A blockchain phishing fraud identification method based on a graph neural network

Abstract

The application provides a blockchain phishing fraud identification method based on a graph neural network, transaction data is preprocessed, and the transaction data is processed into a transaction network graph; the transaction network graph is clustered to obtain a global perspective graph; the transaction network graph is sampled to obtain a local perspective graph; a graph neural network is constructed and trained; the global perspective graph is input into the trained graph neural network to obtain node embedding of the global transaction perspective; the node embedding includes structure and edge perspective information of the transaction network; the local perspective graph is input into the trained graph neural network to obtain node embedding of the local transaction perspective; and the node embedding of the global transaction perspective and the node embedding of the local transaction perspective are spliced and input into a multilayer perceptron together to realize classification and identification of the network phishing address. The application improves the identification performance of the Ethereum phishing fraud identification based on data mining of more effective information from the transaction network in multiple transaction perspectives.

Description

Technical Field

[0001] This invention relates to the field of blockchain transaction network phishing address identification technology, and more specifically, to a method for identifying blockchain phishing scams based on graph neural networks. Background Technology

[0002] Popular cryptocurrencies today all rely heavily on blockchain technology. Blockchain is a novel distributed ledger technology that enables trusted transactions without intermediaries in a trustless environment. Compared to traditional database technologies, blockchain boasts features such as anti-counterfeiting, immutability, and smart contract implementation, and is hailed as a technology poised to trigger societal change. To achieve trusted transactions in a distributed environment, blockchain technology extensively utilizes cryptographic techniques to hide user information, while all transaction information is jointly verified and stored by the distributed network. Various public blockchains have attracted a large number of users, accumulating vast amounts of transaction data. This large user base and active user transactions make blockchain-based data analysis an important and valuable research topic.

[0003] With the development of blockchain technology, various industries are adopting it as an underlying technology, inevitably leading to a large amount of data existing in the form of blockchain data. Therefore, research on blockchain-based data analysis has significant theoretical and practical implications. Blockchain-based payment systems offer anonymity and decentralization, but criminals exploit this anonymity for fraudulent activities. The proliferation of scams in blockchain systems hinders user acceptance and use of blockchain technology, thus impeding technological progress. Therefore, identifying abnormal user behavior on blockchain transaction networks has become an urgent and critical issue in the blockchain ecosystem. Phishing scams on transaction networks are a new type of cybercrime that has emerged with the development of blockchain. Phishing scams exploit the anonymity of blockchain to spread rapidly, and relatively lagging legal measures and still-developing data analysis methods have made these illegal activities increasingly rampant.

[0004] Existing methods for identifying phishing scams can be broadly categorized into two types.

[0005] 1) Based on feature engineering, the topological features of the blockchain transaction network are manually analyzed, and statistical features are constructed as input to a machine learning classifier for phishing scam identification. 219 dimensional features based on first-order and second-order wallet nodes are extracted from the transaction graph constructed based on transaction records and used as input to the LightGBM classifier to identify phishing scam transaction addresses.

[0006] 2) Based on random walk graph representation learning methods, DeepWalk and node2vec algorithms are designed to acquire structural information of the graph. node2vec obtains nodes representing transactions and classifies them using a single-class SVM. trans2vec is extended by introducing biased transaction sampling. However, the external encoders of these random walk-based algorithms cannot utilize the feature information of the nodes, thus limiting their performance.

[0007] 3) Based on graph neural network methods, E-GCN is designed based on graph autoencoders. EdgeProp utilizes information from transaction edge features. MCGC uses multiple feature extraction channels of a graph upgrade network to extract features of transaction patterns of target addresses. TTAGN uses temporal edge representation and the edge2node module to effectively identify phishing fraud. However, existing graph neural network-based methods only use node features and cannot fully utilize the structural information of the graph, while the edge features in blockchain transactions are not fully utilized. Summary of the Invention

[0008] To overcome the problem that existing abnormal transaction node identification techniques, such as heuristic shallow embedding and graph neural network identification, cannot fully utilize the structural and edge information of the transaction network, this invention proposes a blockchain phishing fraud identification method based on graph neural networks. This method improves the identification performance of phishing fraud by extracting more effective information from the transaction network through data mining from multiple transaction perspectives.

[0009] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: A method for identifying blockchain phishing scams based on graph neural networks, comprising the following steps: The transaction data is preprocessed into a transaction network diagram. Clustering is performed on the transaction network graph to obtain a global perspective graph; The transaction network diagram is sampled to obtain a local perspective diagram; Construct and train a multi-transaction perspective attention graph neural network; The global view graph is input into a trained multi-transaction view attention graph neural network to obtain the node embedding of the global transaction view; the node embedding includes the structure of the transaction network and edge view information; Inputting the local viewpoint graph into the trained multi-transaction viewpoint attention graph neural network yields the node embeddings of the local transaction viewpoint. The node embeddings from the global transaction perspective and the node embeddings from the local transaction perspective are concatenated and then input into a multilayer perceptron to achieve the classification and identification of phishing addresses.

[0010] Preferably, the transaction network graph is clustered using a clustering function to obtain a global perspective graph, the expression of which is as follows:

[0011] in, This represents the graph clustering function, where c represents the number of clusters. Represents a transaction network diagram; Represents the i-th subgraph generated after clustering. express The set of nodes in the middle express The set of edges in the middle.

[0012] Preferably, the transaction network graph is sampled using a neighbor sampling function to obtain a local viewpoint graph:

[0013] in, Represents a node K-order neighbor nodes, j The node in the graph is represented by K-hop, which means K-hop, i.e., finding K-order neighbors.

[0014] Preferably, the multi-transaction perspective attention graph neural network obtains edge perspective coefficient information by capturing the transaction network through edge features and attention coefficients, and obtains the structural information of the transaction graph by aggregating the features of address nodes.

[0015] Furthermore, the multi-transaction view attention graph neural network is composed of multiple MTvConv blocks; The input to the MTvConv block is a set of input features of nodes. Where N represents the number of nodes, and F represents the dimension of the input MTVGAT feature in each node. This represents the input feature of the i-th dimension; After training, the multi-transaction view attention graph neural network outputs the embedding of each MTvConv block's output node. ,in, F ′ indicates the dimension of the output embedding. This represents the input feature of the i-th dimension; The multi-transaction perspective attention graph neural network described MTvGAT The calculation formula is as follows:

[0016] in, This indicates the input transaction network diagram. Let z represent the adjacency matrix of the input transaction network graph, where z represents the adjacency matrix from the input transaction network graph. MTvGATThe embedding of the target node learned by the last layer MTvConv block.

[0017] Furthermore, the attention coefficient mentioned The calculation formula is as follows:

[0018] in, This represents a learnable weight matrix that transforms input features into high-dimensional features; This represents a shared attention mechanism. This indicates a feature splicing operation.

[0019] Furthermore, the aforementioned side view coefficient It is constructed by concatenating edge features and attention coefficients:

[0020] Each MTvConv block takes node and edge features as input; it is described as follows through the information forward propagation mechanism:

[0021] in, and It is a multilayer perceptron that calculates the output node embedding by splicing the input; This represents a combination of multiple aggregators and scalers; the aggregator aggregates information from its neighbors, and the scaler applies different scaling to the aggregated information. The aforementioned information forward propagation mechanism aggregates information from neighboring nodes in a multi-transaction perspective attention graph neural network to generate new feature vectors. , This represents the l-th layer of the neural network.

[0022] Furthermore, backpropagation of neural networks is used to train a multi-transaction perspective attention graph neural network.

[0023] Furthermore, during the training process, a loss function is used to measure the similarity between the input transaction network graph and the target node; the reconstructed loss function is defined as follows:

[0024]

[0025] in, Describe the L2-norm of a vector. This represents the sigmoid function. , ; The optimization is achieved by minimizing the reconstruction loss in each training iteration, thereby outputting the structure and side-view information of the node learning the transaction network.

[0026] Furthermore, the node embeddings from the global transaction perspective and the node embeddings from the local transaction perspective are concatenated and then input into a multilayer perceptron to achieve the classification and identification of phishing addresses. The formula expression is as follows:

[0027] in, This indicates a splicing operation. This indicates the probability that a node is a phishing address; Represents the global embedding features of nodes, This represents the local embedding features of a node.

[0028] Compared with the prior art, the beneficial effects of the technical solution of the present invention are: This invention processes a large-scale blockchain transaction network into a global view graph and a local view graph, and uses the global view graph and the local view graph as input to a multi-transaction view attention graph neural network to mine multi-layer transaction network information, and outputs node embeddings containing structure and edge information.

[0029] This invention improves the performance of identifying phishing scams by using a multi-transaction perspective attention graph neural network to mine more effective blockchain transaction network information.

[0030] This invention merges edge features and edge view coefficients to integrate topological structure and transaction information, and generates the final node embedding. Attached Figure Description

[0031] Figure 1 This is a flowchart of the blockchain phishing fraud identification method based on graph neural networks according to the present invention.

[0032] Figure 2 This is a system block diagram of the blockchain phishing fraud identification based on graph neural networks of the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention and are used for illustrative purposes only, and should not be construed as limiting the present patent. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0035] Example 1 like Figure 1 As shown, a method for identifying blockchain phishing scams based on graph neural networks is described, and the method includes the following steps: The transaction data is preprocessed into a transaction network diagram. Clustering is performed on the transaction network graph to obtain a global perspective graph; The transaction network diagram is sampled to obtain a local perspective diagram; Construct and train a multi-transaction perspective attention graph neural network; The global view graph is input into a trained multi-transaction view attention graph neural network to obtain the node embedding of the global transaction view; the node embedding includes the structure of the transaction network and edge view information; Inputting the local viewpoint graph into the trained multi-transaction viewpoint attention graph neural network yields the node embeddings of the local transaction viewpoint. The node embeddings from the global transaction perspective and the node embeddings from the local transaction perspective are concatenated and then input into a multilayer perceptron to achieve the classification and identification of phishing addresses.

[0036] This embodiment processes transaction data into a graph structure. ,in, Represents a transaction chart The transaction account node in the middle, Represents a transaction chart The transaction relationships that occur between transaction account nodes in the system.

[0037] For the characteristics of a single trading account node, each trading account node Each has corresponding characteristics Using matrices Let N represent the number of transaction account nodes, and D represent the number of features for each transaction account node. The initial features of a transaction node include the node's in-degree, out-degree, number of transactions associated with the node, the value of all income of the node, the value of all expenditures of the node, the sum of the values ​​of all income and expenditures of the node, the number of neighboring nodes, and the reciprocal of the transaction frequency.

[0038] For each transaction edge Features Using matrices It means that among them Let be the number of transaction edges. The feature number of each transaction edge.

[0039] Based on the characteristics of the entire transaction network graph (including the amount of each transaction edge and the timestamp of each transaction), an adjacency matrix A is used to represent the structure of the entire transaction network graph. Since the relationships between neighboring nodes in the transaction network graph should be undirected, the original directed graph needs to be converted into an undirected graph.

[0040] In a specific embodiment, the transaction network graph is clustered using a clustering function to obtain a global perspective graph, the expression of which is as follows:

[0041] in, This represents the graph clustering function, where c represents the number of clusters. Represents a transaction network diagram; Represents the i-th subgraph generated after clustering. express The set of nodes in the middle express The set of edges in the middle, the parameter c determines the computational complexity.

[0042] In one specific embodiment, the transaction network graph is sampled using a neighbor sampling function to obtain a local viewpoint graph:

[0043] in, Represents a node K-order neighbor nodes, j The node in the graph is represented by K-hop, which means K-hop, i.e., finding K-order neighbors.

[0044] The choice of parameter K should take into account both the computational complexity and the integrity of the node neighbor structure. In this embodiment, all first-order neighbor nodes are selected, and one node is chosen from all first-order neighbor nodes.

[0045] The multi-transaction perspective attention graph neural network (MTvGAT) is an improved attention mechanism based on the graph neural network GAT architecture. The function of the MTVGAT is to map the features of the input nodes into node embeddings with richer information. The node embeddings can be used as inputs to a multilayer perceptron to classify and identify fishing nodes.

[0046] In one specific embodiment, the multi-transaction perspective attention graph neural network obtains edge perspective coefficient information by capturing transaction network through edge features and attention coefficients, and obtains structural information of the transaction graph by aggregating the features of address nodes.

[0047] Furthermore, the multi-transaction view attention graph neural network MTVGAT is composed of multiple MTVConv blocks; The input to the MTvConv block is a set of input features of nodes. Where N represents the number of nodes, and F represents the dimension of the input MTVGAT feature in each node. This represents the input feature of the i-th dimension; After training, the graph neural network MTVGAT outputs the embedding of each MTVConv block. ,in, F ′ indicates the dimension of the output embedding. This represents the input feature of the i-th dimension; In this embodiment, multiple MTvConv blocks are connected to construct a complete MTvGAT network structure. The calculation formula for the multi-transaction view attention graph neural network MTvGAT is as follows:

[0048] in, This indicates the input transaction network diagram. denoted as the adjacency matrix of the input transaction network graph, and z represents the embedding of the target node learned from the last layer MTvConv block of MTVGAT.

[0049] In a specific embodiment, the attention coefficient The calculation formula is as follows:

[0050] in, This represents a learnable weight matrix that transforms input features into high-dimensional features; This represents a shared attention mechanism. This indicates a feature splicing operation.

[0051] In a specific embodiment, the side view coefficient It is constructed by concatenating edge features and attention coefficients:

[0052] Each MTvConv block takes node and edge features as input; it is described as follows through the information forward propagation mechanism:

[0053] in, and It is a multilayer perceptron that calculates the output node embedding by splicing the input; This represents a combination of multiple aggregators and scalers; the aggregator aggregates information from its neighbors, and the scaler applies different scaling to the aggregated information. The aforementioned information forward propagation mechanism aggregates information from neighboring nodes in a multi-transaction perspective attention graph neural network to generate new feature vectors. , This represents the l-th layer of the neural network.

[0054] In one specific implementation, backpropagation of a neural network is used to train a multi-transaction viewpoint attention graph neural network.

[0055] In a specific implementation, a loss function is used during the training process to measure the similarity between the input transaction network graph and the target node; the reconstruction loss function is defined as follows:

[0056]

[0057] in, Describe the L2-norm of a vector. This represents the sigmoid function. , ; The optimization is achieved by minimizing the reconstruction loss in each training iteration, thereby outputting the structure and side-view information of the node learning the transaction network.

[0058] In a specific embodiment, the node embeddings from the global transaction perspective and the node embeddings from the local transaction perspective are concatenated and then input into a multilayer perceptron to achieve the classification and identification of phishing addresses. The formula expression is as follows:

[0059] in, This indicates a splicing operation. This indicates the probability that a node is a phishing address; Represents the global embedding features of nodes, This represents the local embedding features of a node.

[0060] Example 2 Based on the blockchain phishing fraud identification method based on graph neural networks described in Example 1, this example illustrates a specific implementation case of phishing nodes on a blockchain data platform.

[0061] By using transaction data obtained from XBlock and tags of phishing node addresses from Etherscan.io, a graph data structure was constructed using the Python-based DGL library. The initial characteristics of nodes include: in-degree of the node, out-degree of the node, Total_Tx (number of transactions associated with the node), total value of all income of the in-value node, total value of all expenditure of the out-value node, sum of total value of all income and expenditure of the total-value node, Min_TS (minimum timestamp of transactions associated with the node), Max_TS (maximum timestamp of transactions associated with the node), Num_neigh (number of all neighbors of the node), and Tx_Freq (frequency of transactions occurring in the node). The initial characteristics of edges are: amount (amount of the transaction edge's value) and timestamp (timestamp of the transaction).

[0062] Definition of a trading chart: ,in, For transaction chart The transaction account node in the middle, This is a transaction chart. The transaction relationships that occur between transaction account nodes. For the characteristics of an individual transaction account node, each transaction account node... Each has its own characteristics Using matrices Let N represent the number of transaction account nodes, and D represent the number of features for each transaction account node. The initial features of each transaction node include its in-degree, out-degree, number of transactions associated with the node, the value of all its income, the value of all its expenditures, the sum of the values ​​of all its income and expenditures, the number of its neighboring nodes, and the reciprocal of its transaction frequency. For each transaction edge... Features Using matrices It means that among them Let be the number of transaction edges. Let A represent the number of features for each transaction edge, where A represents the initial features of the transaction edges. The features for the entire transaction graph are (the amount of each transaction edge, the timestamp of the transaction). The adjacency matrix A represents the structure of the entire transaction graph. The transaction graph... As input, feature representations of the graph are learned, and the output is node-level. , where F is the number of features output by each node.

[0063] The pseudocode for this embodiment, which uses inputting a transaction graph into a multi-transaction viewpoint attention graph neural network, is as follows:

[0064] Equations (1) and (2) in the pseudocode represent the nodes v Embedding features and neighboring nodes u The embedding features of each neighboring node are obtained by concatenating the embedding features of the target node and the edge view coefficients between the two nodes. Then, the embedding features of the neighboring nodes are combined with those of the target node. v No. k -1 layer feature concatenation obtained v Node number k Embedding features of layers.

[0065] The difference between equations (3) and (4) in the pseudocode and equations (1) and (2) lies in the nodes here. u It is selected from the nodes in the global clustering graph, and the global embedding features of node v are obtained here.

[0066] In the pseudocode, the sampling function is used to randomly sample a certain number of target nodes, learn embedded features from the target nodes, and then perform anomaly detection.

[0067] To further verify the effectiveness of the blockchain phishing scam identification method based on graph neural networks described in this embodiment, the experimental results are as follows:

[0068] The experimental results show that the graph neural network model achieves better performance than DeepWalk and the model using only features. Among the graph neural network models, GAT is the worst, achieving performance similar to DeepWalk. This indicates that relying solely on structural information and node features cannot significantly improve overall performance. MTvGAT achieves the best performance across all metrics, demonstrating the effectiveness of utilizing multi-transaction perspective structural characteristics and edge features.

[0069]

[0070] Analyzing data using multiple transaction perspectives allows for more comprehensive structural information and understanding of relationships between nodes in large-scale transaction networks. On the local perspective dataset, GCN achieved the highest accuracy, while MTVGAT achieved the highest performance across other metrics. This is because MTVGAT can obtain more information from edge features within the local perspective. Looking at the results on the global perspective dataset, GraphSAGE demonstrated high performance because this model is designed for inductive representation learning on large graphs. On the multi-transaction perspective dataset, MTVGAT achieved the highest performance across all metrics and significantly outperformed other models in all areas. This validates the effectiveness of our proposed method in identifying phishing address nodes.

[0071] Example 3 This embodiment, based on the blockchain phishing fraud identification method based on graph neural networks described in Embodiment 1, also provides a blockchain phishing fraud identification system based on graph neural networks, such as... Figure 2 As shown, the system includes a multi-modal input module, a multi-transaction perspective attention graph neural network module, and a phishing fraud detection module; The multi-modal input module is used to preprocess the transaction data into a transaction network graph; to perform clustering processing on the transaction network graph to obtain a global view graph; and to perform sampling processing on the transaction network graph to obtain a local view graph. The aforementioned multi-transaction perspective attention graph neural network is used to construct and train the multi-transaction perspective attention graph neural network; the global viewpoint node embedding and the local viewpoint node embedding are calculated respectively from the global viewpoint graph and the local viewpoint graph of the trained multi-transaction perspective attention graph neural network.

[0072] The phishing fraud detection module is used to concatenate the node embeddings from the global transaction perspective and the node embeddings from the local transaction perspective and input them together into a multilayer perceptron to achieve the classification and identification of phishing addresses.

[0073] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. Those skilled in the art can make other variations or modifications based on the above description. It is neither necessary nor possible to exhaustively describe all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for identifying blockchain phishing scams based on graph neural networks, characterized in that: The method includes the following steps: The transaction data is preprocessed into a transaction network diagram. Clustering is performed on the transaction network graph to obtain a global perspective graph; The transaction network diagram is sampled to obtain a local perspective diagram; Construct and train a multi-transaction perspective attention graph neural network; The global view graph is input into a trained multi-transaction view attention graph neural network to obtain the node embedding of the global transaction view; the node embedding includes the structure of the transaction network and edge view information; The local view graph is input into the trained multi-transaction view attention graph neural network to obtain the node embedding of the local transaction view; the multi-transaction view attention graph neural network is composed of multiple MTvConv blocks; The input to the MTvConv block is a set of input features of nodes. Where N represents the number of nodes, and F represents the dimension of the input features in each node. This represents the input feature of the i-th node; After training, the graph neural network MTVGAT outputs the embedding of each MTVConv block. ,in, F ′ indicates the dimension of the output embedding. Represents the embedding features of the i-th node; The multi-transaction perspective attention graph neural network described MTvGAT The calculation formula is as follows: in, This indicates the input transaction network diagram. represents the adjacency matrix of the input transaction network graph, and z represents the embedding of the target node learned from the last layer MTvConv block of MTVGAT; The node embeddings from the global transaction perspective and the node embeddings from the local transaction perspective are concatenated and then input into a multilayer perceptron to achieve the classification and identification of phishing addresses.

2. The method for identifying blockchain phishing scams based on graph neural networks according to claim 1, characterized in that: The transaction network graph is clustered using a clustering function to obtain a global perspective graph, the expression of which is as follows: in, This represents the graph clustering function, where c represents the number of clusters. Represents a transaction network diagram; Represents the i-th subgraph generated after clustering. express The set of nodes in the middle express The set of edges in the middle.

3. The method for identifying blockchain phishing scams based on graph neural networks according to claim 1, characterized in that: The transaction network graph is sampled using a neighbor sampling function to obtain a local viewpoint graph: in, Represents a node K-order neighbor nodes, j The node in the graph is represented by K-hop, which means K-hop, i.e., finding K-order neighbors.

4. The method for identifying blockchain phishing scams based on graph neural networks according to claim 1, characterized in that: The multi-transaction perspective attention graph neural network described above captures edge perspective coefficient information by using edge features and attention coefficients to capture the transaction network, and obtains the structural information of the transaction graph by aggregating the features of address nodes.

5. The method for identifying blockchain phishing scams based on graph neural networks according to claim 4, characterized in that: The attention coefficient The calculation formula is as follows: in, This represents a learnable weight matrix that transforms input features into high-dimensional features; This represents a shared attention mechanism. This indicates a feature splicing operation.

6. The method for identifying blockchain phishing scams based on graph neural networks according to claim 5, characterized in that: The aforementioned side view coefficient It is constructed by concatenating edge features and attention coefficients: Each MTvConv block takes node and edge features as input; it is described as follows through the information forward propagation mechanism: in, and It is a multilayer perceptron that calculates the output node embedding by splicing the input; This represents a combination of multiple aggregators and scalers; the aggregator aggregates information from its neighbors, and the scaler applies different scaling to the aggregated information. The aforementioned information forward propagation mechanism aggregates information from neighboring nodes in a multi-transaction perspective attention graph neural network to generate new feature vectors. , This represents the l-th layer of the neural network.

7. The method for identifying blockchain phishing scams based on graph neural networks according to claim 6, characterized in that: A multi-transaction perspective attention graph neural network was trained using backpropagation.

8. The method for identifying blockchain phishing scams based on graph neural networks according to claim 7, characterized in that: During training, a loss function is used to measure the similarity between the input transaction network graph and the target node; the reconstruction loss function is defined as follows: in, Describe the L2-norm of a vector. Represents the sigmoid function; The optimization is achieved by minimizing the reconstruction loss in each training iteration, thereby outputting the structure and side-view information of the node learning the transaction network.

9. The method for identifying blockchain phishing scams based on graph neural networks according to claim 7, characterized in that: The node embeddings from the global transaction perspective and the node embeddings from the local transaction perspective are concatenated and then input into a multilayer perceptron to classify and identify phishing addresses. The formula expression is as follows: in, This indicates a splicing operation. This indicates the probability that a node is a phishing address; Represents the global embedding features of nodes, This represents the local embedding features of a node.

Images