Method and device for identifying illegal nodes in a blockchain

Abstract

The application discloses a method and device for identifying illegal nodes in a blockchain. The method includes constructing a blockchain encrypted digital currency transaction graph, obtaining a vector of each node in the blockchain encrypted digital currency transaction graph, inputting the vector of each node into a phishing fraud identification model to obtain an identification result of the type of each node, and the type includes a normal node or an illegal node. The method can identify phishing fraud nodes in the blockchain encrypted currency transaction and improve security. The detection model still has high performance under the condition of limited hardware resources, so it can be embedded into a blockchain encrypted currency wallet to perform fraud risk early warning from the transaction "entrance", helping users to avoid phishing fraud when using the blockchain encrypted currency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a method and device for identifying illegal nodes in a blockchain. BACKGROUND

[0002] Cryptocurrency is one of the most widely used application scenarios of blockchain technology. There are more than 5000 kinds of cryptocurrencies in the market, with a market value of more than 200 billion US dollars. However, in this emerging financial ecosystem centered on blockchain, there are fraudulent behaviors represented by phishing attacks. Phishing is a criminal mechanism in the field of information security, which uses social engineering and hacking techniques to steal the privacy information of network users. Attackers send fraudulent information that appears to be from legitimate enterprises and institutions to victims, leading victims to enter fake web pages and trick victims into revealing personal information, financial account credentials and other private data. The detection and prevention method for general phishing attacks is to record the URLs of regular websites and illegal websites, and then compare the URLs in emails and SMS to achieve the purpose of phishing attack detection. However, phishing fraud in blockchain cryptocurrency transactions has unique features. Blockchain phishing attacks no longer use URLs as the entry point for attacks, which makes most existing URL-based phishing detection methods unable to work. SUMMARY

[0003] The main purpose of the present application is to provide a method and device for identifying illegal nodes in a blockchain to solve the above problems.

[0004] In order to achieve the above purpose, according to one aspect of the present application, a method for identifying illegal nodes in a blockchain is provided, comprising:

[0005] Constructing a blockchain cryptocurrency transaction graph;

[0006] Obtaining a vector of each node in the blockchain cryptocurrency transaction graph;

[0007] Inputting the vector of each node into a phishing fraud identification model to obtain an identification result of the type of each node;

[0008] The type includes: normal node or illegal node.

[0009] In one embodiment, before constructing the blockchain cryptocurrency transaction graph, the method comprises:

[0010] Obtaining blockchain cryptocurrency transaction data, wherein the transaction data includes nodes of transactions, and the nodes are account numbers;

[0011] Obtaining a label corresponding to each account number from a standard database;

[0012] labeling each transaction account node with a corresponding label; the label includes a legal label or an illegal label;

[0013] constructing a blockchain encrypted digital currency transaction graph according to each account node after labeling.

[0014] In an embodiment, constructing a blockchain encrypted digital currency transaction graph includes:

[0015] The following formula is used to construct a blockchain encrypted digital currency transaction graph:

[0016] G_bctg = (V, E, W);

[0017] Wherein, V represents a node in the blockchain encrypted digital currency transaction graph, E represents an edge in the blockchain encrypted digital currency transaction graph, and W represents a transaction intensity corresponding to each edge.

[0018] In an embodiment, determining the transaction intensity W between any two nodes includes:

[0019] determining the transaction amount and the transaction frequency between the two nodes;

[0020] calculating the product A of the transaction amount and a corresponding preset first weight;

[0021] calculating the product B of the transaction frequency and a corresponding preset second weight;

[0022] calculating the sum of the product A and the product B to obtain the transaction intensity W between the two nodes.

[0023] In an embodiment, obtaining a representation vector of each node in the blockchain encrypted digital currency transaction graph includes:

[0024] inputting the blockchain encrypted digital currency transaction graph into an improved graph convolutional neural network,

[0025] The improved graph convolutional neural network outputs a representation vector of each node.

[0026] In an embodiment, the loss function of the improved graph convolutional neural network is:

[0027]

[0028]

[0029] Wherein, w represents a weight matrix;

[0030] Ω(w) represents a regularization function;

[0031] VTrain represent a set of nodes participating in training;

[0032] f w (X,A) represents the output value of the function softmax;

[0033] y v represent the classification labels of each node in the blockchain encrypted digital currency transaction graph;

[0034] wherein is a diagonal matrix, I is the unit matrix;

[0035] A is an adjacency matrix;

[0036] A ij is the i-th row, j-th column element in the adjacency matrix;

[0037] X is a feature vector of a blockchain transaction address;

[0038] W ∝ and W β are respectively preset weight matrices.

[0039] In an embodiment, the phishing fraud identification model is a Transformer neural network;

[0040] The Transformer neural network comprises an encoder and a decoder;

[0041] The encoder comprises an input layer, a first layer regularization module, a gate linear unit, and a second layer regularization module connected in sequence;

[0042] a first summation module configured to sum the output of the gate linear unit and the output of the input layer, and output the results to the second layer regularization module and a second summation module, respectively;

[0043] The second layer regularization module receives the output end of the first summation module; and the output end is connected to the input end of a first convolutional layer, a second convolutional layer, and a third convolutional layer, respectively;

[0044] The output ends of the first convolutional layer, the second convolutional layer, and the third convolutional layer are connected to the second summation module, respectively;

[0045] The output end of the second summation module is connected to the input end of a third layer regularization module and a third summation module, respectively;

[0046] The output end of the third layer regularization module is connected to the input end of a fourth convolutional layer;

[0047] An output end of the fourth convolutional layer is connected to an input end of the third summing module;

[0048] An output end of the third summing module is connected to input ends of a fourth regularization module and a fifth summing module respectively;

[0049] An output end of the fourth regularization module is connected to an input end of a multi-head attention module;

[0050] An output end of the multi-head attention module is connected to an input end of the fifth summing module;

[0051] An output end of the fifth summing module is connected to input ends of a fifth regularization module and a sixth summing module respectively;

[0052] An output end of the fifth regularization module is connected to an input end of a fifth convolutional layer;

[0053] An output end of the fifth convolutional layer is connected to an input end of a sixth convolutional layer;

[0054] An output end of the sixth convolutional layer is connected to an input end of the sixth summing module;

[0055] An output end of the sixth summing module is connected to an output end of the encoder;

[0056] The decoder comprises a sixth regularization module, and an input end of the sixth regularization module is connected to an input end of the decoder;

[0057] An output end of the sixth regularization module is connected to input ends of a second multi-head attention module and a third multi-head attention module respectively;

[0058] Output ends of the second multi-head attention module and the third multi-head attention module are connected to an input end of a seventh summing module respectively;

[0059] An output end of the seventh summing module is connected to input ends of a seventh regularization module and a ninth summing module respectively;

[0060] Output ends of the seventh regularization module are connected to input ends of a seventh convolutional layer, an eighth convolutional layer and a ninth convolutional layer respectively;

[0061] Output ends of the seventh convolutional layer, the eighth convolutional layer and the ninth convolutional layer are connected to an input end of an eighth summing module respectively;

[0062] An output end of the eighth summing module is connected to an input end of an eighth regularization module;

[0063] An output end of the eighth regularization module is connected to an input end of a tenth convolutional layer;

[0064] An output end of the tenth convolutional layer is connected to an input end of the ninth summing module;

[0065] The output end of the ninth sum module is connected with the input end of the ninth layer regularization module and the input end of the tenth sum module respectively;

[0066] The output end of the ninth layer regularization module is connected with the input end of the multi-head self-attention layer;

[0067] The output end of the multi-head self-attention layer is connected with the input end of the tenth sum module;

[0068] The output end of the tenth sum module is connected with the input end of the tenth layer regularization module and the input end of the eleventh sum module respectively;

[0069] The output end of the tenth layer regularization module is connected with the input end of the eleventh convolutional layer;

[0070] The output end of the eleventh convolutional layer is connected with the input end of the twelfth convolutional layer;

[0071] The output end of the twelfth convolutional layer is connected with the input end of the eleventh sum module;

[0072] The output end of the eleventh sum module is the output of the decoder.

[0073] In a second aspect, a device for identifying illegal nodes in a blockchain is provided, comprising:

[0074] A transaction graph construction module is configured to construct a blockchain encrypted digital currency transaction graph.

[0075] A node vector acquisition module is configured to acquire a vector of each node in the blockchain encrypted digital currency transaction graph.

[0076] An input module is configured to input the vector of each node into a phishing fraud identification model to obtain an identification result of the type of each node.

[0077] The type includes a normal node or an illegal node.

[0078] In an embodiment, the transaction graph construction module is further configured to:

[0079] Before constructing the blockchain encrypted digital currency transaction graph, the method comprises:

[0080] Acquiring blockchain encrypted digital currency transaction data, wherein the transaction data includes a node of a transaction, and the node is an account.

[0081] Obtaining a label corresponding to each account from a standard database;

[0082] Labeling each transaction account node with a corresponding label; the label includes a legal label or an illegal label.

[0083] According to each account node after labeling, a blockchain encrypted digital currency transaction graph is constructed.

[0084] In an embodiment, the transaction graph construction module is further configured to:

[0085] Constructing the blockchain encrypted digital currency transaction graph comprises:

[0086] The blockchain encrypted digital currency transaction graph is constructed by using the following formula:

[0087] G_bctg=(V, E, W);

[0088] Wherein, V represents a node in the blockchain encrypted digital currency transaction graph, E represents an edge in the blockchain encrypted digital currency transaction graph, and W represents a transaction intensity corresponding to each edge.

[0089] In an embodiment, the transaction graph construction module is further configured to:

[0090] Determine the transaction amount and the transaction frequency between the two nodes;

[0091] Calculate the product A of the transaction amount and a preset first weight corresponding thereto;

[0092] Calculate the product B of the transaction frequency and a preset second weight corresponding thereto;

[0093] Calculate the sum of the product A and the product B to obtain the transaction intensity W between the two nodes.

[0094] In an embodiment, the node vector acquisition module is further configured to input the blockchain encrypted digital currency transaction graph into an improved graph convolutional neural network,

[0095] The improved graph convolutional neural network outputs a representation vector of each node.

[0096] In a third aspect, the present application provides an electronic device, comprising: at least one processor and at least one memory; the memory is used to store one or more program instructions; the processor is used to run one or more program instructions to execute the method of any one of the above.

[0097] In a fourth aspect, the present application provides a computer readable storage medium, characterized in that the computer readable storage medium comprises one or more program instructions, and the one or more program instructions are used to execute the method of any one of the above.

[0098] In combination with the particularity of blockchain phishing fraud, the application intends to use the high-dimensional data formed by the blockchain cryptocurrency in the transaction process, and proposes a detection model with high performance under the condition of limited hardware resources, so that it can be embedded into the blockchain cryptocurrency wallet to conduct fraud risk warning from the transaction "entrance", helping users to avoid phishing fraud when using blockchain cryptocurrencies BRIEF DESCRIPTION OF DRAWINGS

[0099] The drawings constituting a part of this application are used to provide a further understanding of the application, so that other features, objects and advantages of the application become more apparent. The illustrative embodiment drawings of the application and their description are used to explain the application, and do not constitute an improper limitation on the application. In the drawings:

[0100] Figure 1 is a flow chart of a method for identifying illegal nodes in a blockchain according to an embodiment of the application;

[0101] Figure 2 is a data source and construction flow chart of BCTG according to an embodiment of the application;

[0102] Figure 3 is a schematic diagram of BCTG embedding based on self-encoding according to an embodiment of the application;

[0103] Figure 4A is a structural schematic diagram of an encoder according to an embodiment of the application;

[0104] Figure 4B is a structural schematic diagram of a decoder according to an embodiment of the application;

[0105] Figure 5 is a structural schematic diagram of an apparatus for identifying illegal nodes in a blockchain according to an embodiment of the application;

[0106] Figure 6 is a structural schematic diagram of an apparatus for identifying illegal nodes in a blockchain according to an embodiment of the application. DETAILED DESCRIPTION

[0107] In order to make the person skilled in the art better understand the application scheme, the technical scheme in the application embodiment will be described clearly and completely below in combination with the drawings in the application embodiment. Obviously, the described embodiments are only a part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by the person skilled in the art without creative labor shall fall within the scope of protection of the application.

[0108] It should be noted that the terms "first", "second" and "third" and the like in the description and in the claims of the present application are used for distinguishing between similar elements and not necessarily for describing a specific sequential or chronological order. It is to be understood that the use of these terms is interchangeable under appropriate circumstances such that the embodiments of the present application described herein are, for example, capable of orderly or inverse order. Moreover, the terms "include", "have" and "contain" and their variations, when used in this description and in the claims of the present application, are intended to cover a non-exclusive inclusion such that a process, method, system, product or apparatus that comprises a list of steps or units are not necessarily limited to those steps or units which are clearly recited.

[0109] In the present application, the terms "upper", "lower", "left", "right", "front", "rear", "top", "bottom", "inner", "outer", "middle", "vertical", "horizontal", "lateral", "longitudinal" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings. These terms are mainly used for better describing the present application and its embodiments, and are not intended to limit the indicated devices, elements or components to have a specific orientation, or to be constructed and operated in a specific orientation.

[0110] In addition, in addition to indicating the orientation or positional relationship, the above-mentioned partial terms can also be used to indicate other meanings, for example, the term "upper" can also be used to indicate a certain dependent relationship or connection relationship in some cases. For those skilled in the art, the specific meaning of these terms in the present application can be understood according to the specific circumstances.

[0111] In addition, the terms "mount", "set", "provided with", "connected", "connected", "sleeved" should be interpreted broadly. For example, it can be fixedly connected, detachably connected, or integrally constructed; it can be mechanically connected, or electrically connected; it can be directly connected, or indirectly connected through an intermediate medium, or internal communication between two devices, elements or components. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0112] It should be noted that the embodiments and features in the embodiments in the present application can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0113] Cryptocurrency is one of the most widely used applications of blockchain technology. There are more than 5000 cryptocurrencies in the market, with a market value of more than 200 billion US dollars. However, there are fraudulent behaviors represented by phishing attacks in this emerging financial ecosystem centered on blockchain. Phishing is a criminal mechanism in the field of information security, which uses social engineering and hacking techniques to steal the privacy information of network users. Attackers send fraudulent information that appears to be from legitimate enterprises and institutions to victims, leading them to enter fake web pages and trick them into revealing personal information, financial account credentials, and other private data.

[0114] For the detection and prevention of general phishing attacks, the commonly used methods can be divided into three categories: blacklist and whitelist methods, traditional machine learning methods, and deep learning methods. Among them, the blacklist and whitelist methods record the URLs of regular websites and illegal websites, and then compare the URLs in emails and SMS to achieve the purpose of phishing attack detection. Traditional machine learning methods require the collection of training data, followed by the identification of features that can fully describe phishing behavior and the extraction of these features to provide machine learning algorithms for model training. Deep learning methods refer to end-to-end models based on deep learning, which can avoid tedious feature engineering. In the study of traditional phishing detection problems, many methods have been proposed to extract phishing fraud features from phishing websites and phishing web pages. These achievements have great reference significance for solving phishing fraud problems in the blockchain ecosystem. However, phishing fraud in blockchain cryptocurrency transactions has unique characteristics. First, blockchain phishing attacks no longer use URLs as the entry point, which makes most existing URL-based phishing detection methods ineffective. Second, there is only limited information such as transaction amount and transaction addresses (account numbers) in blockchain transaction information. Third, traditional phishing attack detection models work on servers or web browsers, while the ideal deployment location for blockchain phishing attack detection models is the "blockchain cryptocurrency wallet". The computing resources of the wallet are limited, so higher performance is required for the detection model embedded in it. Considering the special nature of blockchain phishing fraud, this invention proposes to use the high-dimensional data formed during the transaction of blockchain cryptocurrency to propose a detection model with high performance under the condition of limited hardware resources, which can be embedded in the blockchain cryptocurrency wallet to perform fraud risk warning from the "entry" of the transaction, helping users avoid phishing fraud when using blockchain cryptocurrencies.

[0115] The present application proposes a method for identifying illegal nodes in a blockchain, as shown in the accompanying Figure 1A flow chart of a blockchain illegal node identification method is shown; the method comprises the following steps:

[0116] Step S102, constructing a blockchain encrypted digital currency transaction graph;

[0117] Specifically, referring to the attached Figure 2 The data source and construction flow chart of the BCTG are shown. The blockchain client is used to collect the blockchain encrypted digital currency transaction data within a certain time range; the network crawler technology is used to crawl the verified phishing fraud blockchain addresses from the blockchain address label database website to obtain the positive sample label data of the fraud detection model. According to the BCTG definition, the construction of the BCTGEther is completed to obtain the Ethereum blockchain encrypted digital currency transaction graph. Prepare for the next step of graph embedding.

[0118] In an embodiment, before constructing the blockchain encrypted digital currency transaction graph, the blockchain encrypted digital currency transaction data is obtained, wherein the transaction data includes transaction nodes, and the nodes are account numbers; the corresponding label of each account number is obtained from a standard database;

[0119] Exemplarily, the standard database is the blockchain address label database in Figure 2 , which stores a large number of legal labels and illegal labels.

[0120] Each transaction account node is labeled with a corresponding label; the label includes a legal label or an illegal label; the blockchain encrypted digital currency transaction graph is constructed according to each labeled account node.

[0121] Step S104, obtaining the vector of each node in the blockchain encrypted digital currency transaction graph;

[0122] Step S106, inputting the vector of each node into a phishing fraud identification model to obtain the identification result of the type of each node; the type includes a normal node or an illegal node.

[0123] In an embodiment, the blockchain encrypted digital currency transaction graph is constructed by the following steps:

[0124] The following formula is used to construct the blockchain encrypted digital currency transaction graph:

[0125] G_bctg=(V,E,W);

[0126] Wherein, V represents the node in the blockchain encrypted digital currency transaction graph, E represents the edge in the blockchain encrypted digital currency transaction graph, and W represents the transaction intensity corresponding to each edge.

[0127]

[0128] ​In an embodiment, the transaction intensity W between any two nodes is determined by taking the following steps:

[0129] determining the transaction amount and the transaction frequency between the two nodes;

[0130] calculating the product A of the transaction amount and a preset first weight corresponding to the transaction amount;

[0131] calculating the product B of the transaction frequency and a preset second weight corresponding to the transaction frequency;

[0132] calculating the sum of the product A and the product B to obtain the transaction intensity W between the two nodes.

[0133] The technical solution of the present application is divided into three stages: the method step S102 described above is the first stage, the first stage proposes a graph data structure named Blockchain Cryptocurrency Transaction Graph (BCTG), which effectively expresses the transaction data of the blockchain cryptocurrency; the second stage, step S104, uses a special graph convolutional neural network technology to perform representation learning (Representation Learning) on the structural information and attribute information contained in the BCTG under the self-encoder architecture, obtaining the representation vector Z of each node in the graph; the third stage, step S106, uses a bidirectional GRU architecture based on the attention mechanism to identify the fraudulent nodes and normal nodes in the BCTG graph by taking the representation vector Z as input.

[0134] The key technology of the second stage: the representation learning method of the Blockchain Cryptocurrency Transaction Graph BCTG based on the special graph convolutional neural network, which performs representation learning on the BCTG based on the graph convolutional neural network technology. The basic idea is: an auto-encoder (Autoencoder) architecture is adopted, and the representation vector Z of the input of the encoder is obtained through self-supervised learning.

[0135] In an embodiment, the representation vector of each node in the Blockchain Cryptocurrency Transaction Graph is obtained by taking the following steps:

[0136] inputting the Blockchain Cryptocurrency Transaction Graph into an improved graph convolutional neural network,

[0137] the improved graph convolutional neural network outputs the representation vector of each node.

[0138] For example, refer to the accompanying drawings Figure 3The schematic diagram of the self-encoding based BCTG graph embedding is shown. As shown in the figure, the encoder input of the present application is a graph, so a graph convolutional neural network GCN is used instead of a traditional fully connected neural network in the encoding stage. The calculation method of BCTG in the graph convolutional neural network is the key technology of this step, which is briefly described as follows:

[0139] BCTG is denoted as G btg =(V,E,W), where the vertex set V={v1,…,v N}, the edge set The size of the adjacency matrix A is N×N, when there is an edge between the vertices v i and v j , A i，j =1, otherwise A i，j =0. In order to perform convolution on BCTG, define the graph Laplacian matrix L=D-A, where D i，i =∑ j A i，j , and D i，j =0 when i≠j, and denotes the set of all N×N adjacency matrices, i.e. At this time, the graph node classification task can be represented as:

[0140]

[0141] where X is the feature vector of the vertex on the graph, i.e. the blockchain transaction address, and n is the length of the feature vector. The regularization loss in neural network training is:

[0142]

[0143] where V Train is the training set, is a node readout function. Ω is a regularization function. More specifically, two layers of time domain graph convolution are used to fit f w , i.e.:

[0144]

[0145] where w represents the weight matrix;

[0146] Ω(w) represents the regularization function;

[0147] Specifically, the regularization function Ω constrains the weight w;

[0148] V Train represents the node set participating in training;

[0149] f w(X, A) represents the output value of the function Softmax; represents the calculation process of the graph neural network;

[0150] Wherein, A is an adjacency matrix, that is, the connection relationship of each vertex in the graph; X is the feature vector of the blockchain transaction address;

[0151] y v represents the classification label of each node in the blockchain encrypted digital currency transaction graph;

[0152] Wherein is a diagonal matrix, I is a unit matrix;

[0153] Wherein, the size of the adjacency matrix A is N*N, A_(i, j)=1 when there is an edge between node v_i and v_j, otherwise A_(i, j)=0. ij is the i-th row and j-th column element in the adjacency matrix;

[0154] W ∝ and W β are the pre-set weight matrix respectively.

[0155] It should be particularly pointed out that in order to meet the high performance requirements of embedding the blockchain encrypted currency wallet, the application will improve the f w (X, A) function in the conventional GCN (conventional: f w (X, A)=Softmax The difference between the GCN in the application and the conventional GCN is that: first, the nonlinear activation function (ReLu) is abandoned; second, the pre-designed fixed weight (W ∝ and W β ) is used instead of trainable weight (W1 and W2). Experiments show that this improvement can greatly improve the calculation speed without reducing the accuracy of the model, and at the same time, it occupies less hardware resources in the calculation process. In the graph convolutional autoencoder model improved by the project team, the self-supervised training of BCTG is completed, and the graph embedding of BCTG is obtained. This will provide feature support for the next step of phishing fraud node identification.

[0156] (3) The key technology of the third stage: the implementation of the phishing fraud detection model in the blockchain encrypted digital currency transaction

[0157] Through the work of the previous step, each node in the BCTG graph model is represented as an N-dimensional feature vector, denoted as: Node i ={x1, x2, x3, …, x NNext, the present application proposes a special Transformer neural network architecture for Node i classification (i.e., detecting Node i whether the blockchain address represented by the Node is a high-risk account of phishing fraud). The basic form of the Transformer neural network architecture is as follows:

[0158] In an embodiment, the phishing fraud identification model is a Transformer neural network; the Transformer neural network comprises an encoder and a decoder;

[0159] Referring to the accompanying Figure 4A As shown, the encoder comprises an input layer, a first layer regularization module, a gate linear unit, and a second layer regularization module connected in sequence;

[0160] a first summation module for summing the output of the gate linear unit and the output of the input layer, and outputting the results to the second layer regularization module and the second summation module, respectively;

[0161] The output end of the second layer regularization module is connected to the input end of the first convolutional layer, the second convolutional layer, and the third convolutional layer, respectively;

[0162] The output ends of the first convolutional layer, the second convolutional layer, and the third convolutional layer are connected to the second summation module after being processed by the corresponding activation function modules;

[0163] The convolution kernel of the first convolutional layer is 1x1, and the number is 1024; the convolution kernel of the second convolutional layer is 3x1, and the number is 256; the convolution kernel of the third convolutional layer is 6x1, and the number is 256;

[0164] The first activation function module, the second activation function module, and the third activation function module are respectively arranged at the output ends of the first convolutional layer, the second convolutional layer, and the third convolutional layer; the activation function of the activation function module is RELU.

[0165] The output end of the second summation module is connected to the input end of the third layer regularization module and the third summation module;

[0166] The output end of the third layer regularization module is connected to the input end of the fourth convolutional layer;

[0167] The output end of the fourth convolutional layer is connected to the input end of the third summation module;

[0168] The convolution kernel of the fourth convolutional layer is 9x1, and the number is 256;

[0169] The output end of the third summation module is connected with the input end of the fourth layer regularization module and the fifth summation module respectively;

[0170] The output end of the fourth layer regularization module is connected with the input end of the multi-head attention module;

[0171] Among them, the multi-head attention module comprises:

[0172] The attention mechanism is to weight and sum the value of the elements in the source, and the query and key are used to calculate the weight coefficient of the corresponding value, and the attention calculation formula is:

[0173]

[0174] By calculating the correlation between the query and each key, the weight coefficient of the value corresponding to each key is obtained, and after normalization by softmax, the weight and the corresponding value are weighted and summed to obtain the final attention value. Multi-head attention allows the model to simultaneously pay attention to information from different position subspaces.

[0175]

[0176] MultiHead(Q,K,V)=concat(head1,...,head h )W O ;

[0177] Q, K and V are first subjected to a linear transformation, and then input into a scaled dot product attention, which is performed h times, that is, so-called multi-head, each time a head is calculated, and the parameters between the heads are not shared. The parameters for linear transformation of Q, K and V are different each time. The results of h times of scaled dot product attention are spliced, and the value obtained by performing a linear transformation again is taken as the result of multi-head attention.

[0178] The output end of the multi-head attention module is connected with the input end of the fifth summation module;

[0179] The output end of the fifth summation module is connected with the input end of the fifth layer regularization module and the sixth summation module respectively;

[0180] The output end of the fifth layer regularization module is connected with the input end of the fifth convolutional layer;

[0181] Among them, the convolution kernel of the fifth convolutional layer is 1x1, and the number is 1024;

[0182] The output of the fifth convolutional layer is connected to the corresponding fourth activation function module; the activation function of the activation function module is ReLU;

[0183] The output of the fourth activation function is connected to the input of the sixth convolutional layer;

[0184] The sixth convolutional layer has a 1×1 kernel and a total of 256 kernels.

[0185] The output of the sixth convolutional layer is connected to the input of the sixth summation module;

[0186] The output of the sixth summation module is the output result of the encoder;

[0187] See appendix Figure 4B As shown, the decoder includes: a sixth-layer regularization module, the input of which is connected to the input of the decoder;

[0188] The output of the sixth-layer regularization module is connected to the input of the second multi-head attention module and the third multi-head attention module, respectively.

[0189] The outputs of the second and third multi-head attention modules are respectively connected to the input of the seventh summation module;

[0190] The output of the seventh summation module is connected to the input of the seventh regularization module and the ninth summation module, respectively.

[0191] The output of the seventh regularization module is connected to the inputs of the seventh, eighth, and ninth convolutional layers, respectively.

[0192] The outputs of the seventh, eighth, and ninth convolutional layers are respectively connected to the input of the eighth summation module;

[0193] Among them, the kernel of the seventh convolutional layer is 11×1, which is separable convolution and has a number of 1024.

[0194] The output of the seventh convolutional layer is connected to the input of the fifth activation function module;

[0195] The activation function in the fifth activation function module is ReLU;

[0196] The eighth convolutional layer has a 7×1 kernel, which is separable and has 256 kernels.

[0197] The kernel of the ninth convolutional layer is 7×1, which is separable convolution, and the number of kernels is 256.

[0198] The output of the eighth summation module is connected to the input of the eighth regularization module;

[0199] An output end of the eighth regularization module is connected to an input end of a tenth convolutional layer;

[0200] The convolutional kernel of the tenth convolutional layer is 7x1, and the number is 512.

[0201] An output end of the tenth convolutional layer is connected to an input end of a ninth sum module.

[0202] An output end of the ninth sum module is connected to an input end of a ninth regularization module and an input end of a tenth sum module.

[0203] An output end of the ninth regularization module is connected to an input end of a multi-head self-attention layer.

[0204] An output end of the multi-head self-attention layer is connected to an input end of the tenth sum module.

[0205] Specifically, the number of multi-heads can be set to 8, that is, 8 heads of self-attention layers.

[0206] An output end of the tenth sum module is connected to an input end of a tenth regularization module and an input end of an eleventh sum module.

[0207] An output end of the tenth regularization module is connected to an input end of an eleventh convolutional layer.

[0208] The convolutional kernel of the eleventh convolutional layer is 1x1, the number is 2048, and the activation function is swish.

[0209] The formula of the swish activation function is as follows: f(x) = xg sigmoid(beta x).

[0210] When beta is 0, the swish activation function becomes a linear function.

[0211] When beta is infinite, the swish activation function becomes 0 or x, which is equivalent to Relu.

[0212] Therefore, the swish function can be regarded as a smooth function between the linear function and the ReLU function, which has the characteristics of smooth function and its first derivative, has a lower bound, has no upper bound, and is non-monotonic.

[0213] An output end of the eleventh convolutional layer is connected to an input end of a twelfth convolutional layer.

[0214] The convolutional kernel of the twelfth convolutional layer is 1x1, and the number is 512.

[0215] An output end of the twelfth convolutional layer is connected to an input end of the eleventh sum module.

[0216] An output end of the eleventh sum module is the output of the decoder.

[0217] The method of the present application constructs the original data of the blockchain transaction into a special data structure, and on this basis, a method for quickly extracting effective features of this data structure is proposed, and finally the extracted effective features are input to detect phishing fraud in blockchain encrypted digital currency transactions. The advantages of the present application are: it has good effect on detecting phishing fraud in blockchain encrypted digital currency transactions; the method has low requirements for hardware resources and can be deployed in resource-constrained blockchain digital wallets.

[0218] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown.

[0219] In a second aspect, a device for identifying illegal nodes in a blockchain is provided, as shown in Figure 5 The device includes:

[0220] The transaction graph construction module 41 is configured to construct a blockchain encrypted digital currency transaction graph.

[0221] The node vector acquisition module 42 is configured to acquire a vector of each node in the blockchain encrypted digital currency transaction graph.

[0222] The input module 43 is configured to input the vector of each node into a phishing fraud identification model to obtain an identification result of the type of each node.

[0223] The type includes: normal node or illegal node.

[0224] In an embodiment, the transaction graph construction module 41 is further configured to:

[0225] Before constructing the blockchain encrypted digital currency transaction graph, the method includes:

[0226] Acquiring blockchain encrypted digital currency transaction data, wherein the transaction data includes transaction nodes, and the nodes are account numbers.

[0227] Obtaining a corresponding label for each account number from a standard database.

[0228] Labeling each transaction account node with a corresponding label; the label includes a legal label or an illegal label.

[0229] Constructing a blockchain encrypted digital currency transaction graph according to each labeled account node.

[0230] In an embodiment, the transaction graph construction module 41 is further configured to:

[0231] constructing a blockchain encrypted digital currency transaction graph, comprising:

[0232] constructing a blockchain encrypted digital currency transaction graph using the following formula:

[0233] G_bctg = (V, E, W);

[0234] wherein V represents a node in the blockchain encrypted digital currency transaction graph, E represents an edge in the blockchain encrypted digital currency transaction graph, and W represents a transaction intensity corresponding to each edge.

[0235] In an embodiment, the transaction graph construction module 41 is further configured to:

[0236] determine a transaction amount and a transaction frequency between the two nodes;

[0237] calculate a product A of the transaction amount and a preset first weight corresponding thereto;

[0238] calculate a product B of the transaction frequency and a preset second weight corresponding thereto;

[0239] calculate a sum of the product A and the product B to obtain the transaction intensity W between the two nodes.

[0240] In an embodiment, the node vector acquisition module 42 is further configured to input the blockchain encrypted digital currency transaction graph into an improved graph convolutional neural network.

[0241] The improved graph convolutional neural network outputs a representation vector of each node.

[0242] According to a third aspect of the present application, an electronic device is provided, as shown in the structural schematic diagram of the electronic device; comprising at least one processor 51 and at least one memory 52; the memory 52 is used to store one or more program instructions; the processor 51 is used to run one or more program instructions to execute the method of any one of the above. Figure 6

[0243] According to a fourth aspect of the present application, a computer readable storage medium is also provided, the computer readable storage medium comprises one or more program instructions, and the one or more program instructions are used to execute the method of any one of the above.

[0244] ​The disclosed methods, steps, and logic block diagrams in the embodiments of the present application can be implemented or performed with a general- purpose processor, a special purpose processor, or any other processor. The steps of the methods disclosed in the embodiments of the present application can be directly embodied to a hardware code, a processor, or a combination of software modules and hardware modules in the processor. The software modules can reside in memories, such as random access memory (RAM), flash memory, read only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EEPROM), a register, or other forms of storage. The processor reads information in the memories and completes the steps of the above methods with the aid of hardware.

[0245] The storage media can be a memory, such as a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory.

[0246] The non-volatile memory can be read only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EEPROM), or flash memory.

[0247] The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct Rambus RAM (DRRAM). The disclosure describes and delineates the storage media to include, but not be limited to, these and any other suitable type of memory.

[0248] The storage media described in the embodiments of the present application is intended to include, but not be limited to, these and any other suitable type of memory.

[0249] Those skilled in the art should clearly understand that the functions described in the above one or more examples can be implemented by a combination of hardware and software. When the software is applied, the corresponding functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium. The computer readable medium includes a computer storage medium and a communication medium, wherein the communication medium includes any medium that facilitates the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0250] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, which can be concentrated on a single computing device or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by program codes executable by a computing device, so that they can be stored in a storage device and executed by a computing device, or they can be respectively made into individual integrated circuit modules, or multiple modules or steps among them can be made into a single integrated circuit module. Thus, the present application is not limited to any specific combination of hardware and software.

[0251] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for identifying illegal nodes in a blockchain, characterized in that, The method comprises the following steps: constructing a blockchain encrypted digital currency transaction graph; obtaining a vector of each node in the blockchain encrypted digital currency transaction graph; inputting the vector of each node into a phishing fraud identification model to obtain an identification result of the type of each node; the type includes: normal node or illegal node, before constructing the blockchain encrypted digital currency transaction graph, the method comprises the following steps: obtaining blockchain encrypted digital currency transaction data, wherein the transaction data includes transaction nodes, and the nodes are account numbers; obtaining a label corresponding to each account number from a standard database; labeling each transaction account node with a corresponding label; the label includes a legal label or an illegal label; constructing a blockchain encrypted digital currency transaction graph according to each account node after labeling, and the blockchain encrypted digital currency transaction graph comprises the following steps: constructing the blockchain encrypted digital currency transaction graph by using the following formula: G_bctg=(V, E, W); wherein V represents a node in the blockchain encrypted digital currency transaction graph, E represents an edge in the blockchain encrypted digital currency transaction graph, and W represents a transaction intensity corresponding to each edge; determining the transaction intensity W between any two nodes comprises the following steps: determining the transaction amount and the transaction frequency between the two nodes; calculating the product A of the transaction amount and a corresponding preset first weight; calculating the product B of the transaction frequency and a corresponding preset second weight; calculating the sum of the product A and the product B to obtain the transaction intensity W between the two nodes; inputting the blockchain encrypted digital currency transaction graph into an improved graph convolutional neural network, the improved graph convolutional neural network outputs a representation vector of each node, and the loss function of the improved graph convolutional neural network is: ； ； wherein w represents a weight matrix; denotes the regular function; a set of nodes participating in the training; is the output value of the function softmax, where A is the adjacency matrix; X is the feature vector of the blockchain transaction address; a classification label representing each node in a blockchain encrypted digital currency transaction graph; ; where is a diagonal matrix, , is the identity matrix; A ij is the element in the i-th row, j-th column of the adjacency matrix; and are preset weight matrices, respectively; the phishing fraud identification model is a Transformer neural network; the Transformer neural network comprises an encoder and a decoder; the encoder comprises an input layer, a first layer regularization module, a gate linear unit, and a second layer regularization module connected in sequence; a first summation module is configured to sum the output of the gate linear unit and the output of the input layer, and output the results to the second layer regularization module and a second summation module, respectively; the second layer regularization module has an output end connected to the input end of the first convolutional layer, the second convolutional layer, and the third convolutional layer; the output ends of the first convolutional layer, the second convolutional layer, and the third convolutional layer are connected to the second summation module; the output end of the second summation module is connected to the input end of a third layer regularization module and a third summation module; the output end of the third layer regularization module is connected to the input end of a fourth convolutional layer; the output end of the fourth convolutional layer is connected to the input end of the third summation module; the output end of the third summation module is connected to the input end of a fourth layer regularization module and a fifth summation module; the output end of the fourth layer regularization module is connected to the input end of a multi-head attention module; the output end of the multi-head attention module is connected to the input end of the fifth summation module; An output end of the fifth sum module is connected to an input end of a fifth layer regularization module and an input end of a sixth sum module respectively; An output end of the fifth layer regularization module is connected to an input end of a fifth convolutional layer; An output end of the fifth convolutional layer is connected to an input end of a sixth convolutional layer; An output end of the sixth convolutional layer is connected to an input end of the sixth sum module; An output of an output end of the sixth sum module is an output result of the encoder; The decoder comprises a sixth layer regularization module, and an input end of the sixth layer regularization module is connected to an input end of the decoder; An output end of the sixth layer regularization module is connected to an input end of a second multi-head attention module and an input end of a third multi-head attention module respectively; Output ends of the second multi-head attention module and the third multi-head attention module are connected to input ends of a seventh sum module respectively; An output end of the seventh sum module is connected to input ends of a seventh layer regularization module and a ninth sum module respectively; An output end of the seventh layer regularization module is connected to input ends of a seventh convolutional layer, an eighth convolutional layer and a ninth convolutional layer respectively; Output ends of the seventh convolutional layer, the eighth convolutional layer and the ninth convolutional layer are connected to input ends of an eighth sum module respectively; An output end of the eighth sum module is connected to an input end of an eighth layer regularization module; An output end of the eighth layer regularization module is connected to an input end of a tenth convolutional layer; An output end of the tenth convolutional layer is connected to an input end of the ninth sum module; An output end of the ninth sum module is connected to an input end of a ninth layer regularization module and an input end of a tenth sum module respectively; An output end of the ninth layer regularization module is connected to an input end of a multi-head self-attention layer; An output end of the multi-head self-attention layer is connected to an input end of the tenth sum module; An output end of the tenth sum module is connected to input ends of a tenth layer regularization module and an eleventh sum module respectively; An output end of the tenth layer regularization module is connected to an input end of an eleventh convolutional layer; An output end of the eleventh convolutional layer is connected to an input end of a twelfth convolutional layer; An output end of the twelfth convolutional layer is connected to an input end of the eleventh sum module; An output end of the eleventh sum module is an output of the decoder.

2. A device for identifying illegal nodes in a blockchain, according to the method of claim 1, characterized in that, Comprise: A transaction graph construction module, configured to construct a blockchain encrypted digital currency transaction graph; An acquisition node vector module, configured to acquire a vector of each node in the blockchain encrypted digital currency transaction graph; An input module, configured to input the vector of each node into a phishing fraud identification model to obtain an identification result of a type of each node; The type comprises: a normal node or an illegal node.

3. An electronic device, comprising: Comprise: At least one processor and at least one memory; The memory is used to store one or more program instructions; The processor is used to run one or more program instructions to execute the method of claim 1.

4. A computer-readable storage medium, characterized in that, A computer readable storage medium comprises one or more program instructions, and the one or more program instructions are used to execute the method of claim 1. A computer readable storage medium comprises one or more program instructions, and the one or more program instructions are used to execute the method of claim 1.

Images