CN-122027355-A - Intelligent contract abnormal call mode detection method based on dynamic threshold

CN122027355ACN 122027355 ACN122027355 ACN 122027355ACN-122027355-A

Abstract

The invention provides an intelligent contract abnormal call mode detection method based on a dynamic threshold, which comprises the steps of monitoring and capturing call requests pointing to a target intelligent contract in real time, extracting multidimensional behavior features of the call requests, maintaining the dynamic threshold for each multidimensional behavior feature respectively, adopting a preset dynamic threshold algorithm to periodically calculate and update the dynamic threshold based on historical data corresponding to each feature in a recent time window, judging whether each multidimensional behavior feature of the call requests exceeds the dynamic threshold range at corresponding time, judging that the call is abnormal if the call exceeds the dynamic threshold range, triggering an early warning mechanism and executing preset response measures when the abnormal call is detected, and solving the problems of poor adaptability of a fixed threshold and high cost of a machine learning model by dynamically adjusting an abnormal judgment standard and fusing multidimensional feature analysis.

Inventors

CHEN WEI
ZHAO XUEJUN
LU KEMING
Wei Chengmiao
ZHANG YIWEN
WANG FANGYUAN
FU JINXING
LUO TONG
LIU WENBIN

Assignees

上海市刑事科学技术研究院
恒安嘉新（北京）科技股份公司

Dates

Publication Date: 20260512
Application Date: 20260410

Claims (10)

1. The intelligent contract abnormal call mode detection method based on the dynamic threshold is characterized by comprising the following steps of: step one, monitoring and capturing a call request pointing to a target intelligent contract in real time, and extracting multidimensional behavior characteristics of the call request; step two, respectively maintaining a dynamic threshold value for each multidimensional behavior feature, and periodically calculating and updating the dynamic threshold value by adopting a preset dynamic threshold algorithm based on the corresponding historical data of each feature in a recent time window; judging whether each multidimensional behavior feature of the call request exceeds a dynamic threshold range at a corresponding moment, and judging that the call request is abnormal if the multidimensional behavior feature exceeds the dynamic threshold range at a corresponding moment; And step four, triggering an early warning mechanism and executing a preset response measure when abnormal call is detected.
2. The method for detecting abnormal call patterns of intelligent contracts based on dynamic threshold according to claim 1, wherein the multidimensional behavior feature in the step one includes at least one of a call frequency feature, a resource consumption feature, a call sequence feature, and a numerical feature; the calling frequency characteristic comprises the calling times of a specific function in a unit time window; The resource consumption feature includes the amount of Gas consumed by the invocation request; The calling sequence features comprise a sequence mode of specific function calling; The numerical characteristic includes at least one of a transaction amount and a transfer address number involved in the call request.
3. The intelligent contract anomaly call pattern detection method based on dynamic thresholds of claim 1, wherein the preset dynamic threshold algorithm comprises at least one of a dynamic threshold algorithm based on weighted quantiles and a dynamic threshold algorithm based on multi-scale prediction.
4. The intelligent contract exception call pattern detection method based on dynamic thresholds of claim 3, wherein the weighted quantile based dynamic threshold algorithm comprises: Giving time attenuation weight to the characteristic values of each moment in the historical time window; calculating weighted quantiles ; Introducing an inter-feature correlation adjustment factor; The dynamic threshold value obtained is : ; In the formula, For the preset value of the index, For weighting calculated based on time decay weights Dividing the number of bits; Is characterized by Features related to the dynamic threshold currently to be calculated History correlation coefficient of (a); Is characterized by The rate of change over the recent time window, , Is characterized by At the characteristic value of the current time window, Is characterized by Average values over a historical time window; Taking the maximum duration of a historical time window if the history has no abnormal record for the time difference between the current time and the latest abnormal time; In order to adjust the intensity coefficient of the light, Is a smoothing parameter.
5. The method for detecting abnormal call patterns of intelligent contracts based on dynamic threshold according to claim 4, wherein the weighted score is a number of bits The calculation formula of (2) is as follows: ; In the formula, Is the first The time decay weights of the individual historical data, Representing the current time of day, Is the first Recording time of each history data; As a time decay constant, self-adaptively adjusting according to the business fluctuation frequency of the intelligent contract; as candidate feature values, any one of the history feature values is represented, Representing less than or equal to the candidate value Is the sum of the weights of all the historical data, Representing the sum of the weights of all the historical data.
6. The method for detecting abnormal call patterns of intelligent contracts based on dynamic threshold according to claim 3, wherein the dynamic threshold algorithm based on multi-scale prediction in the second step comprises: Respectively carrying out predictive modeling on the short-term, medium-term and long-term historical sequences to obtain a short-term predictive model, a medium-term predictive model and a long-term predictive model; fusing the characteristic predicted values of the multi-scale predicted model to obtain a multi-scale predicted fused value ; Adjusting sensitivity based on the prediction consistency; The dynamic threshold value obtained is : ; In the multi-scale predictive fusion value , 、、 The characteristic prediction values output by the short-term, medium-term and long-term prediction models are respectively, 、、 Fusion weights of short-term, medium-term and long-term predicted values respectively, and + + =1; As the standard deviation of the historical prediction residual, As the mean value of the historical prediction residuals, Representing variances of characteristic prediction values output by short-term, medium-term and long-term prediction models; as a reference confidence coefficient, Is a very small zero-preventing parameter; the short-term prediction model, the medium-term prediction model and the long-term prediction model all adopt LSTM time sequence prediction models.
7. The method for detecting abnormal call patterns of intelligent contracts based on dynamic threshold according to claim 6, wherein the multi-scale prediction fuses weights 、、 Is determined by the following means: ; In the formula, For the average absolute percentage error of the corresponding scale prediction model over the recent validation set, , First, the The true value of the sample is verified and, For corresponding scale model pair The predicted value of the individual samples is calculated, To verify the number of samples.
8. The method for detecting abnormal call patterns of intelligent contracts based on dynamic threshold according to claim 1, wherein the length of the time window in the second step is based on the call frequency fluctuation coefficient of intelligent contracts Dynamic adjustment of the fluctuation coefficient The method comprises the following steps: ; Wherein, the Is the standard deviation of the historical feature values within the current time window, The average value of the historical characteristic values in the current time window is obtained; The adjusting logic is that when When >0.8, the time window length is shortened to 70% of the current length, when 0.3 When the time window length is kept unchanged, when At <0.3, the time window length is extended to 130% of the current length.
9. The method for detecting abnormal call patterns of intelligent contracts based on dynamic threshold according to claim 1, wherein the determining logic of abnormal call in the step three comprises: When at least two behavior features of different dimensions exceed corresponding dynamic thresholds simultaneously, and the proportion of a single feature exceeding the threshold When the call is judged to be abnormal; The ratio exceeding the threshold The calculation formula of (2) is as follows: ; Wherein, the As the value of the current characteristic is, Is a dynamic threshold.
10. The method for detecting abnormal call mode of intelligent contract based on dynamic threshold according to claim 1, wherein the early warning mechanism in the fourth step comprises sending alarm information to a contract administrator, the alarm information comprises at least one of abnormal feature name, abnormal feature current value, corresponding dynamic threshold, abnormal occurrence time, abnormal call source address and feature excess ratio, and the sending mode of the alarm information comprises at least one of short message, mail and intra-block-chain message.

Description

Intelligent contract abnormal call mode detection method based on dynamic threshold Technical Field The invention relates to the technical field of blockchains, in particular to an intelligent contract abnormal call mode detection method based on a dynamic threshold. Background The block chain technology rapidly develops in the global scope by virtue of the characteristics of decentralization and non-falsification, and intelligent contracts are taken as core components of the block chain technology, so that the automatic execution without the intervention of a third party is realized, and the innovation of scenes such as financial transactions, asset confirmation, supply chain tracing and the like is promoted; The existing intelligent contract anomaly detection method mainly goes through three development stages, wherein the first stage is a static analysis method, leakage holes are arranged before contract deployment through formal verification, code audit and other means, and the method is a main stream detection mode, but only can cover known vulnerability types, cannot cope with unknown anomalies generated by complex interaction after deployment, has path explosion problems, and has limited detection depth; the second stage is a dynamic monitoring method based on a fixed threshold, and a static threshold is set for indexes such as calling frequency, gas consumption and the like to realize real-time monitoring, but the normal behavior of an intelligent contract is influenced by factors such as service period, network congestion and the like to dynamically change, the fixed threshold is easy to generate a large number of false positives in a peak period, and is difficult to perceive low-frequency slow attack, and the false negatives rate is higher; At present, the real-time, self-adaptability and accuracy requirements of the industry on intelligent contract anomaly detection are continuously improved, the problems of high false alarm rate, poor adaptability, high deployment cost and the like of the existing method become key bottlenecks for restricting the safe development of the blockchain application, and therefore, an intelligent contract anomaly call mode detection method based on a dynamic threshold is needed in the field so as to solve the problems. Disclosure of Invention The invention provides an intelligent contract abnormal call mode detection method based on a dynamic threshold, which aims to solve the problems of poor adaptability of a fixed threshold and high cost of a machine learning model by dynamically adjusting an abnormal judgment standard and fusing multidimensional feature analysis, realize accurate and real-time detection of contract abnormal call and reduce safety risk and operation and maintenance cost. The invention provides an intelligent contract abnormal call mode detection method based on a dynamic threshold value, which comprises the following steps: step one, monitoring and capturing a call request pointing to a target intelligent contract in real time, and extracting multidimensional behavior characteristics of the call request; step two, respectively maintaining a dynamic threshold value for each multidimensional behavior feature, and periodically calculating and updating the dynamic threshold value by adopting a preset dynamic threshold algorithm based on the corresponding historical data of each feature in a recent time window; judging whether each multidimensional behavior feature of the call request exceeds a dynamic threshold range at a corresponding moment, and judging that the call request is abnormal if the multidimensional behavior feature exceeds the dynamic threshold range at a corresponding moment; And step four, triggering an early warning mechanism and executing a preset response measure when abnormal call is detected. Compared with the prior art, the application has the beneficial effects that: 1. According to the invention, through dynamic threshold self-adaption contract normal behavior fluctuation and combination of multidimensional feature joint judgment, the problems of false alarm and false alarm missing caused by fixed threshold are effectively reduced. 2. The invention can respond to the change of the contract business mode rapidly based on the periodical updating threshold of the recent historical data, does not need to manually and frequently adjust rules, adapts to the behavior fluctuation of different scenes such as peak period, low peak period and the like, greatly reduces the operation and maintenance cost and meets the real-time detection requirement of the block chain. 3. The invention uses statistical calculation as a core, avoids high training and calculation expenditure of a complex machine learning model, has small resource consumption, can be flexibly deployed in block chain nodes or peripheral monitoring service, and is suitable for intelligent contract application of different scales. 4. The detection result is based on the clear assoc