045_区块链域名系统安全：ENS与去中心化身份的防护策略

ENS架构图
┌─────────────────┐    ┌──────────────────┐    ┌───────────────────┐
│  注册表 (Registry) │    │  解析器 (Resolver)  │    │  反向解析器 (Reverse) │
├─────────────────┤    ├──────────────────┤    ├───────────────────┤
│ - 域名所有权    │    │ - 域名->地址映射  │    │ - 地址->域名映射    │
│ - 解析器设置    │    │ - 多类型资源支持  │    │ - 反向查找功能      │
│ - 子域名控制    │    │ - 元数据存储      │    │                     │
└────────┬────────┘    └────────┬─────────┘    └───────────────────┘
         │                     │
         └─────────────┬───────┘
                       ▼
             ┌───────────────────┐
             │  注册控制器 (Registrar) │
             ├───────────────────┤
             │ - 域名注册拍卖    │
             │ - 短期租赁        │
             │ - 域名续费        │
             └───────────────────┘

// ENS Registry合约核心接口示例
interface ENS {    
    // 设置域名所有者
    function setOwner(bytes32 node, address owner) external;
    
    // 获取域名所有者
    function owner(bytes32 node) external view returns (address);
    
    // 设置域名解析器
    function setResolver(bytes32 node, address resolver) external;
    
    // 获取域名解析器
    function resolver(bytes32 node) external view returns (address);
    
    // 设置域名TTL
    function setTTL(bytes32 node, uint64 ttl) external;
    
    // 获取域名TTL
    function ttl(bytes32 node) external view returns (uint64);
}

// 安全解析器实现示例
contract SecureResolver is Resolver {
    // 域名所有者记录
    mapping(bytes32 => address) private _domainOwners;
    
    // 访问控制修饰器
    modifier onlyDomainOwner(bytes32 node) {
        require(msg.sender == _domainOwners[node], "Not authorized");
        _;
    }
    
    // 设置域名所有者
    function setDomainOwner(bytes32 node, address owner) external {
        // 只允许合约部署者或现所有者设置初始所有者
        require(msg.sender == address(0x1234) || _domainOwners[node] == address(0), "Cannot change existing owner");
        _domainOwners[node] = owner;
        emit DomainOwnerChanged(node, owner);
    }
    
    // 设置地址记录 - 带延迟执行
    function setAddrWithDelay(bytes32 node, address addr, uint256 delay) external onlyDomainOwner(node) {
        // 延迟设置机制，允许在一定时间内取消
        _pendingAddressChanges[node] = PendingChange(addr, block.timestamp + delay);
        emit AddressUpdateScheduled(node, addr, block.timestamp + delay);
    }
    
    // 确认地址更改
    function confirmAddressChange(bytes32 node) external onlyDomainOwner(node) {
        require(_pendingAddressChanges[node].newValue != address(0), "No pending change");
        require(block.timestamp >= _pendingAddressChanges[node].effectiveTime, "Change not yet effective");
        
        address oldAddr = addr(node);
        _addresses[node] = _pendingAddressChanges[node].newValue;
        delete _pendingAddressChanges[node];
        
        emit AddressChanged(node, oldAddr, _addresses[node]);
    }
    
    // 取消待处理的地址更改
    function cancelAddressChange(bytes32 node) external onlyDomainOwner(node) {
        require(_pendingAddressChanges[node].newValue != address(0), "No pending change");
        delete _pendingAddressChanges[node];
        emit AddressUpdateCancelled(node);
    }
    
    // 获取地址记录
    function addr(bytes32 node) public view override returns (address) {
        return _addresses[node];
    }
    
    // 紧急暂停功能
    function emergencyPause() external {
        require(msg.sender == _emergencyAdmin, "Not emergency admin");
        _paused = true;
        emit EmergencyPaused();
    }
}

安全转移流程
┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│ 发起转移请求     │────>│  等待确认期(24h) │────>│ 确认转移完成     │
└─────────────────┘     └─────────┬────────┘     └─────────────────┘
                                  │
                           ┌──────┴──────┐
                           │ 取消转移    │
                           └─────────────┘

// 简化的社交恢复合约
contract SocialRecoveryENS {
    // 域名节点
    bytes32 public node;
    
    // 可信恢复者列表
    address[] public guardians;
    
    // 恢复请求
    struct RecoveryRequest {
        address newOwner;
        uint256 createdAt;
        mapping(address => bool) approvals;
        uint256 approvalCount;
    }
    
    RecoveryRequest public recoveryRequest;
    
    // 配置参数
    uint256 public constant MIN_GUARDIANS = 3;
    uint256 public constant REQUIRED_APPROVALS = 2;
    uint256 public constant RECOVERY_DELAY = 48 hours;
    
    // 初始化
    constructor(bytes32 _node, address[] memory _guardians) {
        require(_guardians.length >= MIN_GUARDIANS, "Insufficient guardians");
        node = _node;
        guardians = _guardians;
    }
    
    // 发起恢复请求
    function initiateRecovery(address newOwner) external {
        require(isGuardian(msg.sender), "Not a guardian");
        require(newOwner != address(0), "Invalid address");
        
        // 重置或创建恢复请求
        delete recoveryRequest;
        recoveryRequest.newOwner = newOwner;
        recoveryRequest.createdAt = block.timestamp;
        recoveryRequest.approvals[msg.sender] = true;
        recoveryRequest.approvalCount = 1;
        
        emit RecoveryInitiated(node, newOwner, msg.sender);
    }
    
    // 批准恢复请求
    function approveRecovery() external {
        require(isGuardian(msg.sender), "Not a guardian");
        require(recoveryRequest.newOwner != address(0), "No active recovery");
        require(!recoveryRequest.approvals[msg.sender], "Already approved");
        
        recoveryRequest.approvals[msg.sender] = true;
        recoveryRequest.approvalCount++;
        
        emit RecoveryApproved(node, msg.sender, recoveryRequest.approvalCount);
    }
    
    // 执行恢复
    function executeRecovery() external {
        require(recoveryRequest.newOwner != address(0), "No active recovery");
        require(recoveryRequest.approvalCount >= REQUIRED_APPROVALS, "Insufficient approvals");
        require(block.timestamp >= recoveryRequest.createdAt + RECOVERY_DELAY, "Recovery delay not passed");
        
        // 获取ENS Registry
        ENS ens = ENS(0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e); // ENS Registry地址
        address currentOwner = ens.owner(node);
        
        // 检查当前合约是否有权限
        require(currentOwner == address(this), "Not authorized");
        
        // 转移域名所有权
        ens.setOwner(node, recoveryRequest.newOwner);
        
        emit RecoveryExecuted(node, currentOwner, recoveryRequest.newOwner);
        
        // 清除恢复请求
        delete recoveryRequest;
    }
    
    // 取消恢复请求
    function cancelRecovery() external {
        require(recoveryRequest.newOwner != address(0), "No active recovery");
        require(isGuardian(msg.sender), "Not a guardian");
        
        emit RecoveryCancelled(node, msg.sender);
        
        // 清除恢复请求
        delete recoveryRequest;
    }
    
    // 检查是否为监护人
    function isGuardian(address account) internal view returns (bool) {
        for (uint i = 0; i < guardians.length; i++) {
            if (guardians[i] == account) return true;
        }
        return false;
    }
}

// 简化的多因素认证合约
contract ENSMultiFactorAuth {
    // 与ENS Registry的接口
    ENS public ens;
    
    // 域名节点
    bytes32 public node;
    
    // 所有者地址
    address public owner;
    
    // 第二因素验证器
    address public secondaryValidator;
    
    // 待确认的操作
    struct PendingOperation {
        uint8 operationType; // 0: 设置解析器, 1: 转移所有权
        address targetAddress;
        uint256 requestedAt;
        bool confirmed;
    }
    
    PendingOperation public pendingOperation;
    
    // 操作确认等待时间 (24小时)
    uint256 public constant CONFIRMATION_DELAY = 24 hours;
    
    // 事件
    event OperationRequested(uint8 operationType, address targetAddress);
    event OperationConfirmed(uint8 operationType, address targetAddress);
    event OperationCancelled(uint8 operationType, address targetAddress);
    
    constructor(address _ensAddress, bytes32 _node, address _secondaryValidator) {
        ens = ENS(_ensAddress);
        node = _node;
        owner = msg.sender;
        secondaryValidator = _secondaryValidator;
    }
    
    // 修饰器 - 仅所有者
    modifier onlyOwner() {
        require(msg.sender == owner, "Not authorized");
        _;
    }
    
    // 修饰器 - 仅验证器
    modifier onlyValidator() {
        require(msg.sender == secondaryValidator, "Not validator");
        _;
    }
    
    // 请求设置解析器
    function requestSetResolver(address resolver) external onlyOwner {
        require(pendingOperation.requestedAt == 0, "Operation already pending");
        
        pendingOperation = PendingOperation(0, resolver, block.timestamp, false);
        emit OperationRequested(0, resolver);
    }
    
    // 请求转移所有权
    function requestTransferOwner(address newOwner) external onlyOwner {
        require(pendingOperation.requestedAt == 0, "Operation already pending");
        
        pendingOperation = PendingOperation(1, newOwner, block.timestamp, false);
        emit OperationRequested(1, newOwner);
    }
    
    // 验证器确认操作
    function confirmOperation() external onlyValidator {
        require(pendingOperation.requestedAt > 0, "No pending operation");
        require(!pendingOperation.confirmed, "Operation already confirmed");
        require(block.timestamp >= pendingOperation.requestedAt + CONFIRMATION_DELAY, "Confirmation delay not passed");
        
        pendingOperation.confirmed = true;
        emit OperationConfirmed(pendingOperation.operationType, pendingOperation.targetAddress);
        
        // 执行操作
        executePendingOperation();
    }
    
    // 取消待处理操作
    function cancelOperation() external onlyOwner {
        require(pendingOperation.requestedAt > 0, "No pending operation");
        require(!pendingOperation.confirmed, "Cannot cancel confirmed operation");
        
        emit OperationCancelled(pendingOperation.operationType, pendingOperation.targetAddress);
        
        // 重置待处理操作
        pendingOperation = PendingOperation(0, address(0), 0, false);
    }
    
    // 执行待处理操作
    function executePendingOperation() internal {
        require(pendingOperation.confirmed, "Operation not confirmed");
        
        // 确保当前合约是域名所有者
        require(ens.owner(node) == address(this), "Not domain owner");
        
        // 根据操作类型执行相应操作
        if (pendingOperation.operationType == 0) {
            // 设置解析器
            ens.setResolver(node, pendingOperation.targetAddress);
        } else if (pendingOperation.operationType == 1) {
            // 转移所有权
            ens.setOwner(node, pendingOperation.targetAddress);
        }
        
        // 重置待处理操作
        pendingOperation = PendingOperation(0, address(0), 0, false);
    }
    
    // 更新次要验证器
    function updateSecondaryValidator(address newValidator) external onlyOwner {
        secondaryValidator = newValidator;
    }
}

监控系统架构
┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│ 链上数据采集器  │────>│  安全分析引擎    │────>│  告警通知系统    │
└─────────────────┘     └─────────┬────────┘     └─────────────────┘
                                  │
                           ┌──────┴──────┐
                           │ 数据可视化平台 │
                           └─────────────┘

import time
import web3
import json
import smtplib
from email.mime.text import MIMEText
from web3 import Web3
from datetime import datetime

# 配置信息
RPC_URL = "https://mainnet.infura.io/v3/YOUR_INFURA_KEY"
ENS_REGISTRY_ADDRESS = "0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e"
DOMAIN_NODE = "0x636f6d2e657468"  # 示例: com.eth 的节点哈希
ALERT_EMAIL = "security@yourdomain.com"
CHECK_INTERVAL = 300  # 5分钟检查一次

# ENS Registry ABI (简化版)
ENS_ABI = [
    {
        "inputs": [{"internalType": "bytes32", "name": "node", "type": "bytes32"}],
        "name": "owner",
        "outputs": [{"internalType": "address", "name": "", "type": "address"}],
        "stateMutability": "view",
        "type": "function"
    },
    {
        "inputs": [{"internalType": "bytes32", "name": "node", "type": "bytes32"}],
        "name": "resolver",
        "outputs": [{"internalType": "address", "name": "", "type": "address"}],
        "stateMutability": "view",
        "type": "function"
    }
]

# 初始化Web3连接
w3 = Web3(Web3.HTTPProvider(RPC_URL))

# 初始化ENS Registry合约
ens_registry = w3.eth.contract(address=ENS_REGISTRY_ADDRESS, abi=ENS_ABI)

# 存储当前状态
current_owner = None
current_resolver = None

# 发送告警邮件
def send_alert(subject, message):
    try:
        msg = MIMEText(message)
        msg['Subject'] = subject
        msg['From'] = "ens-monitor@yourdomain.com"
        msg['To'] = ALERT_EMAIL
        
        # 这里需要配置SMTP服务器
        server = smtplib.SMTP('smtp.yourdomain.com', 587)
        server.starttls()
        server.login("username", "password")
        server.send_message(msg)
        server.quit()
        print(f"告警邮件已发送: {subject}")
    except Exception as e:
        print(f"发送邮件失败: {e}")

# 记录日志
def log_change(change_type, old_value, new_value):
    timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    with open("ens_monitor.log", "a") as log_file:
        log_file.write(f"[{timestamp}] {change_type}: {old_value} -> {new_value}\n")

# 监控主循环
def monitor_domain():
    global current_owner, current_resolver
    
    print("开始监控ENS域名安全状态...")
    
    while True:
        try:
            # 获取当前所有者
            new_owner = ens_registry.functions.owner(DOMAIN_NODE).call()
            
            # 获取当前解析器
            new_resolver = ens_registry.functions.resolver(DOMAIN_NODE).call()
            
            # 首次运行，初始化状态
            if current_owner is None:
                current_owner = new_owner
                current_resolver = new_resolver
                print(f"初始状态: 所有者={new_owner}, 解析器={new_resolver}")
                continue
            
            # 检查所有者变更
            if new_owner != current_owner:
                subject = "[高风险] ENS域名所有者变更告警"
                message = f"警告: 域名节点 {DOMAIN_NODE} 的所有者已变更!\n"
                message += f"原所有者: {current_owner}\n"
                message += f"新所有者: {new_owner}\n"
                message += f"时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n"
                message += "请立即验证此变更是否合法!"
                
                send_alert(subject, message)
                log_change("所有者变更", current_owner, new_owner)
                current_owner = new_owner
            
            # 检查解析器变更
            if new_resolver != current_resolver:
                subject = "[中风险] ENS域名解析器变更告警"
                message = f"通知: 域名节点 {DOMAIN_NODE} 的解析器已变更!\n"
                message += f"原解析器: {current_resolver}\n"
                message += f"新解析器: {new_resolver}\n"
                message += f"时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n"
                message += "请验证此变更是否合法!"
                
                send_alert(subject, message)
                log_change("解析器变更", current_resolver, new_resolver)
                current_resolver = new_resolver
            
            print(f"检查完成: 所有者={current_owner}, 解析器={current_resolver}")
            
        except Exception as e:
            print(f"监控过程中出错: {e}")
            send_alert("[错误] ENS域名监控异常", f"监控脚本出现错误: {str(e)}")
        
        # 等待下一次检查
        time.sleep(CHECK_INTERVAL)

# 启动监控
if __name__ == "__main__":
    monitor_domain()

ENS-DID工作流程图
┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│  DID请求 (did:ens:alice.eth) │────>│  ENS解析器查询  │────>│  返回DID文档    │
└─────────────────┘     └─────────┬────────┘     └─────────────────┘
                                  │
                           ┌──────┴──────┐
                           │ 身份验证与授权 │
                           └─────────────┘

// 使用ENS进行身份验证的JavaScript示例
const ethers = require('ethers');

async function verifyIdentityWithENS(ensName, message, signature) {
    try {
        // 初始化提供者
        const provider = new ethers.providers.JsonRpcProvider('https://mainnet.infura.io/v3/YOUR_INFURA_KEY');
        
        // 通过ENS名称获取地址
        const address = await provider.resolveName(ensName);
        if (!address) {
            throw new Error(`无法解析ENS名称: ${ensName}`);
        }
        
        console.log(`ENS名称 ${ensName} 解析到地址: ${address}`);
        
        // 构建消息
        const messageWithPrefix = ethers.utils.hashMessage(message);
        
        // 验证签名
        const recoveredAddress = ethers.utils.verifyMessage(message, signature);
        
        // 检查恢复的地址是否与ENS解析的地址匹配
        const isValid = recoveredAddress.toLowerCase() === address.toLowerCase();
        
        console.log(`签名验证结果: ${isValid}`);
        console.log(`恢复的地址: ${recoveredAddress}`);
        
        return {
            isValid,
            address,
            recoveredAddress,
            ensName
        };
    } catch (error) {
        console.error('身份验证失败:', error);
        throw error;
    }
}

// 使用示例
async function demo() {
    const ensName = 'vitalik.eth';
    const message = `登录请求\n时间戳: ${Date.now()}\n应用: Web3身份演示`;
    
    // 注意: 这里的签名通常由用户的钱包提供
    // 这只是一个演示，实际签名应该从前端钱包获取
    const signature = '0x...'; // 用户签名的消息
    
    try {
        const result = await verifyIdentityWithENS(ensName, message, signature);
        console.log('身份验证结果:', result);
    } catch (error) {
        console.error('验证过程中出错:', error);
    }
}

demo();

// 简化的基于零知识证明的ENS身份验证合约
contract ZKENSResolver {
    // ENS Registry接口
    ENS public ens;
    
    // 存储用户的ZKP验证密钥
    mapping(bytes32 => bytes) public verificationKeys;
    
    // 事件
    event VerificationKeySet(bytes32 indexed node, bytes key);
    event IdentityVerified(bytes32 indexed node, bytes32 context, bool result);
    
    constructor(address _ensAddress) {
        ens = ENS(_ensAddress);
    }
    
    // 设置ZKP验证密钥
    function setVerificationKey(bytes32 node, bytes calldata key) external {
        // 检查调用者是否为域名所有者
        require(ens.owner(node) == msg.sender, "Not authorized");
        
        verificationKeys[node] = key;
        emit VerificationKeySet(node, key);
    }
    
    // 验证零知识证明
    function verifyProof(
        bytes32 node,
        bytes32 context,
        bytes calldata proof,
        bytes[] calldata publicInputs
    ) external returns (bool) {
        // 获取验证密钥
        bytes memory key = verificationKeys[node];
        require(key.length > 0, "No verification key set");
        
        // 这里应该是实际的零知识证明验证逻辑
        // 在实际实现中，会使用如ZoKrates、Circom等库
        bool isValid = _verifyZkProof(key, proof, publicInputs);
        
        emit IdentityVerified(node, context, isValid);
        return isValid;
    }
    
    // 零知识证明验证实现（简化版）
    function _verifyZkProof(
        bytes memory key,
        bytes memory proof,
        bytes[] memory inputs
    ) internal pure returns (bool) {
        // 这里应该是实际的验证逻辑
        // 实际应用中会使用专门的ZKP验证库
        // 这只是一个示例，不代表真实验证
        return true; // 示例返回
    }
}

// 安全的ENS解析器集成
const { ethers } = require('ethers');

class SecureENSResolver {
    constructor(providerUrls = []) {
        // 初始化多个提供者确保可靠性
        this.providers = providerUrls.map(url => new ethers.providers.JsonRpcProvider(url));
        if (this.providers.length === 0) {
            // 默认使用公共提供者作为后备
            this.providers.push(new ethers.providers.JsonRpcProvider('https://mainnet.infura.io/v3/9aa3d95b3bc440fa88ea12eaa4456161'));
            this.providers.push(new ethers.providers.JsonRpcProvider('https://eth-mainnet.g.alchemy.com/v2/demo'));
        }
        
        // 本地缓存
        this.cache = new Map();
        this.cacheTTL = 300000; // 5分钟缓存
    }
    
    // 解析ENS名称到地址，使用多提供者确认
    async resolveName(ensName) {
        const cacheKey = `addr_${ensName}`;
        
        // 检查缓存
        const cached = this.cache.get(cacheKey);
        if (cached && Date.now() < cached.expires) {
            console.log(`缓存命中: ${ensName}`);
            return cached.value;
        }
        
        // 使用多个提供者进行解析
        const results = await Promise.allSettled(
            this.providers.map(provider => provider.resolveName(ensName))
        );
        
        // 收集成功的结果
        const successfulResults = results
            .filter(result => result.status === 'fulfilled' && result.value)
            .map(result => result.value);
        
        if (successfulResults.length === 0) {
            throw new Error(`所有提供者都无法解析ENS名称: ${ensName}`);
        }
        
        // 验证所有结果是否一致
        const firstResult = successfulResults[0];
        const allMatch = successfulResults.every(addr => addr === firstResult);
        
        if (!allMatch) {
            console.warn(`提供者返回不一致的结果: ${ensName}`, successfulResults);
            throw new Error(`解析结果不一致，请检查网络状态`);
        }
        
        // 缓存结果
        this.cache.set(cacheKey, {
            value: firstResult,
            expires: Date.now() + this.cacheTTL
        });
        
        return firstResult;
    }
    
    // 验证地址是否对应特定ENS名称
    async verifyAddressToName(address, ensName) {
        // 标准化地址格式
        const normalizedAddress = ethers.utils.getAddress(address);
        
        // 检查缓存
        const cacheKey = `name_${normalizedAddress}`;
        const cached = this.cache.get(cacheKey);
        if (cached && Date.now() < cached.expires) {
            return cached.value.toLowerCase() === ensName.toLowerCase();
        }
        
        // 使用多个提供者反向解析
        const results = await Promise.allSettled(
            this.providers.map(provider => provider.lookupAddress(normalizedAddress))
        );
        
        // 收集成功的结果
        const successfulResults = results
            .filter(result => result.status === 'fulfilled' && result.value)
            .map(result => result.value);
        
        // 如果没有反向解析记录，返回false
        if (successfulResults.length === 0) {
            return false;
        }
        
        // 验证所有结果是否一致
        const firstResult = successfulResults[0];
        const allMatch = successfulResults.every(name => name === firstResult);
        
        if (!allMatch) {
            console.warn(`反向解析结果不一致: ${address}`, successfulResults);
            // 即使结果不一致，仍尝试匹配提供的ENS名称
        }
        
        // 缓存结果
        this.cache.set(cacheKey, {
            value: firstResult,
            expires: Date.now() + this.cacheTTL
        });
        
        // 检查是否匹配提供的ENS名称
        return successfulResults.some(name => name.toLowerCase() === ensName.toLowerCase());
    }
    
    // 清理缓存
    clearCache() {
        this.cache.clear();
        console.log('缓存已清理');
    }
}

// 使用示例
async function demo() {
    const resolver = new SecureENSResolver([
        'https://mainnet.infura.io/v3/YOUR_INFURA_KEY',
        'https://eth-mainnet.g.alchemy.com/v2/YOUR_ALCHEMY_KEY'
    ]);
    
    try {
        // 解析ENS名称
        const address = await resolver.resolveName('vitalik.eth');
        console.log('解析结果:', address);
        
        // 验证地址与名称
        const isValid = await resolver.verifyAddressToName(address, 'vitalik.eth');
        console.log('验证结果:', isValid);
    } catch (error) {
        console.error('解析失败:', error);
    }
}

demo();

应急响应流程
┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│  安全事件检测   │────>│  初步评估与分类  │────>│  应急响应启动   │
└─────────────────┘     └─────────┬────────┘     └────────┬────────┘
                                  │                      │
                           ┌──────┴──────┐            ┌───┴────────┐
                           │  证据收集   │            │  遏制措施   │
                           └─────────────┘            └────────────┘

恢复时间线
1. 事件发现 (T+0)：监控系统发现域名所有权变更
2. 初步评估 (T+1)：确认是恶意劫持，损失评估约50万美元
3. 紧急遏制 (T+2)：启用备用域名，通知用户
4. 技术尝试 (T+4)：尝试通过社交恢复机制恢复
5. 法律介入 (T+7)：联系平台和法律团队
6. 恢复成功 (T+30)：通过多方协调恢复域名所有权

# AI驱动的钓鱼域名检测示例
import re
import numpy as np
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.ensemble import RandomForestClassifier
from sklearn.model_selection import train_test_split
from sklearn.metrics import classification_report

class PhishingDomainDetector:
    def __init__(self):
        # 初始化向量化器和分类器
        self.vectorizer = TfidfVectorizer(analyzer='char_wb', ngram_range=(2, 4))
        self.classifier = RandomForestClassifier(n_estimators=100, random_state=42)
        self.is_trained = False
    
    def _extract_features(self, domain):
        """提取域名的特征"""
        # 基础特征
        features = {
            'length': len(domain),
            'contains_digit': bool(re.search(r'\d', domain)),
            'hyphen_count': domain.count('-'),
            'dot_count': domain.count('.'),
            'contains_subdomain': domain.count('.') > 1,
            'vowel_ratio': sum(1 for c in domain if c.lower() in 'aeiou') / len(domain) if len(domain) > 0 else 0
        }
        return features
    
    def train(self, domains, labels):
        """训练模型"""
        # 文本特征提取
        text_features = self.vectorizer.fit_transform(domains)
        
        # 提取域名特征
        domain_features = []
        for domain in domains:
            features = self._extract_features(domain)
            domain_features.append(list(features.values()))
        domain_features = np.array(domain_features)
        
        # 合并特征
        combined_features = np.hstack((text_features.toarray(), domain_features))
        
        # 训练分类器
        self.classifier.fit(combined_features, labels)
        self.is_trained = True
        
        print("模型训练完成")
        return self
    
    def predict(self, domain):
        """预测域名是否为钓鱼域名"""
        if not self.is_trained:
            raise ValueError("模型尚未训练")
        
        # 文本特征提取
        text_features = self.vectorizer.transform([domain])
        
        # 提取域名特征
        features = self._extract_features(domain)
        domain_features = np.array([list(features.values())])
        
        # 合并特征
        combined_features = np.hstack((text_features.toarray(), domain_features))
        
        # 预测
        prediction = self.classifier.predict(combined_features)
        probability = self.classifier.predict_proba(combined_features)
        
        return {
            'is_phishing': prediction[0] == 1,
            'confidence': probability[0][prediction[0]]
        }
    
    def evaluate(self, domains, labels):
        """评估模型性能"""
        if not self.is_trained:
            raise ValueError("模型尚未训练")
        
        # 文本特征提取
        text_features = self.vectorizer.transform(domains)
        
        # 提取域名特征
        domain_features = []
        for domain in domains:
            features = self._extract_features(domain)
            domain_features.append(list(features.values()))
        domain_features = np.array(domain_features)
        
        # 合并特征
        combined_features = np.hstack((text_features.toarray(), domain_features))
        
        # 预测
        predictions = self.classifier.predict(combined_features)
        
        # 生成评估报告
        report = classification_report(labels, predictions)
        print(report)
        return report

# 演示使用
def demo():
    # 示例训练数据 (实际应用中应该使用更大的数据集)
    domains = [
        'vitalik.eth', 'uniswap.eth', 'aave.eth', 'compound.eth', 'maker.eth',
        'vitalik-secure-wallet.eth', 'uniswap-verify.eth', 'aave-finance-update.eth',
        'vitalik-official-airdrop.eth', 'uniswap-dao-voting.eth', 'aave-secure-connect.eth'
    ]
    # 0 = 合法域名, 1 = 可疑/钓鱼域名
    labels = [0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1]
    
    # 初始化并训练模型
    detector = PhishingDomainDetector()
    detector.train(domains, labels)
    
    # 测试预测
    test_domains = [
        'vitalik.eth',  # 合法
        'vitalik-airdrop-token.eth',  # 可疑
        'ethereum.eth',  # 可能是合法的
        'secure-wallet-connect.eth'  # 可疑
    ]
    
    print("\n预测结果:")
    for domain in test_domains:
        result = detector.predict(domain)
        print(f"域名: {domain}")
        print(f"  是钓鱼域名: {result['is_phishing']}")
        print(f"  置信度: {result['confidence']:.4f}")
        print()

demo()

区块链域名安全趋势预测 (2025-2030)

┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│ 2025: 跨链安全标准成熟 │────>│ 2027: 量子安全全面部署 │────>│ 2030: 自修复系统普及 │
└─────────────────┘     └─────────┬────────┘     └─────────────────┘
                                  │
                           ┌──────┴──────┐
                           │  AI驱动的安全生态系统 │
                           └─────────────┘