CN117710100B - Data analysis method based on block chain and calculation server - Google Patents
Data analysis method based on block chain and calculation server Download PDFInfo
- Publication number
- CN117710100B CN117710100B CN202311614114.0A CN202311614114A CN117710100B CN 117710100 B CN117710100 B CN 117710100B CN 202311614114 A CN202311614114 A CN 202311614114A CN 117710100 B CN117710100 B CN 117710100B
- Authority
- CN
- China
- Prior art keywords
- transaction
- transaction record
- chain
- blockchain node
- record
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 35
- 238000007405 data analysis Methods 0.000 title claims abstract description 23
- 238000004364 calculation method Methods 0.000 title abstract description 6
- 238000001514 detection method Methods 0.000 claims description 58
- 230000015654 memory Effects 0.000 claims description 24
- 239000006185 dispersion Substances 0.000 claims description 20
- 238000000605 extraction Methods 0.000 claims description 18
- 239000000969 carrier Substances 0.000 claims description 17
- 230000002159 abnormal effect Effects 0.000 claims description 13
- 230000006399 behavior Effects 0.000 claims description 11
- 238000006243 chemical reaction Methods 0.000 claims description 10
- 238000007781 pre-processing Methods 0.000 claims description 8
- 238000005070 sampling Methods 0.000 claims description 3
- 239000013598 vector Substances 0.000 description 21
- 238000012545 processing Methods 0.000 description 9
- 238000010586 diagram Methods 0.000 description 7
- 238000010801 machine learning Methods 0.000 description 6
- 238000013500 data storage Methods 0.000 description 5
- 238000013528 artificial neural network Methods 0.000 description 4
- 238000004891 communication Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 4
- 238000012706 support-vector machine Methods 0.000 description 4
- 238000004458 analytical method Methods 0.000 description 3
- 206010000117 Abnormal behaviour Diseases 0.000 description 2
- 238000012512 characterization method Methods 0.000 description 2
- 238000003066 decision tree Methods 0.000 description 2
- 239000011159 matrix material Substances 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 238000012549 training Methods 0.000 description 2
- OKTJSMMVPCPJKN-UHFFFAOYSA-N Carbon Chemical compound [C] OKTJSMMVPCPJKN-UHFFFAOYSA-N 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000013527 convolutional neural network Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000003814 drug Substances 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000004927 fusion Effects 0.000 description 1
- 229910021389 graphene Inorganic materials 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000004900 laundering Methods 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000008447 perception Effects 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/26—Visual data mining; Browsing structured data
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Databases & Information Systems (AREA)
- Finance (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- General Business, Economics & Management (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention provides a data analysis method and a calculation server based on a blockchain, which fully pass through the characteristics of different aspects of blockchain link point transaction records, determine the similarity comparison condition of a first blockchain node transaction record and a second blockchain node transaction record based on the comparison result of two dimensions of a transaction chain dimension comparison result and a knowledge carrier dimension comparison result of the first blockchain link point transaction record and the second blockchain node transaction record, wherein the detail comparison of the transaction chain dimension can be carried out between the first blockchain link point transaction record and the second blockchain link point transaction record based on the comparison result of the transaction chain dimension, and accurately compare the blockchain node transaction record characteristics in the first blockchain link point transaction record and the second blockchain node transaction record based on the comparison result of the knowledge carrier dimension, thereby increasing the comparison reliability of the blockchain node transaction record so as to quickly and accurately identify anomalies.
Description
Technical Field
The present disclosure relates to the field of blockchain, electrical data processing, and more particularly, to a blockchain-based data analysis method and computing server.
Background
Blockchain is a decentralized distributed ledger technology that has been widely used in the fields of finance, logistics, medicine, etc. The method has the characteristics of non-tampering, decentralization, transparency and the like, and therefore has important application value in the aspects of data storage, transaction and the like. With the development of blockchain technology, more and more enterprises begin to apply the blockchain technology to the field of data analysis so as to realize more efficient and safer data analysis. It will be appreciated that blockchain security is a major concern in blockchain technology. In blockchain security analysis, artificial intelligence algorithms may be used for anomaly detection, attack detection, and malicious behavior detection. The algorithms can analyze large amounts of data and determine whether abnormal or malicious transaction behavior exists according to preset rules or models. How to ensure the accuracy of abnormal transaction behavior detection is a technical problem that needs to be considered in blockchain data analysis.
Disclosure of Invention
Accordingly, embodiments of the present disclosure provide at least a blockchain-based data analysis method.
According to an aspect of the embodiments of the present disclosure, there is provided a blockchain-based data analysis method, which is applied to a computing server, the method including:
acquiring a first block chain node transaction record and a second block chain node transaction record to be compared;
Determining a transaction chain dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record through transaction events of all transaction chains in the first blockchain node transaction record and transaction events of all transaction chains in the second blockchain node transaction record; the transaction chain dimension comparison result indicates the matching property of the transaction record of the first block chain link point and the transaction record of the second block chain node in the transaction chain dimension;
Determining a knowledge carrier dimension comparison result of the first block link point transaction record and the second block link node transaction record through a first transaction knowledge carrier corresponding to the first block link point transaction record and a second transaction knowledge carrier corresponding to the second block link node transaction record; the knowledge carrier dimension comparison result indicates the matching property of the first blockchain node transaction record and the second blockchain node transaction record in the knowledge carrier dimension;
Determining a matching condition comparison result of the first blockchain node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result;
and if the matching condition comparison result is a desired result, determining that the first block chain link node transaction record and the second block chain node transaction record have consistent abnormal transaction behaviors.
According to an example of an embodiment of the present disclosure, the determining, by the transaction event of each transaction chain in the first blockchain node transaction record and the transaction event of each transaction chain in the second blockchain node transaction record, a comparison result of the transaction chain dimensions of the first blockchain node transaction record and the second blockchain node transaction record includes:
Determining a statistical transaction event corresponding to the transaction chain through the combined transaction event of the transaction chain aiming at each transaction chain in the first block chain link point transaction record and the second block chain node transaction record;
and determining one or all of global comparison data and local comparison data as a dimension comparison result of the transaction chains through the statistical transaction event corresponding to each transaction chain in the transaction record of the first block chain node and the statistical transaction event corresponding to each transaction chain in the transaction record of the second block chain node.
According to one example of an embodiment of the present disclosure, wherein obtaining the global comparison data comprises:
calculating a mean square difference through the statistical transaction event corresponding to each transaction chain in the first blockchain node transaction record and the statistical transaction event corresponding to each transaction chain in the second blockchain node transaction record;
calculating the global comparison data by the data capacity and the mean square difference of each transaction chain;
The obtaining the local comparison data includes:
Calculating a first comparison result through the data average value of the statistical transaction event corresponding to each transaction chain in the first blockchain node transaction record and the data average value of the statistical transaction event corresponding to each transaction chain in the second blockchain node transaction record;
calculating a second comparison result through the dispersion of the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and the dispersion of the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record;
calculating a correlation variable between the first block link point transaction record and the second block link point transaction record through the statistical transaction event corresponding to each transaction chain in the first block link node transaction record and the statistical transaction event corresponding to each transaction chain in the second block link node transaction record;
Calculating a local comparison result through the correlation variable, the dispersion of the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and the dispersion of the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record;
The local comparison data is determined based on the first comparison result, the second comparison result, and the local comparison result.
According to one example of an embodiment of the present disclosure, the determining, by the first transaction knowledge carrier corresponding to the first blockchain node transaction record and the second transaction knowledge carrier corresponding to the second blockchain node transaction record, a knowledge carrier dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record includes one or all of:
Performing event detection on the first block chain link point transaction record and the second block chain node transaction record through a target event detection component to obtain each first target event and a corresponding event knowledge carrier in the first block chain link point transaction record, and each second target event and a corresponding event knowledge carrier in the second block chain node transaction record;
Determining a detection matching result through the first target event and the corresponding event knowledge carrier thereof and the second target event and the corresponding event knowledge carrier thereof, and taking the detection matching result as a dimension comparison result of the knowledge carriers;
Carrying out knowledge carrier extraction on the first block chain link point transaction record and the second block chain node transaction record through a transaction record knowledge carrier extraction component to obtain a first intermediate transaction record knowledge carrier corresponding to the first block chain link point transaction record and a second intermediate transaction record knowledge carrier corresponding to the second block chain node transaction record;
And determining a knowledge carrier difference as a result of the knowledge carrier dimension comparison by the first intermediate transaction record knowledge carrier and the second intermediate transaction record knowledge carrier.
According to an example of an embodiment of the present disclosure, the determining, by the first target event and the corresponding event knowledge carrier thereof, the detection matching result includes:
generating a plurality of candidate target event pairs through each first target event and the corresponding event knowledge carrier respectively and each second target event and the corresponding event knowledge carrier respectively; the alternative target event pair comprises a first target event and a second target event, and a first space similarity condition is met between event knowledge carriers corresponding to the first target event and the second target event of the same alternative target event pair;
Determining a target event pair among the plurality of candidate target event pairs; the first target event and the second target event in the target event pair respectively correspond to event knowledge carriers and meet a second space similarity condition;
And determining the detection matching result through the number of the first target events and the second target events included in each target event pair, the total number of the first target events in the first blockchain node transaction record and the total number of the second target events in the second blockchain node transaction record.
According to one example of an embodiment of the present disclosure, the first intermediate transaction record knowledge carrier includes a transaction chain intermediate knowledge carrier corresponding to each transaction chain in the first blockchain node transaction record, and the second intermediate transaction record knowledge carrier includes a transaction chain intermediate knowledge carrier corresponding to each transaction chain in the second blockchain node transaction record;
said determining a knowledge carrier difference by said first intermediate transaction record knowledge carrier and said second intermediate transaction record knowledge carrier, comprising:
For each transaction chain pair, determining a transaction chain difference corresponding to the transaction chain pair through a transaction chain intermediate knowledge carrier corresponding to each of two transaction chains in the transaction chain pair; one transaction chain in the transaction chain pair is a transaction chain recorded by the first block chain link point transaction, the other transaction chain is a transaction chain recorded by the second block chain node transaction, and the positions of the two transaction chains in the same transaction chain pair in the first block chain link point transaction record and the second block chain node transaction record are the same;
And determining the knowledge carrier difference through the transaction chain difference corresponding to each transaction chain pair.
According to an example of an embodiment of the disclosure, if the transaction chain dimension comparison result includes global comparison data and local comparison data, and the knowledge carrier dimension comparison result includes a detection matching result and a knowledge carrier difference, the determining, based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result, a matching condition comparison result of the first blockchain link point transaction record and the second blockchain node transaction record includes:
If the global comparison data belong to a first global numerical interval, determining that the comparison result of the matching condition is not matched;
If the knowledge carrier difference is smaller than a preset difference value, determining that the matching condition comparison result is matching;
If the global comparison data belongs to a second global value interval, if the local comparison data is smaller than or equal to a preset local value or the detection matching result is smaller than or equal to a preset detection value, determining that the matching condition comparison result is not matched; otherwise, determining that the comparison result of the matching condition is matching; the second global value interval comprises global values which are larger than the first global value interval;
If the global comparison data belongs to a third global value interval, if the local comparison data is smaller than or equal to the preset local value and the detection matching result is smaller than or equal to the preset detection value, determining that the matching condition comparison result is not matched; otherwise, determining that the comparison result of the matching condition is matching; the third global value interval comprises global values which are larger than the second global value interval;
If the global comparison data belong to a fourth global value interval, determining that the matching condition comparison result is matching; the fourth global value interval includes global values that are greater than global values that the third global value interval includes.
According to one example of an embodiment of the present disclosure, the obtaining the first blockchain node transaction record and the second blockchain node transaction record to be compared includes:
acquiring a first basic block link point traffic record and a second basic block link point traffic record;
Determining one basic blockchain node transaction record from the first basic blockchain node transaction record and the second basic blockchain node transaction record as a reference blockchain node transaction record, and determining the rest basic blockchain node transaction record as a blockchain node transaction record to be converted;
Preprocessing the block chain node transaction record to be converted based on the reference block chain node transaction record to obtain a block chain link node transaction record after conversion;
and taking the reference block chain link point transaction record and the converted block chain node transaction record as the first block chain link point transaction record and the second block chain node transaction record.
According to an example of an embodiment of the present disclosure, the preprocessing the blockchain node transaction record to be converted based on the reference blockchain node transaction record to obtain a converted blockchain link node transaction record includes:
If the transaction record of the block chain link point to be converted is different from the transaction record data capacity of the reference block chain node, carrying out data sampling adjustment on the transaction record of the block chain node to be converted, and adjusting the data capacity of the transaction record of the block chain link point to be converted into the data capacity of the transaction record of the reference block chain link point;
Performing event detection on the reference block link point transaction record and the block chain node transaction record to be converted through a target event detection component to obtain each third target event in the reference block link point transaction record and an event knowledge carrier corresponding to each third target event, and each fourth target event in the block link point transaction record to be converted and an event knowledge carrier corresponding to each fourth target event;
Determining a matched target event pair through each third target event and the corresponding event knowledge carrier and each fourth target event and the corresponding event knowledge carrier; the matching target event pair comprises a third target event and a fourth target event, and event knowledge carriers corresponding to the third target event and the fourth target event of the same matching target event pair respectively meet matching requirements;
Determining the blockchain node transaction record adjustment tensor based on the third and fourth target events included in the matching target event pair.
And carrying out transaction chain position adjustment on the to-be-converted block chain node transaction record through the block chain node transaction record adjustment tensor to obtain the converted block chain link node transaction record.
According to another aspect of the disclosed embodiments, there is provided a computing server including:
One or more processors;
and one or more memories, wherein the memories have stored therein computer readable code, which when executed by the one or more processors, causes the one or more processors to perform the method described above.
The beneficial effects that this disclosure contains at least:
The present disclosure provides a blockchain-based data analysis method and a calculation server, in the execution process, a first blockchain node transaction record and a second blockchain node transaction record to be compared are obtained first, and the transaction event of each transaction chain in the first blockchain node transaction record and the transaction event of each transaction chain in the second blockchain node transaction record are used for determining the transaction chain dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record, and the matching property of the first blockchain node transaction record and the second blockchain node transaction record in the transaction chain dimension is represented by the transaction chain dimension comparison result; determining a knowledge carrier dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record through a first transaction knowledge carrier of the first blockchain node transaction record and a second transaction knowledge carrier of the second blockchain node transaction record, and representing the matching property of the first blockchain node transaction record and the second blockchain node transaction record in the knowledge carrier dimension through the knowledge carrier dimension comparison result; and determining a matching condition comparison result of the first blockchain node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result. The method fully utilizes the characteristics of different aspects of the blockchain node transaction records, determines the similarity comparison condition of the first blockchain node transaction record and the second blockchain node transaction record based on the comparison result of two dimensions of the transaction chain dimension comparison result and the knowledge carrier dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record, wherein the detail comparison of the transaction chain dimension can be carried out between the first blockchain node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result, and the blockchain node transaction record characteristics in the first blockchain node transaction record and the second blockchain node transaction record are accurately compared based on the knowledge carrier dimension comparison result, so that the blockchain node transaction record comparison reliability is increased, and the anomaly identification is rapidly and accurately carried out.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the aspects of the disclosure.
Drawings
The above and other objects, features and advantages of the presently disclosed embodiments will become more apparent from the more detailed description of the presently disclosed embodiments when taken in conjunction with the accompanying drawings. The accompanying drawings are included to provide a further understanding of embodiments of the disclosure, and are incorporated in and constitute a part of this specification, illustrate embodiments of the disclosure and together with the description serve to explain the disclosure, without limitation to the disclosure. In the drawings, like reference numerals generally refer to like parts or steps.
Fig. 1 is a schematic diagram of an application scenario provided in an embodiment of the present disclosure.
Fig. 2 is a schematic implementation flow chart of a data analysis method based on a blockchain according to an embodiment of the disclosure.
Fig. 3 is a schematic diagram of a composition structure of a data analysis device according to an embodiment of the disclosure.
Fig. 4 is a schematic diagram of a hardware entity of a computer device according to an embodiment of the disclosure.
Detailed Description
The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure. It will be apparent that the described embodiments are merely embodiments of a portion, but not all, of the present disclosure. All other embodiments, which can be made by one of ordinary skill in the art without the need for inventive faculty, are intended to be within the scope of the present disclosure, based on the embodiments in this disclosure.
For the purpose of making the objects, technical solutions and advantages of the present disclosure more apparent, the technical solutions of the present disclosure are further elaborated below in conjunction with the drawings and the embodiments, and the described embodiments should not be construed as limiting the present disclosure, and all other embodiments obtained by those skilled in the art without making inventive efforts are within the scope of protection of the present disclosure.
In the following description, reference is made to "some embodiments" which describe a subset of all possible embodiments, but it is to be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments and can be combined with one another without conflict. The term "first/second/third" is merely to distinguish similar objects and does not represent a particular ordering of objects, it being understood that the "first/second/third" may be interchanged with a particular order or precedence where allowed, to enable embodiments of the disclosure described herein to be implemented in other than those illustrated or described herein.
Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used herein is for the purpose of describing the present disclosure only and is not intended to be limiting of the present disclosure.
The data analysis method based on the blockchain provided by the embodiment of the disclosure can be applied to an application environment as shown in fig. 1. Wherein the blockchain node 102 communicates with the compute server 104 over a communications network. The data storage system may store data that the computing server 104 needs to process. The data storage system may be integrated on the computing server 104 or may be located on a cloud or other network server. The blockchain data may be stored in a local storage of the blockchain node 102, or may be stored in a data storage system or a cloud storage associated with the computing server 104, and when data analysis is required, the computing server 104 may obtain blockchain transaction data from the local storage of the blockchain node 102, or from the data storage system or the cloud storage. The blockchain node 102 may be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers, internet of things devices, and portable wearable devices, and the internet of things devices may be smart speakers, smart televisions, smart air conditioners, smart vehicle devices, and the like. The portable wearable device may be a smart watch, smart bracelet, headset, or the like. The computing server 104 may be implemented as a stand-alone server or as a cluster of servers.
The blockchain-based data analysis method provided by the embodiment of the present disclosure is applied to the computing server 104, and specifically includes the following steps:
operation S101 obtains a first blockchain node transaction record and a second blockchain node transaction record to be compared.
The first blocklink point transaction record and the second blocklink node transaction record are two blocklink point transaction records when the blocklink point transaction records are compared.
The blockchain node may be a terminal or a server responsible for maintaining blockchain operation, where the terminal is at least one of a mobile phone, a tablet computer, a notebook computer, and the like, and the server may be implemented by an independent server or a server cluster formed by multiple servers. Blockchain node transaction records are transaction events that occur in one blockchain node record, which can include multiple transaction chains, one transaction chain can contain events of ordered records of transaction hash, sender address, recipient address, transaction amount, timestamp, signature, last transaction hash, etc., through which the transaction chain can track and present the flow and order of transactions.
As a simple example, a blockchain node transaction record is illustrated, where in the example of the following table, the blockchain node transaction record includes 4 transaction chains, namely, transaction chain 1 to transaction chain 4.
It will be appreciated that analysis of the data recorded in the transaction chain can identify whether the blockchain link point transaction record contains abnormal behavior or abnormal activity, such as transaction behavior of double payment, 51% attack, money laundering, transaction tampering, etc. It should be noted that the formats of the above data are not uniform, and the machine learning model cannot be directly processed based on the data, so that, before the data is processed, data preprocessing, for example, data encoding, may be performed first, discrete data in the data may be encoded according to a specific encoding mode, for example, hash data may be encoded according to, for example, base58 encoding or Base64 encoding to obtain an encoded string, and then the string may be mapped into a vector. The following is a specific example:
It is assumed that transactions need to be classified to determine which transactions are normal and which transactions are abnormal. In this problem, we need to convert raw data (e.g., transaction data, transaction addresses, etc.) into a numerical representation in order to facilitate training and prediction of machine learning algorithms. One of the key steps is to encode the transaction address. Here, we can use Base58 coding to convert the original address into a character string with higher readability and shorter length. For example, assume a transaction address of: 9x583031d1113ad414f02576bdbafabfb302140225, encoded by Base58, can be converted into the following string: 1EU8C6oH9jA4NQcNv3VUM4YjZ7zGv, then further converts the encoded address into a numerical vector for processing by a machine learning algorithm. For example, a Bag of words model (Bag-of-words model) may be used to represent a string of characters as a sparse vector, where each element represents a word or character and the value represents the number of times that word or character appears in the string of characters, in such a way that we can translate the transaction address into a vector of values to facilitate training and prediction of machine learning algorithms. For example, the transaction data may be classified using a Support Vector Machine (SVM), neural network, or decision tree algorithm to determine normal and abnormal transactions. It should be noted that the selection of an appropriate coding scheme is important, as different coding schemes may have different effects on the result. In this example, the Base58 encoding scheme is chosen because it converts the original address into a short, readable string, while also having certain fault tolerance and anti-counterfeiting properties.
In the above example, the process of encoding an address into a numerical vector may use a bag of words model to convert an address in the form of a string of characters into a sparse vector, where each element represents a word or character and the value represents the number of times that word or character appears in the string of characters. For example, assuming we use a vocabulary of 1000 to represent transaction addresses, each address may be converted into a 1000-dimensional sparse vector. Specifically, assume that a transaction address is encoded by Base58 to obtain the following string: 1EU8C6oH9jA4NQcNV3VUM4YjZ7zGV and we use a vocabulary of size 1000 to represent the transaction address. Then we can translate this address into the following vector:
[0，0，……，1，0，……1，0，…]
Where the i-th element in the vector represents the number of times the i-th word or character in the vocabulary appears in the address. For example, in the above vector, the 174 th element is 1, indicating that the 174 th word (or character) in the vocabulary appears 1 time; element 735 is also 1, indicating that word 735 (or character) in the vocabulary also appears 1 time. It should be noted that, since each address can be represented as a 1000-dimensional sparse vector and most elements are 0, in practical applications, a sparse matrix can be typically used to represent these vectors to save storage space and computing resources. Through the coding mode, the transaction address can be converted into a numerical vector so as to facilitate the processing of a machine learning algorithm. For example, the transaction data may be classified using a Support Vector Machine (SVM), neural network, or decision tree algorithm to determine normal and abnormal transactions.
For other discrete data in the transaction chain, similar principles may be employed for encoding so that the obtained data can be processed by a machine learning model.
One of the first blockchain node transaction record and the second blockchain node transaction record is a transaction record (which may be referred to as a target transaction record) to be subjected to anomaly detection, the other is a transaction record (which may be referred to as a comparison transaction record) which is a transaction record which has been monitored for accurate anomaly, it being understood that the number of comparison transaction records is typically a plurality to provide more anomaly types for comparison, and to increase recall. When comparing the target transaction record with the comparison transaction record, the plurality of comparison transaction records stored in the database may be compared one by one with the target transaction record until a matching comparison transaction record is determined, and if traversing is complete and the matching comparison transaction record is not determined, then the target transaction record is determined to have no known abnormal behavior.
Optionally, the operation S101 may specifically include:
and S10, acquiring a first basic block link point transaction record and a second basic block link point transaction record.
Operation S20 determines one base blockchain node transaction record from the first base blockchain node transaction record and the second base blockchain node transaction record as a reference blockchain node transaction record, and determines the remaining one base blockchain node transaction record as a blockchain node transaction record to be converted.
And S30, preprocessing the block chain node transaction record to be converted based on the reference block chain node transaction record to obtain a block chain link node transaction record after conversion.
The first base blockchain node transaction record and the second base blockchain node transaction record are raw state data of two blockchain node transaction records that require a blockchain node transaction record comparison. When the block link point transaction records are compared, two basic block link node transaction records, namely a first basic block link point transaction record and a second basic block link point transaction record, are obtained.
Because the obtained first base block link node transaction record and the second base block link node transaction record may not be consistent in data capacity (e.g., the number of involved transaction chains), position (e.g., the sequence of each event record), etc. before comparing the block link node transaction records, the present disclosure pre-processes the first base block link node transaction record and the second base block link node transaction record to make the two block link node transaction records as block link node transaction records with the same data capacity and position. The comparison can be directly based on transaction chain and block link point transaction record characteristics of the same position in two block chain node transaction records, and the comparison efficiency of the block chain node transaction records is relatively higher, however, in other embodiments, preprocessing is not required.
Specifically, in order to adjust the first basic block link node transaction record and the second basic block link node transaction record to be the same two block link node transaction records, one of the first basic block link node transaction record and the second basic block link node transaction record is taken as a reference block link node transaction record, the other is taken as a block link node transaction record to be converted, all reference items of the reference block link node transaction record are taken as standards, the block link node transaction record to be converted is preprocessed, all reference items of the block link node transaction record to be converted are adjusted to be the same as all reference items of the reference block link node transaction record, and the block link node transaction record after conversion is obtained. The data capacity, the position and other reference items of the transaction record of the block chain node after conversion are the same as those of the transaction record of the reference block chain node.
For example, when the blockchain node transaction record to be converted is processed based on the reference blockchain node transaction record, the processing may be performed from the blockchain node transaction record data capacity and the blockchain node transaction record, at which time operation S30 may include:
And S31, if the data capacity of the block chain link point transaction record to be converted is different from the data capacity of the reference block chain node transaction record, performing data sampling adjustment on the block chain node transaction record to be converted, and adjusting the data capacity of the block chain link point transaction record to be converted to the data capacity of the reference block chain node transaction record.
After the reference block link point transaction record and the block link point transaction record to be converted are determined from the first basic block link point transaction record and the second basic block link point transaction record, the data capacity of the reference block link point transaction record and the data capacity of the block link node transaction record to be converted may be different, and then the data capacity of the block link node transaction record to be converted is adjusted based on the data capacity of the reference block link point transaction record. For example, the transaction records of the blockchain nodes with smaller data capacity are copied, so that the expanded blockchain node transaction records are obtained, and the expanded blockchain node transaction records are consistent with the data capacity of the blockchain node transaction records with more data capacity. Or filling in the blockchain node transaction records with smaller data capacity in a linear interpolation mode.
Operation S32, determining a block link point cross record adjustment tensor based on the to-be-converted block link point cross record and the reference block link point cross record with the same data capacity; and carrying out transaction chain position adjustment on the transaction records of the block chain nodes to be converted through the block chain node transaction record adjustment tensor to obtain the block chain link point transaction record after conversion.
If the data capacity of the block link point transaction record to be converted is the same as that of the reference block link node transaction record, event data record positions (such as sequence) in the two transaction chains may not be consistent, so that the position consistency processing of the block link point transaction record is also required. When the block link point transaction records are processed consistently, the adjustment tensor (which can be a second-order matrix) of the block link point transaction records is determined according to the positions of each event record in the block link point transaction records to be converted and the reference block link node transaction records, the transaction chain position adjustment is carried out on the block link node transaction records to be converted according to the adjustment tensor of the block link point transaction records, and each feature in the block link point transaction records to be converted is aligned with the corresponding feature in the reference block link node transaction records, so that the converted block link node transaction records are obtained. In the converted blockchain node transaction record, the data capacity of the blockchain node transaction record is consistent with that of the reference blockchain node transaction record, and in the blockchain node transaction record, the positions of all the features are also consistent with those of the corresponding features of the reference blockchain node transaction record. Based on this, the accuracy of block link point transaction record comparison based on the post-conversion block chain node transaction record and the reference block chain node transaction record may be increased.
Optionally, the blockchain node transaction record adjustment tensor in operation S32, when acquired, may include:
and S321, performing event detection on the reference block chain link point transaction record and the block chain node transaction record to be converted through a target event detection component to obtain each third target event in the reference block chain link point transaction record and an event knowledge carrier corresponding to each third target event, and each fourth target event in the block chain link point transaction record to be converted and an event knowledge carrier corresponding to each fourth target event.
In operation S322, a matching target event pair is determined by each third target event and the corresponding event knowledge carrier, and each fourth target event and the corresponding event knowledge carrier.
Operation S323, determining a block link point transaction record adjustment tensor based on the third target event and the fourth target event included in the matching target event pair.
The target event detection component is a feature detection neural network, the target event extracted from the blockchain node transaction record by the target event detection component is an event with more prominent numerical value (such as transaction amount and greater transaction frequency) in the blockchain node transaction record, and can also be called a key event, and the third target event and the corresponding event knowledge carrier in the reference blockchain node transaction record and the fourth target event and the corresponding event knowledge carrier in the to-be-converted blockchain node transaction record are extracted based on the detection of the reference blockchain node transaction record and the to-be-converted blockchain node transaction record by the target event detection component. The event knowledge carrier is characterization data carrying corresponding event feature information, for example, knowledge characterization can be performed through carriers such as vectors, matrixes, tensors and the like, and the event knowledge is the corresponding event feature information.
And matching the target events by referring to each third target event and the corresponding event knowledge carrier in the block link point transaction record to be converted and each fourth target event and the corresponding event knowledge carrier in the block link point transaction record to be converted to obtain a matching result between each third target event and each fourth target event, and taking the third target event and the fourth target event meeting the matching requirement as a matching target event pair. The matching target event pair comprises a third target event and a fourth target event, and the matching target event pair meets the matching requirement between event knowledge carriers of the third target event and the fourth target event. The matching requirement is a condition for matching the third target event with the fourth target event through the event knowledge carrier corresponding to the third target event and the event knowledge carrier corresponding to the fourth target event. For example, if the event knowledge carrier is a feature vector, matching third target events and fourth target events, wherein the distance between the feature vectors is smaller than the distance threshold, and if the number of fourth target events matched by the third target events is multiple, the fourth target event with the highest matching degree with the third target event in the multiple corresponding fourth target events and the third target event form a matched target event pair.
And determining the position of the fourth target event in the block link point transaction record to be converted by matching the position of the third target event in the reference block link node transaction record and the position of the fourth target event in the block link point transaction record to be converted, and generating a block link node transaction record adjustment tensor for carrying out transaction link position conversion on the block link node transaction record to be converted in the same manner as the position of the third target event in the reference block link node transaction record.
And extracting each third target event and the corresponding event knowledge carrier in the transaction record of the reference block chain node through the target event detection component, and obtaining the block chain link point transaction record adjustment tensor aiming at the transaction record of the block chain link point to be converted after matching each fourth target event and the corresponding event knowledge carrier in the transaction record of the block chain link point to be converted, thereby helping to improve the comparison speed and accuracy of the transaction record comparison of the block chain node.
And S40, taking the basic image test block link point transaction record and the converted block link point transaction record as a first block chain node transaction record and a second block chain node transaction record.
And obtaining a block link point transaction record after conversion through a block link point transaction record preprocessing operation, wherein at the moment, a reference block link point transaction record and a block link point transaction record after conversion are used as a first block link point transaction record and a second block link point transaction record for comparing the block link point transaction record, and the block link point transaction record comparison of the first block link point transaction record and the second block link point transaction record is started.
Operation S102, determining a transaction chain dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record through the transaction event of each transaction chain in the first blockchain node transaction record and the transaction event of each transaction chain in the second blockchain node transaction record.
The transaction chain dimension comparison result indicates the matching of the transaction record of the first blockchain node and the transaction record of the second blockchain node in the dimension of the transaction chain.
The embodiment of the disclosure compares the transaction record of the first block chain link point with the transaction record of the second block chain link point, and can determine the dimension comparison result of the transaction chains of the transaction record of the first block chain node and the transaction record of the second block chain node through the transaction event of each transaction chain in the transaction record of the first block chain node and the transaction event of each transaction chain in the transaction record of the second block chain node. And in the dimension comparison result of the transaction chains, the transaction chains in the same position are corresponding to the transaction chain in which the first block chain link point transaction record and the second block chain link point transaction record are in the same position, and whether the transaction chains in the same position are consistent or not is evaluated through the difference between transaction events in the transaction chains in the same position, so that the similarity of the transaction records of the first block chain link point and the transaction records of the second block chain node on the transaction chains is determined together through the difference of the transaction chains in the same positions in the transaction records of the first block chain node and the second block chain node.
Optionally, the operation S102 specifically includes:
Operation S1021, for each transaction chain in the first blockchain node transaction record and the second blockchain node transaction record, determining a statistical transaction event corresponding to the transaction chain through the combined transaction events of the transaction chains.
After the first blockchain link point transaction record and the second blockchain node transaction record are obtained, the transaction event of each transaction chain in the first blockchain node transaction record and the transaction event of each transaction chain in the second blockchain node transaction record are used for determining the combined transaction event corresponding to each transaction chain (namely, all the transaction events are respectively corresponding vector values), then each transaction chain in the first blockchain link point transaction record and the second blockchain node transaction record is used for determining the statistical transaction event corresponding to the transaction chain through the corresponding combined transaction event, wherein the statistical transaction event is an event (particularly, a vector) obtained after statistical operation is carried out on the element values (namely, the vectors) corresponding to each event in the transaction chain, and the statistical operation mode is, for example, average calculation. Because the number of transaction chain data channels (e.g., the number of transactions that a transaction chain contains) in the first blockchain point transaction record and the second blockchain node transaction record may be the same or different, statistical transaction events may be employed to characterize the consolidated transaction events for each of the transaction chains in the first blockchain point transaction record and the second blockchain point transaction record for ease of calculation.
The statistical transaction event is a comprehensive transaction event that characterizes each transaction chain transaction event in the first blockchain node transaction record and each transaction chain transaction event in the second blockchain node transaction record. For example, the transaction chain in the first block link point transaction record is a block link point transaction record containing N transaction events, the transaction chain in the second block link node transaction record is a block link point transaction record containing m transaction events, and although the whole data capacity of the transaction records is unified by filling or copying, the single transaction chain is not unified, and then the value (vector) of each transaction chain on the N transaction events in the first block link point transaction record is used for calculating the value of the statistical transaction event of each transaction chain as the statistical transaction event of each transaction chain. The second blockchain node transaction records correspond to the statistical transaction events.
Operation S1022, determining one or all of the global comparison data and the local comparison data as a transaction chain dimension comparison result through the statistical transaction event corresponding to each transaction chain in the first blockchain node transaction record and the statistical transaction event corresponding to each transaction chain in the second blockchain node transaction record.
Global comparison data is a comparison result comparing two block link point traffic records as a whole, and specifically can be a numerical value (such as approximation degree, such as probability), or a classification tendency (such as approximation or non-approximation).
The local comparison data is based on a comparison between the detail information in the two blockchain node transaction records, and may specifically be a numerical value (e.g., a degree of approximation, such as probability), or a classification tendency (e.g., approximate or non-approximate).
The global comparison data and the local comparison data are both judgment standards for the matching property of the block chain link point transaction records in the dimension of the transaction chain, and when determining the transaction chain dimension comparison result of the first block chain node transaction record and the second block chain node transaction record, one or two of the global comparison data and the local comparison data between the first block chain link point transaction record and the second block chain link point transaction record can be determined as the transaction chain dimension comparison result of the first block chain node transaction record and the second block chain node transaction record through the statistical transaction event corresponding to each transaction chain in the first block chain node transaction record and the statistical transaction event corresponding to each transaction chain in the second block chain node transaction record.
Based on the statistical transaction event corresponding to each transaction chain in the transaction records of the first block chain node and the statistical transaction event corresponding to each transaction chain in the transaction records of the second block chain node, one or both of global comparison data and local comparison data are determined to serve as transaction chain dimension comparison results, and detail comparison of each transaction chain between the transaction records of the block chain node is achieved in the transaction chain dimension, so that the accuracy of comparison of the transaction records of the first block chain node and the second block chain node in the transaction chain dimension is higher.
Alternatively, global comparison data may be obtained using the following operations:
And S21, calculating the mean square difference through the statistical transaction event corresponding to each transaction chain in the transaction record of the first blockchain node and the statistical transaction event corresponding to each transaction chain in the transaction record of the second blockchain node.
Operation S22 calculates global comparison data by the data capacity and the mean square difference of each transaction chain.
When global comparison data is obtained, the mean square difference between the statistical transaction event corresponding to each transaction chain in the first blockchain node transaction record and the statistical transaction event corresponding to each transaction chain in the second blockchain node transaction record may be calculated based on a general MSE formula, such as:
Wherein E1 is the mean square difference, m is the number of transaction chains in the block chain link point transaction record, R1 and R2 are the first block chain node transaction record and the second block chain node transaction record for comparing the block chain link point transaction record, n is the serial number of the transaction chain in the block chain link point transaction record, and R1 (n) and R2 (n) are the corresponding statistical transaction events in the first block chain node transaction record and the second block chain node transaction record respectively.
After the mean square difference is obtained, global comparison data between the first blockchain node transaction record and the second blockchain node transaction record is calculated through the data capacity of each transaction chain in the first blockchain node transaction record and the second blockchain node transaction record and the mean square difference, for example:
Where Sa is global comparison data between the first blockchain node transaction record and the second blockchain node transaction record, and x is the data capacity of each transaction chain, i.e., the sum of the values of all transaction events.
The global comparison data of the first blockchain node transaction record and the second blockchain node transaction record are obtained to estimate the difference of corresponding transaction chains in the first blockchain node transaction record and the second blockchain node transaction record, so that the similarity of the first blockchain node transaction record and the second blockchain node transaction record can be estimated in the dimension of the transaction chains, and the accuracy of comparison of the blockchain node transaction records is improved.
Alternatively, the local comparison data may be obtained using the following operations:
and S31, calculating a first comparison result through the data average value of the statistical transaction event corresponding to each transaction chain in the first blockchain node transaction record and the data average value of the statistical transaction event corresponding to each transaction chain in the second blockchain node transaction record.
Calculating a data average value of statistical transaction events corresponding to each transaction chain in a first blockchain node transaction record through statistical transaction events corresponding to each transaction chain in a first blockchain node transaction record, calculating a data average value of statistical transaction events corresponding to each transaction chain in a second blockchain node transaction record through statistical transaction events corresponding to each transaction chain in a second blockchain node transaction record, and calculating a first comparison result of the first blockchain node transaction record and the second blockchain node transaction record through the data average value of statistical transaction events of the two blockchain node transaction records, for example, according to the following formula:
Wherein A1 and A2 are respectively the data average value of the statistical transaction event corresponding to each transaction chain in the transaction record of the first blockchain node, the data average value of the statistical transaction event corresponding to each transaction chain in the transaction record of the second blockchain node, C1 is the first comparison result of the transaction record of the first blockchain node and the transaction record of the second blockchain node, β is an anti-zero constant, and the specific value is not limited.
And S32, calculating a second comparison result through the dispersion of the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and the dispersion of the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record.
The dispersion of the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record (used for measuring the dispersion degree of data and can be expressed by variance) can be determined through the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record, and the dispersion of the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record can be determined through the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record. Calculating a second comparison of the first blockchain link point transaction record with the second blockchain node transaction record based on the dispersion of the statistical transaction events of the two blockchain node transaction records, for example, may be calculated according to the following formula:
Wherein V1 and V2 are respectively the dispersion of the statistical transaction event corresponding to each transaction chain in the first blockchain node transaction record and the dispersion of the statistical transaction event corresponding to each transaction chain in the second blockchain node transaction record, C2 is the second comparison result of the first blockchain node transaction record and the second blockchain node transaction record, γ is an anti-zero constant, and the specific value is not limited.
Operation S33, calculating a relativity variable between the transaction record of the first block chain node and the transaction record of the second block chain link node through the respective statistical transaction event of each transaction chain in the transaction record of the first block chain node and the respective statistical transaction event of each transaction chain in the transaction record of the second block chain node; and calculating a local comparison result through the correlation variable, the dispersion of the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and the dispersion of the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record.
Through the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record, a correlation variable (a variable representing the degree of correlation between two objects can be obtained by calculating covariance through the prior art) between the first blockchain node transaction record and the second blockchain node transaction record can be determined, and the local comparison result of the first blockchain node transaction record and the second blockchain node transaction record is determined based on the correlation variable between the first blockchain node transaction record and the second blockchain node transaction record, the dispersion of the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and the dispersion of the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record, for example, based on the following formula:
Wherein V12 is a correlation variable between the transaction record of the first blockchain node and the transaction record of the second blockchain node, Ω is an anti-zero constant, and specific values are not limited.
Operation S34 determines local comparison data based on the first comparison result, the second comparison result, and the local comparison result.
After the first comparison result, the second comparison result and the local comparison result are respectively calculated in operation S31 to operation S33, integration is performed based on the first comparison result, so that local comparison data of the first blockchain node transaction record and the second blockchain node transaction record are determined, and the similarity of the first blockchain node transaction record and the second blockchain node transaction record is determined through the local comparison data. The local comparison data is determined by, for example:
Sb＝(C1a,C2b,C3c)
wherein Sb is local comparison data, C1 is a first comparison result, C2 is a second comparison result, C3 is a local comparison result, and a, b, and C are super parameters, respectively.
And determining local comparison data of the first blockchain node transaction record and the second blockchain node transaction record through a first comparison result, a second comparison result and a local comparison result of the first blockchain node transaction record and the second blockchain node transaction record, and determining similarity of the first blockchain node transaction record and the second blockchain node transaction record in three different dimensions based on the local comparison data, so that accuracy of comparison of the blockchain node transaction records is improved.
Operation S103 determines a knowledge carrier dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record through the first transaction knowledge carrier corresponding to the first blockchain node transaction record and the second transaction knowledge carrier corresponding to the second blockchain node transaction record.
The knowledge carrier dimension comparison results represent the matching of the first blockchain node transaction record with the second blockchain node transaction record in the knowledge carrier dimension. In an embodiment of the disclosure, the first transaction knowledge carrier is used to characterize blockchain link point transaction record characteristics in a first blockchain node transaction record, and the second transaction knowledge carrier is used to characterize blockchain node transaction record characteristics in a second blockchain node transaction record. The blockchain node transaction record features mainly comprise the features of transaction amount, object, address and the like of the blockchain node transaction record. In order to compare the first blockchain node transaction record with the second blockchain node transaction record, a knowledge carrier dimension comparison of the first blockchain node transaction record with the second blockchain node transaction record is determined based on the first transaction knowledge carrier and the second transaction knowledge carrier together. And in the dimension comparison result of the knowledge carrier, all block chain link point transaction record characteristics in the first block chain node transaction record and the second block chain node transaction record are included, the block chain node transaction record characteristics in the same position in the first block chain link point transaction record and the second block chain node transaction record are corresponding through comparison of the block chain node transaction record characteristics, and the similarity of the block chain link point transaction record characteristics of the first block chain node transaction record and the second block chain node transaction record is determined according to the block chain node transaction record characteristic difference of the first block chain node transaction record and the second block chain node transaction record in the same position.
Optionally, the operation S103 may specifically include:
Operation S1031, performing event detection on the first block link point transaction record and the second block link node transaction record by using the target event detection component, to obtain each first target event in the first block link point transaction record and a corresponding event knowledge carrier respectively, and each second target event in the second block link node transaction record and a corresponding event knowledge carrier respectively; and determining a detection matching result through the first target event and the corresponding event knowledge carrier thereof and the second target event and the corresponding event knowledge carrier thereof, and taking the detection matching result as a knowledge carrier dimension comparison result.
When comparing the first blockchain node transaction record and the second blockchain node transaction record with each other, the embodiment of the disclosure firstly carries out knowledge detection on the first blockchain node transaction record and the second blockchain node transaction record through the target event detection component so as to determine each target event and corresponding event knowledge carrier for characteristic identification in the first blockchain node transaction record and the second blockchain node transaction record, so as to obtain each first target event and each event knowledge carrier corresponding to each first target event in the first blockchain node transaction record, and obtain each second target event and each event knowledge carrier corresponding to each second target event in the second blockchain node transaction record. The event knowledge carrier corresponding to each target event is a feature vector corresponding to the target event.
In operation S1031, the detection matching result is determined based on, for example, the following manner:
In operation S41, a plurality of candidate target event pairs are generated by each first target event and each second target event and each corresponding event knowledge carrier.
The candidate target event pair comprises a first target event and a second target event, and the first space similarity condition is satisfied between event knowledge carriers corresponding to the first target event and the second target event belonging to the same candidate target event pair (the space similarity represents the distance between knowledge carriers in space, and the closer the distance is, the greater the similarity is). After each first target event and the corresponding event knowledge carrier are extracted from the first block link point transaction record through the target event detection component, the cosine distance between each first target event and each second target event in the first block link node transaction record can be calculated, and the matching between the first target event and the second target event is represented based on the cosine distance. And generating an alternative target event pair from the first target event and the second target event which meet the first spatial similarity condition through a preset first spatial similarity condition, wherein the first spatial similarity condition is a condition for determining the second target event with the minimum distance from the first target event.
Operation S42 determines a target event pair among a plurality of candidate target event pairs.
And determining a second target event with the smallest distance from the first target event in the second blockchain node transaction record through the first space similarity condition, so as to generate an alternative target event pair. However, the first spatial similarity condition is only used to determine one target event with the smallest distance for the first target event among the plurality of second target events, and if the similarity between all the second target events and the first target event is smaller, a second target event is also determined. Then, the first spatial similarity condition is a filter, the second target event forming the candidate target event pair with the first target event is obtained through the filtering of the first spatial similarity condition, and the similarity with the second target event may be insufficient, however, the second target event is more similar than the rest of the second target events, which does not represent that the first target event is actually similar to the second target event, and the second spatial similarity condition is added in the present disclosure for determining the target event pair which is actually similar in a plurality of candidate target event pairs. The second spatial similarity condition is a condition for determining a target event pair having a distance less than a threshold among a plurality of candidate target event pairs, the second spatial similarity condition being an absolute spatial similarity condition in comparison to the first spatial similarity condition. And after the second spatial similarity condition is filtered, obtaining a target event pair meeting the second spatial similarity condition, wherein the similarity between the first target event and the second target event is strong, and the first target event and the second target event in the target event are really similar.
Operation S43 determines a detection matching result by the number of the first target event and the second target event included in each target event pair, the total number of the first target events in the first blockchain node transaction record, and the total number of the second target events in the second blockchain node transaction record.
The detection matching result is data representing the matching of the first blockchain node transaction record and the second blockchain node transaction record according to the ratio of the number of target events in the target event pair to the number of all target events in the first blockchain node transaction record and the second blockchain node transaction record. Because the target event pair comprises a first target event and a second target event, the number of the target events in the target event pair is 2 times that of the target event pair, namely the number of similar target events in the first blockchain node transaction record and the second blockchain node transaction record; the number of all target events in the first block chain link point transaction record and the second block chain node transaction record is the sum of the number of the first target events and the number of the second target events, the detection matching result indicates the matching property of the first block chain node transaction record and the second block chain node transaction record by the ratio of the number of similar target events to the number of all target events in the two block chain link point transaction records, and if the number of similar target events in the first block chain link point transaction record and the second block chain node transaction record is more, the value of the detection matching result is larger, and the matching property of the first block chain node transaction record and the second block chain node transaction record is higher.
And determining the actual similar target event pairs in the first block chain node transaction record and the second block chain link node transaction record through the first space similarity condition and the second space similarity condition, determining a detection matching result, matching the target events between the block chain link node transaction records, and increasing the accuracy.
Operation S1032, performing knowledge carrier extraction on the first blockchain node transaction record and the second blockchain node transaction record through the transaction record knowledge carrier extraction component, to obtain a first intermediate transaction record knowledge carrier corresponding to the first blockchain node transaction record and a second intermediate transaction record knowledge carrier corresponding to the second blockchain node transaction record; and determining the knowledge carrier difference as a knowledge carrier dimension comparison result through the first intermediate transaction record knowledge carrier and the second intermediate transaction record knowledge carrier.
The transaction record knowledge carrier extraction component is a feature extraction neural network, which may be implemented as a convolutional neural network. The method further includes extracting a corresponding first intermediate transaction record knowledge carrier from the first blockchain link point transaction record based on the transaction record knowledge carrier extraction component, extracting a corresponding second intermediate transaction record knowledge carrier from the second blockchain node transaction record, and determining a knowledge carrier difference between the first blockchain node transaction record and the second blockchain link point transaction record by the first intermediate transaction record knowledge carrier and the second intermediate transaction record knowledge carrier. The first intermediate transaction record knowledge carrier is a hidden characteristic diagram of transaction record knowledge carrier extraction component from the first block chain node transaction record, and the second intermediate transaction record knowledge carrier is a hidden characteristic diagram of transaction record knowledge carrier extraction component from the second block chain node transaction record.
The knowledge carrier difference is essentially the loss obtained by hidden layer perception, and particularly when the knowledge loss of the bottom layer is obtained, the difference is obtained based on the comparison of the characteristic extraction output of the basic block link node transaction record and the characteristic extraction output of the generated block chain node transaction record. The embodiment of the disclosure compares the feature extraction output of the first blockchain node transaction record with the feature extraction output of the second blockchain node transaction record through the transaction record knowledge carrier extraction component to obtain a difference, and uses the difference as a knowledge carrier dimension comparison result to determine the difference between the first blockchain node transaction record and the second blockchain node transaction record, if the smaller the knowledge carrier difference value is, the smaller the difference between the first blockchain node transaction record and the second blockchain node transaction record is, and the higher the similarity between the first blockchain node transaction record and the second blockchain node transaction record is.
And the detected matching result and the knowledge carrier difference are used as a knowledge carrier dimension comparison result of the transaction record of the first block chain node and the transaction record of the second block chain node, so that the difference between the transaction record of the first block chain node and the transaction record of the second block chain node can be compared in the dimension of the transaction record characteristic of the block chain node, and the accuracy of the transaction record comparison of the block chain node is improved. For each transaction chain in the first block chain link point transaction record and the second block chain link point transaction record, the first intermediate transaction record knowledge carrier comprises a transaction chain intermediate knowledge carrier (i.e., implicit feature) corresponding to each transaction chain in the first block chain node transaction record, and the second intermediate transaction record knowledge carrier comprises a transaction chain intermediate knowledge carrier corresponding to each transaction chain in the second block chain node transaction record.
Operation S1032 may specifically include:
in operation S51, for each transaction chain pair, a transaction chain difference corresponding to the transaction chain pair is determined through the transaction chain intermediate knowledge carriers corresponding to the two transaction chains in the transaction chain pair.
When the knowledge carrier difference is determined, transaction chain dimension comparison can be carried out on hidden layer feature graphs extracted from the first block chain node transaction record and the second block chain node transaction record through the transaction record knowledge carrier extraction component, each transaction chain in the first block chain node transaction record corresponds to each transaction chain in the second block chain node transaction record according to positions, and transaction chain pairs formed by each transaction chain in the first block chain node transaction record and each transaction chain in the second block chain node transaction record are determined. One transaction chain in the transaction chain pair is a transaction chain of a transaction record of a first blockchain node, the other transaction chain is a transaction chain of a transaction record of a second blockchain node, and the positions of two transaction chains belonging to the same transaction chain pair in the transaction record of the first blockchain node and the transaction record of the second blockchain node are the same.
Operation S52, determining a knowledge carrier difference by the transaction chain differences corresponding to the transaction chain pairs.
Based on the transaction records of the first block chain link points and the transaction records of the second block chain nodes, the transaction chain pairs respectively correspond to the transaction chain differences, and the overall knowledge carrier differences between the transaction records of the first block chain links and the transaction records of the second block chain links are determined together, for example, the following formulas are referred to:
Wherein L1 is the knowledge carrier difference between the transaction record of the first blockchain node and the transaction record of the second blockchain node, m is the number of transaction chains in the transaction record of one blockchain node, fm is the hidden layer feature map extracted by the transaction record knowledge carrier extraction component in the transaction record of the blockchain node, and L1 (Rn) and L2 (Rn) are the transaction chain differences corresponding to the transaction chains in the transaction record of the first blockchain node and the transaction record of the second blockchain node respectively. If the transaction chain difference between the transaction records of the first block chain node and the transaction chain corresponding to the transaction chain at the same position in the transaction records of the second block chain node is smaller, the knowledge carrier difference between the transaction records of the first block chain node and the transaction records of the second block chain node is smaller, and the transaction records of the first block chain node and the transaction records of the second block chain node are more similar.
And forming transaction chains at the same position in the first block chain link point transaction record and the second block chain node transaction record into transaction chain pairs for comparing the dimension of the transaction chains, determining the difference of knowledge carriers between the first block chain node transaction record and the second block chain link point transaction record based on the difference of the transaction chains corresponding to each chain pair, and finishing accurate comparison of knowledge carriers in the middle of the transaction chains corresponding to the same position in the first block chain link point transaction record and the second block chain node transaction record, wherein the accuracy of comparing the block chain node transaction records is high.
And S104, determining a matching condition comparison result of the first blockchain node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result.
The match condition comparison results are variables that characterize the similarity of the first blockchain node transaction record to the second blockchain node transaction record, which may be expressed based on specific values (e.g., probabilities, confidence) or labels.
Because the transaction chain dimension comparison result comprises the transaction events of each transaction chain in the first block chain node transaction record and the second block chain node transaction record, the similarity of each transaction chain in the first block chain node transaction record and the second block chain node transaction record can be compared in sequence through the transaction chain dimension comparison result, so that the block chain node transaction record is finer, furthermore, the knowledge carrier dimension comparison result comprises all block chain node transaction record characteristics in the first block chain node transaction record and the second block chain node transaction record, and the same or similar block chain node transaction record characteristics in the first block chain node transaction record and the second block chain node transaction record can be accurately determined based on the knowledge carrier dimension comparison result, so that the accuracy of the comparison result of the matching condition is increased. And determining a matching situation comparison result of the first blockchain node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result, wherein the matching situation comparison result comprises comparison results of each transaction chain of the first blockchain node transaction record and the second blockchain node transaction record in the transaction chain dimension and comparison results of each blockchain node transaction record characteristic of the first blockchain node transaction record and the second blockchain node transaction record in the blockchain node dimension, and the matching situation comparison result is accurate and reliable.
When implemented, operation S104 may specifically include:
In operation S1041, if the global comparison data belongs to the first global value interval, it is determined that the comparison result of the matching condition is not matching.
The interval value of the first global value interval is not limited and is selected according to actual needs.
And S1042, if the knowledge carrier difference is smaller than the preset difference value, determining that the matching condition comparison result is matching.
The preset difference value is a judgment threshold, and the specific value is not limited.
Operation S1043, if the global comparison data belongs to the second global value interval, determining that the comparison result of the matching condition is not matched if the local comparison data is smaller than or equal to the preset local value or the detection result is smaller than or equal to the preset detection value; and otherwise, determining that the comparison result of the matching condition is matching, wherein the global value (namely, the element in the second global value interval) included in the second global value interval is larger than the global value included in the first global value interval.
The interval value of the second global value interval is not limited, the preset detection value is a judgment threshold value, and the specific value is not limited.
Operation S1044, if the global comparison data belongs to the third global value interval, and if the local comparison data is smaller than or equal to the preset local value and the detected matching result is smaller than or equal to the preset detection value, determining that the matching condition comparison result is not matching; otherwise, determining that the comparison result of the matching condition is matching; the third global value interval includes global values that are greater than global values included in the second global value interval.
Operation S1045, determining that the matching condition comparison result is matching if the global comparison data belongs to the fourth global value interval; the fourth global value interval includes global values that are greater than global values that the third global value interval includes.
The interval values of the third global value interval and the fourth global value interval are not limited.
The global comparison data, the local comparison data, the detection matching result and the knowledge carrier difference which are determined in the first block chain link point transaction record and the second block chain link point transaction record are adopted to determine the matching property between the first block chain link point transaction record and the second block chain link point transaction record, the similarity between the first block chain link point transaction record and the second block chain link node transaction record is judged in different dimensions, and the accuracy of the comparison result of the block chain link node transaction record matching condition is improved.
In operation S105, if the matching condition comparison result is the expected result, it is determined that the first blockchain node transaction record and the second blockchain node transaction record have consistent abnormal transaction behaviors.
Because the matching condition comparison result may be a numerical value or a label, the expected result may be adaptively configured according to the form of the matching condition comparison result, for example, if the matching condition comparison result is a numerical value, the expected result may be that the matching condition comparison result is greater than a preset expected value, a specific numerical value of the preset expected value is not limited, and if the matching condition comparison result is a label, the expected result may be that information corresponding to the label is indicative of matching. It will be appreciated that one of the first blockchain node transaction record and the second blockchain node transaction record, whose abnormal transaction behavior is explicit, may be mapped if it is determined that the other and the other match, whose corresponding abnormal transaction behavior type is consistent with the abnormal type of the other blockchain node transaction record.
In summary, by the blockchain-based data analysis method provided by the embodiment of the present disclosure, a first blockchain node transaction record and a second blockchain node transaction record to be compared are obtained first, and a transaction chain dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record is determined through transaction events of each transaction chain in the first blockchain node transaction record and transaction events of each transaction chain in the second blockchain node transaction record, and the matching of the first blockchain node transaction record and the second blockchain node transaction record in a transaction chain dimension is represented through the transaction chain dimension comparison result; determining a knowledge carrier dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record through a first transaction knowledge carrier of the first blockchain node transaction record and a second transaction knowledge carrier of the second blockchain node transaction record, and representing the matching property of the first blockchain node transaction record and the second blockchain node transaction record in the knowledge carrier dimension through the knowledge carrier dimension comparison result; and determining a matching condition comparison result of the first blockchain node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result. The method fully utilizes the characteristics of different aspects of the blockchain node transaction records, determines the similarity comparison condition of the first blockchain node transaction record and the second blockchain node transaction record based on the comparison result of two dimensions of the transaction chain dimension comparison result and the knowledge carrier dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record, wherein the detail comparison of the transaction chain dimension can be carried out between the first blockchain node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result, and the blockchain node transaction record characteristics in the first blockchain node transaction record and the second blockchain node transaction record are accurately compared based on the knowledge carrier dimension comparison result, so that the blockchain node transaction record comparison reliability is increased, and the anomaly identification is rapidly and accurately carried out.
Based on the same inventive concept, the embodiments of the present disclosure also provide a data analysis apparatus for implementing the above-mentioned blockchain-based data analysis method. The implementation of the solution provided by the apparatus is similar to that described in the above method, so the specific limitations in one or more embodiments of the data analysis apparatus provided below may be referred to above as limitations of the blockchain-based data analysis method, and will not be described in detail herein.
In one embodiment, as shown in FIG. 3, there is provided a data analysis apparatus 300 comprising:
a data acquisition module 310, configured to acquire a first blockchain node transaction record and a second blockchain node transaction record to be compared;
A first comparing module 320, configured to determine a transaction chain dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record according to the transaction event of each transaction chain in the first blockchain node transaction record and the transaction event of each transaction chain in the second blockchain node transaction record; the transaction chain dimension comparison result indicates the matching property of the transaction record of the first block chain link point and the transaction record of the second block chain node in the transaction chain dimension;
A second comparing module 330, configured to determine a knowledge carrier dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record through the first transaction knowledge carrier corresponding to the first blockchain node transaction record and the second transaction knowledge carrier corresponding to the second blockchain node transaction record; the knowledge carrier dimension comparison result indicates the matching property of the first blockchain node transaction record and the second blockchain node transaction record in the knowledge carrier dimension;
a comparison fusion module 340, configured to determine a matching condition comparison result of the first blockchain link node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result;
And the behavior detection module 350 is configured to determine that the first blockchain node transaction record and the second blockchain node transaction record have identical abnormal transaction behaviors if the matching condition comparison result is a desired result.
The respective modules in the tag processing apparatus described above may be implemented in whole or in part by software, hardware, and combinations thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.
In one embodiment, a computing server is provided, which may be implemented as a computing server in the present disclosure, and in particular may be a server, whose internal structure diagram may be as shown in fig. 4. The computing server includes a processor, memory, input/Output interfaces (I/O for short), and a communication interface. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface is connected to the system bus through the input/output interface. Wherein the processor of the computing server is configured to provide computing and control capabilities. The memory of the computing server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer readable code, and a database. The internal memory provides an environment for the execution of an operating system and computer readable code in a non-volatile storage medium. The database of the computing server is used for storing data including blockchain node transaction records and the like. The input/output interface of the computing server is used to exchange information between the processor and the external device. The communication interface of the computing server is used for communicating with an external terminal through network connection. The computer readable code, when executed by a processor, implements a blockchain-based data analysis method.
Those skilled in the art will appreciate that the architecture shown in fig. 4 is merely a block diagram of a portion of the architecture associated with the disclosed aspects and is not limiting of the computing servers to which the disclosed aspects apply, and that a particular computing server may include more or fewer components than shown, or may combine some of the components, or have a different arrangement of components.
In one embodiment, there is also provided a computing server including a memory having computer readable code stored therein and a processor that when executing the computer readable code performs the steps of the method embodiments described above.
In one embodiment, a computer readable storage medium is provided having computer readable code stored thereon, which when executed by a processor, implements the steps of the method embodiments described above.
In one embodiment, a computer readable code product is provided comprising computer readable code which when executed by a processor performs the steps of the method embodiments described above.
It should be noted that, the object information (including, but not limited to, device information, corresponding personal information, etc. of the object) and the data (including, but not limited to, data for analysis, stored data, presented data, etc.) related to the present disclosure are information and data authorized by the object or sufficiently authorized by each party, and the collection, use, and processing of the related data are required to comply with the related laws and regulations and standards of the related countries and regions.
Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by instructing the associated hardware with computer readable code stored on a non-transitory computer readable storage medium, which when executed may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in embodiments provided by the present disclosure may include at least one of non-volatile and volatile memory, among others. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magneto-resistive random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (PHASE CHANGE Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in various forms such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The databases referred to in the various embodiments provided by the present disclosure may include at least one of a relational database and a non-relational database. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processors involved in the embodiments provided by the present disclosure may be general-purpose processors, central processing units, graphics processors, digital signal processors, programmable logic, quantum computing-based data processing logic, etc., without limitation thereto.
The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.
The foregoing examples have expressed only a few embodiments of the present disclosure, which are described in more detail and detail, but are not to be construed as limiting the scope of the present disclosure. It should be noted that variations and modifications can be made by those skilled in the art without departing from the spirit of the disclosure, which are within the scope of the disclosure. Accordingly, the scope of the present disclosure should be determined from the following claims.
Claims (4)
1. A blockchain-based data analysis method, for application to a computing server, the method comprising:
acquiring a first block chain node transaction record and a second block chain node transaction record to be compared;
Determining a transaction chain dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record through transaction events of all transaction chains in the first blockchain node transaction record and transaction events of all transaction chains in the second blockchain node transaction record; the transaction chain dimension comparison result indicates the matching property of the transaction record of the first block chain link point and the transaction record of the second block chain node in the transaction chain dimension;
Determining a knowledge carrier dimension comparison result of the first block link point transaction record and the second block link node transaction record through a first transaction knowledge carrier corresponding to the first block link point transaction record and a second transaction knowledge carrier corresponding to the second block link node transaction record; the knowledge carrier dimension comparison result indicates the matching property of the first blockchain node transaction record and the second blockchain node transaction record in the knowledge carrier dimension;
Determining a matching condition comparison result of the first blockchain node transaction record and the second blockchain node transaction record based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result;
If the matching condition comparison result is a desired result, determining that the first block chain link node transaction record and the second block chain node transaction record have consistent abnormal transaction behaviors;
The determining, by the transaction event of each transaction chain in the first blockchain node transaction record and the transaction event of each transaction chain in the second blockchain node transaction record, a comparison result of the transaction chain dimensions of the first blockchain node transaction record and the second blockchain node transaction record includes:
Determining a statistical transaction event corresponding to the transaction chain through the combined transaction event of the transaction chain aiming at each transaction chain in the first block chain link point transaction record and the second block chain node transaction record;
Determining one or all of global comparison data and local comparison data as a dimension comparison result of the transaction chains through respective statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and respective statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record;
the obtaining the global comparison data includes:
calculating a mean square difference through the statistical transaction event corresponding to each transaction chain in the first blockchain node transaction record and the statistical transaction event corresponding to each transaction chain in the second blockchain node transaction record;
calculating the global comparison data by the data capacity and the mean square difference of each transaction chain;
The obtaining the local comparison data includes:
Calculating a first comparison result through the data average value of the statistical transaction event corresponding to each transaction chain in the first blockchain node transaction record and the data average value of the statistical transaction event corresponding to each transaction chain in the second blockchain node transaction record;
calculating a second comparison result through the dispersion of the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and the dispersion of the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record;
calculating a correlation variable between the first block link point transaction record and the second block link point transaction record through the statistical transaction event corresponding to each transaction chain in the first block link node transaction record and the statistical transaction event corresponding to each transaction chain in the second block link node transaction record;
Calculating a local comparison result through the correlation variable, the dispersion of the statistical transaction events corresponding to each transaction chain in the first blockchain node transaction record and the dispersion of the statistical transaction events corresponding to each transaction chain in the second blockchain node transaction record;
determining the local comparison data based on the first comparison result, the second comparison result, and the local comparison result;
The determining, by the first transaction knowledge carrier corresponding to the first blockchain node transaction record and the second transaction knowledge carrier corresponding to the second blockchain node transaction record, a knowledge carrier dimension comparison result of the first blockchain node transaction record and the second blockchain node transaction record, including one or all of the following:
Performing event detection on the first block chain link point transaction record and the second block chain node transaction record through a target event detection component to obtain each first target event and a corresponding event knowledge carrier in the first block chain link point transaction record, and each second target event and a corresponding event knowledge carrier in the second block chain node transaction record;
Determining a detection matching result through the first target event and the corresponding event knowledge carrier thereof and the second target event and the corresponding event knowledge carrier thereof, and taking the detection matching result as a dimension comparison result of the knowledge carriers;
Carrying out knowledge carrier extraction on the first block chain link point transaction record and the second block chain node transaction record through a transaction record knowledge carrier extraction component to obtain a first intermediate transaction record knowledge carrier corresponding to the first block chain link point transaction record and a second intermediate transaction record knowledge carrier corresponding to the second block chain node transaction record;
determining a knowledge carrier difference as a result of the knowledge carrier dimension comparison by the first intermediate transaction record knowledge carrier and the second intermediate transaction record knowledge carrier;
the determining, by the first target event and the corresponding event knowledge carrier thereof, the detection matching result includes:
generating a plurality of candidate target event pairs through each first target event and the corresponding event knowledge carrier respectively and each second target event and the corresponding event knowledge carrier respectively; the alternative target event pair comprises a first target event and a second target event, and a first space similarity condition is met between event knowledge carriers corresponding to the first target event and the second target event of the same alternative target event pair;
Determining a target event pair among the plurality of candidate target event pairs; the first target event and the second target event in the target event pair respectively correspond to event knowledge carriers and meet a second space similarity condition;
Determining the detection matching result through the number of the first target events and the second target events included in each target event pair, the total number of the first target events in the first blockchain node transaction record and the total number of the second target events in the second blockchain node transaction record;
the first intermediate transaction record knowledge carrier comprises transaction chain intermediate knowledge carriers corresponding to each transaction chain in the first blockchain node transaction record, and the second intermediate transaction record knowledge carrier comprises transaction chain intermediate knowledge carriers corresponding to each transaction chain in the second blockchain node transaction record;
said determining a knowledge carrier difference by said first intermediate transaction record knowledge carrier and said second intermediate transaction record knowledge carrier, comprising:
For each transaction chain pair, determining a transaction chain difference corresponding to the transaction chain pair through a transaction chain intermediate knowledge carrier corresponding to each of two transaction chains in the transaction chain pair; one transaction chain in the transaction chain pair is a transaction chain recorded by the first block chain link point transaction, the other transaction chain is a transaction chain recorded by the second block chain node transaction, and the positions of the two transaction chains in the same transaction chain pair in the first block chain link point transaction record and the second block chain node transaction record are the same;
determining the knowledge carrier difference through the transaction chain difference corresponding to each transaction chain pair;
If the transaction chain dimension comparison result includes global comparison data and local comparison data, and the knowledge carrier dimension comparison result includes a detection matching result and a knowledge carrier difference, determining a matching condition comparison result of the first block chain link point transaction record and the second block chain node transaction record based on the transaction chain dimension comparison result and the knowledge carrier dimension comparison result includes:
If the global comparison data belong to a first global numerical interval, determining that the comparison result of the matching condition is not matched;
If the knowledge carrier difference is smaller than a preset difference value, determining that the matching condition comparison result is matching;
If the global comparison data belongs to a second global value interval, if the local comparison data is smaller than or equal to a preset local value or the detection matching result is smaller than or equal to a preset detection value, determining that the matching condition comparison result is not matched; otherwise, determining that the comparison result of the matching condition is matching; the second global value interval comprises global values which are larger than the first global value interval;
If the global comparison data belongs to a third global value interval, if the local comparison data is smaller than or equal to the preset local value and the detection matching result is smaller than or equal to the preset detection value, determining that the matching condition comparison result is not matched; otherwise, determining that the comparison result of the matching condition is matching; the third global value interval comprises global values which are larger than the second global value interval;
If the global comparison data belong to a fourth global value interval, determining that the matching condition comparison result is matching; the fourth global value interval includes global values that are greater than global values that the third global value interval includes.
2. The method of claim 1, wherein the obtaining a first blockchain node transaction record and a second blockchain node transaction record to be compared comprises:
acquiring a first basic block link point traffic record and a second basic block link point traffic record;
Determining one basic blockchain node transaction record from the first basic blockchain node transaction record and the second basic blockchain node transaction record as a reference blockchain node transaction record, and determining the rest basic blockchain node transaction record as a blockchain node transaction record to be converted;
Preprocessing the block chain node transaction record to be converted based on the reference block chain node transaction record to obtain a block chain link node transaction record after conversion;
and taking the reference block chain link point transaction record and the converted block chain node transaction record as the first block chain link point transaction record and the second block chain node transaction record.
3. The method of claim 2, wherein the preprocessing the blockchain node transaction record to be converted based on the reference blockchain node transaction record to obtain a converted blockchain node transaction record, comprises:
If the transaction record of the block chain link point to be converted is different from the transaction record data capacity of the reference block chain node, carrying out data sampling adjustment on the transaction record of the block chain node to be converted, and adjusting the data capacity of the transaction record of the block chain link point to be converted into the data capacity of the transaction record of the reference block chain link point;
Performing event detection on the reference block link point transaction record and the block chain node transaction record to be converted through a target event detection component to obtain each third target event in the reference block link point transaction record and an event knowledge carrier corresponding to each third target event, and each fourth target event in the block link point transaction record to be converted and an event knowledge carrier corresponding to each fourth target event;
Determining a matched target event pair through each third target event and the corresponding event knowledge carrier and each fourth target event and the corresponding event knowledge carrier; the matching target event pair comprises a third target event and a fourth target event, and event knowledge carriers corresponding to the third target event and the fourth target event of the same matching target event pair respectively meet matching requirements;
Determining the blockchain node transaction record adjustment tensor based on the third target event and the fourth target event included in the matched target event pair;
and carrying out transaction chain position adjustment on the to-be-converted block chain node transaction record through the block chain node transaction record adjustment tensor to obtain the converted block chain link node transaction record.
4. A computing server, comprising:
One or more processors;
and one or more memories, wherein the memories have stored therein computer readable code, which, when executed by the one or more processors, causes the one or more processors to perform the method of any of claims 1-3.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311614114.0A CN117710100B (en) | 2023-11-28 | 2023-11-28 | Data analysis method based on block chain and calculation server |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311614114.0A CN117710100B (en) | 2023-11-28 | 2023-11-28 | Data analysis method based on block chain and calculation server |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117710100A CN117710100A (en) | 2024-03-15 |
| CN117710100B true CN117710100B (en) | 2024-06-04 |
Family
ID=90159773
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311614114.0A Active CN117710100B (en) | 2023-11-28 | 2023-11-28 | Data analysis method based on block chain and calculation server |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117710100B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111694502A (en) * | 2019-03-14 | 2020-09-22 | 北京沃东天骏信息技术有限公司 | Block chain data storage method, device, equipment and storage medium |
| CN114418109A (en) * | 2021-08-30 | 2022-04-29 | 河南大学 | Node selection and aggregation optimization system and method for federal learning under micro-service architecture |
| CN114548959A (en) * | 2021-12-29 | 2022-05-27 | 杭州趣链科技有限公司 | Block chain-based abnormal sudden increase transaction behavior monitoring method and system |
| CN115271733A (en) * | 2022-09-28 | 2022-11-01 | 深圳市迪博企业风险管理技术有限公司 | Privacy-protecting block chain transaction data anomaly detection method and equipment |
-
2023
- 2023-11-28 CN CN202311614114.0A patent/CN117710100B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111694502A (en) * | 2019-03-14 | 2020-09-22 | 北京沃东天骏信息技术有限公司 | Block chain data storage method, device, equipment and storage medium |
| CN114418109A (en) * | 2021-08-30 | 2022-04-29 | 河南大学 | Node selection and aggregation optimization system and method for federal learning under micro-service architecture |
| CN114548959A (en) * | 2021-12-29 | 2022-05-27 | 杭州趣链科技有限公司 | Block chain-based abnormal sudden increase transaction behavior monitoring method and system |
| CN115271733A (en) * | 2022-09-28 | 2022-11-01 | 深圳市迪博企业风险管理技术有限公司 | Privacy-protecting block chain transaction data anomaly detection method and equipment |
Non-Patent Citations (1)
| Title |
|---|
| 面向区块链异常交易识别与溯源方法研究;韩华龙;万方数据;20231002;1-68 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117710100A (en) | 2024-03-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Chen et al. | Saliency detection via the improved hierarchical principal component analysis method | |
| CN113095370B (en) | Image recognition method, device, electronic equipment and storage medium | |
| CN111612041A (en) | Abnormal user identification method and device, storage medium and electronic equipment | |
| CN113569933A (en) | Trademark pattern matching method and corresponding device, equipment and medium | |
| CN112749737A (en) | Image classification method and device, electronic equipment and storage medium | |
| CN116030312B (en) | Model evaluation method, device, computer equipment and storage medium | |
| CN117710100B (en) | Data analysis method based on block chain and calculation server | |
| CN116738009A (en) | Method for archiving and backtracking data | |
| CN116541792A (en) | Method for carrying out group partner identification based on graph neural network node classification | |
| Bu et al. | A High‐Order CFS Algorithm for Clustering Big Data | |
| CN116186708A (en) | Class identification model generation method, device, computer equipment and storage medium | |
| CN116861226A (en) | Data processing method and related device | |
| CN110929118A (en) | Network data processing method, equipment, device and medium | |
| CN112446310B (en) | Age identification system, method and device based on block chain | |
| CN117743916A (en) | Model training method, abnormal information detection method and device | |
| KR20230154601A (en) | Method and device for obtaining pixel information of table | |
| CN118447620A (en) | Currency recognition method, apparatus, electronic device, computer-readable storage medium, and computer program product | |
| CN117275007A (en) | Account information recognition classifier generation method and device and resource card recognition method | |
| CN117523259A (en) | Semi-supervised model training method, device, computer equipment and storage medium | |
| CN116881099A (en) | System performance evaluation method, device, computer equipment and storage medium | |
| CN118229296A (en) | Account abnormal behavior identification method and device, computer equipment and storage medium | |
| CN117041015A (en) | Network fault detection method, device, computer equipment and storage medium | |
| CN117278381A (en) | Processing method, device, computer equipment and medium for server alarm data | |
| Jiang et al. | Robust semisupervised nonnegative local coordinate factorization for data representation | |
| CN113255753A (en) | Component supply consistency control method using block chain technology |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |