Ethereum user behavior analysis method based on heterogeneous condition coding and decoding architecture

Abstract

The invention discloses an Ethereum user behavior analysis method based on a heterogeneous condition coding and decoding architecture, and belongs to the technical field of artificial intelligence and block chain behavior analysis. The method comprises the following steps: modeling an Ethereum interaction network into a directed heterogeneous graph for distinguishing a user type and an interaction type, and defining six meta-interaction types to carry out one-hot coding; aggregating neighbor source user features from a target user perspective to generate neighborhood features, and inputting the target features and meta interaction features into an encoder to output an intermediate hidden state; reconstructing and generating features through a feature decoder, and aggregating different interactive features by using attention to obtain enhanced features of a target user; splicing the original features and inputting the original features into a heterogeneous graph neural network to detect malicious behaviors; meanwhile, neighborhood features and hidden states are symmetrically generated from the perspective of a source user, and an adjacent matrix is reconstructed through a structure decoder to construct an auxiliary learning target. According to the method, refined interactive semantic modeling is realized, multi-type interactive modes are adaptively learned, topological relation characterization is enhanced, and the detection accuracy is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of artificial intelligence and blockchain behavior analysis, and in particular relates to an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture. Background Art

[0002] With the rapid development of blockchain technology, it has been widely applied in various fields. Ethereum, with its revolutionary smart contract technology, has rapidly risen to prominence, and with it a growing number of users, a growing number of problems have emerged. Smart contracts derive their functionality from code logic. To meet ever-changing user needs, contract functionality continues to grow and become increasingly complex, further increasing the difficulty of analyzing user behavior. In this context, how to effectively mine Ethereum user behavior patterns for efficient illegal activity detection and maintain Ethereum security has become a hot research topic.

[0003] The Ethereum network is highly complex due to the diverse user types and complex interactions between them. Furthermore, the high user activity leads to a massive amount of interaction data, making it difficult to extract effective information from this interaction data to capture user behavior. Existing methods introduce graph neural network algorithms to model Ethereum interactions as homogeneous or heterogeneous graphs, and combine them with downstream graph neural network algorithms to learn user behavior patterns and detect illegal behavior. However, homogeneous graph-based modeling ignores type information, making it impossible to fully model and learn user behavior representations. Existing heterogeneous graph methods distinguish between user and edge types, which can more comprehensively model user behavior, but also significantly increase graph complexity. Furthermore, such methods often use meta-paths to define fixed user behavior patterns to enhance detection, which makes the model lack versatility. Summary of the Invention

[0004] In order to solve the above technical problems, the present invention proposes an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture to solve the problems existing in the above-mentioned prior art.

[0005] In a first aspect, to achieve the above-mentioned objectives, the present invention provides an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture, comprising the following steps:

[0006] The Ethereum interaction network is modeled as a directed heterogeneous graph from source users to target users, distinguishing between user types and interaction types;

[0007] The triple consisting of source user, target user and interaction behavior is defined as meta-interaction type, and the meta-interaction type is one-hot encoded to generate meta-interaction type features;

[0008] From the perspective of the target user, the neighbor source user features are aggregated based on different meta-interaction types to generate the neighborhood features of the target user;

[0009] Input the target user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the target user's intermediate hidden state;

[0010] The intermediate hidden state is input into the feature decoder to reconstruct the generated features of the target user under the meta-interaction behavior;

[0011] Aggregate the generated features under different meta-interaction behaviors through the attention mechanism to obtain the enhanced features of the target user;

[0012] Concatenate enhanced features with original features and combine them with the original adjacency matrix to input into heterogeneous graph neural network to detect malicious behavior;

[0013] From the perspective of the source user, aggregate the neighbor target user features to generate the source user neighborhood features;

[0014] Input the source user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the source user's intermediate hidden state;

[0015] The intermediate hidden states of the target user and the source user under the same meta-interaction are input into the structural decoder to reconstruct the adjacency matrix and construct the auxiliary learning objective.

[0016] Optionally, the user type includes external users and contract users;

[0017] The interaction types include calls and transactions; the meta-interaction types are defined as six triples:

[0018] Contract users point to contract users through calls, contract users point to contract users through transactions, contract users point to external users through transactions, external users point to contract users through calls, external users point to contract users through transactions, and external users point to external users through transactions.

[0019] Optionally, the process of generating the target user neighborhood features includes:

[0020] Extract the neighbor source user features of the target user under a specific meta-interaction type;

[0021] Average and aggregate the neighbor source user features to obtain the neighborhood features of the target user under this meta-interaction type;

[0022] The process of generating source user neighborhood features includes:

[0023] Extract the neighbor target user features of the source user under a specific meta-interaction type;

[0024] The neighbor target user features are averaged and aggregated to obtain the neighborhood features of the source user under this meta-interaction type.

[0025] Optionally, the encoder is a two-layer multi-layer perceptron;

[0026] Input the concatenated vector of target user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the target user;

[0027] Input the concatenated vector of source user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the source user;

[0028] The encoder parameters of the target user are shared with the source user.

[0029] Optionally, the process of reconstructing the target user-generated features includes:

[0030] The target user's intermediate hidden state, neighborhood features, and meta-interaction type features are input into a feature decoder composed of two layers of multi-layer perceptrons to reconstruct the generated features;

[0031] The attention mechanism aggregation process includes:

[0032] The importance weight of each meta-interaction type is calculated through the meta-interaction level attention vector;

[0033] The generated features under different meta-interaction types are fused according to the weights to obtain the enhanced features of the target user.

[0034] Optionally, the process of reconstructing the adjacency matrix includes:

[0035] Input the target user intermediate hidden state and the source user intermediate hidden state under the same meta-interaction type into the structure decoder;

[0036] Generate the reconstructed adjacency matrix under this meta-interaction type through matrix multiplication;

[0037] The auxiliary learning objective is constructed by calculating the mean square error between the reconstructed adjacency matrix and the original adjacency matrix.

[0038] In a second aspect, the present invention further provides an Ethereum user behavior analysis system based on a heterogeneous conditional encoding and decoding architecture, which is used to implement an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture, and the system includes:

[0039] The network modeling module is used to model the Ethereum interaction network as a directed heterogeneous graph from source users to target users, distinguish between user types and interaction types, and define the triple consisting of source user, target user and interaction behavior as a meta-interaction type;

[0040] Feature encoding module, used to perform one-hot encoding on meta-interaction types to generate meta-interaction type features;

[0041] A neighborhood aggregation module is used to aggregate neighbor source user features based on different meta-interaction types from the perspective of the target user to generate target user neighborhood features, and to aggregate neighbor target user features from the perspective of the source user to generate source user neighborhood features;

[0042] A conditional encoding module, configured to input target user features into an encoder and output the target user's intermediate hidden state conditioned on neighborhood features and meta-interaction type features, and to input source user features into an encoder and output the source user's intermediate hidden state conditioned on neighborhood features and meta-interaction type features;

[0043] The feature decoding module is used to input the intermediate hidden state of the target user into the feature decoder to reconstruct the generated features under the meta-interaction behavior;

[0044] Attention aggregation module, which is used to aggregate the generated features under different meta-interaction behaviors through the attention mechanism to obtain the enhanced features of the target user;

[0045] The behavior detection module is used to combine enhanced features with original features and input the original adjacency matrix into a heterogeneous graph neural network to detect malicious behavior;

[0046] The structural decoding module is used to input the intermediate hidden states of the target user and the source user under the same meta-interaction into the structural decoder to reconstruct the adjacency matrix and construct the auxiliary learning target.

[0047] Optional modeling modules include:

[0048] User type definition unit, used to distinguish external users from contract users;

[0049] Interaction type definition unit, used to distinguish between calls and transactions;

[0050] The meta-interaction construction unit is used to construct six types of meta-interactions: contract users pointing to contract users through calls, contract users pointing to contract users through transactions, contract users pointing to external users through transactions, external users pointing to contract users through calls, external users pointing to contract users through transactions, and external users pointing to external users through transactions.

[0051] In a third aspect, the present invention further provides a computer terminal device, comprising:

[0052] one or more processors;

[0053] a memory, coupled to the processor, for storing one or more programs;

[0054] When the one or more programs are executed by the one or more processors, the one or more processors implement an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture.

[0055] In a fourth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture.

[0056] Compared with the prior art, the present invention has the following advantages and technical effects:

[0057] The present invention provides an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture. The present invention refines the modeling of user interaction semantics through meta-interaction types to avoid preset meta-path restrictions; adaptively learns multiple types of interaction patterns based on the heterogeneous conditional encoding and decoding architecture, and strengthens the topological relationship representation by combining dual-view hidden state learning and graph structure reconstruction tasks; and generates enhanced representations by fusing multiple interaction features through an attention mechanism to improve the accuracy of malicious behavior detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings, which constitute part of the present invention, are provided to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are provided to explain the present invention and do not constitute an undue limitation of the present invention. In the accompanying drawings:

[0059] Figure 1 This is a flow chart of a malicious behavior detection architecture method according to an embodiment of the present invention;

[0060] Figure 2 This is a task framework diagram of the malicious behavior detection method according to an embodiment of the present invention;

[0061] Figure 3 This is a diagram of a user-enhanced feature-assisted learning framework according to an embodiment of the present invention;

[0062] Figure 4 This is a framework diagram of a malicious behavior detection system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0063] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0064] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0065] Example 1

[0066] like Figure 1 As shown, this embodiment provides an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture, including:

[0067] The Ethereum interaction network is modeled as a directed heterogeneous graph from source users to target users, distinguishing between user types and interaction types;

[0068] The triple consisting of source user, target user and interaction behavior is defined as meta-interaction type, and the meta-interaction type is one-hot encoded to generate meta-interaction type features;

[0069] From the perspective of the target user, the neighbor source user features are aggregated based on different meta-interaction types to generate the neighborhood features of the target user;

[0070] Input the target user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the target user's intermediate hidden state;

[0071] The intermediate hidden state is input into the feature decoder to reconstruct the generated features of the target user under the meta-interaction behavior;

[0072] Aggregate the generated features under different meta-interaction behaviors through the attention mechanism to obtain the enhanced features of the target user;

[0073] Concatenate enhanced features with original features and combine them with the original adjacency matrix to input into heterogeneous graph neural network to detect malicious behavior;

[0074] From the perspective of the source user, aggregate the neighbor target user features to generate the source user neighborhood features;

[0075] Input the source user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the source user's intermediate hidden state;

[0076] The intermediate hidden states of the target user and the source user under the same meta-interaction are input into the structural decoder to reconstruct the adjacency matrix and construct the auxiliary learning objective.

[0077] Specifically, S1: Aiming at the complex interaction behaviors between multiple types of users in the Ethereum platform, we distinguish users and interaction types and model the Ethereum interaction network as a directed heterogeneous graph from source users to target users;

[0078] S2: The triple consisting of the source user, the target user, and the corresponding interaction behavior is regarded as a meta-interaction type. The meta-interaction type is encoded using the one-hot encoding method to obtain a specific meta-interaction type feature;

[0079] S3: Learning from the perspective of the target user, targeting the various meta-interaction situations around the target user, aggregates source users based on different meta-interaction types to obtain the neighborhood features of the target user under different meta-interaction behaviors;

[0080] S4: Take the target user features as input, its neighborhood features and corresponding meta-interaction type features as conditions, and input them into the encoder of the heterogeneous CVAE model to obtain the intermediate hidden state of the target user;

[0081] S5: Input the intermediate hidden state of the target user into the feature decoder to reconstruct the generated features of the target user under different meta-interaction behaviors. Then, use the attention mechanism to aggregate the features generated under different meta-interaction behaviors to obtain the enhanced features of the final target user.

[0082] S6: Concatenate the enhanced features with the original features and input them into the downstream heterogeneous graph neural network module in combination with the original adjacency matrix to learn user behavior and detect malicious behavior;

[0083] S7: To enable the encoder to mine deeper topological structure information, an auxiliary learning module is designed to learn from the perspective of the source user. First, the target users under different meta-interaction behaviors around the source user are aggregated as the neighborhood features of the source user under different meta-interaction behaviors.

[0084] S8: Same as S4, combining the source user’s neighborhood features and meta-interaction type features, and the source user features, and inputting them into the parameter-sharing encoder to obtain the source user’s intermediate hidden state;

[0085] S9: Combine the intermediate hidden states of the target user and the intermediate hidden states of the source user under the same meta-interaction relationship, input them into the structure decoder, reconstruct the reconstructed adjacency matrix under the meta-interaction relationship, and construct the auxiliary learning target.

[0086] As an implementation method of this embodiment, the user types include external users and contract users;

[0087] The interaction types include calls and transactions; the meta-interaction types are defined as six triples:

[0088] Contract users point to contract users through calls, contract users point to contract users through transactions, contract users point to external users through transactions, external users point to contract users through calls, external users point to contract users through transactions, and external users point to external users through transactions.

[0089] Specifically, step S1 includes: on the Ethereum platform, users are divided into two categories: external users (EOA) and contract users (CA), and interaction behaviors are mainly divided into two types: call and transaction. Through different users and different interaction behaviors, the Ethereum interaction network is modeled as a directed heterogeneous graph from source users to target users, where the target user is defined as , the source user is defined as Specifically, based on the actual interaction situation of Ethereum, six triple structures combining user type, target user type and interaction type are constructed, which are called meta-interactions and recorded as .

[0090] For more details, please refer to the attached Figure 2 As stated, Figure 2 For Figure 1 The flowchart shown in the figure provides a detailed description of generating target user enhanced features in a heterogeneous codec architecture for malicious behavior detection. The specific process is as follows:

[0091] S1: Based on the actual interaction situation of Ethereum, the types of head, tail and middle users are distinguished to obtain six combination forms, which are called meta-interaction relationships , respectively:

[0092]

[0093] Among them, the symbols in the brackets are corresponding to various meta-interaction types. According to different meta-interaction types, construct meta-interaction types ,in Indicates the user type.

[0094] Specifically, in step S2, one-hot encoding is used to encode the corresponding meta-interaction behaviors for different meta-interaction behaviors, and the features corresponding to each meta-interaction type are obtained, which are recorded as .

[0095] More specifically, S2: For different meta-interaction behaviors, one-hot encoding technology is used to encode the corresponding meta-interaction behaviors and obtain the feature vector of the meta-interaction type. , the specific encoding format is as follows:

[0096]

[0097] As an implementation method of this embodiment, the process of generating the target user neighborhood features includes:

[0098] Extract the neighbor source user features of the target user under a specific meta-interaction type;

[0099] Average and aggregate the neighbor source user features to obtain the neighborhood features of the target user under this meta-interaction type;

[0100] The process of generating source user neighborhood features includes:

[0101] Extract the neighbor target user features of the source user under a specific meta-interaction type;

[0102] The neighbor target user features are averaged and aggregated to obtain the neighborhood features of the source user under this meta-interaction type.

[0103] Specifically, step S3 extracts neighbor source users around the target user under a specific interaction type, aggregates and averages the features of the neighbor source users, and obtains a neighborhood feature representation of the target user under the meta-interaction behavior.

[0104] More specifically, S3: Aggregate target users from the perspective of target users exist Source user characteristics under meta-interaction type , get the target user Domain characteristics under meta-interaction , the formula is as follows:

[0105]

[0106] in, Indicates target users Based on meta-interaction The total number of neighbor users.

[0107] As an implementation method in this embodiment, the encoder is a two-layer multi-layer perceptron;

[0108] Input the concatenated vector of target user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the target user;

[0109] Input the concatenated vector of source user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the source user;

[0110] The encoder parameters of the target user are shared with the source user.

[0111] Specifically, step S4 uses the target user features as encoder input, and its domain features and corresponding meta-interaction type as conditions, and inputs them into the CVAE encoder to obtain the intermediate hidden state of the target user under the meta-interaction type.

[0112] More specifically, S4.1: Target user characteristics As input, its domain characteristics and corresponding meta-interaction type characteristics As a condition, input to the CVAE encoder In the example, the encoder is trained using a two-layer multi-layer perceptron, and the formula is as follows:

[0113]

[0114] in, , Represent the parameter matrices of the first and second layers of the multilayer perceptron respectively. After encoding, the intermediate hidden state of the target user is obtained .

[0115] S4.2: Calculate the KL divergence of the target user's intermediate hidden state to optimize the encoder performance. The specific formula is as follows:

[0116]

[0117] in, Indicates the number of meta-interaction types, Relative entropy measures the similarity of two distributions.

[0118] As an implementation method of this embodiment, the process of reconstructing the target user generated features includes:

[0119] The target user's intermediate hidden state, neighborhood features, and meta-interaction type features are input into a feature decoder composed of two layers of multi-layer perceptrons to reconstruct the generated features;

[0120] The attention mechanism aggregation process includes:

[0121] The importance weight of each meta-interaction type is calculated through the meta-interaction level attention vector;

[0122] The generated features under different meta-interaction types are fused according to the weights to obtain the enhanced features of the target user.

[0123] Specifically, step S5 includes:

[0124] S5.1: Combine the intermediate hidden state and the conditional vector and input them into the feature decoder to reconstruct the generated features of the target user under different meta-interaction behaviors;

[0125] S5.2: Through meta-interaction-level attention learning, the importance index of users under each meta-interaction type is aggregated based on this index to obtain the enhanced features of the final target user.

[0126] More specifically, S5.1: Combining conditional vectors and , and the generated intermediate hidden state of the target user Common input feature decoder In the feature decoder, a two-layer multi-layer perceptron is used for feature mapping, and the formula is as follows:

[0127]

[0128] Reconstruct the generated features of the target user under different meta-interaction behaviors through the feature decoder .in, , Represent the parameter matrices of the first and second layer multilayer perceptrons respectively.

[0129] S5.2: Based on generated features and input features , calculate the feature reconstruction loss function as follows:

[0130]

[0131] in, Indicates the total number of neighbors of the target user, Indicates the type of meta-interaction between the target user and the source user. Generated via the reparameterization technique.

[0132] S5.3: Aggregate the generated target user features under each meta-interaction behavior through the meta-interaction level attention mechanism to obtain the enhanced features of the target user. First, introduce the meta-interaction level attention vector ,use Function calculation Importance scores of generated features under meta-interaction behaviors , the specific calculation process is as follows:

[0133]

[0134] in, is the weight matrix, is the deviation vector. After obtaining the importance of each meta-interaction behavior, the generated features under each meta-interaction behavior are fused , and obtain the final enhanced features of the target user:

[0135]

[0136] in, is the number of meta-interaction behavior types, For target users The final enhancement feature.

[0137] Specifically, step S6 concatenates the enhanced features and original features of the target user to obtain the enhanced user representation, and then combines the original adjacency matrix to perform graph message passing and update, and obtains the final user representation by fusing structural information, which is input into the downstream classifier to realize malicious behavior detection.

[0138] More specifically, S6.1: Target users Enhanced features and original features Splicing to obtain its enhanced user representation , combined with the original adjacency matrix of the target user and the source user , and are input into the downstream HGNN for malicious behavior detection tasks.

[0139]

[0140] in, For target users The end user representation is input into the downstream classifier to achieve the malicious behavior detection task.

[0141] S6.2: Calculate the loss function for malicious behavior detection, using cross entropy as the objective function and a multi-layer perceptron as the classifier. The formula is as follows:

[0142]

[0143] in, Indicates the number of users that need to be tested.

[0144] Specifically, step S7 is a process starting from the perspective of the source user, which averages and aggregates the neighbor target user features of the source user under a specific meta-interaction to obtain the neighborhood features of the source user under the meta-interaction type.

[0145] For more details, please refer to the attached Figure 3 As stated, Figure 3 For Figure 1 The flowchart shown is about the auxiliary learning task of graph reconstruction in the heterogeneous codec architecture, and is used to guide the detailed description of encoder optimization. The specific process is as follows:

[0146] S7: Starting from the source user's perspective, under the same meta-interaction type, by switching the focus perspective to focus on the source user's domain information, the meta-interaction triplet structure is converted into the following form Aggregate source users exist Target user characteristics under meta-interaction type , get the source user Neighborhood characteristics , the formula is as follows:

[0147]

[0148] in, Indicates the source user Meta-interaction type Neighbor users under .

[0149] Specifically, step S8 combines the source user's neighborhood features and the corresponding meta-interaction type to encode the source user's features to obtain the source user's intermediate hidden state. Specifically, operations similar to steps S3 and S4 are repeated, and the user representation and corresponding conditions are input to the encoder to obtain the source user's intermediate hidden state under the specific meta-interaction type;

[0150] More specifically, S8.1: Source user characteristics As input, its domain characteristics Meta-interaction type characteristics As conditional input into the encoder In [1], the encoder uses the same S4 ​​to achieve parameter sharing, and the learning process of the encoder is optimized through auxiliary tasks. The encoding process is implemented using a two-layer multi-layer perceptron. The specific calculation process is as follows:

[0151]

[0152] in, , Represent the parameter matrices of the first and second layer multilayer perceptrons respectively.

[0153] S8.2: Calculate the KL divergence of the source user's intermediate hidden state to optimize the encoder performance. The specific formula is as follows:

[0154]

[0155] in, Indicates the number of meta-interaction types.

[0156] As an implementation method in this embodiment, the process of reconstructing the adjacency matrix includes:

[0157] Input the target user intermediate hidden state and the source user intermediate hidden state under the same meta-interaction type into the structure decoder;

[0158] Generate the reconstructed adjacency matrix under this meta-interaction type through matrix multiplication;

[0159] The auxiliary learning objective is constructed by calculating the mean square error between the reconstructed adjacency matrix and the original adjacency matrix.

[0160] Specifically, step S9 describes the process of reconstructing the adjacency matrix between the target user and the source user under a specific meta-interaction type through the structural decoder. Specifically, the intermediate latent state of the target user and the intermediate latent state of the source user are input into the structural decoder to obtain a reconstructed adjacency matrix. This reconstructed adjacency matrix and the original adjacency matrix are used to construct the auxiliary task to optimize the user representation learning process.

[0161] More specifically, S9.1: The intermediate hidden states of all target users under meta-interaction behavior and the intermediate hidden state of the source user Input to the structure decoder In the above example, we get the reconstructed adjacency matrix , the specific calculation process is as follows:

[0162]

[0163] in, and for The total number of target users and source users under meta-interaction behavior.

[0164] S9.2: Calculate the loss function of the reconstructed adjacency matrix to assist in the learning task. The formula is as follows:

[0165]

[0166] in, is the total number of meta-interaction behavior types.

[0167] S9.3: Calculate the total loss of the model:

[0168]

[0169] in, 、 、 They are KL divergence , feature loss and reconstruction loss The weight under the total loss L.

[0170] Based on this, an embodiment of the present invention provides an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture. The present invention refines the modeling of user interaction semantics through meta-interaction types to avoid preset meta-path restrictions; adaptively learns multiple types of interaction patterns based on the heterogeneous conditional encoding and decoding architecture, and strengthens the topological relationship representation by combining dual-perspective hidden state learning and graph structure reconstruction tasks; generates enhanced representations by fusing multiple interaction features through the attention mechanism, thereby improving the accuracy of malicious behavior detection.

[0171] Example 2

[0172] Based on the same general inventive concept, the present invention also provides an Ethereum user behavior analysis system based on a heterogeneous conditional encoding and decoding architecture. Figure 4As mentioned above, the following describes the Ethereum user behavior analysis system based on the heterogeneous conditional encoding and decoding architecture provided by the present invention. The Ethereum user behavior analysis system based on the heterogeneous conditional encoding and decoding architecture described below and the Ethereum user behavior analysis method based on the heterogeneous conditional encoding and decoding architecture described above can correspond to each other. The system includes:

[0173] The network modeling module is used to distinguish the type information in the collected interaction data and model it into a heterogeneous network;

[0174] The user domain information acquisition and encoding module is used to obtain the neighbor aggregation information of the target user and the source user in the network under a specific interaction type, and distinguish the input and conditional information and pass them into the encoder to learn the user local domain representation;

[0175] The feature decoder module is used to generate enhanced features of the target user and describe the local interactive behavior characteristics of the user;

[0176] The structure decoder module is used to reconstruct the target user's hidden state and the source user's hidden state to generate reconstructed graphs under different meta-interactions, assisting the encoder in learning optimization;

[0177] The attention aggregation module is used to aggregate user representations obtained under various interaction types to obtain user representations that can ultimately describe complex interaction behaviors;

[0178] The malicious behavior detection module is used to input the end-user enhanced representation into the classifier, use the graph structure reconstruction task to enhance malicious behavior detection, and design the main task optimization function and the graph reconstruction optimization function to optimize model training.

[0179] Taking the Ethereum interaction network as an example, the Ethereum interaction network is modeled as a heterogeneous graph containing six meta-interaction behaviors. The neighborhood information of the source user and the target user is obtained respectively and input into the encoder to learn the intermediate hidden state of the user; then, feature decoding and structure decoding are performed according to different task requirements to construct different optimization objectives; secondly, attention is used to aggregate the output results of multiple meta-interactions to obtain the final enhanced user representation; finally, it is input into the downstream neural network model for training and the final classification result is obtained; according to the above steps, a user representation that takes into account the semantic information of multiple interaction behaviors is obtained, thereby improving the performance of malicious behavior detection.

[0180] It should be understood that the Ethereum user behavior analysis system based on a heterogeneous conditional encoding and decoding architecture provided in the embodiment of the present invention has all the advantages of the Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture provided in the above embodiment.

[0181] Example 3

[0182] In this embodiment, a computer terminal device is provided, including:

[0183] one or more processors;

[0184] a memory, coupled to the processor, for storing one or more programs;

[0185] When the one or more programs are executed by the one or more processors, the one or more processors implement the methods in the above embodiments.

[0186] In this embodiment, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed by a processor, the method in the above embodiment is implemented.

[0187] In this embodiment, an electronic device is further provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to execute the method in the above embodiment.

[0188] The above program can be executed in a processor or stored in a memory (or computer-readable medium). Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and can be implemented using any method or technology to store information. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0189] These computer programs can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps of the functions specified in one or more blocks can be implemented by different modules corresponding to different steps.

[0190] This embodiment provides such a device or system. The system is called an Ethereum user behavior analysis system based on a heterogeneous conditional encoding and decoding architecture, and includes:

[0191] The network modeling module is used to model the Ethereum interaction network as a directed heterogeneous graph from source users to target users, distinguish between user types and interaction types, and define the triple consisting of source user, target user and interaction behavior as a meta-interaction type;

[0192] Feature encoding module, used to perform one-hot encoding on meta-interaction types to generate meta-interaction type features;

[0193] A neighborhood aggregation module is used to aggregate neighbor source user features based on different meta-interaction types from the perspective of the target user to generate target user neighborhood features, and to aggregate neighbor target user features from the perspective of the source user to generate source user neighborhood features;

[0194] A conditional encoding module, configured to input target user features into an encoder and output the target user's intermediate hidden state conditioned on neighborhood features and meta-interaction type features, and to input source user features into an encoder and output the source user's intermediate hidden state conditioned on neighborhood features and meta-interaction type features;

[0195] The feature decoding module is used to input the intermediate hidden state of the target user into the feature decoder to reconstruct the generated features under the meta-interaction behavior;

[0196] Attention aggregation module, which is used to aggregate the generated features under different meta-interaction behaviors through the attention mechanism to obtain the enhanced features of the target user;

[0197] The behavior detection module is used to combine enhanced features with original features and input the original adjacency matrix into a heterogeneous graph neural network to detect malicious behavior;

[0198] The structural decoding module is used to input the intermediate hidden states of the target user and the source user under the same meta-interaction into the structural decoder to reconstruct the adjacency matrix and construct the auxiliary learning target.

[0199] As an implementation method of this embodiment, the network modeling module includes:

[0200] User type definition unit, used to distinguish external users from contract users;

[0201] Interaction type definition unit, used to distinguish between calls and transactions;

[0202] The meta-interaction construction unit is used to construct six types of meta-interactions: contract users pointing to contract users through calls, contract users pointing to contract users through transactions, contract users pointing to external users through transactions, external users pointing to contract users through calls, external users pointing to contract users through transactions, and external users pointing to external users through transactions.

[0203] As an implementation method of this embodiment, the neighborhood aggregation module includes:

[0204] The target neighborhood generation unit is used to extract the neighbor source user features of the target user under a specific meta-interaction type and perform average aggregation to generate the target user neighborhood features;

[0205] The source neighborhood generation unit is used to extract the neighbor target user features of the source user under a specific meta-interaction type and perform average aggregation to generate the source user neighborhood features.

[0206] As an implementation method of this embodiment, the conditional encoding module includes:

[0207] Multi-layer perceptron coding unit, consisting of two layers of multi-layer perceptrons;

[0208] The target hidden state generation unit, which inputs the target user features, neighborhood features, and meta-interaction type features into the multi-layer perceptual encoding unit, outputs the target user's intermediate hidden state;

[0209] The source hidden state generation unit, which inputs the source user features, neighborhood features, and meta-interaction type features into the multi-layer perceptual encoding unit, outputs the source user's intermediate hidden state;

[0210] The parameters of the target hidden state generation unit and the source hidden state generation unit are shared.

[0211] As an implementation method of this embodiment, the feature decoding module includes:

[0212] The feature reconstruction unit consists of two layers of multi-layer perceptrons and is used to reconstruct the target user's intermediate hidden state, neighborhood features, and meta-interaction type features into generated features;

[0213] The attention aggregation module includes:

[0214] The weight calculation unit calculates the importance weight of each meta-interaction type through the meta-interaction level attention vector;

[0215] The feature fusion unit fuses the generated features under different meta-interaction types according to the weights to generate the enhanced features of the target user.

[0216] As an implementation method of this embodiment, the structure decoding module includes:

[0217] The matrix reconstruction unit is used to generate a reconstructed adjacency matrix by matrix multiplication of the intermediate hidden states of the target user and the source user under the same meta-interaction type;

[0218] The auxiliary learning unit constructs the auxiliary learning target by calculating the mean square error between the reconstructed adjacency matrix and the original adjacency matrix.

[0219] The system or device is used to implement the functions of the method in the above-mentioned embodiment. Each module in the system or device corresponds to each step in the method, which has been explained in the method and will not be repeated here.

[0220] Through the above implementation, the problem of Ethereum user behavior analysis based on heterogeneous conditional encoding and decoding architecture in the related art is solved, thereby ensuring that the problems existing in the existing technology are solved.

[0221] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for analyzing Ethereum user behavior based on a heterogeneous conditional encoding and decoding architecture, characterized in that: The following steps are involved: The Ethereum interaction network is modeled as a directed heterogeneous graph from source users to target users, distinguishing between user types and interaction types; The triple consisting of source user, target user and interaction behavior is defined as meta-interaction type, and the meta-interaction type is one-hot encoded to generate meta-interaction type features; From the perspective of the target user, the neighbor source user features are aggregated based on different meta-interaction types to generate the neighborhood features of the target user; Input the target user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the target user's intermediate hidden state; The intermediate hidden state is input into the feature decoder to reconstruct the generated features of the target user under the meta-interaction behavior; Aggregate the generated features under different meta-interaction behaviors through the attention mechanism to obtain the enhanced features of the target user; Concatenate enhanced features with original features and combine them with the original adjacency matrix to input into heterogeneous graph neural network to detect malicious behavior; From the perspective of the source user, aggregate the neighbor target user features to generate the source user neighborhood features; Input the source user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the source user's intermediate hidden state; The intermediate hidden states of the target user and the source user under the same meta-interaction are input into the structural decoder to reconstruct the adjacency matrix and construct the auxiliary learning objective.

2. The method according to claim 1, characterized in that The user types include external users and contract users; The interaction types include calls and transactions; the meta-interaction types are defined as six triples: Contract users point to contract users through calls, contract users point to contract users through transactions, contract users point to external users through transactions, external users point to contract users through calls, external users point to contract users through transactions, and external users point to external users through transactions.

3. The method according to claim 1, characterized in that The process of generating the target user neighborhood features includes: Extract the neighbor source user features of the target user under a specific meta-interaction type; Average and aggregate the neighbor source user features to obtain the neighborhood features of the target user under this meta-interaction type; The process of generating source user neighborhood features includes: Extract the neighbor target user features of the source user under a specific meta-interaction type; The neighbor target user features are averaged and aggregated to obtain the neighborhood features of the source user under this meta-interaction type.

4. The method according to claim 1, wherein The encoder is a two-layer multi-layer perceptron; Input the concatenated vector of target user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the target user; Input the concatenated vector of source user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the source user; The encoder parameters of the target user are shared with the source user.

5. The method according to claim 1, wherein The process of reconstructing the target user generated features includes: The target user's intermediate hidden state, neighborhood features, and meta-interaction type features are input into a feature decoder composed of two layers of multi-layer perceptrons to reconstruct the generated features; The attention mechanism aggregation process includes: The importance weight of each meta-interaction type is calculated through the meta-interaction level attention vector; The generated features under different meta-interaction types are fused according to the weights to obtain the enhanced features of the target user.

6. The method according to claim 1, characterized in that The process of reconstructing the adjacency matrix includes: Input the target user intermediate hidden state and the source user intermediate hidden state under the same meta-interaction type into the structure decoder; Generate the reconstructed adjacency matrix under this meta-interaction type through matrix multiplication; The auxiliary learning objective is constructed by calculating the mean square error between the reconstructed adjacency matrix and the original adjacency matrix.

7. An Ethereum user behavior analysis system based on heterogeneous conditional encoding and decoding architecture, characterized in that: The system comprises: The network modeling module is used to model the Ethereum interaction network as a directed heterogeneous graph from source users to target users, distinguish between user types and interaction types, and define the triple consisting of source user, target user and interaction behavior as a meta-interaction type; Feature encoding module, used to perform one-hot encoding on meta-interaction types to generate meta-interaction type features; A neighborhood aggregation module is used to aggregate neighbor source user features based on different meta-interaction types from the perspective of the target user to generate target user neighborhood features, and to aggregate neighbor target user features from the perspective of the source user to generate source user neighborhood features; A conditional encoding module, configured to input target user features into an encoder and output the target user's intermediate hidden state conditioned on neighborhood features and meta-interaction type features, and to input source user features into an encoder and output the source user's intermediate hidden state conditioned on neighborhood features and meta-interaction type features; The feature decoding module is used to input the intermediate hidden state of the target user into the feature decoder to reconstruct the generated features under the meta-interaction behavior; Attention aggregation module, which is used to aggregate the generated features under different meta-interaction behaviors through the attention mechanism to obtain the enhanced features of the target user; The behavior detection module is used to combine enhanced features with original features and input the original adjacency matrix into a heterogeneous graph neural network to detect malicious behavior; The structural decoding module is used to input the intermediate hidden states of the target user and the source user under the same meta-interaction into the structural decoder to reconstruct the adjacency matrix and construct the auxiliary learning target.

8. The system according to claim 7, characterized in that The network modeling module includes: User type definition unit, used to distinguish external users from contract users; Interaction type definition unit, used to distinguish between calls and transactions; The meta-interaction construction unit is used to construct six types of meta-interactions: contract users pointing to contract users through calls, contract users pointing to contract users through transactions, contract users pointing to external users through transactions, external users pointing to contract users through calls, external users pointing to contract users through transactions, and external users pointing to external users through transactions.

9. A computer terminal device, characterized in that: include: one or more processors; a memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum user behavior analysis method based on the heterogeneous conditional encoding and decoding architecture as described in any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture as described in any one of claims 1 to 6 is implemented.

Images