A method and device for tracing the origin of digital currency transactions based on unsupervised learning technology

Abstract

The present invention discloses a method and device for tracing digital currency transactions based on unsupervised learning technology. The method includes: obtaining the digital currency transaction traffic sent or received between a target node and its peer nodes; for each digital currency transaction involved in the obtained traffic, counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing a feature vector of the digital currency transaction according to the counted number of messages; for the feature vectors of each digital currency transaction, performing anomaly detection using an unsupervised anomaly detection algorithm; and tracing whether each digital currency transaction is created by the target node according to the anomaly detection result. Applying the present invention can improve the accuracy of tracing digital currency transactions.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for tracing digital currency transactions based on unsupervised learning technology. Background Art

[0002] The existing digital currency transaction tracing technologies are mainly divided into two research directions: transaction layer tracing technology and network layer tracing technology. The transaction layer tracing technology refers to analyzing transaction records to discover certain relationships between anonymous transaction addresses, such as "common input, change address", clustering anonymous addresses that may belong to the same entity using heuristics, or clustering transactions that conform to specific patterns by observing transaction behaviors. This tracing technology can only achieve the clustering of addresses of the same entity and cannot obtain the real identity information of the entity.

[0003] The network layer tracing technology refers to collecting information on the traffic of the digital currency network layer, analyzing the propagation path of transactions in the network, and establishing a mapping between transactions and the node IPs that generate the transactions.

[0004] In the existing digital currency tracing technologies, the transaction layer tracing technology only realizes the clustering of transaction addresses that may belong to the same entity, cannot obtain the identity information of anonymous digital currency users, and the degree of de-anonymization is insufficient; while the tracing technology based on unsupervised learning mainly uses network traffic analysis and anomaly detection algorithms to identify transactions created by nodes, and there are also problems of low tracing accuracy. In addition, there may be various abnormal behaviors in the detected data. Such abnormal behaviors outside the target behavior are regarded as noise data, and the detection algorithms based on pure unsupervised learning cannot distinguish them from the target behavior. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to propose a method and device for tracing digital currency transactions based on unsupervised learning technology, which can improve the tracing accuracy of digital currency transactions compared with the existing tracing technologies based on unsupervised learning.

[0006] Based on the above purpose, the present invention provides a method for tracing digital currency transactions based on unsupervised learning technology, including:

[0007] Obtaining the digital currency transaction traffic sent or received between a target node and its peer nodes;

[0008] For each digital currency transaction involved in the obtained traffic, counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing a feature vector of the digital currency transaction according to the counted number of messages;

[0009] Performing anomaly detection on the feature vectors of each digital currency transaction by using an unsupervised anomaly detection algorithm;

[0010] Trace whether each digital currency transaction is created for the target node according to the anomaly detection result.

[0011] Optionally, after performing anomaly detection using the unsupervised anomaly detection algorithm, it further includes:

[0012] Perform temporal relationship analysis of the traffic for each digital currency transaction in the anomaly detection result, identify and filter out the forwarding transactions of the target node, and obtain the filtered anomaly detection result; and

[0013] The tracing whether each digital currency transaction is created for the target node according to the anomaly detection result specifically includes:

[0014] Identify each digital currency transaction in the filtered anomaly detection result as a digital currency transaction created for the target node.

[0015] Optionally, the counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing a feature vector of this digital currency transaction according to the counted number of messages specifically includes:

[0016] The constructed feature vector of this digital currency transaction includes: Inv_Num, Getdata_Num, Ratio, Sum;

[0017] Among them, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received counted for this digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

[0018] Optionally, after constructing the feature vector of this digital currency transaction, it further includes:

[0019] Expand the feature vector:

[0020] After expanding the output probability of the feature vector calculated by the unsupervised learning algorithm to the feature vector, obtain the expanded feature vector.

[0021] Optionally, the performing temporal relationship analysis of the traffic for each digital currency transaction in the anomaly detection result, and using heuristic method to identify and filter out the forwarding transactions of the target node specifically includes:

[0022] For the transaction broadcast messages sent and received by the target node that contain the same transaction hash value, if it is analyzed that the received transaction broadcast message is earlier than the sent transaction broadcast message, then identify the digital currency transaction corresponding to this transaction hash value as the forwarded transaction of the target node;

[0023] For the transaction request messages sent and received by the target node that contain the same transaction hash value, if it is analyzed that the sent transaction request message is earlier than the received transaction request message, then identify the digital currency transaction corresponding to this transaction hash value as the forwarded transaction of the target node;

[0024] For the transaction broadcast message and transaction request message sent by the target node that contain the same transaction hash value, if it is analyzed that the sent transaction request message is earlier than the sent transaction broadcast message, then identify the digital currency transaction corresponding to this transaction hash value as the forwarded transaction of the target node.

[0025] Optionally, for the feature vectors of each digital currency transaction, an unsupervised anomaly detection algorithm is used for anomaly detection, specifically including:

[0026] For the feature vectors of each digital currency transaction, an isolation forest anomaly detection algorithm based on unsupervised learning is used for anomaly detection.

[0027] Optionally, for the feature vectors of each digital currency transaction, an isolation forest anomaly detection algorithm based on unsupervised learning is used for anomaly detection, specifically including:

[0028] Based on the feature vectors of each digital currency transaction, several binary search trees are constructed to form an isolation forest;

[0029] For the feature vector of each digital currency transaction, traverse the feature vector of this digital currency transaction in each binary search tree of the isolation forest; and

[0030] For each binary search tree, determine the path length from the position of this feature vector in this binary search tree to the root node;

[0031] According to the path lengths determined in each binary search tree, calculate the anomaly score of this feature vector;

[0032] Judge whether this digital currency transaction is abnormal according to the anomaly score, and add the abnormal digital currency transactions to the anomaly set and output.

[0033] The present invention also provides a digital currency transaction traceability device based on unsupervised learning technology, including:

[0034] A traffic acquisition module, configured to acquire the digital currency transaction traffic sent or received by the target node;

[0035] A feature vector construction module, which is used to count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for each digital currency transaction involved in the obtained traffic, and construct a feature vector of this digital currency transaction according to the counted number of messages;

[0036] An anomaly detection module, which is used to perform anomaly detection on the feature vectors of each digital currency transaction by using an unsupervised anomaly detection algorithm;

[0037] A transaction traceability module, which is used to trace whether each digital currency transaction is created by the target node according to the anomaly detection result.

[0038] The present invention also provides an electronic device, including a central processing unit, a signal processing and storage unit, and a computer program stored on the signal processing and storage unit and operable on the central processing unit, wherein the central processing unit executes the digital currency transaction traceability method based on unsupervised learning technology as described above.

[0039] In the technical solution of the present invention, the digital currency transaction traffic sent or received between the target node and its peer nodes is obtained; for each digital currency transaction involved in the obtained traffic, the number of transaction broadcast messages sent by the target node and the number of transaction request messages received are counted, and a feature vector of this digital currency transaction is constructed according to the counted number of messages; for the feature vectors of each digital currency transaction, an unsupervised anomaly detection algorithm is used to perform anomaly detection; according to the anomaly detection result, it is traced whether each digital currency transaction is created by the target node.

[0040] Since the feature vector constructed based on the number of broadcast and request messages can reflect the significant difference between the created transaction and the forwarded transaction, the constructed feature vector is used to identify the transactions created by the target node and the forwarded transactions through an unsupervised anomaly detection algorithm based on unsupervised learning. Compared with the existing traceability technology based on unsupervised learning, the accuracy of digital currency transaction traceability can be greatly improved.

[0041] In addition, for the detection algorithm based on unsupervised anomaly detection, it can identify the transactions suspected to be created by the target node itself from the transactions broadcast by the target node, reducing the size of the anonymous set for transaction detection; that is, using the isolation forest algorithm to construct an anomaly detection model can realize the identification of coarse-grained anomaly sample points based on unsupervised learning, namely, the detection of transactions suspected to be created by the node itself.

[0042] Furthermore, based on the coarse-grained recognition of the unsupervised anomaly detection algorithm, the technical solution of the present invention also analyzes the temporal relationship of transactions spreading in the digital currency network, and proposes a method for identifying node-forwarded transactions based on heuristic judgment, that is, a method for eliminating noise in the recognition results of the unsupervised anomaly detection algorithm, identifying and filtering possible node-forwarded transactions from the preliminary anomaly detection results of the unsupervised anomaly detection algorithm, and further improving the recognition degree of transactions created by nodes, that is, further improving the accuracy of tracing digital currency transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0044] Figure 1 It is a schematic diagram of the transaction broadcast and request process in the digital currency network of the prior art;

[0045] Figure 2 It is a flowchart of the method for tracing digital currency transactions based on unsupervised learning technology provided by the embodiment of the present invention;

[0046] Figure 3 It is a flowchart of a method for anomaly detection using the isolation forest anomaly detection algorithm based on unsupervised learning provided by the embodiment of the present invention;

[0047] Figure 4 It is a block diagram of the internal structure of a device for tracing digital currency transactions based on unsupervised learning technology provided by the embodiment of the present invention;

[0048] Figure 5 It is a schematic diagram of the experimental results of a method for tracing digital currency transactions based on unsupervised learning technology provided by the embodiment of the present invention;

[0049] Figure 6 It is a schematic diagram of the hardware structure of an electronic device provided by the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0050] In order to make the purpose, technical solutions and advantages of the present invention clearer, the following will further describe the present invention in detail with reference to specific embodiments and the accompanying drawings.

[0051] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should have the ordinary meanings understood by those of ordinary skill in the art to which the present disclosure pertains. The "first", "second" and similar terms used in the present disclosure do not denote any order, quantity or importance, but are only used to distinguish different components. Words such as "including" or "comprising" mean that the elements or objects appearing before this word cover the elements or objects listed after this word and their equivalents, without excluding other elements or objects. Words such as "connected" or "coupled" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right", etc. are only used to represent relative positional relationships, and when the absolute position of the object being described changes, the relative positional relationship may also change accordingly.

[0052] The inventors of the present invention considered that when a node conducts a digital currency transaction, that is, when sending the digital currency owned by the present node to the digital currency address of the recipient, it is necessary to broadcast this transaction in the peer-to-peer network, and other nodes in the network will forward and verify this transaction, and finally this transaction is added to the blockchain "ledger".

[0053] As Figure 1 shown, when a node creates or receives a new transaction, it will include the hash value of this transaction in the transaction broadcast message (such as an Inv message) and send it to the peer nodes in the network. The peer node that first receives this transaction will return a transaction request message (such as a Getdata message) containing the hash value of this transaction to request the complete transaction information. Finally, the node will send a transaction response message (such as a Tx message) to respond to the transaction request message from the peer node.

[0054] Through the analysis of the digital currency traffic, the inventors observed that: compared with forwarding transactions, the propagation mode of transactions created by the node itself is more unique. Therefore, the technical solution of the present invention constructs a feature vector by using the significant difference in the number of broadcast and request messages between the transactions created by the node and the forwarded transactions;

[0055] That is to say, compared with forwarding transactions, the performance of the digital currency transactions created by the node itself is more abnormal when propagating in the network layer. This abnormality is mainly reflected in the number of transaction broadcast messages and request messages. Therefore, based on this abnormal performance, the technical solution of the present invention extracts eigenvalue from the network traffic and constructs a feature vector and space.

[0056] Based on the above analysis, in the technical solution of the present invention, the digital currency transaction traffic sent or received between the target node and its peer nodes is obtained; for each digital currency transaction involved in the obtained traffic, the number of transaction broadcast messages sent by the target node and the number of transaction request messages received are counted, and a feature vector of this digital currency transaction is constructed according to the counted number of messages; for the feature vectors of each digital currency transaction, an unsupervised anomaly detection algorithm is used for anomaly detection; according to the anomaly detection result, trace back whether each digital currency transaction is created by the target node.

[0057] Since the feature vector constructed based on the number of broadcast and request messages can reflect the significant difference between the created transactions and the forwarded transactions, the constructed feature vector is used to identify the created transactions and the forwarded transactions of the target node through an unsupervised anomaly detection algorithm based on unsupervised learning. Compared with the existing unsupervised learning-based tracing technology, the tracing accuracy of digital currency transactions can be greatly improved.

[0058] The technical solution of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0059] A method for tracing digital currency transactions based on unsupervised learning technology provided by an embodiment of the present invention has a process as Figure 2 shown, and includes the following steps:

[0060] Step S201: Obtain the digital currency transaction traffic sent or received between the target node and its peer nodes.

[0061] Specifically, the digital currency transaction traffic at the network layer sent or received by the target node can be obtained at the entrance or exit gateway of the autonomous domain where the target node is located.

[0062] Step S202: Construct a feature vector for each digital currency transaction involved in the obtained traffic.

[0063] In this step, for each digital currency transaction involved in the obtained traffic, the number of transaction broadcast messages sent by the target node and the number of received transaction request messages are counted, and a feature vector of this digital currency transaction is constructed according to the counted number of messages.

[0064] Specifically, for the obtained traffic, analyze the types of digital currency messages that appear in the traffic, mainly focusing on three types of messages: transaction broadcast messages, transaction request messages, and Tx messages; and parse the transaction hash value from these types of messages. Messages with the same hash value belong to the same digital currency transaction. After parsing the transaction hash value from the message, establish the corresponding relationship between the transaction hash value and the message; based on the corresponding relationship between the transaction hash value and the message, the number of transaction broadcast messages sent by the target node corresponding to the transaction hash value in the traffic can be counted, as well as the number of transaction request messages received by the target node corresponding to the transaction hash value in the traffic, that is, for each digital currency transaction involved in the obtained traffic, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received.

[0065] For a digital currency transaction, the number of transaction broadcast messages Inv_Num sent by the node. Compared with the forwarded transactions, the node will broadcast the transactions created by itself to more peer nodes;

[0066] For a digital currency transaction, the number of transaction request messages Getdata_Num received by the node. Peer nodes will only send transaction request messages for transactions they have never received. Compared with the forwarded transactions, more peer nodes will request the transactions created by the node itself.

[0067] For a digital currency transaction, the ratio Ratio of the number of transaction request messages Getdata_Num received by the node to the number of transaction broadcast messages Inv_Num sent, that is, the ratio of the number of broadcasts to the number of requests for a transaction. Compared with the forwarded transactions, the transactions created by the node itself should have a higher request-to-broadcast ratio, that is, request / broadcast.

[0068] For a digital currency transaction, the sum Sum of the number of transaction broadcast messages sent by the node and the number of transaction request messages received. Compared with the forwarded transactions, the transactions created by the node itself have a higher sum of message numbers.

[0069] Thus, in an exemplary embodiment, based on the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for a digital currency transaction, the feature vector of this digital currency transaction can include: Inv_Num, Getdata_Num, Ratio, Sum;

[0070] Among them, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, which are statistically obtained for this digital currency transaction. Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

[0071] That is, the constructed feature vector X = [Inv_Num, Getdata_Num, Ratio, Sum];

[0072] Where n represents the number of digital currency transactions involved in the traffic, and d represents the number of eigenvalues in the feature vector X. represents a real matrix space of size n×d.

[0073] As a more optimal implementation, the feature vector can also be expanded: using unsupervised representation learning, the output probability Score(X) calculated by passing the feature vector X through an unsupervised learning algorithm (such as the IsolationForest algorithm) is expanded into the feature vector to obtain the expanded feature vector X_NEW; that is, after expanding the output probability of the feature vector calculated by the unsupervised learning algorithm into the feature vector, the expanded feature vector is obtained.

[0074] That is, the expanded feature vector X_NEW = [X, Score(X)] = [Inv_Num, Getdata_Num, Ratio, Sum, Score(X)];

[0075]

[0076] Step S203: For the feature vectors of each digital currency transaction, use an unsupervised anomaly detection algorithm to perform anomaly detection;

[0077] In this step, for the feature vectors of each digital currency transaction, existing unsupervised anomaly detection algorithms can be used to perform anomaly detection; for example, use the Isolation Forest anomaly detection algorithm based on unsupervised learning to perform anomaly detection, or use the one-class support vector machine anomaly detection algorithm based on unsupervised learning to perform anomaly detection, or use the autoencoder anomaly detection algorithm based on unsupervised learning to perform anomaly detection.

[0078] In an exemplary embodiment, for the feature vectors (or expanded feature vectors) of each digital currency transaction, use the Isolation Forest anomaly detection algorithm based on unsupervised learning to perform anomaly detection. The specific method process is as Figure 3 shown, including the following sub-steps:

[0079] Sub-step S401: Based on the feature vectors of each digital currency transaction, construct a number of binary search trees to form an isolation forest;

[0080] In this sub-step, divide the feature vectors (or the extended feature vectors) of each digital currency transaction into several sub-datasets for constructing several binary search trees respectively. The process of constructing a binary search tree using one sub-dataset is as follows:

[0081] Obtain the i-th eigenvalue from the feature vectors in the sub-dataset, and recursively construct a binary search tree using the obtained eigenvalues. In the constructed binary search tree, place the eigenvalues smaller than the current root node into the left child node, and place the eigenvalues larger than the current root node into the right child node until the binary search tree reaches the specified height or only one eigenvalue remains. In the constructed binary search tree, the node where the eigenvalue is located corresponds to the feature vector to which the eigenvalue belongs. Here, i is a random number greater than 0 and less than n, and n is the total number of eigenvalues in the feature vector.

[0082] The constructed number of binary search trees form an isolation forest.

[0083] Sub-step S402: For the feature vector of each digital currency transaction, traverse the feature vector of the digital currency transaction in each binary search tree of the isolation forest, and determine the path length from the position of the feature vector in the binary search tree to the root node; <>

[0084] In this sub-step, for the feature vector (or the extended feature vector) of a digital currency transaction, for the current binary search tree to be traversed, obtain the j-th eigenvalue from the feature vector, traverse using the j-th eigenvalue in the binary search tree, determine the node where the eigenvalue is inserted into the binary search tree, and then determine the path length from this node to the root node of the binary search tree. Here, the binary search tree is constructed based on the j-th eigenvalue in the feature vectors of each digital currency transaction.

[0085] Sub-step S403: Calculate the anomaly score of the feature vector according to the path lengths determined in each binary search tree;

[0086] In this sub-step, for the feature vector (or the extended feature vector) of a digital currency transaction, after determining the path length of the feature vector in each binary search tree, use statistical methods to calculate the average path length; and then determine the anomaly score of the feature vector of the digital currency transaction according to the calculated average path length. Generally speaking, the larger the average path length, the higher the anomaly score.

[0087] Sub-step S404: Determine whether the digital currency transaction is abnormal according to the abnormal score, and add the abnormal digital currency transactions to the abnormal set and output.

[0088] In this sub-step, if the abnormal score of the feature vector (or the extended feature vector) of the digital currency transaction is greater than the set threshold, it is determined that the digital currency transaction is abnormal, and the digital currency transactions determined to be abnormal are added to the abnormal set;

[0089] Output the abnormal set as the abnormal detection result.

[0090] Step S204: Trace whether each digital currency transaction is created for the target node according to the abnormal detection result.

[0091] In this step, the digital currency transactions in the abnormal detection result that can be traced back to be created for the target node are identified as the transactions created for the target node.

[0092] As a more optimal implementation, the abnormal detection result obtained by using the unsupervised anomaly detection algorithm can be used as a coarse-grained identification of abnormal transactions, that is, suspicious abnormal transactions, that is, transactions suspected to be created by the target node; then, for each digital currency transaction in the abnormal detection result, heuristic judgment-based node forwarding transaction identification is performed, that is, for each digital currency transaction in the abnormal detection result, temporal relationship analysis of the traffic is performed to identify and filter out the forwarding transactions of the target node:

[0093] For the transaction broadcast messages sent and received by the target node that contain the same transaction hash value, if it is analyzed that the received transaction broadcast message is earlier than the sent transaction broadcast message, then the digital currency transaction corresponding to the transaction hash value is identified as the forwarding transaction of the target node;

[0094] For the transaction request messages sent and received by the target node that contain the same transaction hash value, if it is analyzed that the sent transaction request message is earlier than the received transaction request message, then the digital currency transaction corresponding to the transaction hash value is identified as the forwarding transaction of the target node;

[0095] For the transaction broadcast message and transaction request message sent by the target node that contain the same transaction hash value, if it is analyzed that the sent transaction request message is earlier than the sent transaction broadcast message, then the digital currency transaction corresponding to the transaction hash value is identified as the forwarding transaction of the target node.

[0096] Filter out the identified forwarding transactions from the abnormal detection result, so as to improve the accuracy of transaction traceability based on the abnormal detection result.

[0097] Based on the above digital currency transaction traceability method based on unsupervised learning technology, an apparatus for digital currency transaction traceability based on unsupervised learning technology provided by an embodiment of the present invention has an internal structure as shown in Figure 4 follows, including: a traffic acquisition module 501, a feature vector construction module 502, and a transaction traceability module 503;

[0098] Among them, the traffic acquisition module 501 is used to acquire the digital currency transaction traffic sent or received between the target node and its peer nodes;

[0099] The feature vector construction module 502 is used to count the number of transaction broadcast messages sent by the target node and the number of received transaction request messages for each digital currency transaction involved in the acquired traffic, and construct a feature vector for this digital currency transaction according to the counted number of messages;

[0100] More preferably, the feature vector construction module 502 can also expand the feature vector: after expanding the output probability of the feature vector calculated by the unsupervised learning algorithm to the feature vector, an expanded feature vector is obtained.

[0101] The transaction traceability module 503 is used to perform anomaly detection on the feature vectors of each digital currency transaction constructed by the feature vector construction module 502 by using an unsupervised anomaly detection algorithm; according to the anomaly detection result, trace whether each digital currency transaction is created by the target node, that is, identify whether this digital currency transaction is created by the target node;

[0102] More preferably, after the transaction traceability module 503 performs anomaly detection on the feature vectors of each digital currency transaction by using an unsupervised anomaly detection algorithm, it performs an analysis of the temporal relationship of the traffic for each digital currency transaction in the anomaly detection result, identifies and filters out the forwarding transactions of the target node, and then traces each digital currency transaction in the filtered anomaly detection result as created by the target node, that is, identifies the above transactions as transactions created by the target node.

[0103] For the implementation methods of the functions of each module in the above apparatus for digital currency transaction traceability based on unsupervised learning technology, reference can be made to the methods in each step of the process shown in the above Figure 2 、 3 and will not be elaborated here.

[0104] The digital currency transaction tracing technology based on unsupervised learning technology of the present invention has low operation difficulty, does not require deploying a large number of probe nodes, and has very low tracing cost and consumption of computer network resources. This technology constructs a feature space by using the differences in traffic and the number of network messages between the node's own created transactions and forwarded transactions, and enhances the representation of feature vectors through unsupervised representation learning. At the same time, compared with a simple unsupervised method, the combination with a heuristic based on time series analysis has a good noise reduction effect and can effectively improve the tracing accuracy. Using the tracing method of the present invention, even if only the traffic under the connection between the target node and half or fewer of its peer nodes is collected, the transactions created by the target node can be identified with a precision of more than 85% and a recall rate of 100%, as Figure 5 shown. Among them, the evaluation indexes of this method are defined as follows:

[0105]

[0106] Figure 6 FIG. shows a more specific schematic hardware structure diagram of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. Among them, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other inside the device through the bus 1050.

[0107] The processor 1010 may be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is used to execute relevant programs to implement the digital currency transaction tracing method based on unsupervised learning technology provided in the embodiments of this specification.

[0108] The memory 1020 may be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When implementing the technical solutions provided in the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0109] The input / output interface 1030 is used to connect to the input / output module, and can be connected to a non-linear receiver to receive information from the non-linear receiver, so as to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure), or can be externally connected to the device to provide corresponding functions. Among them, the input devices can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices can include a display, a speaker, a vibrator, an indicator light, etc.

[0110] The communication interface 1040 is used to connect to a communication module (not shown in the figure) to realize the communication interaction between this device and other devices. Among them, the communication module can realize communication through a wired method (such as USB, network cable, etc.), or can also realize communication through a wireless method (such as mobile network, WIFI, Bluetooth, etc.).

[0111] The bus 1050 includes a path for transmitting information between various components of the device (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0112] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, this device may also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device may also only include the components necessary to implement the solution of the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0113] In the technical solution of the present invention, the digital currency transaction flow sent or received between the target node and its peer node is obtained; for each digital currency transaction involved in the obtained flow, the number of transaction broadcast messages sent by the target node and the number of transaction request messages received are counted, and a feature vector of this digital currency transaction is constructed according to the counted number of messages; for the feature vectors of each digital currency transaction, an unsupervised anomaly detection algorithm is used for anomaly detection; according to the anomaly detection result, trace back whether each digital currency transaction is created by the target node.

[0114] Since the feature vector constructed based on the number of broadcast and request messages can reflect the significant difference between the transactions created by the nodes in the digital currency network and the transactions forwarded, therefore, by using the constructed feature vector, through the unsupervised anomaly detection algorithm based on unsupervised learning, the identification of the transactions created and forwarded by the target node can be realized. Compared with the existing unsupervised learning-based traceability technology, the traceability accuracy of digital currency transactions can be greatly improved.

[0115] In addition, based on the detection algorithm of unsupervised anomaly detection, the detection algorithm can identify the transactions suspected to be created by the target node itself from the transactions broadcast by the target node, reducing the size of the anonymous set for transaction detection; that is, using the isolation forest algorithm to construct an anomaly detection model, which can realize the identification of coarse-grained anomaly sample points based on unsupervised learning, namely, the detection of transactions created by the suspected node itself.

[0116] Furthermore, based on the coarse-grained identification of the unsupervised anomaly detection algorithm, the technical solution of the present invention also analyzes the temporal relationship of transactions spreading in the digital currency network, and proposes a method for identifying node-forwarded transactions based on heuristic judgment, that is, a method for eliminating the noise of the identification results of the unsupervised anomaly detection algorithm, identifying and filtering possible node-forwarded transactions from the anomaly detection results of the preliminary unsupervised anomaly detection algorithm, further improving the recognition degree of transactions created by the node itself, that is, further improving the accuracy of digital currency transaction traceability.

[0117] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0118] Those of ordinary skill in the art should understand that the discussion of any of the above embodiments is only exemplary, and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples; under the idea of the present invention, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations in different aspects of the present invention as described above, which are not provided in detail for the sake of brevity.

[0119] In addition, for simplicity of explanation and discussion, and so as not to render the present invention difficult to understand, well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Further, the devices may be shown in block diagram form in order to avoid rendering the present invention difficult to understand, and this also takes into account the fact that details of the implementation of such block diagram devices are highly dependent on the platform on which the present invention is to be implemented (i.e., these details should be fully within the understanding of those of ordinary skill in the art). In cases where specific details (such as circuits) are set forth to describe exemplary embodiments of the present invention, it will be apparent to those of ordinary skill in the art that the present invention may be practiced without these specific details or with variations of these specific details. Accordingly, these descriptions are to be regarded as illustrative rather than restrictive.

[0120] Although the present invention has been described in connection with specific embodiments thereof, many alternatives, modifications, and variations thereof will be apparent to those of ordinary skill in the art based on the foregoing description. For example, other memory architectures (such as dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0121] Embodiments of the present invention are intended to cover all such alternatives, modifications, and variations that fall within the broad scope of the appended claims. Accordingly, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for tracing the origin of digital currency transactions based on unsupervised learning technology, characterized in that, Including: Obtain the digital currency transaction flow sent or received between the target node and its peer nodes; For each digital currency transaction involved in the obtained flow, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and construct a feature vector for this digital currency transaction based on the counted message numbers; For the feature vectors of each digital currency transaction, perform anomaly detection using an unsupervised anomaly detection algorithm: Based on the feature vectors of each digital currency transaction, construct several binary search trees to form an isolation forest; for the feature vector of each digital currency transaction, traverse the feature vector of this digital currency transaction in each binary search tree of the isolation forest; and for each binary search tree, determine the path length from the position of this feature vector in this binary search tree to the root node; calculate the anomaly score of this feature vector according to the path lengths determined in each binary search tree; Judge whether this digital currency transaction is abnormal according to the anomaly score, and add the abnormal digital currency transactions to the anomaly set for output; According to the anomaly detection result, trace whether each digital currency transaction is created by the target node.

2. The method according to claim 1, characterized in that, After performing anomaly detection using the unsupervised anomaly detection algorithm, it further includes: For each digital currency transaction in the anomaly detection result, perform analysis of the temporal relationship of the flow, identify and filter out the forwarding transactions of the target node, and obtain the filtered anomaly detection result; and The tracing whether each digital currency transaction is created by the target node according to the anomaly detection result specifically includes: Identify each digital currency transaction in the filtered anomaly detection result as a digital currency transaction created by the target node.

3. The method according to claim 1, characterized in that, The counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing a feature vector for this digital currency transaction based on the counted message numbers specifically includes: The constructed feature vector for this digital currency transaction includes: Inv_Num, Getdata_Num, Ratio, Sum; Wherein, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received counted for this digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

4. The method according to claim 3, wherein After constructing the feature vector for this digital currency transaction, it further includes: Expand the feature vector: After expanding the output probability of the feature vector calculated by the unsupervised learning algorithm to the feature vector, obtain the expanded feature vector.

5. The method according to claim 2, wherein The performing analysis of the temporal relationship of the flow for each digital currency transaction in the anomaly detection result, identifying and filtering out the forwarding transactions of the target node specifically includes: For the transaction broadcast messages sent and received by the target node that contain the same transaction hash value, if it is analyzed that the received transaction broadcast message is earlier than the sent transaction broadcast message, then identify the digital currency transaction corresponding to the transaction hash value as the forwarded transaction of the target node; For the transaction request messages sent and received by the target node that contain the same transaction hash value, if it is analyzed that the sent transaction request message is earlier than the received transaction request message, then identify the digital currency transaction corresponding to the transaction hash value as the forwarded transaction of the target node; For the transaction broadcast message and transaction request message sent by the target node that contain the same transaction hash value, if it is analyzed that the sent transaction request message is earlier than the sent transaction broadcast message, then identify the digital currency transaction corresponding to the transaction hash value as the forwarded transaction of the target node.

6. A digital currency transaction traceability device based on unsupervised learning technology, characterized in that, Includes: A traffic acquisition module, configured to acquire the digital currency transaction traffic sent or received by the target node; A feature vector construction module, configured to, for each digital currency transaction involved in the acquired traffic, count the number of transaction broadcast messages sent by the target node and the number of received transaction request messages, and construct a feature vector of the digital currency transaction according to the counted number of messages; An anomaly detection module, configured to perform anomaly detection on the feature vectors of each digital currency transaction by using an unsupervised anomaly detection algorithm: based on the feature vectors of each digital currency transaction, construct a number of binary search trees to form an isolation forest; for the feature vector of each digital currency transaction, traverse the feature vector of the digital currency transaction in each binary search tree of the isolation forest; and for each binary search tree, determine the path length from the position of the feature vector in the binary search tree to the root node; calculate the anomaly score of the feature vector according to the path lengths determined in each binary search tree; Judge whether the digital currency transaction is abnormal according to the anomaly score, and add the abnormal digital currency transactions to the anomaly set for output; A transaction tracing module, configured to trace whether each digital currency transaction is created by the target node according to the anomaly detection result.

7. The device according to claim 6, characterized in that, Also includes: The transaction tracing module is specifically configured to, after performing anomaly detection on the feature vectors of each digital currency transaction by using an unsupervised anomaly detection algorithm, perform a temporal relationship analysis of the traffic for each digital currency transaction in the anomaly detection result, identify and filter out the forwarded transactions of the target node, and then identify each digital currency transaction in the filtered anomaly detection result as the digital currency transaction created by the target node.

8. An electronic device, comprising a central processing unit, a signal processing and storage unit, and a computer program stored on the signal processing and storage unit and executable on the central processing unit, characterized in that, When the central processing unit executes the program, it implements the method according to any one of claims 1-5.

Images