Phishing account detection model training method, detection method and device

Abstract

According to the phishing account detection model training method, the phishing account detection method and the phishing account detection device, a second-order transaction network is independently constructed for each account, a local transaction structure of each account is completely reserved, and the bottleneck of feature dilution and excessive smoothness caused by traditional global large graph training is broken through; address similarity features are introduced, high-frequency transaction object tail number similarity deliberately constructed by an attacker is accurately captured, and the visual confusion type fishing behavior is effectively recognized. A random walk restart algorithm is adopted to generate double local subgraphs, center node self-pairing is used as a positive sample, a cross-subgraph non-center node is used as a negative sample, node-level comparison loss is constructed, and the discrimination capability of a model on phishing nodes and normal neighbors is enhanced; through joint classification loss end-to-end training, the graph neural network can be incrementally updated without re-training a global graph, and lightweight deployment is realized. According to the method, in a block chain transaction scene with extremely unbalanced data, the risk of misjudgment of the phishing account can be remarkably reduced, and high sensitivity and real-time performance are both achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network transaction security, and particularly relates to a phishing account detection model training method and device and a detection method. BACKGROUND

[0002] As one of the most common crimes in network transaction scenarios, network phishing fraud is particularly harmful. Data or interest transactions based on a blockchain platform have irreversibility, and once a victim is deceived, there is almost no way to recover the related interests. Network phishing fraud usually tricks users into providing private keys or other sensitive information through fake smart contracts or websites, thereby stealing money from user accounts. According to statistics, network phishing fraud accounts for about 50% of blockchain fraud events, and presents a periodic outbreak trend. At the same time, a recent phishing method using small interest transfers has become increasingly rampant, and the phisher calls the TransferFrom function to transfer small amounts of interest to the victim. Moreover, the address of the phishing account is the same as the tail number of the address of the transaction object frequently traded by the victim, and the purpose is to mistake the address of the phishing account for the address of the transaction object when the victim is careless, thereby making an error transaction to the phishing account and causing a loss of digital assets or interests. Although the blockchain technology ensures the non-tamperability of transaction records through a distributed ledger and a hash algorithm, it does not effectively solve the identification problem of illegal accounts and suspicious transactions. In particular, in a large blockchain transaction platform, network criminals can take advantage of the characteristics of decentralization and anonymity to evade traditional financial regulation and legal sanctions.

[0003] Existing blockchain phishing detection mainly relies on global transaction graph node embedding: first, a complete transaction network containing all accounts is constructed, and then a graph convolution network (GCN), Node2Vec or a shallow integrated model is used to learn node representation. Such solutions expose three defects in data balancing, dynamic updating and disguise attack scenarios: 1) Local transaction features of a single node are diluted as the node expands during global graph training, especially when the number of network nodes reaches millions, the feature propagation mechanism based on graph convolution is prone to over-smoothing, and the local phishing signal is overwhelmed by normal transactions, resulting in insufficient learning of minority class features. 2) The model needs to be retrained on the entire graph to update, which is computationally expensive and difficult to respond to new addresses in real time. 3) New attacks such as small transfer disguises and visual confusion addresses are ignored: attackers send small transactions and mimic the last few characters of the victim's high-frequency transaction object, using the homogeneity assumption to make the phishing node and normal neighbors almost indistinguishable in existing representations. Traditional detection methods that rely on large amounts of money or topological abnormalities are therefore ineffective. In recent years, there have been attempts at contrast learning, but they still use subgraphs within the same global graph and have not been able to break free from the constraints of scale and dynamics. Moreover, they have not designed special features for address string similarity, and the risk of misjudgment is high. In summary, the industry urgently needs a new phishing account detection architecture that is lightweight, incrementally updatable, and sensitive to visual confusion and small disguises. SUMMARY

[0004] Therefore, the embodiments of the present application provide a phishing account detection model training method and a detection method and device to eliminate or improve one or more defects in the prior art, solve the problem that the prior art is difficult to identify phishing accounts that use small transfers and visual confusion addresses in real time and accurately due to reliance on a global transaction graph.

[0005] One aspect of the present application provides a phishing account detection model training method in a decentralized transaction scenario, which comprises the following steps: For a target decentralized transaction network, a sample account address set containing phishing account samples and randomly sampled normal account samples is obtained as a training sample set; for each account sample in the training sample set, a second-order transaction network is extracted, which includes first-order associated account nodes that directly transact with the corresponding account sample, and second-order associated account nodes that directly transact with the first-order associated account but have no direct transaction with the corresponding account sample, and an edge is constructed based on the transaction relationship to record the transaction statistical features of each account sample with respect to a predetermined transaction parameter; for each account sample, the first number of target accounts with the highest transaction frequency are selected in the second-order transaction network, and the address similarity features of the account sample and the target accounts are calculated; the account sample is added with a class label indicating whether it belongs to a phishing account; Taking each account sample in the training sample set as a center node, a first subgraph and a second subgraph are obtained by performing twice independent sampling on the second-order transaction network using a random walk restart algorithm; the center nodes of the first subgraph and the second subgraph are constructed as positive sample pairs, and the center node of the first subgraph and the non-center nodes of the second subgraph, and the center node of the second subgraph and the non-center nodes of the first subgraph are constructed as negative sample pairs; An initial neural network comprising a graph neural network encoder and a classifier is obtained; the graph neural network encoder extracts topological features of each node in the second-order transaction network, the first subgraph and the second subgraph respectively, and connects the topological features of the second-order transaction network with transaction statistical features and address similarity features to obtain final feature transaction statistical features; the final features are processed by the classifier to output a classification prediction value of whether the center node belongs to a phishing account; the initial neural network is trained using the training sample set, the topological features of each node in the first subgraph and the second subgraph are mapped to the same space based on a projection head, and a contrast loss is calculated based on the positive sample pairs and the negative sample pairs; a classification loss is calculated based on the deviation of the classification prediction value and the category label, and the initial neural network parameters are updated to obtain a phishing account detection model based on the contrast loss and the classification loss.

[0006] In some embodiments, the preset transaction parameters include the number of out-edge transactions, the number of in-edge transactions, the total received transaction amount, and the total sent transaction amount, and the preset transaction parameters are one-hot encoded after numerical normalization processing. The graph neural network encoder is composed of three layers of graph convolution network encoders, and each layer of graph convolution network encoders is further provided with a ReLU activation function layer; the classifier uses an XGBoost classifier.

[0007] In some embodiments, for each account sample, the first number of target accounts with the highest transaction frequency in the second-order transaction network are screened, and the address similarity features of the account sample and the corresponding target accounts are calculated, including: For each account sample, 5-10 target accounts with the highest transaction frequency in the second-order transaction network are screened. The Levenshtein distance between the account addresses of the account sample and its corresponding target accounts is calculated, and the minimum value, maximum value, average value or variance is taken as the address similarity feature.

[0008] In some embodiments, the calculation formula of the contrast loss is: ; wherein, represents the node-level contrast loss, This represents the first subgraph sampled by the i-th central node in the second-order transaction network using the random walk restart algorithm. This represents the second subgraph sampled by the i-th central node in the second-order transaction network using the random walk restart algorithm; N represents the number of samples. τ is a temperature parameter. This represents the calculation of the cosine similarity of vectors. For nodes The negative sample topological features The topological features of the central node of the first subgraph. For nodes The negative sample topological features The topological features of the central node of the second subgraph.

[0009] In some embodiments, the contrast loss is InfoNCE loss and the classification loss is cross-entropy loss.

[0010] In some embodiments, for blockchain transaction scenarios, the second-order transaction network of each account sample is crawled through the RESTful API interface provided by the Etherscan blockchain explorer.

[0011] On the other hand, the present invention also provides a method for detecting phishing accounts in a decentralized trading scenario, the method comprising the following steps: For the account to be analyzed in the target decentralized transaction network, obtain its corresponding second-order transaction network. The second-order transaction network includes first-order associated account nodes that directly transact with the corresponding account sample, and second-order associated account nodes that directly transact with the first-order associated account but do not directly transact with the corresponding account sample. Edges are constructed based on transaction relationships. Obtain the transaction statistics features of the account to be analyzed with respect to preset transaction parameters, filter the first number of target accounts with the highest transaction frequency in the second-order transaction network, and calculate the address similarity features between the account to be analyzed and the corresponding target accounts; The second-order transaction network with the account to be analyzed as the central node is input into the graph neural network encoder of the phishing account detection model in the decentralized transaction scenario training method according to any one of claims 1 to 6 to extract topological features. The topological features, transaction statistical features and address similarity features of the account to be analyzed are then connected and input into the classifier in the phishing account detection model to output the detection result of whether the account to be analyzed belongs to a phishing account, which is the transaction statistical features.

[0012] In some embodiments, the preset transaction parameters include an out-edge transaction number, an in-edge transaction number, a total received transaction amount, and a total sent transaction amount, and the preset transaction parameters are one-hot encoded after being value-normalized. The calculation of the address similarity feature comprises: screening 5-10 target accounts with the highest transaction frequency of the to-be-analyzed account in the second-order transaction network; calculating the Levenshtein distance between the account addresses of the to-be-analyzed account and the corresponding target account after the second set number of positions, and taking the minimum value, the maximum value, the average value, or the variance as the address similarity feature.

[0013] In another aspect, the application also provides a phishing account detection device in a decentralized transaction scenario, comprising a processor, a memory, and a computer program / instruction stored in the memory, wherein the processor is configured to execute the computer program / instruction, and the device realizes the steps of the above method when the computer program / instruction is executed.

[0014] In another aspect, the application also provides a computer-readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction is executed by a processor to realize the steps of the above method.

[0015] The phishing account detection model training method, detection method, and device of the application break through the feature dilution and excessive smoothing bottleneck caused by traditional global graph training by independently constructing a second-order transaction network for each account and completely preserving its local transaction structure; introduce the address similarity feature to accurately capture the high-frequency transaction object tail number similarity deliberately constructed by attackers and effectively identify visual confusion type phishing behavior. The random walk restart algorithm is used to generate a double local subgraph, and the center node self-pairing is innovatively taken as a positive sample, and the cross-subgraph non-center node is taken as a negative sample to construct a node-level contrastive loss, thereby strengthening the model's ability to distinguish phishing nodes and normal neighbors. The joint classification loss is trained end-to-end, so that the graph neural network can be incrementally updated without retraining the global graph, and lightweight deployment is realized. The application can significantly reduce the risk of misjudgment in the blockchain transaction scenario with extremely unbalanced data, has high sensitivity and real-time performance, and is suitable for online risk control scenarios of large-scale decentralized transaction platforms.

[0016] Additional advantages, objects, and features of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following or can be learned by practice of the application. The objects and other advantages of the application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0017] Those skilled in the art will understand that the objects and advantages of the application realized by the application are not limited to the above specific description, and the above and other objects realized by the application will be more clearly understood according to the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings, which are included to provide a further understanding of the application and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings: Figure 1 The logic schematic diagram of the phishing account detection model training method in the decentralized transaction scenario according to an embodiment of the application.

[0019] Figure 2 The logic schematic diagram of the phishing account detection method in the decentralized transaction scenario according to another embodiment of the application.

[0020] Figure 3 The training logic schematic diagram of the graph neural network encoder in the network phishing node detection method based on graph contrast learning according to an embodiment of the application.

[0021] Figure 4 The training logic schematic diagram of the Xgboost classifier in the network phishing node detection method based on graph contrast learning according to an embodiment of the application.

[0022] Figure 5 The application logic schematic diagram of the network phishing node detection method based on graph contrast learning according to an embodiment of the application. DETAILED DESCRIPTION

[0023] In order to make the objects, technical solutions and advantages of the application clearer, the application will be further described in detail below in combination with embodiments and drawings. Herein, the illustrative embodiments of the application and the description thereof are used to explain the application, but are not used as a limitation of the application.

[0024] It should be further noted that, in order to avoid the application being obscured by unnecessary details, only structures and / or processing steps closely related to the solutions according to the application are shown in the drawings, and other details not closely related to the application are omitted.

[0025] It should be emphasized that the term “comprises / comprising” is used herein to indicate the presence of a feature, element, step or component, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0026] In a decentralized transaction scenario, the transaction history of a user account naturally forms a transaction network, which takes addresses as nodes and transactions between addresses as edges. Currently, methods for detecting phishing fraud mainly rely on this transaction network. They learn the representation of phishing nodes from the transaction network and classify the nodes accordingly. Existing methods for detecting phishing fraud can be divided into two categories. The first category uses shallow models, such as traditional machine learning methods and feature engineering techniques that focus on transaction statistical features, and uses integrated machine learning algorithms such as LightGBM and double sampling integration techniques to identify phishing nodes. The second category uses graph representation learning methods to extract transaction statistical features, then uses DeepWalk, Node2Vec, and Graph Convolutional Networks (GCN) to extract deep features, or directly uses the Node2Vec algorithm to learn node representations on the transaction network, and finally realizes the detection of phishing nodes. However, existing technologies are difficult to identify phishing accounts that use small transfers and visual confusion addresses due to their reliance on global transaction graphs.

[0027] Therefore, the present application provides a phishing account detection model training method in a decentralized transaction scenario, as shown in Figure 1 The method comprises the following steps S101-S103: Step S101: For a target decentralized transaction network, obtain a sample account address set containing phishing account samples and randomly sampled normal account samples as a training sample set; extract a second-order transaction network for each account sample in the training sample set, which includes first-order associated account nodes that directly transact with the corresponding account sample, and second-order associated account nodes that directly transact with the first-order associated account but have no direct transaction with the corresponding account sample, and construct edges with transaction relationships to record the transaction statistical features of each account sample with respect to the preset transaction parameters; for each account sample, filter the first number of target accounts with the highest transaction frequency in the second-order transaction network, and calculate the address similarity features of the account sample and the corresponding target account; add a class label to the account sample indicating whether it is a phishing account.

[0028] Step S102: Take each account sample in the training sample set as a center node, and use a random walk restart algorithm to perform two independent samplings in the second-order transaction network to obtain a first subgraph and a second subgraph; construct the center nodes of the first subgraph and the second subgraph as positive sample pairs, and construct the first subgraph center node and the second subgraph non-center node, as well as the second subgraph center node and the first subgraph non-center node as negative sample pairs.

[0029] Step S103: obtaining an initial neural network comprising a graph neural network encoder and a classifier; the graph neural network encoder extracts topological features of each node in the second-order transaction network, the first subgraph and the second subgraph respectively, and connects the topological features of the second-order transaction network with transaction statistical features and address similarity features to obtain final feature transaction statistical features; the final features are processed by the classifier to output a classification prediction value of whether the center node belongs to a phishing account; the initial neural network is trained using a training sample set, the topological features of each node in the first subgraph and the second subgraph are mapped to the same space based on a projection head, and a contrast loss is calculated based on positive sample pairs and negative sample pairs; a classification loss is calculated based on the deviation of the classification prediction value and the category label, and the initial neural network parameters are updated to obtain a phishing account detection model.

[0030] In step S101, the present application mainly aims at a decentralized transaction scenario, and the target decentralized transaction network can be a blockchain transaction network, and the transaction content can be a digital asset or equity. In order to train a model capable of detecting phishing accounts, first, training data is prepared, specifically, a training sample set is constructed based on a labeled database in a specified transaction scenario. In the labeled database, phishing accounts and normal accounts in historical transaction data are marked. In the process of phishing account identification, the present application does not use global graph data of the transaction network, but relies on a second-order transaction network with high relevance to the account for identification, so as to overcome the problem that local transaction features of a single node are diluted due to the expansion of the global graph size. For a blockchain transaction network, the original data of the second-order transaction network of each account can be directly crawled through a RESTful API interface provided by an Etherscan blockchain browser. The account is taken as a node, and the transaction relationship is taken as an edge. For each transaction record of each account, structured fields are extracted according to preset transaction parameters, specifically, core attributes such as transaction timestamp accurate to milliseconds, transaction amount, addresses of the sender and the receiver, and transaction hash value. The preset transaction parameters can be used to constitute transaction statistical features, to mine features from the actual transaction amount and quantity, and to effectively discover the transaction characteristics of an account implementing disguise through small transactions. In the process of identifying phishing accounts, the address information of the account sample is obtained to focus on the features of the fake address. By analyzing the address string distribution pattern, a visual confusion address deliberately manufactured by a phishing account is identified.

[0031] In some embodiments, the preset transaction parameters include the number of outgoing edges, the number of incoming edges, the total transaction amount received, and the total transaction amount sent, and the discrete numerical values are one-hot encoded after numerical normalization processing of the preset transaction parameters. The type of the preset transaction parameters can be selected and set according to a specific application scenario, and multiple transaction-related parameters are used.

[0032] In some embodiments, the first number of target accounts with the highest transaction frequency in the second-order transaction network are screened for each account sample, and the address similarity features of the account sample and the corresponding target account are calculated, including steps S1011-S1012: Step S1011: For each account sample, 5-10 target accounts with the highest transaction frequency in the second-order transaction network are screened.

[0033] Step S1012: The Levenshtein distance between the account addresses of the account sample and its corresponding target account is calculated, and the minimum value, maximum value, average value or variance is taken as the address similarity feature.

[0034] In step S102, in order to introduce the way of contrast learning to mine account features in the subsequent model training process, it is necessary to construct positive and negative sample pairs. The random walk restart algorithm (Random Walk with Restart, RWR) used in the present application is an algorithm based on graph node importance measurement and local structure sampling. It introduces a "restart mechanism" based on traditional random walk, that is, the walker has a certain probability to return to the starting node to start walking again at each step. This mechanism makes the walking process always around the local neighborhood of the starting node (i.e. the center node), which not only captures the correlation strength of the node and its neighbors, but also effectively avoids over-dispersion of the walk to the global network, thereby realizing focused sampling of the local topological structure. In phishing account detection, RWR is used to generate a local subgraph with structural representation from the transaction network of each account as an enhanced view in contrast learning, thereby improving the model's ability to distinguish account transaction behavior patterns. On the second-order transaction network, the random walk restart algorithm is used twice to sample two transaction subgraphs with a single account sample as the center node. The center nodes of the first and second subgraphs are constructed as positive sample pairs, and the first subgraph center node and the second subgraph non-center node, as well as the second subgraph center node and the first subgraph non-center node, are constructed as negative sample pairs.

[0035] In step S103, the graph neural network encoder is composed of three layers of graph convolution network encoders, each layer of graph convolution network encoder is also provided with a ReLU activation function layer; the classifier adopts an XGBoost classifier.

[0036] By jointly training contrastive and supervised learning, the model simultaneously learns the general structural features of the transaction network and the specific classification features of phishing accounts. Specifically, this step uses a graph neural network to extract the topological features of nodes in two augmented subgraphs of the same account, and maps them to the contrastive learning space using a projection head. Based on this, on the one hand, by constructing positive and negative sample pairs to calculate the contrastive loss, the model can ignore local structural noise and focus on the stable behavioral patterns of the account itself (unsupervised learning objective). On the other hand, the topological features are fused with transaction statistics and address features and input into the classifier, and the classification loss is calculated based on the deviation between the predicted value and the true label (supervised learning objective). Finally, the model updates its parameters by simultaneously optimizing the joint objective of contrastive and classification losses, thereby training a phishing account detection model with both powerful representation capabilities and high classification accuracy.

[0037] In some embodiments, the contrast loss is calculated as follows: ; in, This represents the node-level comparison loss. This represents the first subgraph sampled by the i-th central node in the second-order transaction network using the random walk restart algorithm. This represents the second subgraph sampled by the i-th central node using the random walk restart algorithm in the second-order transaction network; N represents the number of samples. Where τ is the temperature parameter, This represents the calculation of the cosine similarity of vectors. For nodes The negative sample topological features The topological features of the central node of the first subgraph For nodes The negative sample topological features The topological features of the central node of the second subgraph.

[0038] In other embodiments, the contrast loss uses InfoNCE loss, and the classification loss uses cross-entropy loss.

[0039] On the other hand, the present invention also provides a method for detecting phishing accounts in decentralized trading scenarios, such as... Figure 2 As shown, the method includes the following steps S201~S203: Step S201: For a target account to be analyzed in a target decentralized transaction network, a corresponding second-order transaction network is obtained, the second-order transaction network including first-order associated account nodes directly transacted with the corresponding account sample and second-order associated account nodes directly transacted with the first-order associated account but not directly transacted with the corresponding account sample, and edges are constructed in a transaction relationship.

[0040] Step S202: Obtain transaction statistical features of the account to be analyzed with respect to preset transaction parameters, filter a first number of target accounts with the highest transaction frequency in the second-order transaction network, and calculate address similarity features of the account to be analyzed and the corresponding target accounts.

[0041] Step S203: The second-order transaction network with the account to be analyzed as the center node is input into the graph neural network encoder of the phishing account detection model in the phishing account detection model training method in the decentralized transaction scenario described in steps S101-S103 to extract topological features, and the topological features, transaction statistical features and address similarity features of the account to be analyzed are connected and input into the classifier in the phishing account detection model, and a detection result of whether the account to be analyzed belongs to a phishing account is output.

[0042] In some embodiments, the preset transaction parameters include the number of outgoing transactions, the number of incoming transactions, the total transaction amount received, and the total transaction amount sent, and the preset transaction parameters are processed by numerical normalization and then one-hot encoding for discrete numerical values. The calculation steps of the address similarity features include: filtering 5-10 target accounts with the highest transaction frequency in the second-order transaction network for the account to be analyzed; calculating the Levenshtein distance between the account addresses of the account to be analyzed and its corresponding target accounts after the second set number of positions, and taking the minimum value, maximum value, average value or variance as the address similarity features.

[0043] In another aspect, the present application also provides a phishing account detection device in a decentralized transaction scenario, including a processor, a memory and a computer program / instruction stored on the memory, the processor being used to execute the computer program / instruction, when the computer program / instruction is executed, the device implements the steps of the above method.

[0044] In another aspect, the present application also provides a computer readable storage medium having a computer program / instruction stored thereon, the computer program / instruction being executed by a processor to implement the steps of the above method.

[0045] The present application will be described below in conjunction with a specific embodiment: The embodiment provides a phishing node detection method based on graph contrast learning, focuses on a scene of small amount phishing through graph contrast learning and increase of features about account addresses, solves the problem of serious data imbalance caused by a very low proportion of phishing accounts in a network transaction graph, and causes insufficient learning of minority class features by traditional supervised learning, and improves phishing account detection performance.

[0046] In the embodiment, phishing detection is divided into several steps: data collection, feature calculation, contrast learning model training, and account prediction classification.

[0047] 1. Perform data collection Based on a target account address set (containing phishing accounts and randomly sampled normal accounts) in a labeled sample library, an automatic data collection system is constructed: ①Through the RESTful API interface provided by the Etherscan block chain browser, the original data of the second-order transaction network of each account (including the direct transaction object of the target account and the expansion network of the associated party) is directly crawled; ②For each transaction record, structured fields are extracted, specifically covering transaction timestamp (accurate to milliseconds), transfer amount (in Wei as the smallest unit), participant address (including sender and receiver), transaction hash value and other core attributes; ③Multi-dimensional data cleaning and verification is implemented, including address format verification, abnormal amount filtering and repeated transaction deduplication; ④A graph structure model is used to construct a second-order transaction network data set for each account, taking account addresses as nodes and transaction relationships as directed edges, forming a heterogeneous data integration structure including a node attribute table and an adjacency matrix.

[0048] 2. Perform feature calculation In the transaction network feature extraction process, multi-dimensional feature quantization analysis is performed on the second-order transaction network constructed for each account, specifically covering three dimensions of basic topological features, economic behavior features and innovative security features: the total in-degree (the number of all in-edge transactions) and the total out-degree (the number of all out-edge transactions) of the node are calculated at the basic topological level to depict the directionality of account fund flow; the total transaction amount received (cumulative account balance) and the total transaction amount sent (cumulative expenditure amount) are aggregated at the economic behavior dimension to quantify the scale of account economic activity; the account address similarity feature is introduced, which effectively identifies visually confusing addresses deliberately constructed by attackers by analyzing the character distribution pattern (address edit distance) of the address string, and this feature is particularly designed for the current prevalent small amount phishing attack behavior using local character similarity of the address, which can capture the address generation rule anomaly that traditional features cannot detect, thereby enhancing the detection sensitivity of disguised phishing accounts.

[0049] Specifically, the account address similarity feature calculation includes the following steps: according to the provided transaction network graph, for each account, extract his first-order transaction nodes and second-order transaction nodes, the first-order transaction nodes are the nodes that have traded with the account, and the second-order transaction nodes are the nodes with a distance of 2 from the account in the transaction graph, and filter out the top 5 nodes in transaction frequency, calculate the similarity of the last 5 addresses of the account and these 5 nodes, the calculation method adopts Levenshtein distance, and take the minimum value, maximum value, average value or variance as the address similarity feature. Levenshtein distance is defined as the minimum number of editing operations required to convert one string to another.

[0050] Further, the data preparation stage dynamically constructs a graph data structure from the CSV format of the original transaction record and the phishing address annotation file through a multi-source heterogeneous data integration mechanism. For each target node, an adjacency matrix containing its transaction topology and a dynamic subgraph are created. The feature engineering module designs a five-dimensional node feature vector, including in-degree, out-degree, total sending amount, total receiving amount, and improved address similarity feature, where the latter uses an address suffix similarity algorithm based on Levenshtein distance to calculate the edit distance between the target node and its second-order neighbor address suffix and take the maximum value. The graph structure encoder converts transaction participants into continuous node IDs through an address mapping table, constructing a sparse adjacency matrix to represent the transaction flow topology. The data standardization module implements logarithmic normalization processing on the amount feature, and One-Hot encoding on the discrete feature, eliminating the influence of dimension difference on the model. The center node strengthening mechanism ensures that the target node always occupies the first row position of the feature matrix through matrix rearrangement operation, and synchronously adjusts the index correspondence relationship of the adjacency matrix. The final output graph data object contains a three-dimensional feature tensor, an adjacency matrix and a binary label, which is stored as a standardized format file using Pickle serialization technology, providing structured input for subsequent graph neural network training.

[0051] 3. Perform model training based on contrast learning In the model training stage, as Figure 3As shown, this embodiment employs a contrastive learning framework based on the Random Walk with Restart (RWR) algorithm. Its core process is as follows: For each account's second-order transaction network in the training set, using the account address as the central node, the RWR algorithm performs two independent subgraph sampling operations to generate two second-order transaction network subgraphs with local structural differences. These two subgraphs are then input into a graph neural network encoder (using a GCN architecture) for topological feature extraction to obtain the high-dimensional embedding vector of the central node. Based on this, an innovative rule for constructing positive and negative sample pairs is defined—the embedding vectors of the two subgraph central nodes from the same source node are used as positive sample pairs, while the embedding vectors of the central node of the first subgraph and the non-central node of the second subgraph are used as positive sample pairs. The central node, the central node of the second subgraph, and the non-central node of the first subgraph are each constructed as negative sample pairs. By optimizing the contrastive learning objective function based on InfoNCE loss, the representational similarity of positive sample pairs is maximized and the correlation of negative sample pairs is minimized. Finally, the graph neural network encoder optimized by contrastive learning extracts the topological features of the nodes in the second-order transaction network, connects the transaction statistical features and address similarity features, and inputs them into the XGBoost classifier to train a binary classification discrimination model for node types in a supervised learning manner (outputting the probability distribution of phishing nodes and normal nodes), thereby completing the end-to-end training process of the detection system.

[0052] Specifically, the formula for calculating the contrast loss can be: ; in, This represents the node-level comparison loss. This represents the first subgraph sampled by the i-th central node in the second-order transaction network using the random walk restart algorithm. This represents the second subgraph sampled by the i-th central node using the random walk restart algorithm in the second-order transaction network; N represents the number of samples. Where τ is the temperature parameter, This represents the calculation of the cosine similarity of vectors. For nodes The negative sample topological features The topological features of the central node of the first subgraph For nodes The negative sample topological features The topological features of the central node of the second subgraph.

[0053] Specifically, the second-order transaction network graph of each training set account is input for training, and a dynamic subgraph generation mechanism is adopted to extract local topological structure from the original graph as a contrastive learning unit through a random walk restart algorithm (RWR). The algorithm takes the center node as the starting point, controls the randomness and locality of the walk path based on a preset restart probability, dynamically generates a subgraph containing the center node and its neighborhood relationship, and realizes the standardized representation of the subgraph structure through node index mapping.

[0054] The feature extraction module is composed of a three-layer graph convolution network encoder (GCNConv), and each layer realizes nonlinear transformation of node features through neighborhood aggregation operation. The first layer maps the input features to a 256-dimensional space, the second layer keeps the feature dimension unchanged to enhance the stability of the representation, and the third layer further compresses to a 128-dimensional embedding vector. The ReLU activation function is used between layers to realize the gating mechanism of information transmission, and finally the node embedding with topological perception ability is output.

[0055] The contrastive learning module constructs a dynamic optimization target with the center node as the anchor point, and enhances the generation of positive sample pairs through homologous subgraphs. The similarity matrix of the anchor point and the positive sample is calculated by using the cosine similarity function with temperature coefficient adjustment, and the node-level contrastive loss function is constructed by combining the negative sampling nodes, and the unsupervised training is realized by maximizing the consistency of the same type of nodes. The feature processing module includes a standardization layer and a two-stage projection head. The former normalizes the input features by mean-variance to eliminate the dimensional difference, and the latter maps the original embedding to a 32-dimensional contrast space through a fully connected layer to enhance the distinguishability of the features.

[0056] The training optimization module uses the Adam optimizer to update the parameters, and dynamically adjusts the weight distribution of the contrastive loss function through the back propagation algorithm. Each training cycle traverses all the enhanced sample pairs of the training subgraph, uses gradient clipping technology to prevent parameter oscillation, and through iterative optimization, the model learns to learn discriminative node representations.

[0057] As shown in Figure 4 , the classification decision module splices the trained graph neural network embedding and the original attribute features to construct a fusion feature vector as input. XGBoost is used to realize the final node classification, the model performance is evaluated through five-fold cross-validation, and the precision detection of phishing nodes is realized through the analysis of the confusion matrix.

[0058] 4. Perform account prediction classification In the model inference phase, as shown in Figure 5As shown, the trained graph neural network encoder is input into the second-order transaction network of the account to be detected, and a high-dimensional embedding vector containing topological relationships is generated through a multi-layer message passing mechanism; then the representation vector is fused with the statistical features of the account (including in-out degree values, transaction amount distribution, and address similarity indicators, etc. artificial features), and after eliminating the dimensional differences by using the min-max normalization method, the feature vector splicing is performed to form a joint representation containing structural features and behavioral features; finally, the fused feature matrix is input into the pre-trained XGBoost classifier to perform node classification and identify phishing accounts.

[0059] Specifically, for the node to be detected, the second-order transaction network graph is extracted by querying the Api provided by the website Etherscan, the statistical features (including transaction statistical features and address similarity features) of each node in the network graph are calculated, the second-order transaction network graph is input into the trained graph neural network encoder, the topological features of the account to be detected are extracted from the second-order transaction network graph, and then the statistical features of the account to be detected are spliced and input into the trained Xgboost classifier for account classification to determine whether it is a normal account or a phishing account.

[0060] In the calculation of the initial features of the account, the address similarity features of each account in the transaction network of the account to be detected are calculated to detect small amount phishing scenarios. Based on the random walk restart algorithm, subgraphs are generated from the transaction network of the account, and the center nodes of the first and second subgraphs are taken as positive samples, the center nodes in the first subgraph and the non-center nodes in the second subgraph are taken as negative samples, and the center nodes of the second subgraph and other non-center nodes of the first subgraph are also taken as negative samples for comparative learning.

[0061] The embodiment adopts a transaction network data architecture based on independent nodes, and the core design principle is that each account constructs an independent second-order transaction topological graph as a training sample input, rather than using a global transaction network graph aggregated from all accounts for model training. This architecture follows a divide-and-conquer data processing mechanism, and effectively realizes the accurate extraction of account-level transaction features through independent modeling of individual account transaction networks.

[0062] For the detection of phishing nodes, the transaction network graph of the account to be detected needs to be input, and the trained model extracts the transaction structure features of the account to be detected from the transaction network graph, and splices the transaction statistical features and address similarity features of the account to be detected, and finally uses the classifier for classification.

[0063] Corresponding to the above method, the application also provides a device / system, which comprises a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, and the processor being configured to execute the computer instructions stored in the memory, so that the device / system implements the steps of the method as described above.

[0064] The application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the edge computing server deployment method as described above. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0065] In summary, the fishing account detection model training method, detection method and device of the application break through the feature dilution and excessive smoothing bottleneck caused by traditional global large graph training by independently constructing a second-order transaction network for each account and completely retaining its local transaction structure; the address similarity feature is introduced to accurately capture the high-frequency transaction object tail number similarity deliberately constructed by attackers and effectively identify visual confusion type phishing behavior. The random walk restart algorithm is used to generate a double local subgraph, and the center node self-pairing is innovatively taken as a positive sample, and the cross-subgraph non-center node is taken as a negative sample to construct a node-level contrast loss, thereby strengthening the model's ability to distinguish phishing nodes and normal neighbors; the classification loss is trained end-to-end to enable the graph neural network to be incrementally updated without retraining the global graph, thereby realizing lightweight deployment. In the blockchain transaction scenario with extremely imbalanced data, the application can significantly reduce the risk of misjudgment, has high sensitivity and real-time performance, and is suitable for online risk control scenarios of large-scale decentralized transaction platforms.

[0066] Those of ordinary skill in the art will appreciate that the various illustrative components, systems, and methods described herein can be implemented, individually and / or collectively, by a wide range of hardware, software, firmware, or any combination thereof. The illustrative embodiments described herein could be implemented by one or more computer programs executed by one or more programmable computers. Each computer program can be implemented in a high-level procedural or object-oriented programming language, or in assembly or machine language. The language can be a compiled or interpreted language. Each such computer program can be stored in a computer readable storage medium (removable, non-removable, or in a transitory signal) that can represent a repository for a repository for such a computer program, and that can communicate such a computer program to a storage medium device or to an information-carrying medium of a carrier wave or other transport mechanism. A functionality corresponding to that described herein can be implemented by one or more such computer programs in connection with one or more computers. The computer programs can be stored in any proprietary, higher level, or even assembly or machine language suitable for the computer on which the computer program is to be executed. The general nature of the algorithms and computer programs can be understood by those of ordinary skill in the art having the benefit of the description contained herein.

[0067] It is to be understood that the application is not limited to the particular configurations and processes described herein and shown in the drawings, which can be varied in accordance with the spirit and principles of the application. Exemplary, non-limiting details of well-known methods are omitted so as not to obscure the disclosure. In the above-described embodiments, a number of specific steps are described and / or illustrated as examples. However, the methods process of the application is not limited to the specific steps described and / or illustrated, and the order of the steps can be changed, or other steps can be added, or replaced, or eliminated, depending on the circumstances.

[0068] In the present application, features described and / or illustrated with respect to one embodiment can be used in the same or a similar way in one or more other embodiments and / or combined with or substituted for features of other embodiments.

[0069] The above description is only preferred embodiments of the present application, not for limiting the present application. The embodiments of the present application can be variously changed and / or modified by those skilled in the art. Any modified, equivalent, improved and / or changed techniques, which are made within the spirit and principles of the present application, should be included in the scope of the present application.

Claims

1. A method for training a phishing account detection model in a decentralized trading scenario, characterized in that, The method includes the following steps: For a target decentralized trading network, a set of sample account addresses, including phishing account samples and randomly sampled normal account samples, is obtained as a training sample set. For each account sample in the training sample set, a second-order transaction network is extracted. This second-order transaction network includes first-order associated account nodes that directly transact with the corresponding account sample, and second-order associated account nodes that directly transact with the first-order associated accounts but not with the corresponding account sample. Edges are constructed based on transaction relationships, and the transaction statistical characteristics of each account sample with respect to preset transaction parameters are recorded. For each account sample, a first number of target accounts with the highest transaction frequency are selected from the second-order transaction network, and the address similarity features between the account sample and the corresponding target account are calculated. Finally, a category label indicating whether the account sample belongs to a phishing account is added. Using each account sample in the training sample set as the center node, the second-order transaction network is subjected to two independent sampling operations using a random walk restart algorithm to obtain the first subgraph and the second subgraph; the center nodes of the first subgraph and the second subgraph are constructed as positive sample pairs, and the center node of the first subgraph and the non-center node of the second subgraph, as well as the center node of the second subgraph and the non-center node of the first subgraph, are constructed as negative sample pairs; An initial neural network containing a graph neural network encoder and a classifier is obtained. The graph neural network encoder extracts topological features from each node in the second-order transaction network, the first subgraph, and the second subgraph, respectively. The topological features of the second-order transaction network are connected to transaction statistical features and address similarity features to obtain the final features. The final features are processed by the classifier to output a classification prediction value indicating whether the central node belongs to a phishing account. The initial neural network is trained using the training sample set. The topological features of each node in the first subgraph and the second subgraph are mapped to the same space based on the projection head, and the contrastive loss is calculated based on the positive sample pairs and the negative sample pairs. The classification loss is calculated based on the deviation between the classification prediction value and the category label. The parameters of the initial neural network are updated by combining the contrastive loss and the classification loss to obtain the phishing account detection model.

2. The method for training a phishing account detection model in a decentralized transaction scenario according to claim 1, characterized in that, The preset transaction parameters include the number of outgoing edge transactions, the number of incoming edge transactions, the total amount of received transactions, and the total amount of sent transactions. The preset transaction parameters are normalized and then one-hot encoded for discrete values. The graph neural network encoder consists of a three-layer graph convolutional network encoder, and each layer of the graph convolutional network encoder also has a ReLU activation function layer; the classifier adopts the XGBoost classifier.

3. The method for training a phishing account detection model in a decentralized transaction scenario according to claim 1, characterized in that, For each account sample, a first number of target accounts with the highest transaction frequency are selected in the second-order transaction network, and the address similarity features between the account sample and the corresponding target accounts are calculated, including: For each account sample, select 5-10 target accounts with the highest trading frequency from the second-order trading network; Calculate the Levinstein distance between the account sample and its corresponding target account after the second predetermined number of digits of the account address, and take the minimum, maximum, average or variance as the address similarity feature.

4. The method for training a phishing account detection model in a decentralized transaction scenario according to claim 1, characterized in that, The formula for calculating the contrast loss is: ； in, This represents the node-level comparison loss. This represents the first subgraph sampled by the i-th central node in the second-order transaction network using the random walk restart algorithm. This represents the second subgraph sampled by the i-th central node in the second-order transaction network using the random walk restart algorithm; N represents the number of samples. τ is a temperature parameter. This represents the calculation of the cosine similarity of vectors. For nodes The negative sample topological features The topological features of the central node of the first subgraph. For nodes The negative sample topological features The topological features of the central node of the second subgraph.

5. The method for training a phishing account detection model in a decentralized transaction scenario according to claim 1, characterized in that, The contrast loss uses InfoNCE loss, and the classification loss uses cross-entropy loss.

6. The method for training a phishing account detection model in a decentralized transaction scenario according to claim 1, characterized in that, For blockchain transaction scenarios, the second-order transaction network of each account sample is crawled through the RESTful API interface provided by the Etherscan blockchain explorer.

7. A method for detecting phishing accounts in a decentralized trading scenario, characterized in that, The method includes the following steps: For the account to be analyzed in the target decentralized transaction network, obtain its corresponding second-order transaction network. The second-order transaction network includes first-order associated account nodes that directly transact with the corresponding account sample, and second-order associated account nodes that directly transact with the first-order associated account but do not directly transact with the corresponding account sample. Edges are constructed based on transaction relationships. Obtain the transaction statistics features of the account to be analyzed with respect to preset transaction parameters, filter the first number of target accounts with the highest transaction frequency in the second-order transaction network, and calculate the address similarity features between the account to be analyzed and the corresponding target accounts; The second-order transaction network with the account to be analyzed as the central node is input into the graph neural network encoder of the phishing account detection model in the decentralized transaction scenario training method according to any one of claims 1 to 6 to extract topological features. The topological features, transaction statistical features and address similarity features of the account to be analyzed are then connected and input into the classifier in the phishing account detection model to output the detection result of whether the account to be analyzed belongs to a phishing account.

8. The method for detecting phishing accounts in a decentralized transaction scenario according to claim 7, characterized in that, The preset transaction parameters include the number of outgoing edge transactions, the number of incoming edge transactions, the total amount of received transactions, and the total amount of sent transactions. The preset transaction parameters are normalized and then one-hot encoded for discrete values. The calculation steps for the address similarity features include: selecting 5 to 10 target accounts with the highest transaction frequency in the second-order transaction network for the account to be analyzed; Calculate the Levinstein distance between the account address of the account to be analyzed and its corresponding target account, and take the minimum, maximum, average or variance as the address similarity feature.

9. A phishing account detection device for decentralized trading scenarios, comprising a processor, a memory, and a computer program / instructions stored in the memory, characterized in that, The processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the device implements the steps of the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 8.

Images