A method and device for tracing digital currency transactions based on supervised learning technology

Abstract

The present invention discloses a method and apparatus for tracing digital currency transactions based on supervised learning technology. The method includes: intercepting the digital currency transaction traffic sent or received by a target node; for each digital currency transaction involved in the intercepted traffic, counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing a feature vector of the digital currency transaction based on the counted message numbers; based on the feature vector of the digital currency transaction and a pre-trained classifier, tracing whether the digital currency transaction was created by the target node; wherein, the classifier is pre-trained according to training samples constructed from the intercepted digital currency transaction traffic sent or received by a controlled node; wherein, the digital currency transaction traffic sent or received by the controlled node includes the traffic of several active transactions created by the controlled node. Applying the present invention can improve the accuracy of tracing digital currency transactions.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for tracing digital currency transactions based on supervised learning technology. Background Art

[0002] As the initial implementation of blockchain thinking, digital currency, led by digital currency, has developed rapidly, and the transaction scale has been continuously climbing. At the same time, the decentralized characteristics and anonymous nature of digital currency, as well as its convenience that allows users to instantly transfer funds anywhere in the world, provide opportunities for criminals to conduct illegal activities such as money laundering and black market transactions. Therefore, it is very necessary to study the tracing technology of illegal digital currency, especially digital currency transactions.

[0003] The existing digital currency transaction tracing technologies are mainly divided into two research directions: transaction layer tracing technology and network layer tracing technology. The transaction layer tracing technology refers to analyzing transaction records to discover certain relationships between anonymous transaction addresses, such as: "common input, change address", using heuristics to cluster anonymous addresses that may belong to the same entity, or observing transaction behaviors to achieve transaction clustering that conforms to specific patterns. This tracing technology can only achieve address clustering of the same entity and cannot obtain the real identity information of the entity.

[0004] The network layer tracing technology refers to collecting information on the network layer traffic of digital currency, analyzing the propagation path of transactions in the network, and establishing a mapping between transactions and the node IP that generates the transactions.

[0005] In an existing network layer tracing technology that uses unsupervised learning, a method based on routing attacks uses AS-level listeners to intercept packets sent by target nodes in an undetectable manner, and adopts an unsupervised learning algorithm - isolation forest to detect transactions created by target nodes. Experiments show that an AS-level attacker intercepting 50% of the connections of target nodes can de-anonymize transactions created by target nodes with a recall rate of 90% and a false positive rate of 0.003%.

[0006] In the existing digital currency tracing technologies, the transaction layer tracing technology only realizes the clustering of transaction addresses that may belong to the same entity, and cannot obtain the identity information of anonymous digital currency users, and the degree of de-anonymization is insufficient; while the tracing technology based on unsupervised learning mainly uses network traffic analysis and anomaly detection algorithms to identify transactions created by nodes, and there are also problems with low tracing accuracy. In addition, there may be various abnormal behaviors in the detection data. These abnormalities outside the target behavior are used as noise data, and the detection algorithm based on pure unsupervised learning cannot distinguish them from the target behavior. Summary of the Invention

[0007] In view of this, the object of the present invention is to provide a method and device for tracing digital currency transactions based on supervised learning technology, which uses a classifier trained based on supervised learning technology for tracing identification. Compared with the existing tracing technology based on unsupervised learning, the tracing accuracy of digital currency transactions can be improved.

[0008] Based on the above object, the present invention provides a method for tracing digital currency transactions based on supervised learning technology, including:

[0009] Intercept the digital currency transaction traffic sent or received between the target node and its peer nodes;

[0010] For each digital currency transaction involved in the intercepted traffic, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and construct a feature vector of this digital currency transaction according to the counted number of messages;

[0011] For each digital currency transaction, trace whether this digital currency transaction is created by the target node based on the feature vector of this digital currency transaction and a pre-trained classifier;

[0012] Wherein, the classifier is pre-trained based on supervised learning technology according to the training samples constructed from the digital currency transaction traffic sent or received by the intercepted controlled nodes; wherein, the digital currency transaction traffic sent or received by the controlled nodes includes the traffic of several active transactions created by the controlled nodes.

[0013] Wherein, the classifier is specifically pre-trained according to the following method:

[0014] Collect the digital currency transaction traffic sent or received by the controlled nodes, including the traffic of several active transactions created by the controlled nodes;

[0015] For each digital currency transaction involved in the collected traffic, count the number of transaction broadcast messages sent and received by the controlled node and the number of transaction request messages received, and construct the feature vector of this digital currency transaction as a training sample according to the counted number of messages;

[0016] Calculate the output probability of the feature vector of each digital currency transaction through an unsupervised learning algorithm;

[0017] Mark the feature vector of the active transaction created by the controlled node as a positive sample, and determine the minimum value among the output probabilities of the positive samples;

[0018] For the feature vector of each other digital currency transaction, if the output probability of this feature vector is less than the minimum value, mark this feature vector as a negative sample; otherwise, mark it as a positive sample;

[0019] Train the classifier using positive and negative samples.

[0020] Optionally, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and construct a feature vector for this digital currency transaction, specifically including:

[0021] The feature vector constructed for this digital currency transaction includes: Inv_Num, Getdata_Num, Ratio, Sum;

[0022] Among them, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for this digital currency transaction. Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

[0023] Further, after constructing the feature vector for this digital currency transaction, it further includes:

[0024] Expand the feature vector:

[0025] After expanding the output probability of the feature vector calculated by the unsupervised learning algorithm to the feature vector, an expanded feature vector is obtained.

[0026] Optionally, based on the feature vector of this digital currency transaction and a pre-trained classifier, trace whether this digital currency transaction was created by the target node, specifically:

[0027] Input the expanded feature vector of this digital currency transaction into the pre-trained classifier;

[0028] Based on the output of the classifier, trace whether this digital currency transaction was created by the target node.

[0029] Optionally, before training the classifier using positive and negative samples, it further includes:

[0030] Expand the training samples:

[0031] After expanding the output probability of the training samples calculated by the unsupervised learning algorithm to the training samples, expanded training samples are obtained.

[0032] Optionally, the training of the classifier using positive and negative samples is specifically:

[0033] Train the classifier using the expanded training samples.

[0034] The present invention also provides a digital currency transaction traceability device based on supervised learning technology, comprising:

[0035] A traffic acquisition module, configured to intercept the digital currency transaction traffic sent or received by a target node;

[0036] A feature vector construction module, configured to, for each digital currency transaction involved in the intercepted traffic, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received by the target node, and construct a feature vector of the digital currency transaction according to the counted number of messages;

[0037] A transaction traceability module, configured to, for each digital currency transaction, trace whether the digital currency transaction is created by the target node based on the feature vector of the digital currency transaction and a pre-trained classifier;

[0038] Wherein, the classifier is pre-trained based on supervised learning technology according to training samples constructed from the digital currency transaction traffic sent or received by intercepted controlled nodes; wherein, the digital currency transaction traffic sent or received by the controlled nodes includes the traffic of a number of active transactions created by the controlled nodes.

[0039] The present invention also provides an electronic device, comprising a central processing unit, a signal processing and storage unit, and a computer program stored on the signal processing and storage unit and executable on the central processing unit, wherein the central processing unit executes the digital currency transaction traceability method based on supervised learning technology as described above.

[0040] In the technical solution of the present invention, intercept the digital currency transaction traffic sent or received by a target node; for each digital currency transaction involved in the intercepted traffic, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received by the target node, and construct a feature vector of the digital currency transaction according to the counted number of messages; for each digital currency transaction, trace whether the digital currency transaction is created by the target node based on the feature vector of the digital currency transaction and a pre-trained classifier; wherein, the classifier is pre-trained based on supervised learning technology according to training samples constructed from the digital currency transaction traffic sent or received by intercepted controlled nodes; wherein, the digital currency transaction traffic sent or received by the controlled nodes includes the traffic of a number of active transactions created by the controlled nodes.

[0041] Since the feature vector constructed based on the number of broadcast and request messages can reflect the significant differences between the created transactions and the forwarded transactions, the constructed feature vector and the classifier pre-trained based on supervised learning techniques are used to identify the transactions created by the target node and the forwarded transactions. Compared with the existing unsupervised learning-based traceability techniques, the traceability accuracy of digital currency transactions can be greatly improved.

[0042] The technical solution of the present invention can identify the transactions created by the target node itself from the transactions broadcast by the target node for the target node, realizing the de-anonymization of transactions. By using a controlled node and a small number of active transaction tags, the node traffic is collected to construct a training set, and a semi-supervised learning model is trained to solve the binary classification problem of transactions using the XGBoost algorithm, and the transactions created by the target node itself are identified from the network layer traffic of the target node.

[0043] Furthermore, the technical solution of the present invention uses unsupervised representation learning for feature engineering, takes the output probability of the original feature space under the unsupervised algorithm as a new feature value, and expands it into the final feature vector to enhance the representation ability of the feature vector for samples.

[0044] Furthermore, the technical solution of the present invention adopts a "unsupervised + supervised" technical architecture, which can further improve the traceability accuracy of digital currency transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0046] Figure 1 It is a schematic diagram of the transaction broadcast and request process in the digital currency network of the prior art;

[0047] Figure 2 It is a flowchart of the digital currency transaction traceability method based on supervised learning technology provided by the embodiment of the present invention;

[0048] Figure 3 It is a schematic diagram of intercepting the digital currency transaction traffic provided by the embodiment of the present invention;

[0049] Figure 4 It is a flowchart of a classifier training method provided by the embodiment of the present invention;

[0050] Figure 5 It is a block diagram of the internal structure of a digital currency transaction traceability device based on supervised learning technology provided by the embodiment of the present invention;

[0051] Figure 6 Schematic diagram of experimental results of a digital currency transaction traceability method based on supervised learning technology provided by an embodiment of the present invention;

[0052] Figure 7 Schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. Detailed implementation manners

[0053] To make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to specific embodiments and the accompanying drawings.

[0054] It should be noted that unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should be of the ordinary meanings understood by those of ordinary skill in the art to which the present disclosure pertains. The "first", "second" and similar terms used in the present disclosure do not denote any order, quantity or importance, but are only used to distinguish different components. The terms such as "comprising" or "including" mean that the elements or objects appearing before the term cover the elements or objects listed after the term and their equivalents, without excluding other elements or objects. The terms such as "connected" or "coupled" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The terms such as "upper", "lower", "left" and "right" are only used to represent relative positional relationships, and when the absolute position of the object being described changes, the relative positional relationship may also change accordingly.

[0055] The inventors of the present invention considered that when a node conducts a digital currency transaction, that is, when sending the digital currency owned by the node to the digital currency address of the recipient, it is necessary to broadcast this transaction in the peer-to-peer network, and other nodes in the network will forward and verify this transaction, and finally this transaction is added to the blockchain "ledger".

[0056] As Figure 1 shown, when a node creates or receives a new transaction, it will include the hash value of this transaction in the transaction broadcast message (such as Inv message) and send it to the peer nodes in the network. The peer node that first receives this transaction will return a transaction request message (such as Getdata message) containing the hash value of this transaction to request the complete transaction information. Finally, the node will send a transaction response message (such as Tx message) to respond to the transaction request message from the peer node.

[0057] Through the analysis of the digital currency traffic, the inventors observed that: compared with forwarding transactions, the propagation pattern of transactions created by nodes themselves is more unique. Therefore, the technical solution of the present invention constructs a feature vector by using the significant difference in the number of broadcast and request messages between node-created transactions and forwarded transactions;

[0058] That is to say, compared with forwarding transactions, the performance of digital currency nodes creating transactions themselves is more abnormal when propagating in the network layer. This abnormality is mainly reflected in the number of transaction broadcast messages and request messages. Therefore, based on this abnormal performance, the technical solution of the present invention extracts eigenvalue from network traffic and constructs a feature vector and space.

[0059] Based on the above analysis, in the technical solution of the present invention, intercept the digital currency transaction traffic sent or received by the target node; for each digital currency transaction involved in the intercepted traffic, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and construct a feature vector for this digital currency transaction according to the counted number of messages; for each digital currency transaction, trace whether this digital currency transaction is created by the target node based on the feature vector of this digital currency transaction and a pre-trained classifier; wherein, the classifier is pre-trained based on supervised learning technology according to the training samples constructed from the digital currency transaction traffic sent or received by the intercepted controlled node; wherein, the digital currency transaction traffic sent or received by the controlled node includes the traffic of several active transactions created by the controlled node.

[0060] Since the feature vector constructed based on the number of transaction broadcast and request messages can reflect the significant difference between the transactions created by the node and the forwarded transactions, the identification between the created transactions and the forwarded transactions is carried out by using the constructed feature vector and a classifier pre-trained based on supervised learning technology. Compared with the existing traceability technology based on unsupervised learning, the traceability accuracy of digital currency transactions can be greatly improved.

[0061] Furthermore, the technical solution of the present invention can also calculate the output probability of the feature vector through an unsupervised learning algorithm and expand the feature vector, so as to enhance the representation of the feature vector through unsupervised representation learning; adopting the "unsupervised + supervised" technical architecture can further improve the traceability accuracy of digital currency transactions.

[0062] The technical solution of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0063] A method for tracing digital currency transactions based on supervised learning technology provided by an embodiment of the present invention has a process as Figure 2 shown and includes the following steps:

[0064] Step S201: Intercept the digital currency transaction traffic sent or received by the target node.

[0065] Specifically, as Figure 3 shown, attackers at the AS (Autonomous System) or IXP (Internet Exchange Point) level capture the digital currency transaction traffic. They act as the middlemen between the hosts of the custodian nodes in the digital currency network and can intercept the traffic between digital currency nodes in different ASs in the digital currency network without being detected; that is, the attacker collects the traffic when the target node is connected to some of its peer nodes.

[0066] That is to say, the digital currency transaction traffic at the network layer sent or received by the target node can be intercepted at the entrance or exit gateway of the autonomous domain where the target node is located.

[0067] Step S202: For each digital currency transaction involved in the intercepted traffic, construct a feature vector for this digital currency transaction.

[0068] In this step, for each digital currency transaction involved in the intercepted traffic, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and construct a feature vector for this digital currency transaction based on the counted number of messages.

[0069] Specifically, for the intercepted traffic, analyze the types of digital currency messages that appear in the traffic, mainly focusing on three types of messages: transaction broadcast messages, transaction request messages, and Tx messages; and parse the hash value of the transaction from these types of messages. Messages with the same hash value belong to the same digital currency transaction. After parsing the hash value of the transaction from the message, establish the correspondence between the hash value of the transaction and the message; based on the correspondence between the hash value of the transaction and the message, the number of transaction broadcast messages sent by the target node corresponding to the hash value of each transaction in the traffic can be counted, and the number of transaction request messages received by the target node corresponding to the hash value of each transaction can be counted, that is, for each digital currency transaction involved in the intercepted traffic, count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received.

[0070] For a digital currency transaction, the number of transaction broadcast messages Inv_Num sent by the node. Compared with the forwarded transactions, the node will broadcast the transactions created by itself to more peer nodes;

[0071] For a digital currency transaction, the number of transaction request messages Getdata_Num received by the node. The peer nodes will only send transaction request messages for transactions they have never received. Compared with the forwarded transactions, more peer nodes will request the transactions created by the node itself.

[0072] For a digital currency transaction, the ratio Ratio of the number Getdata_Num of transaction request messages received by a node to the number Inv_Num of transaction broadcast messages sent, that is, the ratio of the number of broadcasts to the number of requests for a transaction. Compared with forwarding transactions, the transactions created by the node itself should have a higher request-broadcast ratio, that is, request / broadcast.

[0073] For a digital currency transaction, the sum Sum of the number of transaction broadcast messages sent by a node and the number of transaction request messages received. Compared with the forwarded transactions, the transactions created by the node itself have a higher sum of message numbers.

[0074] Thus, in an exemplary embodiment, based on the number of transaction broadcast messages sent and transaction request messages received by a target node statistically obtained for a digital currency transaction, the feature vector constructed for this digital currency transaction may include: Inv_Num, Getdata_Num, Ratio, Sum;

[0075] Wherein, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received statistically obtained for this digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

[0076] That is, the constructed feature vector X = [Inv_Num, Getdata_Num, Ratio, Sum];

[0077] Constructed Where n represents the number of digital currency transactions involved in the traffic, d represents the number of feature values in the feature vector X, Represents a real matrix space of size n×d.

[0078] As a more optimal implementation manner, the feature vector can also be expanded: using unsupervised representation learning, the output probability Score(X) calculated by the feature vector X through an unsupervised learning algorithm (such as, Isolation Forest algorithm) is expanded into the feature vector to obtain an expanded feature vector X_NEW; that is to say, after expanding the output probability of the feature vector calculated by the unsupervised learning algorithm into the feature vector, an expanded feature vector is obtained.

[0079] That is, the expanded feature vector X_NEW = [X, Score(X)] = [Inv_Num, Getdata_Num, Ratio, Sum, Score(X)];

[0080]

[0081] Step S203: Based on the constructed feature vectors of digital currency transactions and the pre-trained classifier, trace the origin of digital currency transactions.

[0082] In this step, for each digital currency transaction, based on the feature vector of this digital currency transaction and the pre-trained classifier, trace whether this digital currency transaction is created by the target node, that is, identify whether this digital currency transaction is created by the target node, so as to achieve transaction tracing.

[0083] Specifically, for each digital currency transaction, the feature vector of this digital currency transaction can be input into the pre-trained classifier; according to the output of the classifier, trace whether this digital currency transaction is created by the target node or forwarded by the target node, that is, identify whether this digital currency transaction is created by the target node or forwarded by the target node.

[0084] As a more optimal implementation manner, the extended feature vector of this digital currency transaction can be input into the pre-trained classifier; according to the output of the classifier, trace whether this digital currency transaction is created by the target node or forwarded by the target node, that is, identify whether this digital currency transaction is created by the target node or forwarded by the target node.

[0085] Among them, the above classifier is pre-trained based on supervised learning technology according to the training samples constructed from the intercepted digital currency transaction traffic sent or received by the controlled node; among them, the digital currency transaction traffic sent or received by the controlled node includes the traffic of several active transactions created by the controlled node, and the specific training method process is as Figure 4 shown, including the following steps:

[0086] Step S401: Collect the digital currency transaction traffic sent or received by the controlled node;

[0087] Specifically, set a controlled node in the digital currency network, and several active transactions can be created through this controlled node.

[0088] In this step, a traffic capture device can be deployed at the entrance or exit gateway of the autonomous domain where the controlled node is located to collect the digital currency transaction traffic sent or received by the controlled node, which includes the traffic of several active transactions created by the controlled node.

[0089] Step S402: For each digital currency transaction involved in the collected traffic, construct the feature vector of this digital currency transaction as a training sample;

[0090] In this step, for each digital currency transaction involved in the collected traffic, count the number of transaction broadcast messages sent by the controlled node and the number of transaction request messages received, and construct a feature vector for this digital currency transaction based on the counted number of messages.

[0091] In an exemplary embodiment, based on the number of transaction broadcast messages sent by the controlled node and the number of transaction request messages received, which are counted for a digital currency transaction, the constructed feature vector for this digital currency transaction is similar to the feature vector constructed in step S202 above, and may include: Inv_Num, Getdata_Num, Ratio, Sum; where Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the controlled node and the number of transaction request messages received, which are counted for this digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

[0092] As a more optimal implementation, the constructed feature vector can also be expanded: using unsupervised representation learning, expand the output probability Score(X) calculated by the unsupervised learning algorithm (such as the Isolation Forest algorithm) of the feature vector X into the feature vector to obtain the expanded feature vector X_NEW; that is, after expanding the output probability of the feature vector calculated by the unsupervised learning algorithm into the feature vector, the expanded feature vector is obtained.

[0093] Step S403: Calculate the output probability of the feature vector of each digital currency transaction through an unsupervised learning algorithm;

[0094] In this step, for the feature vector of each digital currency transaction constructed in step S402, calculate the output probability of the feature vector through an unsupervised learning algorithm (such as the Isolation Forest algorithm).

[0095] Step S404: Mark the feature vector of the active transaction created by the controlled node as a positive sample, and determine the minimum value among the output probabilities of the positive samples.

[0096] Since it is an active transaction created by the controlled node, after identifying the hash values of these transactions, count the number of transaction broadcast messages sent by the controlled node for these transactions and the number of transaction request messages received, and after constructing the feature vector, mark these feature vectors used as training samples as positive samples, and determine the minimum value a among the output probabilities of the feature vectors used as positive samples.

[0097] Step S405: Compare the output probabilities of other feature vectors with the determined minimum value a; label the feature vectors as positive samples or negative samples according to the comparison results.

[0098] In this step, for the feature vectors of each digital currency transaction that are other training samples, if the output probability of the feature vector is less than the minimum value a, then label the feature vector as a negative sample; otherwise, label it as a positive sample.

[0099] Step S406: Use the positive and negative samples to train the classifier.

[0100] In this step, input the training samples into the classifier, and adjust the parameters of the classifier according to the output of the classifier and the positive or negative samples labeled for the training samples.

[0101] As a more optimal implementation, the feature vectors used as training samples can also be expanded: using unsupervised representation learning, calculate the output probability for the feature vectors through an unsupervised learning algorithm (such as the Isolation Forest algorithm), and expand the calculated output probability into the feature space of the feature vectors to obtain the expanded feature vectors; that is, expand the calculated output probability into the feature space of the training samples to obtain the expanded training samples.

[0102] When training the classifier based on the expanded training samples, input the training samples with the expanded feature space into the classifier, and adjust the parameters of the classifier according to the output of the classifier and the positive or negative samples labeled for the expanded training samples.

[0103] In this way, train a classifier for a semi-supervised learning model and use the XGBoost algorithm to solve the binary classification problem of transactions.

[0104] Based on the above digital currency transaction traceability method based on supervised learning technology, an embodiment of the present invention provides a digital currency transaction traceability device based on supervised learning technology, and its internal structure is as Figure 5 shown, including: a traffic acquisition module 501, a feature vector construction module 502, and a transaction traceability module 503;

[0105] Among them, the traffic acquisition module 501 is used to intercept the digital currency transaction traffic sent or received between the target node and its peer nodes;

[0106] The feature vector construction module 502 is used to count the number of transaction broadcast messages sent by the target node and the number of transaction request messages received for each digital currency transaction involved in the intercepted traffic, and construct the feature vector of this digital currency transaction according to the counted number of messages;

[0107] Preferably, the feature vector construction module 502 may further expand the feature vector: after expanding the output probability of the feature vector calculated by the unsupervised learning algorithm to the feature vector, an expanded feature vector is obtained.

[0108] The transaction traceability module 503 is used to trace whether each digital currency transaction is created by the target node based on the feature vector of the digital currency transaction and a pre-trained classifier, that is, to identify whether each digital currency transaction is created by the target node;

[0109] Preferably, for each digital currency transaction, the transaction traceability module 503 may input the expanded feature vector of the digital currency transaction into a pre-trained classifier, and trace whether the digital currency transaction is created by the target node according to the output of the classifier, that is, identify whether the digital currency transaction is created by the target node.

[0110] The classifier is pre-trained based on a supervised learning technique according to training samples constructed from the digital currency transaction traffic sent or received by the intercepted controlled node; the digital currency transaction traffic sent or received by the controlled node includes the traffic of a number of active transactions created by the controlled node.

[0111] Further, a digital currency transaction traceability device based on a supervised learning technique provided by an embodiment of the present invention may further include: a classifier training module 504;

[0112] The classifier training module 504 is used to collect the digital currency transaction traffic sent or received by the controlled node, including the traffic of a number of active transactions created by the controlled node; for each digital currency transaction involved in the collected traffic, count the number of transaction broadcast messages sent by the controlled node and the number of transaction request messages received, and construct the feature vector of the digital currency transaction as a training sample according to the counted number of messages; calculate the output probability of the feature vector of each digital currency transaction through an unsupervised learning algorithm; after marking the feature vector of the active transaction created by the controlled node as a positive sample, determine the minimum value of the output probabilities of the positive samples; for the feature vector of each other digital currency transaction, if the output probability of the feature vector is less than the minimum value, mark the feature vector as a negative sample; otherwise, mark it as a positive sample; use the positive and negative samples to train the classifier.

[0113] Preferably, the classifier training module 504 can also augment the training samples: after augmenting the output probabilities of the training samples calculated by the unsupervised learning algorithm into the feature space of the training samples, the augmented training samples are obtained; and when training the classifier, the augmented training samples are used to train the classifier.

[0114] For the implementation methods of the functions of each module in the above digital currency transaction traceability device based on supervised learning technology, reference can be made to the methods in each step of the process shown above Figure 2 、 4 and will not be elaborated here.

[0115] The digital currency transaction traceability technology based on supervised learning technology of the present invention does not require the deployment of probe nodes and the traceability cost is extremely low. Only one controlled node and a small number of active transactions are required, and the transaction amount can adopt the minimum transaction amount. This technology constructs a feature space by using the differences in traffic and the number of network messages between the node's own created transactions and forwarded transactions, and enhances the representation of feature vectors through unsupervised representation learning. Using the traceability method of the present invention, even if only the traffic under the connection (Connections) between the target node and half or less of its peer nodes is collected, the transactions created by the target node can be identified with a precision of more than 85% and a recall rate of 100%, as Figure 6 shown. Among them, the evaluation indexes of this method are defined as follows:

[0116]

[0117] Figure 7 FIG. shows a more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. Among them, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other inside the device through the bus 1050.

[0118] The processor 1010 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is used to execute relevant programs to implement the digital currency transaction traceability method provided in the embodiments of this specification.

[0119] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When implementing the technical solutions provided in the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1020 and called and executed by the processor 1010.

[0120] The input / output interface 1030 is used to connect to the input / output module, can be connected to a non-linear receiver, receive information from the non-linear receiver, and implement information input and output. The input / output module can be configured as a component in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Among them, the input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0121] The communication interface 1040 is used to connect to a communication module (not shown in the figure) to implement communication interaction between this device and other devices. Among them, the communication module can implement communication through a wired method (such as USB, network cable, etc.) or through a wireless method (such as a mobile network, WIFI, Bluetooth, etc.).

[0122] The bus 1050 includes a path for transmitting information between various components of the device (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0123] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, this device may also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device may also only include the components necessary for implementing the solutions of the embodiments of this specification, and do not necessarily include all the components shown in the figure.

[0124] In the technical solution of the present invention, the digital currency transaction traffic sent or received by the target node is intercepted; for each digital currency transaction involved in the intercepted traffic, the number of transaction broadcast messages sent by the target node and the number of transaction request messages received are counted, and a feature vector of this digital currency transaction is constructed according to the counted number of messages; for each digital currency transaction, based on the feature vector of this digital currency transaction and a pre-trained classifier, trace whether this digital currency transaction is created by the target node; wherein, the classifier is pre-trained based on supervised learning technology according to the training samples constructed from the digital currency transaction traffic sent or received by the intercepted controlled node; wherein, the digital currency transaction traffic sent or received by the controlled node includes the traffic of a number of active transactions created by the controlled node.

[0125] Since the feature vector constructed based on the number of broadcast and request messages can reflect the significant differences between the created transactions and the forwarded transactions, the use of the constructed feature vector and the classifier pre-trained based on supervised learning technology to identify between the created transactions and the forwarded transactions can greatly improve the accuracy of digital currency transaction traceability compared with the existing traceability technology based on unsupervised learning.

[0126] The technical solution of the present invention can identify the transactions created by the target node itself from the transactions broadcast by the target node, realizing the de-anonymization of transactions. By using a controlled node and a small number of active transaction tags, node traffic is collected to construct a training set, and a semi-supervised learning model is trained to solve the binary classification problem of transactions using the XGBoost algorithm, and the transactions created by the target node itself are identified from the network layer traffic of the target node.

[0127] Furthermore, the technical solution of the present invention uses unsupervised representation learning for feature engineering, takes the output probability of the original feature space under the unsupervised algorithm as a new feature value, and expands it into the final feature vector to enhance the representation ability of the feature vector for samples.

[0128] Furthermore, the technical solution of the present invention adopts a "unsupervised + supervised" technical architecture, which can further improve the accuracy of digital currency transaction traceability.

[0129] The computer-readable media of this embodiment include both permanent and non-permanent, removable and non-removable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0130] Those of ordinary skill in the art should understand that: The discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples; Under the concept of the present invention, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations in different aspects of the present invention as described above, which are not provided in detail for the sake of brevity.

[0131] In addition, for simplicity of description and discussion, and so as not to make the present invention difficult to understand, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Further, the devices may be shown in block diagram form in order to avoid making the present invention difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the present invention is to be implemented (i.e., these details should be entirely within the understanding of those skilled in the art). In cases where specific details (such as circuits) are set forth to describe exemplary embodiments of the present invention, it will be apparent to those skilled in the art that the present invention can be practiced without these specific details or with variations of these specific details. Accordingly, these descriptions should be considered illustrative rather than restrictive.

[0132] Although the present invention has been described in connection with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those of ordinary skill in the art based on the foregoing description. For example, other memory architectures (such as dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0133] Embodiments of the present invention are intended to cover all such alternatives, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for tracing the source of digital currency transactions based on supervised learning technology, characterized in that, Including: Intercepting the digital currency transaction traffic sent or received between the target node and its peer nodes; For each digital currency transaction involved in the intercepted traffic, counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing a feature vector for this digital currency transaction based on the counted number of messages; For each digital currency transaction, based on the feature vector of this digital currency transaction and a pre-trained classifier, tracing whether this digital currency transaction was created by the target node; Wherein, the classifier is pre-trained based on supervised learning technology according to the training samples constructed from the intercepted digital currency transaction traffic sent or received by the controlled node: Collecting the digital currency transaction traffic sent or received by the controlled node, including the traffic of several active transactions created by the controlled node; For each digital currency transaction involved in the collected traffic, counting the number of transaction broadcast messages sent by the controlled node and the number of transaction request messages received, and constructing the feature vector of this digital currency transaction as a training sample according to the counted number of messages; Calculating the output probability of the feature vector of each digital currency transaction through an unsupervised learning algorithm; Marking the feature vector of the active transaction created by the controlled node as a positive sample, and determining the minimum value among the output probabilities of the positive samples; For the feature vector of each other digital currency transaction, if the output probability of this feature vector is less than the minimum value, marking this feature vector as a negative sample; otherwise, marking it as a positive sample; Using the positive and negative samples to train the classifier.

2. The method according to claim 1, characterized in that, The specific steps of counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing the feature vector of this digital currency transaction based on the counted number of messages include: The constructed feature vector of this digital currency transaction includes: Inv_Num, Getdata_Num, Ratio, Sum; Wherein, Inv_Num and Getdata_Num respectively represent the number of transaction broadcast messages sent by the target node and the number of transaction request messages received counted for this digital currency transaction, Ratio represents the ratio of Inv_Num to Getdata_Num, and Sum represents the sum of Inv_Num and Getdata_Num.

3. The method according to claim 2, wherein After constructing the feature vector of this digital currency transaction, it further includes: Expanding the feature vector: After expanding the output probability of the feature vector calculated through the unsupervised learning algorithm to the feature vector, an expanded feature vector is obtained.

4. The method according to claim 3, wherein The specific method of tracing whether this digital currency transaction was created by the target node based on the feature vector of this digital currency transaction and a pre-trained classifier is: Inputting the expanded feature vector of this digital currency transaction into the pre-trained classifier; Based on the output of the classifier, tracing whether this digital currency transaction was created by the target node.

5. The method according to claim 2, characterized in that Before using the positive and negative samples to train the classifier, it further includes: Expanding the training samples: After expanding the output probability of the training sample calculated by the unsupervised learning algorithm to the training sample, an expanded training sample is obtained.

6. The method according to claim 5, characterized in that, The training of the classifier using positive and negative samples is specifically as follows: The classifier is trained using the expanded training sample.

7. A digital currency transaction traceability device based on supervised learning technology, characterized in that, It includes: A traffic acquisition module for intercepting the digital currency transaction traffic sent or received by the target node; A feature vector construction module for, for each digital currency transaction involved in the intercepted traffic, counting the number of transaction broadcast messages sent by the target node and the number of transaction request messages received, and constructing a feature vector for this digital currency transaction based on the counted number of messages; A transaction tracing module for, for each digital currency transaction, tracing whether this digital currency transaction is created by the target node based on the feature vector of this digital currency transaction and a classifier pre-trained; A classifier training module for collecting the digital currency transaction traffic sent or received by the controlled node, including the traffic of several active transactions created by the controlled node; For each digital currency transaction involved in the collected traffic, counting the number of transaction broadcast messages sent by the controlled node and the number of transaction request messages received, and constructing a feature vector for this digital currency transaction as a training sample; calculating the output probability of the feature vector of each digital currency transaction through an unsupervised learning algorithm; after marking the feature vector of the active transaction created by the controlled node as a positive sample, determining the minimum value among the output probabilities of the positive samples; for the feature vector of each other digital currency transaction, if the output probability of this feature vector is less than the minimum value, marking this feature vector as a negative sample; otherwise, marking it as a positive sample; training the classifier using positive and negative samples.

8. An electronic device, comprising a central processing unit, a signal processing and storage unit, and a computer program stored on the signal processing and storage unit and executable on the central processing unit, characterized in that, When the central processing unit executes the program, it implements the method according to any one of claims 1-6.

Images