of each block conforms to an algorithm type auditing strategy. If yes, go to step S204; if not, the method ends.

Specifically, the corresponding algorithm type evaluation policy is: if the block outlet algorithms of the continuous blocks with the number exceeding the preset number are all the same algorithm type, determining that malicious mining behaviors exist, and correspondingly judging whether the algorithm type data of each block conforms to the algorithm type evaluation strategy is as follows: judging whether the algorithm type data of n continuous blocks in each block are the same, wherein n is greater than or equal to a preset value; if the algorithm type data of the n continuous blocks are the same, judging that the algorithm type auditing strategy is met, and executing the step S204; if the algorithm type data of the n continuous blocks are not the same, judging that the algorithm type auditing strategy is not met, and ending the method.

Step S204: and obtaining the perception result of the attack event.

And if the algorithm type data of each block is judged to accord with the algorithm type auditing strategy, sensing an attack event.

In the embodiment, the steps S201 to S204 are performed by auditing the algorithm type data of each block by using an algorithm type auditing strategy to sense the attack event, and meanwhile, as an optional step in the embodiment, considering that the frequency of occurrence of an isolated block is very low in a normal ore excavation mode, generally, several isolated blocks per day, while in a malicious ore excavation mode, a large number of ore ponds cannot normally work and begin to continuously excavate the isolated block, and as a branched chain cannot compete with the longest chain of an attacker, blocks in the branched chain become the isolated block, it is seen that the number of the isolated blocks and the frequency of occurrence of the blocks are abnormally increased in the malicious ore excavation mode, so that security audit can be performed by using the isolated block auditing strategy and the attack event can be sensed. Specifically, data content provided by the mine system is read; performing safety audit on data content provided by the mine pool system according to the isolated block audit strategy; and if the data content provided by the mine system conforms to the isolated block auditing strategy, obtaining the sensing result of the attack event. The system comprises a mine system and a control system, wherein the mine system comprises block outlet information in a preset time period, and data content provided by the mine system refers to content reflecting isolated block information, such as the number of isolated blocks, the frequency of the isolated blocks and the like; the isolated block auditing strategy can be set according to isolated block information corresponding to normal ore excavation, or set according to practice data or theoretical results corresponding to malicious ore excavation, which is not particularly limited by the invention. Optionally, the isolated block audit strategy is as follows: and if the frequency of the occurrence of the isolated blocks in the preset time period exceeds m%, determining that malicious ore excavation behaviors exist. It should be emphasized that this optional step may be executed at any time between step S201 and step S204, or before step S201, or after step S204, and the present invention is not limited in this regard.

Step S205: analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses; and storing one or more transaction addresses into a preset address library.

The transaction data refers to the transaction details of each block, which records the information of the transfer party, the income party, the amount of money, the digital signature of the transfer party and the like of each transaction, and the first transaction record is the reward transaction for the successful mining person, which is also called the generation transaction. For the block dug by the malicious mining, the first transaction record is the reward transaction for the attacker, and correspondingly, the income party is the collection address of the attacker.

Specifically, after the attack event is sensed, in order to prevent the same attacker from obtaining the reward of the corresponding block again in a malicious mining mode, the transaction data recorded in one or more blocks involved in the attack event is analyzed to obtain the collection address used by the attacker for gaining profit, that is: one or more transaction addresses; and then, storing the one or more transaction addresses as malicious addresses into a preset address library so as to monitor and query by using the preset address library, thereby preventing more malicious mining behaviors or attack events.

The method can be realized in various ways, and in some specific embodiments of the invention, the method is realized by a block chain browser, and the block chain browser can read the algorithm type data and judge whether the algorithm type data conforms to an algorithm type audit strategy, so as to sense an attack event; or, in other embodiments of the present invention, the attack event is sensed by a plug-in, the plug-in reads the algorithm type data by establishing communication with the blockchain browser, and then the plug-in determines whether the algorithm type data conforms to the algorithm type audit policy.

According to the algorithm type-based block chain attack event sensing method provided by the embodiment, algorithm type description data of a block chain is obtained; generating an algorithm type auditing strategy according to the algorithm type description data of the block chain; reading the algorithm type data of each block in the block chain; judging whether the algorithm type data of each block accords with an algorithm type auditing strategy or not, and if so, obtaining a sensing result of an attack event; analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses; and storing one or more transaction addresses into a preset address library. By using the scheme of the embodiment, safety audit can be automatically performed from the angle of the algorithm type, when the characteristics of the algorithm type corresponding to the malicious mining behavior are found, the attack event is sensed, and further, the countermeasure is conveniently taken against the attack event, so that the loss of other miners caused by the fact that an attacker monopolizes mining is avoided.

Fig. 3 shows a flowchart of a method for time stamp-based blockchain attack event awareness, according to yet another embodiment of the invention. As shown in fig. 3, the method comprises the steps of:

step S301: acquiring the block-out time interval description data of the block chain; and generating a timestamp auditing strategy according to the block outlet time interval description data of the block chain.

For the block chain network, the block time can be controlled by adjusting the difficulty value, and for block chains in different currency forms, the corresponding block time interval description data is different due to different adopted difficulty adjusting algorithms. For example, a blockchain of the form XVG, corresponds to an out-of-block time interval of 30 seconds. The difficulty adjustment algorithm is as follows: the difficulty average value of 12 blocks of the same algorithm is obtained for calculation by backtracking forwards, and if the actual block time interval is less than one third of the ideal block time interval, the difficulty is adjusted to be three times of the average value; if the actual block output time interval is more than three times of the ideal block output time interval, the adjustment difficulty is one third of the average value, and thus the dynamic difficulty adjustment can be carried out by comparing the actual block output time interval with the ideal block output time interval. For another example, for a blockchain in the form of bitcoins, the corresponding out-of-block time interval is 10 minutes.

In the malicious mining process, an attacker can not verify the block dug by other miners through the timestamp range by modifying the timestamp to form an isolated block. This results in only the attacker digging up the blocks on the main chain, while other normal miners cannot. Specifically, the attacker modifies the timestamp in three forms: first, in the initial stage of malicious mining, the time stamps are modified so that the block-out time interval of a plurality of blocks in succession is much larger than the normal block-out time interval (i.e., block-out time interval description data). In this way, the block chain network can reduce the difficulty through the difficulty adjustment algorithm, so that the mining difficulty is greatly reduced. Meanwhile, due to the fact that the time stamp is modified by the attacker, the blocks stamped out by the normal time cannot meet the time stamp range verification, and therefore the blocks cannot be added to the main chain dug by the attacker. Second, the rate of difficulty reduction is controlled by alternating the modification of the timestamps. Through the initial stage, an attacker can basically and exclusively excavate the mine, the difficulty is reduced greatly, and the attacker does not need great calculation power to excavate the mine without interference. At this stage, the attacker alternates the timestamp to make the degree of mining difficulty fluctuate in order not to drop too quickly, which could lead to other miners finding and other problems. Thirdly, every certain number of blocks, the time stamps are modified to make the block-out time interval of the continuous blocks far smaller than the normal block-out time interval (namely, the block-out time interval description data). The speed of the block discharging is greatly improved in the mode, and the speed of difficulty reduction can also be controlled.

Specifically, the timestamp auditing strategy is generated according to the characteristics of the block-out time interval caused by the three ways of modifying the timestamp and the block-out time interval description data (namely the normal block-out time interval). Optionally, the timestamp evaluation policy is: if the time stamp interval of the m continuous blocks is less than or equal to a first time interval threshold value; and/or if the timestamp interval of the n consecutive blocks is greater than or equal to a second time interval threshold, determining that malicious mining behavior exists. It should be noted that the form of the modified timestamp is merely an example, and the present invention is not limited thereto, and in an actual implementation process, the timestamp auditing policy may also be generated according to characteristics of a block time interval caused by other manners of modifying the timestamp.

Step S302: the time stamp data of each block in the block chain is read.

Step S303: and judging whether the timestamp data of each block conforms to a timestamp auditing strategy. If yes, go to step S304; if not, the method ends.

Specifically, whether the timestamp interval of m continuous blocks in each block is smaller than or equal to a first time interval threshold value or not is judged, if yes, the block outlet time interval of the m continuous blocks is considered to be extremely reduced, and then the timestamp auditing strategy is judged to be met. Or judging whether the timestamp intervals of n continuous blocks in each block are greater than or equal to a second time interval threshold, if so, determining that the block outlet time intervals of the n continuous blocks are extremely improved, and further determining that the timestamp auditing strategy is met. Wherein m is greater than or equal to a first preset value, and n is greater than or equal to a second preset value; the first time interval threshold and the second time interval threshold are set according to the block-out time interval.

For example, the block-out time interval of XVG is 30 seconds, if the first time interval threshold is 1 second and the first preset value is 3, it is determined that the timestamp auditing policy is met when the timestamp intervals of 3 or more blocks are less than or equal to 1 second. Or if the second time interval threshold is 5 minutes and the second preset value is 9, when the time stamp interval of 9 or more continuous blocks is greater than or equal to 5 minutes, judging that the time stamp audit strategy is met.

Step S304: and obtaining the perception result of the attack event.

And if the time stamp data of each block is judged to accord with the time stamp auditing strategy, sensing the attack event.

As an optional step of this embodiment, as the same as the embodiment corresponding to fig. 2, security audit can be further performed and an attack event can be sensed through a lone block audit policy, specifically: reading data content provided by the mine system; performing safety audit on data content provided by the mine pool system according to the isolated block audit strategy; and if the data content provided by the mine system conforms to the isolated block auditing strategy, obtaining the sensing result of the attack event. For a detailed description, reference may be made to relevant contents in the embodiment corresponding to fig. 2, which are not described herein again.

Step S305: analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses; and storing one or more transaction addresses into a preset address library.

Specifically, refer to the description of step S205, which is not described herein again.

As in the embodiment corresponding to fig. 2, the method of this embodiment may also be implemented by a blockchain browser or a plug-in.

According to the block chain attack event sensing method based on the timestamp provided by the embodiment, the block-out time interval description data of the block chain is obtained; generating a timestamp auditing strategy according to the block outlet time interval description data of the block chain; reading the time stamp data of each block in the block chain; judging whether the timestamp data of each block accords with a timestamp auditing strategy or not, and if so, obtaining a sensing result of the attack event; analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses; and storing one or more transaction addresses into a preset address library. By the scheme, safety audit can be automatically carried out from the angle of the timestamp, and when the characteristics of the block outlet time interval corresponding to the malicious ore digging behavior are found, the attack event is sensed, so that the countermeasure is conveniently taken for the attack event, and the problem that an attacker monopolizes the ore to cause the loss of other miners is avoided.

Fig. 4 shows a flowchart of a blockchain attack event awareness method based on transaction counts according to yet another embodiment of the present invention. As shown in fig. 4, the method comprises the steps of:

step S401: and reading transaction stroke number data of each block in the block chain.

Transaction information in the time between the block-out time stamp of the previous block and the block-out time stamp of the current block is recorded in each block, wherein the transaction information comprises transaction number data recorded in a transaction counter.

Step S402: and judging whether the transaction number data of each block conforms to a transaction number auditing strategy. If yes, go to step S403; if not, the method ends.

Generally, the situation that transaction stroke data of a plurality of continuous blocks are all very small or even 1 does not occur in the blocks dug in a normal ore digging mode; the block dug by the malicious mining method can cause only a very small amount of transactions in a plurality of continuous blocks or even only one transaction which generates the block due to the modification of the time stamp or some other abnormal reason.

Specifically, whether the transaction number of n continuous blocks in each block is smaller than or equal to a transaction number threshold value is judged, if yes, the transaction number data caused by malicious ore excavation is considered to be abnormal, and then the condition that the transaction number auditing strategy is met is judged; wherein n is greater than or equal to a preset value.

Step S403: and obtaining the perception result of the attack event.

And if the transaction number data of each block is judged to accord with the transaction number auditing strategy, sensing an attack event.

Step S404: analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses; and storing one or more transaction addresses into a preset address library.

According to the block chain attack event sensing method based on transaction number provided by the embodiment, transaction number data of each block in a block chain is read; judging whether the transaction number data of each block accords with a transaction number auditing strategy or not, and if so, obtaining a sensing result of an attack event; analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses; and storing one or more transaction addresses into a preset address library. By using the scheme of the embodiment, safety audit can be automatically performed from the perspective of transaction number, when data of the transaction number is found to be abnormal, an attack event is sensed, and further, countermeasures can be conveniently taken for the attack event, so that the problem that an attacker monopolizes to dig mines and causes loss of other miners is avoided.

Fig. 5 shows a flowchart of a method for sensing a blockchain attack event according to yet another embodiment of the present invention. The method and the device are suitable for the condition of performing security audit on the data content by utilizing various preset audit strategies. As shown in fig. 5, the method comprises the steps of:

step S501: and acquiring the feature description data of the block chain, and generating a plurality of preset auditing strategies according to the feature description data of the block chain.

The characteristic description data of the block chain is any standard data capable of representing the characteristics of the block chain, and the standard data corresponds to the parameters of the blocks dug by normal mining behaviors. Optionally, in some embodiments of the invention, the characterization data of the blockchain includes: an out-of-block time interval and/or an algorithm type. However, the invention is not limited thereto, and those skilled in the art should understand that all the data that can be used to distinguish the blocks dug by the malicious mining behavior and the normal mining behavior can be selected as the characteristic description data of the block chain.

Specifically, different preset auditing strategies are generated according to the feature description data of the block chains corresponding to the block chains in different currency forms, so that the condition that the perception of the attack event is inaccurate is avoided. For example, only one ore mining algorithm of a block chain in the form of bitcoin is used, and correspondingly, the block-out algorithm of all blocks in the block chain is the one ore mining algorithm, in this case, if the ratio of the same block-out algorithm in the block-out algorithms of a plurality of consecutive blocks exceeds a preset ratio, it is determined that malicious ore mining behaviors exist, and the security audit is performed by using an algorithm audit policy, so that the attack event is erroneously sensed when the attack event does not exist. Therefore, the blockchain of bitcoins is not suitable for security auditing using an algorithm type auditing strategy.

Step S502: the data content of each block in the block chain is read.

Reading data content of each block in the block chain, wherein the data content comprises relevant information reflecting the mining process, such as algorithm type data; information about block characteristics, such as timestamp data; and/or sector-recorded transaction-related information, such as transaction count data. However, the present invention is not limited to the above examples, and those skilled in the art will understand that any data content capable of reflecting the above-mentioned related information can be used as the actual data content of the present invention.

Step S503: and performing safety audit on the data content of each block according to a plurality of preset audit strategies to obtain an audit result meeting at least one preset audit strategy.

Specifically, the corresponding data content is audited according to a plurality of preset auditing strategies, wherein the corresponding data content can be audited respectively in parallel by using the plurality of preset auditing strategies simultaneously, or the corresponding data content can be audited by using one preset auditing strategy each time according to a preset sequence. Optionally, the timestamp data, the algorithm type data and the transaction number data are respectively audited by using a timestamp audit strategy, an algorithm type audit strategy and a transaction number audit strategy, so that an audit result can be quickly obtained.

After the safety audit is carried out, an audit result is obtained, and specifically, the audit result meeting at least one preset audit strategy comprises the following three types: one data content accords with a corresponding preset auditing strategy; or, a plurality of data contents conform to corresponding preset auditing strategies; or all the data contents conform to the corresponding preset auditing strategy.

Step S504: and analyzing the audit result to obtain a perception result of the attack event.

In specific implementation, different analysis criteria can be set according to actual requirements, and then a perception result is obtained according to the analysis criteria. The analysis criteria can be set from the number of the at least one preset auditing strategy or the auditing angle of the at least one preset auditing strategy. Specifically, quantitatively, the analysis criteria include, but are not limited to, one or more of the following: if one data content conforms to a corresponding preset auditing strategy, determining that an attack event exists; or, if a plurality of data contents respectively accord with a plurality of corresponding preset auditing strategies, determining that an attack event exists; or if all the data contents respectively accord with all the corresponding preset auditing strategies, determining that the attack event exists. And setting from an auditing perspective, and determining that an attack event exists if at least one preset auditing strategy is a specific auditing strategy, wherein the specific auditing strategy can be set according to currency.

In the embodiment, the steps S501 to S504 are performed by auditing the data content of each block in the block chain to sense the attack event, and meanwhile, as an optional step in this embodiment, it is considered that the frequency of occurrence of an isolated block is very low in a normal mining mode, generally, several isolated blocks per day, and in a malicious mining mode, a large number of mine pools cannot normally work, and the isolated blocks are continuously excavated, and since a branched chain cannot compete with the longest chain of an attacker, blocks in the branched chain become isolated blocks, it is obvious that the number of the isolated blocks and the frequency of occurrence of the blocks are abnormally increased in the malicious mining mode, so that security audit can be performed by using an isolated block auditing strategy, and the attack event can be sensed. Specifically, data content provided by the mine system is read; performing safety audit on data content provided by the mine pool system according to the isolated block audit strategy; and if the data content provided by the mine system conforms to the isolated block auditing strategy, obtaining the sensing result of the attack event. The system comprises a mine system and a control system, wherein the mine system comprises block outlet information in a preset time period, and data content provided by the mine system refers to content reflecting isolated block information, such as the number of isolated blocks, the frequency of the isolated blocks and the like; the isolated block auditing strategy can be set according to isolated block information corresponding to normal ore excavation, or set according to practice data or theoretical results corresponding to malicious ore excavation, which is not particularly limited by the invention. Optionally, the isolated block audit strategy is as follows: and if the frequency of the occurrence of the isolated blocks in the preset time period exceeds m%, determining that malicious ore excavation behaviors exist. It should be emphasized that the optional step may be executed at any time between step S501 and step S504, or before step S501, or after step S504, and the present invention is not limited in this regard.

Step S505: analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses; and storing one or more transaction addresses into a preset address library.

The method can be realized in various ways, and in some specific embodiments of the invention, the method is realized by a blockchain browser, and the blockchain browser can read data content and judge whether the data content meets a preset audit strategy, so as to sense an attack event; or, in other embodiments of the present invention, the method is implemented by a plug-in, where the plug-in reads data content by establishing communication with the blockchain browser, and then the plug-in determines whether the data content meets a preset audit policy, so as to sense an attack event.

According to the sensing method of the block chain attack event provided by the embodiment, the feature description data of the block chain is obtained, and a plurality of preset auditing strategies are generated according to the feature description data of the block chain; reading block head data of each block in a block chain; performing safety audit on the data content of each block according to a plurality of preset audit strategies to obtain an audit result meeting at least one preset audit strategy; analyzing the audit result to obtain a sensing result of the attack event; analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses; and storing one or more transaction addresses into a preset address library. By using the scheme of the embodiment, the security audit can be performed on the corresponding data content by using a plurality of preset audit strategies, so that the effect of performing the security audit from a plurality of angles is achieved; when the data content meeting the preset auditing strategy meets the analysis criteria, the attack event is sensed, so that the flexibility of sensing the attack event is improved; meanwhile, the attack event is sensed, so that the countermeasure can be conveniently taken against the attack event, and the loss of other miners caused by the fact that the attacker exclusively excavates the mine is avoided.

Fig. 6 shows a functional block diagram of a block chain attack event awareness apparatus based on time stamps according to an embodiment of the present invention. As shown in fig. 6, the apparatus includes: the system comprises a first reading module 601, a first auditing module 602, a first sensing module 603, an obtaining module 604, a generating module 605, an analyzing module 606, a storing module 607, a second reading module 608, a second auditing module 609 and a second sensing module 610.

A first reading module 601, adapted to read timestamp data of each block in the block chain;

a first auditing module 602, adapted to determine whether the timestamp data of each block complies with a timestamp auditing policy;

the first sensing module 603 is adapted to obtain a sensing result of the attack event if it is determined that the timestamp audit policy is met.

An obtaining module 604 adapted to obtain an out-of-block time interval description data of a block chain;

a generating module 605 adapted to generate the timestamp auditing policy according to the out-block time interval description data of the block chain.

The first audit module 602 is further adapted to:

judging whether the timestamp interval of m continuous blocks in each block is less than or equal to a first time interval threshold value; and/or judging whether the timestamp interval of n continuous blocks in each block is greater than or equal to a second time interval threshold value, if so, judging that the timestamp audit strategy is met;

wherein m is greater than or equal to a first preset value, and n is greater than or equal to a second preset value; the first time interval threshold and the second time interval threshold are set according to the block-out time interval.

An analysis module 606 adapted to analyze transaction data recorded by one or more blocks involved in the attack event to obtain one or more transaction addresses;

the storage module 607 is adapted to store the one or more transaction addresses in a preset address library.

A second reading module 608 adapted to read data content provided by the mine system;

the second auditing module 609 is suitable for carrying out safety audit on the data content provided by the mine system according to the isolated block auditing strategy;

the second sensing module 610 is adapted to obtain a sensing result of the attack event if the data content provided by the mine system conforms to the isolated block auditing policy.

Wherein the apparatus is implemented by a blockchain browser; alternatively, the apparatus is implemented by a plug-in.

The specific structure and operation principle of each module described above may refer to the description of the corresponding step in the method embodiment, and are not described herein again.

The embodiment of the present application provides a non-volatile computer storage medium, where the computer storage medium stores at least one executable instruction, and the computer executable instruction may execute the block chain attack event sensing method based on the timestamp in any of the above method embodiments.

Fig. 7 is a schematic structural diagram of a computing device according to an embodiment of the present invention, and the specific embodiment of the present invention does not limit the specific implementation of the computing device.

As shown in fig. 7, the computing device may include: a processor (processor)702, a Communications Interface 704, a memory 706, and a communication bus 708.

Wherein:

the processor 702, communication interface 704, and memory 706 communicate with each other via a communication bus 708.

A communication interface 704 for communicating with network elements of other devices, such as clients or other servers.

The processor 702 is configured to execute the program 710, and may specifically execute relevant steps in the above embodiments of the method for sensing a blockchain attack event based on a timestamp.

In particular, the program 710 may include program code that includes computer operating instructions.

The processor 702 may be a central processing unit CPU, or an Application Specific Integrated Circuit (ASIC), or one or more Integrated circuits configured to implement an embodiment of the invention. The computing device includes one or more processors, which may be the same type of processor, such as one or more CPUs; or may be different types of processors such as one or more CPUs and one or more ASICs.

The memory 706 stores a program 710. The memory 706 may comprise high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.

The program 710 may specifically be used to cause the processor 702 to perform the following operations:

reading the time stamp data of each block in the block chain;

and if so, obtaining the perception result of the attack event.

In an alternative manner, the program 710 may be further specifically configured to cause the processor 702 to: acquiring the block-out time interval description data of the block chain;

and generating the timestamp auditing strategy according to the block outlet time interval description data of the block chain.

In an alternative manner, the program 710 may be further specifically configured to cause the processor 702 to:

analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses;

and storing the one or more transaction addresses into a preset address library.

reading data content provided by the mine system;

performing safety audit on data content provided by the mine pool system according to the isolated block audit strategy;

and if the data content provided by the mine system conforms to the isolated block auditing strategy, obtaining the sensing result of the attack event.

In an alternative, the method is implemented by a blockchain browser.

In an alternative, the method is implemented by a plug-in.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual machine, or other apparatus. Various general purpose systems may also be used with the teachings herein. The required structure for constructing such a system will be apparent from the description above. Moreover, the present invention is not directed to any particular programming language. It is appreciated that a variety of programming languages may be used to implement the teachings of the present invention as described herein, and any descriptions of specific languages are provided above to disclose the best mode of the invention.

In the description provided herein, numerous specific details are set forth. It is understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be interpreted as reflecting an intention that: that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will appreciate that the modules in the device in an embodiment may be adaptively changed and disposed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and furthermore they may be divided into a plurality of sub-modules or sub-units or sub-components. All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or elements of any method or apparatus so disclosed, may be combined in any combination, except combinations where at least some of such features and/or processes or elements are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that while some embodiments described herein include some features included in other embodiments, rather than other features, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or Digital Signal Processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the timestamp based blockchain attack event awareness apparatus according to embodiments of the present invention. The present invention may also be embodied as apparatus or device programs (e.g., computer programs and computer program products) for performing a portion or all of the methods described herein. Such programs implementing the present invention may be stored on computer-readable media or may be in the form of one or more signals. Such a signal may be downloaded from an internet website or provided on a carrier signal or in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The usage of the words first, second and third, etcetera do not indicate any ordering. These words may be interpreted as names.

Claims

1. A block chain attack event perception method based on time stamps comprises the following steps:

reading the time stamp data of each block in the block chain;

if so, obtaining a sensing result of the attack event;

judging whether the timestamp interval of m continuous blocks in each block is smaller than or equal to a first time interval threshold value; and/or judging whether the timestamp interval of n continuous blocks in each block is greater than or equal to a second time interval threshold value, if so, judging that the timestamp audit strategy is met;

2. The method of claim 1, wherein the method further comprises:

acquiring the block-out time interval description data of the block chain;

3. The method of claim 1, wherein after the obtaining the perceived outcome of the attack event, the method further comprises:

4. The method according to any one of claims 1-3, wherein the method further comprises:

reading data content provided by the mine system;

5. The method of any of claims 1-3, wherein the method is implemented by a blockchain browser.

6. The method of any of claims 1-3, wherein the method is implemented by an add-in.

7. A timestamp-based blockchain attack event awareness apparatus, comprising:

the first sensing module is suitable for obtaining a sensing result of the attack event if the first sensing module is judged to be in accordance with the timestamp auditing strategy;

wherein the first audit module is further adapted to: judging whether the timestamp interval of m continuous blocks in each block is less than or equal to a first time interval threshold value; and/or judging whether the timestamp interval of n continuous blocks in each block is greater than or equal to a second time interval threshold value, if so, judging that the timestamp audit strategy is met;

8. The apparatus of claim 7, wherein the apparatus further comprises:

the acquisition module is suitable for acquiring the block output time interval description data of the block chain;

and the generating module is suitable for generating the timestamp auditing strategy according to the block outlet time interval description data of the block chain.

9. The apparatus of claim 7, wherein the apparatus further comprises:

the analysis module is suitable for analyzing the transaction data recorded by one or more blocks related to the attack event to obtain one or more transaction addresses;

and the storage module is suitable for storing the one or more transaction addresses into a preset address library.

10. The apparatus of any of claims 7-9, wherein the apparatus further comprises:

the second reading module is suitable for reading the data content provided by the mine system;

the second auditing module is suitable for carrying out safety auditing on the data content provided by the mine pond system according to the isolated block auditing strategy;

and the second sensing module is suitable for obtaining a sensing result of the attack event if the data content provided by the mine system conforms to the isolated block auditing strategy.

11. The apparatus of any of claims 7-9, wherein the apparatus is implemented by a blockchain browser.

12. The apparatus of any of claims 7-9, wherein the apparatus is implemented by an insert.

13. A computing device, comprising: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;

the memory is used for storing at least one computer program, and the computer program enables the processor to execute the operation corresponding to the block chain attack event perception method based on the time stamp according to any one of claims 1-6.

14. A computer storage medium having at least one computer program stored therein, the computer program causing a processor to perform operations corresponding to the timestamp-based blockchain attack event awareness method according to any one of claims 1 to 6.