Ethereum phishing fraud account detection device and method based on multi-feature learning

Abstract

The present invention provides an Ethereum phishing fraud account detection device and method based on multi-feature learning, and relates to the security field of Ethereum transaction network. The device includes a data acquisition module, an Ethereum phishing fraud network construction module, an Ethereum phishing fraud network initialization module, a feature extraction module, an account category balancing module and a classification module. The method includes collecting Ethereum phishing fraud related data; constructing an Ethereum phishing fraud network G and determining the adjacency matrix A of the network; initializing the node features and edge features of the network to obtain an initial node feature matrix F and an initial edge feature matrix X; extracting the relevant features of each node according to A, F and X, and assigning an attention coefficient to each feature; after balancing the account categories in the network, using a graph neural network to update the node features of the nodes, and training a classifier based on a cross entropy loss function to distinguish between phishing fraud accounts and normal accounts. The device and method have high accuracy and security and save resources.

Description

Technical Field

[0001] The present invention relates to the security field of Ethereum transaction network in blockchain, and more specifically, to an Ethereum phishing fraud account detection device and method based on multi-feature learning. Background Art

[0002] Blockchain has the characteristics of decentralization, anonymity, and traceability. It solves the problem of over-reliance on trusted third parties in electronic payments, realizes the decentralization of electronic payments, and creates a new world of cryptocurrency. However, due to the decentralized nature of blockchain and the lack of a third-party regulated trading environment, criminals have shifted their Internet fraud positions to the cryptocurrency trading market. Unlike ordinary crimes on the Internet, crimes in cryptocurrency are more difficult to track and review. Once a user's transfer to a criminal is confirmed by the blockchain, it is almost impossible to recover the cryptocurrency lost by the user.

[0003] In recent years, along with the development of blockchain, phishing scams have begun to grow rapidly in the blockchain ecosystem and become a common fraud method on the blockchain. Phishing scam criminals generally disguise themselves as a trustworthy entity to defraud users of sensitive information or cryptocurrency, which seriously threatens the financial security of the blockchain. Among the numerous blockchain financial scams, more than 50% can be classified as phishing scams that target cryptocurrency.

[0004] Ethereum is currently the largest public blockchain platform that supports smart contracts. It processes peer-to-peer transactions by providing a decentralized virtual machine. According to statistics, the cumulative number of Ethereum users has exceeded 35.87 million, with an average daily active user base of 200,000 and a daily transaction volume of 640,000. Therefore, Ethereum has become a hotbed for phishing scams. This requires the proposal of a device and method for detecting phishing scam accounts in the Ethereum transaction network, which should be embedded in the user's encrypted wallet (a tool for managing accounts and transactions in the blockchain ecosystem) to ensure that users are reminded of potential risks when trading with unfamiliar accounts, and to provide users with a financial risk warning function.

[0005] The Chinese patent "Ethereum phishing fraud account detection method and device based on deep neural network" with document number CN113344562B first constructs an Ethereum phishing fraud second-order sub-network through a web crawler and Ethereum nodes; analyzes and extracts the account transaction sequence characteristics, account status characteristics and account transaction network characteristics of Ethereum phishing fraud, and constructs the Ethereum phishing fraud account data set ETHScam; then constructs a deep learning model MFL based on FCN-LSTM network and BP neural network, and extracts features according to the input Ethereum phishing fraud account data set ETHScam: the account transaction sequence characteristics are input into the network where FCN and LSTM are juxtaposed to extract the numerical feature vector and time series feature vector of the transaction, and the account status characteristics and account transaction network characteristics are input into the BP neural network to learn and obtain the statistical feature vector; the extracted statistical feature vector, numerical feature vector and time series feature vector are spliced, and then input into the classifier constructed by the fully connected neural network for classification, and the classification result of whether the account is a phishing account is obtained. However, the technical solution protected by this patent ignores the imbalance problem of phishing fraud accounts and normal account categories in the Ethereum phishing fraud network (statistics show that the ratio of phishing fraud accounts to normal accounts exceeds 1:26000), which will cause the classifier to show a "preference" for normal accounts and reduce the ability to distinguish phishing fraud accounts, resulting in the inability to accurately identify phishing fraud accounts; at the same time, this method only considers numerical information and time series information in the feature extraction process, ignoring the graph structure information of the Ethereum phishing fraud network as a dynamic directed graph, and the obtained node features are not comprehensive, thereby reducing the accuracy of the classifier's classification results.

[0006] The Chinese patent application with document number CN113283909A "A Method for Detecting Ethereum Phishing Accounts Based on Deep Learning" combines transaction time and weight features to model the Ethereum transaction network as a time-series weighted directed graph, effectively capturing the properties of a more comprehensive dynamic transaction network; then the Skip-Gram model is used to obtain the graph embedding feature vector of each account node in the time-series weighted directed graph. Compared with traditional manual features, the graph embedding feature vector obtained by this model can adaptively capture the implicit characteristics between each account; finally, the above-obtained graph embedding feature vector is input into a classifier that combines the k-means clustering algorithm in unsupervised learning and the support vector machine algorithm in supervised learning to obtain the classification result of whether the account is a phishing fraud account. However, the technical solution protected by this patent application only improves the robustness of classification results in the case of a small amount of labeled data by constructing a classifier by combining the k-means clustering algorithm in unsupervised learning and the support vector machine algorithm in supervised learning, but does not fundamentally solve the impact of the account category imbalance problem on the account classification results; at the same time, this method uses the traditional Skip-Gram model to obtain the graph feature vector of each account node in the time-series weighted directed graph, which only retains part of the graph characteristics and ignores important graph structure information. The obtained node features are not comprehensive, which reduces the accuracy of the classification results of the classifier. Summary of the invention

[0007] In view of the shortcomings of the above-mentioned prior art, the present invention provides an Ethereum phishing fraud account detection device and method based on multi-feature learning, aiming to overcome the defect of the prior art that the effective information in the Ethereum phishing fraud network is not fully utilized, resulting in inaccurate classification, and to eliminate the impact of the imbalance of account categories in the Ethereum phishing fraud network on the account classification results.

[0008] The technical solution of the present invention is:

[0009] The first aspect of the present invention provides an Ethereum phishing fraud account detection device based on multi-feature learning, the device comprising:

[0010] A data collection module is used to collect the address data of the marked phishing fraud account, the historical transaction record data of the phishing fraud account, and the historical transaction record data of the first-order neighbors of the phishing fraud account; each of the transaction record data includes: sender, receiver, transaction amount and transaction time;

[0011] The Ethereum phishing fraud network construction module is used to construct an Ethereum phishing fraud network based on the phishing fraud account address data and historical transaction record data collected by the data collection module, using the account addresses participating in the transaction as nodes and the transactions between accounts as edges, and determine the adjacency matrix of the network; the nodes include phishing nodes and normal nodes, wherein the phishing nodes correspond to the addresses of the phishing fraud accounts, and the normal nodes correspond to the addresses of the normal accounts;

[0012] An Ethereum phishing fraud network initialization module is used to initialize the node features and edge features in the Ethereum phishing fraud network according to the historical transaction record data collected by the data collection module and the adjacency matrix of the Ethereum phishing fraud network, and obtain an initial node feature matrix and an initial edge feature matrix;

[0013] A feature extraction module is used to extract the graph features of nodes, the sequence features of nodes and the time series features of nodes from the Ethereum phishing fraud network, obtain the graph feature matrix of nodes, the sequence feature matrix of nodes and the time series feature matrix of nodes, combine the graph feature matrix, the sequence feature matrix and the time series feature matrix, and send the obtained combined feature matrix to the account category balancing module;

[0014] An account category balancing module, used for balancing the account categories in the Ethereum phishing fraud network according to the combined feature matrix received from the feature extraction module, and sending the category-balanced node feature matrix and the category-balanced adjacency matrix to the classification module;

[0015] The classification module is used to classify nodes according to the category-balanced node feature matrix and the category-balanced adjacency matrix output from the account category balancing module, so as to identify phishing fraud accounts and normal accounts.

[0016] Furthermore, according to the Ethereum phishing fraud account detection device based on multi-feature learning, the graph feature of the node refers to the node feature after aggregating neighbor node information through a graph neural network in the Ethereum phishing fraud network; the sequence feature of the node refers to capturing the sequence relationship between nodes through a random walk algorithm in the Ethereum phishing fraud network, extracting the node sequence corresponding to each node, and extracting the node features based on the node sequence through the Skip-Gram model; the time series feature refers to the node feature extracted by capturing the temporal distribution law and evolution law of all transactions of each node in the Ethereum phishing fraud network through an LSTM neural network.

[0017] Furthermore, according to the Ethereum phishing fraud account detection device based on multi-feature learning, the feature extraction module further includes:

[0018] A graph feature extraction module, used to input the adjacency matrix output by the Ethereum phishing fraud network construction module and the initial node feature matrix output by the Ethereum phishing fraud network initialization module into the graph neural network to extract the graph features of each node, obtain the graph feature matrix, and send the graph feature matrix to the attention embedding module;

[0019] A sequence feature extraction module is used to first obtain a node sequence corresponding to each node from the Ethereum phishing scam network using a biased random walk algorithm based on transaction time according to the adjacency matrix output by the Ethereum phishing scam network construction module, and then use the Skip-Gram model to extract the sequence features of the nodes according to the obtained node sequence, obtain a sequence feature matrix, and send the sequence feature matrix to the attention embedding module;

[0020] A time series feature extraction module is used to first extract the transaction time series of each node according to the initial edge feature matrix output by the Ethereum phishing fraud network initialization module, and then use a recurrent neural network RNN ​​to extract the time series features of each node to obtain a time series feature matrix, and send the time series feature matrix to an attention embedding module;

[0021] The attention embedding module is used to receive the graph feature matrix sent by the graph feature extraction module, the sequence feature matrix sent by the sequence feature extraction module, and the time series feature matrix sent by the time series feature extraction module, and assign different attention coefficients to the graph feature matrix, the sequence feature matrix and the time series feature matrix to obtain a combined feature matrix, and send the combined feature matrix to the account category balancing module.

[0022] Further, according to the Ethereum phishing fraud account detection device based on multi-feature learning, the account category balancing module further includes:

[0023] A node synthesis module is used to oversample the phishing nodes in the Ethereum phishing fraud network and synthesize new phishing nodes using an oversampling method according to the combined feature matrix output by the attention embedding module until the account categories are balanced, thereby obtaining a node feature matrix after category balance; and the node feature matrix after category balance is sent to the edge generation module and the classification module at the same time;

[0024] The edge generation module is used to predict whether there are edge connections between the newly synthesized fishing node and other nodes based on the category-balanced node feature matrix output by the node synthesis module, so as to obtain the category-balanced adjacency matrix, and send the category-balanced adjacency matrix to the classification module.

[0025] The second aspect of the present invention provides an Ethereum phishing fraud account detection method based on multi-feature learning, the method comprising the following steps:

[0026] Step 1: Collect data related to Ethereum phishing scams, including address data of the marked phishing scam accounts, historical transaction record data of the phishing scam accounts, and historical transaction record data of the first-order neighbors of the phishing scam accounts;

[0027] Step 2: Based on the collected phishing fraud account address data and historical transaction record data, the Ethereum phishing fraud network G is constructed with the account addresses involved in the transaction as nodes and the transactions between accounts as edges, and the adjacency matrix A of the network is determined;

[0028] Step 3: Initialize the node features and edge features in the Ethereum phishing fraud network according to the collected historical transaction record data and the adjacency matrix A of the Ethereum phishing fraud network to obtain an initial node feature matrix F and an initial edge feature matrix X;

[0029] Step 4: According to the adjacency matrix A of the Ethereum phishing scam network G and the initial node feature matrix F, extract the graph features of each node and construct the graph feature matrix F graph ; Extract the sequence features of each node based on the adjacency matrix A of the Ethereum phishing fraud network G and construct the sequence feature matrix F sequence ; According to the initial edge feature matrix X of the Ethereum phishing fraud network G, extract the time series features of each node and construct the time series feature matrix F time ;

[0030] Step 5: Use the attention mechanism to generate the graph feature matrix F graph , sequence feature matrix F sequence And the time series feature matrix F time Assign different attention coefficients to obtain the combined feature matrix Z;

[0031] Step 6: According to the combined feature matrix Z and the adjacency matrix A, the account categories in the Ethereum phishing fraud network are balanced to obtain the node feature matrix Z after category balance. new And the adjacency matrix A after category balance new ;

[0032] Step 7: Node feature matrix Z after category balance new And the adjacency matrix A after category balance new , use the graph neural network to update the node features of the node and obtain the updated node feature matrix Z n ' ew ; According to the updated node feature matrix Z n ' ew A classifier is trained based on the cross entropy loss function to classify the accounts corresponding to the nodes in the Ethereum phishing fraud network after category balance, and distinguish between phishing fraud accounts and normal accounts.

[0033] Further, according to the Ethereum phishing fraud account detection method based on multi-feature learning, the method of constructing the Ethereum phishing fraud network G and determining the adjacency matrix A of the network is:

[0034] First, each fishing node is used as the central node, and the account address of the other party who has traded with the current central node is extracted as the first-order node according to the transaction record of the central node. Then, the first-order node is used as the central node, and the account address of the other party who has traded with the current central node is extracted as the second-order node according to the transaction record. The Ethereum phishing fraud network G={V,E,Y} is constructed; where V={v1,v2,...,v n} represents the node set of the Ethereum phishing fraud network, n is the total number of nodes; E = {e1, e2, ..., e m} represents the edge set of the Ethereum phishing fraud network, m is the total number of edges; Y = {y1, y2, ..., y n} represents the category label set of the accounts corresponding to each node in the Ethereum phishing fraud network, and the account categories include phishing fraud accounts and normal accounts;

[0035] Assume (v i ,v j ) represents the slave node v i To node v j , traverse the node set V, and determine the network adjacency matrix A∈R of the Ethereum phishing scam network G according to formula (1): n×n ;

[0036]

[0037] Furthermore, according to the Ethereum phishing fraud account detection method based on multi-feature learning, the method for initializing the node features and edge features in the Ethereum phishing fraud network is: define node-related numerical attributes and edge-related numerical attributes, and traverse the corresponding node set V, edge set E and corresponding historical transaction record data according to the defined node-related numerical attributes and edge-related numerical attributes, respectively, to obtain the initial node feature matrix F and initial edge feature matrix X of the Ethereum phishing fraud network G.

[0038] Further, according to the Ethereum phishing fraud account detection method based on multi-feature learning, the node-related numerical attributes include:

[0039] In-degree, which is the number of incoming edges of any node, is defined as the number of transactions sent to any node;

[0040] Out-degree, the number of outgoing edges of any node, is defined as the number of transactions sent by any node to other nodes;

[0041] Degree, which is the total number of edges connected to any node, is defined as the total number of transactions that occurred at any node;

[0042] The number of neighbors, defined as the number of nodes connected to any node;

[0043] The inverse of the transaction frequency, defined as the time interval between the first and last transaction of any node divided by the degree of the node;

[0044] The edge-related numerical attributes include:

[0045] Transaction time, defined as the time when the transaction was initiated;

[0046] Transaction direction is defined as: in a transaction, if the current node is the sender, the transaction direction is recorded as 1; if the current node is the receiver, the transaction direction is recorded as -1.

[0047] Further, according to the Ethereum phishing fraud account detection method based on multi-feature learning, step 4 further includes the following steps:

[0048] Step 4.1: Input the adjacency matrix A and the initial node feature matrix F of the Ethereum phishing scam network into the graph neural network, transfer and fuse the initial node features of the target node v∈V with its neighbor nodes, and obtain the graph features of the target node v that store the node numerical information and graph structure information. In this way, traverse the node set V of the Ethereum phishing scam network to obtain the graph feature matrix F graph

[0049] Step 4.2: According to the adjacency matrix A of the Ethereum phishing fraud network, the sequence relationship between nodes is captured by the biased random walk algorithm based on transaction time, the node sequence corresponding to each node is extracted, and the Ethereum phishing fraud network is converted into a set of node sequences; according to the obtained node sequence, the Skip-Gram model is used to obtain the sequence feature matrix of the node;

[0050] Step 4.3: Based on the initial edge feature matrix X and historical transaction records of the Ethereum phishing fraud network, the sliding window method is used to sample and obtain the transaction sequence of each node, and then the time series feature matrix F is obtained through the LSTM neural network. time .

[0051] Furthermore, according to the Ethereum phishing fraud account detection method based on multi-feature learning, the core idea of ​​the biased random walk algorithm based on transaction time is: let node v∈V be the source node, map the transaction time corresponding to each edge of node v to a discrete time step, and improve the node transfer probability during walking based on the latest transaction time of the two transaction parties. The improved node transfer probability is the ratio of the transaction time of the most recent transaction between the current node and one of its neighbor nodes to the sum of the most recent transaction times of the current node and all its neighbor nodes. The neighbor node that has the latest transaction with the current node is more likely to be selected as the next node of the walk.

[0052] Compared with the prior art, the technical solution proposed by the present invention has the following beneficial effects:

[0053] (1) High accuracy: The device and method of the present invention improve the accuracy of Ethereum phishing fraud account detection by making full use of the node features extracted from the Ethereum phishing fraud network information. At the same time, by oversampling the phishing nodes, the impact of the imbalance of account categories in Ethereum phishing fraud account detection on the account classification results is eliminated.

[0054] (2) High security: The device and method of the present invention can accurately distinguish phishing fraud accounts in the Ethereum transaction network, and can also prevent abnormal behavior of phishing fraud accounts. Therefore, the device and method of the present invention are embedded in the user's encrypted wallet to ensure that the user is reminded of potential risks when trading with unfamiliar accounts, providing users with a financial risk warning function and improving the security of the Ethereum transaction network.

[0055] (3) Saving resources: The device and method of the present invention use graph neural networks such as GraphSAGE, random walk algorithm and LSTM neural network to map the node features and edge features of the Ethereum transaction network into a lower-dimensional feature space, which can save a lot of computing power consumed in deep learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a schematic diagram of the structure of an Ethereum phishing fraud account detection device based on multi-feature learning in this embodiment;

[0057] Figure 2 This is a flow chart of the Ethereum phishing fraud account detection method based on multi-feature learning in this embodiment;

[0058] Figure 3 Schematic diagram of the process of constructing the Ethereum phishing fraud network in this embodiment, wherein (a) is a schematic diagram of the process of constructing the first-order node by the fishing node in this embodiment; (b) is a schematic diagram of the process of constructing the Ethereum phishing fraud network by the first-order node in this embodiment;

[0059] Figure 4 This is an example diagram of the biased random walk algorithm based on transaction time in this implementation mode;

[0060] Figure 5 Schematic diagram of a method for oversampling minority class nodes to synthesize new minority class nodes in this embodiment. DETAILED DESCRIPTION

[0061] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0062] The purpose of the present invention is to provide an Ethereum phishing fraud account detection device and method based on multi-feature learning, making full use of Ethereum phishing fraud network information, obtaining the graph features, sequence features and time series features of nodes respectively through graph neural networks such as GraphSAGE, random walk algorithm and LSTM neural network, and using the attention mechanism to assign different attention coefficients to the three features to obtain combined features; then using oversampling methods such as SMOTE (Synthetic Minority Oversampling Techniques, synthetic minority class oversampling technology) algorithm in the feature space of the account node to synthesize new minority class nodes, i.e., fishing nodes corresponding to phishing fraud accounts, and using edge generators to predict the relationship between the newly synthesized minority class nodes and the original nodes, i.e., whether there are edges, thereby generating a class-balanced Ethereum phishing fraud network, solving the problem of account category imbalance in the Ethereum phishing fraud network. The device and method of the present invention can overcome the defect that the prior art cannot make full use of the effective information in the Ethereum phishing fraud network, resulting in inaccurate classification, and can also eliminate the impact of the class imbalance problem on the account classification results in the Ethereum phishing fraud account detection.

[0063] Figure 1 Schematic diagram of the structure of the Ethereum phishing fraud account detection device based on multi-feature learning in this embodiment. Figure 1 As shown, the Ethereum phishing fraud account detection device based on multi-feature learning includes:

[0064] The data collection module is used to collect Ethereum phishing fraud related data, including the address data of the marked phishing fraud account, the historical transaction record data of the phishing fraud account, and the historical transaction record data of the first-order neighbors of the phishing fraud account; each of the transaction record data includes: sender, receiver, transaction amount and transaction time; in this embodiment, specifically, firstly obtain the address data of the marked phishing fraud account through an Ethereum blockchain browser such as Etherscan, and then obtain all historical transaction records from Ethereum; then extract the historical transaction record data of the phishing fraud account and the historical transaction record data of the first-order neighbors of the phishing fraud account from all historical transaction records;

[0065] An Ethereum phishing fraud network construction module is used to construct an Ethereum phishing fraud network based on the phishing fraud account address data and historical transaction record data collected by the data collection module, using the account addresses involved in the transaction as nodes and the transactions between accounts as edges, and determine the adjacency matrix of the network;

[0066] An Ethereum phishing fraud network initialization module is used to initialize the node features and edge features in the Ethereum phishing fraud network according to the historical transaction record data collected by the data collection module and the adjacency matrix of the Ethereum phishing fraud network, and obtain an initial node feature matrix and an initial edge feature matrix;

[0067] A feature extraction module is used to extract the graph features of nodes, the sequence features of nodes and the time series features of nodes from the Ethereum phishing fraud network, obtain the graph feature matrix of nodes, the sequence feature matrix of nodes and the time series feature matrix of nodes, and combine the graph feature matrix, the sequence feature matrix and the time series feature matrix, and send the obtained combined feature matrix to the account category balance module; the graph features of the nodes refer to the node features after aggregating neighbor node information through the graph neural network in the Ethereum phishing fraud network; the sequence features of the nodes refer to the node features extracted by the Skip-Gram model according to the node sequence by capturing the sequence relationship between nodes through the random walk algorithm in the Ethereum phishing fraud network, extracting the node sequence corresponding to each node; the time series features refer to the node features extracted by capturing the temporal distribution and evolution laws of all transactions of each node in the Ethereum phishing fraud network through the LSTM neural network;

[0068] An account category balancing module, used for balancing the account categories in the Ethereum phishing fraud network according to the combined feature matrix received from the feature extraction module, and sending the category-balanced node feature matrix and the category-balanced adjacency matrix to the classification module;

[0069] The classification module is used to classify nodes according to the category-balanced node feature matrix and the category-balanced adjacency matrix output from the account category balancing module, so as to identify phishing fraud accounts and normal accounts.

[0070] The feature extraction module further comprises:

[0071] A graph feature extraction module, used for inputting the adjacency matrix output by the Ethereum phishing scam network construction module and the initial node feature matrix output by the Ethereum phishing scam network initialization module into a graph neural network such as a GraphSAGE neural network to extract the graph features of each node, obtain a graph feature matrix, and send the graph feature matrix to the attention embedding module;

[0072] A sequence feature extraction module is used to first obtain a node sequence corresponding to each node from the Ethereum phishing scam network using a biased random walk algorithm based on transaction time according to the adjacency matrix output by the Ethereum phishing scam network construction module, and then extract node features using the Skip-Gram model according to the obtained node sequence to obtain a sequence feature matrix, and send the sequence feature matrix to the attention embedding module;

[0073] A time series feature extraction module is used to first extract the transaction time series of each node according to the initial edge feature matrix output by the Ethereum phishing scam network initialization module, and then use a recurrent neural network RNN ​​such as LSTM (Long Short-Term Memory) neural network to extract the time series features of each node, obtain a time series feature matrix, and send the time series feature matrix to the attention embedding module;

[0074] The attention embedding module is used to receive the graph feature matrix sent by the graph feature extraction module, the sequence feature matrix sent by the sequence feature extraction module, and the time series feature matrix sent by the time series feature extraction module, and assign different attention coefficients to the graph feature matrix, the sequence feature matrix and the time series feature matrix to obtain a combined feature matrix, and send the combined feature matrix to the account category balancing module.

[0075] The account category balancing module further includes:

[0076] A node synthesis module is used to oversample the minority class nodes, i.e., fishing nodes, according to the combined feature matrix output by the attention embedding module using an oversampling method such as the SMOTE algorithm to synthesize new minority class nodes until the account categories are balanced, thereby obtaining a node feature matrix after category balance; the node feature matrix after category balance is sent to the edge generation module and the classification module at the same time;

[0077] The edge generation module is used to predict whether there are edge connections between the newly synthesized minority class nodes and other nodes based on the category-balanced node feature matrix output by the node synthesis module, so as to obtain the category-balanced adjacency matrix and send the category-balanced adjacency matrix to the classification module.

[0078] Figure 2 Schematic diagram of the process of detecting Ethereum phishing fraud accounts based on multi-feature learning in this embodiment. Figure 2 As shown, the Ethereum phishing fraud account detection method based on multi-feature learning includes the following steps:

[0079] Step 1: Collect data related to Ethereum phishing scams, including address data of the marked phishing scam accounts, historical transaction record data of the phishing scam accounts, and historical transaction record data of the first-order neighbors of the phishing scam accounts;

[0080] In this embodiment, firstly, according to the API (Application Programming Interface) provided by the Ethereum blockchain browser Etherscan, the hexadecimal address data of the marked phishing fraud account is crawled through the web crawler technology, for example

[0081] 0x71C7656EC7ab88b098defB751B7401B5f6d8976F. Then run an Ethereum full node on the local server, and obtain all historical transaction records by synchronizing with the Ethereum network; then extract the historical transaction record data of the phishing fraud account and the historical transaction record data of the first-order neighbors of the phishing fraud account from all historical transaction records; each of the transaction record data includes: sender, receiver, transaction amount and transaction time; in this embodiment, the transaction record is represented in the form of a four-tuple, for example, a transaction is (Src, Dst, t, w), which means the sender Src At time t, w amount of cryptocurrency is transferred to the recipient Dst.

[0082] A further preferred implementation is that after obtaining all historical transaction records from the Ethereum network, all historical transaction records obtained can be filtered according to heuristic filtering rules, and then the historical transaction record data of the phishing fraud account and the historical transaction record data of the first-order neighbors of the phishing fraud account can be extracted from the filtered historical transaction records.

[0083] The heuristic filtering rules include:

[0084] 1) Filter transaction records where the sender or receiver is a smart contract;

[0085] 2) Among the addresses with less than a certain number, such as 10, or more than a certain number, such as 1,000, of transaction records, only a very small number, such as 1, is marked as a phishing fraud account address, so the transaction records with less than the said number, such as 10, or more than the said number, such as 1,000, are filtered;

[0086] 3) Since there have been no phishing fraud account addresses before a certain date, such as 2016--08-02, the transaction records generated before this date are filtered.

[0087] Step 2: Based on the collected phishing fraud account address data and historical transaction record data, the Ethereum phishing fraud network G is constructed with the account addresses involved in the transaction as nodes and the transactions between accounts as edges, and the adjacency matrix A of the network is determined;

[0088] In this embodiment, the nodes include two types: fishing nodes and normal nodes. Fishing nodes correspond to the addresses of phishing fraud accounts, and normal nodes correspond to the addresses of normal accounts. First, each fishing node is used as a central node, such as Figure 3 As shown in (a), the account address of the other party who has traded with the current central node is extracted as the first-order node according to the transaction record of the central node, and then the first-order node is used as the central node, and the account address of the other party who has traded with the current central node is extracted as the second-order node according to the transaction record to construct the Ethereum phishing fraud network G = {V, E, Y} of this embodiment. Figure 3 (b); where V = {v1, v2, ..., v n} represents the node set of the Ethereum phishing fraud network, n is the total number of nodes; E = {e1, e2, ..., e m} represents the edge set of the Ethereum phishing fraud network, m is the total number of edges, Y = {y1,y2,…,y n} represents the category label set of the accounts corresponding to each node in the Ethereum phishing fraud network, and the account categories include phishing fraud accounts and normal accounts. i ,v j ) represents the slave node v i To node v j , traverse the node set V, and obtain the network adjacency matrix A∈R of the Ethereum phishing fraud network G according to formula (1): n×n .

[0089]

[0090] Step 3: Initialize the node features and edge features in the Ethereum phishing fraud network according to the collected historical transaction record data and the adjacency matrix A of the Ethereum phishing fraud network to obtain an initial node feature matrix F and an initial edge feature matrix X;

[0091] In this embodiment, the node features in the Ethereum phishing scam network are initialized by defining 5 node-related numerical attributes to obtain an initial node feature matrix F; and the edge features in the Ethereum phishing scam network are initialized by defining 3 edge-related numerical attributes to obtain an initial edge feature matrix X.

[0092] The five node-related numerical attributes are:

[0093] ① In-degree, i.e. the number of incoming edges of any node. In this implementation, it refers to the number of transactions sent to any node;

[0094] ② Out-degree, i.e. the number of outgoing edges of any node. In this implementation, it refers to the number of transactions sent by any node to other nodes;

[0095] ③ Degree, which is the total number of edges connected to any node. In this implementation, it refers to the total number of transactions occurring at any node.

[0096] ④ The number of neighbors, which in this embodiment refers to the number of nodes connected to any node;

[0097] ⑤ The reciprocal of the transaction frequency, which is defined in this embodiment as the time interval between the first transaction and the last transaction of any node divided by the degree of the node.

[0098] According to the five node-related numerical attributes defined above, we traverse the node set V and historical transaction record data to obtain the initial node feature matrix F∈R of the Ethereum phishing fraud network G. n×d , d is the node feature dimension.

[0099] The three edge-related numerical attributes are:

[0100] Transaction time: the time when the transaction is initiated. The transaction time can be used to obtain the temporal distribution pattern of all transactions in which the account participates. Phishing accounts often involve a small number of low-frequency transactions in the development period, a large number of high-frequency transactions in the outbreak period, and a small number of transactions in the ending period.

[0101] Transaction direction: In a transaction, if the current node is the sender, the transaction direction is recorded as 1; if the current node is the receiver, the transaction direction is recorded as -1.

[0102] According to the three edge-related numerical attributes defined above, we traverse the edge set E and historical transaction record data to obtain the initial edge feature matrix X∈R of the Ethereum phishing fraud network G. m×l , l is the edge feature dimension.

[0103] Step 4: According to the adjacency matrix A of the Ethereum phishing scam network G and the initial node feature matrix F, extract the graph features of each node and construct the graph feature matrix Fgraph ; Extract the sequence features of each node based on the adjacency matrix A of the Ethereum phishing fraud network G and construct the sequence feature matrix F sequence ; According to the initial edge feature matrix X of the Ethereum phishing fraud network G, extract the time series features of each node and construct the time series feature matrix F time .

[0104] Step 4.1: Based on the adjacency matrix A and the initial node feature matrix F of the Ethereum phishing scam network G, extract the graph features of each node and construct the graph feature matrix F graph .

[0105] In this embodiment, the adjacency matrix A and the initial node feature matrix F of the Ethereum phishing fraud network are input into a graph neural network, such as a single-layer GraphSAGE neural network, and the initial node features of the neighboring nodes are transferred and fused for the target node v∈V according to formula (2), and the graph features of the target node v that store the node numerical information and graph structure information are obtained. Then, according to formula (2), the node set V of the Ethereum phishing fraud network is traversed to obtain the graph feature matrix F graph .

[0106]

[0107] Where F represents the initial node feature matrix of the Ethereum phishing scam network; F[v,:] represents the initial node feature of node v; A[:,v] represents the column corresponding to node v in the adjacency matrix; represents the graph features of node v; W 1 represents the weight parameter; σ represents the activation function, such as ReLU.

[0108] Step 4.2: According to the adjacency matrix A of the Ethereum phishing scam network, the sequence relationship between nodes is captured by the biased random walk algorithm based on transaction time, the node sequence corresponding to each node is extracted, and the Ethereum phishing scam network is converted into a set of node sequences; according to the obtained node sequence, the Skip-Gram model is used to obtain the sequence feature matrix of the node.

[0109] The core idea of ​​the biased random walk algorithm based on transaction time is as follows: let node v∈V be the source node, map the transaction time corresponding to each edge of node v to a discrete time step, and improve the node transfer probability during the walk based on the latest transaction time of the two transaction parties. The improved node transfer probability is shown in formula (3), which is the ratio of the transaction time of the most recent transaction between the current node and one of its neighbor nodes to the sum of the most recent transaction times between the current node and all its neighbor nodes. The neighbor node that has the most recent transaction with the current node has a greater probability of being selected as the next node of the walk. Figure 4This is an example diagram of the biased random walk algorithm based on transaction time. According to the core idea of ​​the biased random walk algorithm based on transaction time, the probability of transferring from node v to node u1 is 1 / 6, the probability of transferring from node v to node u2 is 1 / 3, and the probability of transferring from node v to node u3 is 1 / 2. Since the ratio of the most recent transaction time between node v and node u3 to the sum of the most recent transaction times of node v and all its neighboring nodes is the largest, node u3 is most likely to be selected as the next node of the walk.

[0110]

[0111] In the above formula, P T(v,u) represents the probability of transferring from node v to node u, u' is the first-order neighbor of node v, V v is the set of first-order neighbor nodes of node v, and T(v,u) is the time step of the most recent transaction between nodes v and u.

[0112] As shown in formula (4), according to the improved node transfer probability, the neighbor node of the source node v is selected as the next node for node sampling, and this process is repeated until a node sequence W of a fixed length is obtained. v Repeat the above process to transform the Ethereum phishing scam network G into a set of node sequences W v .

[0113]

[0114] Among them, c i Represents the current node; c i+1 represents the next node to be sampled; P T(v,u) is the node transfer probability from node v to node u; E is the edge set of the Ethereum phishing fraud network.

[0115] The method of obtaining the sequence feature matrix of a node using the Skip-Gram model is as follows: using the Skip-gram model to optimize the mapping function shown in formula (5) by the stochastic gradient descent method, so that under the condition of node mapping Φ(v), the neighborhood W of node v v The logarithm of the probability of other nodes appearing together in the node is maximized as shown in formula (6), which fully captures the sequence relationship between nodes and then obtains the node sequence feature matrix F sequence .

[0116]

[0117] max∑logP r (W v |Φ(v)) (6)

[0118] Step 4.3: Based on the initial edge feature matrix X and historical transaction records of the Ethereum phishing fraud network, the sliding window method is used to sample and obtain the transaction sequence of each node, and then the time series feature matrix F is obtained through the LSTM neural network. time .

[0119] Specifically, first, according to the initial edge feature matrix X of the Ethereum phishing fraud network, the node set V and historical transaction records are traversed to obtain all transaction records in which each node v∈V participates; then, for the transaction records of each node, the sliding window method is used for sampling to extract the transaction sequence of the preset length, wherein, for the transaction sequence less than the preset length, 0 is filled at the end of the transaction sequence to make it reach the preset length; for the transaction sequence exceeding the preset length, the sliding window method is used for multiple sampling to reach the preset length; each time step contains 3 eigenvalues, namely transaction time, transaction amount and transaction direction; finally, the extracted transaction sequence of each node is input into the LSTM neural network to learn the distribution law and evolution law of each node's transaction in time, and obtain the time series feature matrix F time .

[0120] Step 5: Use the attention mechanism to generate the graph feature matrix F graph , sequence feature matrix F sequence And the time series feature matrix F time Assign different attention coefficients to obtain the combined feature matrix Z.

[0121] Z=γ G ·F graph +γ S ·F sequence +γ T ·F time (7)

[0122] Among them, γ G is the graph feature matrix F graph The attention coefficient of S is the sequence feature matrix F sequence The attention coefficient of T is the time series feature matrix F time The attention coefficient of ; Z represents the combined feature matrix.

[0123] Step 6: According to the combined feature matrix Z and the adjacency matrix A, the account categories in the Ethereum phishing fraud network are balanced to obtain the node feature matrix Z after category balance. new And the adjacency matrix A after category balance new .

[0124] Step 6.1: According to the combined feature matrix Z, use the oversampling method in the feature space to oversample the fishing nodes and synthesize new fishing nodes until the account categories are balanced, and obtain the node feature matrix Z after category balance new .

[0125] In the feature space, an oversampling method such as the SMOTE algorithm is used to oversample the minority class nodes, i.e., the fishing nodes, to synthesize new minority class nodes. Specifically, a minority class node v is randomly selected in the feature space, such as Figure 5 As shown, according to formula (8), find the nearest neighbor node nn(v) of the same type with the same account category label as the minority node v and the closest Euclidean distance, randomly select a point on the line connecting the minority node v and the nearest neighbor node nn(v) of the same type, and synthesize a new minority node v', as shown in formula (9).

[0126]

[0127] Among them, z nn ( v ) is the combined feature of the nearest neighbor node nn(v), z u is the combined feature of node v with similar nodes u in the feature space, z v is the combined feature of minority class node v, Y u and Y v are the account category labels of node u and node v respectively.

[0128] z v′ =(1-δ)·z v +δ·z nn(v) (9)

[0129] Among them, δ represents a random variable, which is uniformly distributed in the range [0,1], and z v′ is the combined feature of the new minority class node v'.

[0130] Step 6.2: Use the combined feature matrix Z and the adjacency matrix A to train an edge generator based on the node feature matrix Z after category balance new The edge generator is used to predict whether there is an edge connection between the newly synthesized fishing node and other nodes, and the adjacency matrix A after category balance is obtained. new , thus obtaining a class-balanced Ethereum phishing fraud network.

[0131] In this embodiment, the edge generator shown in formula (10) is trained according to formula (11) using the combined feature matrix Z and the adjacency matrix A:

[0132] H v,u =softmax(σ(Z v ·S·Zu )) (10)

[0133] Among them, H v,u represents the probability of the existence of an edge between node v and node u, and S is a parameter matrix used to capture the interaction between nodes.

[0134] The specific formula of the loss function for training the edge generator is as follows:

[0135]

[0136] Among them, L edge is the probability matrix of the existence of edges between each pair of nodes in the Ethereum phishing fraud network, that is, H v,u A collection of .

[0137] After training the edge generator, the node feature matrix Z after category balance is new , use formula (12) to predict whether there is an edge connection between the newly synthesized minority class node and other nodes, so as to obtain the adjacency matrix A after category balance new .

[0138]

[0139] in, represents the probability that there is an edge between any two nodes v and u in the node set after the account category is balanced; Represents the node features of node v after category balancing; Represents the node features of node u after category balancing;

[0140] Step 7: Node feature matrix Z after category balance new And the adjacency matrix A after category balance new , use the graph neural network to update the node features of the node and obtain the updated node feature matrix Z n ' ew ; According to the updated node feature matrix Z n ' ew A classifier is trained based on the cross entropy loss function to classify the accounts corresponding to the nodes in the Ethereum phishing fraud network after category balance, and distinguish between phishing fraud accounts and normal accounts.

[0141] First, according to formula (13), a graph neural network such as GraphSAGE is used to update the node features of the node:

[0142]

[0143] Among them, Z new [v,:] represents the node feature of any node v in the node set after the account category is balanced; A new[:,v] represents the adjacency matrix A after category balance new The column corresponding to the middle node v; represents the node feature of the updated node v; W 2 represents the weight parameter; σ represents the activation function, such as ReLU.

[0144] Then, according to formula (14), the updated node feature matrix Z' is used new Calculate the probability distribution of the account category label corresponding to each node and obtain the probability distribution matrix P:

[0145] P = softmax(σ(W·Z′ new +B)) (14)

[0146] Where P is the probability distribution matrix of the account category label corresponding to the node; W is the trainable weight parameter; Z' new is the updated node feature matrix; B is the bias matrix.

[0147] Finally, the cross entropy loss function shown in formula (15) is used to train the classifier shown in formula (14) through continuous iteration, and finally the trained classifier is used to classify the nodes with unknown account category labels.

[0148]

[0149] Where v represents any node in the node set after the account category is balanced; c is one of the account category labels corresponding to the node; P v [c] represents the probability that the account category label corresponding to node v is c.

[0150] An embodiment of the present invention is described in detail above. Obviously, the above embodiment is only a part of the embodiments of the present invention, not all of the embodiments; the above embodiment is only used to explain the present invention and does not constitute a limitation on the protection scope of the present invention. Based on the above embodiment, all other embodiments obtained by those skilled in the art without making creative work, that is, all modifications, equivalent substitutions and improvements made within the spirit and principles of this application, fall within the protection scope required by the present invention.

Claims

1. An Ethereum phishing fraud account detection device based on multi-feature learning, characterized in that: The device includes: A data collection module is used to collect the address data of the marked phishing fraud account, the historical transaction record data of the phishing fraud account, and the historical transaction record data of the first-order neighbors of the phishing fraud account; each of the transaction record data includes: sender, receiver, transaction amount and transaction time; The Ethereum phishing fraud network construction module is used to construct an Ethereum phishing fraud network based on the phishing fraud account address data and historical transaction record data collected by the data collection module, using the account addresses participating in the transaction as nodes and the transactions between accounts as edges, and determine the adjacency matrix of the network; the nodes include phishing nodes and normal nodes, wherein the phishing nodes correspond to the addresses of the phishing fraud accounts, and the normal nodes correspond to the addresses of the normal accounts; An Ethereum phishing fraud network initialization module is used to initialize the node features and edge features in the Ethereum phishing fraud network according to the historical transaction record data collected by the data collection module and the adjacency matrix of the Ethereum phishing fraud network, and obtain an initial node feature matrix and an initial edge feature matrix; A feature extraction module is used to extract the graph features of nodes, the sequence features of nodes and the time series features of nodes from the Ethereum phishing fraud network, obtain the graph feature matrix of nodes, the sequence feature matrix of nodes and the time series feature matrix of nodes, combine the graph feature matrix, the sequence feature matrix and the time series feature matrix, and send the obtained combined feature matrix to the account category balancing module; An account category balancing module, used for balancing the account categories in the Ethereum phishing fraud network according to the combined feature matrix received from the feature extraction module, and sending the category-balanced node feature matrix and the category-balanced adjacency matrix to the classification module; A classification module, for classifying nodes according to the category-balanced node feature matrix and the category-balanced adjacency matrix output from the account category balancing module, so as to identify phishing fraud accounts and normal accounts; the graph feature of the node refers to the node feature after aggregating neighbor node information through the graph neural network in the Ethereum phishing fraud network; the sequence feature of the node refers to the node feature extracted by the Skip-Gram model based on the node sequence by capturing the sequence relationship between nodes through the random walk algorithm in the Ethereum phishing fraud network, extracting the node sequence corresponding to each node; the time series feature refers to the node feature extracted by capturing the distribution law and evolution law of all transactions of each node in time through the LSTM neural network in the Ethereum phishing fraud network; The feature extraction module further comprises: A graph feature extraction module, used to input the adjacency matrix output by the Ethereum phishing fraud network construction module and the initial node feature matrix output by the Ethereum phishing fraud network initialization module into the graph neural network to extract the graph features of each node, obtain the graph feature matrix, and send the graph feature matrix to the attention embedding module; A sequence feature extraction module is used to first obtain a node sequence corresponding to each node from the Ethereum phishing scam network using a biased random walk algorithm based on transaction time according to the adjacency matrix output by the Ethereum phishing scam network construction module, and then use the Skip-Gram model to extract the sequence features of the nodes according to the obtained node sequence, obtain a sequence feature matrix, and send the sequence feature matrix to the attention embedding module; A time series feature extraction module is used to first extract the transaction time series of each node according to the initial edge feature matrix output by the Ethereum phishing fraud network initialization module, and then use a recurrent neural network RNN ​​to extract the time series features of each node to obtain a time series feature matrix, and send the time series feature matrix to an attention embedding module; an attention embedding module, configured to receive the graph feature matrix sent by the graph feature extraction module, the sequence feature matrix sent by the sequence feature extraction module, and the time series feature matrix sent by the time series feature extraction module, and to assign different attention coefficients to the graph feature matrix, the sequence feature matrix, and the time series feature matrix to obtain a combined feature matrix, and to send the combined feature matrix to the account category balancing module; The method of constructing the Ethereum phishing fraud network G and determining the adjacency matrix A of the network is: First, each fishing node is used as the central node, and the account address of the other party who has traded with the current central node is extracted as the first-order node according to the transaction record of the central node. Then, the first-order node is used as the central node, and the account address of the other party who has traded with the current central node is extracted as the second-order node according to the transaction record. The Ethereum phishing fraud network G={V,E,Y} is constructed; where V={v1,v2,...,v n } represents the node set of the Ethereum phishing fraud network, n is the total number of nodes; E = {e1, e2, ..., e m } represents the edge set of the Ethereum phishing fraud network, m is the total number of edges; Y = {y1, y2, ..., y n } represents the category label set of the accounts corresponding to each node in the Ethereum phishing fraud network, and the account categories include phishing fraud accounts and normal accounts; Assume (v i ,v j ) represents the slave node v i To node v j , traverse the node set V, and determine the network adjacency matrix A∈R of the Ethereum phishing scam network G according to formula (1): n×n ; 2. The Ethereum phishing fraud account detection device based on multi-feature learning according to claim 1 is characterized in that: The account category balancing module further includes: A node synthesis module is used to oversample the phishing nodes in the Ethereum phishing fraud network and synthesize new phishing nodes using an oversampling method according to the combined feature matrix output by the attention embedding module until the account categories are balanced, thereby obtaining a node feature matrix after category balance; and the node feature matrix after category balance is sent to the edge generation module and the classification module at the same time; The edge generation module is used to predict whether there are edge connections between the newly synthesized fishing node and other nodes based on the category-balanced node feature matrix output by the node synthesis module, so as to obtain the category-balanced adjacency matrix, and send the category-balanced adjacency matrix to the classification module.

3. The Ethereum phishing fraud account detection method based on multi-feature learning is characterized by: The method comprises the following steps: Step 1: Collect data related to Ethereum phishing scams, including address data of the marked phishing scam accounts, historical transaction record data of the phishing scam accounts, and historical transaction record data of the first-order neighbors of the phishing scam accounts; Step 2: Based on the collected phishing fraud account address data and historical transaction record data, the Ethereum phishing fraud network G is constructed with the account addresses involved in the transaction as nodes and the transactions between accounts as edges, and the adjacency matrix A of the network is determined; Step 3: Initialize the node features and edge features in the Ethereum phishing fraud network according to the collected historical transaction record data and the adjacency matrix A of the Ethereum phishing fraud network to obtain an initial node feature matrix F and an initial edge feature matrix X; Step 4: According to the adjacency matrix A of the Ethereum phishing scam network G and the initial node feature matrix F, extract the graph features of each node and construct the graph feature matrix F graph ; According to the adjacency matrix A of the Ethereum phishing fraud network G, extract the sequence features of each node and construct the sequence feature matrix F sequence ; According to the initial edge feature matrix X of the Ethereum phishing fraud network G, extract the time series features of each node and construct the time series feature matrix F time ; Step 5: Use the attention mechanism to generate the graph feature matrix F graph , sequence feature matrix F sequence And the time series feature matrix F time Assign different attention coefficients to obtain the combined feature matrix Z; Step 6: According to the combined feature matrix Z and the adjacency matrix A, the account categories in the Ethereum phishing fraud network are balanced to obtain the node feature matrix Z after category balance. new And the adjacency matrix A after category balance new ; Step 7: Node feature matrix Z after category balance new And the adjacency matrix A after category balance new , use the graph neural network to update the node features of the node and obtain the updated node feature matrix Z n ' ew ; According to the updated node feature matrix Z n ' ew A classifier is trained based on the cross entropy loss function to classify the accounts corresponding to the nodes in the Ethereum phishing fraud network after category balance, and distinguish between phishing fraud accounts and normal accounts; the method of constructing the Ethereum phishing fraud network G and determining the adjacency matrix A of the network is: First, each fishing node is used as the central node, and the account address of the other party who has traded with the current central node is extracted as the first-order node according to the transaction record of the central node. Then, the first-order node is used as the central node, and the account address of the other party who has traded with the current central node is extracted as the second-order node according to the transaction record to construct the Ethereum phishing fraud network G = {V, E, Y}; Where V = {v1,v2,...,v n } represents the node set of the Ethereum phishing fraud network, n is the total number of nodes; E = {e1, e2, ..., e m } represents the edge set of the Ethereum phishing fraud network, m is the total number of edges; Y = {y1, y2, ..., y n } represents the category label set of the accounts corresponding to each node in the Ethereum phishing fraud network, and the account categories include phishing fraud accounts and normal accounts; Assume (v i ,v j ) represents the slave node v i To node v j , traverse the node set V, and determine the network adjacency matrix A∈R of the Ethereum phishing scam network G according to formula (1): n×n ; The step 4 further comprises the following steps: Step 4.1: Input the adjacency matrix A and the initial node feature matrix F of the Ethereum phishing scam network into the graph neural network, transfer and fuse the initial node features of the target node v∈V with its neighbor nodes, and obtain the graph features of the target node v that store the node numerical information and graph structure information. In this way, traverse the node set V of the Ethereum phishing scam network to obtain the graph feature matrix F graph Step 4.2: According to the adjacency matrix A of the Ethereum phishing fraud network, the sequence relationship between nodes is captured by the biased random walk algorithm based on transaction time, the node sequence corresponding to each node is extracted, and the Ethereum phishing fraud network is converted into a set of node sequences; according to the obtained node sequence, the Skip-Gram model is used to obtain the sequence feature matrix of the node; Step 4.3: Based on the initial edge feature matrix X and historical transaction records of the Ethereum phishing fraud network, the sliding window method is used to sample and obtain the transaction sequence of each node, and then the time series feature matrix F is obtained through the LSTM neural network. time .

4. The Ethereum phishing fraud account detection method based on multi-feature learning according to claim 3 is characterized in that: The method for initializing the node features and edge features in the Ethereum phishing fraud network is: define node-related numerical attributes and edge-related numerical attributes, traverse the corresponding node set V, edge set E and corresponding historical transaction record data according to the defined node-related numerical attributes and edge-related numerical attributes, and obtain the initial node feature matrix F and initial edge feature matrix X of the Ethereum phishing fraud network G.

5. The Ethereum phishing fraud account detection method based on multi-feature learning according to claim 4 is characterized in that: The node-related numerical attributes include: In-degree, which is the number of incoming edges of any node, is defined as the number of transactions sent to any node; Out-degree, the number of outgoing edges of any node, is defined as the number of transactions sent by any node to other nodes; Degree, which is the total number of edges connected to any node, is defined as the total number of transactions that occurred at any node; The number of neighbors, defined as the number of nodes connected to any node; The inverse of the transaction frequency, defined as the time interval between the first and last transaction of any node divided by the degree of the node; The edge-related numerical attributes include: Transaction time, defined as the time when the transaction was initiated; Transaction direction is defined as: in a transaction, if the current node is the sender, the transaction direction is recorded as 1; if the current node is the receiver, the transaction direction is recorded as -1.

6. The Ethereum phishing fraud account detection method based on multi-feature learning according to claim 5 is characterized in that: The core idea of ​​the biased random walk algorithm based on transaction time is: let node v∈V be the source node, map the transaction time corresponding to each edge of node v to a discrete time step, and improve the node transfer probability during the walk based on the latest transaction time of the two transaction parties. The improved node transfer probability is the ratio of the transaction time of the most recent transaction between the current node and one of its neighbor nodes to the sum of the most recent transaction times of the current node and all its neighbor nodes. The neighbor node with the latest transaction with the current node is selected as the next node of the walk.

Images