Ethereum phishing detection method and system based on dynamic feature fusion

Abstract

The invention discloses an Ethereum phishing detection method and system based on dynamic feature fusion, and aims to accurately evaluate phishing risks in Ethereum transactions in real time. According to the system, a graph structure analysis technology, a graph embedding method and a Transform model are combined, a unified and flexible transaction data graph is constructed, multi-source features are dynamically extracted and fused, and a multi-head attention mechanism is utilized to realize adaptive adjustment of feature weights. The system can process transaction data of different scales, has a dynamic updating mechanism, and can timely adapt to and identify continuously evolved phishing attack modes. The method has high detection accuracy and robustness, and an effective technical scheme is provided for guaranteeing the security of the Ethereum block chain network.

Description

Technical Field

[0001] This invention relates to the field of blockchain security technology, and in particular to an Ethereum phishing detection method and system based on dynamic feature fusion. Background Technology

[0002] Current blockchain security detection technologies for Ethereum phishing attacks primarily rely on a combination of static transaction graph analysis and traditional machine learning models. However, with the continuous growth of Ethereum network transaction volume and increasingly complex attack methods, phishing has become one of the most covert and harmful attack methods in the blockchain ecosystem. Furthermore, phishing attack methods have evolved rapidly in recent years, with the emergence of numerous new attack forms such as Approval Phishing, Permit Phishing, and spoofed smart contract calls, no longer limited to the early direct fund transfer model. Based on the latest WWW'23 research data, traditional models show a significant decrease in accuracy when facing these new attacks, highlighting a serious problem of model "aging" and a lack of ability to model temporal evolution characteristics.

[0003] Secondly, traditional graph embedding methods suffer from scalability bottlenecks when dealing with dynamic transaction networks. When Ethereum transaction volume expands to the level of millions of nodes, classic models such as Trans2Vec and Node2Vec experience a sharp drop in training efficiency when faced with extreme imbalanced data (a 1:50 ratio of positive to negative samples) commonly found in reality. A single training round takes more than 24 hours, and the F1 score plummets to 0.041, severely impacting the model's practicality and reflecting the problems of excessively high algorithm complexity and a lack of efficient sparsity handling mechanisms.

[0004] Furthermore, existing systems generally employ fixed threshold strategies for risk assessment, lacking real-time awareness of transaction behavior patterns and environmental dynamics, and are unable to effectively counter the "obfuscation" strategies employed by phishing attackers. For example, attackers significantly increase the difficulty of detection by periodically dispersing funds, using intermediary accounts for money laundering, or simulating normal smart contract calls. In cross-time verification tests, representative models such as EPD also show significant performance degradation on novel phishing samples, demonstrating insufficient robustness to data distribution drift in real-world environments. In addition, current mainstream feature engineering methods rely heavily on manually designed transaction topology features (such as node degree, clustering coefficient, inflow and outflow strength, etc.), severely neglecting the temporal dynamics and economic behavior characteristics inherent in Ethereum transactions themselves. For example, transaction interval patterns, gas price fluctuation trends, and contract call depth are highly valuable for identification in phishing attacks, but are rarely systematically modeled in existing methods. This results in insufficient model generalization ability and a significantly increased false positive rate when dealing with "zero-sample" phishing attacks (i.e., novel phishing patterns that the model has never seen before), making it difficult to meet the detection needs in real-world scenarios.

[0005] Existing Ethereum phishing detection technologies suffer from significant technical bottlenecks, including insufficient timeliness, poor scalability, weak dynamic adaptability, and limited feature extraction. These issues severely restrict the application value of detection systems in real-world blockchain environments. There is an urgent need to construct a novel detection framework that integrates multi-dimensional features, possesses dynamic evolution capabilities, and can process large-scale transactions to effectively address ever-evolving phishing attack methods and improve detection accuracy and real-time performance. Summary of the Invention

[0006] This invention aims to overcome the shortcomings of existing Ethereum phishing detection technologies in terms of timeliness, scalability, and adaptability to new attack patterns. It proposes an Ethereum phishing detection system that integrates graph neural networks, deep embedding models, and Transformer technology, possessing dynamic updating and adaptive capabilities. Designed for real-world large-scale transaction environments, this system continuously monitors the transaction network, dynamically assesses and identifies phishing behavior, significantly improving the accuracy and practicality of detection.

[0007] This invention is achieved through the following technical solution: This invention provides a method for detecting phishing on the Ethereum network based on dynamic feature fusion, the method comprising the following steps: (1) Collect Ethereum transaction data in real time or periodically, and construct an account-transaction graph or transaction-transaction graph. The nodes in the graph contain account addresses or transactions, and the edges contain transaction amounts, timestamps, gas prices, and contract call information. (2) Extract structural features, temporal features, economic behavior features and contract features from the transaction graph, and use graph neural network (GNN), graph embedding method and Transformer model to generate deep embedding representations of nodes and transactions; (3) Joint detection of transaction behavior is performed based on graph neural network, machine learning model and Transformer model, risk score is calculated and phishing risk judgment result is generated by dynamic weighted fusion scoring mechanism; (4) Periodically collect the latest phishing samples and transaction data to realize incremental model learning, adaptive feature adjustment and robustness monitoring; the periodicity refers to the data acquisition and update operation that is automatically executed every 24 hours at a set time interval.

[0008] Further, step (2) extracts structural features, temporal features, economic behavior features, and contract features from the transaction graph; specifically: (2.1) Structural feature extraction: In-degree and out-degree: measure the activity level of an account or transaction, and detect abnormal high-frequency trading or concentrated fund flows; Clustering coefficient: reflects the degree of local close connection between accounts, and helps to identify phishing characteristics of concentrated or cyclical fund flows; Inflow and outflow intensity: This measures the total amount of funds transferred in and out of the account to assess the scale of account cash flow. Count of neighboring nodes: Count the number of direct transaction partners to identify potential intermediary accounts or bulk transfer activities; (2.2) Behavioral feature extraction: Transaction frequency: Count the number of transactions per unit of time to identify suspicious accounts that engage in high-frequency operations within a short period of time; Active Cycle: Calculate the lifecycle of an account or transaction to assess the "quick in, quick out" operational characteristics of a typical phishing address; Fund Flow Patterns: Analyze the inflow and outflow paths of funds to capture complex patterns of dispersed or cyclical fund transfers; Gas price fluctuations: Monitor gas price changes in transactions and identify attacks that manipulate gas prices. (2.3) Contract Feature Extraction: Contract call identifier: Identifies whether a transaction involves contract calls, and identifies phishing contract interaction behaviors; Contract type: Differentiate between ERC20, ERC721, or custom contracts, and extract features for specific phishing techniques (such as Approval phishing); Call frequency and depth: Analyze the frequency and recursion depth of account and contract interactions to uncover phishing behaviors hidden in complex call chains; (2.4) Temporal feature extraction: Transaction time interval: Calculate the time difference between consecutive transactions to identify abnormally dense trading behavior within a short period of time; Lifecycle: Calculate the time span from the first appearance of an account or transaction to the present, and assess the lifecycle characteristics of ephemeral phishing accounts; Time-based volatility patterns: Modeling changes in trading activity over time to identify cyclical fishing patterns.

[0009] Furthermore, the joint detection of transaction behavior based on graph neural networks, traditional machine learning models, and Transformer models specifically includes: (3.1) The graph neural network detection submodule identifies high-risk nodes and abnormal transaction patterns based on the structural features of the transaction graph; (3.2) The embedded feature classification submodule classifies transaction risks based on deep embedding vectors, using LightGBM or Support Vector Machine (SVM). (3.3) The Transformer time series detection submodule is based on transaction time series modeling to identify complex time series phishing strategies; (3.4) The weighted fusion algorithm is used to integrate the detection results of each sub-module to generate the final risk score and label.

[0010] Furthermore, the dynamic weighted fusion scoring mechanism in step (3) includes result normalization processing, weighted fusion algorithm, and threshold adaptive strategy, as follows: The result normalization processing normalizes the output risk probabilities of structure detection, feature detection, and time sequence detection; then, the weighted fusion algorithm is used to calculate the comprehensive risk score based on the model performance weights; and the threshold adaptive strategy is combined to support static thresholds and dynamic adjustments; the dynamic threshold is adjusted according to the time period, transaction volume, and on-chain environment; finally, the comprehensive risk score of a single address or transaction is determined and output; finally, the risk level is divided into high risk, medium risk, and low risk; and an interpretable report is generated, as well as the features or transaction links that trigger the risk are indicated.

[0011] Furthermore, step (4) specifically includes the following sub-steps: (4.1) Incremental learning: This involves updating model parameters online based on newly added data samples; (4.2) Feature Adaptation: Automatically remove invalid features and dynamically introduce new features; (4.3) Model robustness monitoring: Real-time monitoring of detection performance indicators and automatic triggering of model fine-tuning or retraining processes.

[0012] This invention also provides an Ethereum network phishing detection system based on dynamic feature fusion. The overall architecture of this system includes a data acquisition module, a graph modeling and feature engineering module, a multi-dimensional detection module, and a dynamic update module. Data Acquisition and Graph Modeling Module: Collects Ethereum transaction data in real-time or periodically, constructs account-transaction graphs or transaction-transaction graphs, where nodes contain account addresses or transactions, and edges contain attributes such as transaction amount, timestamp, gas price, and contract call information; Multi-dimensional Feature Extraction and Deep Embedding Module: Extracts structural features, temporal features, economic behavior features, and contract features from the transaction graph, and uses Graph Neural Networks (GNNs), graph embedding methods, and Transformer models to generate deep embedded representations of nodes and transactions; Multi-model Fusion Detection and Risk Scoring Module: Jointly detects transaction behavior based on graph neural networks, traditional machine learning models, and Transformer models, calculates risk scores, and generates phishing risk assessment results; Dynamic Update and Evolutionary Adaptation Module: Periodically collects the latest phishing samples and transaction data, enabling incremental model learning, adaptive feature adjustment, and robustness monitoring to maintain stable detection performance.

[0013] Furthermore, the data acquisition and graph modeling module includes acquisition range control, allowing users to set the acquisition depth according to their needs, specifically including: First-level transaction capture: Captures the direct transaction records of the target account, suitable for rapid detection and evaluation; Second-order and multi-order transaction collection: Based on the acquisition of first-order transactions, the transaction records of relevant accounts are recursively collected up to the specified level to fully restore the transaction flow and behavior chain and accurately identify phishing techniques; it also supports time window and block range control to collect transaction data within a specific time period or block height range to meet the needs of time series modeling.

[0014] Specifically, the data acquisition and graph modeling module is designed with the following structural characteristics: Weighted attribute design: Each edge supports multiple attribute fields, including amount, time, tag, etc., to fully retain key transaction information; Multi-attribute nodes: Nodes support binding risk tags, address attribution, and account type; Dynamic graph support: The system supports the generation and maintenance of dynamic graphs based on time windows, enabling rapid incremental graph creation for real-time incoming data to meet dynamic detection requirements; Sparse storage structure optimization: Sparse adjacency lists and indexing mechanisms are used to store large-scale graph data to reduce memory overhead.

[0015] Specifically, the system supports processing millions of transaction nodes and large-scale transaction graphs, can cope with extreme imbalance scenarios of positive and negative samples of 1:50 or higher, and the detection time for a single round is controlled within 24 hours.

[0016] Specifically, the system can be deployed on digital asset trading platforms, blockchain explorers, digital wallets, or auditing platforms, supports API calls, and provides real-time assessment, early warning, and visual tracking of phishing risks in Ethereum transactions.

[0017] The beneficial effects of this invention are as follows: (a) High scalability: Supports processing of millions of transaction nodes and ultra-large-scale transaction graphs, with strong detection timeliness to meet the needs of practical scenarios; (b) Strong robustness and adaptability: Through dynamic updates and deep temporal modeling, the model’s ability to recognize new fishing techniques is significantly enhanced; (c) Precise risk assessment: Integrating multi-model detection and risk scoring, comprehensively improving detection accuracy and recall, and effectively reducing false positives and false negatives; (d) High real-time availability: The system can be flexibly deployed on trading platforms, wallet systems or blockchain nodes to achieve real-time monitoring and early warning of transactions, thereby improving the security level of the blockchain ecosystem. Attached Figure Description

[0018] Figure 1 This is a system flowchart of the present invention; Figure 2This is a flowchart of the transaction graph modeling process of the present invention; Figure 3 These are the F1 score plots of each model in this invention at a data ratio of 1:1; Figure 4 These are the F1 score plots of each model in this invention at a data ratio of 1:10; Figure 5 This is a diagram of the feature extraction and embedding generation module of the present invention. Detailed Implementation

[0019] To more clearly illustrate the present invention, the specific implementation process of the present invention is described in detail below with reference to embodiments. The present invention provides an Ethereum network phishing detection method based on dynamic feature fusion, the method comprising the following steps: (1) Collect Ethereum transaction data in real time or periodically, and construct an account-transaction graph or transaction-transaction graph. The nodes in the graph contain account addresses or transactions, and the edges contain transaction amounts, timestamps, gas prices, and contract call information. (2) Extract structural features, temporal features, economic behavior features and contract features from the transaction graph, and use graph neural network (GNN), graph embedding method and Transformer model to generate deep embedding representations of nodes and transactions; (3) Joint detection of transaction behavior is performed based on graph neural network, machine learning model and Transformer model, risk score is calculated and phishing risk judgment result is generated by dynamic weighted fusion scoring mechanism; (4) Periodically collect the latest phishing samples and transaction data to realize incremental model learning, adaptive feature adjustment and robustness monitoring; the periodicity refers to the data acquisition and update operation that is automatically executed every 24 hours at a set time interval.

[0020] Furthermore, this invention provides an Ethereum network phishing detection system based on multi-technology integration and dynamic update mechanism, suitable for large-scale Ethereum transaction data environments, capable of dynamically identifying and assessing potential phishing risks. The system includes the following core modules and implementation process: I. Data Acquisition and Preprocessing Module like Figure 1 As shown, this module is the basic functional module of the system, responsible for efficiently and comprehensively acquiring Ethereum on-chain transaction data and related tag information, and cleaning and preprocessing it to provide standardized and high-quality data input for subsequent modeling and feature extraction.

[0021] 1.1 Data Collection Methods and Sources This module supports multiple data acquisition methods to ensure data integrity and real-time performance, specifically including: Blockchain node synchronization: Directly connect to Ethereum full nodes or light nodes to synchronize blocks and transaction data in real time, obtain complete original transaction records, and ensure data authority; API interface capture: Quickly obtain transaction details for a specified address or block range by calling the API interfaces of mainstream Ethereum data platforms such as Etherscan, Infura, or Alchemy; Third-party data platform collection: Integrating public data sources such as XBlock platform and Ethereum Label Cloud to obtain historical transaction data and information on specially labeled accounts such as phishing, DeFi, and blacklisted accounts.

[0022] 1.2 Data Acquisition Content and Structure Design To meet the feature extraction requirements for phishing detection, the system collects data that comprehensively covers the key attributes of transactions, including but not limited to: Basic transaction information: Transaction hash (TxHash); Block height and timestamp; Sender address (From Address); Receiver address (To Address); Transaction amount (Value); Gas price (Gas Price) and actual gas used (Gas Used).

[0023] Smart contract information: whether a contract call is involved; the address of the called contract and its function signature; the call parameters and return results; and internal transaction records.

[0024] Address tag information: source tag (e.g., "Phishing", "Exchange", "DEX", "DeFi"); risk level (e.g., high risk, medium risk, normal); project or entity identifier; The data structure design adopts object-oriented modeling and supports storage in JSON or relational database formats, which facilitates subsequent graph structure generation and feature extraction.

[0025] 1.3 Customization of Transaction Scope and Construction of Behavioral Chain The system supports flexible acquisition range control, allowing users to set the acquisition depth according to their needs, specifically including: First-level transaction capture: Captures the direct transaction records of the target account, suitable for rapid detection and evaluation; Second- and multi-level transaction collection: Based on the acquisition of first-level transactions, recursively collect transaction records of relevant accounts up to the specified level, fully reconstruct the flow of funds and the chain of behavior, and accurately identify complex phishing techniques such as money laundering or circular transfers.

[0026] In addition, the system supports time window and block range control, collecting transaction data within a specific time period or block height range to meet the needs of time series modeling.

[0027] 1.4 Data Cleaning and Standardization To ensure data quality and subsequent modeling effectiveness, this module incorporates an automatic cleaning and normalization process, specifically including: field integrity check and filling: automatically detecting missing fields (such as missing Gas values ​​or labels); filling or completing missing values ​​based on on-chain data or rule bases; Abnormal transaction filtering: Remove invalid transactions (such as failed transactions or transactions with unsuccessful status codes); remove duplicate transaction records to avoid redundant calculations in feature extraction; filter zero-amount transactions or obviously risk-free system contract transactions (such as ERC20 batch transfer system operations).

[0028] Data standardization processing: Amounts are uniformly converted to Ethereum Main Units (ETH); timestamps are converted to standard UTC time format; Gas prices and consumption are converted to standard units (Gwei, ETH) that are easy to model.

[0029] Feature enhancement and preprocessing: Derivative transaction direction (in / out), transaction type (normal transfer, contract call) and other auxiliary features; add edge attributes (such as transaction amount, time difference) for subsequent graph modeling; generate a unique identifier for the behavior chain to ensure full-chain tracking capability.

[0030] 1.5 Data Storage and Management The cleaned data is stored in a dedicated transaction data warehouse, designed with a scalable distributed storage architecture that supports: node-level indexing for quick location of target accounts or transactions; multi-level caching mechanisms to accelerate the reading efficiency of hot data; and data version control to support incremental updates and historical backtracking.

[0031] 1.6 Technical Effects This module enables the system to automatically collect and preprocess massive amounts of Ethereum transaction data, ensuring: complete and accurate transaction behavior data; comprehensive extraction of key fields for phishing attack characteristics; support for large-scale, in-depth transaction behavior chain modeling needs; and effectively reduce noise interference in subsequent modeling, improving the accuracy and efficiency of model detection.

[0032] II. Transaction Chart Modeling Module like Figure 2As shown, this module aims to automatically construct a multi-dimensional, multi-attribute transaction graph structure based on preprocessed Ethereum transaction data, providing a complete and rich graph representation for subsequent feature extraction, embedding generation, and model detection. This module considers both account relationships and transaction behavior perspectives, and its flexible design meets the modeling needs of different detection strategies.

[0033] 2.1 Selection of Graph Modeling Mode This system supports two transaction graph modeling modes, which users can choose as needed or build in parallel: (1) Account-based graph modeling Node definition: Ethereum account addresses (including external account EOA and smart contract accounts) are used as nodes in the graph.

[0034] Edge definition: Transactions between accounts are considered as edges. Each transaction is an edge, and the direction of the edge is from the sender to the receiver.

[0035] Edge attribute design: transfer amount (Value); transaction timestamp (Timestamp); gas price and actual consumption (Gas Price, Gas Used); whether it is a contract call (IsContractCall); tag propagation information (such as risk tags, project ownership tags).

[0036] Graph features: Supports directed and weighted graph design; supports multiple edges between the same node, retains the time sequence and frequency information of all transactions; expandable to support dynamic time slice modeling, facilitating time series feature analysis.

[0037] This modeling approach is suitable for capturing the flow of funds and transaction density characteristics at the account level, and can effectively reveal structured behaviors such as fund dispersion and circular transfers commonly found in phishing attacks.

[0038] (2) Transaction-based Line Graph Modeling Node definition: Each transaction on the Ethereum blockchain is considered an independent node (Transaction Node).

[0039] Edge definition: If two transactions involve a common account (e.g., the recipient of the first transaction is the sender of the second transaction), then an edge is established between the nodes of the two transactions.

[0040] Edge attribute design: Time Interval; Flow Direction, indicating whether funds flow continuously between two transactions; Gas Change; Whether the participating account is a Risk Flag address.

[0041] Graph features: Enhanced modeling of order and dependency relationships between transactions; easy to capture complex chain attacks, mass phishing, and fund laundering paths; scalable support for path weight calculation to measure the "cost" or "risk level" of fund flows.

[0042] This modeling approach is suitable for identifying advanced phishing techniques based on contract calls or complex path designs, such as Approval phishing, Permit fraud, and "stepping stone" account transfers.

[0043] 2.2 Graph Structure Design and Storage Optimization To enhance the system's ability to process large-scale transaction data, this module is designed with the following structural characteristics: Weighted attribute design: Each edge supports multiple attribute fields, including amount, time, tag, etc., to fully retain key transaction information; Multi-attribute nodes: Nodes support binding multi-dimensional information such as risk tags, address attribution, and account type (ordinary address or contract address); Dynamic graph support: The system supports the generation and maintenance of dynamic graphs based on time windows, and can quickly and incrementally build graphs for real-time incoming data to meet dynamic detection needs; Sparse storage structure optimization: A sparse adjacency list + index mechanism is used to store large-scale graph data, which significantly reduces memory overhead and improves retrieval efficiency.

[0044] 2.3 Quality Control and Anomaly Handling An automatic deduplication mechanism avoids edge redundancy caused by duplicate transactions or abnormal rollbacks; cyclic edges and self-connected edges are identified and marked to facilitate special processing in the subsequent feature extraction stage; low-amount, high-frequency transaction chains are marked to help identify attack patterns such as "money laundering" or "transaction brushing".

[0045] 2.4 Technical Effects and Advantages Through this module, the system can: construct a complete and high-fidelity Ethereum transaction graph, fully preserving the temporal relationships and structural features in transactions; flexibly support account behavior analysis and transaction chain modeling, taking into account both micro-level transaction details and macro-level fund flows; provide an efficient and scalable graph data structure, laying a solid foundation for subsequent graph neural network modeling, embedding generation, and feature extraction; and significantly improve the system's performance in identifying complex phishing behaviors, especially demonstrating stronger detection capabilities against chained, batch, and temporal phishing strategies.

[0046] III. Feature Extraction and Embedding Generation Module like Figure 5 As shown, this module designs a multi-dimensional feature extraction and deep embedding mechanism based on the transaction graph modeling results, comprehensively characterizing the node and edge attribute features in the Ethereum transaction network, and improving the subsequent model's ability to identify phishing behavior and its generalization performance.

[0047] 3.1 Multidimensional Feature Extraction Design This module systematically extracts the features of nodes and edges in the graph from four dimensions: structure, behavior, contract, and time sequence, as detailed below: (1) Structural feature extraction In-degree and Out-degree: These measures the activity level of an account or transaction, and can detect unusually high-frequency trading or concentrated fund flows. Clustering coefficient: reflects the degree of local closeness between accounts, and helps to identify phishing characteristics of concentrated or cyclical fund flows; In / Out Strength: This measures the total amount of funds transferred in and out, and is used to assess the scale of account cash flow. Neighbor Count: Counts the number of direct transaction partners to identify potential "transfer accounts" or "bulk transfer" behaviors.

[0048] (2) Behavioral feature extraction Transaction Frequency: Counts the number of transactions per unit of time to identify suspicious accounts that engage in high-frequency operations within a short period of time; Activity Span: Calculates the lifecycle of an account or transaction to assess the "quick in, quick out" operational characteristics of a typical phishing address; Fund Flow Pattern: Analyze the inflow and outflow paths of funds to capture complex patterns of dispersed or cyclical fund transfers; Gas Price Variance: Monitors changes in gas prices during transactions to identify attacks that manipulate gas prices.

[0049] (3) Contract feature extraction Contract Call Identifier: Identifies whether a transaction involves a contract call, thus identifying phishing contract interaction behavior; Contract Type: Differentiates between ERC20, ERC721, or custom contracts, and extracts features for specific phishing techniques (such as Approval phishing); Call Frequency & Depth: Analyze the frequency and recursion depth of account and contract interactions to uncover phishing behaviors hidden in complex call chains.

[0050] (4) Temporal feature extraction Transaction interval: Calculates the time difference between consecutive transactions to identify abnormally dense trading behavior within a short period of time; Lifetime: Calculates the time span from the first appearance of an account or transaction to the present, assessing the lifetime characteristics of temporary phishing accounts; Temporal Volatility: Models changes in trading activity over time to identify cyclical fishing patterns.

[0051] 3.2 Deep Embedding Generation Mechanism To effectively reduce feature dimensionality and capture complex relationships, this module designs a multi-model embedding strategy to fully preserve the structural and dynamic features of the transaction graph: (1) Modeling based on graph neural network (GNN): GNN models such as GCN (Graph Convolutional Network) and GraphSAGE are adopted to aggregate the features of the node neighbors and extract local and global structural characteristics; multi-layer convolution is supported to capture deep-level transaction relationships and potential risk propagation paths; and the ability to perceive abnormal nodes and local abnormal structures (such as fund circulation and short-chain high-frequency transfers) is improved.

[0052] (2) Graph embedding (Node2Vec / Trans2Vec) modeling: Using the Node2Vec or Trans2Vec algorithm, the high-dimensional transaction graph is mapped to a low-dimensional dense vector space; it supports flexible depth-first and breadth-first search strategies, balancing structure preservation and sequence feature modeling; it focuses on preserving the temporal relationship and path dependency in the transaction behavior chain, adapting to the modeling needs of advanced phishing strategies such as money laundering and fund splitting.

[0053] (3) Transformer-based time series modeling: To address the time dependence of fund flows and behavioral characteristics, a long sequence modeling module based on the Transformer architecture is designed; through the self-attention mechanism, long-term transaction dependencies and latent attack behaviors (such as delayed withdrawals and deep fund washing) are captured; batch parallel processing is supported, taking into account the performance and accuracy of time series modeling, and improving the detection capability of complex cross-time period phishing strategies.

[0054] 3.3. Dynamic Selection and Optimization of Features and Embeddings The system automatically selects feature extraction paths and embedding models according to different detection tasks, balancing computational efficiency and detection results; it supports dynamic evaluation of feature importance, eliminates inefficient or redundant features, and ensures efficient model training and inference processes; the embedding results support real-time caching and reuse, improving real-time detection capabilities under large-scale transaction flows.

[0055] 3.4 Technical Effects and Advantages The feature extraction and embedding mechanism designed and implemented in this module has the following technical advantages: it comprehensively covers transaction structure, behavior patterns, contract interaction and time series features, and has a complete feature system; it has diversified embedding models, taking into account both local feature extraction and global dependency modeling, thereby improving model robustness; it efficiently processes large-scale transaction graphs, significantly reduces feature dimensionality, and improves the performance of downstream detection models; it strengthens the system's ability to perceive and detect complex, covert and dynamically evolving phishing attacks, thereby improving generalization effect.

[0056] IV. Multi-model fusion detection module This module is the core decision-making unit of the system. It designs an integrated risk assessment framework that combines graph neural networks, machine learning models, and time series modeling techniques. By combining multi-dimensional features and prediction results, it comprehensively assesses the phishing risks of addresses or transactions in the Ethereum transaction network, achieving high-precision and robust dynamic detection.

[0057] 4.1 Structure Detection Based on Graph Neural Networks (GNNs) This step primarily targets the topological features of the transaction graph, utilizing GCN (Graph Convolutional Network) or GraphSAGE models to model the strength of relationships between nodes and potential risk propagation paths. The input consists of the node feature matrix and adjacency matrix in the transaction graph. The model automatically aggregates the features of adjacent nodes and extracts local and global structural features through multi-layer convolution. The output is a risk probability score for each node, reflecting the degree of anomaly and phishing tendency of the node in the overall network. This part is particularly adept at detecting typical structured phishing attack patterns such as fund loops, intensive transfers, and concentrated money laundering.

[0058] 4.2 Feature Detection Based on Machine Learning This step uses traditional machine learning classifiers to assess risk based on the node embedding vectors and multi-dimensional transaction features generated in the previous module. It supports models such as LightGBM, Random Forest, and Support Vector Machine (SVM), balancing accuracy and computational efficiency. It automatically models the non-linear relationship between features and phishing risks, enhancing the identification of behavioral features such as amount fluctuations, abnormal transaction frequency, and gas manipulation. This path effectively improves the system's ability to identify atypical phishing patterns, such as strategies that use gas price manipulation or small-amount, high-frequency transactions to confuse the detection system.

[0059] 4.3 Transformer-based timing detection To address the complex transaction behaviors with long time spans and deep dependency chains commonly encountered in phishing attacks, the system designs a time-series modeling process based on the Transformer architecture; the model takes a continuous transaction sequence and its time-series characteristics as input, and models the long dependencies between transactions through a self-attention mechanism; 4.4 Risk Integration and Scoring Mechanism To fully leverage the detection advantages of each sub-model, the system designs a dynamically weighted fusion scoring mechanism, specifically including: result normalization: normalizing the output risk probabilities of structure detection, feature detection, and time series detection; weighted fusion algorithm: calculating the comprehensive risk score based on the model performance weights (which can be trained or manually configured); threshold adaptive strategy: supporting static thresholds and dynamic adjustment strategies; the dynamic threshold can be adjusted according to factors such as time period, transaction volume, and on-chain environment; final judgment output: outputting the comprehensive risk score of a single address or transaction; risk level classification (e.g., high risk, medium risk, low risk); generating an interpretable report that indicates the main features or transaction links that trigger the risk.

[0060] 4.5 Technical Effects and Advantages Experimental results are as follows Figure 3 and Figure 4 As shown, the F1 scores of various detection models integrated in the system are demonstrated under different dataset time periods and class imbalance conditions, verifying the superiority of the multi-model fusion architecture proposed in this invention.

[0061] Figure 3 This reflects the F1 score performance of different models across consecutive time periods under class balance (1:1) conditions. It can be seen that models such as TTAGN, CFEM, and GCN maintain consistently high and stable performance across multiple time periods, with F1 scores generally remaining above 0.7. TTAGN even reaches a high level of 0.85 in several time periods, demonstrating its deep integration of graph structure and time series features. In contrast, traditional methods such as Handcraft, Node2Vec, and Graph2Vec show significantly unstable performance, indicating limited generalization ability in the absence of co-modeling of structural behavior.

[0062] Figure 4Experimental results are presented under extreme class imbalance (1:10) conditions. Although the overall F1 score decreased, the TTAGN and GCN models in this system still showed significant robustness, especially TTAGN, which maintained an F1 score above 0.7 across multiple time periods. In contrast, other models such as BERT4ETH, EPD, and Trans2Vec degraded significantly or even approached 0, demonstrating the significant advantage of the structure-behavior-temporal feature fusion design in this invention in resisting data skew.

[0063] In summary, the multi-model fusion architecture proposed in this invention possesses the following technical advantages: High comprehensiveness: It integrates structural, behavioral, and temporal features, adapting to diverse attack scenarios and covering the vast majority of phishing behavior patterns; High detection accuracy: The fused models complement each other, effectively reducing false positives and false negatives caused by single models; High real-time performance: It adopts lightweight design and graph compression technology to meet the real-time detection needs of large-scale on-chain transactions; Good interpretability: It integrates feature contribution analysis and path tracing mechanisms, enhancing model transparency and facilitating traceability and accountability; High robustness: The dynamic integration strategy adapts to different time periods and data distribution changes, effectively addressing the continuous evolution of phishing techniques. The experimental results fully verify the practicality and effectiveness of the proposed multi-model detection system in complex blockchain environments, demonstrating high engineering application value and promising prospects for widespread adoption.

[0064] V. Dynamic Update and Model Adaptation Module This module is designed with a complete dynamic update and model adaptation mechanism to ensure that the system maintains high detection accuracy and strong robustness in long-term operation, and has the ability to adapt to and respond to unknown new fishing techniques.

[0065] 5.1 Automatic Data Update Mechanism The system has a built-in data collection scheduler that supports periodic or real-time collection of new on-chain transaction data and the latest phishing address tags. The data update scope includes: transaction records and contract call data in the latest block; newly added phishing address lists published by public or third-party platforms; attack signature databases or risk tag information shared within the industry; and an automatic data update process that ensures that the system's feature extraction and modeling stages are always based on the latest on-chain environment and attack intelligence, reducing the risk of model aging.

[0066] 5.2 Feature Library Dynamic Adjustment Mechanism The system design includes a feature importance assessment module that periodically quantifies the contribution of each feature to the current model; inefficient feature elimination: automatically removing features that no longer have discriminative power or contribute no positive impact to the model's performance; reducing feature redundancy and optimizing computational resource usage; dynamic introduction of emerging features: introducing new features such as the latest Gas usage patterns and interactive contract features based on changes in on-chain transaction behavior; supporting the model's awareness of potential key features in new attack methods (such as flash loan-related features, cross-chain bridge operation features, etc.); and adaptive adjustment of the feature library to ensure that the system's feature expression capabilities are highly consistent with the actual risk environment.

[0067] 5.3 Incremental Training and Model Fine-tuning Mechanism This module adopts an incremental learning framework to avoid the high computational overhead and time cost of traditional full retraining. Implementation method: New data samples are quickly incorporated into model training through online learning. It supports fine-tuning of some model weights, updating only the affected neural network layers or decision tree branches. Its advantages include rapid response to environmental changes, such as dealing with new attack scenarios like ApprovalPhishing and NFT phishing. It also maintains historical and effective knowledge to prevent "catastrophic forgetting" and ensures the stability and consistency of detection results.

[0068] 5.4 Performance Monitoring and Feedback Optimization Mechanism The system deploys a performance monitoring module to track the following key indicators in real time: trends in detection accuracy, recall, and F1 score; the number and causes of false positives and false negatives; prediction latency and resource consumption; automatic hyperparameter tuning, dynamically adjusting key hyperparameters such as learning rate, regularization coefficient, and sampling strategy based on fluctuations in detection performance; model fusion weight adjustment to enhance the influence of strong models and reduce interference from weak models; a user-configurable automatic feedback mechanism: samples reviewed by humans can be fed back into the model; and "human-machine co-training" to continuously optimize model strategies and detection capabilities.

[0069] 5.5 Technical Effects and System Advantages The design and implementation of this module endows the system with the following significant advantages: Strong self-evolution capability: It can continuously absorb the latest on-chain data and attack characteristics, realizing the self-updating and iteration of the model; Strong adaptability: It effectively copes with the rapid changes in the trading environment and attack methods, maintaining the long-term effectiveness of the detection model; Resource optimization: Through incremental learning and feature optimization, it significantly reduces training and computing costs, adapting to large-scale on-chain data environments; Strong stability and robustness: The detection performance remains stable under long-term operation, avoiding model failure or decreased detection accuracy due to environmental drift.

[0070] VI. System Deployment and Application Scenarios The Ethereum phishing detection system designed in this invention has highly flexible deployment capabilities and can be seamlessly integrated into various blockchain-related platforms and security protection systems to meet the real-time detection and risk warning needs in different application scenarios, thereby comprehensively improving the security and stability of the Ethereum ecosystem.

[0071] 6.1 Deployment Mode Design This system supports the following typical deployment modes: Local deployment mode: The system can be deployed independently on digital asset trading platforms, proprietary data centers, or private cloud environments; it supports direct connection with the platform's internal transaction clearing and settlement system and risk control system to achieve internal closed-loop risk control; Cloud service deployment modes: Provides API interfaces or SaaS service formats, facilitating rapid access for various small platforms or applications; supports multi-tenant management to ensure data isolation and privacy security for different customers; Edge node deployment mode: Deployed on the blockchain node or light node in the side, it monitors and analyzes the on-chain transaction flow in real time, and is suitable for decentralized applications (DApps) and blockchain explorer scenarios.

[0072] 6.2 Typical Application Scenarios (1) Digital asset exchanges and decentralized trading platforms (DEX) The system can be deeply integrated into the risk control modules of centralized exchanges (CEX) or decentralized exchanges (DEX) to monitor potential phishing behavior in user transactions in real time; before a user initiates a transfer or contract interaction, the system immediately assesses the risk level of the trading object and issues warnings or blocks high-risk transactions; it supports post-event auditing and retrospective analysis of suspicious transactions, thereby enhancing the exchange's fund security and user asset protection capabilities.

[0073] (2) Digital wallets and asset custody platforms It integrates into wallet apps or cold / hot wallet management systems to monitor the security of contract addresses and account addresses involved in user operations in real time; before user authorization, transfer, or interaction, the system provides risk warnings to prevent users from mistakenly signing phishing contracts or transferring funds to high-risk addresses; it supports user-defined security policies to achieve personalized risk prevention and control.

[0074] (3) Blockchain Explorer and Audit Platform The system can be integrated into a blockchain explorer, directly displaying the risk level and source of risk on the transaction details page or address analysis page; It supports calls to smart contract auditing platforms to assess phishing risks during contract interactions, assisting auditors in discovering potential security vulnerabilities or attack entry points; and provides regulatory agencies with phishing risk analysis reports and visual tracking based on on-chain data.

[0075] 6.3 Technical Effects and Advantages Strong real-time early warning capabilities: The system supports millisecond-level risk scoring and feedback, meeting the real-time requirements of transactions; Easy integration and expansion: Standardized API interface design adapts to various platform architectures and supports subsequent expansion to multi-chain environments; Full-chain visualized risk tracking: Transactions are traceable, and the phishing chain is visualized, facilitating in-depth analysis by risk control and auditing personnel; Effectively enhances Ethereum ecosystem security: The application of the system can significantly reduce asset losses caused by phishing attacks, enhancing platform credibility and user trust.

[0076] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0077] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for detecting phishing on the Ethereum network based on dynamic feature fusion, characterized in that, The method includes the following steps: (1) Collect Ethereum transaction data in real time or periodically, and construct an account-transaction graph or transaction-transaction graph. The nodes in the graph contain account addresses or transactions, and the edges contain transaction amounts, timestamps, gas prices, and contract call information. (2) Extract structural features, temporal features, economic behavior features and contract features from the transaction graph, and use graph neural network (GNN), graph embedding method and Transformer model to generate deep embedding representations of nodes and transactions; (3) Joint detection of transaction behavior is performed based on graph neural network, machine learning model and Transformer model, risk score is calculated and phishing risk judgment result is generated by dynamic weighted fusion scoring mechanism; (4) Periodically collect the latest phishing samples and transaction data to realize incremental model learning, adaptive feature adjustment and robustness monitoring; the periodicity refers to the data acquisition and update operation that is automatically executed every 24 hours at a set time interval.

2. The Ethereum network phishing detection method based on dynamic feature fusion according to claim 1, characterized in that, Step (2) extracts structural features, temporal features, economic behavior features, and contract features from the transaction graph; Specifically: (2.1) Structural feature extraction: In-degree and out-degree: measure the activity level of an account or transaction, and detect abnormal high-frequency trading or concentrated fund flows; Clustering coefficient: reflects the degree of local close connection between accounts, and helps to identify phishing characteristics of concentrated or cyclical fund flows; Inflow and outflow intensity: This measures the total amount of funds transferred in and out of the account to assess the scale of account cash flow. Count of neighboring nodes: Count the number of direct transaction partners to identify potential intermediary accounts or bulk transfer activities; (2.2) Behavioral feature extraction: Transaction frequency: Count the number of transactions per unit of time to identify suspicious accounts that engage in high-frequency operations within a short period of time; Active Cycle: Calculate the lifecycle of an account or transaction to assess the "quick in, quick out" operational characteristics of typical phishing addresses; Fund Flow Patterns: Analyze the inflow and outflow paths of funds to capture complex patterns of dispersed or cyclical fund transfers; Gas price fluctuations: Monitor gas price changes in transactions and identify attacks that manipulate gas prices. (2.3) Contract Feature Extraction: Contract call identifier: Identifies whether a transaction involves contract calls, and identifies phishing contract interaction behaviors; Contract type: Differentiate between ERC20, ERC721, or custom contracts, and extract features for specific phishing techniques (such as Approval phishing); Call frequency and depth: Analyze the frequency and recursion depth of account and contract interactions to uncover phishing behaviors hidden in complex call chains; (2.4) Temporal feature extraction: Transaction time interval: Calculate the time difference between consecutive transactions to identify abnormally dense trading behavior within a short period of time; Lifecycle: Calculate the time span from the first appearance of an account or transaction to the present, and assess the lifecycle characteristics of ephemeral phishing accounts; Time-based volatility patterns: Modeling changes in trading activity over time to identify cyclical fishing patterns.

3. The Ethereum network phishing detection method based on dynamic feature fusion according to claim 1, characterized in that, The joint detection of transaction behavior based on graph neural networks, traditional machine learning models, and Transformer models specifically includes: (3.1) The graph neural network detection submodule identifies high-risk nodes and abnormal transaction patterns based on the structural features of the transaction graph; (3.2) The embedded feature classification submodule classifies transaction risks based on deep embedding vectors, using LightGBM or Support Vector Machine (SVM). (3.3) The Transformer time series detection submodule is based on transaction time series modeling to identify complex time series phishing strategies; (3.4) The weighted fusion algorithm is used to integrate the detection results of each sub-module to generate the final risk score and label.

4. The Ethereum network phishing detection method based on dynamic feature fusion according to claim 1, characterized in that, The dynamic weighted fusion scoring mechanism in step (3) includes result normalization processing, weighted fusion algorithm, and threshold adaptive strategy, as follows: The result normalization processing normalizes the output risk probabilities of structure detection, feature detection, and time sequence detection; then, the weighted fusion algorithm is used to calculate the comprehensive risk score based on the model performance weights; and the threshold adaptive strategy is combined to support static thresholds and dynamic adjustments; the dynamic threshold is adjusted according to the time period, transaction volume, and on-chain environment; finally, the comprehensive risk score of a single address or transaction is determined and output; finally, the risk level is divided into high risk, medium risk, and low risk; and an interpretable report is generated, as well as the features or transaction links that trigger the risk are indicated.

5. The Ethereum network phishing detection method based on dynamic feature fusion according to claim 1, characterized in that, Step (4) specifically includes the following sub-steps: (4.1) Incremental learning: This involves updating model parameters online based on newly added data samples; (4.2) Feature Adaptation: Automatically remove invalid features and dynamically introduce new features; (4.3) Model robustness monitoring: Real-time monitoring of detection performance indicators and automatic triggering of model fine-tuning or retraining processes.

6. A system for Ethereum network phishing detection based on dynamic feature fusion according to any one of claims 1-5, characterized in that, The system includes the following modules: Data Acquisition and Graph Modeling Module: Collects Ethereum transaction data in real time or periodically, and constructs an account-transaction graph or a transaction-transaction graph. Nodes in the graph contain account addresses or transactions, and edges contain transaction amounts, timestamps, gas prices, and contract call information. Multidimensional feature extraction and deep embedding module: Extracts structural features, temporal features, economic behavior features and contract features from the transaction graph, and uses graph neural network (GNN), graph embedding method and Transformer model to generate deep embedded representations of nodes and transactions; Multi-model fusion detection and risk scoring module: Based on graph neural network, traditional machine learning model and Transformer model, it jointly detects trading behavior, calculates risk score and generates phishing risk judgment result; Dynamic update and evolutionary adaptation module: Periodically collect the latest phishing samples and transaction data to achieve incremental model learning, adaptive feature adjustment and robustness monitoring, and maintain stable detection performance.

7. The system according to claim 6, characterized in that, The data acquisition and graph modeling module includes acquisition range control, allowing users to set the acquisition depth according to their needs. Specifically, it includes: First-level transaction capture: Captures the direct transaction records of the target account, suitable for rapid detection and evaluation; Second-order and multi-order transaction collection: Based on the acquisition of first-order transactions, the transaction records of relevant accounts are recursively collected up to the specified level to fully restore the transaction flow and behavior chain and accurately identify phishing techniques; it also supports time window and block range control to collect transaction data within a specific time period or block height range to meet the needs of time series modeling.

8. The system according to claim 6, characterized in that, The data acquisition and graph modeling module is designed with the following structural characteristics: Weighted attribute design: Each edge supports multiple attribute fields, including amount, time, tag, etc., to fully retain key transaction information; Multi-attribute nodes: Nodes support binding risk tags, address attribution, and account type; Dynamic graph support: The system supports the generation and maintenance of dynamic graphs based on time windows, enabling rapid incremental graph creation for real-time incoming data to meet dynamic detection requirements; Sparse storage structure optimization: Sparse adjacency lists and indexing mechanisms are used to store large-scale graph data to reduce memory overhead.

9. The system according to claim 6, characterized in that, The system supports processing millions of transaction nodes and large-scale transaction graphs, can cope with extreme imbalance scenarios of positive and negative samples of 1:50 or higher, and the detection time for a single round is controlled within 24 hours.

10. The system according to claim 6, characterized in that, This system can be deployed on digital asset trading platforms, blockchain explorers, digital wallets, or auditing platforms, supports API calls, and provides real-time assessment, early warning, and visual tracking of phishing risks in Ethereum transactions.

Images