CN109767329A - Abnormal transaction detection method and device, electronic equipment and storage medium - Google Patents
Abnormal transaction detection method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN109767329A CN109767329A CN201811645999.XA CN201811645999A CN109767329A CN 109767329 A CN109767329 A CN 109767329A CN 201811645999 A CN201811645999 A CN 201811645999A CN 109767329 A CN109767329 A CN 109767329A
- Authority
- CN
- China
- Prior art keywords
- transaction
- data
- abnormal
- trade
- meets
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses an abnormal transaction detection method, an abnormal transaction detection device, electronic equipment and a storage medium. In the abnormal transaction detection method, when the Ethernet shop node synchronizes transaction data, the current synchronized transaction data is obtained, and whether the transaction corresponding to the transaction data meets the abnormal transaction condition or not is judged based on the transaction data; and when the judgment result is yes, judging that the transaction corresponding to the transaction data is the current abnormal transaction. One of the links of the transaction process is the transaction data of the block of the ether house node synchronous block chain, so that when the transaction data of the block of the ether house node synchronous block chain, whether the transaction corresponding to the synchronized transaction data meets the abnormal transaction condition is judged, that is, whether the transaction in progress is the abnormal transaction in progress is analyzed. Therefore, the abnormal transaction detection method provided by the embodiment of the invention can effectively detect the abnormal transaction in progress from the transaction in progress.
Description
Technical field
The present invention relates to block chain technical fields, more particularly to a kind of abnormal transaction detection method, device, electronic equipment
And storage medium.
Background technique
Ether mill is the first floor system of a open source that intelligent contract can be realized on block chain.Wherein, intelligent contract
It is a set of promise defined in digital form, the agreement of these promises is executed including contract participant.Here, agreement refers to specifically
The technology of computer language form realize, such as bit coin agreement.
Language is write also in initial stage of development due to intelligent contract, and the experience of programming personnel is insufficient, therefore, intelligence
Often there are some security breaches in energy contract, so that the ideal money based on intelligent contract is traded, will inevitably exist
It is some to be traded using the exception of these loopholes.In order to avoid because being lost brought by abnormal transaction, it is necessary to from ongoing
In transaction, ongoing abnormal transaction is detected, to sound an alarm before transaction extremely is completed.However, how from
In the transaction of progress, ongoing abnormal transaction is effectively detected, there are no realistic plans.
Summary of the invention
Be designed to provide a kind of abnormal transaction detection method, device, electronic equipment and the storage of the embodiment of the present invention are situated between
Matter effectively detects ongoing abnormal transaction to realize from ongoing transaction.Specific technical solution is as follows:
A kind of abnormal transaction detection method, is applied to ether mill node, this method comprises:
When the ether mill node isochronous transaction data, the transaction data of current sync is obtained；
Based on the transaction data, judge whether transaction corresponding to the transaction data meets abnormal terms of trade；
When the judgment result is yes, determine that the corresponding transaction of the transaction data is ongoing abnormal transaction.
Optionally, described to be based on the transaction data, judge whether transaction corresponding to the transaction data meets exception
Terms of trade, comprising:
Based on the tentation data in the transaction data, judge whether transaction corresponding to the transaction data meets exception
Terms of trade.
Optionally, the tentation data based in the transaction data, judges transaction corresponding to the transaction data
Whether abnormal terms of trade are met, comprising:
Judge whether the data format of the tentation data meets predetermined abnormal format corresponding with the tentation data,
And/or judge whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data；
If so, determining that transaction corresponding to the transaction data meets abnormal terms of trade, otherwise, it is determined that the transaction
Transaction corresponding to data does not meet abnormal terms of trade.
Optionally, the tentation data includes: number of deals, transaction procedure expense and one of trade initiator's information or
It is a variety of.
Optionally, when the tentation data includes the number of deals, the data content of the judgement tentation data
Whether with the tentation data corresponding judgment of objectives condition is met, comprising:
It is preset with reference to number to judge whether the number of deals is greater than；
If so, determining that the number of deals meets judgment of objectives condition corresponding with the number of deals.
Optionally, the tentation data includes that the transaction procedure is time-consuming, in the data of the judgement tentation data
Hold and whether meet judgment of objectives condition corresponding with the tentation data, comprising:
It is preset with reference to service charge to judge whether the transaction procedure expense is greater than；
If so, determining that the transaction procedure expense meets judgment of objectives condition corresponding with transaction procedure expense.
Optionally, when the tentation data includes trade initiator's information, the number of the judgement tentation data
Whether meet judgment of objectives condition corresponding with the tentation data according to content, comprising:
According to trade initiator's information, the corresponding target promoter to trade of the transaction data is determined；
Determine the transaction stroke count that transaction has been initiated on target promoter block belonging to the transaction data；
Judge whether the transaction stroke count reaches or beyond preset early warning transaction stroke count；
If so, determining that trade initiator's information meets judgment of objectives item corresponding with trade initiator's information
Part.
A kind of abnormal transaction detection device, is applied to ether mill node, which includes:
Module is obtained, for obtaining the number of deals of current sync when the ether mill node isochronous transaction data
According to；
It is different to judge whether transaction corresponding to the transaction data meets for being based on the transaction data for judgment module
Normal terms of trade；
Determination module, for when the judgment result is yes, determining that the corresponding transaction of the transaction data is ongoing
Abnormal transaction.
Optionally, the judgment module, including judging submodule；
The judging submodule, for judging that the transaction data institute is right based on the tentation data in the transaction data
Whether the transaction answered meets abnormal terms of trade.
Optionally, the judging submodule, is specifically used for:
Judge whether the data format of the tentation data meets predetermined abnormal format corresponding with the tentation data,
And/or whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data；
If so, determining that transaction corresponding to the transaction data meets abnormal terms of trade, otherwise, it is determined that the transaction
Transaction corresponding to data does not meet abnormal terms of trade.
Optionally, the tentation data includes: number of deals, transaction procedure expense and one of trade initiator's information or
It is a variety of.
Optionally, the judging submodule, judges whether the data content of tentation data meets and the tentation data pair
The judgment of objectives condition answered, specifically:
When the tentation data includes the number of deals, judge whether the number of deals is greater than preset reference number
Volume；
If so, determining that the number of deals meets judgment of objectives condition corresponding with the number of deals.
Optionally, the judging submodule, judges whether the data content of tentation data meets and the tentation data pair
The judgment of objectives condition answered, specifically:
When the tentation data includes that the transaction procedure is time-consuming, judge whether the transaction procedure expense is greater than preset ginseng
Examine service charge；
If so, determining that the transaction procedure expense meets judgment of objectives condition corresponding with transaction procedure expense.
Optionally, the judging submodule, judges whether the data content of tentation data meets and the tentation data pair
The judgment of objectives condition answered, specifically:
When the tentation data includes trade initiator's information, according to trade initiator's information, institute is determined
State the corresponding target promoter to trade of transaction data；
Determine the transaction stroke count that transaction has been initiated on target promoter block belonging to the transaction data；
Judge whether the transaction stroke count reaches or beyond preset early warning transaction stroke count；
If so, determining that trade initiator's information meets judgment of objectives item corresponding with trade initiator's information
Part.
A kind of electronic equipment, the electronic equipment be ether mill node, the electronic equipment include processor, communication connect
Mouth, memory and communication bus, wherein processor, communication interface, memory complete mutual communication by communication bus；
Memory, for storing computer program；
Processor when for executing the program stored on memory, realizes any of the above-described abnormal transaction detection method institute
The method and step stated.
A kind of computer readable storage medium is stored with computer program in the computer readable storage medium, described
Method and step described in any of the above-described abnormal transaction detection method is realized when computer program is executed by processor.
Abnormal transaction detection method provided in an embodiment of the present invention, when the friendship of the block in the synchronous block chain of ether mill node
When easy data, the transaction data of current sync is obtained, and be based on the transaction data, judge that transaction corresponding to the transaction data is
It is no to meet abnormal terms of trade；When the judgment result is yes, determine that the corresponding transaction of the transaction data is current ongoing
Abnormal transaction.One of link due to transaction carry out process synchronizes the transaction data of the block of block chain for ether mill node, because
Whether this judges the corresponding transaction of institute's isochronous transaction data in the transaction data of the block of the synchronous block chain of ether mill node
Meet abnormal terms of trade, as analyzes whether ongoing transaction is ongoing abnormal transaction.As it can be seen that the present invention is real
The abnormal transaction detection method for applying example offer, may be implemented from ongoing transaction, effectively detects ongoing different
Often transaction.Certainly, it implements any of the products of the present invention or method must be not necessarily required to reach all the above advantage simultaneously.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
Some embodiments of invention for those of ordinary skill in the art without creative efforts, can be with
It obtains other drawings based on these drawings.
Fig. 1 is a kind of flow chart of abnormal transaction detection method provided in an embodiment of the present invention；
Fig. 2 is a kind of structural schematic diagram of abnormal transaction detection device provided in an embodiment of the present invention；
Fig. 3 is the structural schematic diagram of a kind of electronic equipment provided in an embodiment of the present invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall within the protection scope of the present invention.
In order to from ongoing transaction, effectively detect ongoing abnormal transaction, the embodiment of the present invention is provided
A kind of abnormal transaction detection method, device, electronic equipment and storage medium.
It should be noted that the embodiment of the present invention be exchange on the network of ether mill block become block chain
After formal block, to transaction carry out it is abnormal whether detection.Embodiment to facilitate the understanding of the present invention, now by ether mill network
On process of exchange be summarized as follows: a certain user initiates transaction by a certain ether mill node on the network of ether mill, and to ether
The transaction is included in respective by the transaction of the ether mill node broadcasts of mill network the whole network, the ether mill node of ether mill network the whole network
In one block.When it is a certain include that the block of the transaction is dug out after, the corresponding ether mill node of the block is to ether mill net
Network the whole network broadcasts the All Activity of block record, and the ether mill node of ether mill network the whole network, which trades to these, carries out validity
Verifying, after these transaction are verified effectively, which becomes the formal block on block chain.Then, ether mill network the whole network
The ether mill node checks block book keeping operation correctness, during verification, ether mill node can by these trade friendship
Easy data are synchronized to local, and after these transaction are checked without mistake in ether mill, these trade fairs obtain receipts of transactions, so far,
These transaction terminate, and certainly, that transaction that above-mentioned user is initiated can also terminate.
It should be noted that a kind of executing subject of abnormal transaction detection method provided in an embodiment of the present invention can be one
The abnormal transaction detection device of kind, the device can be applied to ether mill node.Here, ether mill node can be to be equipped with ether
Mill client and the electronic equipment being linked into the network of ether mill, specifically, the electronic equipment can be terminal device, it can also be with
For server, in a particular application, which can be computer.
In addition, since ether mill network is the network of a decentralization, no matter the electronics as ether mill node
Equipment is terminal device or server, as long as the ether mill client that the electronic equipment is installed has every pipe of server
Function is managed, such as has the function of data on synchronous block chain, then, such ether mill node can be ether mill network
Server.
It should be noted that abnormal transaction detection method provided in an embodiment of the present invention, is not suitable for type of server singly
Ether mill node, as long as ether mill node has the function of data on synchronous block chain, then the ether mill node
Using abnormal detection method of trading provided in an embodiment of the present invention.
In a first aspect, a kind of abnormal transaction detection method provided in an embodiment of the present invention is described in detail, such as Fig. 1 institute
Show, abnormal transaction detection method provided in an embodiment of the present invention may comprise steps of:
S101: when ether mill node isochronous transaction data, the transaction data of current sync is obtained.
Here, ether mill node isochronous transaction data can be the transaction data of the block of synchronous block chain, specifically,
It can be the real-time deal details on the block for the block chain that ether mill node is saved.
In practical applications, obtaining the specific embodiment of the transaction data of current sync, there are a variety of.
Illustratively, can using by the Transaction Details Formatting Output on block into kafka real-time queue by the way of
To realize the transaction data for obtaining current sync.Here, kafka is a kind of high-throughput developed by Apache Software Foundation
Distributed post subscribe to message system, can be used for handling the everything flow data in the website of consumer's scale.
S102: it is based on transaction data, judges whether transaction corresponding to transaction data meets abnormal terms of trade.
S103: when the judgment result is yes, determine that transaction corresponding to the transaction data is ongoing abnormal friendship
Easily.
It is understood that therefore more than one of the transaction on block obtains transaction data, and judge transaction data
Whether corresponding transaction meets abnormal terms of trade, is the operation that will be carried out to each transaction on block.
Since transaction data is the Transaction Details of real-time synchronization, it can be based on transaction data, judge transaction data institute
Whether corresponding transaction meets abnormal terms of trade, and when the judgment result is yes, determines friendship corresponding to the transaction data
It is easily ongoing abnormal transaction.It is emphasized that since one of link of transaction carry out process is same for ether mill node
The transaction data of the block of block chain is walked, therefore, in the transaction data of the block of the synchronous block chain of ether mill node, judges institute
Whether the corresponding transaction of isochronous transaction data is abnormal, as analyzes whether ongoing transaction is ongoing abnormal friendship
Easily.That is, the corresponding transaction of institute's isochronous transaction data is also when the transaction data of the block of the synchronous block chain of ether mill node
Receipt is not up to generated, i.e., the stage that not up to transaction terminates therefore can be in the block of the synchronous block chain of ether mill node
When transaction data, judge whether the corresponding transaction of institute's isochronous transaction data is abnormal.
In addition, being based on transaction data, judge whether transaction corresponding to transaction data meets the specific of abnormal terms of trade
There are a variety of for implementation.
Illustratively, it is based on transaction data, judges whether transaction corresponding to transaction data meets abnormal terms of trade, it can
To include:
Based on the tentation data in transaction data, judge whether transaction corresponding to the transaction data meets abnormal transaction
Condition.
In practical applications, the transaction data on block may include trade initiator's information, transaction acceptance people information, hand over
Easy timestamp, number of deals, transaction procedure take, after ether mill node gets these transaction data, so that it may from transaction
Corresponding field is read or parsed in data to know the tentation data of the transaction, to judge according to the tentation data known
Whether transaction meets abnormal terms of trade.
In addition, in practical applications, the transaction on block chain can be related to the transaction of a variety of different types of tokens, such as
Ether and the token for following ERC20 agreement.Here, ether is a kind of token title, and ERC 20 is a kind of token agreement.It is different
The transaction of the token of type, the implementation for reading or parsing tentation data from transaction data can be different.For example,
When reading from transaction data or parsing number of deals, for ether, the value field in transaction data can be read
Field contents, obtain transaction amount, which, which shows, currently transfers accounts ether number for including, i.e. the friendship of ether
Easy number.And for the token for following ERC20 agreement, the logs field in transaction data can be parsed, be parsed
Out comprising " 0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a 4df523b3ef "
Character string, the character string are the character string of logical card transfer token transfer method.In the character string parsed, there is transaction to send out
Play the parameter from, the parameter to of transaction acceptance side and the parameter value of trading volume of side, parameter value, that is, generation of trading volume
Table follows the number of deals of the token of ERC20 agreement.
In addition, judging whether transaction corresponding to transaction data meets abnormal friendship based on the tentation data in transaction data
There are a variety of for the specific implementation of easy condition.
Illustratively, based on the tentation data in the transaction data, judge that transaction corresponding to the transaction data is
It is no to meet abnormal terms of trade, may include:
Judge whether the data format of the tentation data meets predetermined abnormal format corresponding with the tentation data,
And/or judge whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data；
If so, determining that transaction corresponding to the transaction data meets abnormal terms of trade, otherwise, it is determined that the transaction
Transaction corresponding to data does not meet abnormal terms of trade.
In the embodiment of the present invention, it is abnormal can both to determine that transaction whether there is according to the data format of tentation data,
Whether can meet corresponding judgment of objectives condition according to the data content of tentation data to determine transaction with the presence or absence of abnormal.When
So, in some cases, only while the data format of tentation data meets predetermined abnormal format, the data of tentation data
Content also complies with corresponding judgment of objectives condition, and it is abnormal just to can determine that transaction exists.
It is understood that the data format or data content of a kind of tentation data have exception, it may indicate that transaction is different
Often, and in some cases, when at least two tentation datas exist simultaneously abnormal, just show that transaction is abnormal, wherein every kind predetermined
Exception present in data can be the exception of data format, or the exception of data content can also be data format
With the dual exception of data content.For example, in oneainstance, the data format of tentation data 1 is abnormal, tentation data 2 number
When all abnormal according to the data format and data content of content exception and tentation data 3, it just may indicate that transaction is abnormal.Therefore,
In practical applications, it can judge whether the corresponding transaction of transaction data meets abnormal transaction item based on a kind of tentation data
Part；At least two tentation datas can also be based on, to judge whether the corresponding transaction of transaction data meets abnormal terms of trade.
In addition, according to passing attack example it can be appreciated that some numbers of deals traded extremely with attack
In, the data format of certain parameter transactions is often abnormal format, such as format as 0XFFFFF.Therefore, it can incite somebody to action
Once occurred or it is expected that it is possible that the parameter transaction of abnormal format considers these predetermined numbers as tentation data in advance
According to various abnormal formats, when a certain tentation data of certain transaction or the abnormal lattice of format character unification kind of certain tentation datas
When formula, so that it may accordingly determine that the transaction meets abnormal terms of trade.
It should be noted that abnormal data format is not limited to 0XFFFFF, this is a kind of, any to be different from the different of normal format
Normal format can be used as the predetermined abnormal format for determining whether transaction meets abnormal terms of trade.
In practical applications, it can be used for judging whether corresponding trade of transaction data meets the predetermined number of abnormal terms of trade
According to there are a variety of.
Illustratively, tentation data may include: one of number of deals, transaction procedure expense and trade initiator's information
Or it is a variety of.In the embodiment of the present invention, number of deals, transaction procedure are taken and trade initiator's information is as tentation datas, to sentence
It breaks off a friendship and easily whether meets abnormal terms of trade, it is, of course, understood that can be used in judging whether transaction meets abnormal transaction
The transaction data of condition is not limited to that.
In order to scheme understand and be laid out it is clear, it is subsequent to make a reservation for described to judge whether the data content of tentation data meets
The embodiment of the corresponding judgment of objectives condition of data is illustrated.
The detection method it is found that exception provided in an embodiment of the present invention is traded of embodiment in summary, when ether mill node
When the transaction data of the block in synchronous block chain, the transaction data of current sync is obtained, and be based on the transaction data, judgement should
Whether transaction corresponding to transaction data meets abnormal terms of trade；When the judgment result is yes, determine that the transaction data is corresponding
Transaction be current ongoing abnormal transaction.One of link due to transaction carry out process is the synchronous block of ether mill node
Therefore the transaction data of the block of chain in the transaction data of the block of the synchronous block chain of ether mill node, judges institute's timed delivery
Easy data are corresponding to trade whether meet abnormal terms of trade, as analyzes whether ongoing transaction is ongoing different
Often transaction.As it can be seen that abnormal transaction detection method provided in an embodiment of the present invention, may be implemented to have from ongoing transaction
Effect detects ongoing abnormal transaction.
In order to which scheme understands and is laid out clear, make a reservation for described to judge whether the data content of tentation data meets below
The embodiment of the corresponding judgment of objectives condition of data is illustrated.
Illustratively, in one implementation, when tentation data includes number of deals, judge the tentation data
Whether data content meets judgment of objectives condition corresponding with the tentation data, may include:
It is preset with reference to number to judge whether number of deals is greater than；
If so, determining that the number of deals meets judgment of objectives condition corresponding with the number of deals.
It should be noted that the transaction that number of deals is huge, not representing the transaction must be just abnormal transaction, the present invention
Why number of deals is greater than the preset transaction with reference to number and is determined as abnormal transaction by embodiment, is because number is huge
Transaction is abnormal a possibility that trading, and transaction general much larger than number is abnormal a possibility that trading.In addition, even if number of deals
The huge transaction of volume is arm's length dealing, can also play the role of warning alert to counterparty.
Here, preset to can be a default number threshold value based on experience value with reference to number, it can also be and be based on
In preset historical time section, number is referred in block chain determined by the average number of deals of each historical trading.
It is understood that different types of token, the preset determination mode with reference to number be can be different.Example
Property, for ether, can be arranged based on experience value with reference to number, such as: it is preset to can be set to 100 with reference to number.
Illustratively, can be based in preset historical time section for following the token of ERC20 agreement, each history in block chain
The average number of deals of transaction determines with reference to number, such as: it can calculate in 3 hours before current time, each history
The average trading volume of the trading volume of transaction, and 3 times of values of average trading volume are referred into number as preset.Illustratively, right
In the token for following ERC20 agreement for having gone up exchange, already have the market price, then it can be by the trading volume of the token
Bit coin is converted to, at this point it is possible to rule of thumb be set as certain amount bit coin, such as 5 with reference to number for preset
Bit coin.In practical applications, whether the token that judgement follows ERC20 agreement has gone up exchange, can be according to transaction data
In, if there is the information for logging in exchange's network address to determine.
Illustratively, in one implementation, tentation data includes that transaction procedure is time-consuming, judges the tentation data
Whether data content meets judgment of objectives condition corresponding with the tentation data, may include:
It is preset with reference to service charge to judge whether the transaction procedure expense is greater than；
If so, determining that the transaction procedure expense meets judgment of objectives condition corresponding with transaction procedure expense.
In practical applications, every to execute an operation when being traded on block, it requires to pay certain formality
Take, with counting as unit of fuel gas, such as: 21000gas etc. will generally be consumed by once transferring accounts.Wherein, gas is by two parts
Composition: fuel limits gas limit and fuel price gas Price, and the two, which is multiplied, is equal to gas.Wherein, gas Price is to use
Family is ready to spend in the price of each gas unit, and gas Limit is that user is ready to execute some operation or confirmation transaction payment
Maximum gas amount.Some exceptions with attack trade that, by priority processing, abnormal high gas can be paid
Therefore Price can refer to service charge by default one, therefore, it is determined that whether transaction meets abnormal terms of trade.
Here, preset to can be the equal of the service charge paid based on the historical trading in block chain with reference to service charge
Value.
Illustratively, when tentation data includes trade initiator's information, judge the tentation data data content whether
Meet judgment of objectives condition corresponding with the tentation data, may include:
According to trade initiator's information, the corresponding target promoter to trade of transaction data is determined；
Determine that target promoter has initiated the transaction stroke count of transaction on the block belonging to transaction data；
Judge whether transaction stroke count reaches or beyond preset early warning transaction stroke count；
If so, determining that trade initiator's information meets judgment of objectives item corresponding with trade initiator's information
Part.
The ether mill current block time is 12 seconds, and within 12 seconds, same promoter initiates a large amount of transaction, then should
Promoter is just very suspicious, and the transaction that the corresponding promoter is initiated is also likely to meet abnormal terms of trade.It therefore, can be pre-
The stroke count if early warning is traded, when a transaction target promoter the exchange the transaction of transaction initiated of block
When stroke count reaches or exceed early warning transaction stroke count, determine that transaction corresponding to transaction data meets abnormal terms of trade.
In addition, in practical applications, existing attack can be described by the way of modeling, transaction ginseng is such as established
Model, the transaction procedure of number format exception take abnormal model and the model of promoter's Information abnormity etc..Then, foundation is utilized
Good challenge model judges transaction, if transaction meets a certain challenge model, then it is assumed that trade as abnormal transaction.When
So, a kind of challenge model can also be uniformly established into all existing attacks, if one kind that transaction meets the model is retouched
It states, then it is assumed that trade as abnormal transaction.
Also, when tentation data includes: number of deals and transaction procedure are time-consuming, the data of the judgement tentation data
Whether content meets judgment of objectives condition corresponding with the tentation data, may include:
It is preset with reference to number to judge whether the number of deals is greater than, and whether the transaction procedure takes greater than preset
With reference to service charge, when judging result, which is, is, determine that transaction corresponding to the transaction data meets abnormal terms of trade.
When tentation data includes: when number of deals and trade initiator's information, the data of the judgement tentation data
Whether content meets judgment of objectives condition corresponding with the tentation data, may include:
It is preset with reference to number to judge whether the number of deals is greater than, and the corresponding target of trade initiator's information
Promoter has initiated the transaction stroke count of transaction on the block belonging to the transaction data, if reach or beyond preset early warning
Transaction stroke count determines that transaction corresponding to the transaction data meets abnormal terms of trade when judging result, which is, is.
When tentation data includes: when transaction procedure expense and trade initiator's information, the number of the judgement tentation data
Whether meet judgment of objectives condition corresponding with the tentation data according to content, may include:
It is preset with reference to service charge to judge whether the transaction procedure expense is greater than, and trade initiator's information is corresponding
Target promoter has initiated the transaction stroke count of transaction on the block belonging to the transaction data, if reach or beyond preset
Early warning transaction stroke count determines that transaction corresponding to the transaction data meets abnormal terms of trade when judging result, which is, is.
Wherein, about judge the number of deals whether be greater than it is preset with reference to number, judge that the transaction procedure takes and be
It is no to refer to service charge greater than preset, and judge to have initiated on target promoter block belonging to the transaction data
The transaction stroke count of transaction, if reach or beyond preset early warning transaction stroke count specific implementation, be referred to above-mentioned
Corresponding plan content when about tentation data including a kind of data, this will not be repeated here.
A kind of abnormal transaction detection device provided in an embodiment of the present invention is described in detail, such as Fig. 2 in second aspect
Shown, abnormal transaction detection device provided in an embodiment of the present invention may include:
Module 201 is obtained, for obtaining the transaction of current sync when the ether mill node isochronous transaction data
Data；
Judgment module 202 judges whether transaction corresponding to the transaction data meets for being based on the transaction data
Abnormal terms of trade；
Determination module 203 is being carried out for when the judgment result is yes, determining the corresponding transaction of the transaction data
Abnormal transaction.
In obtaining module 201, ether mill node isochronous transaction data can be the transaction of the block in synchronous block chain
Data, specifically, can be the real-time deal details on the block for the block chain that ether mill node is saved.
Since transaction data is the Transaction Details of real-time synchronization, in judgment module 202, number of deals can be based on
According to judging whether transaction corresponding to transaction data meets abnormal terms of trade, and when the judgment result is yes, by determination module
203 determine that transaction corresponding to the transaction data is ongoing abnormal transaction.It is emphasized that since transaction carries out
One of link of process is the transaction data of the block of the synchronous block chain of ether mill node, therefore, in ether mill node synchronization zone
When the transaction data of the block of block chain, judge whether the corresponding transaction of institute's isochronous transaction data is abnormal, as analyzes and is carrying out
Transaction whether be ongoing abnormal transaction.That is, the transaction data of the block of the synchronous block chain of ether mill node
When, the corresponding transaction of institute's isochronous transaction data also not up to generates receipt, i.e., the stage that not up to transaction terminates therefore can be with
In the transaction data of the block of the synchronous block chain of ether mill node, judge whether the corresponding transaction of institute's isochronous transaction data is different
Often.
Optionally, judgment module 202 may include judging submodule:
The judging submodule can be used for judging the transaction data institute based on the tentation data in the transaction data
Whether corresponding transaction meets abnormal terms of trade.
Optionally, judging submodule specifically can be used for:
Judge whether the data format of the tentation data meets predetermined abnormal format corresponding with the tentation data,
And/or whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data；
If so, determining that transaction corresponding to the transaction data meets abnormal terms of trade, otherwise, it is determined that the transaction
Transaction corresponding to data does not meet abnormal terms of trade.
Optionally, it is corresponding with the tentation data to judge whether the data content of tentation data meets for judging submodule
Judgment of objectives condition, specifically:
When the tentation data includes the number of deals, judge whether the number of deals is greater than preset reference number
Volume；
If so, determining that the number of deals meets judgment of objectives condition corresponding with the number of deals.
Here, preset to can be a default number threshold value based on experience value with reference to number, it can also be and be based on
In preset historical time section, number is referred in block chain determined by the average number of deals of each historical trading.
Optionally, it is corresponding with the tentation data to judge whether the data content of tentation data meets for judging submodule
Judgment of objectives condition, specifically:
When the tentation data includes that the transaction procedure is time-consuming, judge whether the transaction procedure expense is greater than preset ginseng
Examine service charge；
If so, determining that the transaction procedure expense meets judgment of objectives condition corresponding with transaction procedure expense.Here,
The preset mean value that can be the service charge paid based on the historical trading in block chain with reference to service charge.
Optionally, it is corresponding with the tentation data to judge whether the data content of tentation data meets for judging submodule
Judgment of objectives condition, specifically:
When the tentation data includes trade initiator's information, according to trade initiator's information, institute is determined
State the corresponding target promoter to trade of transaction data；
Determine the transaction stroke count that transaction has been initiated on target promoter block belonging to the transaction data；
Judge whether the transaction stroke count reaches or beyond preset early warning transaction stroke count；
If so, determining that trade initiator's information meets judgment of objectives item corresponding with trade initiator's information
Part.
The detection device it is found that exception provided in an embodiment of the present invention is traded of embodiment in summary, when ether mill node
When the transaction data of the block in synchronous block chain, the transaction data of current sync is obtained, and be based on the transaction data, judgement should
Whether transaction corresponding to transaction data meets abnormal terms of trade；When the judgment result is yes, determine that the transaction data is corresponding
Transaction be current ongoing abnormal transaction.One of link due to transaction carry out process is the synchronous block of ether mill node
Therefore the transaction data of the block of chain in the transaction data of the block of the synchronous block chain of ether mill node, judges institute's timed delivery
Easy data are corresponding to trade whether meet abnormal terms of trade, as analyzes whether ongoing transaction is ongoing different
Often transaction.As it can be seen that abnormal transaction detection device provided in an embodiment of the present invention, may be implemented to have from ongoing transaction
Effect detects ongoing abnormal transaction.
The third aspect, the embodiment of the invention also provides a kind of electronic equipment, which can be ether mill node,
As shown in figure 3, the electronic equipment includes processor 301, communication interface 302, memory 303 and communication bus 304, wherein place
Device 301, communication interface 302 are managed, memory 303 completes mutual communication by communication bus 304,
Memory 303, for storing computer program；
Processor 301 when for executing the program stored on memory 303, realizes following steps:
When the ether mill node isochronous transaction data, the transaction data of current sync is obtained；
Based on the transaction data, judge whether transaction corresponding to the transaction data meets abnormal terms of trade；
When the judgment result is yes, determine that the corresponding transaction of the transaction data is ongoing abnormal transaction.
Optionally, described to be based on the transaction data, judge whether transaction corresponding to the transaction data meets exception
Terms of trade, comprising:
Based on the tentation data in the transaction data, judge whether transaction corresponding to the transaction data meets exception
Terms of trade.
Optionally, the tentation data based in the transaction data, judges transaction corresponding to the transaction data
Whether abnormal terms of trade are met, comprising:
Judge whether the data format of the tentation data meets predetermined abnormal format corresponding with the tentation data,
And/or judge whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data；
If so, determining that transaction corresponding to the transaction data meets abnormal terms of trade, otherwise, it is determined that the transaction
Transaction corresponding to data does not meet abnormal terms of trade.
Optionally, the tentation data includes: number of deals, transaction procedure expense and one of trade initiator's information or
It is a variety of.
Optionally, when the tentation data includes the number of deals, the data content of the judgement tentation data
Whether with the tentation data corresponding judgment of objectives condition is met, comprising:
It is preset with reference to number to judge whether the number of deals is greater than；
If so, determining that the number of deals meets judgment of objectives condition corresponding with the number of deals.
Optionally, the tentation data includes that the transaction procedure is time-consuming, in the data of the judgement tentation data
Hold and whether meet judgment of objectives condition corresponding with the tentation data, comprising:
It is preset with reference to service charge to judge whether the transaction procedure expense is greater than；
If so, determining that the transaction procedure expense meets judgment of objectives condition corresponding with transaction procedure expense.
Optionally, when the tentation data includes trade initiator's information, the number of the judgement tentation data
Whether meet judgment of objectives condition corresponding with the tentation data according to content, comprising:
According to trade initiator's information, the corresponding target promoter to trade of the transaction data is determined；
Determine the transaction stroke count that transaction has been initiated on target promoter block belonging to the transaction data；
Judge whether the transaction stroke count reaches or beyond preset early warning transaction stroke count；
If so, determining that trade initiator's information meets judgment of objectives item corresponding with trade initiator's information
Part.
The communication bus that above-mentioned electronic equipment is mentioned can be Peripheral Component Interconnect standard (Peripheral Component
Interconnect, PCI) bus or expanding the industrial standard structure (Extended Industry Standard
Architecture, EISA) bus etc..The communication bus can be divided into address bus, data/address bus, control bus etc..For just
It is only indicated with a thick line in expression, figure, it is not intended that an only bus or a type of bus.
Communication interface is for the communication between above-mentioned electronic equipment and other equipment.
Memory may include random access memory (Random Access Memory, RAM), also may include non-easy
The property lost memory (Non-Volatile Memory, NVM), for example, at least a magnetic disk storage.Optionally, memory may be used also
To be storage device that at least one is located remotely from aforementioned processor.
Above-mentioned processor can be general processor, including central processing unit (Central Processing Unit,
CPU), network processing unit (Network Processor, NP) etc.；It can also be digital signal processor (Digital Signal
Processing, DSP), it is specific integrated circuit (Application Specific Integrated Circuit, ASIC), existing
It is field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic device, discrete
Door or transistor logic, discrete hardware components.
In another embodiment provided by the invention, a kind of computer readable storage medium is additionally provided, which can
It reads to be stored with instruction in storage medium, when run on a computer, so that computer executes any institute in above-described embodiment
The abnormal transaction detection method stated.
In another embodiment provided by the invention, a kind of computer program product comprising instruction is additionally provided, when it
When running on computers, so that computer executes any abnormal transaction detection method in above-described embodiment.
It should be noted that, in this document, relational terms such as first and second and the like are used merely to a reality
Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation
In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or its any other variant are intended to
Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those
Element, but also including other elements that are not explicitly listed, or further include for this process, method, article or equipment
Intrinsic element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that
There is also other identical elements in process, method, article or equipment including the element.
Each embodiment in this specification is all made of relevant mode and describes, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for device and
For electronic equipment embodiment, since it is substantially similar to the method embodiment, so be described relatively simple, related place referring to
The part of embodiment of the method illustrates.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the scope of the present invention.It is all
Any modification, equivalent replacement, improvement and so within the spirit and principles in the present invention, are all contained in protection scope of the present invention
It is interior.
Claims (10)
1. a kind of abnormal transaction detection method, which is characterized in that it is applied to ether mill node, this method comprises:
When the ether mill node isochronous transaction data, the transaction data of current sync is obtained；
Based on the transaction data, judge whether transaction corresponding to the transaction data meets abnormal terms of trade；
When the judgment result is yes, determine that the corresponding transaction of the transaction data is ongoing abnormal transaction.
2. judging the number of deals the method according to claim 1, wherein described be based on the transaction data
Whether meet abnormal terms of trade according to corresponding transaction, comprising:
Based on the tentation data in the transaction data, judge whether transaction corresponding to the transaction data meets abnormal transaction
Condition.
3. according to the method described in claim 2, it is characterized in that, the tentation data based in the transaction data, sentences
Whether transaction corresponding to the transaction data of breaking meets abnormal terms of trade, comprising:
Judge whether the data format of the tentation data meets predetermined abnormal format corresponding with the tentation data, and/or,
Judge whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data；
If so, determining that transaction corresponding to the transaction data meets abnormal terms of trade, otherwise, it is determined that the transaction data
Corresponding transaction does not meet abnormal terms of trade.
4. according to the method described in claim 3, it is characterized in that, the tentation data includes: number of deals, transaction procedure expense
With one of trade initiator's information or a variety of.
5. described according to the method described in claim 4, it is characterized in that, when the tentation data includes the number of deals
Judge whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data, comprising:
It is preset with reference to number to judge whether the number of deals is greater than；
If so, determining that the number of deals meets judgment of objectives condition corresponding with the number of deals.
6. according to the method described in claim 4, it is characterized in that, the tentation data includes that the transaction procedure is time-consuming, institute
It states and judges whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data, comprising:
It is preset with reference to service charge to judge whether the transaction procedure expense is greater than；
If so, determining that the transaction procedure expense meets judgment of objectives condition corresponding with transaction procedure expense.
7. according to the method described in claim 4, it is characterized in that, the tentation data includes trade initiator's information
When, whether the data content for judging the tentation data meets judgment of objectives condition corresponding with the tentation data, packet
It includes:
According to trade initiator's information, the corresponding target promoter to trade of the transaction data is determined；
Determine the transaction stroke count that transaction has been initiated on target promoter block belonging to the transaction data；
Judge whether the transaction stroke count reaches or beyond preset early warning transaction stroke count；
If so, determining that trade initiator's information meets judgment of objectives condition corresponding with trade initiator's information.
8. a kind of abnormal transaction detection device, which is characterized in that be applied to ether mill node, which includes:
Module is obtained, for obtaining the transaction data of current sync when the ether mill node isochronous transaction data；
Judgment module judges whether transaction corresponding to the transaction data meets abnormal friendship for being based on the transaction data
Easy condition；
Determination module, for when the judgment result is yes, determining that the corresponding transaction of the transaction data is ongoing exception
Transaction.
9. device according to claim 8, which is characterized in that the judgment module, including judging submodule；
The judging submodule, for judging corresponding to the transaction data based on the tentation data in the transaction data
Whether transaction meets abnormal terms of trade.
10. device according to claim 9, which is characterized in that the judging submodule is specifically used for:
Judge whether the data format of the tentation data meets predetermined abnormal format corresponding with the tentation data, and/or,
Whether the data content of the tentation data meets judgment of objectives condition corresponding with the tentation data；
If so, determining that transaction corresponding to the transaction data meets abnormal terms of trade, otherwise, it is determined that the transaction data
Corresponding transaction does not meet abnormal terms of trade.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811645999.XA CN109767329A (en) | 2018-12-29 | 2018-12-29 | Abnormal transaction detection method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811645999.XA CN109767329A (en) | 2018-12-29 | 2018-12-29 | Abnormal transaction detection method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109767329A true CN109767329A (en) | 2019-05-17 |
Family
ID=66453397
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811645999.XA Pending CN109767329A (en) | 2018-12-29 | 2018-12-29 | Abnormal transaction detection method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109767329A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110263536A (en) * | 2019-06-21 | 2019-09-20 | 深圳前海微众银行股份有限公司 | The monitoring method and device of intelligent contract in a kind of block chain |
| CN113269621A (en) * | 2021-06-17 | 2021-08-17 | 上海万向区块链股份公司 | Commodity transaction method and system based on block chain |
| CN114677217A (en) * | 2022-03-14 | 2022-06-28 | 北京交通大学 | Ethernet workshop-oriented abnormal transaction behavior detection method based on subgraph matching |
| CN114691732A (en) * | 2022-03-09 | 2022-07-01 | 中国邮政储蓄银行股份有限公司 | Method and device for positioning abnormal transaction, nonvolatile storage medium and processor |
| CN115187250A (en) * | 2022-09-09 | 2022-10-14 | 南方科技大学 | Detection method, terminal and storage medium for ether house privacy transaction |
| CN118070201A (en) * | 2024-04-22 | 2024-05-24 | 湖南高阳通联信息技术有限公司 | Third party payment abnormal transaction detection method based on blockchain |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105956923A (en) * | 2016-04-20 | 2016-09-21 | 上海如鸽投资有限公司 | Asset transaction platform and digital certification and transaction method for assets |
| KR101814989B1 (en) * | 2017-07-06 | 2018-01-05 | 주식회사 케이뱅크은행 | Method of detecting fraud financial trade and server performing the same |
| CN108306893A (en) * | 2018-03-05 | 2018-07-20 | 北京大学深圳研究生院 | A kind of Novel Distributed Intrusion Detection Method and system of ad-hoc network |
| CN108537668A (en) * | 2018-04-11 | 2018-09-14 | 北京奇虎科技有限公司 | Digital cash method of commerce and device, computing device based on intelligent contract |
-
2018
- 2018-12-29 CN CN201811645999.XA patent/CN109767329A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105956923A (en) * | 2016-04-20 | 2016-09-21 | 上海如鸽投资有限公司 | Asset transaction platform and digital certification and transaction method for assets |
| KR101814989B1 (en) * | 2017-07-06 | 2018-01-05 | 주식회사 케이뱅크은행 | Method of detecting fraud financial trade and server performing the same |
| CN108306893A (en) * | 2018-03-05 | 2018-07-20 | 北京大学深圳研究生院 | A kind of Novel Distributed Intrusion Detection Method and system of ad-hoc network |
| CN108537668A (en) * | 2018-04-11 | 2018-09-14 | 北京奇虎科技有限公司 | Digital cash method of commerce and device, computing device based on intelligent contract |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110263536A (en) * | 2019-06-21 | 2019-09-20 | 深圳前海微众银行股份有限公司 | The monitoring method and device of intelligent contract in a kind of block chain |
| WO2020253476A1 (en) * | 2019-06-21 | 2020-12-24 | 深圳前海微众银行股份有限公司 | Method and device for monitoring smart contract in blockchain |
| CN110263536B (en) * | 2019-06-21 | 2024-05-24 | 深圳前海微众银行股份有限公司 | Method and device for monitoring intelligent contracts in block chain |
| CN113269621A (en) * | 2021-06-17 | 2021-08-17 | 上海万向区块链股份公司 | Commodity transaction method and system based on block chain |
| CN114691732A (en) * | 2022-03-09 | 2022-07-01 | 中国邮政储蓄银行股份有限公司 | Method and device for positioning abnormal transaction, nonvolatile storage medium and processor |
| CN114677217A (en) * | 2022-03-14 | 2022-06-28 | 北京交通大学 | Ethernet workshop-oriented abnormal transaction behavior detection method based on subgraph matching |
| CN114677217B (en) * | 2022-03-14 | 2023-02-07 | 北京交通大学 | Ethernet room-oriented abnormal transaction behavior detection method based on subgraph matching |
| CN115187250A (en) * | 2022-09-09 | 2022-10-14 | 南方科技大学 | Detection method, terminal and storage medium for ether house privacy transaction |
| CN118070201A (en) * | 2024-04-22 | 2024-05-24 | 湖南高阳通联信息技术有限公司 | Third party payment abnormal transaction detection method based on blockchain |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109767329A (en) | Abnormal transaction detection method and device, electronic equipment and storage medium | |
| CN104574050B (en) | The method, apparatus and system settled accounts online | |
| EP2122896B1 (en) | Detecting inappropriate activity by analysis of user interactions | |
| JP6382334B2 (en) | A system for measuring and automatically accumulating various cyber risks and methods for dealing with them | |
| CN105447028B (en) | The method and device of identification feature account | |
| CN107491948B (en) | Transfer payment method based on block chain technology | |
| CN108416668A (en) | Trade tracking and financing by accounts receivable method, system, equipment and storage medium | |
| CN107480978B (en) | Payment method based on block chain technology | |
| CN108647966A (en) | A kind of data interactive method and device based on block chain | |
| CN110349004A (en) | Risk of fraud method for detecting and device based on user node relational network | |
| CN109784870A (en) | Measure of managing contract, device, computer equipment and computer readable storage medium | |
| CN107391359A (en) | A kind of service test method and device | |
| CN110347593B (en) | Flow testing method and device | |
| CN108092955A (en) | Processing method, device, server and the storage medium for information of insuring | |
| CN107451812B (en) | APP payment method on mobile terminal based on block chain technology | |
| CN108198071A (en) | A kind of futures sales counter risk control method and system | |
| CN107239994A (en) | Order processing method, device, computer equipment and computer-readable recording medium | |
| WO2016172985A1 (en) | Commission allocation method and system | |
| CN101261715A (en) | A method and system for online trade based on blog | |
| CN116934061A (en) | Block chain-based carbon emission management method, system, equipment and storage medium | |
| CN116029825B (en) | Block chain transaction method, device and system, electronic equipment and storage medium | |
| CN116739842A (en) | Mobile phone room business data processing method and device, electronic equipment and storage medium | |
| CN110473053A (en) | Risk control method and device based on guarantee | |
| CN111274255A (en) | Service data monitoring method and system, monitoring architecture, equipment and storage medium | |
| CN111198763A (en) | Resource reuse detection method, terminal and computer-readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190517 |
|
| RJ01 | Rejection of invention patent application after publication |