A digital currency transaction tracing method and device based on classifier

Abstract

The present invention discloses a digital currency transaction tracing method and device based on a classifier, the method comprising: intercepting the digital currency transaction traffic sent or received between a target node and its peer node; for each digital currency transaction involved in the intercepted traffic, counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing a feature vector according to the number of statistical messages; based on the feature vector of each digital currency transaction and the classifier, tracing whether the digital currency transaction is created by the target node; wherein the classifier is pre-trained based on a supervised learning technology using a training sample; wherein the training sample is constructed based on the digital currency transaction traffic sent or received collected from the target node in advance, and marking positive and negative samples according to the detection results of at least two different unsupervised anomaly detection algorithms. The application of the present invention can improve the accuracy of digital currency transaction tracing.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a digital currency transaction tracing method and device based on a classifier. Background Art

[0002] As the initial realization of the blockchain idea, digital currencies, led by cryptocurrencies, have developed rapidly, and the scale of transactions has continued to rise. At the same time, the decentralized and anonymous nature of digital currencies, as well as the convenience of allowing users to send funds instantly anywhere in the world, provide criminals with opportunities to engage in money laundering, black market transactions and other illegal activities. Therefore, it is very necessary to study illegal digital currencies, especially the transaction traceability technology of digital currencies.

[0003] Existing digital currency transaction traceability technologies are mainly divided into two research directions: transaction layer traceability technology and network layer traceability technology. Transaction layer traceability technology refers to the analysis of transaction records to find a certain relationship between anonymous transaction addresses, such as "common input, change address", and use heuristics to cluster anonymous addresses that may belong to the same entity, or observe transaction behavior to achieve transaction clustering that conforms to a specific pattern. This traceability technology can only achieve address clustering of the same entity, and cannot obtain the entity's real identity information.

[0004] Network layer tracing technology refers to collecting information on digital currency network layer traffic, analyzing the propagation path of transactions in the network, and establishing a mapping between transactions and the node IP that generated the transaction.

[0005] In a network layer tracing technology using unsupervised learning in the prior art, a routing attack method is used to intercept data packets sent by the target node in an unnoticeable way using an AS-level listener, and an unsupervised learning algorithm - isolation forest is used to detect transactions created by the target node. Experiments show that an AS-level attacker who intercepts 50% of the target node connections can deanonymize transactions created by the target node with a recall rate of 90% and a false positive rate of 0.003%.

[0006] Among the existing digital currency traceability technologies, transaction layer traceability technology only realizes the clustering of transaction addresses that may belong to the same entity, and cannot obtain the identity information of anonymous digital currency users, and the degree of de-anonymization is insufficient; while the traceability technology based on unsupervised learning mainly uses network traffic analysis and anomaly detection algorithms to identify transactions created by nodes, and also has the problem of low traceability accuracy. In addition, there may be multiple abnormal behaviors in the detection data. Such anomalies outside the target behavior are regarded as noise data, and the detection algorithm based on pure unsupervised learning cannot distinguish them from the target behavior. Summary of the invention

[0007] In view of this, the purpose of the present invention is to propose a digital currency transaction tracing method and device based on a classifier, which uses a classifier trained based on supervised learning technology for tracing identification. Compared with the existing tracing technology based on unsupervised learning, the tracing accuracy of digital currency transactions can be improved.

[0008] Based on the above purpose, the present invention provides a digital currency transaction tracing method based on a classifier, comprising:

[0009] Intercepting digital currency transaction traffic sent or received between the target node and its peer nodes;

[0010] For each digital currency transaction involved in the intercepted traffic, count the number of transaction broadcast messages sent and transaction request messages received by the target node, and construct a feature vector of the digital currency transaction based on the number of counted messages;

[0011] For each digital currency transaction, based on the feature vector of the digital currency transaction and the pre-trained classifier, trace whether the digital currency transaction was created by the target node;

[0012] The classifier is pre-trained using training samples based on supervised learning technology; the training samples are constructed based on the digital currency transaction traffic sent or received collected in advance from the target node, and positive and negative samples are marked based on the detection results of at least two different unsupervised anomaly detection algorithms.

[0013] Optionally, the training samples are constructed based on the sent or received digital currency transaction traffic collected in advance from the target node, and positive and negative samples are marked based on the detection results of at least two different unsupervised anomaly detection algorithms, specifically including:

[0014] For each digital currency transaction involved in the pre-collected digital currency transaction traffic sent or received by the target node, count the number of transaction broadcast messages sent and transaction request messages received by the node, and construct a feature vector of the digital currency transaction as a training sample based on the number of counted messages;

[0015] After all the obtained training samples are formed into a sample set, at least two different unsupervised anomaly detection algorithms are used to perform anomaly detection on the sample set to obtain detected anomaly sets respectively;

[0016] Take the intersection of the obtained anomaly sets and mark the training samples in the intersection as positive samples;

[0017] The output probability of each training sample is calculated through an unsupervised learning algorithm, and the minimum value of the output probability of the positive sample is determined;

[0018] For other training samples, if the output probability of the training sample is less than the minimum value, the training sample is marked as a negative sample; otherwise, it is marked as a positive sample.

[0019] Optionally, counting the number of transaction broadcast messages sent and transaction request messages received by the target node, and constructing a feature vector of the digital currency transaction according to the number of counted messages, specifically includes:

[0020] The constructed feature vector of the digital currency transaction includes: Inv_Num, Getdata_Num, Ratio, Sum;

[0021] Among them, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for the digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

[0022] Furthermore, after constructing the feature vector of the digital currency transaction, the method further includes:

[0023] Expand the feature vector:

[0024] After the output probability of the feature vector calculated by the unsupervised learning algorithm is expanded to the feature vector, an expanded feature vector is obtained.

[0025] Optionally, the feature vector based on the digital currency transaction and the pre-trained classifier are used to trace whether the digital currency transaction is created by the target node, specifically:

[0026] Input the expanded feature vector of the digital currency transaction into the pre-trained classifier;

[0027] According to the output of the classifier, it is traced whether the digital currency transaction was created by the target node.

[0028] Optionally, before the classifier is trained using positive and negative samples, the method further includes:

[0029] Expand the training samples:

[0030] After the output probability of the training sample calculated by the unsupervised learning algorithm is expanded to the training sample, the expanded training sample is obtained.

[0031] Optionally, the classifier is pre-trained using training samples based on supervised learning technology, specifically:

[0032] The classifier is pre-trained using the expanded training samples based on a supervised learning technique.

[0033] The present invention also provides a digital currency transaction tracing device based on a classifier, comprising:

[0034] Traffic acquisition module, used to intercept digital currency transaction traffic sent or received between the target node and its peer nodes;

[0035] A feature vector construction module is used to count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for each digital currency transaction involved in the intercepted traffic, and to construct a feature vector of the digital currency transaction according to the number of counted messages;

[0036] A transaction tracing module is used to trace, for each digital currency transaction, whether the digital currency transaction is created by the target node based on the feature vector of the digital currency transaction and the pre-trained classifier;

[0037] The classifier is pre-trained using training samples based on supervised learning technology; the training samples are constructed based on the digital currency transaction traffic sent or received collected in advance from the target node, and positive and negative samples are marked based on the detection results of at least two different unsupervised anomaly detection algorithms.

[0038] The present invention also provides an electronic device, comprising a central processing unit, a signal processing and storage unit, and a computer program stored in the signal processing and storage unit and executable on the central processing unit, wherein the central processing unit executes the classifier-based digital currency transaction tracing method as described above.

[0039] In the technical solution of the present invention, the digital currency transaction traffic sent or received by the target node is intercepted; for each digital currency transaction involved in the intercepted traffic, the number of transaction broadcast messages sent and transaction request messages received by the target node is counted, and a feature vector of the digital currency transaction is constructed according to the number of counted messages; for each digital currency transaction, based on the feature vector of the digital currency transaction and a pre-trained classifier, the source of the digital currency transaction is traced to see whether it is created by the target node; wherein the classifier is pre-trained using training samples based on supervised learning technology; wherein the training samples are constructed based on the digital currency transaction traffic sent or received collected in advance from the target node, and positive and negative samples are marked according to the detection results of at least two different unsupervised anomaly detection algorithms.

[0040] Since the feature vector constructed based on the number of broadcast and request messages can reflect the significant difference between transactions created by a node and transactions forwarded, the constructed feature vector and the classifier pre-trained based on supervised learning technology are used to identify node creation transactions and forwarded transactions. Compared with the existing traceability technology based on unsupervised learning, the traceability accuracy of digital currency transactions can be greatly improved.

[0041] The technical solution of the present invention is aimed at the target node, and can identify the transactions created by the target node itself from the transactions broadcast by the node, so as to realize the de-anonymization of the transaction. Several unsupervised anomaly detection algorithms are used to identify suspicious transactions from the collected sample set to form a suspicious transaction set, and positive samples are marked by finding the intersection of the suspicious transaction set. Finally, the sample set is oversampled to construct a training set, so as to train a semi-supervised learning model, and the XGBoost algorithm is used to solve the binary classification problem of the transaction, and the transactions created by the target node itself are identified from the network layer traffic of the target node. Compared with the existing traceability technology based on unsupervised learning, it can greatly improve the traceability accuracy of digital currency transactions.

[0042] Furthermore, the technical solution of the present invention utilizes unsupervised representation learning to perform feature engineering, takes the output probability of the original feature space under the unsupervised algorithm as a new eigenvalue, and expands it into the final feature vector, so as to enhance the representation ability of the feature vector for the sample.

[0043] Furthermore, the technical solution of the present invention adopts an "unsupervised + supervised" technical architecture, which can further improve the traceability accuracy of digital currency transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A schematic diagram of a transaction broadcast and request process in a digital currency network in the prior art;

[0046] Figure 2 A flow chart of a digital currency transaction tracing method based on a classifier provided in an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of intercepting digital currency transaction traffic provided by an embodiment of the present invention;

[0048] Figure 4A flow chart of a classifier training method provided by an embodiment of the present invention;

[0049] Figure 5 A block diagram of the internal structure of a digital currency transaction tracing device based on a classifier provided in an embodiment of the present invention;

[0050] Figure 6 A schematic diagram of experimental results of a digital currency transaction tracing method based on a classifier provided in an embodiment of the present invention;

[0051] Figure 7 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0053] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the present disclosure do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0054] The inventor of the present invention took into consideration that when a node conducts a digital currency transaction, that is, sends the digital currency owned by the node to the digital currency address of the recipient, it is necessary to broadcast the transaction in the peer-to-peer network, and other nodes in the network will forward and verify the transaction, and finally the transaction will be added to the blockchain "ledger".

[0055] like Figure 1 As shown, when a node creates or receives a new transaction, it will include the hash value of the transaction in a transaction broadcast message (such as an Inv message) and send it to the peer nodes in the network. The peer node that receives the transaction for the first time will return a transaction request message (such as a Getdata message) containing the hash value of the transaction to request complete transaction information. Finally, the node will send a transaction response message (such as a Tx message) to respond to the transaction request message from the peer node.

[0056] Through the analysis of digital currency traffic, the inventors observed that: compared with forwarded transactions, the propagation pattern of transactions created by nodes themselves is more unique. Therefore, the technical solution of the present invention uses the significant difference in the number of broadcast and request messages between node-created transactions and forwarded transactions to construct a feature vector;

[0057] That is to say, compared with forwarding transactions, digital currency nodes themselves create transactions in the network layer with abnormal performance. This abnormality is mainly reflected in the number of transaction broadcast messages and request messages. Therefore, the technical solution of the present invention is based on this abnormal performance, extracts characteristic values ​​from network traffic, and constructs characteristic vectors and spaces.

[0058] Based on the above analysis, in the technical solution of the present invention, the digital currency transaction traffic sent or received by the target node is intercepted; for each digital currency transaction involved in the intercepted traffic, the number of transaction broadcast messages sent and transaction request messages received by the target node is counted, and a feature vector of the digital currency transaction is constructed based on the counted number of messages; for each digital currency transaction, based on the feature vector of the digital currency transaction and a pre-trained classifier, the source of the digital currency transaction is traced to see whether it is created by the target node; wherein the classifier is pre-trained based on supervised learning technology using training samples; wherein the training samples are constructed based on the digital currency transaction traffic sent or received collected in advance from the target node, and positive and negative samples are marked according to the detection results of at least two different unsupervised anomaly detection algorithms.

[0059] Since the feature vector constructed based on the number of broadcast and request messages can reflect the significant differences between created transactions and forwarded transactions, the use of the constructed feature vector and the classifier pre-trained based on supervised learning technology to identify created transactions and forwarded transactions can greatly improve the traceability accuracy of digital currency transactions compared to the existing traceability technology based on unsupervised learning.

[0060] The technical solution of the present invention is aimed at the target node, and can identify the transactions created by the target node itself from the transactions broadcast by the node, so as to realize the de-anonymization of the transaction. Several unsupervised anomaly detection algorithms are used to identify suspicious transactions from the collected sample set to form a suspicious transaction set, and positive samples are marked by finding the intersection of the suspicious transaction set. Finally, the sample set is oversampled to construct a training set, so as to train a semi-supervised learning model, and the XGBoost algorithm is used to solve the binary classification problem of the transaction, and the transactions created by the target node itself are identified from the network layer traffic of the target node. Compared with the existing traceability technology based on unsupervised learning, it can greatly improve the traceability accuracy of digital currency transactions.

[0061] Furthermore, the technical solution of the present invention can also calculate the output probability of the feature vector through an unsupervised learning algorithm, and expand the feature vector, thereby enhancing the representation of the feature vector through unsupervised representation learning; the use of the "unsupervised + supervised" technical architecture can further improve the traceability accuracy of digital currency transactions.

[0062] The technical solutions of the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0063] The embodiment of the present invention provides a digital currency transaction tracing method based on a classifier, the process is as follows: Figure 2 As shown, the following steps are included:

[0064] Step S201: intercepting the digital currency transaction traffic sent or received by the target node.

[0065] Specifically, you can Figure 3 As shown, attackers who rely on the AS (autonomous domain) or IXP (Internet exchange center) level capture digital currency transaction traffic. They act as middlemen between hosts of managed nodes in the digital currency network (such as the Bitcoin network), and can intercept traffic between digital currency nodes (such as Bitcoin nodes) located in different ASs in the digital currency network (such as the Bitcoin network) without being noticed; that is, attackers collect traffic when they intercept the connection between the target node and some of its peer nodes.

[0066] That is to say, the digital currency transaction traffic sent or received between the target node and its peer node can be intercepted at the entry or exit gateway of the autonomous domain where the target node is located.

[0067] Step S202: For each digital currency transaction involved in the intercepted traffic, construct a feature vector of the digital currency transaction.

[0068] In this step, for each digital currency transaction involved in the intercepted traffic, the number of transaction broadcast messages sent and transaction request messages received by the target node is counted, and a feature vector of the digital currency transaction is constructed based on the number of counted messages.

[0069] Specifically, for the intercepted traffic, the types of digital currency messages appearing in the traffic are analyzed, focusing on three types of messages: transaction broadcast messages, transaction request messages, and Tx messages; and the hash values ​​of the transactions are parsed from these types of messages. Messages with the same hash value belong to the same digital currency transaction. After parsing the hash value of the transaction from the message, a corresponding relationship between the hash value of the transaction and the message is established; based on the corresponding relationship between the hash value of the transaction and the message, the number of transaction broadcast messages sent by the target node corresponding to the hash value of each transaction in the traffic, and the number of transaction request messages received by the target node corresponding to the hash value of each transaction can be counted, that is, for each digital currency transaction involved in the intercepted traffic, the number of transaction broadcast messages sent by the target node and the number of transaction request messages received are counted.

[0070] For a digital currency transaction, the number of transaction broadcast messages sent by the node is Inv_Num. Compared with the forwarded transactions, the node will broadcast the transactions it created to more peer nodes;

[0071] For a digital currency transaction, the number of transaction request messages received by the node is Getdata_Num. The peer node will only send transaction request messages for transactions that it has never received. Compared with forwarded transactions, more peer nodes will request transactions created by themselves from the node.

[0072] For a digital currency transaction, the ratio of the number of transaction request messages Getdata_Num received by the node to the number of transaction broadcast messages Inv_Num sent, that is, the ratio of the number of broadcasts to the number of requests for a transaction. Compared with forwarded transactions, transactions created by the node itself should have a higher request-broadcast ratio, that is, request / broadcast.

[0073] For a digital currency transaction, the sum of the number of transaction broadcast messages sent by the node and the number of transaction request messages received is Sum. Compared with the forwarded transactions, the transactions created by the node itself have a higher sum of messages.

[0074] Thus, in an exemplary embodiment, based on the number of transaction broadcast messages sent by a target node and the number of transaction request messages received for a digital currency transaction, the feature vector of the digital currency transaction constructed may include: Inv_Num, Getdata_Num, Ratio, Sum;

[0075] Among them, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for the digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

[0076] That is, the constructed feature vector X = [Inv_Num, Getdata_Num, Ratio, Sum];

[0077] Where n represents the number of digital currency transactions involved in the traffic, d represents the number of eigenvalues ​​in the eigenvector X, Represents a real matrix of size n×d.

[0078] As a more optimal implementation method, the feature vector can also be expanded: using unsupervised representation learning, the output probability Score(X) calculated by the feature vector X through an unsupervised learning algorithm (for example, the isolation forest algorithm) is expanded into the feature vector to obtain an expanded feature vector X_NEW; that is, after the output probability of the feature vector calculated by the unsupervised learning algorithm is expanded to the feature vector, the expanded feature vector is obtained.

[0079] That is, the expanded feature vector X_NEW = [X, Score(X)] = [Inv_Num, Getdata_Num, Ratio, Sum, Score(X)];

[0080]

[0081] Step S203: Based on the constructed feature vector of the digital currency transaction and the pre-trained classifier, the digital currency transaction is traced.

[0082] In this step, for each digital currency transaction, based on the feature vector of the digital currency transaction and the pre-trained classifier, trace whether the digital currency transaction is created by the target node, that is, identify whether the digital currency transaction is created by the target node, thereby realizing transaction tracing.

[0083] Specifically, for each digital currency transaction, the feature vector of the digital currency transaction can be input into a pre-trained classifier; according to the output of the classifier, the source of the digital currency transaction can be traced to see whether it is created by the target node or forwarded by the target node, that is, whether the digital currency transaction is created by the target node or forwarded by the target node can be identified.

[0084] As a more optimal implementation method, the expanded feature vector of the digital currency transaction can be input into a pre-trained classifier; based on the output of the classifier, it is possible to trace back whether the digital currency transaction was created by the target node or forwarded by the target node, that is, to identify whether the digital currency transaction was created by the target node or forwarded by the target node.

[0085] The above-mentioned classifier is pre-trained using training samples based on supervised learning technology; wherein the training samples are constructed based on the sent or received digital currency transaction flow collected in advance from the target node in the digital currency network, and positive and negative samples are marked according to the detection results of at least two different unsupervised anomaly detection algorithms. The specific training method process is as follows Figure 4 As shown, the following steps are included:

[0086] Step S401: Collecting digital currency transaction traffic sent or received by the target node from the digital currency network;

[0087] In this step, the digital currency transaction traffic sent or received between the target node and its peer node in the digital currency network can be collected from the entry or exit gateway of the autonomous domain where the target node is located.

[0088] Step S402: for each digital currency transaction involved in the collected traffic, construct a feature vector of the digital currency transaction as a training sample;

[0089] In this step, for each digital currency transaction involved in the collected traffic, the number of transaction broadcast messages sent by the node and the number of transaction request messages received are counted, and a feature vector of the digital currency transaction is constructed based on the number of counted messages.

[0090] In an exemplary embodiment, based on the number of transaction broadcast messages sent by the node and the number of transaction request messages received by the node for a digital currency transaction, a feature vector of the digital currency transaction constructed is similar to the feature vector constructed in the above step S202, and may include: Inv_Num, Getdata_Num, Ratio, Sum; wherein, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the node and the number of transaction request messages received by the node for the digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

[0091] As a more optimal implementation method, the constructed feature vector can also be expanded: using unsupervised representation learning, the feature vector X is calculated through an unsupervised learning algorithm (for example, the Isolation Forest algorithm) to obtain the output probability Score(X), and the calculated output probability is expanded into the feature vector to obtain the expanded feature vector X_NEW; that is, after the output probability of the feature vector calculated by the unsupervised learning algorithm is expanded into the feature vector, the expanded feature vector is obtained.

[0092] Step S403: After all the obtained training samples are formed into a sample set, at least two different unsupervised anomaly detection algorithms are used to perform anomaly detection on the sample set to obtain detected anomaly sets, namely, suspicious transaction sets.

[0093] In an exemplary embodiment, three unsupervised anomaly detection algorithms based on unsupervised learning algorithms are used to perform anomaly detection on the sample set; the three unsupervised anomaly detection algorithms may be based on isolation forest, single-classification support vector machine, and autoencoder unsupervised learning algorithms respectively;

[0094] The process of detecting a sample set by an unsupervised anomaly detection algorithm based on an unsupervised learning algorithm is as follows: using the unsupervised learning algorithm to calculate the output probability of each training sample in the sample set; and forming an anomaly set from training samples whose output probability is higher than a set threshold.

[0095] After performing anomaly detection on the sample set using three different unsupervised anomaly detection algorithms, three detected anomaly sets are obtained respectively.

[0096] Step S404: taking the intersection of the obtained abnormal sets, and marking the training samples in the intersection as positive samples.

[0097] Step S405: Calculate the output probability of each training sample through an unsupervised learning algorithm, and determine the minimum value of the output probability of the positive samples.

[0098] In this step, for each digital currency transaction constructed in step S402, the feature vector used as a training sample is used to calculate the output probability through an unsupervised learning algorithm (eg, Isolation Forest algorithm).

[0099] Furthermore, for the positive samples marked in the above step S404, the minimum value a among the output probabilities of the positive samples is determined.

[0100] Step S406: Compare the output probabilities of other training samples with the determined minimum value a; and mark the training samples as positive samples or negative samples according to the comparison results.

[0101] In this step, for other training samples except the positive sample, if the output probability of the training sample is less than the minimum value a, the training sample is marked as a negative sample; otherwise, it is marked as a positive sample.

[0102] Step S407: train the classifier using positive and negative samples.

[0103] In this step, the training samples are input into the classifier, and the parameters of the classifier are adjusted according to the output of the classifier and the positive or negative samples marked by the training samples.

[0104] As a more optimal implementation method, the feature vector used as a training sample can also be expanded: by using unsupervised representation learning, the feature vector is used to calculate the output probability through an unsupervised learning algorithm (for example, the Isolation Forest algorithm), and the calculated output probability is expanded to the feature vector to obtain an expanded feature vector; that is, after the calculated output probability is expanded to the feature space of the training sample, the training sample after the feature space is expanded is obtained.

[0105] When training a classifier based on the expanded training samples, the training samples with expanded feature space are input into the classifier, and parameters of the classifier are adjusted according to the output of the classifier and the positive or negative samples marked by the expanded training samples.

[0106] This is used to train a classifier of a semi-supervised learning model and use the XGBoost algorithm to solve the binary classification problem of transactions.

[0107] Based on the above-mentioned digital currency transaction tracing method based on a classifier, an embodiment of the present invention provides a digital currency transaction tracing device based on a classifier, and its internal structure is as follows: Figure 5 As shown, it includes: a traffic acquisition module 501, a feature vector construction module 502, and a transaction tracing module 503;

[0108] The traffic acquisition module 501 is used to intercept the digital currency transaction traffic sent or received by the target node;

[0109] The feature vector construction module 502 is used to count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for each digital currency transaction involved in the intercepted traffic, and construct a feature vector of the digital currency transaction according to the number of counted messages;

[0110] More preferably, the feature vector construction module 502 may further expand the feature vector: after the output probability of the feature vector calculated by the unsupervised learning algorithm is expanded to the feature vector, an expanded feature vector is obtained.

[0111] The transaction tracing module 503 is used to trace, for each digital currency transaction, whether the digital currency transaction is created by the target node based on the feature vector of the digital currency transaction and the pre-trained classifier;

[0112] Preferably, the transaction tracing module 503 can input the expanded feature vector of each digital currency transaction into a pre-trained classifier, and trace whether the digital currency transaction was created by the target node based on the output of the classifier.

[0113] Wherein, the classifier is pre-trained using training samples based on supervised learning technology; wherein, the training samples are constructed based on the sent or received digital currency transaction traffic collected in advance from the target node in the digital currency network, and positive and negative samples are marked based on the detection results of at least two different unsupervised anomaly detection algorithms.

[0114] Furthermore, the digital currency transaction tracing device based on a classifier provided in an embodiment of the present invention may further include: a classifier training module 504;

[0115] The classifier training module 504 is used to count the number of transaction broadcast messages sent by the node and the number of transaction request messages received by the target node for each digital currency transaction involved in the digital currency transaction flow sent or received by the target node collected in advance from the digital currency network, and construct a feature vector of the digital currency transaction as a training sample based on the number of counted messages; after all the obtained training samples are formed into a sample set, at least two different unsupervised anomaly detection algorithms are used to perform anomaly detection on the sample set to detect anomaly sets respectively; the obtained anomaly sets are intersected, and the training samples in the intersection are marked as positive samples; the output probability of each training sample is calculated by an unsupervised learning algorithm, and the minimum value of the output probability of the positive sample is determined; for other training samples, if the output probability of the training sample is less than the minimum value, the training sample is marked as a negative sample; otherwise, it is marked as a positive sample; the classifier is trained using the training samples marked with positive and negative samples.

[0116] Preferably, the classifier training module 504 can also expand the training samples: expand the output probability of the training samples calculated by the unsupervised learning algorithm to the training samples to obtain expanded training samples; and when training the classifier, use the expanded training samples to train the classifier.

[0117] The implementation method of the functions of each module in the above-mentioned digital currency transaction tracing device based on the classifier can refer to the above-mentioned Figure 2 , 4The methods in each step of the process shown will not be repeated here.

[0118] The classifier-based digital currency transaction tracing technology of the present invention does not require the deployment of a large number of probe nodes, and has almost no capital cost, and consumes very little computer and network resources. The technology uses the difference in traffic and the number of network messages between transactions created by the node itself and forwarded transactions to construct a feature space, and enhances the representation of feature vectors through unsupervised representation learning. Using the tracing method of the present invention, even if only the traffic under the connection between the target node and half or less of its peer nodes is collected, the transaction created by the target node can be identified with an accuracy rate of more than 85% and a recall rate of 100%, such as Figure 6 As shown. The evaluation indicators of this method are defined as follows:

[0119]

[0120]

[0121]

[0122] Figure 7 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0123] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the classifier-based digital currency transaction tracing method provided in the embodiments of this specification.

[0124] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0125] The input / output interface 1030 is used to connect the input / output module, and can be connected to the nonlinear receiver to receive information from the nonlinear receiver to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0126] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0127] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0128] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0129] In the technical solution of the present invention, the digital currency transaction traffic sent or received by the target node is intercepted; for each digital currency transaction involved in the intercepted traffic, the number of transaction broadcast messages sent and transaction request messages received by the target node is counted, and a feature vector of the digital currency transaction is constructed according to the number of counted messages; for each digital currency transaction, based on the feature vector of the digital currency transaction and a pre-trained classifier, the source of the digital currency transaction is traced to see whether it is created by the target node; wherein the classifier is pre-trained using training samples based on supervised learning technology; wherein the training samples are constructed based on the digital currency transaction traffic sent or received collected in advance from the target node, and positive and negative samples are marked according to the detection results of at least two different unsupervised anomaly detection algorithms.

[0130] Since the feature vector constructed based on the number of broadcast and request messages can reflect the significant differences between created transactions and forwarded transactions, the use of the constructed feature vector and the classifier pre-trained based on supervised learning technology to identify created transactions and forwarded transactions can greatly improve the traceability accuracy of digital currency transactions compared to the existing traceability technology based on unsupervised learning.

[0131] The technical solution of the present invention is aimed at the target node, and can identify the transactions created by the target node itself from the transactions broadcast by the node, thereby realizing the de-anonymization of the transactions. Several unsupervised anomaly detection algorithms are used to identify suspicious transactions from the collected sample set to form an abnormal set, and positive samples are marked by finding the intersection of the abnormal set. Finally, the sample set is oversampled to construct a training set, so as to train a semi-supervised learning model, and the XGBoost algorithm is used to solve the binary classification problem of the transaction, and the transactions created by the target node itself are identified from the network layer traffic of the target node. Compared with the existing traceability technology based on unsupervised learning, it can greatly improve the traceability accuracy of digital currency transactions.

[0132] Furthermore, the technical solution of the present invention utilizes unsupervised representation learning to perform feature engineering, takes the output probability of the original feature space under the unsupervised algorithm as a new eigenvalue, and expands it into the final feature vector, so as to enhance the representation ability of the feature vector for the sample.

[0133] Furthermore, the technical solution of the present invention adopts an "unsupervised + supervised" technical architecture, which can further improve the traceability accuracy of digital currency transactions.

[0134] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0135] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Within the scope of the present invention, the above embodiments or technical features in different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0136] In addition, to simplify the description and discussion, and in order not to obscure the present invention, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the devices may be shown in the form of block diagrams to avoid obscuring the present invention, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the present invention will be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present invention, it will be apparent to those skilled in the art that the present invention may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0137] Although the invention has been described in conjunction with specific embodiments of the invention, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0138] The embodiments of the present invention are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A digital currency transaction tracing method based on a classifier, characterized in that: include: Intercepting digital currency transaction traffic sent or received between the target node and its peer nodes; For each digital currency transaction involved in the intercepted traffic, the number of transaction broadcast messages sent by the target node and the number of transaction request messages received are counted, and a feature vector of the digital currency transaction is constructed according to the number of counted messages; then, the feature vector is expanded: the output probability of the feature vector calculated by the unsupervised learning algorithm is expanded to the feature vector to obtain the expanded feature vector; For each digital currency transaction, based on the feature vector of the digital currency transaction and the pre-trained classifier, trace whether the digital currency transaction was created by the target node; The classifier is pre-trained using training samples based on supervised learning technology; the training samples are constructed according to the following method: For each digital currency transaction involved in the pre-collected digital currency transaction traffic sent or received by the target node, count the number of transaction broadcast messages sent and transaction request messages received by the node, and construct a feature vector of the digital currency transaction as a training sample based on the number of counted messages; After all the obtained training samples are formed into a sample set, at least two different unsupervised anomaly detection algorithms are used to perform anomaly detection on the sample set to obtain detected anomaly sets respectively; Take the intersection of the obtained anomaly sets and mark the training samples in the intersection as positive samples; The output probability of each training sample is calculated through an unsupervised learning algorithm, and the minimum value of the output probability of the positive sample is determined; For other training samples, if the output probability of the training sample is less than the minimum value, the training sample is marked as a negative sample; otherwise, it is marked as a positive sample.

2. The method according to claim 1, characterized in that The counting of the number of transaction broadcast messages sent and transaction request messages received by the target node, and constructing a feature vector of the digital currency transaction according to the number of counted messages, specifically includes: The constructed feature vector of the digital currency transaction includes: Inv_Num, Getdata_Num, Ratio, Sum; Among them, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for the digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

3. The method according to claim 2, characterized in that The feature vector based on the digital currency transaction and the pre-trained classifier are used to trace whether the digital currency transaction is created by the target node, specifically: Input the expanded feature vector of the digital currency transaction into the pre-trained classifier; According to the output of the classifier, it is traced whether the digital currency transaction was created by the target node.

4. The method according to claim 1, characterized in that Before the classifier is trained using positive and negative samples, the method further includes: Expand the training samples: After the output probability of the training sample calculated by the unsupervised learning algorithm is expanded to the feature vector of the training sample, the expanded training sample is obtained.

5. The method according to claim 4, characterized in that The classifier is pre-trained using training samples based on supervised learning technology, specifically: The classifier is pre-trained using the expanded training samples based on a supervised learning technique.

6. A digital currency transaction tracing device based on a classifier, characterized in that: include: Traffic acquisition module, used to intercept digital currency transaction traffic sent or received between the target node and its peer nodes; A feature vector construction module is used to count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for each digital currency transaction involved in the intercepted traffic, and to construct a feature vector of the digital currency transaction according to the number of counted messages; further, the output probability of the feature vector calculated by the unsupervised learning algorithm is expanded to the feature vector to obtain an expanded feature vector; A transaction tracing module is used to trace, for each digital currency transaction, whether the digital currency transaction is created by the target node based on the feature vector of the digital currency transaction and the pre-trained classifier; The classifier training module is used to pre-train a classifier based on a supervised learning technology using training samples: for the sent or received digital currency transaction traffic collected in advance from the target node, for each digital currency transaction involved, the number of transaction broadcast messages sent by the node and the number of transaction request messages received are counted, and a feature vector of the digital currency transaction is constructed as a training sample according to the number of counted messages; after all the obtained training samples are formed into a sample set, at least two different unsupervised anomaly detection algorithms are used to perform anomaly detection on the sample set, and anomaly sets are detected respectively; the obtained anomaly sets are intersected, and the training samples in the intersection are marked as positive samples; the output probability of each training sample is calculated by an unsupervised learning algorithm, and the minimum value among the output probabilities of the positive samples is determined; For other training samples, if the output probability of the training sample is less than the minimum value, the training sample is marked as a negative sample; otherwise, it is marked as a positive sample; The classifier is trained using training samples labeled with positive and negative samples.

7. An electronic device comprising a central processing unit, a signal processing and storage unit, and a computer program stored in the signal processing and storage unit and executable on the central processing unit, characterized in that: When the central processing unit executes the program, the method according to any one of claims 1 to 5 is implemented.

Images