Blockchain address-based portrait recognition method, storage medium and electronic device

Abstract

The application provides a blockchain address-based portrait identification method, a storage medium and an electronic device, and the method comprises the following steps: S1, receiving address information to be queried; S2, obtaining historical transaction data and off-chain associated data of the address information to be queried on a blockchain for analysis to obtain a user portrait corresponding to the address information to be queried; and S3, visually displaying the user portrait. The above scheme can fully grasp the transaction state of the blockchain address information to be queried by obtaining the historical transaction data and the off-chain associated data of the address information to be queried on the blockchain for analysis, and then obtaining the user portrait according to the analysis result and visually displaying the user portrait, which is beneficial to the supervisor to grasp the behavior state of each blockchain address and timely supervision and tracking.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchains, in particular to a portrait recognition method based on blockchain addresses, a storage medium and an electronic device. BACKGROUND

[0002] With the development of blockchain technology, the financial system extended by blockchain technology is also constantly improving, and the demand for monitoring blockchain assets for anti-money laundering is particularly important. In the process of tracking and tracing blockchain assets, most of the analysis is still based on traditional blockchain address analysis methods.

[0003] Traditional blockchain address analysis methods include using blockchain browsers or association graphs, clustering analysis, and combining off-chain KYC data, which can obtain the counterparty address of a transaction from a blockchain browser and analyze the basic transfer and source of funds of assets. However, traditional blockchain address analysis methods cannot effectively analyze the behavior of blockchain addresses, and it is even more difficult to depict the user portrait of the address owner, which brings some difficulty to the supervision of blockchain transactions. SUMMARY

[0004] Therefore, it is necessary to provide a portrait recognition technology based on blockchain addresses to solve the problem that the user portrait of the owner of the blockchain address cannot be confirmed, resulting in ineffective supervision of transactions made by each blockchain address.

[0005] To achieve the above-mentioned purpose, in a first aspect, the present application provides a portrait recognition method based on blockchain addresses, comprising the following steps:

[0006] S1: receiving address information to be queried;

[0007] S2: obtaining historical transaction data and off-chain associated data of the address information to be queried on the blockchain for analysis to obtain a user portrait corresponding to the address information to be queried;

[0008] S3: displaying the user portrait in a visual manner.

[0009] In some embodiments, step S1 further comprises receiving currency information to be queried.

[0010] In step S2, "obtaining historical transaction data and off-chain associated data of the address information to be queried on the blockchain for analysis" comprises obtaining historical transaction data and off-chain associated data corresponding to the currency information on the blockchain for analysis.

[0011] In some embodiments, obtaining historical transaction data of the address information to be queried on the blockchain comprises:

[0012] The blockchain data is structurally parsed by a blockchain RPC node and an open-source blockchain ETL parser to obtain blockchain structured data;

[0013] The blockchain structured data is classified according to transaction behavior types, and the classified data is stored as the historical transaction data in a behavior classification data set;

[0014] The historical transaction data is obtained from the behavior classification data set.

[0015] In some embodiments, step S2 is further preceded by step S11:

[0016] It is determined whether there is a behavior classification data set corresponding to the address information to be queried, and if so, step S2 is performed; otherwise, step S12 is performed: the transaction behavior type of the address information to be queried is listed as a normal transfer category, and analysis is performed based on the normal transfer category and off-chain associated data corresponding to the address information to be queried to obtain a user portrait corresponding to the address information to be queried.

[0017] In some embodiments, the user portrait includes time zone information, and the time zone information corresponding to the address information to be queried is determined according to the following manner:

[0018] The operation times of all historical transaction data of the address information to be queried on the blockchain are statistically classified according to time periods in which the operation times are located to determine a number of time periods in which the operation times occur most frequently;

[0019] The time zone information corresponding to the address information to be queried is determined according to the determined time periods.

[0020] In some embodiments, the off-chain associated data includes user information on a third-party software;

[0021] The off-chain associated data is analyzed to obtain the user portrait corresponding to the address information to be queried, including:

[0022] It is determined whether user signature information on the third-party software includes the address information to be queried, and if so, user information on a page where the third-party software is located is captured, and the captured user information is clustered and analyzed to obtain the user portrait corresponding to the address information to be queried.

[0023] In some embodiments, the method further includes:

[0024] Obtain the analysis result of the historical transaction data and off-chain associated data of the address information to be queried on the blockchain, determine the attack level corresponding to the address information to be queried according to the analysis result, and add prompt information in the user portrait displayed when it is determined that the attack level exceeds a predetermined level.

[0025] In some embodiments, the analysis result includes the number of risk label classification data, the matching degree with malicious addresses, and user information on third-party software associated with the address information to be queried.

[0026] According to the comprehensive analysis result, the attack level corresponding to the address information to be queried is determined.

[0027] Different weights are set for different items in the analysis result, a comprehensive score is calculated according to the weights of all items, and the attack level corresponding to the address information to be queried is determined according to the comprehensive score calculated.

[0028] In a second aspect, the application provides a storage medium, wherein the storage medium stores a computer program, and the computer program is executed to implement the method of the first aspect of the application.

[0029] In a third aspect, the application further provides an electronic device, comprising:

[0030] The storage medium is the storage medium of the second aspect of the application.

[0031] The processor is electrically connected with the storage medium, and is used for executing the computer program stored in the storage medium to implement the method of the first aspect of the application.

[0032] Compared with the prior art, the application has the following characteristics:

[0033] The application provides a portrait recognition method based on a blockchain address, a storage medium and an electronic device, and the method comprises the following steps: S1: receiving address information to be queried; S2: obtaining historical transaction data and off-chain associated data of the address information to be queried on the blockchain for analysis, and obtaining a user portrait corresponding to the address information to be queried; and S3: visually displaying the user portrait. The above scheme can fully grasp the transaction state of the blockchain address information to be queried by obtaining the historical transaction data and off-chain associated data of the address information to be queried on the blockchain for analysis, and then obtaining the user portrait according to the analysis result and visually displaying the user portrait, which is beneficial to the supervisor to grasp the behavior state of each blockchain address and timely supervision and tracking. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1A flow chart of the blockchain address-based portrait recognition method according to the first embodiment of the present application;

[0035] Figure 2 A flow chart of the blockchain address-based portrait recognition method according to the second embodiment of the present application;

[0036] Figure 3 A flow chart of the blockchain address-based portrait recognition method according to the third embodiment of the present application;

[0037] Figure 4 A flow chart of the blockchain address-based portrait recognition method according to the fourth embodiment of the present application;

[0038] Figure 5 A schematic diagram of an electronic device according to an embodiment of the present application;

[0039] Figure 6 A flow chart of the blockchain address-based portrait recognition method according to the fifth embodiment of the present application;

[0040] Figure 7 A schematic diagram of a computer program module in a storage medium according to an embodiment of the present application; DETAILED DESCRIPTION

[0041] To explain the possible application scenarios, technical principles, specific schemes that can be implemented, and the purposes and effects that can be achieved of the present application in detail, the following will be described in detail in combination with the specific embodiments listed and the accompanying drawings. The embodiments described in this paper are only used to more clearly illustrate the technical solutions of the present application, and therefore only serve as examples, and cannot limit the protection scope of the present application.

[0042] In this paper, the term "embodiment" means that the specific features, structures or characteristics described in combination with the embodiment can be included in at least one embodiment of the present application. The term "embodiment" appearing at various places in the specification does not necessarily refer to the same embodiment, and does not particularly limit its independence or association with other embodiments. In principle, in the present application, as long as there is no technical contradiction or conflict, each technical feature mentioned in each embodiment can be combined in any way to form a corresponding implementable technical solution.

[0043] Unless otherwise defined, the meaning of the technical terms used in this paper is the same as that generally understood by those skilled in the art to which the present application belongs; the use of related terms in this paper is only for the purpose of describing specific embodiments, and is not intended to limit the present application.

[0044] In the description of the present application, the phrase "and / or" is a description of a logical relationship between objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases: A exists, B exists, and A and B exist at the same time. In addition, the character " / " herein generally represents that the associated objects before and after are an "or" logical relationship.

[0045] In the present application, phrases such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual quantity, primary and secondary, or order relationship between the entities or operations.

[0046] In the present application, without more limitation, the "includes", "contains", "has" or other similar expressions used in the sentence are intended to cover non-exclusive inclusion, and these expressions do not exclude the presence of additional elements in the process, method or product including the elements, so that the process, method or product including a series of elements can not only include those limited elements, but also include other elements not explicitly listed, or also include elements inherent to such process, method or product.

[0047] As the same understanding as in the "Guidelines for Examination", in the present application, the expressions "greater than", "less than", "exceed" and the like are understood as not including the number; the expressions "above", "below", "within" and the like are understood as including the number. In addition, in the description of the embodiments of the present application, the meaning of "multiple" is more than two (including two), and similar expressions related to "multiple" are also understood in this way, for example, "multiple groups", "multiple times" and the like, unless otherwise explicitly limited.

[0048] As Figure 1 shown, in a first aspect, the present application provides a portrait recognition method based on a blockchain address, the method comprising the following steps:

[0049] S1: receiving address information to be queried;

[0050] S2: obtaining historical transaction data and off-chain associated data of the address information to be queried on the blockchain for analysis to obtain a user portrait corresponding to the address information to be queried;

[0051] S3: displaying the user portrait in a visual manner.

[0052] In the present embodiment, the address information to be queried is blockchain address information, preferably an account wallet address. When a regulator believes that a certain blockchain address has the potential threat possibility, if it wants to further understand more behavior information of the blockchain address, the address information to be queried can be input into the search box, so as to be further analyzed and processed subsequently.

[0053] In this embodiment, historical transaction data on the blockchain refers to transaction data that has involved monetary transactions with the address information to be queried. Historical transaction data can be either inbound or outbound transactions.

[0054] Off-chain associated data refers to data outside the blockchain that is associated with the address information to be queried. For example, if a third-party website or software uses the address information to be queried as a personal signature or registers, it can be considered that the third-party website or software is associated with the address information to be queried. Information published on the third-party website or software with the same account ID can be considered as off-chain associated data.

[0055] User profiling refers to the behavioral analysis of the owner of the address information to be queried, including the classification of frequently performed interactive behaviors of the address information, the possibility of attack, daily operating habits (such as operation time and operation time zone), personal information (such as age, photos, etc., which can be obtained by clustering analysis of off-chain related data), etc.

[0056] In this implementation, visualization methods include, but are not limited to, graphical displays, text displays, video displays, and light projection displays. Through visualization, regulators can clearly understand the user profile corresponding to the address information to be queried, thereby enabling more precise supervision and tracking.

[0057] The above solution analyzes the historical transaction data and off-chain related data of the address information to be queried on the blockchain, which can fully grasp the transaction status of the blockchain address information to be queried. Then, based on the analysis results, user profiles can be obtained and visualized, which is conducive to regulators grasping the behavioral status of each blockchain address and carrying out timely supervision and tracking.

[0058] In some embodiments, step S1 further includes: receiving the currency information to be queried; step S2, "obtaining and analyzing the historical transaction data and off-chain related data of the address information to be queried on the blockchain", includes: obtaining and analyzing the historical transaction data and off-chain related data of the address information to be queried corresponding to the currency information on the blockchain.

[0059] Typically, transaction data on the blockchain is categorized by currency information. By inputting currency information and retrieving historical transaction data and off-chain related data of the address to be queried, the analysis results can be made more targeted and accurate.

[0060] like Figure 2 As shown, in some embodiments, obtaining the historical transaction data of the address information to be queried on the blockchain includes:

[0061] First, step S201 enters the structured parsing of blockchain data by a blockchain RPC node and an open source blockchain ETL parsing program, to obtain blockchain structured data;

[0062] Then, step S202 classifies the blockchain structured data according to transaction behavior types, and stores the classified data as the historical transaction data in a behavior classification data set;

[0063] Then, step S203 obtains the historical transaction data from the behavior classification data set.

[0064] In step S201, the blockchain data is structured parsed by a blockchain RPC node and an open source blockchain ETL parsing program, i.e., the data in the RocksDB database is parsed into MySQL data and structured stored, so as to obtain data related to transaction behavior identification, which specifically includes normal transaction details, internal transaction details, Event Logs, etc.

[0065] In step S202, the classification according to transaction behavior types can include: dividing the transaction behavior into interaction behavior with a normal address and interaction behavior with a smart contract address.

[0066] The interaction behavior with a normal address includes but is not limited to: normal transfer, malicious address transfer (identified by malicious address library data), exchange transfer-in / transfer-out transaction, etc.

[0067] The interaction behavior with a smart contract address includes but is not limited to: normal transfer, malicious address transfer, exchange transaction, etc.

[0068] In step S203, when the address information to be queried has the behavior classification data set corresponding thereto stored, the classified blockchain structured data can be obtained as part of the historical transaction data.

[0069] As shown in Figure 3 and Figure 6 Before step S2, step S11 is further included: judging whether there is a behavior classification data set corresponding to the address information to be queried, if yes, step S2 is executed; otherwise, step S12 is executed: listing the transaction behavior type of the address information to be queried as a normal transfer category, and analyzing the off-chain associated data corresponding to the address information to be queried based on the normal transfer category, to obtain the user portrait corresponding to the address information to be queried.

[0070] By judging whether the behavior classification data set corresponding to the address information to be queried is pre-stored, the current address information to be queried can be processed in different categories, so that the user portrait obtained is more accurate.

[0071] As shown in Figure 4 The user portrait includes time zone information, and the time zone information corresponding to the address information to be queried is determined according to the following manner:

[0072] First, step S401 classifies the operation time of all historical transaction data of the address information to be queried on the blockchain according to the time period in which the operation time is located, and determines a plurality of time periods with the highest occurrence frequency;

[0073] Then, step S402 determines the time zone information corresponding to the address information to be queried according to the determined time period.

[0074] Further, the operation time of all historical transaction data of the address information to be queried on the blockchain can be used as a basic data source, and the time zone in which the operator of the address information to be queried is located can be determined by recognizing the time zone algorithm, and then the location of the address operator is determined. For example: the active time of a transfer transaction of an address to be queried is concentrated in 2:10AM (UTC)~13:50PM (UTC), which corresponds to UTC+8, i.e. 10:10AM~21:50PM, and the time zone of the operator of the address information to be queried is UTC+7~UTC+9.

[0075] In some embodiments, the off-chain association data includes user information on a third-party software; analyzing the off-chain association data, obtaining the user portrait corresponding to the address information to be queried includes: judging whether the user signature information on the third-party software appears the address information to be queried, if yes, grabbing the user information of the page where the third-party software is located, and performing clustering analysis on the grabbed user information to obtain the user portrait corresponding to the address information to be queried.

[0076] For example, the association can be made through OSINT open source intelligence information, and some Twitter users or some DeFi project participants are associated to obtain more information of the owner of the locked address. For example: some Twitter users use their own nicknames as blockchain ENS resolution addresses, and more information of the Twitter user can be associated according to the ENS resolution address. More information such as image information or text information can be captured from the Twitter interface of the Twitter user, and the age (usually the nickname note is filled in), preferences (the user can be determined to be a sports enthusiast by analyzing the text or pictures on the page, for example, the text or photos of climbing or fitness frequently appear), photos (collect all portrait photos on the page, and determine which person is the operator account by combining the text of the photos published at the time) and the like of the user can be analyzed.

[0077] In some embodiments, the method further comprises: obtaining analysis results of historical transaction data and off-chain associated data of the address information to be queried on the blockchain, determining an attack level corresponding to the address information to be queried according to the analysis results, and adding prompt information in the user portrait displayed when it is determined that the attack level exceeds a predetermined level.

[0078] The prompt information includes text prompt information, picture prompt information, pop-up prompt information, video prompt information and the like. By determining the attack level corresponding to the address information to be queried, the transaction of the address information with high attack level can be monitored in advance, and the security of the transaction is improved.

[0079] For example, when it is determined that a certain address information to be queried has a high attack level, when the address information initiates a certain transaction request next time, the application will perform pre-execution on the current transaction data and construct blocking transaction information, and block the transaction data of the calling smart contract of the current address information according to the blocking transaction information. Specifically, it includes:

[0080] According to the address calling sequence information (the sequence of the account addresses called in the execution process of the current transaction data), each transaction account address information in the pre-execution of the current transaction data is replaced, so that the address with high attack level is separated from each transaction account address information called in the pre-execution of the current transaction data, and the blocking transaction information controlled by the node program is constructed, and the transaction data of the calling smart contract of the current is blocked according to the blocking transaction information, thereby greatly improving the security of the transaction.

[0081] In some embodiments, the analysis result includes the number of risk label classification data, the matching degree with malicious addresses, and user information on a third-party software associated with the address information to be queried; and determining the attack level corresponding to the address information to be queried according to the comprehensive analysis result includes setting different weights for different items in the analysis result, calculating a comprehensive score according to the weights of all items, and determining the attack level corresponding to the address information to be queried according to the calculated comprehensive score.

[0082] In short, for the determination of the attack level, in addition to considering whether a certain address information has historical attack behavior on the blockchain (if it exists, it can be listed as a malicious address, and the attack level is directly adjusted to the highest, higher than the preset level), the off-chain associated data corresponding to the address information to be queried can also be considered for comprehensive judgment, and the attack level can be calculated by setting different weights for different items, so that the calculation of the attack level is more accurate.

[0083] In a second aspect, the present application also provides a storage medium having a computer program stored therein, wherein the computer program is executed to implement the method of the first aspect of the present application.

[0084] In a third aspect, as shown in the first aspect, Figure 5 The present application also provides an electronic device 10, including a storage medium 102 and a processor 101, the storage medium 102 is the storage medium of the second aspect; the processor 101 is electrically connected with the storage medium 102, and is used for executing the computer program stored in the storage medium to implement the method of the first aspect.

[0085] Preferably, the electronic device can be a computer device, including but not limited to: personal computer, server, general-purpose computer, special-purpose computer, network device, embedded device, programmable device, smart mobile terminal, smart home device, wearable smart device, vehicle-mounted smart device, etc. The storage medium includes but is not limited to: RAM, ROM, magnetic disk, magnetic tape, optical disc, flash memory, U disk, mobile hard disk, memory card, memory stick, network server storage, network cloud storage, etc. The processor includes but is not limited to CPU (central processing unit), GPU (graphics processor), MCU (microprocessor), etc.

[0086] By analyzing the behavior of the blockchain address and portrait recognition, the present application can globally depict the user portrait of the owner of the address information to be queried, which contains the behavior analysis of the address, the time zone analysis and the open source associated information (i.e. third-party software or website), thereby improving the dimension and information of the blockchain address analysis. The scheme of the present application can timely find the associated information of the address to be measured (i.e. the address information to be queried) on and off the chain, further expanding the dimension of the blockchain address supervision and anti-money laundering.

[0087] In particular, as shown in Figure 7 The computer program implementing the method of the present application can be divided into a data layer and an application layer. The data layer obtains blockchain data through a blockchain RPC node and a blockchain ETL analysis program and stores it in a database, and uses an automatic script program to collect and classify off-chain associated data, including: Twitter and address associated data, address label data, transaction behavior analysis data, risk label classification data, and malicious address data (such as the association between a Twitter account and a blockchain ENS address, exchange address labels, public hacking event malicious addresses, etc.). The application layer provides services through a backend program based on the data provided by the data layer, and ultimately obtains the analysis result report of the behavior analysis and portrait recognition.

[0088] Although the above embodiments have been described, those skilled in the art can make further changes and modifications to these embodiments once they know the basic creative concept, so the above is only an embodiment of the present application and does not limit the patent protection scope of the present application. Any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A blockchain address-based portrait recognition method, characterized in that, The method comprises the following steps: S1: receiving address information to be queried; S2: obtaining historical transaction data and off-chain associated data of the address information to be queried on the blockchain for analysis to obtain a user portrait corresponding to the address information to be queried; S3: visually displaying the user portrait; The off-chain associated data includes user information on a third-party software; The analysis of the off-chain associated data includes: determining whether the user signature information on the third-party software includes the address information to be queried, if so, capturing user information on the page where the third-party software is located, and performing cluster analysis on the captured user information to obtain the user portrait corresponding to the address information to be queried; The method further comprises: obtaining an analysis result of the historical transaction data and the off-chain associated data of the address information to be queried on the blockchain, determining an attack level corresponding to the address information to be queried according to the analysis result, and when it is determined that the attack level exceeds a predetermined level, when the address information initiates a transaction request with a smart contract again, performing pre-execution on current transaction data and constructing blocking transaction information, and blocking transaction data of a smart contract called by the current address information according to the blocking transaction information, specifically including: replacing each transaction account address information when the current transaction data is pre-executed according to the order of account addresses called in the current transaction data execution process, so that the current address information is separated from each transaction account address information called when the current transaction data is pre-executed, a blocking transaction information controlled by a node program is constructed, and the transaction data of the called smart contract is blocked according to the blocking transaction information. 2.The blockchain address-based portrait identification method of claim 1, wherein, Step S1 further comprises: receiving currency information to be queried; In step S2, "obtaining historical transaction data and off-chain associated data of the address information to be queried on the blockchain for analysis" includes: obtaining historical transaction data and off-chain associated data corresponding to the currency information on the blockchain for analysis. 3.The blockchain address-based portrait identification method of claim 1 or 2, wherein, Obtaining historical transaction data of the address information to be queried on the blockchain includes: structurally parsing blockchain data through a blockchain RPC node and an open-source blockchain ETL parsing program to obtain blockchain structured data; classifying the blockchain structured data according to transaction behavior types, and storing the classified data as the historical transaction data into a behavior classification data set; obtaining the historical transaction data from the behavior classification data set. 4.The blockchain address-based portrait identification method of claim 3, wherein, Step S2 further comprises step S11: determining whether there is a behavior classification data set corresponding to the address information to be queried, if so, performing step S2; otherwise, performing step S12: listing the transaction behavior type of the address information to be queried as a normal transfer category, and analyzing the off-chain associated data corresponding to the address information to be queried based on the normal transfer category to obtain a user portrait corresponding to the address information to be queried. 5.The blockchain address-based portrait identification method of claim 1 or 2, wherein, The user portrait includes time zone information, and time zone information corresponding to the address information to be queried is determined according to the following manner: According to the time period in which the operation time is located, the operation time of all historical transaction data of the address information to be queried on the blockchain is statistically classified to determine a plurality of time periods with the highest occurrence frequency; According to the determined time period, the time zone information corresponding to the address information to be queried is determined. 6.The blockchain address-based portrait identification method of claim 1 or 2, wherein, The method further comprises: When it is determined that the aggressiveness level exceeds a predetermined level, adding prompt information in the displayed user portrait. 7.The blockchain address-based portrait identification method of claim 6, wherein, The analysis result includes the number of risk label classification data, the matching degree with the malicious address, and the user information on the third-party software associated with the address information to be queried; According to the comprehensive analysis result, determining the aggressiveness level corresponding to the address information to be queried comprises: Different weights are set for different items in the analysis result, a comprehensive score is calculated according to the weights of all items, and the aggressiveness level corresponding to the address information to be queried is determined according to the calculated comprehensive score.

8. A storage medium, characterized by The storage medium stores a computer program, and the computer program is executed to implement the method of any one of claims 1 to 7.

9. An electronic device, comprising: Comprise: The storage medium is the storage medium of claim 8; The processor is electrically connected with the storage medium and is used for executing the computer program stored in the storage medium to implement the method of any one of claims 1 to 7.

Images