Abnormal virtual currency wallet address detection method based on graph neural network

Abstract

This invention discloses a method for detecting abnormal virtual currency wallet addresses based on a graph neural network. The method comprises: 1) processing historical virtual currency transaction data; 2) constructing a virtual currency transaction anomaly detection network based on a batch of abnormal virtual currency wallet addresses; 3) adding features to each wallet address in the virtual currency transaction anomaly detection network; and 4) constructing a classification model based on the graph neural network, training the model on the virtual currency transaction anomaly detection network, and predicting previously undetected abnormal virtual currency wallet addresses. The entire method has a five-layer architecture. Based on a number of existing abnormal virtual currency wallet addresses, the method establishes a virtual currency transaction anomaly detection network. By training the graph neural network classification model, which consists of a multilayer perceptron (MLP), a graph convolutional neural network (GCN), and a graph attention network (GAT), the method can uncover more hidden abnormal virtual currency wallet addresses.

Description

Technical Field

[0001] The present invention belongs to the field of graph learning and blockchain application security technology, and relates to a method for detecting abnormal virtual currency wallet addresses based on graph neural networks. Background Art

[0002] Virtual currency is a product of the development of blockchain technology, a novel technology that integrates distributed data storage, peer-to-peer transmission, consensus mechanisms, encryption algorithms, and other technologies. Its cryptographic design ensures that virtual currency can only be transferred or spent by its true owner. This also ensures the anonymity of currency ownership and circulation transactions.

[0003] Many abnormal transactions occur in virtual currency transactions. These transactions are often linked to illegal and gray industries, disrupting the trading order of virtual currency exchanges, impacting their service capabilities, and causing reputational and financial losses. Therefore, detecting wallet addresses associated with abnormal transactions is particularly important. Due to the complexity and dense transaction structure of virtual currency networks, detecting them is not an easy task. Machine learning can process this complex data and train detection models, which can then be applied to anomaly detection. Transactions between virtual currency wallet addresses can form graph data, resulting in considerable research on virtual currency graph data. Research has explored the use of graph convolutional networks (GCNs) to detect illegal transactions in virtual currency networks, using GCNs to detect illegal transactions in a given dataset, but these methods have not achieved satisfactory results. This research demonstrates an improvement to the classic graph convolutional network by connecting the node embeddings obtained from the graph convolutional layer with a single hidden layer derived from a linear transformation of the node feature matrix, thus introducing the concept of feature cointegration in deep learning. Summary of the Invention

[0004] The purpose of this invention is to mine more hidden abnormal virtual currency wallet addresses based on existing abnormal virtual currency wallet addresses. To this end, a blockchain anomaly identification method based on graph neural network is proposed, which includes the following steps:

[0005] Step 1: Collect all virtual currency transactions from the public blockchain and store them in the Elasticsearch transaction transaction database; collect contract addresses and exchange address information from the blockchain browser and store them in the MySQL address database; store existing abnormal virtual currency wallet addresses in the MySQL address database; obtain withdrawal data and exchange registration information from the exchange and store them in the MongoDB exchange data database. The exchange registration information includes the user's ID number and mobile phone number. As sensitive information, the ID number and mobile phone number are first desensitized using SHA-256 hash encryption before being stored in the exchange data database; specifically, it includes:

[0006] Step 1.1: Store the existing abnormal virtual currency wallet addresses in a set form, recorded as S0; load the currency withdrawal information in the exchange data information database and store it in the form of key-value pairs, recorded as M draw The key is the desensitized ID number, and the value is the set of wallet addresses of opponents whose ID number has initiated withdrawal operations;

[0007] Step 1.2: Read the exchange registration information, which is also stored in the form of key-value pairs, denoted as M register The key is the desensitized ID number, and the value is the set of all virtual currency wallet addresses registered on the exchange of the person to whom the ID number belongs;

[0008] Step 1.3: Get the abnormal wallet address, contract address, and exchange address list from the address information database, and store this data in the form of key-value pairs, denoted as M label , used to determine the label of the wallet address; the key is the wallet address, the value is the label of the address, and the label types include abnormal address, contract address, exchange large address and no label. Among them, the no label type is the label of all other wallet addresses that do not belong to the three types of abnormal address, contract address and exchange large address.

[0009] Step 2: Based on the data information collected in step 1, add several abnormal virtual currency wallet addresses as the initial wallet address nodes to the virtual currency transaction anomaly detection network; then find all the transaction counterparties of the initial wallet address node from the virtual currency transaction flow on the blockchain, select personal wallet addresses or anonymous wallet addresses with less than 10 counterparties and add them to the virtual currency transaction anomaly detection network, and then find the counterparties of these counterparties, and repeat the process until the tenth-order neighbors of the initial wallet address node are added to the virtual currency transaction anomaly detection network, thus completing the construction of the virtual currency transaction anomaly detection network; specifically, it includes:

[0010] Step 2.1: Query the counterparty of each wallet address in the set S0 on the public chain, using the key-value pair M obtained in step 1.3 label Determine whether the opponent's label is a contract address or an exchange's big address. If the opponent's label is a contract address or an exchange's big address, ignore the opponent. Otherwise, add an edge between the opponent and the wallet address, called the original transaction edge. If the opponent is not in set S0, that is, the label is not an abnormal address, add the opponent to set S1. Set S1 is the set of first-order newly added neighbors of all wallet addresses in set S0.

[0011] Step 2.2: Based on the transaction flow database obtained in step 1, query the number of outgoing and incoming counterparties of each wallet address in set S1, and take the wallet addresses with both the number of outgoing and incoming counterparties less than 10 as valid wallet addresses, and expand the first-order new neighbors of set S1; then query the counterparties of each valid wallet address in the transaction flow database, and use the key-value pair M obtained in step 1.3 label Determine whether the opponent's label is a contract address or an exchange's big address. If the opponent's label is a contract address or an exchange's big address, ignore the opponent. Otherwise, add an edge between the opponent and the valid wallet address, also called the original transaction edge. If the opponent is neither in set S0 nor in set S1, add the opponent to set S2. Set S2 is the set of all first-order newly added neighbors of the wallet addresses in set S1, and also the set of second-order newly added neighbors of set S0.

[0012] Step 2.3: Repeat step 2.2 until you get the set S 10 , that is, the set of tenth-order new neighbors of set S0; set S0 to S 10 All nodes of are merged into a large set S, which represents all newly added neighbors within the tenth order of all abnormal wallet addresses;

[0013] Step 2.4: Traverse the key-value pairs M obtained in step 1.1 draw , each key K draw Represents a desensitized ID card number, value V draw Represents K draw The set of wallet addresses of opponents whose owners have initiated withdrawal operations; find the wallet addresses of opponents in the set V draw , and the wallet addresses in the set S, these wallet address sets are recorded as S draw , and then the key-value pair M obtained in step 1.2 register , find the key K draw All registered virtual currency wallet addresses V register , both in the set V register The wallet addresses in the set S are recorded as S register ; Set S draw and set S register Add an edge between each wallet address in the transaction, which represents the actual transaction relationship that has not been reflected in the blockchain public chain flow;

[0014] Step 2.5: Traverse the key-value pairs M obtained in step 1.2 register , each key K register Represents a desensitized ID card number, value V register Representative key K registerThe set of all virtual currency wallet addresses registered by the owner in the exchange; find the address in the set V register In the wallet addresses in set S, an edge is added between each of these wallet addresses, indicating that these wallet addresses belong to the same person. Transactions between them are considered to have occurred, but this will not be reflected in the blockchain public chain flow;

[0015] Step 2.6: Find the largest connected subgraph consisting of all nodes in the set S as the final virtual currency transaction anomaly detection network, denoted as G = (N, E), where N represents the wallet address node in the virtual currency transaction anomaly detection network and E represents the associated edges between wallet addresses.

[0016] Step 3: Combined with the transaction flow database obtained in step 1, calculate the number of counterparties, transaction amount, transaction time, and balance information of each node in the virtual currency transaction anomaly detection network as the transaction features of the virtual currency wallet address; specifically, including:

[0017] For all wallet address nodes N in the virtual currency transaction anomaly detection network G = (N, E) obtained in step 2.6, their 19-dimensional features are extracted according to the information in the transaction flow reservoir, namely, the total number of transactions of each wallet address, the number of transfer-in transactions, the number of transfer-out transactions, the total amount of transfer-in transactions, the total amount of transfer-out transactions, the most recent transaction time, the first transaction time, the current balance, the ratio of the number of transfer-in transactions, the ratio of the total amount of transfer-in transactions, the number of transfer-out counterparties, the number of transfer-out counterparties, the ratio of the number of transfer-in transactions to the total amount of transfer-out transactions, the historical maximum balance, the date of the historical maximum balance, the number of days of the historical maximum balance, the number of days of wallet address use, and the ratio of the number of days of the historical maximum balance to the number of days of wallet address use, and the 19-dimensional features are normalized to the maximum and minimum values.

[0018] Step 4: Divide all nodes in the virtual currency transaction anomaly detection network into training, validation, and test sets at a ratio of 60%, 20%, and 20%, ensuring that the training, validation, and test sets follow the same data distribution. Use the MLP-GCN-GAT model to perform semi-supervised node classification on the virtual currency transaction anomaly detection network, and output the wallet address with the highest anomaly probability that has not yet been discovered, as well as the corresponding anomaly probability. This includes:

[0019] Step 4.1: Construct an MLP-GCN-GAT model, which consists of two layers of multilayer perceptrons (MLPs), one layer of graph convolutional neural network (GCN), and one layer of graph attention network (GAT). First, use the multilayer perceptron (MLP) module to filter the features of the dataset and remove data with little influence. Then, use the graph convolutional neural network (GCN) module to extract features based on the processing power of the graph data. Then, use the MLP module to relearn the data to ensure that the data is fully utilized. Then, import the data into the graph attention network (GAT) module to improve the extraction accuracy of the graph data. Finally, use a linear layer to classify whether it is abnormal.

[0020] Step 4.2: Define the loss function as cross-entropy loss. Calculate and continuously optimize the loss of the model recognition results on the training set through gradient descent to learn the model parameters. Use the model parameters to predict wallet addresses in the validation and test sets. Evaluate the model's ability to identify abnormal virtual currency wallet addresses in the validation and test sets through its performance in four aspects: accuracy, precision, recall, and F1 value.

[0021] Step 4.3: The F1 value represents the overall training effect of the entire model. The F1 value on the validation set is used to determine the performance of the model and adjust the hyperparameters accordingly. After obtaining a set of hyperparameters that can best fit the validation set, the F1 value on the test set is used to evaluate the generalization ability of the model. The F1 values of multiple sets of hyperparameters on the test set are compared and the set with the highest F1 value is selected as the final hyperparameter set for the model, indicating that this set of hyperparameters has the best generalization ability.

[0022] Step 4.4: Use the final parameters of the model to predict whether all unlabeled wallet address nodes in the virtual currency transaction anomaly detection network G are abnormal, and finally output the predicted probability of abnormality through the Softmax function; according to the size of the abnormal probability, the corresponding virtual currency wallet addresses are output in descending order as the key monitoring objects in the subsequent period.

[0023] The function of the present invention is to accurately and efficiently mine more similar abnormal virtual currency wallet addresses based on existing abnormal virtual currency wallet addresses, which helps to effectively manage virtual currency transaction behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A diagram illustrating the structure of the method for implementing the present invention;

[0025] Figure 2 A flowchart of a virtual currency transaction anomaly detection network construction process according to an embodiment of the present invention;

[0026] Figure 3 This is a flowchart of the first-order new neighbor expansion of a valid wallet address in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0028] Example

[0029] See Figure 1 The present invention proposes a method for detecting abnormal virtual currency wallet addresses based on graph neural network, which includes the following steps:

[0030] Step 1: Collect all virtual currency transactions from the public blockchain and store them in the Elasticsearch transaction flow database; collect contract addresses and exchange address information from the blockchain browser and store them in the MySQL address database; store existing abnormal virtual currency wallet addresses in the MySQL address database; obtain withdrawal data and exchange registration information from the exchange and store them in the MongoDB exchange data database. The exchange registration information includes the user's ID number and mobile phone number. As sensitive information, the ID number and mobile phone number are first desensitized using SHA-256 hash encryption before being stored in the exchange data database;

[0031] Step 2: Based on the data information collected in step 1, add several abnormal virtual currency wallet addresses as the initial wallet address nodes to the virtual currency transaction anomaly detection network; then find all the transaction counterparties of the initial wallet address node from the virtual currency transaction flow on the blockchain, select personal wallet addresses or anonymous wallet addresses with less than 10 counterparties and add them to the virtual currency transaction anomaly detection network, and then find the counterparties of these counterparties, and repeat the cycle until the tenth-order neighbors of the initial wallet address node are added to the virtual currency transaction anomaly detection network, completing the construction of the virtual currency transaction anomaly detection network. The specific process is as follows: Figure 2 As shown;

[0032] Step 3: Combined with the transaction flow database obtained in step 1, calculate the number of counterparties, transaction amount, transaction time and balance information of each node in the virtual currency transaction anomaly detection network as the transaction features of the virtual currency wallet address;

[0033] Step 4: Divide all nodes in the virtual currency transaction anomaly detection network obtained in Step 2 into training, validation, and test sets at a ratio of 60%, 20%, and 20%, ensuring that the training, validation, and test sets follow the same data distribution. Use the MLP-GCN-GAT model to perform semi-supervised node classification on the graph and output the wallet addresses that are most likely to be abnormal and have not yet been discovered, as well as the corresponding anomaly probability.

[0034] Furthermore, in this embodiment, in step 1, the virtual currency historical transaction data is processed to construct a virtual currency abnormality data set. The specific process includes:

[0035] Step 1.1: Store the existing 208 abnormal virtual currency wallet addresses in a set form, recorded as S0; load the withdrawal information from the exchange data information database and store it in the form of key-value pairs, recorded as M draw The key is the desensitized ID number, and the value is the set of wallet addresses of opponents whose ID number has initiated withdrawal operations;

[0036] Step 1.2: Read the exchange registration information, which is also stored in the form of key-value pairs, denoted as M register The key is the desensitized ID number, and the value is the set of all virtual currency wallet addresses registered on the exchange of the person to whom the ID number belongs;

[0037] Step 1.3: Get the abnormal wallet address, contract address, and exchange address list from the address information database, and store this data in the form of key-value pairs, denoted as M label , used to determine the label of the wallet address; the key is the wallet address, the value is the label of the address, and the label types include abnormal address, contract address, exchange large address and no label. Among them, the no label type is the label of all other wallet addresses that do not belong to the three types of abnormal address, contract address and exchange large address;

[0038] Furthermore, in this embodiment, in step 2, a virtual currency transaction anomaly detection network is constructed based on abnormal personnel information. The specific process includes:

[0039] Step 2.1: Query the counterparty of each wallet address in the set S0 on the public chain, using the key-value pair M obtained in step 1.3 label Determine whether the opponent's label is a contract address or an exchange's big address. If the opponent's label is a contract address or an exchange's big address, ignore the opponent. Otherwise, add an edge between the opponent and the wallet address, called the original transaction edge. If the opponent is not in set S0, that is, the label is not an abnormal address, add the opponent to set S1. Set S1 is the set of first-order newly added neighbors of all wallet addresses in set S0.

[0040] Step 2.2: Based on the transaction flow database obtained in step 1, query the number of outgoing and incoming counterparties of each wallet address in set S1, and take the wallet addresses with both the number of outgoing and incoming counterparties less than 10 as valid wallet addresses, and expand the first-order new neighbors of set S1; then query the counterparties of each valid wallet address in the transaction flow database, and use the key-value pair M obtained in step 1.3 labelDetermine whether the opponent's label is a contract address or an exchange address. If the opponent's label is a contract address or an exchange address, ignore the opponent. Otherwise, add an edge between the opponent and the valid wallet address, which is also called the original transaction edge. If the opponent is neither in set S0 nor in set S1, add the opponent to set S2. Set S2 is the set of all first-order newly added neighbors of the wallet addresses in set S1, and also the set of second-order newly added neighbors of set S0. The specific process is as follows: Figure 3 As shown;

[0041] Step 2.3: Repeat step 2.2 until you get the set S 10 , that is, the set of tenth-order new neighbors of set S0; set S0 to S 10 All nodes of are merged into a large set S, which represents all newly added neighbors within the tenth order of all abnormal wallet addresses;

[0042] Step 2.4: Traverse the key-value pairs M obtained in step 1.1 draw , each key K draw Represents a desensitized ID card number, value V draw Represents K draw The set of wallet addresses of opponents whose owners have initiated withdrawal operations; find the wallet addresses of opponents in the set V draw , and the wallet addresses in the set S, these wallet address sets are recorded as S draw , and then the key-value pair M obtained in step 1.2 register , find the key K draw All registered virtual currency wallet addresses V register , both in the set V register The wallet addresses in the set S are recorded as S register ; Set S draw and set S register Add an edge between each wallet address in the transaction, which represents the actual transaction relationship that has not been reflected in the blockchain public chain flow;

[0043] Step 2.5: Traverse the key-value pairs M obtained in step 1.2 register , each key K register Represents a desensitized ID card number, value V register Representative key K register The set of all virtual currency wallet addresses registered by the owner in the exchange; find the address in the set V register In the wallet addresses in set S, an edge is added between each of these wallet addresses, indicating that these wallet addresses belong to the same person. Transactions between them are considered to have occurred, but this will not be reflected in the blockchain public chain flow;

[0044] Step 2.6: Find the largest connected subgraph consisting of all nodes in the set S. This is the final virtual currency transaction anomaly detection network, denoted as G = (N, E). N represents the wallet address nodes in the virtual currency transaction anomaly detection network, which has a total of 17,079 nodes, of which 150 have the label type "anomaly"; E represents the associated edges between wallet addresses, which have a total of 23,404 edges, including 21,101 original transaction edges, 2,954 verification edges, and 549 personal edges.

[0045] Furthermore, in this embodiment, in step 3, features are added to each wallet address in the virtual currency transaction anomaly detection network. The specific process includes:

[0046] For all wallet address nodes N in the virtual currency transaction anomaly detection network G = (N, E) obtained in step 2.6, extract their 19-dimensional features based on the information in the transaction flow database, namely, the total number of transactions of each wallet address, the number of transfer-in transactions, the number of transfer-out transactions, the total amount of transfer-in transactions, the total amount of transfer-out transactions, the most recent transaction time, the first transaction time, the current balance, the ratio of the number of transfer-in transactions, the ratio of the total amount of transfer-in transactions, the number of transfer-out counterparties, the number of transfer-out counterparties, the ratio of the number of transfer-in transactions to the total amount of transfer-out counterparties, the historical maximum balance, the date of the historical maximum balance, the number of days of the historical maximum balance, the number of days of the wallet address being used, and the ratio of the number of days of the historical maximum balance to the number of days of the wallet address being used, and perform maximum and minimum value normalization on the 19-dimensional features;

[0047] Furthermore, in this embodiment, the process of predicting the undiscovered abnormal virtual currency wallet address in step 4 includes:

[0048] Step 4.1: Construct an MLP-GCN-GAT model, which consists of two layers of multilayer perceptrons (MLPs), one layer of graph convolutional neural network (GCN), and one layer of graph attention network (GAT). First, use the multilayer perceptron (MLP) module to filter the features of the dataset and remove data with little influence. Then, use the graph convolutional neural network (GCN) module to extract features based on the processing power of the graph data. Then, use the MLP module to relearn the data to ensure that the data is fully utilized. Then, import the data into the graph attention network (GAT) module to improve the extraction accuracy of the graph data. Finally, use a linear layer to classify whether it is abnormal.

[0049] Step 4.2: Define the loss function as cross-entropy loss. Calculate and continuously optimize the loss of the model recognition results on the training set through gradient descent to learn the model parameters. Use the model parameters to predict wallet addresses in the validation and test sets. Evaluate the model's ability to identify abnormal virtual currency wallet addresses in the validation and test sets through its performance in four aspects: accuracy, precision, recall, and F1 value.

[0050] In this embodiment, we hope to minimize the number of missed detections of abnormal wallet addresses and have a high tolerance for misjudgments. Therefore, we modify the F1-score calculation method to give more attention to the recall rate and moderately reduce the importance of the precision rate. The modified F-score calculation formula is:

[0051]

[0052] During the evaluation, β is the weight. The higher the value, the more it can reduce the importance of improving the recall rate and reduce the importance of the precision rate. Therefore, β=5 is selected.

[0053] Step 4.3: The F1 value represents the overall training effect of the entire model. The F1 value on the validation set is used to determine the performance of the model and adjust the hyperparameters accordingly. After obtaining a set of hyperparameters that can best fit the validation set, the F1 value on the test set is used to evaluate the generalization ability of the model. The F1 values of multiple sets of hyperparameters on the test set are compared and the set with the highest F1 value is selected as the final hyperparameter set for the model, indicating that this set of hyperparameters has the best generalization ability.

[0054] Step 4.4: Use the final parameters of the model to predict whether all unlabeled wallet address nodes in the virtual currency transaction anomaly detection network G are abnormal, and finally output the predicted probability of abnormality through the Softmax function; according to the size of the abnormal probability, the corresponding virtual currency wallet addresses are output in descending order as the key monitoring objects in the subsequent period.

[0055] The final model prediction results of this embodiment are shown in Table 1 below:

[0056] Table 1 Model prediction result evaluation table

[0057] Accuracy Precision Recall F1 value 91.72％ 87.76％ 9.42％ 0.6649

Claims

1. A method for detecting abnormal virtual currency wallet addresses based on graph neural networks, characterized in that: The method comprises the following steps: Step 1: Collect all virtual currency transactions from the public blockchain and store them in the Elasticsearch transaction flow database; collect contract addresses and exchange address information from the blockchain browser and store them in the MySQL address database; store existing abnormal virtual currency wallet addresses in the MySQL address database; obtain withdrawal data and exchange registration information from the exchange and store them in the MongoDB exchange data database. The exchange registration information includes the user's ID number and mobile phone number. As sensitive information, the ID number and mobile phone number are first desensitized using SHA-256 hash encryption before being stored in the exchange data database; Step 2: Based on the data information collected in step 1, several abnormal virtual currency wallet addresses are added as the initial wallet address nodes to the virtual currency transaction anomaly detection network; then, all transaction counterparties of the initial wallet address node are found from the virtual currency transaction flow on the blockchain, and personal wallet addresses or anonymous wallet addresses with less than 10 counterparties are selected and added to the virtual currency transaction anomaly detection network. Then, the counterparties of these counterparties are found, and the cycle is repeated until the tenth-order neighbors of the initial wallet address node are added to the virtual currency transaction anomaly detection network, completing the construction of the virtual currency transaction anomaly detection network; Step 3: Combined with the transaction flow database obtained in step 1, calculate the number of counterparties, transaction amount, transaction time and balance information of each node in the virtual currency transaction anomaly detection network as the transaction features of the virtual currency wallet address; Step 4: Divide all nodes in the virtual currency transaction anomaly detection network into training set, validation set, and test set according to the ratio of 60%, 20%, and 20%, respectively, to ensure that the training set, validation set, and test set follow the same data distribution; construct an MLP-GCN-GAT model, which consists of two layers of multi-layer perceptrons (MLP), one layer of graph convolutional neural network (GCN), and one layer of graph attention network (GAT); use the MLP-GCN-GAT model to perform semi-supervised node classification tasks on the virtual currency transaction anomaly detection network, and output the wallet address with the highest anomaly probability that has not been discovered and the corresponding anomaly probability.

2. The abnormal virtual currency wallet address detection method based on graph neural network according to claim 1 is characterized in that: The step 1 specifically includes: Step 1.1: Store the existing abnormal virtual currency wallet addresses in a set form, recorded as S0; load the currency withdrawal information in the exchange data information database and store it in the form of key-value pairs, recorded as M draw The key is the desensitized ID number, and the value is the set of wallet addresses of opponents whose ID number has initiated withdrawal operations; Step 1.2: Read the exchange registration information, which is also stored in the form of key-value pairs, denoted as M register The key is the desensitized ID number, and the value is the set of all virtual currency wallet addresses registered on the exchange of the person to whom the ID number belongs; Step 1.3: Get the abnormal wallet address, contract address, and exchange address list from the address information database, and store this data in the form of key-value pairs, denoted as M label , used to determine the label of the wallet address; the key is the wallet address, the value is the label of the address, and the label types include abnormal address, contract address, exchange large address and no label. Among them, the no label type is the label of all other wallet addresses that do not belong to the three types of abnormal address, contract address and exchange large address.

3. According to claim 1, the abnormal virtual currency wallet address detection method based on graph neural network is characterized in that: The step 2 specifically includes: Step 2.1: Query the counterparty of each wallet address in the set S0 on the public chain, using the key-value pair M obtained in step 1.3 label Determine whether the opponent's label is a contract address or an exchange's big address. If the opponent's label is a contract address or an exchange's big address, ignore the opponent. Otherwise, add an edge between the opponent and the wallet address, called the original transaction edge. If the opponent is not in set S0, that is, the label is not an abnormal address, add the opponent to set S1. Set S1 is the set of first-order newly added neighbors of all wallet addresses in set S0. Step 2.2: Based on the transaction flow database obtained in step 1, query the number of outgoing and incoming counterparties of each wallet address in set S1, and take the wallet addresses with both the number of outgoing and incoming counterparties less than 10 as valid wallet addresses, and expand the first-order new neighbors of set S1; then query the counterparties of each valid wallet address in the transaction flow database, and use the key-value pair M obtained in step 1.3 label Determine whether the opponent's label is a contract address or an exchange's big address. If the opponent's label is a contract address or an exchange's big address, ignore the opponent. Otherwise, add an edge between the opponent and the valid wallet address, also called the original transaction edge. If the opponent is neither in set S0 nor in set S1, add the opponent to set S2. Set S2 is the set of all first-order newly added neighbors of the wallet addresses in set S1, and also the set of second-order newly added neighbors of set S0. Step 2.3: Repeat step 2.2 until you get the set S 10 , that is, the set of tenth-order new neighbors of set S0; set S0 to S 10 All nodes of are merged into a large set S, which represents all newly added neighbors within the tenth order of all abnormal wallet addresses; Step 2.4: Traverse the key-value pairs M obtained in step 1.1 draw , each key K draw Represents a desensitized ID card number, value V draw Represents K draw The set of wallet addresses of opponents whose owners have initiated withdrawal operations; find the wallet addresses of opponents in the set V draw , and the wallet addresses in the set S, these wallet address sets are recorded as S draw , and then the key-value pair M obtained in step 1.2 register , find the key K draw All registered virtual currency wallet addresses V register , both in the set V register The wallet addresses in the set S are recorded as S register ; Set S draw and set S register Add an edge between each wallet address in the transaction, which represents the actual transaction relationship that has not been reflected in the blockchain public chain flow; Step 2.5: Traverse the key-value pairs M obtained in step 1.2 register , each key K register Represents a desensitized ID card number, value V register Representative key K register The set of all virtual currency wallet addresses registered by the owner in the exchange; find the address in the set V register In the wallet addresses in set S, an edge is added between each of these wallet addresses, indicating that these wallet addresses belong to the same person. Transactions between them are considered to have occurred, but this will not be reflected in the blockchain public chain flow; Step 2.6: Find the largest connected subgraph consisting of all nodes in the set S as the final virtual currency transaction anomaly detection network, denoted as G = (N, E), where N represents the wallet address node in the virtual currency transaction anomaly detection network and E represents the associated edges between wallet addresses.

4. The abnormal virtual currency wallet address detection method based on graph neural network according to claim 1 is characterized in that: The step 3 specifically includes: For all wallet address nodes N in the virtual currency transaction anomaly detection network G = (N, E) obtained in step 2.6, their 19-dimensional features are extracted according to the information in the transaction flow reservoir, namely, the total number of transactions of each wallet address, the number of transfer-in transactions, the number of transfer-out transactions, the total amount of transfer-in transactions, the total amount of transfer-out transactions, the most recent transaction time, the first transaction time, the current balance, the ratio of the number of transfer-in transactions, the ratio of the total amount of transfer-in transactions, the number of transfer-out counterparties, the number of transfer-out counterparties, the ratio of the number of transfer-in transactions to the total amount of transfer-out transactions, the historical maximum balance, the date of the historical maximum balance, the number of days of the historical maximum balance, the number of days of wallet address use, and the ratio of the number of days of the historical maximum balance to the number of days of wallet address use, and the 19-dimensional features are normalized to the maximum and minimum values.

5. The abnormal virtual currency wallet address detection method based on graph neural network according to claim 1 is characterized in that: The step 4 specifically includes: Step 4.1: First, use the Multi-Layer Perceptron (MLP) module to filter the features of the dataset and remove data with little influence. Then, use the Graph Convolutional Neural Network (GCN) module to extract features based on the processing power of the graph data. Then, use the MLP module to re-learn the data to ensure that the data is fully utilized. Then, import the data into the Graph Attention Network (GAT) module to improve the extraction accuracy of the graph data. Finally, use the linear layer to classify whether it is abnormal. Step 4.2: Define the loss function as cross-entropy loss. Calculate and continuously optimize the loss of the model recognition results on the training set through gradient descent to learn the model parameters. Use the model parameters to predict wallet addresses in the validation and test sets. Evaluate the model's ability to identify abnormal virtual currency wallet addresses in the validation and test sets through its performance in four aspects: accuracy, precision, recall, and F1 value. Step 4.3: The F1 value represents the overall training effect of the entire model. The F1 value on the validation set is used to determine the performance of the model and adjust the hyperparameters accordingly. After obtaining a set of hyperparameters that can best fit the validation set, the F1 value on the test set is used to evaluate the generalization ability of the model. The F1 values of multiple sets of hyperparameters on the test set are compared and the set with the highest F1 value is selected as the final hyperparameter set for the model, indicating that this set of hyperparameters has the best generalization ability. Step 4.4: Use the final parameters of the model to predict whether all unlabeled wallet address nodes in the virtual currency transaction anomaly detection network G are abnormal, and finally output the predicted probability of abnormality through the Softmax function; according to the size of the abnormal probability, the corresponding virtual currency wallet addresses are output in descending order as the key monitoring objects in the subsequent period.

Images