CN115018502A

CN115018502A - Virtual currency public link network transaction node IP-based tracing method and system

Info

Publication number: CN115018502A
Application number: CN202210743303.7A
Authority: CN
Inventors: 高辉; 高杰; 陈鹏鹄; 郑宇�
Original assignee: Fujian Hongchuang Technology Information Co ltd
Current assignee: Fujian Hongchuang Technology Information Co ltd
Priority date: 2021-08-25
Filing date: 2022-06-27
Publication date: 2022-09-06
Also published as: CN113706304A

Abstract

The invention provides a tracing method and a tracing system based on a virtual currency public link network transaction node IP, wherein the method collects transaction information of each node through a probe node deployed in a virtual currency public link network, determines the probability of a potential neighbor node corresponding to each transaction node according to the arrival time sequence of each transaction information received by the probe node, and then calculates the routing overheads of two transaction nodes based on the probability value to obtain the routing overheads of each two adjacent transaction nodes. And then, taking a time ordering set when a certain transaction message reaches the probe node and a certain transaction node as an originating node to correspond to the difference of the propagation path routing overhead ordering set reaching the probe node, if the difference is minimum, determining the transaction node as the originating node corresponding to the transaction and highlighting the transaction node and the corresponding propagation path in the transaction topology. Through the scheme of the application, the tracing of each transaction information in the virtual currency public chain network can be realized.

Description

Tracing method and system based on virtual currency public link network transaction node IP

Technical Field

The invention relates to the technical field of server node monitoring, in particular to a tracing method and a tracing system based on a virtual currency public link network transaction node IP.

Background

Recently, with the rapid development of block chain technology, the size of virtual currency transactions is gradually increased, and the wide attention is attracted at home and abroad. Taking the bit currency transaction in the virtual currency as an example, the bit currency transaction has the characteristics of block chain decentralization and anonymization, so that the identity of a virtual currency transactor is difficult to identify, and a hidden space is provided for illegal activities (such as illegal item transaction, virtual currency Lesox virus, money laundering and the like). The virtual currency transaction based on the block chain has the decentralization characteristic, and has stronger anti-traceability capacity compared with the traditional financial system.

Virtual currency transaction systems based on blockchains generally have the following characteristics: (1) the IP address of the trader is anonymous, the trader IP is an account number used when the user participates in the virtual currency transaction when the virtual currency is transacted, the address is created by the user, the address is irrelevant to the identity information of the user, and a third party is not required to participate in the creating and using processes. (2) The transaction nodes are distributed, and the virtual currency system supports users to initiate transactions through different transaction nodes, so that the transaction information of the users is distributed in different transaction nodes, and the identity characteristics of the users are difficult to find through analyzing transaction records. (3) The network structure is decentralized, the virtual currency system adopts P2P (peer-to-peer network) protocol for networking, and no central node exists.

Based on the characteristics of the virtual currency system, it is difficult to track the propagation path of the transaction information in the virtual currency public link network by monitoring a single server, and the traditional transaction tracing technology cannot be applied to the virtual currency system. Therefore, the existing tracing technology cannot predict the starting node of the transaction information in the virtual currency public link network, and the accuracy of tracing the transaction information is influenced.

Disclosure of Invention

Therefore, a technical scheme for tracing the source of the transaction node IP based on the virtual currency public link network is needed to be provided, so as to solve the problem that the existing virtual currency tracing technology cannot predict the originating node of the transaction information.

To achieve the above object, in a first aspect, the present invention provides a method for tracing a virtual currency public link network transaction node IP, where the method includes the following steps:

s1: setting at least one probe node in the virtual currency public link network; the probe node is configured to be capable of establishing connections with all nodes in the virtual currency public link network;

s2: monitoring all transaction information of each transaction node in the virtual currency public link network in a transaction process through the probe node, and determining the probability of potential neighbor nodes corresponding to each transaction node in the virtual currency public link network based on the sequence of time when the transaction information reaches the probe node;

s3: establishing a transaction topology of a primary virtual currency public link network according to potential neighbor nodes of all transaction nodes in the virtual currency public link network, and converting probability values of the transaction nodes and the corresponding potential neighbor nodes into routing overheads of adjacent transaction nodes;

s4: calculating network routing overheads of any two adjacent transaction nodes according to the probability value of the potential neighbor node corresponding to each transaction node in the determined virtual currency public link network, and obtaining a propagation path routing overheads set of each transaction node based on the routing overheads of each two adjacent transaction nodes; the propagation path routing overhead set is a set of the sum of the routing overhead of each propagation path received by the probe node through different propagation paths by a certain transaction information initiated by a transaction node if the transaction node is an originating node;

s5: the probe node judges the time of each transaction message actually occurring in the virtual currency public link network reaching the probe node, counts the time of each transaction message reaching the probe node, and sorts the corresponding node IP according to the reaching sequence to obtain a first sorting set group;

s6: judging the difference degree of a time sorting set which is corresponding to a certain transaction information and reaches the probe node in the first sorting set group and a propagation path routing overhead sorting set which is corresponding to a certain transaction node as an originating node and reaches the probe node, and if the difference degree is minimum, determining the transaction node as the originating node corresponding to the transaction;

s7: according to the starting node determined in the step S6, all the propagation paths from the starting node to the probe node are calculated, and the starting node and the corresponding propagation paths are highlighted in the transaction topology of the initial virtual currency public link network.

Further, the transaction information arrival time refers to timestamp information of each transaction information received by the probe node, and the IP address information of the transaction sender is the IP address information of the sender forwarding the transaction information to the probe node;

the step of determining the probability of the potential neighbor nodes corresponding to the transaction nodes in the virtual currency public link network based on the sequence of the time when the transaction information reaches the probe node comprises the following steps:

the probe node classifies all collected transaction information according to different transaction hash values, and sorts the IP addresses of the transaction senders corresponding to the transaction information with the same transaction hash value according to the sequence of the arrival time of the received transaction information of each transaction information, so as to obtain a first sorting set group.

Further, "obtaining a propagation path routing cost set of each transaction node based on the network routing cost of each two adjacent transaction nodes" includes:

and taking a plurality of propagation paths with the shortest propagation route overhead, and arranging the route overheads of the propagation paths according to a sequence from small to large to obtain the propagation path route overhead set.

Further, "determining a difference between a time-ordered set corresponding to a certain transaction information in the first ordered set group and a propagation path routing cost ordered set corresponding to an originating node and reaching the probe node" includes:

taking a plurality of shortest time when a certain transaction information reaches the probe node as elements of a time set corresponding to the transaction information, and arranging the elements in the time set from small to large; the number of the plurality of times is the same as the selected number of the plurality of propagation paths;

and calculating the difference degree of the element values from the first ranking to the last ranking in the time set and the element values from the first ranking to the last ranking in each propagation path routing overhead set in the element and the sequence of the element values, and selecting the transaction node corresponding to the minimum difference degree as the originating node of the current transaction information.

Further, "determining a difference between a time-ordered set corresponding to a certain transaction information in the first ordered set group and reaching the probe node and a propagation path network overhead set corresponding to a certain transaction node" includes:

taking a plurality of shortest time when a certain transaction message reaches the probe node as elements of a time set corresponding to the transaction message, arranging the elements in the time set from small to large, and marking the elements according to sequence numbers to obtain a real arrangement sequence; the number of the plurality of times is the same as the selected number of the plurality of propagation paths;

and selecting the elements in the time set one by one as potential originating nodes, calculating a set of the sum of the routing overheads of each propagation path received by the probe node through different propagation paths by the transaction node originating transaction information, sequencing the elements according to the sum of the routing overheads from small to large to obtain a simulated arrangement sequence, calculating the difference degree between the simulated arrangement sequence and the real arrangement sequence, and finally determining the corresponding element with the minimum difference degree as the originating node of the transaction information.

Further, "determining the probability of the potential neighbor node corresponding to each transaction node in the virtual currency public link network based on the sequence of the time when the transaction information reaches the probe node" includes:

counting the number of sequencing sets of a target node and a node to be tested which simultaneously appear in a first sequencing set group, calculating the ratio of the number of the sequencing sets of the target node and the node to be tested which simultaneously appear to the number of sets of the target node in the first sequencing set group, and outputting the calculation result as the probability that the node to be tested is a potential neighbor node of the target node.

Further, the step of "calculating a ratio of the number of the ordering sets in which the target node and the node to be detected simultaneously appear to the number of sets including the target node in the first ordering set group, and outputting a calculation result as a probability that the node to be detected is a potential neighbor node of the target node" includes:

calculating the ratio of the number of the sequencing sets of the target node and each node to be tested appearing at the same time to the number of sets containing the target node in the first sequencing set group, and obtaining and outputting the probability of each node to be tested as a potential neighbor node of the target node;

and screening out the nodes to be tested with the probability of the potential neighbor nodes as the target nodes being larger than a preset probability threshold value when the number of the nodes to be tested is larger than a preset number, and taking the nodes to be tested as the potential neighbor nodes of the target nodes.

Further, the method comprises:

the probe node requests a node information table known by a target node from the target node connected with the probe node to serve as a visible node information table corresponding to the target node, judges whether identification information of a node to be detected of a potential neighbor node listed as the target node is present in the visible node information table corresponding to the target node, if so, the node to be detected is reserved as the potential neighbor node of the target node, otherwise, the node to be detected is removed from the potential neighbor node of the target node.

Further, "converting into network routing overhead of any two adjacent transaction nodes according to the probability values of the potential neighbor nodes corresponding to the transaction nodes in the virtual currency public link network determined as follows":

and carrying out standardized conversion on the probability values of potential neighbor nodes corresponding to the transaction nodes, and converting the probability values of two transaction nodes which are neighbor nodes to each other into network routing overheads corresponding to the two transaction nodes.

In a second aspect, the present invention also provides a system for tracing a virtual currency public link network transaction node IP, the system comprising a storage medium having stored therein a computer program which, when executed, implements the method according to the first aspect of the present invention.

Different from the prior art, the invention has the following characteristics: the method comprises the steps of collecting transaction information transmitted by each node through probe nodes deployed in a virtual currency public link network, determining the probability of potential neighbor nodes corresponding to each transaction node in the virtual currency public link network according to the sequence of arrival time of each transaction information received by the probe nodes, and then calculating the routing overheads of two transaction nodes based on the probability values to obtain the routing overheads of each two adjacent transaction nodes. And then, taking the time ordering set when a certain transaction message reaches the probe node and a certain transaction node as an originating node to correspond to the difference degree of the propagation path routing overhead ordering set reaching the probe node, and if the difference degree is minimum, determining the transaction node as the originating node corresponding to the transaction. By the scheme, the starting nodes of all transaction information in the virtual currency public link network can be predicted, and the transaction information can be traced.

Drawings

Fig. 1 is a flowchart of an IP discrimination method based on a virtual currency public link network transaction originating node according to a first embodiment of the present invention;

fig. 2 is a flowchart of an IP discrimination method based on a virtual currency public link network transaction originating node according to a second embodiment of the present invention;

fig. 3 is a flowchart of an IP discrimination method based on a virtual currency public link network transaction originating node according to a third embodiment of the present invention;

fig. 4 is a flowchart of an IP discrimination method based on a virtual currency public link network transaction neighbor node according to a first embodiment of the present invention;

fig. 5 is a flowchart of an IP discrimination method based on a virtual currency public link network transaction neighbor node according to a second embodiment of the present invention;

fig. 6 is a flowchart of an IP discrimination method based on a virtual currency public link network transaction neighbor node according to a third embodiment of the present invention;

fig. 7 is a flowchart of an IP discrimination method based on a virtual currency public link network transaction neighbor node according to a fourth embodiment of the present invention;

fig. 8 is a method for connecting a probe node to a global transaction node according to an embodiment of the present invention;

fig. 9 is a schematic diagram of an electronic device according to an embodiment of the present invention;

fig. 10 is a schematic diagram of first-order neighbor nodes corresponding to each target node according to an embodiment of the present invention;

fig. 11 is a full-chain first-order link node connection topology diagram according to an embodiment of the present invention.

Detailed Description

In order to explain in detail possible application scenarios, technical principles, practical embodiments, and the like of the present application, the following detailed description is given with reference to the accompanying drawings in conjunction with the listed embodiments. The embodiments described herein are merely for more clearly illustrating the technical solutions of the present application, and therefore, the embodiments are only used as examples, and the scope of the present application is not limited thereby.

Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase "an embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or related to other embodiments specifically defined. In principle, in the present application, the technical features mentioned in the embodiments can be combined in any manner to form a corresponding implementable technical solution as long as there is no technical contradiction or conflict.

Unless defined otherwise, technical terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the use of relational terms herein is intended only to describe particular embodiments and is not intended to limit the present application.

In the description of the present application, the term "and/or" is a expression for describing a logical relationship between objects, indicating that three relationships may exist, for example, a and/or B, indicating that: there are three cases of A, B, and both A and B. In addition, the character "/" herein generally indicates that the former and latter associated objects are in a logical relationship of "or".

In this application, terms such as "first" and "second" are used merely to distinguish one entity or operation from another entity or operation without necessarily requiring or implying any actual such relationship or order between such entities or operations.

Without further limitation, in this application, the use of "including," "comprising," "having," or other similar expressions in phrases and expressions of "including," "comprising," or "having," is intended to cover a non-exclusive inclusion, and such expressions do not exclude the presence of additional elements in a process, method, or article that includes an element, such that a process, method, or article that includes a list of elements may include not only those elements but also other elements not expressly listed or inherent to such process, method, or article.

As is understood in the examination of the guidelines, the terms "greater than", "less than", "more than" and the like in this application are to be understood as excluding the number; the expressions "above", "below", "within" and the like are understood to include the present numbers. In addition, in the description of the embodiments of the present application, "a plurality" means two or more (including two), and expressions related to "a plurality" similar thereto are also understood, for example, "a plurality of groups", "a plurality of times", and the like, unless specifically defined otherwise.

To facilitate understanding of the concepts described herein, certain terms referred to herein are defined and explained below, in particular as follows:

(1) virtual currency public link network

The virtual currency public link network refers to a virtual currency transaction network constructed based on the blockchain technology, and virtual currencies can include bitcoin, lexel, ethernet and the like. Typically, a virtual currency public link network includes a plurality of transaction nodes, each transaction node may be implemented by a server or a cluster of servers.

The transaction nodes in the virtual currency public link network are communicated through a specific communication protocol, for example, the bit currency transaction is taken as an example, and each transaction node can be connected into the bit currency transaction network by initiating a 'connect ip-xxxx-port' command. Meanwhile, in order to ensure that the receiving and forwarding of the transaction information are not interfered by other information, the user of each transaction node can shield the transaction information of other types of virtual money by setting a port authority, namely, each transaction node is ensured to only receive the transaction information in a certain virtual money public link network once being connected into the virtual money public link network.

(2) Probe node

The probe node in the application refers to a transaction node which is provided with a tracing program and is deployed in a virtual currency public link network, and the tracing program is used for analyzing and processing various data collected and recorded by the probe node when being executed so as to judge the probability that a certain node is a neighbor node of another node. The probe node in the application is configured to be capable of establishing connection with all other transaction nodes in the virtual currency public link network, so that the transaction information forwarded by all transaction nodes in the virtual currency public link network can be acquired. The probe node joins a virtual currency public link network by sending a specific protocol command.

(3) Transaction information

Typically, in a virtual currency public link network, transaction information includes transaction hash values, transaction status, transaction amount, timestamps, sender addresses, recipient addresses, mine fees, random numbers, and other information. The transaction hash value is obtained by encrypting transaction information through a hash algorithm by a blockchain and compressing the encrypted information into a hash character string consisting of a string of numbers and letters, and can uniquely and accurately identify a transaction record and forward the transaction record to a next transaction node along with transaction contents (such as transaction amount and other remarks) of the transaction. In the process of transmitting the transaction information, although the same transaction information is continuously transmitted by each transaction node, the transaction hash value of the same transaction information is always unchanged. The same transaction here refers to a transaction initiated by a transaction node at a certain point in time.

(4) Transaction information arrival time

In the present application, the transaction information arrival time refers to the time information of each transaction information received by the probe node. Preferably, the arrival time of the transaction information can be expressed by a differential time, which is a difference between a timestamp of a certain transaction received by the probe node and a timestamp of the transaction initiated in the virtual currency public link network, namely network delay. When a certain transaction node initiates a certain transaction, based on the transaction mechanism of the virtual currency, all transaction nodes in the virtual currency public link network can know the initiation time of the transaction, but cannot know which transaction node initiated the transaction. The method and the device establish connection with all transaction nodes by setting the probe nodes, and then calculate the probability that a certain node is a neighbor node of another node by respectively monitoring and collecting all transaction information.

(5) IP address information of transaction sender

In the present application, the IP address information of the sender of the transaction is the IP address information of the sender that forwards the transaction information to the probe node. In short, all transaction nodes in the virtual currency public link network are connected with the probe node, that is, the probe node is a neighbor node of all transaction nodes, so that the probe node can continuously receive transaction information forwarded by each transaction node, and the probe node can record the arrival time corresponding to each transaction information and the IP address of a sender (that is, which node transaction IP sends the transaction information to the probe node) besides classifying the transaction information according to the transaction hash value.

(6) Node to be tested and target node

The node to be tested is relative to the target node, and one of the purposes of the present application is to determine the probability that a certain node is a neighbor node of another node, for example, if it needs to be determined whether the node a is the probability value of the neighbor node of the node B, the node a is the node to be tested, and the node B is the target node.

(7) Seed node

In the virtual currency public link network, a plurality of nodes which run stably for a long time are regarded as seed nodes, and the seed nodes are even written into a program in a hard coding mode, so that other nodes in the network can be found quickly by connecting to the seed nodes. The IP addresses of the seed nodes in the virtual currency transaction block chain are known, and the probe node can acquire node information (including the IP addresses of all transaction nodes in part or all transactions) from a plurality of seed nodes and other node IP information known by the nodes. And the probe node sends connection requests to the collected node information, and establishes connection one by one, so that the probe node can establish connection with all transaction nodes in the current virtual currency public link network.

As shown in fig. 1, in a first aspect, the present invention provides a method for tracing a virtual currency public link network transaction node IP, the method comprising the following steps:

s4: calculating network routing overheads of any two adjacent transaction nodes according to the probability values of potential neighbor nodes corresponding to the transaction nodes in the determined virtual currency public link network, and obtaining a propagation path routing overhead set of the transaction nodes based on the routing overheads of the two adjacent transaction nodes; the propagation path routing overhead set is a set of the sum of the routing overhead of each propagation path received by the probe node through different propagation paths by a certain transaction information initiated by a transaction node if the transaction node is an originating node;

s5: the method comprises the steps that a probe node judges the time of each transaction information actually occurring in a virtual currency public link network reaching the probe node, counts the time of each transaction information reaching the probe node, and sorts corresponding node IP according to the reaching sequence to obtain a first sorting set group;

In this embodiment, the probe node classifies the collected transaction information according to the transaction hash value. Each transaction has a corresponding transaction hash value, and different transactions involve different transaction hash values. The collected transaction information is classified according to the transaction hash values through the probe nodes, so that the arrival time of the transaction information of the same hash value, which is forwarded to the probe nodes through different propagation links, can be known, and the IP addresses of the transaction senders corresponding to the arrival times of a plurality of transaction information with the top rank are selected according to the sequence of the arrival times to obtain a first sequencing set group.

Aiming at the same virtual currency transaction with the same transaction hash value, a probe node receives a plurality of versions of transaction information from transaction nodes of different paths in a virtual currency public link network, although the transaction hash value of each version of transaction information is the same, because the time for forwarding the transaction information by different transaction nodes is different (usually, two transaction nodes which are adjacent nodes can appear in the first arrival time sequence of the same transaction information), the probe node can sequence corresponding transaction senders according to the arrival time sequence of the received transaction information with the same hash value, after a first sequencing set group is obtained, the time sequencing set which arrives at the probe node and corresponds to a certain transaction information in the first sequencing set group is judged, and the difference degree of the propagation path route overhead sequencing set which corresponds to the probe node with a certain transaction node as an originating node is judged, and if the difference degree is minimum, determining the transaction node as an originating node corresponding to the transaction.

After confirming the corresponding originating node of each transaction, the originating node and the corresponding propagation path can be highlighted in the transaction topology of the initial virtual currency public link network, so that an observer can clearly know the trend of the propagation path of each transaction. The observer can also search the corresponding transaction information propagation path by inputting the transaction hash value, that is, the originating node and the propagation path of the transaction information corresponding to the received transaction hash value are only highlighted in the transaction topology of the initially set virtual currency public link network. Highlighting may be accomplished by changing colors, adding display effects (e.g., blinking), and the like.

By the scheme, the judgment of the neighbor nodes corresponding to all target nodes in the virtual currency public link network can be completed, so that the transaction topology of the initially set virtual currency public link network is constructed, meanwhile, the judgment of the starting node of each transaction message can be realized, the starting node and all propagation paths from the starting node to the probe node are highlighted in the transaction topology of the initially set virtual currency public link network, and the tracing of the transaction messages can be effectively realized.

Preferably, the different propagation paths may be ordered according to the total cost of the originating node to reach the probe node, and the different propagation paths may be identified by different colors, for example, the fastest propagation path may be identified by green, and the slowest propagation path may be identified by red or yellow. Of course, the identification may also be performed according to the hash value of the transaction information, for example, the originating node and the propagation path of the transaction information corresponding to the transaction hash value a are both marked as green, and the originating node and the propagation path of the transaction information corresponding to the transaction hash value B are both marked as yellow, so that the location and the corresponding propagation path of the originating node of each transaction information can be clearly known.

In some embodiments, "deriving a set of propagation path routing costs for each respective transaction node based on the network routing costs for each respective two neighboring transaction nodes" comprises: and taking a plurality of propagation paths with the shortest propagation route overhead, and arranging the route overheads of the propagation paths according to a sequence from small to large to obtain the propagation path route overhead set. In short, the greater the probability that two transaction nodes are adjacent to each other, the smaller the routing overhead between the two transaction nodes, after calculating the overhead of any two transaction nodes in the virtual currency public link network, the sum of the routing overheads reaching the probe node through different propagation paths assuming that any one transaction node in the virtual currency public link network is used as an originating node can be calculated, and the routing overheads of the propagation paths are arranged in the order from small to large to obtain the propagation path routing overhead set. The routing overhead set records the time of any transaction node as an originating node to reach the probe node through different propagation paths, so that subsequent fitting is convenient to be used as a basis for judging the originating node of certain transaction information.

In some embodiments, the transaction information arrival time refers to timestamp information of each transaction information received by the probe node, and the IP address information of the transaction sender is IP address information of a sender forwarding the transaction information to the probe node; the step of determining the probability of the potential neighbor node corresponding to each transaction node in the virtual currency public link network based on the sequence of the time when the transaction information reaches the probe node comprises the following steps: the probe node classifies all collected transaction information according to different transaction hash values, and sorts the IP addresses of the transaction senders corresponding to the transaction information with the same transaction hash value according to the sequence of the arrival time of the received transaction information of each transaction information, so as to obtain a first sorting set group.

As shown in fig. 2, in some embodiments, the "determining a difference between the time-ordered set corresponding to a certain transaction message in the first ordered set group and the propagation path routing cost ordered set corresponding to the probe node as the originating node" includes:

firstly, step S201 is entered, a plurality of shortest time when a certain transaction information reaches the probe node is taken as elements of a time set corresponding to the transaction information, and all the elements in the time set are arranged according to a sequence from small to large; the number of the plurality of times is the same as the selected number of the plurality of propagation paths;

then step S202 is entered to calculate the difference degree of the element values from the first to the last ranking in the time set and the element values from the first to the last ranking in each propagation path routing overhead set in the element and the sequence of the element values, and the transaction node corresponding to the minimum difference degree is selected as the originating node of the current transaction information.

As shown in fig. 3, in other embodiments, "determining a difference between a time-ordered set corresponding to a certain transaction information in the first ordered set group and reaching the probe node and a propagation path network overhead set corresponding to a certain transaction node" includes:

firstly, step S301 is entered, a plurality of shortest time when a certain transaction information reaches the probe node is taken as elements of a time set corresponding to the transaction information, all the elements in the time set are arranged according to a sequence from small to large and marked according to sequence numbers, and a real arrangement sequence is obtained; the number of the plurality of times is the same as the selected number of the plurality of propagation paths;

and then step S302 is carried out, elements in the time set are selected one by one to serve as potential originating nodes, a set of the sum of the routing overheads of each propagation path received by the probe node through different propagation paths by the transaction node originating transaction information is calculated, the sum of the routing overheads is sorted from small to large to obtain a simulated arrangement sequence, the difference degree between the simulated arrangement sequence and the real arrangement sequence is calculated, and finally the corresponding element with the minimum difference degree is determined as the originating node of the transaction information.

In short, when determining an originating node of a certain transaction information, starting from a simulated transaction, a corresponding propagation path may be calculated when each node in the virtual currency public link network is taken as the originating node, a propagation routing overhead set may be calculated for different propagation paths of a certain transaction node, and assuming that there are 1000 transaction nodes in the network, an overhead set of 1000 transaction propagation paths may be constructed, each element in the routing overhead set, the measuring and calculating time of the probe node and the corresponding IP are obtained by the corresponding transaction node through the forwarding of the first-order, second-order and third-order neighbor nodes, and then acquiring 10 IPs of a certain actually-occurring transaction information (transaction information with the same hash value) reaching the probe node first, fitting the 10 IPs with the IPs corresponding to the first 10 elements of the 1000 routing cost sets, and determining the transaction node corresponding to the routing cost set with the highest fitting degree as an actual originating node.

Or starting from actual transaction, firstly calculating a plurality of times when the probe node actually receives a certain transaction message (the transaction message with the same hash value) first reaches the probe node, establishing a time element set (the time element set records the sequence of time arrival and the IP address of the transaction node corresponding to the sequence), then, the elements (the IP addresses of the transaction nodes) in the time set are selected one by one to be used as potential originating nodes, the set of the sum of the routing overhead of each propagation path received by the probe node through different propagation paths by the transaction node originating transaction information is calculated, and sequencing according to the sum of the routing overheads from small to large to obtain a simulated arrangement sequence, calculating the difference degree between the simulated arrangement sequence and the real arrangement sequence, and finally determining the corresponding element with the minimum difference degree as the originating node of the transaction information.

As shown in fig. 4-7, the present application also provides a method for determining whether a certain transaction node is a neighbor node of another transaction node, which specifically includes the following steps: the S11 probe node counts the number of the sequencing sets of the target node and the node to be detected in the first sequencing set group, calculates the ratio of the number of the sequencing sets of the target node and the node to be detected in the first sequencing set group to the number of sets of the target node, and outputs the calculation result as the probability that the node to be detected is the potential neighbor node of the target node.

For example, when a probe node collects 10000 transaction information which occurs in a virtual currency public link network in a certain time period, and selects and records the IP addresses of the first 8 transaction senders which arrive at the front of the certain transaction information, a first ordered set group of 10000 rows and 8 columns can be obtained, and if 2000 transaction nodes appear in 10000 sets and 1500 transaction nodes a and B appear together, the probability that the transaction node B is a neighbor node of the transaction node a can be calculated to be 1500/2000-0.75. Based on the above manner, the probability value that one transaction node in the virtual currency public link network is another transaction node can be calculated, so that the construction of the transaction topology of the virtual currency public link network is completed, and the tracing of subsequent transaction information is facilitated.

As shown in fig. 4, the "calculating a ratio of the number of the ordering sets in which the target node and the node to be detected appear simultaneously to the number of sets including the target node in the first ordering set group, and outputting a calculation result as a probability that the node to be detected is a potential neighbor node of the target node" includes:

firstly, step S401 is carried out to calculate the ratio of the number of the sequencing sets where the target node and each node to be tested simultaneously appear to the number of sets containing the target node in the first sequencing set group, and the probability that each node to be tested is used as a potential neighbor node of the target node is obtained and output;

and then, step S402 is carried out, when the number of the nodes to be tested is larger than the preset number, the nodes to be tested, which are taken as the target nodes, are screened out, and the probability of the potential neighbor nodes is larger than the preset probability threshold value, and the nodes to be tested are taken as the potential neighbor nodes of the target nodes.

Preferably, the predetermined number is less than 10. For example, the preset number is 8, assuming that the preset probability threshold value is 0.6, and when the transaction nodes a are taken as target nodes and the transaction nodes in the virtual currency public link network are judged one by one as nodes to be tested, the nodes to be tested are the probability values of the neighbor nodes of the transaction nodes a, and assuming that the number of the nodes to be tested which is obtained through final calculation and meets the probability value of being greater than 0.6 is 12, the first 8 nodes with the larger probability value are selected as the potential neighbor nodes of the transaction nodes a. Of course, if the number of the nodes to be tested which satisfy the probability value of more than 0.6 and are obtained by calculation is less than 8, the first 8 nodes with the larger probability value can be directly selected as the potential neighbor nodes of the transaction node A.

As shown in fig. 5, the method includes:

firstly, entering step S501, the probe node requests a node information table known by a target node from the target node connected with the probe node, and the node information table is used as a visual node information table corresponding to the target node;

and then, the step S502 is carried out to judge whether the identification information of the node to be detected of the potential neighbor node listed as the target node appears in a visible node information table corresponding to the target node, if so, the step S503 is carried out to reserve the node to be detected as the potential neighbor node of the target node, otherwise, the step S504 is carried out to remove the node to be detected from the potential neighbor node of the target node.

In the virtual currency public link network, each transaction node has a node information table corresponding to the transaction node, wherein node IP addresses with information interaction with the transaction node in historical data are stored, the node IP addresses are arranged according to the sequence of interaction time from near to far, if two transaction nodes are adjacent nodes, the IP address of the other transaction node is stored in the node information table of one transaction node, namely in the past historical transaction data, the two transaction nodes should transmit transaction information with each other.

Therefore, the node information table known by the target node is obtained and used as the visible node information table corresponding to the target node, and then whether the identification information of the node to be detected of the potential neighbor node listed as the target node appears in the visible node information table corresponding to the target node is judged, if yes, the node to be detected is reserved as the potential neighbor node of the target node, otherwise, the node to be detected is removed from the potential neighbor node of the target node. By the method, the accuracy of judging whether the node to be detected is the neighbor node of the target node can be further improved.

As shown in fig. 6, in certain embodiments, the method comprises:

firstly, entering a step S601 to select a plurality of nodes to be tested with the highest probability values of potential neighbor nodes of the target node as neighbor nodes of the target node;

then, step S602 is carried out, the neighbor nodes of the target node are used as new target nodes, and the probability of potential neighbor nodes of the new target node is calculated and output according to the method of step S11;

and then, the step S603 is carried out, and the steps are repeated until the neighbor nodes of all the transaction nodes in the virtual currency public link network are confirmed.

For example, the target node is a transaction node a, and for the target node a, the method in step S11 is adopted to screen out the transaction node with the probability value of top 8 as a potential neighbor node of the target node a, where the 8 transaction nodes are transaction nodes B-transaction node I, and then any one of the transaction nodes B-transaction node I may be used as a new target node, and all neighbor nodes of the new target node are obtained through calculation. By analogy, until all transaction nodes in the virtual currency public link network are calculated once as target nodes, the neighbor nodes corresponding to all transaction nodes in the virtual currency public link network can be obtained.

In some embodiments, "translating into a network routing cost of any two neighboring transaction nodes according to the determined probability values of potential neighbor nodes corresponding to the transaction nodes in the virtual currency public link network": and carrying out standardized conversion on the probability values of potential neighbor nodes corresponding to the transaction nodes, and converting the probability values of two transaction nodes which are neighbor nodes to each other into network routing overheads corresponding to the two transaction nodes. Routing overhead, that is, network delay, generally, the higher the probability that two transaction nodes are mutually neighbor nodes, the shorter the communication time required for information interaction between the two transaction nodes, that is, the smaller the routing overhead. The normalization calculation may thus comprise: and taking the reciprocal of each probability value obtained by calculation, and converting the probability value into the routing overhead of the adjacent transaction nodes. After the routing cost among all the adjacent transaction nodes is calculated, the time that transaction information initiated by any transaction node in the virtual currency public link network as a transaction initiating node reaches the probe node through any propagation path can be obtained through estimation, and the initiating node and the propagation path of each transaction information in the virtual currency public link network can be predicted according to the specific numerical value of each transaction time received by the probe node, so that the tracing of the transaction information is completed.

As shown in fig. 7, in certain embodiments, the method comprises:

the method comprises the following steps of S701, acquiring all transaction information in a plurality of unit times, respectively calculating the probability that a node to be detected is a potential neighbor node of a target node in each unit time to obtain a group of probability value sequences, and fitting the probability value sequences to obtain a probability value fitting function corresponding to the node to be detected;

then, step S702 is carried out to obtain all transaction information in the next unit time, and the probability that the node to be tested is a potential neighbor node of the target node in the current unit time is calculated;

and then step S703 is performed to determine whether the probability that the node to be measured is a potential neighbor node of the target node in the current unit time matches the result predicted by the fitting function, if so, step S704 is performed to keep the node to be measured as a potential neighbor node of the target node, otherwise, step S705 is performed to remove the node to be measured from the potential neighbor node of the target node.

For example, all transaction information is acquired within a preset time period (including multiple unit time periods), the acquired transaction information is sliced according to unit time (such as 1 day), then the probability of the potential neighbor node of the target node is calculated according to the transaction information within each unit time, and the probability of taking a certain node to be measured as the potential neighbor node of the target node can be correspondingly calculated within multiple unit times. And fitting the probabilities as discrete points to obtain a fitting function, and predicting the probability of the node to be detected as a potential neighbor node of the target node based on the transaction information of the next unit time according to the fitting function. The probability value in the next period is predicted by calculating the fitting function, and the further screening of the potential neighbor nodes of the target node can be realized by comparing the predicted value with the actual value, so that the transaction topology of the initially-set virtual currency public link network is more practical, and the accuracy of transaction tracing is improved.

Preferably, the judging whether the probability that the node to be tested is the potential neighbor node of the target node in the current unit time is matched with the result predicted by the fitting function includes: and judging whether the frequency of the probability that the node to be detected is the potential neighbor node of the target node in the current unit time deviates from the predicted value of the fitting function exceeds a preset frequency, if so, judging that the node to be detected is not matched with the target node, otherwise, judging that the node to be detected is matched with the target node.

In some embodiments, the information transmitted between the probe node and all nodes in the virtual currency public link network comprises first type message information and second type message information; the first type message information is message information which can influence the judgment result of a neighbor node and comprises the transaction information, and the second type message information is message information except the first type message information;

the method comprises the following steps:

the probe node is configured to not forward the first type message information, and normally process the second type message information, so that the probe node always keeps an active state in the virtual currency public link network.

Taking a bitcoin trading network as an example, the interaction protocol between adjacent trading nodes in two networks comprises the protocols of node discovery, connection, message forwarding, initial block downloading, an SPV client, heartbeat messages and the like. The information such as getaddr, addr message broadcast, getlocks, getdata and the like is first type message information, and the probe node does not forward the information. The interaction information such as heartbeat message information, connection information (such as version synchronization information), node discovery and the like is second type message information, and the probe node normally processes such messages, so that the probe node is always in an active state in the virtual currency public link network, and the concealment of the probe node in the whole transaction network is improved.

As shown in fig. 8, the number of the seed nodes is multiple, and each seed node stores node information corresponding to a part of transaction nodes in the virtual currency public link network; the probe node is configured to be capable of establishing connection with all nodes in the virtual currency public link network, and comprises the following steps:

firstly, in step S801, after a probe node establishes connection with each seed node in the virtual currency public link network, a node information acquisition request is sent to all the seed nodes;

then, the probe node enters the step S802 to acquire the node information stored by each seed node; the node information includes IP address information of a corresponding node in the virtual currency public link network;

and then, step S803 is entered, the probe node sorts the node information sent by all the seed nodes, and initiates a connection request to the IP address of each node to establish a connection.

Then, step S804 is performed, where the probe node sorts the node information sent by all the seed nodes, including: when the received node information sent by various child nodes contains a plurality of same IP addresses, a connection request is initiated to only one of the IP addresses.

By arranging the node information sent by all the seed nodes and only initiating a connection request to one of the IP addresses, the bandwidth can be effectively saved.

In a second aspect, the present invention also provides a system for tracing a virtual currency public link network transaction node IP, the system comprising a storage medium that can be placed in a probe node, the storage medium having stored therein a computer program that, when executed, implements the method according to the first aspect of the present invention.

As shown in fig. 9, the system may be an electronic device 10 comprising a processor 101 and a storage medium 102, the storage medium 102 being a storage medium according to the second aspect; the processor 101 is electrically connected to said storage medium 102 for executing a computer program stored in the storage medium 102 for carrying out the method steps as of the first aspect.

Preferably, the electronic device is a computer device, including but not limited to: personal computers, servers, general-purpose computers, special-purpose computers, network devices, embedded devices, programmable devices, intelligent mobile terminals, intelligent home devices, wearable intelligent devices, vehicle-mounted intelligent devices, and the like. Storage media include, but are not limited to: RAM, ROM, diskette, tape, optical disk, flash memory, U disk, removable hard disk, memory card, memory stick, network server storage, network cloud storage, etc. Processors include, but are not limited to, a CPU (Central processing Unit), a GPU (image processor), an MCU (Microprocessor), and the like.

The method of the present application is described in detail below with reference to examples, and the neighbor nodes are determined as follows:

connecting a probe Node d to a block chain network (such as a virtual currency public chain network), and establishing connection with all nodes in the network, wherein the probe Node can store all Node information as a list Node ═ { Node _1, Node _2, Node _3, …, Node _ m }; wherein m is the total number of all nodes connected by the probe node d.

Then, the probe Node d requests Node information from all the Node _ i in the Node list Node, and the Node _ i returns the Node information { Node _ i } known to the probe Node d. The probe node d establishes a node relation table NeighborNodes { { node _1}, { node _2}, { node _3}, …, { node _ m } }, and records the node information known by all nodes. Usually, there is history information interaction between two adjacent trading nodes, so if a certain trading node is a neighbor node of another trading node, the node information table of the trading node generally stores the IP address of another trading node.

The probe node d listens for transaction data on the link, and for the same transaction data (transaction information with the same hash value), the probe node d sends the transaction data to the probe node d, and the transaction data are sorted according to the received time sequence:

List(txid_1)＝{node1,node2,node3,…,nodek}，

probe node d continuously listens to the transaction messages on the link, and for each new transaction datum, a record of the order of arrival of the transaction messages sent to it by each node is generated, and List (txid _ i) ═ … }.

As shown in fig. 10, a discriminant model of whether any two transaction nodes in the network are first-order neighbor node relationships may then be constructed, specifically as follows:

1) construction of the subset list (txid): since the message of the originating node (initiator of transaction message) of a certain transaction message and its first-order neighbor node most probably reaches the probe node first, the probability that the first-order neighbor nodes are the first-order neighbor nodes is the highest for the first-order nodes in the List (txid _ i). Let l be 8, i.e. take the top 8 nodes in the top order as potential first-order neighbor node objects, construct the List (txid _ i) subset

The number of nodes in list (txid) is not more than l.

2) Taking a target node _ i, calculating the probability that node _ j is a first-order neighbor node of node _ i, wherein node _ j belongs to the subset list (txid), and node _ j is contained in the node information table { node _ i } of node _ i. The calculation steps are as follows:

(1) setting time granularity (unit time) as 1 day, slicing the list (txid) according to the date, observing the list (txid) in the same day, and calculating the number Count (node _ i) of node _ i nodes contained in the list (txid);

(2) calculating the number Count (node _ i, node _ j) of nodes i and j simultaneously contained in the list (txid);

(3) the probability that node j is node i can be expressed as:

P _date (node_j|node_i)＝Count(node_i,node_j)/Count(node_i)

wherein, P _date In (1), date is a subscript to date.

Observing and recording transaction information obtained by the probe node within a period of time, calculating according to the day as a unit to obtain a group of probability value sequences of first-order neighbor nodes of two transaction nodes of node _ i and node _ j, and adopting a curve fitting function P ═ at for the probability value sequences ² + bt + c, where t is a time variable, a set of fitting parameters a, b, c can be calculated.

And predicting the probability that the node _ j is the first-order neighbor node of the node _ i in the next time period according to the fitting function, and taking the first k (k is less than or equal to l) nodes with the maximum probability as the first-order neighbor nodes of the node _ i.

According to the latest time period that the probe node d receives the transaction messages to reach the List (txid _ i), calculating the probability P that the node _ j is the node _ i in the latest period _{new_date} (node _ j | node _ i) if P _{new_date} If the continuous deviation of the fitting value exceeds the specified times, the node _ j is no longer the first-order neighbor node of the node _ i in the new time period, and the first-order neighbor node table of the node _ i is updated.

As shown in fig. 11, in order to construct a schematic diagram of an obtained full-link first-order link node connection topology (i.e., a transaction topology of a primary virtual currency public link network), after obtaining a first-order neighbor node table according to each transaction node, a full-link transaction node matrix may be established:

then, a first-order neighbor node matrix corresponding to the full-chain transaction node can be established:

the first 8 nodes with the maximum connection probability are taken as neighbor nodes of the target node, and then a full-chain first-order node connection topological structure can be constructed, as shown in fig. 11. It should be noted that, because the Node connection state in the full-link transaction Node list Node is not permanent, and a new Node may be added when some nodes disappear in the middle, the neighbor Node corresponding to each target Node is in a changed state, that is, the full-link first-order Node connection topology structure diagram is dynamically changed. In order to ensure that the full-chain first-order node connection topology structure chart is in maximum coincidence with the actual situation, the dynamic full-chain first-order node connection topology structure chart can be constructed according to the method by taking 24 hours as a time unit.

The originating node is distinguished as follows:

for a certain transaction message new _ txid received in the virtual currency public link network, the probe nodes d are arranged according to the time sequence of receiving the transaction message, the IP addresses of a plurality of transaction nodes with the shortest time are obtained to obtain a List (new _ txid), and the real originating node can be considered to be contained in the List (new _ txid);

and for any transaction information in the virtual currency public link network, meeting node _ s E List (new _ txid), calculating the shortest time of the transaction message from the starting node _ s to the probe node d through the propagation paths of different nodes according to the block link point network propagation topological model, and sequencing according to the arrival sequence to obtain a sequencing List (from _ node _ s).

Calculating the similarity S (node _ S) between the List (from _ node _ S) and the List (new _ txid)

The nodes in the List (new _ txid) are numbered sequentially, and assuming that the List (new _ txid) includes 10 nodes, the 10 nodes are sorted according to the order of the message, and the nodes can be numbered as {1,2,3,4,5,6,7,8,9,10} by sequence number once.

The nodes of the sorted ordered List (from _ node _ s) computed by the potential originating node _ s are numbered the same, if nodes nd e List (from _ node _ s) and nd e List (new _ txid), then it is encoded with the sequence number nd in List (new _ txid), if nd e List (from _ node _ s) but not with the sequence number nd e List (new _ txid)

Then nd is uniformly encoded as 11. For example, suppose that the nodes of the List (from _ node _ s) are encoded as {4,3,5,1,6,2,11,9,10,8}, which means that the nodes except the node encoded "11" are all included in the List (new _ txid), except that the order of arrival of the message at the probe node is different.

Calculating the similarity of the code {1,2,3,4,5,6,7,8,9,10} with {4,3,5,1,6,2,11,9,10,8 }:

subtracting the two codes as two one-dimensional vectors to obtain a distance vector:

|a-b|＝(3,1,2,3,1,4,4,1,1,2)

an importance weight is set for each ordinal position, e.g., the weights for the ranking codes 1-10 are set as follows:

w＝(0.3,0.25,0.21,0.18,0.16,0.15,0.13,0.1,0.07,0.05)

the similarity of the two vectors a and b is calculated as follows:

sim＝1-|a-b|·w/len(a)

＝1-(3,1,2,3,1,4,4,1,1,2)·(0.3,0.25,0.21,0.18,0.16,0.15,0.13,0.1,0.07,0.05)/10

＝0.644

for all S (node), node ∈ List (new _ txid), then the node with the greatest similarity can be the originating node.

For example, the node IP address corresponding to a certain transaction message received by the probe node is numbered as [ 12345678910 ] according to the arrival sequence as the actually observed sequence.

Simulating the potential originating nodes through the network topology of the member, numbering according to the sequence of the messages received by the probe nodes, and obtaining the following sequence list of 10 potential originating nodes:

[6 10 7 1 9 4 5 3 2 8]

[5 4 7 6 2 1 9 10 8 3]

[1 3 9 4 7 6 8 10 5 2]

[4 6 5 9 3 10 2 1 7 8]

[4 9 10 8 5 6 1 2 3 7]

[3 7 10 8 4 5 2 6 9 1]

[5 10 2 4 8 1 7 6 3 9]

[6 3 8 1 9 10 5 4 2 7]

[3 5 9 1 10 2 7 6 8 4]

[7 9 5 1 6 8 10 3 2 4]

the similarity between each sequence table and the actually observed sequence is calculated and found to be [0.283,0.499,0.716,0.427,0.321,0.435,0.469,0.412,0.488,0.335]

Wherein, the similarity is the largest and is 0.716, the corresponding sequence is:

[1 3 9 4 7 6 8 10 5 2]

it can be determined that the 3 rd node is most likely the originating node.

The invention provides a tracing method and a tracing system based on a virtual currency public link network transaction node IP, wherein the method collects transaction information of each node through a probe node deployed in a virtual currency public link network, determines the probability of a potential neighbor node corresponding to each transaction node according to the arrival time sequence of each transaction information received by the probe node, and then calculates the routing overheads of two transaction nodes based on the probability value to obtain the routing overheads of each two adjacent transaction nodes. And then, taking the time ordering set when a certain transaction message reaches the probe node and a certain transaction node as the difference degree of the routing overhead ordering set of the propagation path reaching the probe node corresponding to the starting node, and if the difference degree is minimum, determining the transaction node as the starting node corresponding to the transaction. By the scheme, the starting nodes of all transaction information in the virtual currency public link network can be predicted, and the transaction information can be traced.

Although the embodiments have been described, once the basic inventive concept is obtained, other variations and modifications of these embodiments can be made by those skilled in the art, so that these embodiments are only examples of the present invention, and not intended to limit the scope of the present invention, and all equivalent structures or equivalent processes that can be used in the present specification and drawings, or used directly or indirectly in other related fields are encompassed by the present invention.

Claims

1. A tracing method based on virtual currency public link network transaction node IP, characterized in that the method comprises the following steps:

2. The method for tracing the source of the transaction node IP based on the virtual currency public link network as claimed in claim 1, wherein the transaction information arrival time refers to timestamp information that each transaction information is received by the probe node, and the IP address information of the transaction sender is the IP address information of the sender that forwards the transaction information to the probe node;

3. The method for tracing the source of the virtual currency public link network transaction node IP as claimed in claim 1 or 2, wherein the step of obtaining the propagation path routing cost set of each transaction node based on the network routing cost of each two adjacent transaction nodes comprises the steps of:

4. The method according to claim 3, wherein determining the difference between the time-ordered set corresponding to a transaction message in the first ordered set group and the routing cost ordered set corresponding to the probe node as the originating node comprises:

5. The method according to claim 3, wherein determining the difference between the time-ordered set corresponding to a certain transaction message in the first ordered set group and the network cost set of the propagation path corresponding to a certain transaction node comprises:

6. The method for tracing the source of the virtual currency public link network transaction node IP as claimed in claim 1 or 2, wherein the "determining the probability of the potential neighbor node corresponding to each transaction node in the virtual currency public link network based on the sequence of the time when the transaction information reaches the probe node" comprises:

7. The method for tracing the source of the virtual currency public link network transaction node IP as claimed in claim 6, wherein the number of the nodes to be tested is plural, and the step of calculating the ratio of the number of the ordering sets where the target node and the nodes to be tested simultaneously to the number of the sets containing the target node in the first ordering set group and using the calculation result as the probability of the node to be tested as the potential neighbor node of the target node and outputting comprises the following steps:

8. The method for tracing the source of a virtual currency public link network transaction node IP as claimed in claim 6 or 7, wherein the method comprises:

9. The method for tracing the source of the virtual currency public link network transaction nodes IP based on the claims 6 or 7, characterized in that "according to the determined probability value of the potential neighbor node corresponding to each transaction node in the virtual currency public link network, the potential neighbor node is converted into the network routing overhead of any two adjacent transaction nodes":

10. A system for virtual currency public link network transaction node IP based tracing, characterized in that the system comprises a storage medium having stored therein a computer program which, when executed, implements the method according to any of claims 1 to 9.