WO2022127342A1 - Method and device for detecting eclipse attack for blockchain - Google Patents

Abstract

Disclosed are a method and device for detecting an eclipse attack for a blockchain. The method comprises: determining each output node of a first node at the detection moment on the basis of each neighbor node reported by each second node at the detection moment, each second node being a node in a distributed routing table of the first node, and each neighbor node being a node in a distributed routing table of the second node; and then determining each first logical distance between each output node at the detection moment and the first node; determining, for at least one historical moment earlier than the detection moment, each second logical distance between each output node at the historical moment and the first node; and determining, according to each first logical distance and each second logical distance at the at least one historical moment, whether the first node is subjected to an eclipse attack. In this way, the real-time performance and initiative of the non-restart type eclipse attack detection at the detection moment are improved, and the attack mode of the non-restart type eclipse attack is detected.

Description

A method and device for detecting eclipse attack in blockchain

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the priority of the Chinese patent application filed on December 16, 2020 with the application number 202011486985.5 and titled "A method and device for detecting solar eclipse attacks in a blockchain", the entire contents of which are approved by Reference is incorporated in this application.

technical field

The present invention relates to the field of financial technology (Fintech), and in particular, to a method and device for detecting an eclipse attack on a blockchain.

Background technique

With the development of computer technology, more and more technologies (such as: blockchain, cloud computing or big data) are applied in the financial field, the traditional financial industry is gradually transforming into financial technology, and big data technology is no exception, but due to The security and real-time requirements of the financial and payment industries also place higher requirements on big data technology.

The eclipse attack is an attack method against the blockchain system. The attacker restarts the victim node through the eclipse attack, clears the routing table in the victim node, and then controls a specific node (such as a malicious node) to The victim node accesses information, so that all specific nodes exist in the routing table of the victim node, so that it can only receive the attacker's information and send feedback information to the attacker, so that the victim node cannot view the real The information of the blockchain system will cause the victim node to split with the blockchain system, so that the attacker can use less than 51% of the computing power to launch a 51% attack on the blockchain system, resulting in the security of the blockchain system. hidden danger.

In the prior art, in order to defend against restarting solar eclipse attacks, a random forest algorithm is used to detect solar eclipse attacks. Specifically, the random forest algorithm is used to collect offline neighbor nodes determined by other normal nodes in their respective routing tables to construct a random decision forest, and then collect multiple neighbor nodes (specific nodes) of the victim node determined in the routing table according to the random decision forest. , and then detect the victim node.

However, there are various ways of eclipse attacks, including the eclipse attack without restarting the victim node, that is, a restartless eclipse attack. Specifically, by maintaining frequent data communication with the victim node, the specific node is gradually inserted into the output node list of the victim node, so as to invade the victim node running smoothly, without storing the specific node in the routing table of the victim node. node, to achieve a restart-free eclipse attack, but the random forest algorithm can only detect the eclipse attack for the victim nodes whose routing tables are all specific nodes, so the random forest algorithm cannot detect the restart-free eclipse attack, and the random forest The algorithm needs to be detected offline, and its real-time and initiative are low.

Therefore, there is a need for a method for detecting an eclipse attack, so as to detect a restart-free eclipse attack and increase the real-time and proactiveness of the eclipse attack detection.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a method and device for detecting a solar eclipse attack on a blockchain, which are used to detect a restart-free solar eclipse attack and increase the real-time and proactiveness of the solar eclipse attack detection.

In a first aspect, an embodiment of the present invention provides a method for detecting an eclipse attack on a blockchain, including:

Based on each neighbor node reported by each second node at the detection time, each output node of the first node at the detection time is determined; each second node is a node in the distributed routing table of the first node; so Describe each neighbor node as the node in the distributed routing table of the second node;

determining the first logical distances between each output node at the detection moment and the first node respectively;

For at least one historical moment before the detection moment, determine each second logical distance between each output node of the historical moment and the first node respectively;

According to each of the first logical distances and each of the second logical distances of at least one historical moment, it is determined whether the first node is under a solar eclipse attack.

In the above technical solution, based on the logical distance between each neighbor node and the first node reported by each second node at the detection time, a preset number of neighbor nodes with the smallest logical distance between each neighbor node and the first node are assigned. It is determined as each output node of the first node at the detection time. Based on this, the non-restart eclipse attack will construct a neighbor node with a small logical distance from the first node. Therefore, when the output node at the detection time is determined After that, determine the first logical distance between the output node and the first node, and then determine whether the first node is under an eclipse attack at the detection time according to the second logical distance at the historical moment and the first logical distance at the detection time. In this way, the real-time and initiative of the non-restart eclipse attack detection at the detection time is increased, and the attack mode of the non-restart eclipse attack is detected.

Optionally, determining whether the first node is under a solar eclipse attack according to the first logical distances and the second logical distances of at least one historical moment, including:

According to each second logical distance at the at least one historical moment, the predicted logical distance at the detection moment is determined through a neural network model;

According to each first logical distance and the predicted logical distance at the detection time, it is determined whether the first node is under a solar eclipse attack.

In the above technical solution, according to each second logical distance at at least one historical moment, the neural network model is used to determine the predicted logical distance at the detection moment, which increases the real-time and active detection of the output node at the detection moment, thereby increasing the Real-time and proactive detection of restartless eclipse attacks.

Optionally, determining whether the first node is under a solar eclipse attack according to the first logical distances and the predicted logical distances at the detection moment, including:

Determine whether the detection time is an abnormal time according to the predicted logical distances between the first logical distances and the detection time;

If the first node has multiple consecutive abnormal moments, it is determined that the first node is under a solar eclipse attack.

Optionally, according to the predicted logical distances between the first logical distances and the detection time, determining whether the detection time is an abnormal time, including:

For any one of the first logical distances, determine a first error according to the first logical distance and the predicted logical distance at the detection moment;

For any historical moment in the N historical moments, each second error is determined based on each second logical distance of the historical moment and the predicted logical distance of the historical moment;

determining an error threshold according to each of the second errors and the first errors of the N historical moments;

If the first error is greater than the error threshold, it is determined that the detection time is an abnormal time.

In the above technical solution, the output node corresponding to any first logical distance is detected. If at the detection moment, the first error corresponding to any output node is greater than the error threshold, the detection moment is determined to be an abnormal moment to prevent attackers from gradually occupying The output node table of the first node increases the accuracy of the restartless eclipse attack detection.

Optionally, determining an error threshold according to each of the second errors and the first errors of the N historical moments, including:

Obtain a first vector according to each second error and the first error of the N historical moments;

determining a second vector according to the first vector and an exponential moving weighted average algorithm;

The error threshold is obtained from the second vector.

Optionally, the error threshold is obtained according to formula (1), including:

Among them, ∈ is the error threshold; μ(es ) is the average value of the second vector; _σ ( _es ) is the standard deviation of the second vector; Δμ( _es ) is the abnormality in the second vector _Δσ (es ) is the standard deviation of the outliers in the second vector; |e _a | is the modulus of the set of outliers in the second vector; |E _seq | ² is the In the two vectors, the square of the modulus of the set of consecutive outliers; the outliers are the values in the second vector whose historical moments are abnormal moments.

Optionally, the neural network model is obtained by training according to the logical distance between each neighbor node and the first node reported at M historical moments.

In a second aspect, an embodiment of the present invention provides an apparatus for detecting an eclipse attack on a blockchain, including:

A calculation module, configured to determine each output node of the first node at the detection time based on each neighbor node reported by each second node at the detection time; each second node is the distributed routing table of the first node The nodes in the node; the neighbor nodes are nodes in the distributed routing table of the second node;

determining the first logical distances between each output node at the detection moment and the first node respectively;

a processing module, configured to, for at least one historical moment before the detection moment, determine each second logical distance between each output node of the historical moment and the first node respectively;

According to each of the first logical distances and each of the second logical distances of at least one historical moment, it is determined whether the first node is under a solar eclipse attack.

Optionally, the processing module is specifically used for:

According to each second logical distance at the at least one historical moment, the predicted logical distance at the detection moment is determined through a neural network model;

According to each first logical distance and the predicted logical distance at the detection time, it is determined whether the first node is under a solar eclipse attack.

Optionally, the processing module is specifically used for:

According to the predicted logical distance of each first logical distance and the detection moment, determine whether the detection moment is an abnormal moment;

If the first node has multiple consecutive abnormal moments, it is determined that the first node is under a solar eclipse attack.

Optionally, the processing module is specifically used for:

For any one of the first logical distances, determine a first error according to the first logical distance and the predicted logical distance at the detection moment;

For any historical moment in the N historical moments, each second error is determined based on each second logical distance of the historical moment and the predicted logical distance of the historical moment;

determining an error threshold according to each of the second errors and the first errors of the N historical moments;

If the first error is greater than the error threshold, it is determined that the detection time is an abnormal time.

Optionally, the processing module is specifically used for:

Obtain a first vector according to each second error and the first error of the N historical moments;

determining a second vector according to the first vector and an exponential moving weighted average algorithm;

The error threshold is obtained from the second vector.

Optionally, the error threshold is obtained according to formula (1), including:

Among them, ∈ is the error threshold; μ(es ) is the average value of the second vector; _σ ( _es ) is the standard deviation of the second vector; Δμ( _es ) is the abnormality in the second vector _Δσ (es ) is the standard deviation of the outliers in the second vector; |e _a | is the modulus of the set of outliers in the second vector; |E _seq | ² is the In the two vectors, the square of the modulus of the set of consecutive outliers; the outliers are the values in the second vector whose historical moments are abnormal moments.

Optionally, the neural network model is obtained by training according to the logical distance between each neighbor node and the first node reported at M historical moments.

In a third aspect, an embodiment of the present invention further provides a computing device, including:

memory for storing program instructions;

The processor is configured to call the program instructions stored in the memory, and execute the above method for detecting the solar eclipse attack on the blockchain according to the obtained program.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause a computer to execute the above-mentioned blockchain eclipse attack method of detection.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

1 is a schematic diagram of an attack detection method of a random forest algorithm provided by an embodiment of the present invention;

2 is a schematic diagram of a system architecture provided by an embodiment of the present invention;

3 is a schematic flowchart of a method for detecting a solar eclipse attack on a blockchain provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an apparatus for detecting an eclipse attack on a blockchain according to an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The blockchain system is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm, etc., and the established physical network is based on a peer-to-peer (P2P) distributed network. Taking Ethereum as an example, the underlying distributed network of Ethereum, that is, the P2P network, uses the classic Kademlia (Kademlia Distributed Hash Table, distributed hash table) network, referred to as KAD, which is a distributed hash table technology. The OR operation is the basis for measuring the logical distance between nodes. The routing table of KAD is constructed from data called K buckets. The K buckets record information such as node ID (Identity document, identity number), logical distance, etc. In different versions of the Ethereum client, the number of K buckets is not consistent. For example, in the Ethereum client version 1.8, the number of K buckets is 17, and each bucket stores 16 node IDs. Among them, the routing table in the K bucket is obtained according to the node discovery mechanism.

There are various attack methods in the existing technology, such as Sybil attack and Eclipse attack. Through Sybil attack and Eclipse attack, normal nodes are isolated from the blockchain system, so as to achieve 51% attack when the computing power is lower than 51% , for example, the TCP (Transmission Control Protocol) interface of the Ethereum node is determined in two tables, including the output node table and the input node table, where the input node table is determined according to the nodes in the K bucket , a preset number (eg, half the number) of nodes in the output node table are selected in the input node table, and the rest of the nodes are determined through a node discovery mechanism. The attacker builds a large number of malicious nodes through the witch attack, and continuously connects the Ethereum nodes by controlling the botnet, that is, to refresh the two node tables, so that the addresses of the malicious nodes are stored in the two node tables. Through DDoS (Distributed Denial of Service) attacks and other methods, the Ethereum node is restarted, so that the output node table and the input node table of the Ethereum node are all malicious nodes controlled by the attacker.

In the prior art, in order to detect that an Ethereum node has received an eclipse attack, a detection method of the random forest algorithm is given, and FIG. 1 exemplarily shows a schematic diagram of an attack detection method of the random forest algorithm, as shown in FIG. 1 . As shown, the random forest algorithm collects normal data packets in the normal nodes of Ethereum as a data packet training set, wherein the normal data packets include multiple neighbor nodes, and the data packets are obtained according to the node discovery mechanism, for example, node A Randomly generate target node B, and calculate the logical distance l _AB between node A and target node B. Node A finds node C in its own K bucket. It should be noted that the logic between node A and node C The distance l _AC is less than the logical distance l _AB , then node A sends a find-node (find node) request to node C (a request for querying a node with a logical distance from target node B), where the find-node request includes the target node The ID of node B, node C determines a preset number (such as 16) of nodes such as node D according to the ID of target node B. It should be noted that multiple nodes such as node D are in the K bucket of node C, and the The logical distance between the IDs of the target node B is the smallest. Then, the feature vector is extracted from the training set of the data packet of the normal node, and then the random forest model is trained according to the training set including the feature vector and the label, and the label is added to the random forest model.

During the testing process, the random forest model runs the attack script, and continuously sends find-node requests to the victim node to collect the attack data packets returned by the victim node that contain malicious nodes, and then extracts the feature vector of the attack data packets, through The random forest model makes predictions, and the results predicted by the random forest model are regarded as the predicted labels of the detection.

It should be noted that the random forest algorithm is composed of a large number of decision trees, and the random forest algorithm can give relatively accurate detection results under the condition of low consumption of computing resources. In the above testing process, the implementation process of the random forest algorithm is as follows: 1. Use the Bootstrap (front-end toolkit) method to randomly extract k training samples from the training set, thereby generating k classification trees. 2. Randomly select S variables from the nodes of the k classification trees, select representative variables, and then select the threshold for classification from multiple classification points. 3. Do not build the classification tree and keep it growing infinitely. Whenever a new training sample is input, the constructed decision tree forest will be split, and the final label will be obtained by voting on the classification tree.

According to the above, the method of detecting solar eclipse attacks based on the random forest algorithm needs to collect a large number of data packets of normal nodes, build a random decision forest in advance, and then label and classify the data to be detected. When it is determined that there is attack data of malicious nodes packet, the victim node is considered to be attacked. Therefore, the method of detecting eclipse attacks based on the random forest algorithm cannot detect Ethereum nodes in real time. Moreover, when there is a packet that is marked as an attack packet, it is considered that an attack has occurred, and the false positive rate is high.

In addition, the method of detecting solar eclipse attacks based on random forest algorithm is limited to the types of solar eclipse attacks, which can only be restarted solar eclipse attacks, that is to detect low resource consumption solar eclipses that occupy the TCP link of the Ethereum node after the restart of the victim node attack mode.

But at present, there is a restart-free eclipse attack mode called False Friend Attack. This attack mode can take advantage of the fact that the neighbor nodes of normal nodes in the Ethereum network will be disconnected. By constructing long-term online witch nodes, In the process of node discovery mechanism, the output node table in the TCP interface of the victim node is invaded, and there is no need to wait for the restart of the Ethereum node, and this kind of restartless eclipse attack cannot be detected by the method of detecting eclipse attacks based on the random forest algorithm. .

In order to further describe the solar eclipse attack mode of False Friend Attack, the implementation of the solar eclipse attack of False Friend Attack will be described in the following specific examples.

Example 1

In version 1.8 of the Ethereum client, the victim node includes 25 TCP connection IDs, which are divided into an output node table including 8 output nodes and an input node table including 17 input nodes. Since the Ethereum network does not impose restrictions on the input node link, the attacker can easily use the input node table to actively establish a connection with the victim node according to the multiple witch nodes constructed and continuously send TCP inbound connection requests to the victim node. , until the occupation is complete, to achieve the occupation of the input node table. The output node table of the victim node is selected through two mechanisms. The first mechanism is to randomly select the first node in each K bucket of the victim node through the Read Random Nodes function, that is, in the input node table. randomly selected. Another mechanism is selected through the node discovery mechanism. After the victim node obtains the neighbor nodes through the discovery mechanism, it determines the 4 nodes closest to the victim node in the neighbor nodes as output nodes, and obtains the output node table.

The False Friend Attack eclipse attack can compromise a smoothly running victim node without requiring the victim node to reboot. In the False Friend Attack attack model, there are two mechanisms. The first mechanism only needs to inject a witch node into the head of each K bucket of the victim node to ensure that the output node table of the Ethereum node has been invaded. . When the victim node selects the nodes of the output node table, part of it depends on the first mechanism, such as randomly selecting 4 nodes in the input node table as output nodes through the Read Random Nodes function.

For another mechanism: the attacker needs to place at least one witch node in each K bucket of the victim node, so that the Ethereum node sends a find-node request to the attacker, and the attacker receives the find-node request from the victim node. After the node request, return a pre-made fake witch node (neighbors list), where the nodes in the neighbors (neighbors) list are witch nodes that are closer to the victim node. Nodes with short distances invade the output node table of the victim node.

It should be noted that the logical distance between nodes is calculated by XOR operation according to the ID of the node. For example, for example, the logical distance between the node whose node ID is 000111 and the node whose node ID is 000110 and 000011 is calculated as:

(decimal 1),

(Decimal 4).

Therefore, there is a need for a method for detecting an eclipse attack, which is used to detect an attack against a restartless eclipse attack, and increases the real-time and proactiveness of the restartless eclipse attack detection at the detection time.

FIG. 2 exemplarily shows a system architecture to which the embodiments of the present invention are applicable, where the system architecture includes a first node 210 and a second node 220 .

The second node 220 is determined by the first node 210 in its own K bucket. Specifically, the first node 210 randomly generates a target node, and calculates the logical distance between the first node 210 and the target node, Then determine the second node 220 of the first node 210 in its own K bucket, and the logical distance between the first node 210 and the second node 220 is smaller than the logical distance between the first node 210 and the target node, which needs to be explained. Yes, the number of second nodes 220 may be multiple or a preset number. For example, it is determined that the first node 210 determines that 10 nodes in its own K bucket are smaller than the logical distance between the first node 210 and the target node. three nodes are randomly selected as the second nodes 220 .

The first node 210 is configured to send a find-node request to the second node 220 , so that the second node 220 queries neighbor nodes and feeds back the neighbor nodes to the first node 210 .

After obtaining the neighbor nodes, the first node 210 determines an output node among the neighbor nodes, detects the output node, and then determines whether the detection time is an abnormal time.

It should be noted that the structure shown in FIG. 2 above is only an example, which is not limited in this embodiment of the present invention.

Based on the above description, FIG. 3 exemplarily shows a schematic flowchart of a method for detecting a solar eclipse attack on a blockchain provided by an embodiment of the present invention, and the process can be executed by an apparatus for detecting a solar eclipse attack on a blockchain.

As shown in Figure 3, the process specifically includes:

Step 310: Determine each output node of the first node at the detection time based on each neighbor node reported by each second node at the detection time.

In the embodiment of the present invention, each second node is a node in the distributed routing table of the first node, and each neighbor node is a node in the distributed routing table of the second node.

Specifically, the second node is determined by the first node in the distributed routing table of the first node according to the target node, and each neighbor node is determined by the second node in the distributed routing table of the second node according to the target node. In order to better describe how the first node determines the output node, it will be described in a specific example below.

Example 2

At the detection moment, the first node a randomly generates the target node b, wherein the randomly generated target node b includes the node ID of the target node b, and the first node a and the node ID of the target node b are used to calculate the node ID of the first node a and the node ID of the target node b. The logical distance between a node a and the target node b is l _ab , and then the first node a finds the second node c in its own distributed routing table, wherein the logical distance between the first node a and the second node c is The distance l _ac is smaller than the logical distance l _ab . After the second node c is determined, the first node a sends a find-node request to the second node c, where the find-node request includes the node ID of the target node b. So that the second node c determines 16 neighbor nodes d according to the node ID of the target node b, wherein, the neighbor node d is the second node c in the distributed routing table, and the logical distance between the target node b is the smallest. 16 nodes, and then the neighbor node d is fed back to the first node a by the second node c.

After the first node a obtains 16 neighbor nodes d, it calculates each logical distance _{lad between each neighbor node d and the first node a, and determines 4 minimum values among the 16 logical distances lad ,} then the minimum value The corresponding neighbor node d is each output node of the first node at the detection time.

Step 320: Determine each first logical distance between each output node at the detection moment and the first node respectively.

In this embodiment of the present invention, when the first node determines the output node, the first logical distance between the output node and the first node is obtained according to the node ID of the output node.

Step 330: For at least one historical moment before the detection moment, determine each second logical distance between each output node of the historical moment and the first node respectively.

In the embodiment of the present invention, in the historical moment, the first node determines the output node according to the second node, and further determines each second logical distance between the output node and the first node at the historical moment. For example, in conjunction with Example 2, the historical moment is the moment before the detection moment, and the second logical distance between the second node e and the first node in the historical moment is the second logical distance.

Step 340: Determine whether the first node is under a solar eclipse attack according to the first logical distances and the second logical distances of at least one historical moment.

In the embodiment of the present invention, the predicted logical distance at the detection time is determined according to the second logical distance at the historical time, and then it is determined whether the first node is under a solar eclipse attack.

Further, according to each second logical distance of at least one historical moment, the neural network model is used to determine the predicted logical distance at the detection moment, and then according to each first logical distance and the predicted logical distance of the detection moment, it is determined whether the first node is in the daily Eclipse attack.

In this embodiment of the present invention, the predicted logical distance at the detection moment may be determined according to each second logical distance at at least one historical moment, or the predicted logical distance at the detection moment may be determined according to the logical distance between each neighbor node and the first node at at least one historical moment. The predicted logical distance is not limited herein, and the use of the second logical distance can increase the accuracy of determining the predicted logical distance at the detection moment.

For example, the detection time is t, the output nodes at each detection time are 4, and the output nodes of the two historical moments (t-1 and t-2) before the detection time are used as the input samples of the neural network model, that is, the input samples X is

where each feature in sample X (such as

) includes the second logical distance after preprocessing, and the preprocessing includes normalization processing, encoding processing, and the like. Then the predicted logical distance at the detection moment is obtained according to the input sample X

The predicted logical distance at the detection time is used to determine whether the detection time is an abnormal time, and whether the first node is under a solar eclipse attack is determined according to the abnormal time.

Further, according to the predicted logical distance between each first logical distance and the detection time, it is determined whether the detection time is an abnormal time. If the first node has multiple consecutive abnormal time, it is determined that the first node is under a solar eclipse attack.

Specifically, for any first logical distance, the first error is determined according to the predicted logical distance between the first logical distance and the detection moment, and for any historical moment in the N historical moments, each second logical distance based on the historical moment is determined. The second error is determined according to the predicted logical distance from the historical moment, and the error threshold is determined according to each second error and the first error of N historical moments. If the first error is greater than the error threshold, the detection moment is determined to be an abnormal moment.

In the embodiment of the present invention, at the detection time, there are multiple first logical distances, any one of the first logical distances is determined, and when the first error corresponding to any first logical distance is greater than the error threshold, the detection time is determined to be an abnormal time It should be noted that, in order to reduce the false alarm rate, when the first error greater than the error threshold is greater than the preset number, the detection time can be determined as an abnormal time, and the specific number is not limited to determine the detection time as an abnormal time.

The error threshold is obtained by taking the second errors and the first errors of N historical moments as a vector. Specifically, the first vector is obtained according to each second error and the first error at N historical moments, the second vector is determined according to the first vector and the exponential moving weighted average algorithm, and finally the error threshold is obtained according to the second vector.

Further, the error threshold is obtained according to the following formula (1), including:

Among them, ∈ is the error threshold; μ(es ) is the average value of the second vector; _σ ( _es ) is the standard deviation of the second vector, Δμ( _es ) is the average value of outliers in the second vector, Δσ (e _s ) is the standard deviation of the outliers in the second vector, |e _a | is the modulus of the set of outliers in the second vector, |E _seq | ² is the modulus of the set of consecutive outliers in the second vector The square of , the outlier is the value of the historical moment in the second vector that is an abnormal moment.

In the embodiment of the present invention, formula (1) is an unsupervised threshold calculation method. In order to better explain how to determine the error threshold at the detection moment, the following will be described in a specific example in conjunction with Example 2.

Example 3

At the detection time, the output nodes d1, d2, d3, and d4 are determined, and the first logical distance between the output node d1 and the first node is obtained for the output node d1, and the predicted logical distance obtained above is obtained.

get the first error

Then obtain the first vector e according to the second errors (such as e ^(t-1) and e ^(t-2) ) of the first two (that is, N is 2) historical moments,

Then use the first vector e to obtain the second vector _es through the exponential moving weighted average algorithm,

Then, the set of outliers is obtained according to the second vector es. If the historical time of _t -1 is an abnormal time, then the set of outliers

Then according to the second vector _es and the set of outliers

The error threshold s1 at the detection time t is determined by the above formula (1), and finally according to the first error

The magnitude of the error threshold s1 determines whether the detection time is an abnormal time. For example, the first error

If it is greater than the error threshold s1, the detection time is an abnormal time.

Exemplarily, other output nodes at the detection moment determine the first error according to the same method

Is it greater than the error threshold sn, where n is the number of output nodes.

It should be noted that, in the present invention, the detection of the output node is not limited, and the detection of each neighbor node fed back by the second node may also be performed, but the calculation amount in the detection process will be correspondingly increased.

The exponential moving weighted average algorithm is used to give different weights to the first vector e respectively, obtain a moving average according to different weights, and determine the second vector _es based on the final moving average.

In the embodiment of the present invention, the neural network model is obtained by training according to the logical distance between each neighbor node and the first node reported at M historical moments. Each residential node obtained by the first node at each historical moment is used as a training sample, and the neural network model is obtained by training according to the M training samples.

Further, the neural network model can be trained by the Dropout method, so as to prevent the defects of overfitting and long training time of the neural network model during training.

Any logical distance mentioned in the present invention includes, but is not limited to, the distance feature after the logical distance obtained by the node ID is processed by normalization and one-hot encoding.

Based on the same technical concept, FIG. 4 exemplarily shows a schematic structural diagram of a block chain solar eclipse attack detection device provided by an embodiment of the present invention, and the device can execute the flow of the block chain solar eclipse attack detection method. .

As shown in Figure 4, the device specifically includes:

The calculation module 410 is configured to determine, based on each neighbor node reported by each second node at the detection time, each output node of the first node at the detection time; each second node is a distributed route of the first node A node in the table; each neighbor node is a node in the distributed routing table of the second node;

determining the first logical distances between each output node at the detection moment and the first node respectively;

The processing module 420 is configured to, for at least one historical moment before the detection moment, determine each second logical distance between each output node of the historical moment and the first node respectively;

According to each of the first logical distances and each of the second logical distances of at least one historical moment, it is determined whether the first node is under a solar eclipse attack.

Optionally, the processing module 420 is specifically used for:

According to each second logical distance at the at least one historical moment, the predicted logical distance at the detection moment is determined through a neural network model;

According to each first logical distance and the predicted logical distance at the detection time, it is determined whether the first node is under a solar eclipse attack.

Optionally, the processing module 420 is specifically used for:

According to the predicted logical distances between the first logical distances and the detection time, determine whether the detection time is an abnormal time;

If the first node has multiple consecutive abnormal moments, it is determined that the first node is under a solar eclipse attack.

Optionally, the processing module 420 is specifically used for:

For any one of the first logical distances, determine a first error according to the first logical distance and the predicted logical distance at the detection moment;

For any historical moment in the N historical moments, each second error is determined based on each second logical distance of the historical moment and the predicted logical distance of the historical moment;

determining an error threshold according to each of the second errors and the first errors of the N historical moments;

If the first error is greater than the error threshold, it is determined that the detection time is an abnormal time.

Optionally, the processing module 420 is specifically used for:

Obtain a first vector according to each second error and the first error of the N historical moments;

determining a second vector according to the first vector and an exponential moving weighted average algorithm;

The error threshold is obtained from the second vector.

Optionally, the error threshold is obtained according to formula (1), including:

Among them, ∈ is the error threshold; μ(es ) is the average value of the second vector; _σ ( _es ) is the standard deviation of the second vector; Δμ( _es ) is the abnormality in the second vector _Δσ (es ) is the standard deviation of the outliers in the second vector; |e _a | is the modulus of the set of outliers in the second vector; |E _seq | ² is the In the two vectors, the square of the modulus of the set of consecutive outliers; the outliers are the values in the second vector whose historical moments are abnormal moments.

Optionally, the neural network model is obtained by training according to the logical distance between each neighbor node and the first node reported at M historical moments.

Based on the same technical idea, an embodiment of the present invention also provides a computing device, including:

memory for storing program instructions;

The processor is configured to call the program instructions stored in the memory, and execute the above method for detecting the solar eclipse attack on the blockchain according to the obtained program.

Based on the same technical concept, an embodiment of the present invention also provides a computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause a computer to execute the above-mentioned blockchain data. Eclipse attack detection method.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flows of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims (10)

1. A method for detecting an eclipse attack on a blockchain, comprising:

   Based on each neighbor node reported by each second node at the detection time, each output node of the first node at the detection time is determined; each second node is a node in the distributed routing table of the first node; so Describe each neighbor node as the node in the distributed routing table of the second node;

   determining the first logical distances between each output node at the detection moment and the first node respectively;

   For at least one historical moment before the detection moment, determine each second logical distance between each output node of the historical moment and the first node respectively;

   According to each of the first logical distances and each of the second logical distances of at least one historical moment, it is determined whether the first node is under a solar eclipse attack.
2. The method of claim 1, wherein determining whether the first node is under an eclipse attack according to the first logical distances and the second logical distances of at least one historical moment comprises:

   According to each second logical distance at the at least one historical moment, the predicted logical distance at the detection moment is determined through a neural network model;

   According to each first logical distance and the predicted logical distance at the detection time, it is determined whether the first node is under a solar eclipse attack.
3. The method according to claim 2, wherein determining whether the first node is under a solar eclipse attack according to the first logical distances and the predicted logical distances at the detection time comprises:

   According to the predicted logical distances between the first logical distances and the detection time, determine whether the detection time is an abnormal time;

   If the first node has multiple consecutive abnormal moments, it is determined that the first node is under a solar eclipse attack.
4. The method according to claim 3, wherein determining whether the detection time is an abnormal time according to the predicted logical distances between the first logical distances and the detection time comprises:

   For any one of the first logical distances, determine a first error according to the first logical distance and the predicted logical distance at the detection moment;

   For any historical moment in the N historical moments, each second error is determined based on each second logical distance of the historical moment and the predicted logical distance of the historical moment;

   determining an error threshold according to each of the second errors and the first errors of the N historical moments;

   If the first error is greater than the error threshold, it is determined that the detection time is an abnormal time.
5. The method of claim 4, wherein determining an error threshold according to each of the second errors and the first errors of the N historical moments, comprising:

   Obtain a first vector according to each second error and the first error of the N historical moments;

   determining a second vector according to the first vector and an exponential moving weighted average algorithm;

   The error threshold is obtained from the second vector.
6. The method of claim 5, wherein obtaining the error threshold according to formula (1), comprising:

   

   Among them, ε is the error threshold; μ(es ) is the average value of the second vector; _σ ( _es ) is the standard deviation of the second vector; Δμ( _es ) is the abnormality in the second vector _Δσ (es ) is the standard deviation of the outliers in the second vector; |e _a | is the modulus of the set of outliers in the second vector; |E _seq | ² is the In the two vectors, the square of the modulus of the set of consecutive outliers; the outliers are the values in the second vector whose historical moments are abnormal moments.
7. The method according to claim 2, wherein the neural network model is obtained by training according to the logical distance between each neighbor node and the first node reported at M historical moments.
8. A device for detecting an eclipse attack on a blockchain, characterized in that it includes:

   A calculation module, configured to determine each output node of the first node at the detection time based on each neighbor node reported by each second node at the detection time; each second node is the distributed routing table of the first node The nodes in the node; the neighbor nodes are nodes in the distributed routing table of the second node;

   determining the first logical distances between each output node at the detection moment and the first node respectively;

   a processing module, configured to, for at least one historical moment before the detection moment, determine each second logical distance between each output node of the historical moment and the first node respectively;

   According to each of the first logical distances and each of the second logical distances of at least one historical moment, it is determined whether the first node is under a solar eclipse attack.
9. A computing device, comprising:

   memory for storing program instructions;

   The processor is configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 7 according to the obtained program.
10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause a computer to execute the method of any one of claims 1 to 7 .

Images