CN-122001612-A - Abnormality identification method, abnormality identification device, apparatus, medium, and program product

CN122001612ACN 122001612 ACN122001612 ACN 122001612ACN-122001612-A

Abstract

The application is applicable to the technical field of blockchain safety detection and provides an abnormality identification method, an abnormality identification device, equipment, a medium and a program product, wherein the method comprises the steps of acquiring a plurality of transactions in a plurality of blocks generated by a first block outlet node in a first time period in a target blockchain, wherein each block comprises at least one transaction; according to the difference between each transaction in the ith candidate transaction set and each transaction in the jth candidate transaction set, identifying the transaction meeting the abnormality judgment condition, wherein the abnormality judgment condition is used for representing the difference between the transactions under sandwich attack, and outputting abnormality warning information under the condition that the transaction meeting the abnormality judgment condition exists. The scheme can accurately and efficiently identify the cross-block sandwich attack.

Inventors

Xie Difan
Zhu Hanggang
WANG XIAOKE
DENG JING
YU BOMING

Assignees

杭州高新区(滨江)区块链与数据安全研究院

Dates

Publication Date: 20260508
Application Date: 20251212

Claims (10)

1. An anomaly identification method, comprising: In a target blockchain, acquiring a plurality of transactions in a plurality of blocks generated by a first block-out node in a first time period, wherein each block comprises at least one transaction, and the transaction corresponds to an object identifier corresponding to a candidate object; According to object identifiers corresponding to the plurality of transactions respectively, candidate transaction sets corresponding to target objects under the plurality of blocks are obtained, the target objects are objects with transactions in at least two blocks, the candidate transaction sets corresponding to the target objects comprise an ith candidate transaction set and a jth candidate transaction set, and i and j are positive integers; Identifying transactions meeting an anomaly determination condition according to the difference between each transaction in the ith candidate transaction set and each transaction in the jth candidate transaction set, wherein the anomaly determination condition is used for representing the difference between the transactions under sandwich attack; And outputting abnormal alarm information when the transaction meeting the abnormal judgment condition exists, wherein the abnormal alarm information is used for indicating that a cross-block sandwich attack event exists in the blocks.
2. The method of claim 1, wherein the plurality of blocks includes at least one transaction corresponding to a plurality of objects, and the obtaining, according to the object identifiers corresponding to the plurality of transactions, the candidate transaction sets corresponding to the target objects under the plurality of blocks, respectively, includes: in the transactions, dividing the transactions with the same corresponding object identifiers into a group to obtain transaction groups respectively corresponding to the objects; in each transaction group, dividing the transactions with the same affiliated block into a group to obtain at least one transaction set in each transaction group; And determining an object corresponding to a transaction group comprising a plurality of transaction sets as the target object, wherein the transaction set in the transaction group corresponding to the target object is used as the candidate transaction set.
3. The method according to claim 1 or 2, wherein the ith candidate transaction set includes a kth transaction, the jth candidate transaction set includes a qth transaction, the order of execution of the transactions in the ith candidate transaction set is earlier than the order of execution of the transactions in the jth candidate transaction set, and k and q are positive integers; The identifying a transaction meeting an anomaly determination condition according to a difference between each transaction in the ith candidate transaction set and each transaction in the jth candidate transaction set, respectively, includes: Acquiring a first transaction sequence under the condition that the total number of the transactions of the plurality of candidate transaction sets corresponding to the target object is smaller than or equal to a first threshold value, wherein the execution sequence of the transactions in the first transaction sequence is later than the execution sequence of the kth transaction and earlier than the execution sequence of the qth transaction; Acquiring transaction directions among a transaction, a kth transaction and the qth transaction in the first transaction sequence and transaction exchange difference values between the kth transaction and the qth transaction; And under the condition that the transaction direction and the transaction exchange difference value meet the abnormal judgment condition, determining the kth transaction and the q transaction as abnormal transactions.
4. The method of claim 3, wherein the ith candidate transaction set corresponds to an ith chunk, the jth candidate transaction set corresponds to a jth chunk, the transaction including a token identification, the method further comprising: Dividing the transactions with the same token identifications in the candidate transaction sets into a group to obtain at least one token group corresponding to the target object when the total number of the transactions in the candidate transaction sets is larger than the first threshold, wherein the token group comprises at least one transaction and the set identifications of the candidate transaction sets corresponding to the transaction; Under the condition that the target object corresponds to a plurality of token groups, determining a target token group from the plurality of token groups according to the number of the set identifiers of each token group, wherein the target token group comprises at least two set identifiers, the at least two set identifiers comprise an nth set identifier and an mth set identifier, and n and m are positive integers; And identifying the transaction meeting the abnormality judgment condition according to the difference between each transaction corresponding to the nth set identifier and each transaction corresponding to the mth set identifier.
5. The method of claim 4, wherein the method further comprises: Limiting transactions of the target object in the target blockchain in the presence of transactions that satisfy the anomaly determination condition.
6. The method of claim 1 or 2, wherein the anomaly determination condition includes transaction directions of two transactions being opposite, a transaction redemption difference value between the two transactions being greater than or equal to a second threshold, and there being a transaction in the same direction as the transaction of the two transactions in a transaction located between execution sequences of the two transactions.
7. An abnormality recognition device, characterized by comprising: The system comprises an acquisition module, a first block-out node and a second block-out node, wherein the acquisition module is used for acquiring a plurality of transactions in a plurality of blocks generated in a first time period by the first block-out node in a target block chain, each block comprises at least one transaction, and the transaction corresponds to an object identifier corresponding to a candidate object; the acquisition module is further used for acquiring candidate transaction sets respectively corresponding to target objects under the plurality of blocks according to object identifiers respectively corresponding to the plurality of transactions, wherein the target objects are objects with transactions in at least two blocks, the candidate transaction set corresponding to the target objects comprises an ith candidate transaction set and a jth candidate transaction set, and i and j are positive integers; The identification module is used for identifying the transaction meeting the abnormal judgment condition according to the difference between each transaction in the ith candidate transaction set and each transaction in the jth candidate transaction set, wherein the abnormal judgment condition is used for representing the difference between the transactions under sandwich attack; The identification module is further configured to output, when there is a transaction satisfying the abnormality determination condition, abnormality alert information, where the abnormality alert information is used to indicate that a cross-block sandwich attack event exists in the plurality of blocks.
8. An electronic device comprising a processor, a memory and a computer program stored in the memory and executable on the processor, wherein execution of the computer program by the processor causes the electronic device to implement the method of any one of claims 1-6.
9. A computer readable storage medium storing a computer program, characterized in that the computer program when executed by a processor implements the method according to any one of claims 1 to 6.
10. A computer program product comprising a computer program which, when run, causes the method of any one of claims 1-6 to be performed.

Description

Abnormality identification method, abnormality identification device, apparatus, medium, and program product Technical Field The present application relates to the field of blockchain security detection technology, and in particular, to an anomaly identification method, an anomaly identification device, an electronic device, a computer readable storage medium, and a computer program product. Background In the blockchain ecology with a centralized exchange (Decentralized Exchange, DEX) as a core, the Solana blockchain is an increasingly multi-user transaction option with the advantages of high throughput and higher blockiness. However, solana blockchain high-speed nature makes the treasury attacks, especially sandwich attacks, more prominent. At present, the recognition scheme for sandwich attack often carries out transaction analysis in a single block, and cannot effectively recognize complex attack modes crossing a plurality of blocks. Meanwhile, the high throughput and extremely short block-out time of Solana block chains enable the attack identification calculation amount to be huge, and high requirements are put on instantaneity and algorithm efficiency. Therefore, how to accurately and efficiently identify the cross-block sandwich attack in Solana blockchain has become a technical problem to be solved. Disclosure of Invention The embodiment of the application provides an anomaly identification method, an anomaly identification device, electronic equipment, a computer readable storage medium and a computer program product, which can solve the problem of how to accurately and efficiently identify a cross-block sandwich attack in Solana block chains. In a first aspect, an embodiment of the present application provides an anomaly identification method, including: In a target block chain, acquiring a plurality of transactions in a plurality of blocks generated by a first block outlet node in a first time period, wherein each block comprises at least one transaction, and the transaction corresponds to an object identifier corresponding to a candidate object; According to object identifiers corresponding to a plurality of transactions respectively, candidate transaction sets corresponding to target objects under a plurality of blocks are obtained, the target objects are objects with transactions in at least two blocks, the candidate transaction sets corresponding to the target objects comprise an ith candidate transaction set and a jth candidate transaction set, and i and j are positive integers; identifying transactions meeting an anomaly determination condition according to the difference between each transaction in the ith candidate transaction set and each transaction in the jth candidate transaction set, wherein the anomaly determination condition is used for representing the difference between the transactions under sandwich attack; and outputting abnormal alarm information when the transaction meeting the abnormal judgment condition exists, wherein the abnormal alarm information is used for indicating that a cross-block sandwich attack event exists in the blocks. In some embodiments, the plurality of blocks includes at least one transaction respectively corresponding to the plurality of objects, and obtaining, according to object identifiers respectively corresponding to the plurality of transactions, candidate transaction sets respectively corresponding to the target object under the plurality of blocks includes: In the plurality of transactions, dividing the transactions with the same corresponding object identifiers into a group to obtain transaction groups respectively corresponding to the plurality of objects; In each transaction group, dividing the transactions with the same affiliated block into a group to obtain at least one transaction set in each transaction group; And determining the objects corresponding to the transaction groups comprising a plurality of transaction sets as target objects, wherein the transaction sets in the target object corresponding to the transaction groups are used as candidate transaction sets. In some embodiments, the ith candidate transaction set includes a kth transaction, the jth candidate transaction set includes a qth transaction, the order of execution of the transactions in the ith candidate transaction set is earlier than the order of execution of the transactions in the jth candidate transaction set, and k and q are positive integers; Identifying a transaction that satisfies the anomaly determination condition based on a difference between each transaction in the ith candidate transaction set and each transaction in the jth candidate transaction set, respectively, comprising: Under the condition that the total number of the transactions of the plurality of candidate transaction sets corresponding to the target object is smaller than or equal to a first threshold value, a first transaction sequence is obtained, and the execution sequence of the transactions