CN113868216B

CN113868216B - Block chain monitoring method and device

Info

Publication number: CN113868216B
Application number: CN202111461828.3A
Authority: CN
Inventors: 谢家贵; 李志平; 王佳慧; 陈玉英; 李悦
Original assignee: China Academy of Information and Communications Technology CAICT
Current assignee: China Academy of Information and Communications Technology CAICT
Priority date: 2021-12-03
Filing date: 2021-12-03
Publication date: 2022-02-22
Anticipated expiration: 2041-12-03
Also published as: CN113868216A

Abstract

The embodiment of the application provides a block chain monitoring method and a block chain monitoring device, wherein first node characteristics of each node of a block chain in a current period are obtained, and second node characteristics of each node in a previous period of the current period are obtained; predicting a first state result according to the first node characteristics, and predicting a second state result according to the second node characteristics; the state result of the node reflects whether an abnormal node exists in the block chain in the current period, and if the abnormal node exists, the state result also reflects whether the node is the abnormal node; and determining a target node from the plurality of nodes of the block chain according to the first state result and the second state result of each node, and monitoring the target node. According to the method and the device, the node state is predicted according to the node characteristics, the target node is determined according to the node state, and finally the target node is monitored, so that the abnormal problem of the individual node of the block chain is found in time through monitoring the target node.

Description

Block chain monitoring method and device

Technical Field

The present application relates to the field of block chain technology, and in particular, to a block chain monitoring method and apparatus.

Background

The block chain technology is used as a distributed account book technology, the technical advantages of the distributed account book technology are mainly embodied in the aspects of data information non-falsification, data information traceability, distributed decentralization, no need of a trust system and the like, and the block chain technology is applied to the fields of finance, health medical treatment, supply chain, asset management, internet e-commerce and the like at present.

With the increase of the nodes of the block chain and the increase of the blocks on the chain, the consistency check difficulty among the nodes is increased. In addition, due to the fault tolerance of the consensus algorithm, when the number of nodes is too large, it is difficult to find the abnormal problem of the individual node in time. For example, CN112015705A discloses a method for monitoring a blockchain log based on deep learning, which can detect whether a blockchain system is abnormal.

In the prior art, CN113194001A discloses a method for monitoring nodes in a blockchain network, which can implement exception checking on a single node. The proposal aims to provide a scheme for monitoring whether a single node of a block chain is abnormal or not.

Disclosure of Invention

The embodiment of the application provides a block chain monitoring method and a block chain monitoring device, which can find the abnormal problem of individual nodes of a block chain in time.

According to a first aspect of embodiments of the present application, there is provided a method for monitoring a block chain, the method including:

according to anchor point time monitored by a block chain, acquiring first node characteristics of each node of the block chain in a current period, and acquiring second node characteristics of each node in a previous period of the current period;

inputting the first node characteristics of each node into a first classification model, and obtaining a first state result predicted by the first classification model for each node, wherein the first state result of each node is used for representing: whether an abnormal node exists in the block chain in the current period or not, and if the abnormal node exists, whether a node corresponding to the first state result is the abnormal node or not;

inputting the second node characteristics of each node into a second classification model to obtain a second state result predicted by the second classification model for each node, wherein the second state result of each node is used for representing: whether an abnormal node exists in the block chain in the current period or not, and if the abnormal node exists, whether a node corresponding to a second state result is the abnormal node or not;

and determining a target node from the plurality of nodes of the block chain according to the first state result and the second state result of each node, and monitoring the target node.

According to a second aspect of embodiments of the present application, there is provided a block chain monitoring apparatus, the apparatus including:

the node characteristic acquisition module is used for acquiring the first node characteristic of each node of the block chain in the current period and acquiring the second node characteristic of each node in the previous period of the current period according to the anchor point time monitored by the block chain;

a first state result obtaining module, configured to input the first node feature of each node into a first classification model, and obtain a first state result predicted by the first classification model for each node, where the first state result of each node is used to characterize: whether an abnormal node exists in the block chain in the current period or not, and if the abnormal node exists, whether a node corresponding to the first state result is the abnormal node or not;

a second state result obtaining module, configured to input a second node feature of each node into a second classification model, to obtain a second state result predicted by the second classification model for each node, where the second state result of each node is used to characterize: whether an abnormal node exists in the block chain in the current period or not, and if the abnormal node exists, whether a node corresponding to a second state result is the abnormal node or not;

and the node monitoring module is used for determining a target node from the plurality of nodes of the block chain according to the first state result and the second state result of each node and monitoring the target node.

By adopting the block chain monitoring method provided by the embodiment of the application, the first node characteristics of each node of the block chain in the current period are obtained, and the second node characteristics of each node in the previous period of the current period are obtained. The first node characteristics are input into a first classification model to obtain a first state result. And inputting the second node characteristics into the second classification model to obtain a second state result. The first state result of the node reflects whether an abnormal node exists in the block chain in the current period, and if the abnormal node exists, the first state result also reflects whether the node is the abnormal node. Similarly, the second state result of the node reflects whether an abnormal node exists in the block chain in the current period, and if the abnormal node exists, the second state result also reflects whether the node is the abnormal node. And finally, determining a target node from the plurality of nodes of the block chain according to the first state result and the second state result of each node, and monitoring the target node. Therefore, the node state is predicted according to the node characteristics, the target node is determined according to the node state, and finally the target node is monitored, so that the abnormal problem of the individual node of the block chain is found in time through monitoring the target node.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the application and together with the description serve to explain the application and not to limit the application. In the drawings:

fig. 1 is a schematic flowchart of a block chain monitoring method according to an embodiment of the present application;

FIG. 2 is a schematic diagram of a model training process provided by an embodiment of the present application;

fig. 3 is a schematic view of a target node monitoring process according to an embodiment of the present application;

fig. 4 is a schematic view of a target node monitoring process according to another embodiment of the present application;

fig. 5 is a schematic view of a target node monitoring process according to another embodiment of the present application;

fig. 6 is a schematic structural diagram of a block chain monitoring device according to an embodiment of the present application.

Detailed Description

In the process of implementing the present application, the inventor finds that, as the number of nodes of a block chain increases and the number of blocks on the chain increases, the difficulty of checking consistency among the nodes also increases. In addition, due to the fault tolerance of the consensus algorithm, when the number of nodes is too large, it is difficult to find the abnormal problem of the individual node in time.

In view of the above problems, an embodiment of the present application provides a block chain monitoring method, which predicts a node state according to a node characteristic, determines a target node according to the node state, and finally monitors the target node, so as to timely find an abnormal problem of an individual node of a block chain through monitoring the target node.

The scheme in the embodiment of the application can be implemented by adopting various computer languages, such as object-oriented programming language Java and transliterated scripting language JavaScript.

In order to make the technical solutions and advantages of the embodiments of the present application more apparent, the following further detailed description of the exemplary embodiments of the present application with reference to the accompanying drawings makes it clear that the described embodiments are only a part of the embodiments of the present application, and are not exhaustive of all embodiments. It should be noted that the embodiments and features of the embodiments in the present application may be combined with each other without conflict.

Referring to fig. 1, fig. 1 is a schematic flowchart of a block chain monitoring method according to an embodiment of the present application. As shown in fig. 1, the block chain monitoring method includes the following steps:

step S110: according to anchor point time monitored by the block chain, first node characteristics of each node of the block chain in the current period are obtained, and second node characteristics of each node in the previous period of the current period are obtained.

In this application, in some specific embodiments, the monitoring device of the blockchain may automatically trigger the monitoring process according to a preset time/period, the monitoring device of the blockchain may also be manually triggered by a user to trigger the monitoring process, and a time point at which monitoring is triggered each time is used as an anchor point time. And each time when the time reaches the anchor point moment, acquiring the first node characteristic of each node in the current period and acquiring the second node characteristic of each node in the previous period of the current period. In the present application, the previous cycle is a cycle before and closest to the anchor point time. In the present application, by obtaining the first node feature and the second node feature at the anchor point time, the target node may be determined and monitored through the following steps S120 to S140.

In the present application, the node characteristics of each node may be acquired periodically, for example, the node characteristics are acquired every 1 minute. For convenience of description, the node feature of the current period is simply referred to as a first node feature, and the node feature of the previous period of the current period is simply referred to as a second node feature.

In some embodiments, the execution subject of the blockchain monitoring method may be a preset script in the monitoring device. And calling a target intelligent contract of each node of the block chain by a preset script so that each node acquires the node characteristics of the node by executing the target intelligent contract and returns the acquired node characteristics to the monitoring equipment.

In some embodiments, the node features include: node attribute characteristics, node behavior characteristics, and node performance characteristics. The node attribute characteristics comprise the creation time of the node, the type of the node (such as whether the node is a consensus node). The node behavior characteristics comprise transaction frequency, average transaction amount, median of transaction amount, historical abnormal records and the like in corresponding periods. The node performance characteristics comprise the block-out speed of the node in the corresponding period. In addition, the node characteristics also include acquisition time, for example, the intermediate time point of the corresponding period of the node characteristics can be used as the acquisition time of the node characteristics. And splicing the node attribute characteristics, the node behavior characteristics, the node performance characteristics, the acquisition time and the like to obtain the node characteristics.

Step S120: inputting the first node characteristics of each node into a first classification model, and obtaining a first state result predicted by the first classification model for each node, wherein the first state result of each node is used for representing: and if the abnormal node exists, whether the node corresponding to the first state result is the abnormal node is judged.

In some embodiments, after inputting the first node characteristic of a node into the first classification model, the first classification model outputs one of the following three results: normal, abnormal-1, abnormal-2. If the first state result output by the first classification model is normal, the first classification model predicts: there are no exception nodes in the blockchain. If the first state result output by the first classification model is abnormal-1, the first classification model predicts according to the first node feature of the node: an exception node exists in the blockchain, but the node is not an exception node. If the first state result output by the first classification model is abnormal-2, the first classification model predicts according to the first node feature of the node: an abnormal node exists in the block chain, and the node is an abnormal node.

For the current cycle, a first set of state results may be established that includes three subsets, a first subset, a second subset, and a third subset. If the first state result of a node is normal, the node identification of the node is recorded to the first subset. If the first state result of a node is abnormal-1, the node identity of the node is recorded to the second subset. If the first state result of a node is abnormal-2, the node identity of the node is recorded to the third subset.

Step S130: inputting the second node characteristics of each node into a second classification model to obtain a second state result predicted by the second classification model for each node, wherein the second state result of each node is used for representing: and whether the abnormal node exists in the block chain in the current period or not, and if the abnormal node exists, whether the node corresponding to the second state result is the abnormal node or not.

In some embodiments, after inputting the second node characteristics of a node into the second classification model, the second classification model outputs one of the following three results: normal, abnormal-1, abnormal-2. If the second state result output by the second classification model is normal, the second classification model predicts: there are no exception nodes in the blockchain. If the second state result output by the second classification model is abnormal-1, the second classification model predicts according to the second node feature of the node: an exception node exists in the blockchain, but the node is not an exception node. If the second state result output by the second classification model is abnormal-2, the second classification model predicts according to the second node feature of the node: an abnormal node exists in the block chain, and the node is an abnormal node.

For the current cycle, a second set of state results may be established that includes three subsets, a fourth subset, a fifth subset, and a sixth subset. If the second state result of a node is normal, the node identification of the node is recorded to the fourth subset. If the second state result of a node is abnormal-1, the node identity of the node is recorded to the fifth subset. If a node's second state results in abnormal-2, then the node's node identification is recorded to the sixth subset.

Step S140: and determining a target node from the plurality of nodes of the block chain according to the first state result and the second state result of each node, and monitoring the target node.

According to the method and the device, the node state is predicted according to the node characteristics, the target node is determined according to the node state, and finally the target node is monitored, so that the abnormal problem of the individual node of the block chain is found in time through monitoring the target node.

In some embodiments, the first classification model and the second classification model may be trained in advance, and then the trained first classification model is applied to step S120 and the trained second classification model is applied to step S130.

Referring to fig. 2, fig. 2 is a schematic diagram of a model training process according to an embodiment of the present application. As shown in fig. 2, the training process of the first classification model and the second classification model includes the following steps:

step S001: the node characteristics of each node of the block chain are periodically acquired, whether each node characteristic belongs to the node characteristics in the monitoring time or not is judged according to the monitoring time of the block chain and the acquisition time of each node characteristic, the node characteristics belonging to the monitoring time are used as the characteristics in monitoring, and the node characteristics belonging to the monitoring time before are used as the characteristics before monitoring.

Step S002: according to the monitoring result corresponding to the monitoring time, adding a state label for the monitoring time characteristic and the monitoring pre-characteristic of each node, wherein the state label is used for representing: and if the abnormal node exists, whether the node corresponding to the characteristic during monitoring and the characteristic before monitoring is the abnormal node is judged.

In this application, a user may manually trigger a blockchain monitoring procedure before or during training of the first and second classification models. Therefore, the node feature acquired in a certain period may be exactly the node feature acquired in the monitoring time.

As before, the node characteristics include node attribute characteristics, node behavior characteristics, node performance characteristics, and acquisition time T1. If T1 in a certain node feature is within the monitoring time, the node feature is marked as a monitoring time feature, and the monitoring time feature is further marked according to the result of the monitoring (namely whether an abnormal node exists in the blockchain system or not and whether the abnormal node is the current node or not). If the result of the monitoring process is that no abnormal node exists in the blockchain system, a normal label, such as normal, is marked on the characteristic during monitoring. If the result of the monitoring process is that there is an abnormal node in the blockchain system, but the abnormal node is not the current node, a label indicating a common abnormality, such as abnormal-1, can be marked on the feature during monitoring. If the result of this monitoring process is that there is an abnormal node in the blockchain system and the abnormal node is the current node, a label indicating a serious abnormality, such as abnormal-2, can be marked on the feature during monitoring.

In this application, if T1 in a certain node feature is not within the monitoring time, but is located before the monitoring process, and the time interval from the monitoring process is less than the preset time, the node feature is marked as a pre-monitoring feature, and the pre-monitoring feature is further marked according to the result of the monitoring (i.e., whether there is an abnormal node in the block chain system, and whether the abnormal node is the current node).

Step S003: and aiming at the monitoring time characteristic and the pre-monitoring characteristic of each node, inputting the monitoring time characteristic into the first classification model to obtain a third state result predicted by the first classification model, and inputting the pre-monitoring characteristic into the second classification model to obtain a fourth state result predicted by the second classification model.

The first classification model can be a random forest algorithm model, a neural network model and the like, and the type of the first classification model is not limited in the application.

Step S004: and updating the first classification model and the second classification model according to the third state result, the fourth state result, the state label of the characteristic during monitoring and the state label of the characteristic before monitoring.

In some embodiments, to update the model, the first loss value may be determined according to the third status result and the status label of the monitoring time characteristic; determining a second loss value according to the fourth state result and the state label of the characteristic before monitoring; determining a third loss value according to the third state result and the fourth state result; and determining a total loss value according to the first loss value, the second loss value and the third loss value, and updating the first classification model and the second classification model according to the total loss value.

Wherein, when determining the first loss value, the euclidean distance between the third state result and the state label of the feature at the time of monitoring can be used as the first loss value. In determining the second loss value, the euclidean distance between the fourth state result and the state label of the pre-monitoring feature may be used as the second loss value. In determining the third loss value, a euclidean distance between the third state result and the fourth state result may be used as the third loss value. And finally, calculating a weighted average of the first loss value, the second loss value and the third loss value, and taking the weighted average as a total loss value.

Referring to fig. 3, in some embodiments, step S140 may include the following sub-steps:

substep S141: judging whether a first target node exists in all nodes of the block chain or not according to the first state result and the second state result of each node; wherein the first state result and the second state result of the first target node both represent: abnormal nodes exist in the block chain in the current period, and the first target node is the abnormal node.

In a specific implementation, it may be determined whether the same node identifier exists between the third subset in the first state result set and the sixth subset in the second state result set. In short, it is determined whether the same node identification exists between the third subset and the sixth subset. And if so, taking the node corresponding to the node identification as the first target node.

Substep S142: and under the condition that a first target node exists in the nodes of the block chain, determining all the nodes of the block chain as target nodes, and monitoring the target nodes.

In this application, if the same node identifier is recorded in the third subset and the sixth subset, it is indicated that the corresponding node is predicted as an abnormal node by the first classification model and the second classification model at the same time, thereby indicating that a block chain may have a serious abnormality. Therefore, all nodes of the block chain can be determined as target nodes and monitored for the target nodes.

In some optional embodiments, if there is a first target node and no user actively triggers a monitoring instruction currently, and the time interval from the time point of the next automatic monitoring is greater than a time threshold T0', all nodes of the blockchain are determined as target nodes and monitoring is performed on the target nodes.

With continued reference to fig. 3, step S140 may further include the following sub-steps:

substep S143: and under the condition that the first target node does not exist in all nodes of the block chain, judging whether a second target node exists in all nodes of the block chain or not according to the first state result and the second state result of each node. And the first state result and the second state result of the second target node are characterized in that: and no abnormal node exists in the block chain in the current period.

In a specific implementation, it may be determined whether the same node identifier exists between the first subset in the first state result set and the fourth subset in the second state result set. Briefly, it is determined whether the same node identification exists between the first subset and the fourth subset. And if so, taking the node corresponding to the node identification as a second target node.

Substep S144: and monitoring the respective newly added block data and consensus condition of the second target node.

For the purpose of avoiding redundancy, the specific monitoring method is described in detail below.

Substep S145: judging whether a third target node exists in all nodes of the block chain or not according to the first state result and the second state result of each node; wherein one of the first state result and the second state result of the third target node characterizes: abnormal nodes exist in the block chain in the current period, and the third target node is an abnormal node.

In a specific implementation, the node identifier recorded in the third subset of the first state result set may be a corresponding node, and the node identifier may be used as a third target node. Similarly, the nodes recorded in the sixth subset in the aforementioned second state result set are also identified as corresponding nodes, and are taken as third target nodes. In short, the nodes recorded in the third subset are identified as corresponding nodes, and are taken as third target nodes. And identifying the node recorded in the sixth subset as the corresponding node, and taking the node as a third target node.

Substep S146: and monitoring whether the newly added block data of the third target node is abnormal or not by taking the newly added block data of the second target node as a reference.

In the application, the first state result and the second state result corresponding to the second target node are both normal, and the second target node is predicted to be a normal node by both the first classification model and the second classification model. Therefore, in the application, the newly added block data of the second target node is taken as a reference, and the newly added block data of the third target node is monitored, so that whether the newly added block data of the third target node is abnormal or not can be predicted.

substep S147: judging whether a fourth target node exists in all nodes of the block chain or not according to the first state result and the second state result of each node; wherein at least one of the first state result and the second state result of the fourth target node characterizes: abnormal nodes exist in the block chain in the current period, and the fourth target node is not an abnormal node.

Substep S148: and monitoring whether the newly added block data of the fourth target node is abnormal or not by taking the newly added block data of the second target node as a reference.

In specific implementation, the nodes corresponding to the node identifiers recorded in the second subset and the fifth subset at the same time may be used as the fourth target node, and the newly added block data of the second target node is used as a reference, so as to monitor the newly added block data of the fourth target node.

And then, taking the node corresponding to the node identifier only recorded in the second subset or the fifth subset as a fourth target node, and monitoring the newly added block data of the fourth target node by taking the newly added block data of the second target node as a reference.

In the above substeps 141 to S148, once an abnormality is found, the abnormality information is displayed by a visual monitoring tool, or a url address of a page file for displaying the abnormality information is pushed to a preset communication terminal.

In the above substeps 141 to S148, tests are performed in order of the probability of occurrence of an abnormality from high to low, so that the throughput of each substep is relatively small, and it can be found out in a more timely manner whether an abnormality actually exists in a node having a relatively large probability of occurrence of an abnormality.

Referring to fig. 4, in some embodiments, the process of monitoring the target node specifically includes:

step S410: and sending the anchor point time to each target node, so that each target node returns the newly added block data after the anchor point time according to the anchor point time, and returns the first block outlet speed corresponding to the newly added block data.

Step S420: and determining a deviation threshold according to the network time delay of the block chain, the block chain consensus period and the first block-out speed of each target node.

Specifically, the second block output speed may be determined according to the first block output speed of each target node; and dividing the sum of the second block speed and the block chain consensus period by the block chain consensus period to obtain a ratio, and determining a deviation threshold according to the ratio.

Step S430: and comparing whether the newly added block data of each target node has difference, and determining the newly added block data with difference.

Step S440: and determining the block height difference according to the block heights corresponding to the newly added block data with differences.

Step S450: and determining whether the data consistency between the target nodes is abnormal or not according to the block height difference value and the deviation threshold value.

During specific implementation, the monitoring equipment comprises a display module, and the display module displays various monitoring data of the block chain in real time. Before the monitoring device performs the monitoring task each time, it may record an anchor point time (i.e. current time), and record display information of the block chain to be detected at the anchor point time as first information, where the first information may include, for example, current block height, user number and user information, total transaction amount, and even may include other information such as transaction amount of each block.

And acquiring expected change information corresponding to each constructed monitoring scene, wherein the expected change information may include user number change information, transaction change information, block change information and the like. And acquiring current display information of the block chain as second information, comparing the second information with the first information, determining change information of the second information relative to the first information, judging whether the determined change information is consistent with the expected change information, if so, judging that the function of the block chain system is correct, otherwise, presenting an abnormal part.

Then, by performing the above steps S410 to S450, the consistency between the nodes is monitored. Specifically, the monitoring device may transmit the anchor point time as a parameter to a preset interface of each node, and call the preset interface to obtain a first block output speed and newly added block data of the node.

For the sake of understanding, the following description will take the processing flow after the preset interface of the node i in the blockchain is called as an example. In fact, the processing flow of each blockchain node in the blockchain after the preset interface is called is basically consistent.

The block chain node i determines the time interval between the anchor point time and the current time as a target time interval, and determines the block output speed of the node in the target time interval according to the log file, wherein the block output speed can be obtained in the following way: and aiming at each block packed by the node in the target time period, acquiring a first time length from the start of packing the block to the completion of packing the block by the node, and averaging the acquired first time lengths or taking the maximum value of the acquired first time lengths as a first block discharging speed.

And the block chain node i returns the first block outlet speed of the node and newly added block data filtered based on the anchor point time to the monitoring equipment.

The newly added block data comprises the block height seq of each newly added block, the transaction quantity tx _ count in the newly added block and the transaction total quantity total _ count corresponding to the newly added block from the anchor point moment of the block chain copy on the node. The aforementioned three seq, tx _ count and total _ count are in one-to-one correspondence. Here, the added block data may be presented in the form of an array, i.e., an array of the added block data. Each element in the newly added block data array is that the block height of a block j representing a block chain node i newly added in a target time interval is seq _ j, the transaction quantity is tx _ count _ j, and the total transaction quantity of the block chain copy on the block chain node i from the first block to the block j is total _ count _ j.

The monitoring device averages or maximizes the plurality of first block-out speeds, and determines the obtained result as a second block-out speed. And the monitoring equipment acquires the network delay of the block chain system through a ping command and then obtains a deviation threshold value according to the second block outlet speed, the network delay and the consensus period. Specifically, the deviation threshold is obtained by the following calculation equation: [ (second out block speed + network delay)/consensus period ] +1, where [ ] denotes rounding up.

The monitoring device judges whether the newly added blocks of each block chain node in the target time period (i.e. the monitoring process) are consistent, complete and continuous according to the deviation threshold and the newly added block data array of each block chain node. The specific judgment process is as follows:

assuming that the number of block chain nodes in a block chain is n, generating a cache array j for each newly added block j in the block chain within a target time period, comparing whether data elements corresponding to the block j in newly added block data arrays of a 1 st block chain node and a 2 nd block chain node are the same, if so, putting the compared data elements of the block j into the cache array j, and at the moment, storing one data element (namely, one piece of block information) in the cache array j; if the two data elements are different, adding the data elements corresponding to the block j in the newly added block data arrays of the 1 st block chain node and the 2 nd block chain node into the cache array j, wherein two data elements (namely two pieces of block information) exist in the cache array j.

Sequentially taking data elements corresponding to the block j in the newly added block data array of each residual block chain node as target elements, comparing the target elements with the data elements in the cache array j, and if the target elements exist in the cache array j, not processing the target elements; if the target element does not exist in cache array j, the target element is added to cache array j.

After the comparison of the data elements corresponding to the block j in the newly added block data arrays of all the block chain nodes is completed, if only one data element exists in the cache array j, the newly added block j of each block chain node in the target time period is consistent; if the number of the data elements existing in the cache array j is more than 1, the fact that at least one block chain node is inconsistent with other block chain nodes which are newly added in the target time interval is shown.

And for inconsistent block information/data elements in the cache array j, judging whether the difference value of seq in each data element is smaller than the deviation threshold, if so, determining that each data element is consistent, otherwise, determining that each data element is inconsistent. Specifically, if two pieces of block information exist in the cache array j, a difference value of block heights seq corresponding to the two pieces of block information is calculated, and whether the difference value is smaller than the deviation threshold value is judged. If three or more pieces of block information exist in the cache array j, calculating the difference value of the block heights seq corresponding to every two pieces of block information, then selecting the maximum difference value from all the difference values, and judging whether the maximum difference value is smaller than the deviation threshold value.

It should be noted that, in the present application, the seq difference should be 0 theoretically, because the newly added blocks at the same time period on each node of the block chain should be the same. However, due to network delay, each block chain node may have a certain difference in the newly added blocks in the same time period, but the difference cannot be too large. Therefore, the deviation threshold is determined in advance according to the network delay, the consistency between the nodes is judged according to the deviation threshold, the reliability of the judgment result can be improved, and the misjudgment is avoided.

Referring to fig. 5, in some embodiments, the process of monitoring the target node specifically includes:

step S510: sending a log analysis request carrying anchor point time to each target node, so that each target node returns a first log record behind the anchor point time according to the anchor point time; wherein the first log record comprises: a consensus message reception record, a consensus message transmission record, and a view switch record for the target node.

Step S520: and aiming at each block of each target node, judging whether the consensus information receiving record corresponding to the block reaches a preset threshold value.

Step S530: and under the condition that the consensus message receiving record corresponding to the block reaches a preset threshold value, determining a sending node of each consensus message receiving record, judging whether the corresponding block of the sending node corresponds to the relevant consensus message sending record, and if so, determining that the consensus message receiving record is correct.

Step S540: and under the condition that all the consensus information receiving records corresponding to each block of each target node are correct, determining that the consensus condition of the target node is normal.

During specific implementation, as before, in real time, the monitoring device includes a display module, and the display module displays various monitoring data of the block chain in real time. The monitoring device may record an anchor point time (i.e., the current time) each time before performing a monitoring task.

The monitoring equipment sends a log analysis request to each block link point of the block chain through the script service, and the log analysis request carries the anchor point time. The block chain node receives the log analysis request, acquires the anchor point time therein, screens out a first log record after the anchor point time from the node, and filters out a consensus message receiving record, a consensus message sending record and a view switching record of each consensus stage from the first log record according to the consensus stage keywords (including pre-preamble, preamble and commit). Each consensus message receiving record or the consensus message sending record comprises a sending node address and a receiving node address. The block chain node returns the filtered first log record to the monitoring equipment.

And for each first log record, the monitoring equipment searches a node file corresponding to the block link point to which the monitoring equipment belongs from the local file, and further searches a first file from the node file. The first file is named by the block height of the consensus process to which the first log record belongs. If the first log record is found, the first log record is written into the first file.

The monitoring equipment obtains the local file through the script service and traverses each node file in the local file. For each node file, the chunk file in the node file is traversed. And for each stage under the block file, sequentially reading the consensus message receiving records at the stage, and firstly judging whether the number of the consensus message receiving records is greater than or equal to a threshold value n-f, wherein n is greater than or equal to 3f +1, n is the number of consensus nodes, and f is the number of malicious nodes. If the number of the consensus message receiving records reaches the threshold value, further verifying the consensus message receiving records, wherein the specific verification process is as follows:

suppose the name of the currently verified block file is a block ID, and the node file where the currently verified block file is located corresponds to the first block chain node. Then for each consensus message receive record, determining its sending node address as the address of the second blockchain node.

And searching the consensus information sending record with the receiving node address as the address of the first blockchain node from the block file with the name of the block ID under the node file of the second blockchain node. If the current verification result is found, the current verification consensus message receiving record is determined to be correct.

And under the condition that the consensus information receiving records under all the node files are correct, determining that the consensus condition of the newly added blocks under all the nodes is normal.

It is worth noting that most common consensus test verification methods at present are test analysis from unit testing of a code layer or from input and output of a business logic layer, and in contrast, the monitoring method for the common consensus process provided by the application more comprehensively and intuitively covers the common consensus process, is easier to find the problem of deep-level sublevel obscuration in the common consensus process, and can quickly locate specific block chain nodes and specific common consensus stages with abnormal common consensus.

In the above, the present application provides a method for monitoring a block chain through embodiments, and in the following, the present application provides a device for monitoring a block chain through embodiments.

Referring to fig. 6, fig. 6 is a schematic structural diagram of a block chain monitoring device according to an embodiment of the present application. As shown in fig. 6, the block chain monitoring apparatus includes:

a node characteristic obtaining module 610, configured to obtain, according to anchor point time monitored by a block chain, a first node characteristic of each node of the block chain in a current period, and obtain a second node characteristic of each node in a previous period of the current period;

a first state result obtaining module 620, configured to input the first node feature of each node into a first classification model, and obtain a first state result predicted by the first classification model for each node, where the first state result of each node is used to characterize: whether an abnormal node exists in the block chain in the current period or not, and if the abnormal node exists, whether a node corresponding to the first state result is the abnormal node or not;

a second state result obtaining module 630, configured to input the second node feature of each node into a second classification model, to obtain a second state result predicted by the second classification model for each node, where the second state result of each node is used to characterize: whether an abnormal node exists in the block chain in the current period or not, and if the abnormal node exists, whether a node corresponding to a second state result is the abnormal node or not;

a node monitoring module 640, configured to determine a target node from the multiple nodes of the block chain according to the first state result and the second state result of each node, and monitor the target node.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

While the preferred embodiments of the present application have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all alterations and modifications as fall within the scope of the application.

It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.

Claims

1. A method for block chain monitoring, the method comprising:

inputting the first node characteristics of each node into a first classification model, and obtaining a first state result predicted by the first classification model for each node, wherein the first state result of each node is used for representing: whether an abnormal node exists in the block chain in the current period, if the abnormal node exists, the first state result is also used for representing: whether the node corresponding to the first state result is an abnormal node or not;

inputting the second node characteristics of each node into a second classification model to obtain a second state result predicted by the second classification model for each node, wherein the second state result of each node is used for representing: and whether an abnormal node exists in the block chain in the current period, if so, the second state result is also used for representing: whether the node corresponding to the second state result is an abnormal node or not;

2. The method of claim 1, further comprising: training the first classification model and the second classification model;

the training process of the first classification model and the second classification model comprises the following steps:

periodically acquiring the node characteristics of each node of the block chain, judging whether each node characteristic belongs to the node characteristics in the monitoring time or not according to the monitoring time of the block chain and the acquisition time of each node characteristic, taking the node characteristics belonging to the monitoring time as the characteristics during monitoring, and taking the node characteristics belonging to the monitoring time before as the characteristics before monitoring;

adding a state label for the monitoring time characteristic and the monitoring pre-characteristic of each node according to the monitoring result corresponding to the monitoring time, wherein the state label is used for representing: and if the abnormal node exists, the state label is also used for representing that: whether the node corresponding to the monitoring time characteristic and the monitoring front characteristic is an abnormal node or not;

inputting the monitoring time characteristics into the first classification model to obtain a third state result predicted by the first classification model, and inputting the pre-monitoring characteristics into the second classification model to obtain a fourth state result predicted by the second classification model aiming at the monitoring time characteristics and the pre-monitoring characteristics of each node;

and updating the first classification model and the second classification model according to the third state result, the fourth state result, the state label of the feature during monitoring and the state label of the feature before monitoring.

3. The method of claim 2, wherein the updating the first classification model and the second classification model according to the third state result, the fourth state result, the state label of the feature at the time of monitoring, and the state label of the feature before monitoring comprises:

determining a first loss value according to the third state result and the state label of the monitoring time characteristic;

determining a second loss value according to the fourth state result and the state label of the pre-monitoring feature;

determining a third loss value according to the third state result and the fourth state result;

and determining a total loss value according to the first loss value, the second loss value and the third loss value, and updating the first classification model and the second classification model according to the total loss value.

4. The method of claim 1, wherein determining a target node from a plurality of nodes of the blockchain according to the first state result and the second state result of each node and monitoring for the target node comprises:

judging whether a first target node exists in all nodes of the block chain or not according to the first state result and the second state result of each node; wherein the first state result and the second state result of the first target node both characterize: an abnormal node exists in the block chain in the current period, and the first target node is an abnormal node;

and under the condition that a first target node exists in all nodes of the block chain, determining all nodes of the block chain as target nodes, and monitoring the target nodes.

5. The method of claim 4, wherein determining a target node from the plurality of nodes of the blockchain based on the first state result and the second state result of each node and monitoring for the target node further comprises:

under the condition that no first target node exists in all nodes of the block chain, judging whether a second target node exists in all nodes of the block chain or not according to the first state result and the second state result of each node; wherein the first state result and the second state result of the second target node both characterize: abnormal nodes do not exist in the block chain in the current period;

monitoring the newly added block data and the consensus condition of the second target node;

judging whether a third target node exists in all nodes of the block chain or not according to the first state result and the second state result of each node; wherein one of the first state result and the second state result of the third target node characterizes: an abnormal node exists in the block chain in the current period, and the third target node is an abnormal node;

and monitoring whether the newly added block data of the third target node is abnormal or not by taking the newly added block data of the second target node as a reference.

6. The method of claim 5, wherein determining a target node from a plurality of nodes of the blockchain based on the first state result and the second state result of each node and monitoring for the target node further comprises:

judging whether a fourth target node exists in all nodes of the block chain or not according to the first state result and the second state result of each node; wherein at least one of the first state result and the second state result of the fourth target node characterizes: an abnormal node exists in the block chain in the current period, and the fourth target node is not an abnormal node;

and monitoring whether the newly added block data of the fourth target node is abnormal or not by taking the newly added block data of the second target node as a reference.

7. The method of claim 1, wherein the monitoring for the target node comprises:

sending an anchor point time to each target node, so that each target node returns newly-added block data after the anchor point time according to the anchor point time and returns a first block outlet speed corresponding to the newly-added block data;

determining a deviation threshold according to the network time delay of the block chain, the block chain consensus period and the first block outlet speed of each target node;

comparing whether the newly added block data of each target node have difference, and determining the newly added block data with difference;

determining a block height difference value according to the respective corresponding block heights of the newly added block data with differences;

and determining whether the data consistency between the target nodes is abnormal or not according to the block height difference value and the deviation threshold value.

8. The method of claim 7, wherein determining the deviation threshold based on the blockchain network delay, the blockchain consensus period, and the first block out speed of each target node comprises:

determining a second block outlet speed according to the first block outlet speed of each target node;

and dividing the sum of the second block-out speed and the block chain consensus period by the block chain consensus period to obtain a ratio, and determining a deviation threshold according to the ratio.

9. The method of claim 1, wherein the monitoring for the target node comprises:

sending a log analysis request carrying anchor point time to each target node, so that each target node returns a first log record behind the anchor point time according to the anchor point time; wherein the first log record comprises: receiving a common identification message record, sending a common identification message record and switching a view record of a target node;

aiming at each block of each target node, judging whether the consensus information receiving record corresponding to the block reaches a preset threshold value or not;

under the condition that the consensus message receiving record corresponding to the block reaches a preset threshold value, determining a sending node of each consensus message receiving record, judging whether the corresponding block of the sending node corresponds to the relevant consensus message sending record, and if so, determining that the consensus message receiving record is correct;

and under the condition that all the consensus information receiving records corresponding to each block of each target node are correct, determining that the consensus condition of the target node is normal.

10. A blockchain monitoring apparatus, the apparatus comprising:

a first state result obtaining module, configured to input the first node feature of each node into a first classification model, and obtain a first state result predicted by the first classification model for each node, where the first state result of each node is used to characterize: whether an abnormal node exists in the block chain in the current period, if the abnormal node exists, the first state result is also used for representing: whether the node corresponding to the first state result is an abnormal node or not;

a second state result obtaining module, configured to input a second node feature of each node into a second classification model, to obtain a second state result predicted by the second classification model for each node, where the second state result of each node is used to characterize: and whether an abnormal node exists in the block chain in the current period, if so, the second state result is also used for representing: whether the node corresponding to the second state result is an abnormal node or not;