Node number feature extraction method based on timing local bitcoin transaction graph

Abstract

The application discloses a node quantity feature extraction method based on a timing local bitcoin transaction graph, and the method comprises the following steps: acquiring original blockchain transaction ledger data, and parsing the original blockchain transaction ledger data into a complete transaction graph; extracting a local transaction graph of each address in the complete transaction graph within a corresponding research period; extracting a node quantity feature and a node quantity relationship feature in the local transaction graph of each address in each research period; processing the node quantity feature and the node quantity relationship feature without labels and with labels to obtain corresponding timing feature vectors; calculating the similarity of the timing feature vectors corresponding to the addresses without labels and the addresses with labels to obtain corresponding scores, and assigning corresponding types to the addresses without labels according to the scores. The application first uses dynamic timing quantity features in address type judgment, and provides a new solution for solving the problem that a large number of addresses in a transaction graph are unlabeled.

Description

Technical Field

[0001] This invention relates to the field of Bitcoin, and more particularly to a method for extracting node quantity features based on a temporal local Bitcoin transaction graph. Background Technology

[0002] Bitcoin is a decentralized cryptocurrency. Its cryptographic design ensures the security of currency circulation; transaction records are stored within blocks and are publicly accessible on the blockchain. Due to the decentralized and anonymous nature of cryptocurrencies, relevant authorities cannot directly regulate them, and much analysis is post-event analysis and tracking, making pre-event intervention impossible. Because of the inherent anonymity of cryptocurrencies, many criminals choose to use Bitcoin and other cryptocurrencies to hide their identities and obtain illegal profits. They may even use coin mixing services to obfuscate the flow of cryptocurrency funds before transactions or before exchanging cryptocurrency for any fiat currency, making it even more difficult to track cryptocurrency fund flows. Today, with the increasing popularity of cryptocurrencies, many online gambling websites support cryptocurrency gambling. Analyzing and identifying abnormal transaction behaviors and address types in cryptocurrency transactions through the timing information, quantity characteristics, and other transaction behaviors of addresses is an important research topic.

[0003] Methods for analyzing abnormal transaction behavior typically include graph analysis, Bitcoin fund flow visualization analysis, transaction pattern analysis, and complex network analysis. The common process for analyzing and identifying anomalous address nodes is as follows: 1) Obtain complete blockchain transaction ledger data from the client or full node, and parse the raw ledger data into a Bitcoin transaction graph; 2) Obtain tagged address data; 3) Analyze the transaction behavior of the corresponding addresses based on the complete transaction graph and corresponding partial transaction graph data to obtain their transaction characteristics; 4) Identify the type of address node based on the extracted transaction characteristics. The current difficulty lies in steps 2 and 3. Due to the anonymity of cryptocurrencies, collecting a large amount of tagged account information is difficult, as these addresses may belong to any of the tags such as exchanges, gambling, or coin mixing services. Characterizing and judging abnormal transaction behavior from transaction graph data is also difficult because specific indicators are needed to distinguish between abnormal and normal transactions.

[0004] Current research has proposed feature extraction methods for analyzing blockchain transaction behavior. However, these methods all have limitations, including requirements for device performance, analysis time consumption, and methodological limitations. Whether analyzing user-based or address-based transaction graphs, only the transaction behavior characteristics of a single user or address can be obtained. These characteristics cannot reflect the commonalities and differences in changes among addresses of the same type. Because these studies only analyze transactions directly participated in by tagged accounts and the accounts involved in those transactions, or analyze their fund flows, without considering the "time period segmentation" condition, the collected data and analysis results are incomplete. This is because the data cannot reflect the temporal characteristics of the transactions conducted by accounts, the number of various nodes, their quantitative relationships, and dynamic changes. Furthermore, a large number of addresses in current transaction graphs are untagged, i.e., anonymous. Determining the type of an address based on its transaction behavior and related characteristics is equally important.

[0005] Current methods for extracting features from transaction networks, whether analyzing user-based or address-based transaction graphs, can only reveal the transaction behavior characteristics of individual users or addresses. These features fail to reflect the commonalities and differences in dynamic changes among addresses of the same type. Because these studies only analyze transactions directly participated in by tagged accounts and the accounts involved in those transactions, or analyze fund flows, without considering the "time period segmentation" condition, the collected data and analysis results are incomplete. This is because the data cannot reflect the temporal characteristics of transactions conducted by accounts, the number of various nodes, their quantitative relationships, and dynamic changes. Due to anonymity, the user information behind the address is unknown; therefore, a large number of addresses in current transaction graphs are untagged. Existing address type identification schemes also do not consider temporal characteristics. Determining the type of an address based on its transaction behavior and related characteristics is equally important. Therefore, based on the temporal characteristics in local transaction graphs, a new scheme for identifying the type of untagged addresses is proposed. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a method for extracting node quantity features based on temporal local Bitcoin transaction graphs, addressing the deficiencies in the existing technology.

[0007] The technical solution adopted by this invention to solve its technical problem is:

[0008] This invention provides a method for extracting node quantity features based on a temporal local Bitcoin transaction graph, the method comprising the following steps:

[0009] Obtain the raw blockchain transaction ledger data and parse it into a complete transaction graph, which includes all transactions and address information within the research period.

[0010] Using the labeled address, research period, period increment, and number of layers in the local transaction graph as input, extract the local transaction graph of each address in the complete transaction graph within the corresponding research period;

[0011] Extract the node quantity characteristics and node quantity relationship characteristics of the local transaction graph of each address in each research period, and save the extracted node quantity characteristics and node quantity relationship characteristics of the local transaction graph corresponding to the tagged address in the central server;

[0012] The node quantity and node quantity relationship features corresponding to unlabeled addresses are processed to obtain the corresponding time-series feature vectors; and various types of labeled addresses are randomly sampled, and the corresponding node quantity and node quantity relationship features are extracted from the central server based on the sampling results, and processed to obtain the corresponding time-series feature vectors.

[0013] Calculate the similarity between the temporal feature vectors corresponding to unlabeled addresses and labeled addresses to obtain the corresponding scores, and assign the corresponding types to unlabeled addresses based on the scores.

[0014] Furthermore, the complete transaction graph of the present invention is a directed heterogeneous multigraph. The nodes of the complete transaction graph include transaction nodes and address nodes. Transaction nodes are connected through address nodes, and address nodes serve as input and output addresses in transaction nodes.

[0015] Furthermore, the transaction information stored in the transaction node of the present invention includes transaction time, block height, transaction hash value, and input / output address; the information stored in the address node includes address hash value, number of transactions performed by that address within the studied block range, and transaction amount.

[0016] Furthermore, the method for extracting local transaction graphs in the present invention includes:

[0017] 1) In the complete transaction graph, transaction nodes and address nodes are distinguished by transaction hash and address. An index table is built for the transaction nodes and address nodes. The position of each node in the complete transaction graph is quickly located through the index table.

[0018] 2) Using the labeled address, research period, period increment, and the number of layers (4) of the local transaction graph as input for local transaction graph extraction, extract the 4-hop subgraph of the address in the complete heterogeneous graph within the corresponding period, i.e., the local transaction graph, and use the index table mentioned above to locate the position of the address in the complete transaction graph.

[0019] Furthermore, the method for extracting local transaction graphs in the present invention includes:

[0020] The improved process for generating a time-series local transaction graph is as follows: Input the complete transaction graph (whole_graph), the address of the local transaction graph to be generated (address), the hop count of the local transaction graph (k=4), the start time (begin_time) of the study period, and the end time (end_time) of the study period; Use the function Get_Index() to locate the position (source_index) of the address in the complete transaction graph, which is the index of the address in the complete transaction graph; Use a dictionary (distance) to record the distance from the relevant nodes in the breadth-first traversal to the address of the target node in the complete transaction graph; Use a dictionary (index_map) to create new indices for nodes in the local transaction graph and establish connections between nodes in the complete transaction graph and nodes in the local transaction graph; Also, use index_map to filter the starting node (begin_node) of the edges in the breadth-first traversal; only nodes appearing in index_map are eligible to be used to generate the local transaction graph; Use an array (edges) to store the edge set of the local transaction graph; The local transaction graph is then generated based on this edge set.

[0021] First, perform a breadth-first traversal of the complete transaction graph starting from the souce_index, that is, the address node, to obtain multiple sets of node combinations (begin_node, end_node), which is an edge between two nodes in the complete transaction graph. Then, determine whether the begin_node node meets the conditions of the temporal local transaction graph by checking whether the begin_node node is in the index_map, that is, whether the begin_node node is within the research period. If it is not within the research period, skip this loop and then check the next set of nodes (begin_node, end_node). If the begin_node node is a node in the index_map, then determine whether the begin_node node meets the conditions of the 4-hop local transaction graph by distance, that is, the distance needs to satisfy distance[begin_node] < k. Then, check whether the end_node node of the edge (begin_node, end_node) is in distance. If it is not in distance, first calculate the distance from the end_node node to the address node, that is, distance[end_node] = distance[begin_node] + 1. Then, check whether the transaction time of the end_node node is within the research period. Obtain the transaction time of the end_node node through the function Get_Tx_Node_Time(). Determine the type of the end_node node and whether its time is within the research period through the statements distance[end_node] % 2 == 1 and tx_time not in Interval(begin_time, end_time). If the node is a transaction node but its transaction time is not within the research period, do not add this node to this local transaction graph. Filter the multiple sets of edges (begin_node, end_node) obtained from the previous breadth-first search through this condition. By checking the time of the nodes, the transaction nodes outside the research period and their affiliated address nodes can be excluded. If the transaction time of this node is within the research period, add this node to this local transaction graph, add the node end_node to the index_map after assigning it a new index, and then determine whether the direction of the edge (begin_node, end_node) in the complete transaction graph is from begin_node to end_node or from end_node to begin_node, and add the directed edge to the edge set edges;

[0022] After repeating the above node selection operation, until all the multiple sets of edges obtained by breadth-first search are traversed to obtain all nodes and their corresponding edges that satisfy the research period, then the corresponding 4-hop local transaction graph is generated based on the edge set edges, index_map and the function Generate_Subgraph(), and then the corresponding temporal features are extracted from the 4-hop local transaction graph using the function Count_Node().

[0023] Furthermore, the method for extracting the node quantity feature in the method of the present invention includes:

[0024] For a 4-hop local transaction graph, the number of nodes at each level is counted hierarchically, with each level consisting of nodes of the same type. Nodes at a height of 1 from the central address node are all transaction nodes, denoted as Tx1. The number of nodes at a height of 1 from the central address node in the local transaction graph during the study period i is counted as Tx1-i. Nodes at a height of 2 from the central address node are all address nodes, denoted as Addr1. The number of nodes at a height of 2 from the central address node in the local transaction graph during the study period i is counted as Addr1. The number of nodes is Addr1-i; nodes at a height of 3 from the center address node are all transaction nodes, denoted as Tx2, and the number of nodes at a height of 2 from the center address node in the local transaction graph during the study period i is counted as Tx2-i; nodes at a height of 4 from the center address node are all address nodes, denoted as Addr2, and the number of address nodes at a height of 2 from the center address node in the subgraph during the study period i is counted as Addr2-i; the statistical results are recorded in a file; if the address has not participated in any transactions during the study period, the number of each type of node in its local transaction graph is counted as 0 by default.

[0025] Furthermore, the method for extracting the node quantity relationship features in the method of the present invention includes:

[0026] The statistical characteristics of nodes at each level and type are analyzed, and the corresponding quantitative relationships are calculated, including: the proportion of transaction nodes at a height of 1 from the center address node to the total number of nodes in the local transaction graph; the proportion of transaction nodes at a height of 3 from the center address node to the total number of nodes in the local transaction graph; the proportion of address nodes at a height of 2 from the center address node to the total number of nodes in the local transaction graph; the proportion of address nodes at a height of 4 from the center address node to the total number of nodes in the local transaction graph; the ratio of transactions to addresses; the growth of transaction nodes at a height of 1 from the center address node; the growth of transaction nodes at a height of 3 from the center address node; the growth of all transaction nodes in the local transaction graph; the growth of address nodes at a height of 2 from the center address node; the growth of address nodes at a height of 4 from the center address node; the growth of all address nodes in the local transaction graph; and the growth of all address nodes in the local transaction graph. If an address has not participated in any transactions during the research period, the corresponding ratio is set to 0 by default.

[0027] Furthermore, the method for obtaining the temporal feature vector in the method of the present invention includes:

[0028] Temporal features are extracted from the 4-hop local transaction graph. The temporal features include the number of nodes and the relationship between the number of nodes. There are 20 temporal features in a time period. The study time period is N. There are a total of 20*N temporal features for an address. The 20*N temporal features of the unlabeled address are quantized into a feature vector. One unlabeled address corresponds to one temporal feature vector.

[0029] Obtain the Tx1-N of the 4-hop subgraph of unlabeled addresses in the study period N. Tx1-N is the total number of transactions t made by unlabeled addresses in the study period N, corresponding to the number of nodes in the local transaction graph that are 1 hop away from the central address node. Since the time period is incrementally increasing, the study period N is the longest study period, and Tx1-N also represents the largest total number of transactions t in all study periods. Subsequent sampling of labeled addresses will be based on this total number of transactions t.

[0030] For each tagged address in each category, N different time periods of 4-hop local transaction graphs have been extracted from the complete transaction graph. The corresponding time series features are extracted from the 4-hop local transaction graphs and stored in the central server. A tagged address has a total of N time series features, for a total of 20*N time series features.

[0031] For each type of labeled address, 100 address samples are randomly selected. These samples must satisfy the condition that the Tx1-N value of time period N in the time-series address sample is t. The Tx1-N value of time period N can preserve the characteristics of its address type. Furthermore, the time-series features of the 100 samples sampled from each type are quantized into the corresponding time-series feature vector.

[0032] First, input the complete transaction graph (whole_graph), the unlabeled address (unlabel_address) from which the local transaction graph is to be generated, the start time (begin_time) and end time (end_time_N) of the Nth study period, and the type of labeled address to be randomly sampled (select_label_type). Then, the function Temporal_BFS() is used to generate a 4-hop local transaction graph corresponding to the unlabeled address (unlabel_address) with the parameters start time (begin_time), end time (end_time_N) and hop count k (k=4). The number of all transactions (Tx1) of the unlabeled address (unlabel_address) within the time period (begin_time, end_time_N) (i.e., time period N) is obtained and denoted as t.

[0033] The database storing sample addresses and their features on the central server retrieves all address samples labeled `select_label_type` and their statistical results, denoted as `label_address_list`. Since a single sample address stores features from multiple time periods, to maximize the preservation and approximation of an address's transaction characteristics, the labeled address samples are filtered based on the number of direct transactions (Tx1) within time period N (Tx1-N is the total number of transactions an address participates in within time period N). All address samples and their statistical results in the dataset `label_address_list` that satisfy the condition that the number of transactions (Tx1-N) within the research time period N is t are selected; this data sample set is denoted as `samples_set`. Finally, 100 address samples are randomly selected from the sample set `samples_set` to form the random sample set `random_samples_set`.

[0034] Furthermore, the method for calculating the similarity of time-series feature vectors in the method of the present invention includes:

[0035] The temporal feature vectors of labeled and unlabeled address samples are used to calculate the distance (Dist) between the feature vector of the unlabeled address and the feature vectors of 100 samples in each address class, using the Euclidean distance formula. A larger value indicates less similarity between the unlabeled address and the labeled address. Each address's temporal feature vector contains 20*N temporal features, including node quantity features and node quantity relationship features. The feature vector v of the i-th sample in a set of labeled address samples... i =(x1,x2,...,x 20*N The feature vector v = (y1, y2, ..., y) of the unlabeled address samples.20*N The formula for calculating the distance between them is:

[0036]

[0037] To more intuitively represent the similarity between samples, the distance is normalized. The normalized value is the similarity S, and the value of S ranges from [0,1]. The formula for calculating the similarity between the i-th sample and the unlabeled sample in a class of labeled address samples is as follows:

[0038]

[0039] Calculate the mean of the normalized similarity. 'c' represents the type of address label, which can be any type including coin mixing services, darknet markets, gambling, ransomware, and exchanges; the probability that an unlabeled address sample belongs to address type 'c' is calculated using the following formula:

[0040]

[0041] mean As the final evaluation value for unlabeled addresses, the larger the value, the greater the likelihood that it belongs to address type c. This score serves as a reference for address type determination.

[0042] This invention provides a system for extracting node quantity features based on a temporal local Bitcoin transaction graph. The system includes:

[0043] The complete Bitcoin transaction heterogeneous graph construction module is used to obtain the original blockchain transaction ledger data and parse the original blockchain transaction ledger data into a complete transaction graph, which includes all transactions and address information within the research period.

[0044] The Bitcoin address local transaction graph module is used to extract the local transaction graph of each address in the complete transaction graph within the corresponding research period by taking the tagged address, research period, period increment, and number of layers of the local transaction graph as input.

[0045] The local transaction graph feature extraction module is used to extract the node quantity features and node quantity relationship features of each address in the local transaction graph for each research period, and save the extracted node quantity features and node quantity relationship features of the local transaction graph corresponding to the tagged address in the central server.

[0046] The address label evaluation module includes a module for extracting temporal features from unlabeled addresses, a module for sampling labeled temporal samples, and a similarity calculation module. The module for extracting temporal features from unlabeled addresses processes the node quantity and node quantity relationship features corresponding to the unlabeled addresses to obtain the corresponding temporal feature vectors. The module for sampling labeled temporal samples randomly samples various types of labeled addresses, extracts the corresponding node quantity and node quantity relationship features from the central server based on the sampling results, and processes them to obtain the corresponding temporal feature vectors. The similarity calculation module calculates the similarity between the temporal feature vectors corresponding to unlabeled addresses and labeled addresses, obtains the corresponding scores, and assigns the appropriate type to the unlabeled addresses based on the scores.

[0047] The beneficial effects of this invention are as follows: The node quantity feature extraction method based on the temporal local Bitcoin transaction graph of this invention, by extracting the number of nodes of various types within a certain time period and calculating the corresponding node quantity relationships, explores the commonalities and differences in the dynamic changes of the number and quantity relationship features of various types of nodes in the local transaction graph between address categories, and takes time into account. This method is the first to use dynamic temporal quantity features in address type determination, evaluating the probability that an unlabeled address belongs to a certain type of address based on a similarity metric. Based on these extracted dynamic temporal features, a new evaluation method is proposed, which can evaluate the probability that an unlabeled address belongs to a certain type of address, providing a new solution to the problem of a large number of unlabeled addresses in the transaction graph. Attached Figure Description

[0048] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings:

[0049] Figure 1 This is a schematic diagram of the node number feature extraction method based on the temporal local Bitcoin transaction graph according to an embodiment of the present invention;

[0050] Figure 2 This is a schematic diagram of the labelless address type evaluation method according to an embodiment of the present invention;

[0051] Figure 3 This is an example diagram illustrating the division of a 14-day growth period according to an embodiment of the present invention;

[0052] Figure 4 This is an example diagram of a partial transaction graph (4-hop subgraph) according to an embodiment of the present invention;

[0053] Figure 5 This is a flowchart of the improved algorithm for generating time-series local transaction graphs according to an embodiment of the present invention.

[0054] Figure 6 This is a flowchart of the random sampling algorithm based on the number of transactions in an embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0056] Example 1:

[0057] The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to embodiments of the present invention includes the following steps:

[0058] Obtain the raw blockchain transaction ledger data and parse it into a complete transaction graph, which includes all transactions and address information within the research period.

[0059] Using the labeled address, research period, period increment, and number of layers in the local transaction graph as input, extract the local transaction graph of each address in the complete transaction graph within the corresponding research period;

[0060] Extract the node quantity characteristics and node quantity relationship characteristics of the local transaction graph of each address in each research period, and save the extracted node quantity characteristics and node quantity relationship characteristics of the local transaction graph corresponding to the tagged address in the central server;

[0061] The node quantity and node quantity relationship features corresponding to unlabeled addresses are processed to obtain the corresponding time-series feature vectors; and various types of labeled addresses are randomly sampled, and the corresponding node quantity and node quantity relationship features are extracted from the central server based on the sampling results, and processed to obtain the corresponding time-series feature vectors.

[0062] Calculate the similarity between the temporal feature vectors corresponding to unlabeled addresses and labeled addresses to obtain the corresponding scores, and assign the corresponding types to unlabeled addresses based on the scores.

[0063] Example 2:

[0064] The node quantity feature extraction method based on time-series local Bitcoin transaction graphs mainly consists of four modules: a module for constructing a complete heterogeneous Bitcoin transaction graph, a module for generating labeled local Bitcoin address transaction graphs based on time periods, a module for extracting local transaction graph features, and a module for evaluating address labels. The specific descriptions of these modules are as follows:

[0065] (1) Complete Bitcoin Transaction Heterogeneous Graph Construction Module: This module parses the original ledger (transaction information contained in blocks on the blockchain) into a directed heterogeneous multigraph. Compared to homogeneous graphs (such as graphs with addresses or users as nodes), directed heterogeneous multigraphs reduce information loss during graph construction. Heterogeneous multigraph nodes mainly include transaction nodes and address nodes. Transaction nodes store transaction information such as transaction time, block height, transaction hash value, input / output addresses, etc. Address nodes store information such as address hash value, the number of transactions performed by that address within the studied block range, transaction amount, etc. Transaction nodes are connected through address nodes, as address nodes serve as input and output addresses within the transaction nodes.

[0066] (2) Module for generating labeled Bitcoin address local transaction graphs based on time periods: The original transaction ledger in the Bitcoin blockchain is used as input to generate a complete heterogeneous graph, which includes all transaction and address information within the research period. Using labeled addresses, research periods, time period increments, and the number of layers (4) of the local transaction graph as input, the 4-hop local transaction graph of the address within the corresponding time period is extracted in the complete heterogeneous graph, ultimately generating a complete local Bitcoin transaction graph with time-series information.

[0067] Specifically, the steps are as follows:

[0068] 1) A complete transaction graph is a multi-level directed heterogeneous multigraph containing transaction nodes and address nodes. In the complete transaction graph, transaction nodes and account nodes are distinguished by transaction hashes and addresses, as these are unique identifiers in Bitcoin transactions. To ensure the integrity of the original transaction information as much as possible, transaction and account nodes also store the following information: transaction time, block height, associated address, number of transactions associated with that address, amounts of each input / output, total input / output amount, etc. To quickly locate the position of each node in the complete heterogeneous graph, an index table is created for the transaction and account nodes in the graph and saved locally.

[0069] 2) The tagged address, research period, period increment, and the number of layers of the local transaction graph (4) are used as inputs for local transaction graph extraction. The 4-hop subgraph of the address in the complete heterogeneous graph within the corresponding period is extracted from the complete heterogeneous graph, i.e., the local transaction graph. The above index table is used to locate the position of the address in the complete heterogeneous graph.

[0070] The inclusion of a node in the local transaction graph is determined by analyzing its transaction time information. If the transaction time of a node occurs within the studied time period, the node and the address nodes involved in the transaction (a Bitcoin transaction has input and output addresses, and the transaction graph uses a multi-layered heterogeneous network containing both transaction and address nodes) are directly added to the corresponding local transaction graph. Transaction and address nodes are selected based on the study time period, and then a complete local Bitcoin transaction graph with temporal information is generated using a breadth-first search algorithm. Considering that different types of addresses may have different activity cycles, the time period can be arbitrarily adjusted. The start of the time period is determined by the block height read, but the increment of the time period cannot be changed once determined. Because a breadth-first search algorithm is used, the number of nodes at each level in the local transaction graph can be clearly recorded. As the statistical time period increases incrementally, the corresponding local transaction graph needs to be regenerated based on the new study time period. The number of each type of node in the local transaction graph within each time period is counted, and finally, the statistical characteristics are saved in the corresponding file in chronological order.

[0071] The improved algorithm for generating temporal local transaction graphs is as follows: Figure 5 As shown, the input includes the complete transaction graph (whole_graph), the address of the local transaction graph to be generated (address), the hop count k of the local transaction graph (k = 4), the start time (begin_time) of the research period, and the end time (end_time) of the research period. The function `Get_Index()` locates the position (source_index) of the address in the complete transaction graph. This `source_index` is the index of the address in the complete transaction graph. A dictionary `distance` records the distance from relevant nodes in the breadth-first traversal to the target node (address) in the complete transaction graph. A dictionary `index_map` creates new indices for nodes in the local transaction graph and establishes connections between nodes in the complete transaction graph and nodes in the local transaction graph. `index_map` can also filter the starting node (begin_node) of edges in the breadth-first traversal; only nodes appearing in `index_map` meet the criteria for generating the local transaction graph. The array `edges` is the edge set of the local transaction graph, and the local transaction graph is then generated based on this edge set.

[0072] First, perform a breadth-first traversal of the complete transaction graph starting from the souce_index (i.e., the address node) to obtain multiple sets of node combinations (begin_node, end_node), which represent an edge between two nodes in the complete transaction graph. Then, determine whether the begin_node node meets the conditions of the temporal local transaction graph by checking whether the begin_node node is in the index_map, that is, whether the begin_node node is within the research period; if it is not within the research period, skip this loop and then check the next set of nodes (begin_node, end_node). If the begin_node node is a node in the index_map, determine whether the begin_node node meets the conditions of the 4-hop local transaction graph by distance, that is, the distance needs to satisfy distance[begin_node] < k. Then, check whether the end_node node of the edge (begin_node, end_node) is in distance. If it is not in distance, first calculate the distance from the end_node node to the address node, that is, distance[end_node] = distance[begin_node] + 1. Then, check whether the transaction time of the end_node node is within the research period. Obtain the transaction time of the end_node node through the function Get_Tx_Node_Time(). Determine the type of the end_node node and whether its time is within the research period through the statements distance[end_node] % 2 == 1 and tx_time not in Interval(begin_time, end_time). If the node is a transaction node but its transaction time is not within the research period, do not add this node to the local transaction graph. Filter the multiple sets of edges (begin_node, end_node) obtained from the previous breadth-first search through this condition. By checking the time of the nodes, it is possible to exclude transaction nodes outside the research period and their affiliated address nodes. If the transaction time of this node is within the research period, add this node to the local transaction graph, add the node end_node to the index_map after assigning it a new index. Then, determine whether the direction of the edge (begin_node, end_node) in the complete transaction graph is from begin_node to end_node or from end_node to begin_node, and add the directed edge to the edge set edges.

[0073] After repeating the above node selection operation, until all the multiple sets of edges obtained by breadth-first search are traversed to obtain all nodes and their corresponding edges that satisfy the research period, then the corresponding 4-hop local transaction graph is generated based on the edge set edges, index_map and the function Generate_Subgraph(), and then the corresponding temporal features are extracted from the 4-hop local transaction graph using the function Count_Node().

[0074] (3) Local transaction graph feature extraction module: This module is divided into two parts, namely the node number feature extraction module and the node number relationship feature extraction module. The node number feature and node number relationship feature extracted from the local transaction graph with tagged address will be stored in the central server.

[0075] 1) Node Quantity Feature Extraction Module: This method is proposed for 4-hop subgraphs. Since the 4-hop subgraph includes transactions directly participated in by the central address node, it can also obtain the transactions that occurred before and after the transactions of other addresses in these direct transactions. That is, the 4-hop subgraph not only clarifies the Bitcoin flow of the central address node, but also has transaction behavior characteristics.

[0076] First, it is necessary to determine the range of block heights to be studied (e.g., block heights within the complete transaction graph are 663000 to 685000, with a time span from December 26, 2021 to May 26, 2021). Based on the block heights to be studied, different time periods are divided, and the start time of each time period is determined (e.g., January 1, 2021). The increment of the time period is determined based on the activity cycle of different address types. The study time period is increased according to a fixed increment (e.g., 7 days, 14 days, etc.). The number and quantitative characteristics of various types of nodes within the local transaction graph of each address in each time period are studied. Considering the varying activity cycles of different address types, and to obtain a clearer picture of the node count changes within the 4-hop subgraphs for each address type, statistical analysis was conducted on the activity cycles and their intervals for a small number of labeled address samples. The average value of the results was rounded to the nearest integer. Ultimately, it was decided to extract the quantity characteristics for each address type over N study periods, with a period increment of 14 days. For example, if the start time is January 1, 2021, 00:00:00, then the end time of period one is January 15, 2021, 00:00:00, and the start time of period two is January 1, 2021, 00:00:00, and the end time of period two is January 29, 2021, 00:00:00. Based on the local Bitcoin transaction graph generated by these periods, since all nodes within this local Bitcoin transaction graph are within the study period, the number of nodes at each level of the subgraph was directly counted. Since the nodes at each level are of the same type... For example, nodes at a height of 1 from the center address node are all transaction nodes (Tx1), nodes at a height of 2 from the center address node are all address nodes (Addr1), nodes at a height of 3 from the center address node are all transaction nodes (Tx2), and nodes at a height of 4 from the center address node are all address nodes (Addr2). The statistical results are recorded in a file. If an address has not participated in any transactions during the study period, the number of nodes of each type in its subgraph is set to 0 by default. The specific statistical method is as follows:

[0077] ①Tx1 — Transaction node at a height of 1 from the central address node

[0078] Tx1-i: Counts the number of nodes in the subgraph whose height from the center address node is 1 within the study period i.

[0079] ②Tx2 — A transaction node located at a height of 3 from the central address node.

[0080] Tx2-i: Counts the number of nodes in the subgraph that are 3 units away from the center address node during the study period i.

[0081] ③Tx—All transaction nodes within the subgraph

[0082] Tx-i: The total number of all transaction nodes in the subgraph during the study period i.

[0083] ④Addr1 — Address node with a height of 2 from the center address node

[0084] Addr1-i: Counts the number of address nodes in the subgraph that are 2 units away from the center address node during the study period i.

[0085] ⑤Addr2 — Address node with a height of 4 from the center address node

[0086] Addr2-i: Counts the number of address nodes in the subgraph that are 4 units away from the center address node during the study period i.

[0087] ⑥Addr—All address nodes within the subgraph

[0088] Addr-i: Counts the total number of all address nodes in the subgraph within the study period i.

[0089] ⑦SN — All nodes within the subgraph

[0090] SN-i: The total number of all nodes in the subgraph during the study period i.

[0091] 2) Node Quantity Relationship Feature Extraction Module: Based on the above-mentioned statistical quantity characteristics of various nodes, calculate the corresponding quantity relationships, including the proportion of each type of node in the subgraph, the ratio of the number of nodes at level 1 to the number of nodes at level 2 in the subgraph, and the ratio of the number of nodes at level 3 to the number of nodes at level 4 in the subgraph. If the address has not participated in any transactions during the research period, the corresponding ratio is set to a default value. The specific calculation method is as follows:

[0092] ①RT1SN — The percentage of transaction nodes at a height of 1 from the center address node to the total number of nodes in the subgraph.

[0093] RT1SN-i: Calculates the ratio of the number of nodes in the subgraph with a height of 1 from the center node to the total number of nodes in the subgraph during the study period i.

[0094]

[0095] ②RT2SN – The percentage of transaction nodes at a height of 3 from the center address node to the total number of nodes in the subgraph.

[0096] RT2SN-i: Calculates the ratio of the number of nodes in the subgraph with a height of 3 from the center node to the total number of nodes in the subgraph during the study period i.

[0097]

[0098] ③RA1SN — The percentage of address nodes at a height of 2 from the center address node to the total number of nodes in the subgraph.

[0099] RA1SN-i: Calculates the ratio of the number of subgraph nodes with a height of 2 from the center address node to the total number of nodes in the subgraph during the study period i.

[0100]

[0101] ④RA2SN — The percentage of address nodes at a height of 4 from the center address node to the total number of nodes in the subgraph.

[0102] RA2SN-i: Calculates the ratio of the number of subgraph nodes with a height of 4 from the center address node to the total number of nodes in the subgraph during the study period i.

[0103]

[0104] ⑤RT1A1—Ratio of transactions to addresses

[0105] RT1A1-i: Calculate the ratio of the number of transaction nodes in the subgraph that are 1 units away from the center address node to the number of address nodes in the subgraph that are 2 units away from the center address node during the study period i.

[0106]

[0107] ⑥RT2A2—Ratio of transactions to addresses

[0108] RT2A2-i: Calculates the ratio of the number of transaction nodes in the subgraph with a height of 3 from the center address node to the number of address nodes in the subgraph with a height of 4 from the center address node within the study period i.

[0109]

[0110] ⑦ΔTx1 — The growth amount of the transaction node at a height of 1 from the center address node.

[0111] ΔTx1-i: Due to the lack of a control group, ΔTx1-1 is defaulted to 0. Calculate the increase in the number of nodes in the subgraph with a height of 1 from the center address node within the study period i-1 and period i:

[0112] ΔTx1 i =Tx1 i -Tx1 i-1

[0113] ⑧ΔTx2 — The growth of a transaction node at a height of 3 from the center address node.

[0114] ΔTx2-i: Due to the lack of a control group, ΔTx2-1 is defaulted to 0. Calculate the increase in the number of nodes with a height of 3 from the center address node in the subgraph during study period i-1 and period i:

[0115] ΔTx2 i =Tx2 i -Tx2 i-1

[0116] ⑨ΔTx — The growth of all transaction nodes within the subgraph

[0117] ΔTx-i: Due to the lack of a control group, ΔTx-1 is defaulted to 0. Calculate the total increase in the number of all transaction nodes within the subgraph during the study period i-1 and period i:

[0118] ΔTx i =Tx i -Tx i-1

[0119] ⑩ΔAddr1 — The amount of address node growth at a height of 2 from the center address node

[0120] ΔAddr1-i: Due to the lack of a control group, ΔAddr1-1 is set to 0 by default. Calculate the increase in the number of address nodes with a height of 2 from the center address node in the subgraph during the study period i-1 and period i:

[0121] ΔAddr1 i =Addr1 i -Addr1 i-1

[0122] ΔAddr2 — The amount of address node growth at a height of 4 from the center address node.

[0123] ΔAddr2-i: Due to the lack of a control group, ΔAddr2-1 is set to 0 by default. Calculate the increase in the number of address nodes with a height of 4 from the center address node in the subgraph during study period i-1 and period i:

[0124] ΔAddr2 i =Addr2 i -Addr2 i-1

[0125] ΔAddr — The growth rate of all address nodes within the subgraph

[0126] ΔAddr-i: Due to the lack of a control group, ΔAddr-1 defaults to 0. Calculate the total number of all address nodes in the subgraph within the study period i-1 and period i:

[0127] ΔAddri =Addr i -Addr i-1

[0128] ΔSN — Total node growth within the subgraph

[0129] ΔSN-i: Due to the lack of a control group, ΔSN-1 is defaulted to 0. Calculate the total increase in the number of all nodes in the subgraph within the study period i-1 and period i:

[0130] ΔSN i =SN i -SN i-1

[0131] (4) Address Label Evaluation Module: This module requires first extracting local transaction graphs from the complete transaction graph for unlabeled addresses based on time periods, and then extracting time-series features, including quantitative and relational features, from the local transaction graphs. Next, labeled addresses are sampled, and the time-series features of the corresponding sampled addresses are read from the server based on the sampling results. The time-series features of each address are quantified into corresponding feature vectors, and the similarity between unlabeled and labeled addresses is calculated based on the feature vectors to obtain the corresponding score. Ultimately, this module can be divided into three parts: a module for extracting time-series features from unlabeled addresses, a module for sampling labeled time-series samples, and a similarity calculation module.

[0132] The specific steps are as follows:

[0133] 1) Sampling module for unlabeled time-series samples:

[0134] Temporal features of the local transaction graph (4-hop subgraph) of the unlabeled address (A1) are extracted using a local transaction graph feature extraction module. Since the study involves 4-hop subgraphs spanning N time periods, 4-hop subgraphs within different time periods are first extracted from the complete transaction graph for the unlabeled address (A1). Corresponding 4-hop subgraphs are generated based on the time periods, and temporal features are extracted from these subgraphs. These temporal features include the number of nodes and their relationships. There are 20 features within a single time period, as mentioned in the local transaction graph feature extraction module. Given N time periods, each address has a total of 20*N features. Finally, the 20*N temporal features of the unlabeled address (A1) are quantized into a single feature vector, with one feature vector corresponding to one unlabeled address.

[0135] Obtain the Tx1 (i.e., Tx1-N) of the 4-hop subgraph of the unlabeled address (A1) in time period N. Tx1-N represents the total number of transactions t made by the unlabeled address in time period N, corresponding to the number of nodes in the local transaction graph that are 1 unit away from the central address node. Since the time periods grow incrementally, time period N is the longest research period, and Tx1-N also represents the largest total number of transactions t within all research periods. Subsequent sampling of labeled addresses will be based on this total number of transactions t.

[0136] 2) Sampling module for labeled address samples:

[0137] Currently, the addresses are tagged with coin mixing services, dark web markets, gambling, ransomware, and exchanges. For each tagged address in each category, N different time periods of the local transaction graph (4-hop subgraph) have been extracted from the complete transaction graph in advance. The corresponding time-series features are extracted from the 4-hop subgraph and stored on the central server. A tagged address has a total of N time periods of time-series features, for a total of 20*N features.

[0138] Considering that even if an address has the same total number of transactions, its active periods may be different, in order to reduce errors, we randomly select 100 address samples for each type of labeled address. These samples need to satisfy the condition that the Tx1(Tx1-N) value of time period N in the time-series address sample is t. The Tx1(Tx1-N) value of time period N can preserve the characteristics of its address type to the greatest extent. Furthermore, the time-series features of the 100 samples sampled from each type are quantized into corresponding feature vectors (the first time that time-series features are used in similarity calculation).

[0139] The improved algorithm for random sampling based on transaction volume is as follows: Figure 6 As shown, the input is first the complete transaction graph (whole_graph), the unlabeled address (unlabel_address) to which the local transaction graph is to be generated, the start time (begin_time) of the Nth study period, the end time (end_time_N) of the Nth study period, and the type of labeled address to be randomly sampled (select_label_type). Then, the 4-hop local transaction graph corresponding to the unlabeled address (unlabel_address) is generated by the function Temporal_BFS(), with the parameters start time (begin_time), end time (end_time_N) of the study period, and the number of hops k (k=4). The number of all transactions (Tx1) of the unlabeled address (unlabel_address) within the time period (begin_time, end_time_N) (i.e., time period N) is obtained and denoted as t.

[0140] The database storing sample addresses and their features on the central server retrieves all address samples labeled `select_label_type` and their statistical results, denoted as `label_address_list`. Since a single sample address stores features from multiple time periods, to maximize the preservation and approximation of an address's transaction characteristics, the labeled address samples are filtered based on the number of direct transactions (Tx1) within time period N (Tx1-N is the total number of transactions an address participates in within time period N). All address samples and their statistical results in the dataset `label_address_list` that satisfy the condition that the number of transactions (Tx1-N) within the research time period N is t are selected; this data sample set is denoted as `samples_set`. Finally, 100 address samples are randomly selected from the sample set `samples_set` to form the random sample set `random_samples_set`.

[0141] 3) Similarity calculation module:

[0142] The temporal features of both labeled and unlabeled address samples are quantized into feature vectors. The Euclidean distance formula is used to calculate the distance (Dist) between the feature vector of the unlabeled address (A1) and the feature vectors of 100 samples in each address class. A larger value indicates less similarity between the unlabeled address and the sample address. Each address's feature vector contains 20*N temporal features, including quantitative features and quantitative relationship features. The feature vector v of the i-th sample in the address sample set of a certain label is... i =(x1,x2,...,x 20*N The feature vector v = (y1, y2, ..., y) of the unlabeled address samples. 20*N The formula for calculating the distance between them is:

[0143]

[0144] To more intuitively represent the similarity between samples, the distance is normalized. The normalized value is the similarity S, which ranges from [0,1]. The formula for calculating the similarity between the i-th sample and an unlabeled sample in a class of known-labeled address samples is:

[0145]

[0146] Calculate the mean of the normalized similarity. 'c' represents any type of address, including coin mixing services, darknet markets, gambling, ransomware, and exchanges. The probability that an unlabeled address sample belongs to address type 'c' is calculated using the following formula:

[0147]

[0148] mean As the final evaluation value for unlabeled addresses (A1), the larger the value, the greater the likelihood that it belongs to address type c. This score can be used as a reference for address type determination.

[0149] This method, combined with a threshold, can be used to identify the type of an address. When all scores are below the threshold, the address is classified as "Other," meaning the unlabeled address does not belong to any known label. If the scores are above the threshold, it is classified into the highest-scoring type, and all scores above the threshold are listed. The threshold can be determined using a small sample of known labeled addresses or manually defined; choosing an appropriate threshold helps improve recognition accuracy.

[0150] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A method for extracting node quantity features based on a temporal local Bitcoin transaction graph, characterized in that, The method includes the following steps: Obtain the raw blockchain transaction ledger data and parse it into a complete transaction graph, which includes all transactions and address information within the research period. Using labeled addresses, research periods, period increments, and the number of layers in the local transaction graph as input, extract the local transaction graph of each address in the complete transaction graph within the corresponding research period; Extract the node quantity characteristics and node quantity relationship characteristics of the local transaction graph of each address in each research period, and save the extracted node quantity characteristics and node quantity relationship characteristics of the local transaction graph corresponding to the tagged address in the central server; The node quantity and node quantity relationship features corresponding to unlabeled addresses are processed to obtain the corresponding time-series feature vectors; and various types of labeled addresses are randomly sampled, and the corresponding node quantity and node quantity relationship features are extracted from the central server based on the sampling results, and processed to obtain the corresponding time-series feature vectors. Calculate the similarity between the temporal feature vectors corresponding to unlabeled addresses and labeled addresses to obtain the corresponding scores, and assign the corresponding types to unlabeled addresses based on the scores.

2. The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to claim 1, characterized in that, The complete transaction graph is a directed heterogeneous multigraph. The nodes of the complete transaction graph include transaction nodes and address nodes. Transaction nodes are connected through address nodes, and address nodes serve as input and output addresses in the transaction nodes.

3. The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to claim 2, characterized in that, The transaction information stored by the transaction node includes the transaction time, the block height, the transaction hash value, and the input / output address; the information stored by the address node includes the address hash value and the number and amount of transactions made by that address within the studied block range.

4. The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to claim 1, characterized in that, The methods for extracting local transaction graphs include: 1) In the complete transaction graph, transaction nodes and address nodes are distinguished by transaction hash and address. An index table is built for the transaction nodes and address nodes. The position of each node in the complete transaction graph can be quickly located through the index table. 2) Using the labeled address, research period, period increment, and the number of layers (4) of the local transaction graph as input for local transaction graph extraction, extract the 4-hop subgraph of the address in the complete heterogeneous graph within the corresponding period, i.e., the local transaction graph, and use the index table mentioned above to locate the position of the address in the complete transaction graph.

5. The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to claim 4, characterized in that, The methods for extracting local transaction graphs include: The improved process for generating a time-series local transaction graph is as follows: Input the complete transaction graph (whole_graph), the address of the local transaction graph to be generated (address), the hop count of the local transaction graph (k=4), the start time (begin_time) of the study period, and the end time (end_time) of the study period; locate the position (source_index) of the address in the complete transaction graph using the function Get_Index(), which is the index of the address in the complete transaction graph; use a dictionary (distance) to record the distance from the relevant nodes in the breadth-first traversal to the address of the target node in the complete transaction graph; use a dictionary (index_map) to create new indices for nodes in the local transaction graph and establish connections between nodes in the complete transaction graph and nodes in the local transaction graph; also, use index_map to filter the starting node (begin_node) of the edges in the breadth-first traversal, only nodes appearing in index_map are eligible to be used to generate the local transaction graph; use an array (edges) to store the edge set of the local transaction graph, and then generate the local transaction graph based on this edge set. First, perform a breadth-first traversal of the complete transaction graph starting from the souce_index, that is, the address node, to obtain multiple sets of node combinations (begin_node, end_node), which is an edge between two nodes in the complete transaction graph. Then, determine whether the begin_node node meets the conditions of the temporal local transaction graph by checking whether the begin_node node is in the index_map, that is, whether the begin_node node is within the research period. If it is not within the research period, skip this loop and then check the next set of nodes (begin_node, end_node). If the begin_node node is a node in the index_map, determine whether the begin_node node meets the conditions of the 4-hop local transaction graph by distance, that is, the distance needs to satisfy distance[begin_node] < k. Then, check whether the end_node node of the edge (begin_node, end_node) is in distance. If it is not in distance, first calculate the distance from the end_node node to the address node, that is, distance[end_node]=distance[begin_node]+1. Then, check whether the transaction time of the end_node node is within the research period. Obtain the transaction time of the end_node node through the function Get_Tx_Node_Time(). Use the statements distance[end_node] %2 = 1 and tx_time not in Interval(begin_time, end_time) to determine the type of the end_node node and whether the time of this node is within the research period. If this node is a transaction node but its transaction time is not within the research period, do not add this node to this local transaction graph. Filter the multiple sets of edges (begin_node, end_node) obtained from the previous breadth-first search through this condition. By checking the time of the nodes, it is possible to eliminate the transaction nodes outside the research period and their affiliated address nodes. If the transaction time of this node is within the research period, add this node to this local transaction graph, add the node end_node to the index_map after assigning it a new index. Then, determine whether the direction of the edge (begin_node, end_node) in the complete transaction graph is from begin_node to end_node or from end_node to begin_node, and add the directed edge to the edge set edges; After repeating the above node selection operation, until all the multiple sets of edges obtained by breadth-first search are traversed to obtain all nodes and their corresponding edges that satisfy the research period, then the corresponding 4-hop local transaction graph is generated based on the edge set edges, index_map and the function Generate_Subgraph(), and then the corresponding temporal features are extracted from the 4-hop local transaction graph using the function Count_Node().

6. The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to claim 1, characterized in that, The methods for extracting the node quantity feature in this method include: For a 4-hop local transaction graph, the number of nodes at each level is counted hierarchically, with each level consisting of nodes of the same type. Nodes with a height of 1 from the center address node are all transaction nodes, denoted as Tx1. The number of nodes with a height of 1 from the center address node in the local transaction graph during the study period i is counted as Tx1-i. Nodes with a height of 2 from the center address node are all address nodes, denoted as Addr1. The number of nodes with a height of 2 from the center address node in the local transaction graph during the study period i is counted as Addr1-i. Nodes with a center address height of 3 are all transaction nodes, denoted as Tx2. The number of nodes in the local transaction graph at a height of 2 from the center address node during the study period i is counted as Tx2-i. Nodes at a height of 4 from the center address node are all address nodes, denoted as Addr2. The number of address nodes in the subgraph at a height of 2 from the center address node during the study period i is counted as Addr2-i. The statistical results are recorded in a file. If an address has not participated in any transactions during the study period, the number of each type of node in its local transaction graph is counted as 0 by default.

7. The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to claim 6, characterized in that, The methods for extracting node quantity relationship features in this method include: The statistical characteristics of nodes at each level and type are analyzed, and the corresponding quantitative relationships are calculated, including: the proportion of transaction nodes at a height of 1 from the center address node to the total number of nodes in the local transaction graph; the proportion of transaction nodes at a height of 3 from the center address node to the total number of nodes in the local transaction graph; the proportion of address nodes at a height of 2 from the center address node to the total number of nodes in the local transaction graph; the proportion of address nodes at a height of 4 from the center address node to the total number of nodes in the local transaction graph; the ratio of transactions to addresses; the growth of transaction nodes at a height of 1 from the center address node; the growth of transaction nodes at a height of 3 from the center address node; the growth of all transaction nodes in the local transaction graph; the growth of address nodes at a height of 2 from the center address node; the growth of address nodes at a height of 4 from the center address node; the growth of all address nodes in the local transaction graph; and the growth of all address nodes in the local transaction graph. If an address has not participated in any transactions during the research period, the corresponding ratio is set to 0 by default.

8. The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to claim 1, characterized in that, The methods for obtaining temporal feature vectors in this method include: An improved random sampling algorithm based on transaction volume is used to randomly sample 100 addresses for each type of labeled address. First, the input is the whole transaction graph (whole_graph), the unlabeled address (unlabel_address) to which the local transaction graph is to be generated, the start time (begin_time) of the Nth study period, the end time (end_time_N) of the Nth study period, and the type of labeled address to be randomly sampled (select_label_type). Then, the function Temporal_BFS() is used to generate a 4-hop local transaction graph corresponding to the unlabeled address (unlabel_address) with parameters start time (begin_time), end time (end_time_N) of the study period, and hop count k=4. The total number of transactions of the unlabeled address (unlabel_address) within the time period (begin_time, end_time_N), i.e., within time period N, is obtained and denoted as t. The database storing sample addresses and their features on the central server retrieves all address samples labeled `select_label_type` and their statistical results, denoted as `label_address_list`. Since a single sample address stores features from multiple time periods, to maximize the preservation and approximation of an address's transaction characteristics, the labeled address samples are filtered based on the number of direct transactions (Tx1-N) within time period N. Tx1-N represents the total number of transactions an address participates in within time period N. All address samples and their statistical results within the dataset `label_address_list` that satisfy the condition of having a transaction count (Tx1-N) of t within the research time period N are selected; this dataset is denoted as `samples_set`. Finally, 100 address samples are randomly selected from the `samples_set` to form the random sample set `random_samples_set`. Furthermore, the temporal features of the 100 samples sampled from each class are quantized into corresponding temporal feature vectors.

9. The method for extracting node quantity features based on a temporal local Bitcoin transaction graph according to claim 8, characterized in that, The methods for calculating the similarity of time-series feature vectors in this approach include: The temporal feature vectors of labeled and unlabeled address samples are used to calculate the distance between the feature vector of the unlabeled address and the feature vectors of 100 samples in each address class using the Euclidean distance formula. The larger this value, the less similar the unlabeled address is to the labeled address; the temporal feature vector of each address contains 20*N temporal features, including node quantity features and node quantity relationship features, and the feature vector of the i-th sample in a set of labeled address samples. =( , ,..., ) and the feature vector of unlabeled address samples = ( , ,..., The formula for calculating the distance between them is: To more intuitively represent the similarity between samples, the distance is normalized; the normalized value is the similarity score. , The value range is [0,1]; the similarity calculation formula between the i-th sample and the unlabeled sample in a class of labeled address samples is: Calculate the mean of the normalized similarity. 'c' represents the type of address label, which can be any type including coin mixing services, darknet markets, gambling, ransomware, and exchanges; the probability that an unlabeled address sample belongs to address type 'c' is calculated using the following formula: mean As the final evaluation value for unlabeled addresses, the larger the value, the greater the likelihood that it belongs to address type c. This score serves as a reference for address type determination.

10. A system for extracting node quantity features based on a temporal local Bitcoin transaction graph, characterized in that, The system includes: The complete Bitcoin transaction heterogeneous graph construction module is used to obtain the original blockchain transaction ledger data and parse the original blockchain transaction ledger data into a complete transaction graph, which includes all transactions and address information within the research period. The Bitcoin address local transaction graph module is used to extract the local transaction graph of each address in the complete transaction graph within the corresponding research period by taking the tagged address, research period, period increment and the number of layers of the local transaction graph as input. The local transaction graph feature extraction module is used to extract the node quantity features and node quantity relationship features of each address in the local transaction graph for each research period, and save the extracted node quantity features and node quantity relationship features of the local transaction graph corresponding to the tagged address in the central server. The address label evaluation module includes a module for extracting temporal features from unlabeled addresses, a module for sampling labeled temporal samples, and a similarity calculation module. The module for extracting temporal features from unlabeled addresses processes the node quantity and node quantity relationship features corresponding to the unlabeled addresses to obtain the corresponding temporal feature vectors. The module for sampling labeled temporal samples randomly samples various types of labeled addresses, extracts the corresponding node quantity and node quantity relationship features from the central server based on the sampling results, and processes them to obtain the corresponding temporal feature vectors. The similarity calculation module calculates the similarity between the temporal feature vectors corresponding to unlabeled addresses and labeled addresses, obtains the corresponding scores, and assigns the appropriate type to the unlabeled addresses based on the scores.

Images