Intelligent fund analysis system for specific gang behavior of block chain

Abstract

The invention discloses an intelligent fund analysis system for a specific gang behavior of a block chain, and relates to the technical field of block chains, and the system comprises a data collection unit which is used for obtaining data points based on data on all nodes of the block chain; the data fusion unit is used for obtaining first data based on the data points; the label unit is used for obtaining second data based on the label system and the first data; the address anomaly analysis unit is used for obtaining transaction data based on the second data and judging whether the to-be-identified address has a specific gang behavior based on the transaction data; the graph analysis unit is used for constructing a fund flow graph, extracting graph features of the fund flow graph and obtaining key data based on the graph features; the comprehensive analysis unit is used for pre-warning potential risk behaviors based on graph features; and the result unit is used for obtaining an analysis result. The problems that in the prior art, specific gang behavior fund flow based on the block chain cannot be accurately identified and predicted, and block chain characteristics and constantly changing supervision requirements cannot be adapted can be solved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a financial intelligent analysis system targeting the behavior of specific blockchain gangs. Background Art

[0002] Blockchain technology has been applied in many industries due to its decentralized, tamper-proof and transparent features, and has shown great potential in the field of financial transactions. However, these features also make blockchain a popular tool for illegal activities, such as providing a flow path for gambling funds and fraud activities that is difficult to track and regulate.

[0004] Existing technologies for analyzing and monitoring blockchain gambling funds and fraud funds are generally classified into the following categories:

[0005] 1. Transaction monitoring and analysis technology: mainly focuses on monitoring and analyzing transactions on the blockchain to identify transactions related to gambling and fraud. By analyzing the amount, frequency, time and other information of transaction data, abnormal transaction patterns related to it can be identified to explain potential illegal activities. For example, Chainalysis is a widely used blockchain analysis tool. However, since a large number of transactions are generated on the blockchain every second, it is obviously unrealistic to analyze every transaction. Therefore, this technology is usually aimed at transactions under specific conditions, such as specific addresses, specific times, etc. And in the case where traders use complex methods to conceal their activities, this method cannot completely distinguish between legal and illegal transactions.

[0006] 2. Graph analysis technology: By constructing a transaction relationship graph, the flow path of funds between different accounts is analyzed. Graph analysis can help researchers understand the network structure of fund flow, identify central nodes and key transaction links, which is particularly effective in revealing complex gambling and fraud activities. However, when processing extremely large amounts of data, graph analysis may have very high computing and storage requirements. And if the nodes or connections in the network are unusually complex, traditional graph analysis methods may become slow or even inaccurate.

[0007] 3. Behavioral analysis and machine learning technology: Apply machine learning algorithms to model and predict gambling and fraud behaviors, and automatically identify possible illegal activities by analyzing user behaviors and transaction patterns. For example, Featurespace's ARIC platform uses adaptive behavioral analysis technology to learn and identify abnormal behavior patterns from complex data, which is very useful for predicting and preventing behaviors related to online gambling. However, the model requires a large amount of historical data for training. For emerging abnormal gang behavior patterns, if the data is insufficient, the model's prediction accuracy may be affected. And the model needs to be updated regularly to adapt to new gambling behaviors, increasing maintenance costs.

[0008] In order to effectively deal with this serious situation, it is urgent to develop new technical means for monitoring and management. Summary of the invention

[0009] In order to solve the problem that the existing technology cannot accurately identify and predict the capital flow of specific group behaviors based on blockchain and cannot adapt to the characteristics of blockchain and the changing regulatory needs, the present invention provides a capital intelligent analysis system for specific group behaviors on blockchain, the system comprising:

[0010] Data collection unit: used to build a blockchain full node and database, collect on-chain data and off-chain data on the blockchain full node, classify and label the on-chain data and the off-chain data, obtain a number of data points, and create metadata for each of the data points;

[0011] Data fusion unit: used for fusing all the data points to obtain first data;

[0012] Label unit: used for building a label system, classifying and labeling the first data based on the label system and the metadata, obtaining second data, and storing the second data in the database;

[0013] An address anomaly analysis unit: used for obtaining first transaction data of a specific group behavior address based on the second data, obtaining first address features of the specific group behavior address based on the first transaction data, obtaining an abnormal behavior model based on the first address features, and monitoring and analyzing the address to be identified based on the abnormal behavior model to determine whether there is a specific group behavior;

[0014] A graph analysis unit: used for constructing a capital flow graph, extracting graph features of the capital flow graph, and obtaining a first key node and a first key path based on the graph features;

[0015] Comprehensive analysis unit: used for obtaining a node feature vector based on the graph feature; obtaining a graph neural network model based on the node feature vector, and warning of potential risk behaviors based on the graph neural network model;

[0016] Result unit: used to obtain analysis results based on the address anomaly analysis unit, the graph analysis unit and the comprehensive analysis unit.

[0017] Specific gang behavior refers to illegal activities carried out jointly by two or more persons.

[0018] The present invention integrates on-chain data and off-chain data, establishes a comprehensive data support platform, ensures data consistency and accuracy, enhances the depth and breadth of overall analysis, pays attention to the importance of off-chain data, further enhances the data support capabilities of the system, improves the comprehensiveness and accuracy of system monitoring, creates metadata, and assists in subsequent data tracking and quality control; builds an efficient and secure database to ensure rapid access and long-term preservation of data; the label system provides label data support to help decision makers understand the complex capital flow patterns of specific gang behaviors, thereby conducting effective risk assessment and decision making; trains abnormal behavior models that can deeply analyze and learn user behavior patterns, monitors and analyzes unknown new addresses, improves recognition accuracy and reduces misjudgment rate; builds a capital flow Graphs can help understand the network structure of capital flows, and using them to identify important nodes and key paths can effectively reveal complex specific group behavior activities; using the graph neural network in the deep learning model for comprehensive analysis and training to obtain a graph neural network model, it can provide early warning of potential risk behaviors, and continuously update the graph structure data through new transaction data to adapt to emerging abnormal group behavior patterns and strategies, blockchain characteristics and changing regulatory needs; combining the results of the address anomaly analysis unit, graph analysis unit and comprehensive analysis unit for further comprehensive analysis to obtain analysis results, realize an effective multi-technology fusion mechanism, achieve comprehensive coverage from details to the whole, more accurately identify and predict the flow of funds for specific group behaviors based on blockchain, and make the analysis results more comprehensive and accurate.

[0019] Furthermore, the data points include on-chain data points and off-chain data points; the data fusion unit specifically includes:

[0020] The first fusion unit is used to convert the images and preset documents in all the off-chain data points into text data, obtain the off-chain text data, and extract the key entities and key semantics of the off-chain text data;

[0021] A second fusion unit: used for performing unified processing on all the data points to obtain a plurality of first data points;

[0022] A third fusion unit: configured to fuse all the first data points based on a preset matching rule, the metadata, the key entity and the key semantics to obtain preliminary fused data;

[0023] The fourth fusion unit is used to review and verify the preliminary fusion data to obtain the first data.

[0024] Furthermore, the address anomaly analysis unit further includes:

[0025] Tracking unit: used to obtain the second transaction data of the address to be identified, obtain the second address feature based on the second transaction data, determine whether the address to be identified is a suspected specific gang behavior address based on the second address feature, and if so, obtain the address type of the address to be identified based on a preset judgment rule; analyze the capital flow path of the address to be identified based on the address type and the preset address type search strategy to obtain the second key path;

[0026] Clustering unit: used to obtain a tracking address based on the second critical path, and obtain a number of initial clusters based on the tracking address; obtain the third transaction data of the tracking address, perform feature extraction on the third data to obtain transaction behavior features, and construct address vector features of the transaction behavior features; calculate the feature vector average value of each initial cluster and the cosine distance between two adjacent initial clusters based on the address vector features; merge all the initial clusters based on a preset minimum average value and a preset minimum distance to obtain a number of merged clusters; obtain an average distance based on all the cosine distances, draw a curve graph based on the average distance, obtain a smoothness based on the curve graph, and obtain the number of merged clusters; determine whether the smoothness is greater than a preset smoothness value, or whether the number is greater than a preset number, if so, update all the initial clusters to all the merged clusters, if not, obtain a number of address clusters based on all the merged clusters, visualize and integrate the address clusters, and obtain a tree diagram, which is used to analyze the key nodes of the capital flow path;

[0027] A language model analysis unit is used to transform the second transaction data to obtain transaction text data, input the transaction text data into a pre-trained language model, and obtain an abnormal probability and an abnormal type of the address to be identified;

[0028] Transaction analysis unit: used to analyze the capital flow of blockchain full-node transactions based on the tracking unit, the clustering unit and the language model analysis unit to obtain a first analysis result.

[0029] Furthermore, the graph analysis unit specifically includes:

[0030] A construction unit: configured to preset a construction rule, obtain a first address based on the second data, use the first address as an initial node, and construct an initial graph;

[0031] An expansion unit: used for setting a maximum path length, and expanding the initial graph based on the maximum path length and a preset transaction rule to obtain an expanded graph;

[0032] Search unit: used for obtaining a first transaction feature based on a preset abnormal group behavior pattern, searching the extended graph based on the first transaction feature and a preset search rule, obtaining a pattern node, marking the pattern node, classifying the pattern node based on a preset identity category, and obtaining the capital flow graph;

[0033] Feature unit: used to obtain several graph nodes of the capital flow graph, calculate the node information of each graph node, obtain the graph feature based on the node information, and obtain the first key node and the first key path based on the graph feature; the node information includes node degree centrality, betweenness centrality, clustering coefficient and PageRank value.

[0034] Constructing the initial graph based on preset construction rules related to the abnormal gang behavior pattern can ensure that the constructed graph can accurately reflect the flow of funds of abnormal gang behavior.

[0035] Furthermore, the comprehensive analysis unit specifically includes:

[0036] Data unit: used to take the pattern nodes in the capital flow graph as positive samples and the unlabeled nodes in the capital flow graph as negative samples; obtain the second transaction feature of each graph node, and obtain a transaction feature vector based on the second transaction feature; obtain a graph structure feature based on the graph feature, and obtain a graph structure feature vector based on the graph structure feature; concatenate and normalize the transaction feature vector and the graph structure feature vector to obtain the node feature vector; obtain the connection edge of the capital flow graph, and combine the node feature vector and the connection edge to obtain graph structure data;

[0037] Model unit: used for training the model based on the positive sample, the negative sample and the graph structure data to obtain the graph neural network model;

[0038] Early warning unit: used to obtain new transaction data, obtain an update node based on the new transaction data, and obtain a first update node feature of the update node; input the new transaction data and the first update node feature into the graph neural network model, update the graph structure data based on the new transaction data, normalize the first update node feature, and obtain a second update node feature; the graph neural network model classifies and warns the update node based on the second update node feature.

[0039] Furthermore, the system further comprises:

[0040] A first classification unit: used to calculate the entropy of the second transaction data based on a pre-trained first classification model, divide the second address feature based on a preset threshold range, and obtain address feature sets of different classifications; calculate the conditional entropy of each address feature set; obtain the information gain value and split value of the second address feature based on the entropy and the conditional entropy, and obtain the information gain ratio of the second address feature based on the information gain value and the split value; obtain a split point based on the highest information gain ratio; split the second transaction data based on the split point to obtain a number of subsets; calculate all the subsets based on the classification labels to obtain the category probability, and obtain the first specific gang behavior probability of the address to be identified based on the category probability;

[0041] A second classification unit is used to expand the address to be identified based on the pre-trained second classification model to obtain a network representation graph, obtain a first representation of the address to be identified based on the network representation graph, update the first representation to obtain a second representation, and obtain a second specific gang behavior probability of the address to be identified based on the second representation;

[0042] Probability unit: used to merge the first specific group behavior probability and the second specific group behavior probability to obtain a total specific group behavior probability, and determine whether the address to be identified is a specific group behavior address based on the total specific group behavior probability.

[0043] Furthermore, the first calculation formula for obtaining the average value of the feature vector is:

[0044]

[0045] The second calculation formula for obtaining the cosine distance is:

[0046]

[0047] Among them, C i represents the average value of the feature vector of the i-th initial cluster, n represents the number of initial clusters, x i represents the address vector feature of the i-th initial cluster, i represents the i-th initial cluster, d(C i ,C j ) represents the cosine distance between the i-th initial cluster and the j-th initial cluster, represents the average address vector feature of the i-th initial cluster, Represents the average address vector characteristics of the jth initial cluster.

[0048] Furthermore, a third calculation method for obtaining the node degree centrality is:

[0049] C D (v) = D in(v)+D out (v);

[0050] Among them, v represents a graph node, C D (v) represents the node degree centrality of graph node v, D in (v) represents the number of incoming edges of graph node v, D out (v) represents the number of outgoing edges of graph node v;

[0051] A fourth calculation method to obtain the betweenness centrality is:

[0052]

[0053] Among them, C B (v) represents the betweenness centrality of graph node v, s represents the betting node, t represents the payout node, σ st represents the total number of shortest paths from the betting node to the payout node, σ st (v) represents the number of shortest paths from the betting node to the payout node that pass through the graph node v;

[0054] The fifth calculation method for obtaining the clustering coefficient is:

[0055]

[0056] Among them, C(v) represents the clustering coefficient of graph node v, D(v) represents the number of edges directly connected to graph node v, and T(v) represents the number of triangles containing graph node v;

[0057] The sixth calculation method for obtaining the PageRank value is:

[0058]

[0059] Among them, PR(v) represents the PageRank value of graph node v, d represents the damping factor, N represents the total number of graph nodes, N(v) represents the set of neighbor nodes of graph node v, u represents the node in the neighbor node set, PR(u) represents the PageRank value of node u, and D(u) represents the number of edges directly connected to node u.

[0060] Furthermore, the seventh calculation formula for obtaining the entropy is:

[0061] Entropy(D)=-p0log2(p0)-p1log2(p1);

[0062] The eighth calculation formula for obtaining the information gain value is:

[0063]

[0064] The ninth calculation formula for obtaining the split value is:

[0065]

[0066] The tenth calculation formula for obtaining the information gain ratio is:

[0067]

[0068] The eleventh calculation formula for obtaining the class probability is:

[0069]

[0070] When the classification label is a specific group behavior label, the twelfth calculation formula for obtaining the first specific group behavior probability is:

[0071] P CART =P(C);

[0072] When the classification label is a normal behavior label, the thirteenth calculation formula for obtaining the first specific group behavior probability is:

[0073] P CART =1-P(C);

[0074] Where Entropy(D) represents entropy, D represents the second transaction data, p0 represents the proportion of normal transactions, p1 represents the proportion of transactions involving specific group behaviors, Gain(D,f1) represents the information gain value of the second address feature, f1 represents the second address feature, Entropy(D high )、Entropy(D medium ) and Entropy( Dlow ) represents the conditional entropy of different address feature sets, D high , D medium and D low represents the address feature set of different classifications, SplitInfo(D,f1) represents the split value of the second address feature, Gain Ratio(D,f1) represents the information gain ratio of the second address feature, Ρ(C) represents the category probability, C represents the classification label, N1 represents the number of data points of the address feature set of different classifications, N2 represents the number of data points of the second transaction data, P CART Represents the probability of the first specific gang behavior.

[0075] Furthermore, a fourteenth calculation formula for obtaining the first representation is:

[0076]

[0077] The fifteenth calculation formula for obtaining the second representation is:

[0078]

[0079] The sixteenth calculation formula for obtaining the probability of the second specific group behavior is:

[0080]

[0081] The seventeenth calculation formula for obtaining the total probability of specific gang behavior is:

[0082]

[0083] Where a represents a node in the network representation graph, N(a) represents the set of sampled neighbor nodes of node a, represents the first representation of the set of sampled neighbor nodes of the pre-trained second classification model t layer, MEAN() represents the aggregation function, represents the representation of node b in the t-1 layer of the pre-trained second classification model, where b represents a node in the sampled neighbor node set. represents the second representation of node a in the t layer of the pre-trained second classification model, σ represents the activation function, and W t Represents the weight matrix of the pre-trained second classification model t layer, CONCAT() represents concatenation, represents the second representation of node a in the t-1 layer of the pre-trained second classification model, P GraphSAGE represents the probability of the second specific gang behavior, softmax() represents the softmax activation function, W and B both represent learning parameters, represents the second representation of node a in the last layer of the pre-trained second classification model, P final represents the total probability of specific gang behavior, represents the weight of the probability of the first specific gang behavior, P CART Represents the probability of the first specific gang behavior.

[0084] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0085] 1. Integrate on-chain data and off-chain data, establish a comprehensive data support platform, ensure the consistency and accuracy of data, enhance the depth and breadth of overall analysis, pay attention to the importance of off-chain data, further enhance the data support capabilities of the system, improve the comprehensiveness and accuracy of system monitoring, create metadata, and assist in subsequent data tracking and quality control; build an efficient and secure database to ensure rapid access and long-term preservation of data.

[0086] 2. The labeling system provides labeling data support to help decision makers understand the complex gambling fund flow patterns, thereby conducting effective risk assessment and decision making.

[0087] 3. Train abnormal behavior models that can deeply analyze and learn user behavior patterns, monitor and analyze unknown new addresses, improve recognition accuracy and reduce misjudgment rates.

[0088] 4. Constructing a capital flow diagram can help understand the network structure of capital flow. Using it to identify important nodes and key paths can effectively reveal the complex behavior of specific gangs.

[0089] 5. The graph neural network model in the deep learning model is used for comprehensive analysis and training to obtain a graph neural network model, which can provide early warning of potential risk behaviors, continuously update graph structure data through new transaction data, and adapt to emerging abnormal gang behavior patterns and strategies, and adapt to the characteristics of blockchain and changing regulatory needs.

[0090] 6. Combine the results of the address anomaly analysis unit, graph analysis unit and comprehensive analysis unit to further obtain the analysis results, realize an effective multi-technology fusion mechanism, achieve comprehensive coverage from details to the whole, more accurately identify and predict the flow of funds of specific gang behaviors based on blockchain, and make the analysis results more comprehensive and accurate.

[0091] 7. Based on the address type and the preset address type search strategy, the capital flow path of the address to be identified is analyzed to obtain the second key path, which can identify complex capital flow paths, thereby covering the capital network of specific gang behavior; based on the second key path, the tracking address is obtained, and the address cluster is obtained based on the tracking address. The address cluster is visualized and integrated to obtain a tree diagram. Using the tree diagram, the addresses with transactions are associated, and similar addresses are clustered into a cluster, so as to visualize and integrate the address clusters, and the capital collection nodes and dispersion nodes in the tree diagram can be identified. By analyzing the capital collection points and dispersion points in the same cluster, it is helpful to analyze the key nodes, thereby realizing capital flow and revealing hidden capital flow; the second transaction data is converted to obtain transaction text data, and the transaction text data is input into the pre-trained language model to obtain the abnormal probability and abnormal type of the address to be identified, and the language model is used to analyze several transactions associated with the address, so as to obtain the transaction mode and transaction behavior characteristics of the address and other addresses, and determine whether it belongs to abnormal transaction behavior, so as to realize the identification of abnormal transactions.

[0092] 8. Obtain a split point based on the highest information gain ratio; split the second transaction data based on the split point to obtain several subsets; calculate all subsets based on the classification label to obtain the category probability, obtain the first specific group behavior probability of the address to be identified based on the category probability, and select the transaction behavior feature with the highest information gain ratio as the current split point, which can ensure that the selected feature provides the most information in distinguishing normal and fraudulent transactions; obtain the first representation of the address to be identified based on the network representation graph, update the first representation to obtain the second representation, obtain the second specific group behavior probability of the address to be identified based on the second representation, construct a network representation graph, and effectively integrate the local neighbor information of the node, which not only improves the accuracy of classification, but also adapts to the processing requirements of large-scale graph data, and can effectively process the complex network structure data of the blockchain; merge the first specific group behavior probability and the second specific group behavior probability to obtain the total specific group behavior probability, and judge whether the address to be identified is a specific group behavior address based on the total specific group behavior probability, while taking into account the address to be identified, the multi-dimensional transaction behavior characteristics associated with the address, and the multi-address transaction associated with the address, so as to be able to comprehensively analyze the suspicious address and improve the recognition accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of the present invention, and do not constitute a limitation on the embodiments of the present invention;

[0094] Figure 1 It is a flow chart of the financial intelligent analysis system for the behavior of specific blockchain gangs in the present invention. DETAILED DESCRIPTION

[0095] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0096] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those within the scope of this description. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0097] Embodiment 1

[0098] refer to Figure 1 This embodiment provides a fund intelligent analysis system for the behavior of a specific blockchain group, and the system includes:

[0099] Data collection unit: used to build a blockchain full node and database, collect on-chain data and off-chain data on the blockchain full node, classify and label the on-chain data and the off-chain data, such as classifying and labeling the data according to the source, timestamp, relevance and credibility of the data, obtaining a number of data points, and creating metadata for each of the data points; in this embodiment, the on-chain data may include transaction records and smart contract events of the blockchain platform, and the off-chain data may include public opinion information related to gambling activities, which may come from public records, social media, news reports and legal documents, etc.; labeling refers to standardizing or classifying on-chain data and off-chain data into a certain category, rather than treating them as a unique individual; metadata may include data source information, timestamp information and relevance information, etc.

[0100] Data fusion unit: used to fuse all the data points to obtain first data; the data points include on-chain data points and off-chain data points; wherein the data fusion unit specifically includes:

[0101] The first fusion unit is used to convert the images and preset documents in all the off-chain data points into text data using optical character recognition technology, obtain off-chain text data, and extract key entities and key semantics of the off-chain text data using named entity recognition technology; in this embodiment, the preset document can be a paper document, the key entity can be a name, place name, organization, time, etc., and the key semantics can be the meaning of the key entity and keywords related to gambling behavior;

[0102] The second fusion unit is used to unify all the data points by using ETL tools to obtain a number of first data points; ETL tools are a set of software tools used to extract, transform and load data from one or more sources into a target system or database; the unification process includes unification in format and structure.

[0103] The third fusion unit is used to fuse all the first data points based on the preset matching rules, the metadata, the key entities and the key semantics to obtain preliminary fused data; for example, through the time, place and amount in the public opinion event, relevant matching rules are formulated with the relevant information in the metadata, such as keyword matching rules or threshold matching rules, to fuse the off-chain data and the on-chain data.

[0104] The fourth fusion unit is used to review and verify the preliminary fusion data to obtain the first data. For example, in the data fusion step, a manual review and verification link is introduced to check and adjust the preliminary fusion results to ensure the accuracy and reliability of the first data.

[0105] Label unit: used for building a label system, classifying and labeling the first data based on the label system and the metadata, obtaining second data, and storing the second data in the database;

[0106] Address anomaly analysis unit: used to obtain the first transaction data of a specific group behavior address based on the second data, obtain the first address feature of the specific group behavior address based on the first transaction data, obtain an abnormal behavior model based on the first address feature, monitor and analyze the address to be identified based on the abnormal behavior model to determine whether there is specific group behavior; in this embodiment, the transaction data may include user information, transaction time, transaction address, transaction amount, number of counterparties and addresses of counterparties, etc., and the address features may be transaction frequency, transaction time interval and amount distribution, etc.; in this embodiment, specific group behavior may include gambling and fraud.

[0107] Graph analysis unit: used to construct a capital flow graph, extract graph features of the capital flow graph, and obtain a first key node and a first key path based on the graph features; in this embodiment, graph features may be features such as node degree centrality, betweenness centrality, clustering coefficient, PageRank value, transaction weight, and community structure; node degree centrality is the most direct measurement indicator to characterize node centrality, that is, the greater the degree of a node, the more important the node is; betweenness centrality is an indicator that characterizes the importance of a node by the number of shortest paths passing through a node; clustering coefficient, also known as aggregation coefficient or cluster coefficient, is an important concept in graph theory, which is used to describe the degree of clustering between vertices in a graph. Specifically, it measures the degree of interconnection between the adjacent points of a point; under certain conditions, the probability of visiting each node in the extreme case converges to a stable distribution. At this time, the stable probability value of each node is its PageRank value, which indicates the importance of the node; the transaction weight is the edge weight, which can be the connection strength or correlation with the node; the community structure refers to the relatively stable relationship or composition formed between the internal elements and each other in the capital flow diagram.

[0108] The graph analysis unit specifically includes:

[0109] Construction unit: used to preset construction rules, obtain the first address based on the second data, use the first address as the initial node, and construct an initial graph; in this embodiment, the preset construction rules may include a specific transaction amount, frequency, and relationship between the two parties to the transaction, etc., and the first address may include a gambling address and a transaction address with a transaction frequency higher than a certain frequency.

[0110] Extension unit: used to set the longest path length, expand the initial graph based on the longest path length and preset transaction rules, and obtain an extended graph; the longest path length refers to the maximum number of shortest paths between a node and a tail node directly or indirectly connected;

[0111] Search unit: used to obtain a first transaction feature based on a preset abnormal group behavior pattern, search the extended graph based on the first transaction feature and preset search rules, obtain pattern nodes, mark the pattern nodes, classify the pattern nodes based on preset identity categories, and obtain the capital flow graph; in this embodiment, the abnormal group behavior pattern refers to two or more people (including two people) jointly carrying out illegal activities in different forms, such as the abnormal group behavior pattern can be a gambling pattern of betting-opening-payment, the betting address is usually a one-time address, the inbound direction is only for a few users and there is an obvious collection behavior; the opening address is usually a core address involved in gambling, its capital flow is very large and has a clear gap with other addresses; the payment address is usually a one-time address, the outbound direction is only for a few users and there is an obvious distribution behavior; based on these transaction characteristics, the first transaction feature is obtained; then a search rule corresponding to the first transaction feature is formulated to conduct a preliminary search of the network, such as a keyword search rule or a threshold search rule, etc., and manual confirmation and marking of the pattern node can also be added; the preset identity category refers to the category of the address corresponding to the pattern node.

[0112] Feature unit: used to obtain several graph nodes of the capital flow graph, calculate the node information of each graph node, obtain the graph feature based on the node information, and obtain the first key node and the first key path based on the graph feature; the node information includes node degree centrality, betweenness centrality, clustering coefficient and PageRank value.

[0113] Comprehensive analysis unit: used to obtain a node feature vector based on the graph feature; train a graph neural network of a deep learning model based on the node feature vector to obtain a graph neural network model, implement the node classification, link prediction and network classification functions of the model, and warn of potential risk behaviors based on the graph neural network model; wherein the comprehensive analysis unit specifically includes:

[0114] Data unit: used to take the pattern nodes in the capital flow graph as positive samples and the unlabeled nodes in the capital flow graph as negative samples; obtain the second transaction feature of each of the graph nodes, and obtain a transaction feature vector based on the second transaction feature; obtain a graph structure feature based on the graph feature, and obtain a graph structure feature vector based on the graph structure feature; concatenate and normalize the transaction feature vector and the graph structure feature vector to obtain the node feature vector; obtain the connecting edge of the capital flow graph, combine the node feature vector and the connecting edge to obtain graph structure data; in this embodiment, the second transaction feature can be the transaction amount, number of transactions and transaction frequency of each graph node, the transaction feature vector is a feature vector formed by the combination of the second transaction features, and the graph structure feature is a feature vector formed by the combination of graph features; in the capital flow graph, nodes represent addresses, edges represent transactions, and connecting edges refer to edges directly connected to nodes.

[0115] Model unit: used for training the model based on the positive sample, the negative sample and the graph structure data to obtain the graph neural network model;

[0116] Early warning unit: used to warn of potential risk behaviors based on the graph neural network model. The early warning unit is specifically used to: obtain new transaction data, obtain an update node based on the new transaction data, and obtain a first update node feature of the update node; input the new transaction data and the first update node feature into the graph neural network model, update the graph structure data based on the new transaction data, normalize the first update node feature, and obtain a second update node feature; the graph neural network model classifies and warns the update node based on the second update node feature. In this embodiment, the first update node feature can be features such as transaction amount, number of transactions, and transaction frequency.

[0117] Result unit: used to obtain analysis results based on the address anomaly analysis unit, the graph analysis unit and the comprehensive analysis unit.

[0118] Embodiment 2

[0119] Based on Example 1, in this embodiment, the label unit is also used to: build a visual label entry tool, which is used to mark and classify the off-chain data and provide a user visual interface to input and manage data labels; based on a preset review mechanism and user feedback mechanism, update the labels of the label system.

[0120] The visual tag entry tool assists in labeling and classifying off-chain data and empowers on-chain data. Data tags can be intuitively input and managed through a visual interface to ensure that on-chain data can draw on off-chain information when analyzing. A regular review mechanism is established to check updates to the tag system to ensure the accuracy and consistency of tags, and to regularly evaluate and adjust the tag system to ensure that the system reflects the latest industry trends and technological developments. User feedback on the use of the tag system is collected to understand the effects and problems of the tag system in actual applications, and the tag system is adjusted and optimized based on user feedback. While ensuring the efficiency and accuracy of the system, attention is paid to the scalability of the system and the convenience of user interaction.

[0121] Embodiment 3

[0122] Based on the above embodiment, in this embodiment, the system further includes:

[0123] Report unit: used to obtain the monitoring analysis results of the address anomaly analysis unit, the analysis results of the graph analysis unit and the warning results of the comprehensive analysis unit; normalize the monitoring analysis results, the analysis results and the warning results to obtain report data; set prompt words and report templates, and obtain a comprehensive report based on the prompt words, the report template and the report data, and the comprehensive report is used for users to understand the analysis results.

[0124] The monitoring analysis results, the analysis results and the early warning results are normalized to ensure that the data are on the same scale for easy comparison and combination, and are also easy to understand, so as to obtain report data; prompt words and report templates are set, and a comprehensive report is obtained based on the prompt words, the report template and the report data, and the comprehensive report is used for users to understand the analysis results; prompt words are set to provide clear context and analysis focus to the large language model to ensure that the generated text results meet the requirements. The report template may include summary, detailed analysis, risk assessment, recommended measures and other parts.

[0125] Query unit: used to provide interactive query and analysis support based on input data, such as using a large language model (LLM) to process and understand natural language input data from users and data sources, and provide interactive query and analysis support.

[0126] Consultation unit: used to answer users' questions about the comprehensive report.

[0127] A structure display unit is used to aggregate the monitoring and analysis results, the analysis results and the early warning results based on preset dimensions to generate a capital flow network diagram; simplify the capital flow network diagram based on preset rules to obtain a simplified diagram; mark and classify the nodes and edges of the simplified diagram based on the graph neural network model to generate a visual graph network; provide a visualization tool, and operate the visual graph network based on the visualization tool, such as allowing the user to zoom in, zoom out and drag the graph network to view detailed transaction information and paths, etc.; in this embodiment, the preset dimensions may include three dimensions: nodes, edges and graphs;

[0128] The preset rules include: deleting non-gambling related addresses and unmarked nodes; aggregating tail nodes; setting a threshold, and removing non-critical paths based on the threshold.

[0129] Based on the analysis results, the network is aggregated and pruned to generate an easy-to-understand visual graph network to display the flow of funds across the board. The visualization tool dynamically displays and updates in real time, providing real-time data visualization and risk assessment. Users can intuitively view the flow path and key nodes of funds, supporting rapid decision-making and early warning. While ensuring the efficiency and accuracy of the system, attention is paid to the scalability of the system and the convenience of user interaction.

[0130] Therefore, this embodiment establishes a system that accurately identifies and predicts the flow of gambling funds based on blockchain, can adapt to the characteristics of blockchain and the ever-changing regulatory needs, and focuses on system scalability and user interaction convenience.

[0131] On the basis of the above embodiment, in this embodiment, the address anomaly analysis unit further includes:

[0132] Tracking unit: used to obtain the second transaction data of the address to be identified, obtain the second address feature based on the second transaction data, determine whether the address to be identified is a suspected specific gang behavior address based on the second address feature, and if so, obtain the address type of the address to be identified based on a preset judgment rule; analyze the capital flow path of the address to be identified based on the address type and the preset address type search strategy to obtain the second key path; after searching through the preset address type search strategy, mark the capital flow link and transaction counterparty related to the transaction behavior feature exceeding the threshold range, so as to obtain the second key path;

[0133] In this embodiment, the address types may include deposit address, transit address, collection address, redemption address and withdrawal address; deposit address: receiving a large amount of funds, usually from multiple external sources, as the starting point for funds to enter the network; transit address: funds flow out quickly after inflow, and disperse funds from the deposit address to other network nodes to hide the source of funds; collection address: the number of counterparties with inflow of funds is far greater than the number of counterparties with outflow of funds, and it is usually used to concentrate the dispersed funds again; redemption address: receiving the collected funds and conducting large-scale transactions, or having periodic cycle characteristics, usually associated with fiat currency exchanges, over-the-counter (OTC) markets or other redemption services, used to maintain the credibility of the fraud; withdrawal address: the final outflow point of funds, large-scale fund outflows, usually flow to private wallets, exchanges or are laundered through other means, used to achieve actual control of profits.

[0134] The preset judgment rules corresponding to the address type can be: when the amount of inflow funds exceeds the set threshold range, it is judged as a deposit address; when the number of counterparties with outflow funds in the number of counterparties is greater than the number of counterparties with inflow funds, it is judged as a transit address; when the number of counterparties with inflow funds in the number of counterparties is greater than the number of counterparties with outflow funds, it is judged as a collection address; when the transaction is a transaction with an exchange, an OTC market transaction or a currency exchange transaction, it is judged as a redemption address; when the amount of outflow funds exceeds the set threshold range, it is judged as a withdrawal address.

[0135] The preset address type search strategy corresponding to the address type can be: when the address type is a deposit address or a collection address, track the outflow direction of funds from the address; when the address type is a transit address, analyze the path of funds flowing to multiple decentralized addresses; when the address type is a redemption address, analyze the source of the redemption address, or analyze the periodic or repeated inflow amount and transaction time, etc.; when the address type is a withdrawal address, track the extraction method or conversion method of the outflow funds.

[0136] In this embodiment, based on the address type and the preset address type search strategy, when analyzing the fund flow path of the address to be identified, the number of steps for fund tracking can also be set to reduce the situation where the tracking enters an infinite loop.

[0137] A clustering unit: used to obtain a tracking address based on the second key path, and obtain a number of initial clusters based on the tracking address; obtain third transaction data of the tracking address, perform feature extraction on the third data to obtain transaction behavior features, and construct address vector features of the transaction behavior features; calculate the feature vector average value of each initial cluster and the cosine distance between two adjacent initial clusters based on the address vector features; merge all the initial clusters based on a preset minimum average value and a preset minimum distance to obtain a number of merged clusters; obtain an average distance based on all the cosine distances, draw a curve graph based on the average distance, obtain a smoothness based on the curve graph, and obtain the number of merged clusters; determine whether the smoothness is greater than a preset smoothness value, or whether the number is greater than a preset number, if so, update all the initial clusters to all the merged clusters, if not, obtain a number of address clusters based on all the merged clusters, visualize and integrate the address clusters to obtain a tree diagram, and the tree diagram is used to analyze the key nodes of the capital flow path; in this embodiment, the merging can adopt k-means clustering analysis; the transaction behavior features can be features such as transaction frequency, transaction time interval and amount distribution.

[0138] Each tracking address represents an independent entity. As a separate cluster, that is, a node within the cluster, the average feature vector of all points in the cluster is calculated, and the distance between directly connected clusters (two adjacent clusters) is calculated. A minimum average threshold is set, and cluster pairs with a minimum distance below the threshold are merged; the above calculation and merging steps are repeated until the number of clusters is lower than the preset number, or further merging cannot provide additional insights, that is, the turning point in the curve graph where the average cluster distance tends to be flat.

[0139] Language model analysis unit: used to transform the second transaction data to obtain transaction text data, input the transaction text data into the pre-trained language model, and obtain the abnormal probability and abnormal type of the address to be identified; in this embodiment, the pre-trained language model can be a GPT4 model, which is a language model released by OpenAI for the chat robot ChatGPT; the transformation may include processing missing values, removing unreasonable data points, such as data of dust attacks and phishing transactions, unifying data formats, and converting data into a text format acceptable to the model; dust attacks refer to a new type of malicious attack activity, in which hackers and scammers will try to destroy the anonymity of Bitcoin and encrypted Q currency users by sending a very small amount of tokens to the user's private wallet; phishing transactions refer to a type of online fraud, also known as phishing, which sends a large number of deceptive spam emails claiming to be from banks or other well-known institutions, intending to lure recipients to provide sensitive information, such as user names, passwords, account IDs, ATM PIN codes or credit card details.

[0140] Transaction analysis unit: used to analyze the capital flow of blockchain full-node transactions based on the tracking unit, the clustering unit and the language model analysis unit to obtain a first analysis result.

[0141] In this embodiment, it can also be determined whether the abnormal probability is greater than a preset probability threshold. If so, the address to be identified is marked to obtain the first abnormal specific gang behavior address.

[0142] In this embodiment, the address anomaly analysis unit may further include:

[0143] Data processing unit: used to preprocess the second transaction data and the third transaction data and mark the designated addresses in the second transaction data and the third transaction data, and generate address labels, which can ensure the accuracy and efficiency of subsequent analysis; in this embodiment, the preprocessing may include deduplication, format normalization, and noise data filtering, the noise data may include zero-amount transactions and dust attack transactions, and the designated addresses may include black addresses, that is, addresses marked as unsafe or malicious in the network environment, exchanges and hot wallets, that is, wallets that remain online, that is, online wallets. Wallets are tools for storing and using digital currencies. One coin corresponds to one wallet, which is used to store currencies, or "trade" currencies.

[0144] Embodiment 5

[0145] Based on the above embodiment, in this embodiment, the system further includes:

[0146] The first classification unit is used to calculate the entropy of the second transaction data based on the pre-trained first classification model, divide the second address feature based on a preset threshold range, and obtain address feature sets of different classifications; calculate the conditional entropy of each address feature set; obtain the information gain value and split value of the second address feature based on the entropy and the conditional entropy, and obtain the information gain ratio of the second address feature based on the information gain value and the split value; obtain the split point based on the highest information gain ratio; split the second transaction data based on the split point to obtain a number of subsets; calculate all the subsets based on the classification label to obtain the category probability, and obtain the first specific gang behavior probability of the address to be identified based on the category probability; in this embodiment, the pre-trained first classification model can be a CART (Classification and Regression Trees) model, and its model structure can be an input layer: receiving data; decision node: dividing the data into two or more subsets according to the set judgment criteria; leaf node: representing the decision result, each leaf node corresponds to a classification label, such as "normal" or "abnormal", Iterative Dichotomiser 3 model, RandomForest model or XGBoost model and other decision tree models;

[0147] The calculation of its category probability can be as follows: input the address features related to the address to be identified into the pre-trained CART model, search in the decision tree according to its address features until the leaf node is reached, and then calculate the probability of the corresponding category according to the number of data points in the leaf node and the total number of data points in the leaf node.

[0148] The second classification unit is used to expand the address to be identified based on the pre-trained second classification model to obtain a network representation graph, such as taking the address to be identified as the initial node, the transaction relationship of the address as the edge, and the feature vector composed of the transaction behavior characteristics of the address, and expanding several layers of node neighbors of the node to form a network representation graph; obtaining a first representation of the address to be identified based on the network representation graph, updating the first representation to obtain a second representation, and obtaining a second specific gang behavior probability of the address to be identified based on the second representation; in this embodiment, the pre-trained second classification model can be a graph neural network model such as a GraphSAGE (Graph SAmple and aggreGatE) model, a GCN (Graph Convolutional Network) model, and a GAT (Graph Attention Networks) model;

[0149] Probability unit: used to merge the first specific group behavior probability and the second specific group behavior probability to obtain a total specific group behavior probability, and determine whether the address to be identified is a specific group behavior address based on the total specific group behavior probability.

[0150] In this embodiment, it can also include determining whether the total probability of specific group behavior is greater than a preset probability threshold, and if so, marking the address to be identified to obtain a second abnormal specific group behavior address.

[0151] Embodiment 6

[0152] On the basis of the above embodiment, in this embodiment, the first calculation formula for obtaining the average value of the feature vector is:

[0153]

[0154] The second calculation formula for obtaining the cosine distance is:

[0155]

[0156] Among them, C i represents the average value of the feature vector of the i-th initial cluster, n represents the number of initial clusters, x i represents the address vector feature of the i-th initial cluster, i represents the i-th initial cluster, d(C i ,C j ) represents the cosine distance between the i-th initial cluster and the j-th initial cluster, represents the average address vector feature of the i-th initial cluster, Represents the average address vector characteristics of the jth initial cluster.

[0157] Embodiment 7

[0158] Based on the above embodiment, in this embodiment, the third calculation method for obtaining the node degree centrality is:

[0159] C D (v) = D in (v)+D out (v);

[0160] Among them, v represents a graph node, C D (v) represents the node degree centrality of graph node v, D in (v) represents the number of incoming edges of graph node v, D out (v) represents the number of outgoing edges of graph node v;

[0161] A fourth calculation method to obtain the betweenness centrality is:

[0162]

[0163] Among them, C B (v) represents the betweenness centrality of graph node v, s represents the betting node, t represents the payout node, σ st represents the total number of shortest paths from the betting node to the payout node, σ st (v) represents the number of shortest paths from the betting node to the payout node that pass through the graph node v;

[0164] The fifth calculation method for obtaining the clustering coefficient is:

[0165]

[0166] Among them, C(v) represents the clustering coefficient of graph node v, D(v) represents the number of edges directly connected to graph node v, and T(v) represents the number of triangles containing graph node v;

[0167] The sixth calculation method for obtaining the PageRank value is:

[0168]

[0169] Among them, PR(v) represents the PageRank value of graph node v, d represents the damping factor, N represents the total number of graph nodes, N(v) represents the set of neighbor nodes of graph node v, u represents the node in the neighbor node set, PR(u) represents the PageRank value of node u, and D(u) represents the number of edges directly connected to node u.

[0170] Embodiment 8

[0171] On the basis of the above embodiment, in this embodiment, the seventh calculation formula for obtaining the entropy is:

[0172] Entropy(D)=-p0log2(p0)-p1log2(p1);

[0173] The eighth calculation formula for obtaining the information gain value is:

[0174]

[0175] The ninth calculation formula for obtaining the split value is:

[0176]

[0177] The tenth calculation formula for obtaining the information gain ratio is:

[0178]

[0179] The eleventh calculation formula for obtaining the class probability is:

[0180]

[0181] When the classification label is a specific group behavior label, the twelfth calculation formula for obtaining the first specific group behavior probability is:

[0182] P CART =P(C);

[0183] When the classification label is a normal behavior label, the thirteenth calculation formula for obtaining the first specific group behavior probability is:

[0184] P CART =1-P(C);

[0185] Where Entropy(D) represents entropy, D represents the second transaction data, p0 represents the proportion of normal transactions, p1 represents the proportion of transactions involving specific group behaviors, Gain(D,f1) represents the information gain value of the second address feature, f1 represents the second address feature, Entropy(D high )、Entropy(D medium ) and Entropy( Dlow ) represents the conditional entropy of different address feature sets, D high , D medium and D low represents the address feature set of different classifications, SplitInfo(D,f1) represents the split value of the second address feature, Gain Ratio(D,f1) represents the information gain ratio of the second address feature, Ρ(C) represents the category probability, C represents the classification label, N1 represents the number of data points of the address feature set of different classifications, N2 represents the number of data points of the second transaction data, P CART Represents the probability of the first specific gang behavior.

[0186] If the given classification labels of C include normal labels and abnormal labels, when the leaf node finally searched represents the abnormal label, P CART =P(C); When the final searched leaf node represents a normal label, P CART =1-P(C);P CART The predicted probability that the address to be identified is the address of a specific gang behavior.

[0187] Embodiment 9

[0188] On the basis of the above embodiment, in this embodiment, the fourteenth calculation formula for obtaining the first representation is:

[0189]

[0190] The fifteenth calculation formula for obtaining the second representation is:

[0191]

[0192] The sixteenth calculation formula for obtaining the probability of the second specific group behavior is:

[0193]

[0194] The seventeenth calculation formula for obtaining the total probability of specific gang behavior is:

[0195]

[0196] Where a represents a node in the network representation graph, N(a) represents the set of sampled neighbor nodes of node a, represents the first representation of the set of sampled neighbor nodes of the pre-trained second classification model t layer, MEAN() represents the aggregation function, represents the representation of node b in the t-1 layer of the pre-trained second classification model, where b represents a node in the sampled neighbor node set. represents the second representation of node a in the t layer of the pre-trained second classification model, σ represents the activation function, and W t Represents the weight matrix of the pre-trained second classification model t layer, CONCAT() represents concatenation, represents the second representation of node a in the t-1 layer of the pre-trained second classification model, P GraphSAGE represents the probability of the second specific gang behavior, softmax() represents the softmax activation function, W and B both represent learning parameters, represents the second representation of node a in the last layer of the pre-trained second classification model, P final represents the total probability of specific gang behavior, represents the weight of the probability of the first specific gang behavior, P CART Represents the probability of the first specific gang behavior.

[0197] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0198] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. The intelligent fund analysis system for the behavior of specific blockchain gangs is characterized by: The system comprises: Data collection unit: used to build a blockchain full node and database, collect on-chain data and off-chain data on the blockchain full node, classify and label the on-chain data and the off-chain data, obtain a number of data points, and create metadata for each of the data points; Data fusion unit: used for fusing all the data points to obtain first data; Label unit: used for building a label system, classifying and labeling the first data based on the label system and the metadata, obtaining second data, and storing the second data in the database; An address anomaly analysis unit: used for obtaining first transaction data of a specific group behavior address based on the second data, obtaining first address features of the specific group behavior address based on the first transaction data, obtaining an abnormal behavior model based on the first address features, and monitoring and analyzing the address to be identified based on the abnormal behavior model to determine whether there is a specific group behavior; A graph analysis unit: used to construct a capital flow graph, extract graph features of the capital flow graph, and obtain a first key node and a first key path based on the graph features; Comprehensive analysis unit: used for obtaining a node feature vector based on the graph feature; obtaining a graph neural network model based on the node feature vector, and warning of potential risk behaviors based on the graph neural network model; Result unit: used to obtain analysis results based on the address anomaly analysis unit, the graph analysis unit and the comprehensive analysis unit.

2. The intelligent financial analysis system for blockchain specific group behavior according to claim 1 is characterized in that: The data points include on-chain data points and off-chain data points; the data fusion unit specifically includes: The first fusion unit is used to convert the images and preset documents in all the off-chain data points into text data, obtain the off-chain text data, and extract the key entities and key semantics of the off-chain text data; A second fusion unit: used for performing unified processing on all the data points to obtain a plurality of first data points; A third fusion unit: configured to fuse all the first data points based on a preset matching rule, the metadata, the key entity and the key semantics to obtain preliminary fused data; The fourth fusion unit is used to review and verify the preliminary fusion data to obtain the first data.

3. The intelligent fund analysis system for blockchain specific group behavior according to claim 1 is characterized in that: The address anomaly analysis unit also includes: Tracking unit: used to obtain the second transaction data of the address to be identified, obtain the second address feature based on the second transaction data, determine whether the address to be identified is a suspected specific gang behavior address based on the second address feature, and if so, obtain the address type of the address to be identified based on a preset judgment rule; analyze the capital flow path of the address to be identified based on the address type and the preset address type search strategy to obtain the second key path; Clustering unit: used to obtain a tracking address based on the second critical path, and obtain a number of initial clusters based on the tracking address; obtain the third transaction data of the tracking address, perform feature extraction on the third data to obtain transaction behavior features, and construct address vector features of the transaction behavior features; calculate the feature vector average value of each initial cluster and the cosine distance between two adjacent initial clusters based on the address vector features; merge all the initial clusters based on a preset minimum average value and a preset minimum distance to obtain a number of merged clusters; obtain an average distance based on all the cosine distances, draw a curve graph based on the average distance, obtain a smoothness based on the curve graph, and obtain the number of merged clusters; determine whether the smoothness is greater than a preset smoothness value, or whether the number is greater than a preset number, if so, update all the initial clusters to all the merged clusters, if not, obtain a number of address clusters based on all the merged clusters, visualize and integrate the address clusters, and obtain a tree diagram, which is used to analyze the key nodes of the capital flow path; A language model analysis unit is used to transform the second transaction data to obtain transaction text data, input the transaction text data into a pre-trained language model, and obtain an abnormal probability and an abnormal type of the address to be identified; Transaction analysis unit: used to analyze the capital flow of blockchain full-node transactions based on the tracking unit, the clustering unit and the language model analysis unit to obtain a first analysis result.

4. The intelligent financial analysis system for blockchain specific group behavior according to claim 1 is characterized in that: The graph analysis unit specifically includes: A construction unit: configured to preset a construction rule, obtain a first address based on the second data, use the first address as an initial node, and construct an initial graph; An expansion unit: used for setting a maximum path length, and expanding the initial graph based on the maximum path length and a preset transaction rule to obtain an expanded graph; Search unit: used for obtaining a first transaction feature based on the abnormal group behavior pattern, searching the extended graph based on the first transaction feature and a preset search rule, obtaining a pattern node, marking the pattern node, classifying the pattern node based on a preset identity category, and obtaining the capital flow graph; Feature unit: used to obtain several graph nodes of the capital flow graph, calculate the node information of each graph node, obtain the graph feature based on the node information, and obtain the first key node and the first key path based on the graph feature; the node information includes node degree centrality, betweenness centrality, clustering coefficient and PageRank value.

5. The intelligent financial analysis system for blockchain specific group behavior according to claim 4 is characterized in that: The comprehensive analysis unit specifically includes: Data unit: used to take the pattern nodes in the capital flow graph as positive samples and the unlabeled nodes in the capital flow graph as negative samples; obtain the second transaction feature of each graph node, and obtain a transaction feature vector based on the second transaction feature; obtain a graph structure feature based on the graph feature, and obtain a graph structure feature vector based on the graph structure feature; concatenate and normalize the transaction feature vector and the graph structure feature vector to obtain the node feature vector; obtain the connection edge of the capital flow graph, and combine the node feature vector and the connection edge to obtain graph structure data; Model unit: used for training the model based on the positive sample, the negative sample and the graph structure data to obtain the graph neural network model; Early warning unit: used to obtain new transaction data, obtain an update node based on the new transaction data, and obtain a first update node feature of the update node; input the new transaction data and the first update node feature into the graph neural network model, update the graph structure data based on the new transaction data, normalize the first update node feature, and obtain a second update node feature; the graph neural network model classifies and warns the update node based on the second update node feature.

6. The intelligent financial analysis system for blockchain specific group behavior according to claim 1 is characterized in that: The system further comprises: A first classification unit: used to calculate the entropy of the second transaction data based on a pre-trained first classification model, divide the second address feature based on a preset threshold range, and obtain address feature sets of different classifications; calculate the conditional entropy of each address feature set; obtain the information gain value and split value of the second address feature based on the entropy and the conditional entropy, and obtain the information gain ratio of the second address feature based on the information gain value and the split value; obtain a split point based on the highest information gain ratio; split the second transaction data based on the split point to obtain a number of subsets; calculate all the subsets based on the classification labels to obtain the category probability, and obtain the first specific gang behavior probability of the address to be identified based on the category probability; A second classification unit is used to expand the address to be identified based on the pre-trained second classification model to obtain a network representation graph, obtain a first representation of the address to be identified based on the network representation graph, update the first representation to obtain a second representation, and obtain a second specific gang behavior probability of the address to be identified based on the second representation; Probability unit: used to merge the first specific group behavior probability and the second specific group behavior probability to obtain a total specific group behavior probability, and determine whether the address to be identified is a specific group behavior address based on the total specific group behavior probability.

7. The intelligent financial analysis system for blockchain specific group behavior according to claim 3 is characterized in that: The first calculation formula for obtaining the average value of the characteristic vector is: The second calculation formula for obtaining the cosine distance is: Among them, C i represents the average value of the feature vector of the i-th initial cluster, n represents the number of initial clusters, x i represents the address vector feature of the i-th initial cluster, i represents the i-th initial cluster, d(C i ,C j ) represents the cosine distance between the i-th initial cluster and the j-th initial cluster, represents the average address vector feature of the i-th initial cluster, Represents the average address vector characteristics of the jth initial cluster.

8. The intelligent financial analysis system for blockchain specific group behavior according to claim 4 is characterized in that: The third calculation method for obtaining the node degree centrality is: C D (in)=D in (v)+D out (in); Among them, v represents a graph node, C D (v) represents the node degree centrality of graph node v, D in (v) represents the number of incoming edges of graph node v, D out (v) represents the number of outgoing edges of graph node v; A fourth calculation method to obtain the betweenness centrality is: Among them, C B (v) represents the betweenness centrality of graph node v, s represents the betting node, t represents the payout node, σ st represents the total number of shortest paths from the betting node to the payout node, σ st (v) represents the number of shortest paths from the betting node to the payout node that pass through the graph node v; The fifth calculation method for obtaining the clustering coefficient is: Among them, C(v) represents the clustering coefficient of graph node v, D(v) represents the number of edges directly connected to graph node v, and T(v) represents the number of triangles containing graph node v; The sixth calculation method for obtaining the PageRank value is: Among them, PR(v) represents the PageRank value of graph node v, d represents the damping factor, N represents the total number of graph nodes, N(v) represents the set of neighbor nodes of graph node v, u represents the node in the neighbor node set, PR(u) represents the PageRank value of node u, and D(u) represents the number of edges directly connected to node u.

9. The intelligent financial analysis system for blockchain specific group behavior according to claim 6 is characterized in that: The seventh calculation formula for obtaining the entropy is: Entropy(D)=-p0log2(p0)-p1log2(p1); The eighth calculation formula for obtaining the information gain value is: The ninth calculation formula for obtaining the split value is: The tenth calculation formula for obtaining the information gain ratio is: The eleventh calculation formula for obtaining the class probability is: When the classification label is a specific group behavior label, the twelfth calculation formula for obtaining the first specific group behavior probability is: P.S CART HΡ(C) When the classification label is a normal behavior label, the thirteenth calculation formula for obtaining the first specific group behavior probability is: P.S CART N1-Ρ(C) Where Entropy(D) represents entropy, D represents the second transaction data, p0 represents the proportion of normal transactions, p1 represents the proportion of transactions involving specific group behaviors, Gain(D,f1) represents the information gain value of the second address feature, f1 represents the second address feature, Entropy(D high )、Entropy(D medium ) and Entropy( Dlow ) represents the conditional entropy of different address feature sets, D high , D medium and D low represents the address feature set of different classifications, SplitInfo(D,f1) represents the split value of the second address feature, Gain Ratio(D,f1) represents the information gain ratio of the second address feature, Ρ(C) represents the category probability, C represents the classification label, N1 represents the number of data points of the address feature set of different classifications, N2 represents the number of data points of the second transaction data, P CART Represents the probability of the first specific gang behavior.

10. The intelligent financial analysis system for blockchain specific group behavior according to claim 6 is characterized in that: The fourteenth calculation formula for obtaining the first representation is: The fifteenth calculation formula for obtaining the second representation is: The sixteenth calculation formula for obtaining the probability of the second specific group behavior is: The seventeenth calculation formula for obtaining the total probability of specific gang behavior is: Where a represents a node in the network representation graph, N(a) represents the set of sampled neighbor nodes of node a, represents the first representation of the set of sampled neighbor nodes of the pre-trained second classification model t layer, MEAN() represents the aggregation function, represents the representation of node b in the t-1 layer of the pre-trained second classification model, where b represents a node in the sampled neighbor node set. represents the second representation of node a in the t layer of the pre-trained second classification model, σ represents the activation function, and W t Represents the weight matrix of the pre-trained second classification model t layer, CONCAT() represents concatenation, represents the second representation of node a in the t-1 layer of the pre-trained second classification model, P GraphSAGE represents the probability of the second specific gang behavior, softmax() represents the softmax activation function, W and B both represent learning parameters, represents the second representation of node a in the last layer of the pre-trained second classification model, P final represents the total probability of specific gang behavior, represents the weight of the probability of the first specific gang behavior, P CART Represents the probability of the first specific gang behavior.

Images