CN116308372A - Detection method and device for blockchain transaction - Google Patents

Abstract

The embodiment of this specification provides a detection method and device for blockchain transactions. The method includes: first obtaining the transaction data of the target transaction on the blockchain, and the business logic of the target exchange calling the target smart contract includes: transferring the first quantity of target digital resources from the contract account to the target account, and, Transfer the second quantity of target digital resources from the target account and return them to the contract account; then analyze a number of transfer events from the transaction data, where each transfer event includes the transfer-in party, transfer-out party, digital resource type, and The number of transfers of this type of digital resources; then, according to several transfer events, determine the resource change amount of the target account for various digital resources, and obtain the resource value of various digital resources when the target transaction is completed; and then based on resource changes Quantity and resource value, determine the amount of value change generated by the target transaction for the target account, and use it to determine the risk of the target transaction.

Description

Detection method and device for blockchain transactions

technical field

The embodiments of this specification belong to the technical field of blockchain, and in particular relate to a detection method and device for blockchain transactions.

Background technique

Blockchain is a new application model of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. In the blockchain system, the data blocks are combined into a chained data structure in a sequentially connected manner in chronological order, and a non-tamperable and unforgeable distributed ledger is cryptographically guaranteed. Due to the characteristics of decentralization, non-tamperable information, and autonomy, the blockchain has also received more and more attention and application.

Contents of the invention

The purpose of the present invention is to provide a detection method and device for blockchain transactions, so as to efficiently identify risky transactions in blockchain transactions and provide early warnings to relevant parties.

The first aspect of this specification provides a detection method for blockchain transactions. The method includes: obtaining the transaction data of the target transaction on the blockchain, and calling the target smart contract by the target transaction; the business logic of the target smart contract includes: transferring the first quantity of target digital resources from the contract account to the target account, and, The second quantity of target digital resources transferred from the target account is returned to the contract account. A number of transfer events are parsed from the transaction data, where each transfer event includes the transfer-in party, the transfer-out party, the type of digital resource, and the amount transferred for this type of digital resource. According to the above-mentioned several transfer events, determine the amount of resource change of the target account for various digital resources. Obtain the resource value of various digital resources when the execution of the target transaction is completed. Based on the amount of change in resources and the value of resources, determine the amount of change in value generated by the target transaction as the target account, and use it to determine the risk of the target transaction.

The second aspect of this specification provides a detection device for blockchain transactions. The device includes: a transaction data acquisition module configured to acquire transaction data of a target transaction on the block chain, and the target transaction calls the target smart contract; the business logic of the target smart contract includes: transferring the first amount of target digital from the contract account The resources are distributed to the target account, and the second quantity of target digital resources transferred from the target account is returned to the contract account. The transfer event determination module is configured to parse out several transfer events from the transaction data, where each transfer event includes the transfer-in party, transfer-out party, type of digital resource, and the amount of money transferred for this type of digital resource. The resource change determination module is configured to determine the resource change amount of the target account for various digital resources according to the above-mentioned several transfer events. The resource value determination module is configured to obtain the resource value of various digital resources when the execution of the target transaction is completed. The value change determination module is configured to determine the value change amount generated by the target transaction for the target account based on the resource change amount and the resource value, and is used to determine the risk of the target transaction.

A third aspect of the present specification provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in a computer, the computer is instructed to execute the method described in the first aspect.

A fourth aspect of the specification provides a computing device, including a memory and a processor, where executable codes are stored in the memory, and when the processor executes the executable codes, the method described in the first aspect is implemented.

In the solution provided by the embodiment of this specification, the detection method and device for blockchain transactions disclosed in the embodiment of this specification can be used to count the changes in the number of various digital resources of the attacker's address before and after the transaction. The real-time resource value determined by digital resources, real-time and automatic detection of the transaction that calls the target smart contract on the blockchain, and evaluates whether the transaction has arbitrage risk. Thus, timely early warning of arbitrage transactions can be realized to prevent recurrence of similar attacks.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following will briefly introduce the drawings that need to be used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments recorded in this specification. , for those skilled in the art, other drawings can also be obtained according to these drawings without paying creative labor.

Fig. 1 is a blockchain architecture diagram in an embodiment;

FIG. 2 is a schematic flow diagram of a detection method for blockchain transactions in an embodiment of this specification;

FIG. 3 is a schematic structural diagram of a detection device for blockchain transactions in an embodiment of this specification.

Detailed ways

In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described The embodiments are only some of the embodiments in this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the protection scope of this specification.

In the following, combined with Figure 1, a basic introduction will be given to the blockchain architecture, transactions and smart contracts involved in blockchain technology.

Fig. 1 shows a block chain architecture diagram in an embodiment. In the blockchain architecture diagram shown in FIG. 1 , the blockchain 100 includes N nodes, and FIG. 1 schematically shows nodes 1 - 8 . The connection between the nodes schematically represents a P2P (Peer to Peer, point-to-point) connection, and the connection may be, for example, a TCP connection, etc., and is used to transmit data between the nodes. These nodes can store a full amount of books, that is, store the status of all blocks and all accounts. Wherein, each node in the blockchain can generate the same state in the blockchain by executing the same transaction, and each node in the blockchain can store the same state database.

A transaction in the blockchain field may refer to a unit of tasks performed and recorded in the blockchain. A transaction usually includes a sending field (From), a receiving field (To) and a data field (Data). Among them, when the transaction is a transfer transaction, the From field indicates the account address that initiated the transaction (that is, initiates a transfer task to another account), the To field indicates the account address that received the transaction (that is, received the transfer), and the Data field Include the transfer amount.

The function of smart contracts can be provided in the blockchain. Smart contracts on the blockchain are contracts that can be triggered by transactions on the blockchain system. Smart contracts can be defined in the form of code. Invoking a smart contract in the blockchain is to initiate a transaction pointing to the address of the smart contract, so that each node in the blockchain runs the smart contract code in a distributed manner.

In the scenario of deploying a contract, for example, Bob sends a transaction containing information about creating a smart contract (that is, deploying a contract) to the blockchain shown in Figure 1, and the data field of the transaction includes the code of the contract to be created ( Such as bytecode or machine code), the to field of the transaction is empty to indicate that the transaction is used to deploy the contract. After the nodes reach an agreement through the consensus mechanism, the contract address "0x6f8ae93..." is determined, each node adds the contract account corresponding to the contract address of the smart contract in the state database, allocates the state storage corresponding to the contract account, and stores Contract code, save the hash value of the contract code in the state storage of the contract, so that the contract is created successfully.

In the scenario of calling the contract, for example, Bob sends a transaction for calling the smart contract to the blockchain shown in Figure 1, the from field of the transaction is the address of the account of the transaction initiator (ie Bob), The to field is the above "0x6f8ae93...", which is the address of the called smart contract, and the data field of the transaction includes the method and parameters of calling the smart contract. After consensus is reached on the transaction in the blockchain, each node in the blockchain can respectively execute the transaction, thereby respectively executing the contract, and updating the state database based on the execution of the contract.

One of the decentralized features of blockchain technology that distinguishes it from traditional technologies is that bookkeeping is performed on each node, or called distributed bookkeeping, rather than traditional centralized bookkeeping. In order for the blockchain system to become a decentralized, honest and credible system that is difficult to break, open, and cannot be tampered with data records, it is necessary to make distributed data records safe, clear, and irreversible in the shortest possible time. In different types of blockchain networks, in order to maintain the consistency of the ledger in each node that records the ledger, a consensus algorithm is usually used to ensure it, that is, the aforementioned consensus mechanism. For example, a block-granularity consensus mechanism can be implemented between blockchain nodes. For example, after a node (such as a unique node) generates a block, if the generated block is recognized by other nodes, other nodes record the same block. For another example, a consensus mechanism of transaction granularity can be implemented between blockchain nodes. For example, after a node (such as a unique node) obtains a blockchain transaction, if the blockchain transaction is recognized by other nodes, Each node that approves the blockchain transaction can add the blockchain transaction to the latest block maintained by itself, and finally can ensure that each node generates the same latest block. The consensus mechanism is a mechanism for blockchain nodes to reach a consensus on block information (or block data) in the entire network, which can ensure that the latest block is accurately added to the blockchain. The current mainstream consensus mechanisms include: Proof of Work (POW), Proof of Stake (POS), Delegated Proof of Stake (DPOS), Practical Byzantine Fault Tolerance (PBFT) algorithm etc. Among them, in various consensus algorithms, usually after a preset number of nodes reach an agreement on the data to be consensused (that is, the consensus proposal), it is determined that the consensus on the consensus proposal is successful. Specifically, in the PBFT algorithm, for N≥3f+1 consensus nodes, f malicious nodes can be tolerated, that is, when 2f+1 nodes among the N consensus nodes reach a consensus, the consensus can be determined to be successful.

The above mainly introduces some basic concepts in blockchain technology.

As mentioned earlier, blockchain has received more and more attention and application. For example, the issuance, transfer, lending and other services of digital resources (such as electronic bills, etc.) can be carried out in the blockchain. In a lending business scenario, the service provider provides users with digital resource lending services by deploying smart contracts in the blockchain; The lending and returning of digital resources is completed within the transaction. Some attackers will use a large amount of digital resources lent from lending services to buy and sell different digital resources in a short period of time to manipulate the exchange rates of different digital resources, thereby arbitrating high profits. When the attacker finds that his attack is successful, he usually conducts a similar attack again. At present, for such risky transactions for the purpose of arbitrage, it mainly relies on manual analysis for detection, resulting in heavy workload, high cost, and poor real-time performance.

Based on the above observation and analysis, the embodiment of this specification discloses a detection scheme for blockchain transactions, which can automatically and efficiently detect risky transactions for the purpose of arbitrage.

Fig. 2 is a schematic flow diagram of a detection method for blockchain transactions in the embodiment of this specification, and the subject of execution of the method may be any device, platform, server or device cluster with computing and processing capabilities. Exemplarily, the functional code for implementing the method can be deployed in other devices than the blockchain, or can also be deployed in the blockchain nodes, for example, can be deployed on the full nodes of the blockchain.

As shown in Figure 2, the method includes the following steps:

Step S210, acquiring the transaction data of the target transaction on the block chain, and the target transaction invokes the target smart contract. The business logic of the target smart contract includes: transferring the first quantity of target digital resources from the contract account of the target smart contract to the target account, and transferring the second quantity of target digital resources from the target account to return to the contract account.

It can be understood that the above-mentioned service party can provide lending services by deploying the above-mentioned target smart contract in the blockchain. The target digital resource refers to a type of digital resource targeted by the target smart contract, which is different from other types of digital resources circulating on the blockchain. The above target account is a blockchain account, which can be an external account or a contract account.

The incoming parameters of the above-mentioned target smart contract include at least the above-mentioned target account and the first quantity. In one embodiment, the above-mentioned second amount can be automatically calculated by the target smart contract based on the first amount and according to a preset calculation method of principal and interest (principal + interest). Usually, the second amount is greater than the first amount. In another embodiment, the incoming parameters of the target smart contract also include the above-mentioned second quantity. At this time, the business logic of the target smart contract may also include: after judging that the ratio of the second quantity to the first quantity is greater than the preset ratio In the case of the threshold value, the first quantity of target digital resources is issued to the target account.

In one embodiment, the above-mentioned target transaction also calls several smart contracts other than the target smart contract, for example, calls a smart contract for providing exchange and trading services between different kinds of digital resources. It should be understood that a number herein refers to one or more.

In a specific embodiment, several smart contracts include a first smart contract for two types of digital resources, and the business logic of the first smart contract includes: the first contract account of the first smart contract receives the transfer from the first account A third quantity of the first type of digital resource, and a fourth quantity of the second type of digital resource is transferred from the first contract account to the first account. It can be understood that the first account may be an external account or a smart contract account. In one example, the deployment of the first smart contract is based on the second smart contract, and the tradable relationship between the above two types of digital resources is established in the second smart contract, so that the two types of digital resources form a trading resource pair.

The incoming parameters of the first smart contract may include the first account and the third quantity, and the fourth quantity may be obtained by converting the third quantity by the first smart contract according to the real-time exchange rate between the two types of digital resources. In one example, the first account and the above-mentioned target account are transferred to the same account address. In an example, the above-mentioned first type of digital resource is a target type of digital resource.

The contract calls that may be involved in the target transaction are introduced above.

During the execution of this step, the transaction data of multiple transactions can be obtained from the blockchain network first.

In one embodiment, the multiple transactions include transactions stored in the blockchain, that is, transactions packaged on the blockchain. In another embodiment, the plurality of transactions includes transactions broadcast in the blockchain network collected in real time. It should be understood that for newly mined blocks, any blockchain node will broadcast them in the blockchain network after verifying that they are legal. Based on this, the broadcasted blocks can be monitored in real time to obtain the transactions on the block. Exemplarily, the new transactions in the blockchain can be monitored in real time through the full nodes of the blockchain, so as to identify risky transactions in a timely manner.

In one embodiment, transaction data may include a transaction body for each transaction, and/or a transaction log. In a specific embodiment, the transaction data includes the transaction hash, the block number, the address of the transaction initiator and receiver, the input parameters of the transaction (such as the data field), the execution result of the transaction, and the smart contract called in the transaction As for the internal transaction data of the triggered internal transaction, the internal transaction data includes the addresses of the caller and receiver of the internal transaction, and the input parameters of the internal transaction (such as the data field).

Based on the transaction data of multiple transactions acquired above, target transactions can be selected from the multiple transactions.

In one embodiment, several transactions that call a preset target function can be directly screened out from multiple transactions, and then these several transactions are respectively used as target transactions. The target function is used to implement the business logic of the target smart contract. It needs to be understood that the target smart contract includes multiple functions, from which one or a group of functions that are differentiated and strongly related to lending services can be selected as the above-mentioned preset target function.

Specifically, the transaction data includes the method and parameters of calling the smart contract in the corresponding transaction. Therefore, based on the preset objective function, the transaction data of each transaction in multiple transactions can be matched respectively, so as to obtain several transactions that are successfully matched.

In another embodiment, multiple transactions may be pre-screened first, and then the above-mentioned several transactions may be determined according to the results of the pre-screening, thereby improving the execution efficiency of this step.

In a specific embodiment, the pre-screening may include: filtering out transactions whose transaction log length is lower than a preset length threshold. Exemplarily, the length of the transaction log can be measured by the number of characters or the occupied storage space.

In another specific embodiment, the pre-screening may include: filtering out transactions involving transfer events whose number is less than a preset number threshold. For the determination of the number of transfer events, in an example, the transaction data includes a transaction log, which records the parsed events, and specifically records event parameters such as event types. At this time, the transaction can be determined for each transaction The number of transfer events in the log; in another example, the transaction data includes the transaction body. At this time, the virtual machine (Virtual Machine, VM for short) deployed on the blockchain node can be used to execute the transaction body of each transaction , so as to determine the number of transfer events involved in each transaction.

In yet another specific embodiment, the pre-screening may include: filtering out transactions whose input parameters are empty.

Through the above-mentioned pre-screening operation, transactions that are unlikely to call the target smart contract can be excluded from multiple transactions. Further, based on the retained transactions, the above-mentioned several transactions that invoke the above-mentioned preset target function can be screened out, so that each of the several transactions can be used as the target transaction respectively.

Based on the target transaction obtained above, step S220 can be executed to analyze a number of transfer events from the transaction data of the target transaction, where each transfer event includes the transfer-in party, transfer-out party, digital resource type, and digital resource for this type The amount of transfers that occurred.

In one embodiment, all transfer events can be parsed from the transaction data of the target transaction (hereinafter referred to as the target transaction data) as the above-mentioned several transfer events. In a specific embodiment, the target transaction data includes a transaction log that records blockchain events, so all events whose event type is transfer can be parsed from the transaction log and classified into the above-mentioned several transfer events. In another specific embodiment, the target transaction data includes the transaction body. At this time, the VM deployed on the blockchain node can be used to execute the transaction body, so as to obtain the above-mentioned several transfer events by analyzing the execution result.

It is advisable to organize each transfer event into the form of a quadruple E<Type ID, From, To, T _delta >, where Type ID represents the identification of the type of digital resource, for example, it can be used to manage (such as issue) such digital resources The identifier of the smart contract of the resource, usually the contract address of the smart contract (Contract Address); From means the transferer of the transfer event, or the sender of the transfer; To means the transferer of the transfer event, or the transfer receiver; T _delta represents the transfer amount of digital resources.

Further, in an example, several transfer events analyzed in this step may include:

E1: <Type 1, CA, TA, 10000>

E2: <Type 1, TA, BA, 9000>

E3: <Type 2, BA, TA, 3000>

E4: <Type 2, TA, BA, 2500>

E5: <Type 1, BA, TA, 10000>

E6: <Type 1, TA, CA, 10050>

In the above seven transfer events E1 to E6, CA represents the contract account address of the target smart contract, TA represents the account address of the target account, and BA represents the contract account of the smart contract that provides digital resource exchange services for Type 1 and Type 2 address. Observe events E1 and E6, TA borrows 10,000 copies of type 1 digital resources from CA, and returns 10,050 copies of type 1 digital resources; observe events E2 and E3, TA exchanges 9,000 copies of type 1 digital resources with BA for 3,000 copies of type 2 digital resources; observe events E4 and E5, TA exchanges 2500 type 2 digital resources with BA for 10000 type 1 digital resources.

In another embodiment, all transfer events can be parsed from the target transaction data first, and then the transfer events in which the transfer-in or transfer-out party is the above-mentioned target account can be classified into several transfer events.

Based on the above, several transfer events involved in the target transaction can be determined. Then, step S230 may be executed to determine the amount of resource change of the target account for various types of digital resources according to the several transfer events.

The above-mentioned several transfer events involve multiple types of digital resources. Through statistical analysis of several transfer events, the amount of resource change of the target account for each type of digital resources among the multiple types of digital resources can be obtained. Exemplarily, statistical analysis is performed on the events E1 to E6 above, and it can be determined that the amount of change of the target account TA for digital resources of type 1 and type 2 is +950 and +500, respectively.

On the other hand, step S240 is executed to obtain resource values of various digital resources when the target transaction is executed. Specifically, the above-mentioned multiple types of digital resources can be converted into predefined equivalents, so as to achieve a unified measurement of value. It should be understood that an equivalent can generally be defined as any kind of measurable item. Exemplarily, the equivalent may be a preset digital resource of a certain type.

In one embodiment, the multiple types of digital resources include a third type of digital resource whose unit value dynamically changes, so that the exchange rate between the third type of digital resource and the fourth type of digital resource with a preset value can be determined first, Then, according to the exchange rate and the preset value, determine the real-time value of the third type of digital resource after executing the target transaction.

For the determination of the above-mentioned exchange rate, in a specific embodiment, after the execution of the target transaction, the resource quantities of the third type of digital resources and the fourth type of digital resources in the corresponding resource pools can be determined first, and then determined based on the amount of resources exchange rate between the two. In a more specific embodiment, according to the target transaction data and the transaction data of other transactions that occurred before the target transaction, the update event of the number of digital resources related to these two types of digital resources can be determined, so as to determine the number of digital resources in the resource pool. number of resources.

In another more specific embodiment, the mapping relationship between multiple well-known service parties and multiple smart contracts used to manage multiple types of digital resources in the blockchain can be established through the query function of the blockchain browser. Therefore, first filter out the transactions that interact with the well-known service provider from the multiple transactions stored in the blockchain, and then analyze the data of the filtered transactions to analyze the event that the number of digital resources is updated, and then determine the first The respective resource quantities of the third type of digital resources and the fourth type of digital resources in the resource pool.

Furthermore, the above-mentioned determined quantities of the two resources may be substituted into the preset exchange rate calculation formulas for the above-mentioned third and fourth types of digital resources to obtain the exchange rate between the two.

Based on the obtained exchange rate, it is possible to first determine the quantity when the unit quantity of the third type of digital resource is converted into the fourth type of digital resource, and then determine the third type of digital resource based on this quantity and the preset value of the fourth type of digital resource resource value.

In another embodiment, the multiple types of digital resources include a fourth type of digital resource with a preset unit value. At this time, the preset unit value can be directly determined as the resource value of the fourth type of digital resource.

Based on the above, the amount of resource change of various digital resources and the resource value of various digital resources after the execution of the target transaction can be determined. Afterwards, step S250 is executed, based on the resource change amount and resource value, the value change amount generated by the target transaction for the target account is determined, which is used to judge the risk of the target transaction.

In one embodiment, for all kinds of resources involved in the target transaction, the product of the corresponding resource change and resource value can be calculated first, and then the sum of the calculated products can be calculated as the value change quantity.

Exemplarily, assuming that digital resources of type 1 and type 2 are involved in the target transaction, the resource change amount and resource value corresponding to type 1 are +950 and 1 respectively, and the resource change amount and resource value corresponding to type 2 are +500 and resource value respectively 2. At this point, the value change can be calculated as 1950.

In another embodiment, considering that some digital resources may already exist in the target account before executing the target transaction, for the sake of brevity, they are referred to as initial digital resources hereinafter. Exemplarily, the initial digital resources can be tracked or tracked The transfer event involved in the target account can be obtained by other means. At this time, when calculating the above-mentioned value change, the value change brought by the execution of the target transaction to the initial digital resource can also be considered. Specifically, the part of the initial digital resource that has the same type as the digital resource involved in the target transaction can be considered.

In a specific embodiment, for each type in the type intersection formed by the above-mentioned same type, its initial value before executing the target transaction is also determined, and then the resource value of the type when the target transaction is executed is completed minus the initial value, so that the obtained difference is multiplied by the quantity of this type in the initial digital resources to obtain the value change component brought by the execution of the target transaction to the digital resources of this type in the initial digital resources. It should be understood that the method for determining the initial value can refer to the method for determining the resource value mentioned above, and details are not repeated here.

Further, by summing the value change components corresponding to each type in the type intersection, the first value change amount generated by executing the target transaction as the initial resource in the target account can be obtained, and then superimposed on this basis to execute the target transaction to bring the target account. The second value change amount generated by the resource change amount from the source can obtain the value change amount (or total value change amount) brought to the target account by executing the target transaction.

In another example, based on the above-mentioned initial digital resources and the above-mentioned resource changes, it is possible to determine the number of various digital resources in the target account before and after executing the target transaction, and then, according to each type of digital resources in the target transaction The value before and after execution determines the amount of value change brought by the execution of the target transaction to the target account.

Based on the above, it is possible to determine the amount of value change brought by the execution of the target transaction to the target account.

According to another embodiment, it is considered that in order to avoid the arbitrage transaction initiated by the attacker from being detected, the attacker transfers the profit in the target account to other accounts. In the above step S230, when determining the amount of change in resources, what is determined may be the amount of change in various types of digital resources jointly by the target account and the initiating account that initiates the target transaction. Exemplarily, in addition to the above-mentioned events E1-E6, the following events E7-E8 are also determined from the transaction data of the target transaction:

E7: <Type 1, TA, FA, 950>

E8: <Type 2, TA, FA, 500>

At this time, if only the resource change of the target account is determined, the determined corresponding type 1 and type 2 will be 0 and 0, but if the resource change of the target account and the initiator account FA is determined, then determine 950 and 500 are still out.

Correspondingly, in step S250, the determined value variation is for both the target account and the initiating account.

According to yet another embodiment, after step S250 is performed, the above method may further include: judging whether the value change is greater than a preset increment threshold, so that if it is judged to be greater than the value, it is judged that the target transaction is a risk transaction, otherwise it is judged for normal transactions. Furthermore, when the target transaction is determined to be a risky transaction, an early warning can be given to the contract creator of the smart contract called in the target transaction to remind it to repair the vulnerability in time to avoid the recurrence of similar attacks. Alternatively, after step S250 is performed, the amount of value change may also be used as a risk score, as a risk reference.

From the above, it is possible to automatically identify risky transactions for arbitrage purposes contained in the blockchain.

In summary, using the detection method for blockchain transactions disclosed in the embodiments of this specification, it is possible to count the changes in the number of various digital resources of the attacker’s address before and after the transaction, combined with the real-time resource value determined for each digital resource, Real-time and automatic detection of the transaction calling the target smart contract on the blockchain, and evaluate whether the transaction has arbitrage risk. Thus, timely early warning of arbitrage transactions can be realized to prevent recurrence of similar attacks.

Corresponding to the above detection method, the embodiment of this specification also discloses a detection device. Fig. 3 is a schematic structural diagram of a detection device for blockchain transactions in the embodiment of this specification. As shown in Fig. 3, the device 300 includes the following components:

The transaction data acquisition module 310 is configured to obtain the transaction data of the target transaction on the block chain, and the target transaction calls the target smart contract; the business logic of the target smart contract includes: transferring the first quantity of target digital resources from the contract account and issuing them to The target account, and the second quantity of target digital resources transferred from the target account and returned to the contract account. The transfer event determination module 320 is configured to parse out several transfer events from the transaction data, where each transfer event includes the transfer-in party, transfer-out party, type of digital resource, and the amount transferred for this type of digital resource. The resource change determination module 330 is configured to determine the resource change amount of the target account for various digital resources according to the above-mentioned several transfer events. The resource value determination module 340 is configured to obtain the resource value of various digital resources when the execution of the target transaction is completed. The value change determination module 350 is configured to determine the value change amount generated by the target transaction for the target account based on the resource change amount and the resource value, for determining the risk of the target transaction.

In one embodiment, the transaction data includes at least one of the following: a transaction body, a transaction log, and the transaction log includes several transfer events.

In one embodiment, the transaction data acquisition module 310 specifically includes: a data acquisition unit 311 configured to acquire transaction data of multiple transactions stored in the block chain; a transaction screening unit 312 configured to, based on the transaction data of multiple transactions, Screen out several transactions that call a preset target function; the target function is used to implement business logic; and each of the multiple transactions is used as a target transaction.

In a specific embodiment, the transaction screening unit 312 is specifically configured to: remove transactions whose number of transfer events involved in the transaction data is less than a preset number threshold from multiple transactions; based on the transaction data of the remaining transactions, from the remaining transactions Filter out a few transactions.

In one embodiment, the target transaction also invokes several other smart contracts, the first smart contract included is used to provide exchange services between different types of digital resources.

In a specific embodiment, the business logic of the first smart contract includes: the first contract account receives the third amount of the first type of digital resources transferred from the first account, and transfers the first type of digital resources from the first contract account to the first account A fourth quantity of digital resources of the second category is transferred.

In one embodiment, the transfer-in or transfer-out party of each transfer event is the target account.

In one embodiment, various types of digital resources involve a third type of digital resource; the resource value determination module 340 includes: an exchange rate determination unit 341 configured to determine the exchange rate between the third type of digital resource and the fourth type of digital resource, the fourth The category digital resource has a preset value; the value determining unit 342 is configured to determine the resource value of the third category digital resource according to the exchange rate and the preset value.

In a specific embodiment, the exchange rate determination unit 341 is specifically configured to: according to the update event of the quantity of digital resources that occurred in the target transaction and before the target transaction, determine the corresponding digital resources of the third type and the fourth type The number of resources in the resource pool, the update event is obtained by parsing the transaction data of multiple transactions stored in the blockchain; substituting the number of resources into the preset exchange rate calculation formula for the third type of digital resources and the fourth type of digital resources, Solve for the exchange rate.

In one embodiment, the resource value determining module 340 is specifically configured to: use the preset value of the fourth type of digital resource as the resource value of the fourth type of digital resource.

In one embodiment, the target transaction involves several types of digital resources, and the target account has initial digital resources before the execution of the target transaction; the value change determination module 350 is specifically configured to: determine the type intersection between the initial digital resource and several types of digital resources; For each type in the type intersection, determine its initial value before the execution of the target transaction; based on the resource quantity, resource change, initial value, and resource value corresponding to each type in the initial data resource, determine the value change.

In one embodiment, the transfer-in party or transfer-out party of each transfer event is one of the target account and the originating account of the target transaction; the resource change determination module 330 is specifically configured to: Resource change amount of resource; value change determining module 350 is specifically configured to: determine the target transaction as the value change amount generated jointly by the target account and the initiating account.

In a specific embodiment, the device 300 further includes: a risk judging module 360 configured to judge whether the value change is greater than a preset increment threshold; if it is judged to be greater than the value, it is judged that the target transaction is a risk transaction.

The embodiment of this specification also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in a computer, the computer is instructed to execute the method shown in FIG. 2 .

The embodiment of this specification also provides a computing device, including a memory and a processor, where executable code is stored in the memory, and when the processor executes the executable code, the method shown in FIG. 2 is implemented.

In the 1990s, the improvement of a technology can be clearly distinguished as an improvement in hardware (for example, improvements in circuit structures such as diodes, transistors, and switches) or improvements in software (improvement in method flow). However, with the development of technology, the improvement of many current method flows can be regarded as the direct improvement of the hardware circuit structure. Designers almost always get the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be realized by hardware physical modules. For example, a Programmable Logic Device (Programmable Logic Device, PLD) (such as a Field Programmable Gate Array (Field Programmable Gate Array, FPGA)) is such an integrated circuit, and its logic function is determined by programming the device by a user. It is programmed by the designer to "integrate" a digital system on a PLD, instead of asking a chip manufacturer to design and make a dedicated integrated circuit chip. Moreover, nowadays, instead of making integrated circuit chips by hand, this kind of programming is mostly realized by "logic compiler (logic compiler)" software, which is similar to the software compiler used when writing programs. The original code of the computer must also be written in a specific programming language, which is called a hardware description language (Hardware Description Language, HDL), and there is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language) , AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., currently the most commonly used is VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. It should also be clear to those skilled in the art that only a little logical programming of the method flow in the above-mentioned hardware description languages and programming into an integrated circuit can easily obtain a hardware circuit for realizing the logic method flow.

The controller may be implemented in any suitable way, for example the controller may take the form of a microprocessor or processor and a computer readable medium storing computer readable program code (such as software or firmware) executable by the (micro)processor , logic gates, switches, Application Specific Integrated Circuit (ASIC), programmable logic controllers, and embedded microcontrollers, examples of controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic. Those skilled in the art also know that, in addition to realizing the controller in a purely computer-readable program code mode, it is entirely possible to make the controller use logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded The same function can be realized in the form of a microcontroller or the like. Therefore, such a controller can be regarded as a hardware component, and the devices included in it for realizing various functions can also be regarded as structures within the hardware component. Or even, means for realizing various functions can be regarded as a structure within both a software module realizing a method and a hardware component.

The systems, devices, modules, or units described in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of future computer technology, the computer that realizes the functions of the above embodiments can be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant , media players, navigation devices, email devices, game consoles, tablet computers, wearable devices, or any combination of these devices.

Although one or more embodiments of the present specification provide the operation steps of the method described in the embodiment or the flowchart, more or fewer operation steps may be included based on conventional or non-inventive means. The sequence of steps enumerated in the embodiments is only one of the execution sequences of many steps, and does not represent the only execution sequence. When an actual device or terminal product is executed, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (such as a parallel processor or multi-thread processing environment, or even a distributed data processing environment). The term "comprising", "comprising" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, product, or apparatus comprising a set of elements includes not only those elements, but also other elements not expressly listed elements, or also elements inherent in such a process, method, product, or apparatus. Without further limitations, it is not excluded that there are additional identical or equivalent elements in a process, method, product or device comprising said elements. For example, if the words first, second, etc. are used, they are used to indicate names and do not indicate any specific order.

For the convenience of description, when describing the above devices, functions are divided into various modules and described separately. Of course, when implementing one or more of the present specification, the functions of each module can be realized in the same or more software and/or hardware, and the modules that realize the same function can also be realized by a combination of multiple submodules or subunits, etc. . The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in computer readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read only memory (ROM) or flash RAM. Memory is an example of computer readable media.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by computing devices. As defined herein, computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.

Those skilled in the art should understand that one or more embodiments of this specification may be provided as a method, system or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of the present description may employ a computer program embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. The form of the product.

One or more embodiments of this specification may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.

In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

Each embodiment in this specification is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment and

In other words, since it is basically similar to the method embodiment, the description is relatively simple, and for relevant parts, please refer to the part of the description of the method embodiment. In the description of this specification, reference is made to the terms "one embodiment", "some embodiments", "example",

The description of "specific examples" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example in this specification. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, no particular feature, structure, material, or characteristic described

Points may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples and features of different embodiments or examples described in this specification without conflicting with each other.

The above description is only an example of one or more embodiments of this specification, and is not intended to limit one or more embodiments of this specification. For those skilled in the art, one or more embodiments of this description may have various modifications and changes.

change. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this specification shall be included in the scope of the claims.

Claims (16)

1. A detection method for blockchain transactions, comprising: Obtain the transaction data of the target transaction on the block chain, the target transaction calls the target smart contract; the business logic of the target smart contract includes: transferring the first amount of target digital resources from the contract account to the target account, and , transferring the second quantity of target digital resources from the target account and returning them to the contract account; Analyzing a number of transfer events from the transaction data, where each transfer event includes the transfer-in party, the transfer-out party, the type of digital resource, and the amount of transfer for this type of digital resource; According to the above-mentioned several transfer events, determine the amount of resource change of the target account for various digital resources; Obtain the resource value of the various digital resources when the target transaction is executed; Based on the resource change amount and resource value, determine the value change amount generated by the target transaction for the target account, and use it to determine the risk of the target transaction. 2. The method according to claim 1, wherein the transaction data includes at least one of the following: a transaction body and a transaction log, and the transaction log includes the several transfer events. 3. The method according to claim 1, wherein obtaining the transaction data of the target transaction on the block chain comprises: Get transaction data for multiple transactions stored in the blockchain; Based on the transaction data of the plurality of transactions, filter out several transactions that call a preset target function; the target function is used to realize the business logic; Each of the plurality of transactions is used as the target transaction. 4. The method according to claim 3, wherein, based on the transaction data of the plurality of transactions, screening out several transactions that call a preset objective function, comprising: removing from the plurality of transactions transactions in which the number of transfer events involved in the transaction data is less than a preset number threshold; Based on the transaction data of the remaining transactions, the plurality of transactions are selected from the remaining transactions. 5. The method according to claim 1, wherein the target transaction also invokes several other smart contracts, wherein the first smart contract included is used to provide exchange services between different types of digital resources. 6. The method according to claim 5, wherein the business logic of the first smart contract includes: the first contract account receives a third amount of the first type of digital resources transferred from the first account, and, from the The above-mentioned first contract account is transferred to the first account with a fourth quantity of the second type of digital resources. 7. The method according to claim 1, wherein the transfer-in or transfer-out party of each transfer event is the target account. 8. The method according to claim 1, wherein the various types of digital resources involve a third type of digital resources; wherein obtaining the resource value of the various types of digital resources when the execution of the target transaction is completed comprises: determining an exchange rate between the third type of digital resource and the fourth type of digital resource, the fourth type of digital resource having a preset value; Determine the resource value of the third type of digital resource according to the exchange rate and the preset value. 9. The method according to claim 8, wherein determining the exchange rate between the third type of digital resource and the fourth type of digital resource comprises: According to the update event of the number of digital resources that occurred in the target transaction and before the target transaction, determine the respective resource quantities of the third type of digital resources and the fourth type of digital resources in the corresponding resource pools, the updating The event is obtained by parsing the transaction data of multiple transactions stored in the blockchain; The exchange rate is obtained by substituting the amount of resources into the preset exchange rate calculation formula for the third type of digital resources and the fourth type of digital resources. 10. The method according to claim 1, wherein the various types of digital resources relate to the fourth type of digital resources; wherein obtaining the resource value of the various types of digital resources when the target transaction is executed comprises: The preset value of the fourth type of digital resource is used as the resource value of the fourth type of digital resource. 11. The method according to claim 1, wherein the target transaction involves several types of digital resources, and the target account has initial digital resources before the execution of the target transaction; wherein, based on the resource variation and resource value , to determine the amount of value change generated by the target transaction for the target account, including: determining a type intersection between the initial digital resource and the types of digital resources; For each type in the type intersection, determine its initial value before the execution of the target transaction; The value change amount is determined based on the resource quantity corresponding to each type in the initial data resource, the resource change amount, the initial value, and the resource value. 12. The method according to claim 1, wherein the transfer-in party or transfer-out party of each transfer event is one of the target account and the originating account of the target transaction; wherein it is determined that the target account is for each The amount of resource changes of similar digital resources, including: Determining the resource change amount of the target account and the initiating account for the various digital resources; Wherein, determining the value variation generated by the target transaction for the target account includes: The target transaction is determined to be a value change jointly generated by the target account and the initiating account. 13. The method according to any one of claims 1-12, wherein, after determining the amount of value change generated by the target transaction for the target account, the method further comprises: Judging whether the value change is greater than a preset increment threshold; If it is judged to be greater than , it is judged that the target transaction is a risk transaction. 14. A detection device for blockchain transactions, comprising: The transaction data acquisition module is configured to obtain the transaction data of the target transaction on the block chain, and the target transaction calls the target smart contract; the business logic of the target smart contract includes: transferring the first number of target class numbers from the contract account The resources are distributed to the target account, and the second quantity of target digital resources transferred from the target account is returned to the contract account; A transfer event determination module configured to parse out a number of transfer events from the transaction data, where each transfer event includes the transfer-in party, the transfer-out party, the type of digital resource, and the amount transferred for this type of digital resource; The resource change determination module is configured to determine the resource change amount of the target account for various digital resources according to the above-mentioned several transfer events; The resource value determination module is configured to obtain the resource value of the various digital resources when the execution of the target transaction is completed; The value change determining module is configured to determine the value change amount generated by the target transaction for the target account based on the resource change amount and the resource value, for determining the risk of the target transaction. 15. A computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in a computer, it causes the computer to execute the method according to any one of claims 1-13. 16. A blockchain node, comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, it realizes any one of claims 1-13 method.

Images