Granted Patent B2

US 12,294,599 · App. 17/756,258 · Granted May 6, 2025

Inventors: Dezhuang Kong (Beijing, CN); Shihui Nan (Beijing, CN); Yang Wang (Beijing, CN)

Assignee: BEIJING JINGDONG QIANSHI TECHNOLOGY CO., LTD.

H04L63/1425H04L9/50H04L63/1416

Abstract

Claims (75)

1. A blockchain-based host security monitoring method, comprising:

monitoring traffic data of a host in a network communication and determining whether the traffic data is malicious traffic;

in response the determining that the traffic data is the malicious traffic, obtaining security state information of the host and saving the security state information into a security state blockchain; and

generating an invasion log corresponding to the malicious traffic and saving the invasion log and the security state information into a log storage blockchain,

wherein the saving the security state information into the security state blockchain comprises:

saving a network address of the host and the security state information into a block body of a current security state block to be consensus authenticated;

in response that a block generation condition is met, obtaining block header data of a previous security state block in the security state blockchain, and obtaining a parent block hash value by calculation according to the block header data;

calculating a block body hash value of the current security state block according to data saved in the block body of the current block;

saving the parent block hash value, the block body hash value and a timestamp of a current time into a block header of the current security state block; and

broadcasting the current security state block to a security state blockchain network to perform consensus authentication on the current security state block, and linking the current security state block onto the security state blockchain upon a successful authentication.

2. The blockchain-based host security monitoring method according to claim 1 , wherein the determining whether the traffic data is the malicious traffic comprises:

performing feature extraction on the traffic data to obtain a traffic feature of the traffic data;

inputting the traffic feature into a pre-trained support vector machine model to identify a data type of the traffic data by the pre-trained support vector machine model, wherein the data type comprises normal traffic or malicious traffic.

3. The blockchain-based host security monitoring method according to claim 2 , wherein the performing the feature extraction on the traffic data to obtain the traffic feature of the traffic data comprises:

obtaining application layer protocol traffic in the traffic data and performing feature extraction on the application layer protocol traffic to obtain a protocol traffic feature of the application layer protocol traffic;

in response that a file object exists in the application layer protocol traffic, performing feature extraction on the file object to obtain a file object feature of the file object;

operating the file object in a sandbox of the host and determining a file operation feature related to the host according to an operation result; and

determining a traffic feature of the traffic data according to the protocol traffic feature, the file object feature and the file operation feature.

4. The blockchain-based host security monitoring method according to claim 1 , wherein the obtaining the security state information of the host comprises:

obtaining operation state data of the host; and

determining the security state information of the host according to the operation state data and the malicious traffic.

5. The blockchain-based host security monitoring method according to claim 4 , wherein the determining the security state information of the host according to the operation state data and the malicious traffic comprises:

performing feature extraction on the operation state data to obtain a state feature of the host;

determining a traffic feature corresponding to the malicious traffic; and

inputting the state feature and the traffic feature into a pre-trained random forest model to obtain the security state information of the host.

6. The blockchain-based host security monitoring method according to claim 1 , wherein the saving the invasion log and the security state information into the log storage blockchain comprises:

saving a network address of the host, the intrusion log and the security state information into a block body of a current log storage block to be consensus authenticated;

in response that a block generation condition is met, obtaining block header data of a previous log storage block in the log storage blockchain and obtaining a parent block hash value by calculation according to the block header data;

calculating a block body hash value of the current log storage block according to data saved in the block body of the current log storage block;

saving the parent block hash value, the block body hash value and a timestamp of a current time into a block header of the current log storage block; and

broadcasting the current log storage block to a log storage blockchain network to perform consensus authentication on the current log storage block, and linking the current log storage block onto the log storage blockchain upon a successful authentication.

7. A non-transitory computer-readable medium, having a computer program stored thereon, wherein the computer program is configured, when executed by a processor, to perform a blockchain-based host security monitoring method, comprising:

monitoring traffic data of a host in a network communication and determining whether the traffic data is malicious traffic;

in response the determining that the traffic data is the malicious traffic, obtaining security state information of the host and saving the security state information into a security state blockchain; and

generating an invasion log corresponding to the malicious traffic and saving the invasion log and the security state information into a log storage blockchain,

wherein the saving the security state information into the security state blockchain comprises:

saving a network address of the host and the security state information into a block body of a current security state block to be consensus authenticated;

in response that a block generation condition is met, obtaining block header data of a previous security state block in the security state blockchain, and obtaining a parent block hash value by calculation according to the block header data;

calculating a block body hash value of the current security state block according to data saved in the block body of the current block;

saving the parent block hash value, the block body hash value and a timestamp of a current time into a block header of the current security state block; and

broadcasting the current security state block to a security state blockchain network to perform consensus authentication on the current security state block, and linking the current security state block onto the security state blockchain upon a successful authentication.

8. An electronic device, comprising:

a processor;

a memory, configured to store executable instructions executable by the processor, wherein

the processor is configured to perform a blockchain-based host security monitoring method by executing the executable instructions, the blockchain-based host security monitoring method comprising:

monitoring traffic data of a host in a network communication and determining whether the traffic data is malicious traffic;

in response the determining that the traffic data is the malicious traffic, obtaining security state information of the host and saving the security state information into a security state blockchain; and

generating an invasion log corresponding to the malicious traffic and saving the invasion log and the security state information into a log storage blockchain,

wherein the saving the security state information into the security state blockchain comprises:

saving a network address of the host and the security state information into a block body of a current security state block to be consensus authenticated;

in response that a block generation condition is met, obtaining block header data of a previous security state block in the security state blockchain, and obtaining a parent block hash value by calculation according to the block header data;

calculating a block body hash value of the current security state block according to data saved in the block body of the current block;

saving the parent block hash value, the block body hash value and a timestamp of a current time into a block header of the current security state block; and

broadcasting the current security state block to a security state blockchain network to perform consensus authentication on the current security state block, and linking the current security state block onto the security state blockchain upon a successful authentication.

9. The electronic device according to claim 8 , wherein the determining whether the traffic data is the malicious traffic comprises:

performing feature extraction on the traffic data to obtain a traffic feature of the traffic data;

inputting the traffic feature into a pre-trained support vector machine model to identify a data type of the traffic data by the pre-trained support vector machine model, wherein the data type comprises normal traffic or malicious traffic.

10. The electronic device according to claim 9 , wherein the performing the feature extraction on the traffic data to obtain the traffic feature of the traffic data comprises:

obtaining application layer protocol traffic in the traffic data and performing feature extraction on the application layer protocol traffic to obtain a protocol traffic feature of the application layer protocol traffic;

in response that a file object exists in the application layer protocol traffic, performing feature extraction on the file object to obtain a file object feature of the file object;

operating the file object in a sandbox of the host and determining a file operation feature related to the host according to an operation result; and

determining a traffic feature of the traffic data according to the protocol traffic feature, the file object feature and the file operation feature.

11. The electronic device according to claim 8 , wherein the obtaining the security state information of the host comprises:

obtaining operation state data of the host; and

determining the security state information of the host according to the operation state data and the malicious traffic.

12. The electronic device according to claim 11 , wherein the determining the security state information of the host according to the operation state data and the malicious traffic comprises:

performing feature extraction on the operation state data to obtain a state feature of the host;

determining a traffic feature corresponding to the malicious traffic; and

inputting the state feature and the traffic feature into a pre-trained random forest model to obtain the security state information of the host.

13. The electronic device according to claim 8 , wherein the saving the invasion log and the security state information into the log storage blockchain comprises:

saving a network address of the host, the intrusion log and the security state information into a block body of a current log storage block to be consensus authenticated;

in response that a block generation condition is met, obtaining block header data of a previous log storage block in the log storage blockchain and obtaining a parent block hash value by calculation according to the block header data;

calculating a block body hash value of the current log storage block according to data saved in the block body of the current log storage block;

saving the parent block hash value, the block body hash value and a timestamp of a current time into a block header of the current log storage block; and

broadcasting the current log storage block to a log storage blockchain network to perform consensus authentication on the current log storage block, and linking the current log storage block onto the log storage blockchain upon a successful authentication.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (27)