A method and device for detecting malicious behavior in blockchain

Abstract

This invention discloses a method and apparatus for detecting malicious behavior in blockchain, the method comprising: constructing a transaction graph G of the blockchain. trans The method involves pre-calculating the transition probability π of each edge based on the node attribute set to form a transaction graph with transition probabilities, and calculating the node embedding features of each node in the transaction graph. These node embedding features are then classified to obtain address nodes exhibiting malicious behavior. This invention integrates network structure, pure semantics, and hybrid temporal features, eliminating interference from complex on-chain record information while preserving the complete malicious chain without loss, thereby improving detection accuracy, recall, and F1 score.

Description

Technical Field

[0001] This invention relates to the field of computer network security, and is used to detect malicious behavior on a blockchain. More specifically, it is a method and apparatus for detecting malicious behavior on a blockchain. Background Technology

[0002] Blockchain has become a new type of infrastructure. Its high level of attention, large volume of fund transfers, wide range of business applications, and the inherent anonymity and untraceability of the technology have attracted a large number of attackers.

[0003] With the development of artificial intelligence and big data, there are increasingly more methods for anomaly detection using machine learning. In the early stages of blockchain development, unsupervised machine learning methods were often used, combining attack data constructed by researchers to extract features of potential malicious behavior on the blockchain for anomaly detection. These methods typically used data directly obtainable from the blockchain (such as amounts, transaction fees, etc.) and network features (in-degree, out-degree, etc.) as algorithm input, but their accuracy was low, and the extracted features might not include information about potential abnormal behavior. As research on on-chain behavior deepened, researchers increasingly used supervised machine learning algorithms, employing accumulated labeled datasets. During the algorithm's classification process, data directly recorded on the blockchain was extracted based on feature importance. However, this method is less likely to obtain high-order information about behavioral features.

[0004] On-chain behavior is well-suited for modeling as a graph structure, and subsequent research on chain behavior feature extraction is largely based on graph representation learning. Generally, chain behavior feature extraction methods using graph representation learning can be divided into two categories: structure-based graph representation learning algorithms and attribute-integrated graph representation learning algorithms. Structure-based algorithms only include information about the graph structure while ignoring semantic information, while attribute-based algorithms are more sensitive to the structure of the network graph. Although some work has been done, the adaptability of the methods used to malicious on-chain behavior needs improvement.

[0005] Due to the high degree of concealment, dynamic and diverse methods of on-chain fraud, and its continuous upgrades based on underlying technical vulnerabilities, the completeness of the behavioral chain extraction is low, and the discovery of intermediate gray nodes is limited. Current research mainly focuses on simple data-level analysis. Moreover, the blockchain contains massive amounts of data, and fraudulent activities carry a large amount of high-dimensional information, making it difficult to accurately and effectively extract behavioral features. Current detection systems need improvement in terms of speed and accuracy, and there is a lack of efficient automated detection systems for real-world scenarios. Summary of the Invention

[0006] This invention proposes a method and device for detecting malicious behavior in blockchain, which can characterize high-dimensional information of blockchain node interactions and accurately extract behavioral features. It has improved upon previous methods in terms of accuracy, recall, F1 score, speed, and scalability.

[0007] To achieve the above objectives, the specific technical solution adopted by the present invention is as follows:

[0008] A method for detecting malicious behavior in blockchain, comprising the following steps:

[0009] Constructing the blockchain transaction graph G trans = (V, E, F), where V represents the set of nodes obtained from the address nodes based on the blockchain, E represents the set of edges obtained from the transactions between any two address nodes, and F represents the set of node attributes;

[0010] Based on the node attribute set, the transition probability π of each edge is pre-calculated to form a transaction graph with transition probabilities. And calculate the transaction graph The node embedding features of each node in the data;

[0011] The node embedding features are classified to obtain address nodes with malicious behavior.

[0012] Furthermore, the node attributes include: network structure attributes, purely semantic attributes, and hybrid temporal attributes;

[0013] The network structure attributes include: in-degree ratio D(n) and malice level E(n), where n represents a node and n∈V;

[0014] The purely semantic attributes include: total transaction amount A(n) and total number of transactions R(n);

[0015] The mixed time attribute includes: maximum timestamp. n And the decomposition factor Nty(n).

[0016] Furthermore, the degree of malice The splitting factor Max represents the maximum daily balance of address node n, and Min represents the minimum daily balance of address node n.

[0017] Further, the pre-calculation of the transition probability π for each edge based on the node attribute set includes:

[0018] Set the offset parameter α for network structure attributes, the offset parameter β for pure semantic attributes, and the offset parameter γ for mixed temporal attributes, respectively;

[0019] Calculate the transition probability from the current node v to the next node n before normalization. Among them, Pr D Pr represents the transition probability from the current node v to the next node n, considering only the in-degree ratio D(n). EPr represents the transition probability from the current node v to the next node n, considering only the degree of malice E(n). A Pr represents the transition probability from the current node v to the next node n, considering only the total transaction amount A(n). R Pr represents the transition probability from the current node v to the next node n, considering only the total number of transactions R(n). T This represents the probability of transitioning from the current node v to the next node n, considering only the transaction time. Let Nty(n) represent the transition probability from the current node v to the next node n when only considering the splitting factor Nty(n), where v∈V and ω represents the graph weight;

[0020] For the transition probability π vn After normalization, the transition probability π is obtained.

[0021] Furthermore, the transition probability Nbr v Represents the set of neighboring nodes of node v; transition probability.

[0022] Furthermore, the calculation of the on-chain transaction graph The node embedding features of each node include:

[0023] Based on the transition probability π in the transaction graph Alias ​​sampling with biased walk is performed to obtain the behavioral process sequence;

[0024] The sequence of behavioral processes is one-hot encoded;

[0025] Based on the context size and dimension of one-hot encoding, a stochastic gradient descent algorithm is used to maximize the likelihood function of the Skip-Gram model in order to obtain the optimal mapping function.

[0026] Obtain the transaction graph based on the optimal mapping function. The node embedding features of each node in the process.

[0027] Furthermore, the classification of the node embedding features to obtain address nodes with malicious behavior includes:

[0028] The address of a malicious website is selected as the central address for derivation to construct a sample transaction graph G′. trans ;

[0029] According to the sample transaction diagram G′ trans Calculate the sample transaction graph The sample node embedding features of each node in the data;

[0030] Based on sample transaction graphs The sample node embedding features of each node are used to perform supervised machine learning training to obtain a classification model;

[0031] The node embedding features are classified based on the classification model to obtain address nodes with malicious behavior.

[0032] Furthermore, the machine learning method includes: random forest.

[0033] A storage medium storing a computer program, wherein the computer program performs any of the methods described above.

[0034] An electronic device includes a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform any of the methods described above.

[0035] The inventiveness of this invention compared to the prior art lies in:

[0036] 1) The graph construction method of the present invention, by utilizing the life cycle and risk identification points of malicious behavior in the blockchain, retains as much on-site data of malicious behavior as possible compared with the current blockchain graph construction methods and systems, and preserves the complete malicious chain without loss in the intermediate process, forming blockchain transaction graph data that can be used for automated detection training after pruning, thus laying a good data foundation for the accuracy of the classifier.

[0037] 2) To achieve more accurate automated detection, this invention proposes an attribute extraction method and system that integrates network structure, pure semantics, and mixed temporal attributes. This attribute extraction method can be adapted to blockchain abnormal behaviors with similar risk identification points. Compared with other blockchain attribute extraction methods, the method of this invention eliminates the interference of complicated on-chain record information, directly targets the attributes affected by malicious behavior, and improves the accuracy, recall rate, and F1 score of detection. Attached Figure Description

[0038] Figure 1 This is an overall flowchart of the malicious behavior detection method on the blockchain based on graph embedding in this invention.

[0039] Figure 2 This is a schematic diagram of the blockchain transaction graph construction process based on the entire process of on-chain fraud in this invention.

[0040] Figure 3 This is a flowchart of the graph embedding algorithm for feature extraction and detection based on on-chain malicious behavior risk identification points in this invention.

[0041] Figure 4A This is a diagram showing the impact of network structure offset parameters on model performance in this invention.

[0042] Figure 4B This is a diagram showing the impact of the pure semantic offset parameter on the model performance in this invention.

[0043] Figure 4C This is a diagram showing the effect of the hybrid time offset parameter on the model performance in this invention.

[0044] Figure 4D This is a diagram showing the impact of node embedding output dimension on model performance in this invention.

[0045] Figure 4E This is a diagram showing the impact of context size on model performance in this invention.

[0046] Figure 4F This is a diagram showing the effect of single-step sampling length on model performance in this invention.

[0047] Figure 4G This is a graph showing the impact of the number of sampling steps per node on the model performance in this invention.

[0048] Figure 5 This is a graph showing the efficiency results of the method proposed in this invention on the dataset constructed in this invention. Detailed Implementation

[0049] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the core technology of the present invention will be further described in detail below with reference to the accompanying drawings and examples.

[0050] This invention proposes a method and apparatus for detecting malicious behavior on blockchain. The method, based on publicly available and tamper-proof data on the blockchain, structures the interaction behavior graph between addresses, prunes the massive amount of data on the blockchain to retain as much malicious behavior data as possible, and preserves the complete malicious chain. Feature extraction and detection are then performed on the graph. Based on the differences in the lifecycle of fraudulent behavior and risk identification points on the blockchain, a feature extraction method based on graph embedding technology is proposed, integrating three types of attributes: network structure attributes, pure semantic attributes, and mixed temporal attributes, to obtain the embedded features of addresses. Finally, using the obtained address embedding features, supervised machine learning techniques using random forests are employed to detect malicious behavior on the blockchain, achieving good detection results with improvements in precision, recall, F1 score, speed, and scalability.

[0051] The blockchain malicious behavior detection method of the present invention mainly consists of three parts: blockchain transaction graph construction based on the entire process of on-chain fraud, graph embedding algorithm feature extraction based on on-chain malicious behavior risk identification points, and on-chain malicious behavior detection based on graph embedding features. Figure 1 As shown, steps 100-300 are included.

[0052] Step 100: Constructing a blockchain transaction graph based on the entire process of on-chain fraud, mainly including seed data acquisition, finding and fixing the details of malicious behavior to form an expanded transaction graph.

[0053] This step ultimately forms a directed homogeneous graph representing the interaction patterns between blockchain addresses. By comparing blockchain fraud and malicious behavior disclosed in three intelligence databases (Cryptoscamdb, Etherplorer, and Etherscan), if an address is marked as malicious by more than two websites, that address is selected as the central address for subsequent derivations. All transactions within a certain period from Etherscan are obtained as the first hop from the central address. The label L=1 of the central address node and the attribute F={n} obtained from processing its transaction information within a certain period are also considered. out n in balance max balance min R(n), A(n), timestamp n The seed dataset is formed by {D(n), E(n), Nty(n)}, which contains as many details and processes of malicious behavior as possible. This data is then used for derivation, ultimately forming an expanded dataset. During derivation, if a node reaches an exchange, a mixing service, has no subsequent output, or has completed 10 hops in a given hop, the derivation stops. Otherwise, all nodes in the new hop become the new central address for subsequent derivation, ultimately resulting in graph G. trans = (V, E, F), where V represents the address node, E = {(v1, v2); v1, v2 ∈ V} represents a transaction (including contract calls, transfer transactions, etc.), and F is a node attribute, including the out-degree n over a certain period of time. out in-degree n in Daily maximum balance max Daily minimum balance min Total number of transactions R(n), total transaction amount A(n), maximum timestamp n In-degree ratio D(n), malice level E(n), and splitting factor Nty(n).

[0054] In one example, the aforementioned period represents a time period during which node transaction activity is frequent, i.e., the period during which the number of transactions within a day is greater than the number of transactions within a day. If there are multiple periods, the period with the longest duration, i.e., the period with the longest duration within a day, is selected.

[0055] In one example, the in-degree ratio of a node is defined as: Where n represents a node, n outIndicates the out-degree of a node, n in Indicates the in-degree of a node.

[0056] In one example, node malice is defined as: Where n represents a node.

[0057] In one example, when testing a target blockchain, one can first identify malicious nodes in the target blockchain based on an intelligence database.

[0058] In one example, the splitting factor is defined as: Where n represents a node.

[0059] In one example, such as Figure 2 As shown, step 100 includes steps 110-140:

[0060] Step 110: Seed data acquisition.

[0061] This example uses a dataset V of disclosed malicious addresses obtained after comparing intelligence from multiple sources. evil Defines the maximum number of generation steps, max_generate_step, which defaults to 10. The current step is step = 0. This is used to generate steps in V. evil Expand outwards from the center to obtain the transaction connection edge E of the intermediate node and the on-chain record attribute F.

[0062] Step 120: First identification and fixation of the details of the malicious behavior process.

[0063] This example iterates through dataset V. evil Find V from the chain evil For each address corresponding to a transaction, add the address from the transaction to node V in the graph, forming an edge E with the original node (ignore duplicates). Extract and calculate the attribute F = {n} from the transaction information. out n in balance max balance min R(n), A(n), timestamp n ,D(n),E(n),Nty(n)}.

[0064] Step 130: Second search and fixation of the details of malicious behavior process, completing dataset V evil After traversing the graph, if the current step number is greater than max_generate_step, then return the final constructed graph G. trans= (V, E, F), where V represents the address node, E = {(v1, v2); v1, v2 ∈ V} represents the transaction (including contract calls, transfer transactions, etc.), and F is a node attribute. Skip step 140; otherwise, determine whether the transaction address obtained in the current step contains an exchange, a coin mixing service, or has no output. If it does, halt the process; otherwise, iterate through all the addresses txs contained in the transactions of the current step. step .address, find all txs from the chain step For the transaction corresponding to .address, add the address in the transaction to node V in the graph, forming an edge E with the original node in the graph (if there is a duplicate, ignore it), and obtain and calculate the attribute F defined in the content of invention 1 from the transaction information.

[0065] Step 140: After completing the traversal of the set of addresses contained in all transactions in the current step, step += 1, and return to step 130.

[0066] This completes the expanded transaction chart.

[0067] Step 200: Feature extraction based on graph embedding algorithm for identifying on-chain malicious behavior risk points.

[0068] The "risk identification point" in this invention refers to: total number of transactions R(n), total transaction amount A(n), and maximum timestamp. n The parameters are: in-degree ratio D(n), maliciousness E(n), and splitting factor Nty(n). The goal of this step is to learn the node mapping function f. Where d is the dimension, used to obtain the final node embedding features. First, using the graph constructed in step 100, the transition probabilities of each node in the graph are pre-calculated according to the defined transition probabilities. Then, based on the transition probabilities, biased walk Alias ​​sampling is performed on the graph to obtain the behavioral process sequence. The sampled sequence is then used with a Skip-Gram model to maximize the likelihood function of the model, i.e. The optimal mapping function is obtained, and its node embedding features are learned.

[0069] In one example, the transition probability is calculated as follows:

[0070]

[0071] Where s i π represents the i-th node in the sampled sequence. vn Z represents the transition probability from the current node v to the next node n before normalization, and Z represents the normalization constant.

[0072] In one example, the transition probability π from the current node v to the next node n before normalization. vnThe calculation method is as follows

[0073]

[0074] Where ω represents the weight of the graph (set to 1 if it does not exist); Pr D Pr E Pr A Pr R Pr T , , respectively, represent the unnormalized transition probability of the current node v moving to the next node n when only considering the in-degree ratio, malice level, total transaction amount, total number of transactions, transaction time, and splitting factor; α represents the offset parameter for balancing network structural attributes (in-degree ratio, malice level), β represents the offset parameter for balancing pure semantic attributes (total transaction amount, total number of transactions), and γ represents the offset parameter for balancing mixed temporal attributes (transaction time, splitting factor).

[0075] In one example, let Nbr v Represents the set of neighboring nodes of the current node v:

[0076] 1) Considering only the in-degree ratio, the unnormalized transition probability of the current node v moving to the next node n.

[0077] 2) Considering only malice level, the unnormalized transition probability of the current node v moving to the next node n.

[0078] 3) Considering only the total transaction amount, the unnormalized transition probability of the current node v moving to the next node n.

[0079] 4) Considering only the total number of transactions, the unnormalized transition probability of the current node v moving to the next node n.

[0080] 5) Considering only transaction time, the unnormalized transition probability of the current node v moving to the next node n. in Mid(x) represents the median of x.

[0081] 6) Considering only the splitting factor, the unnormalized transition probability of the current node v to the next node n.

[0082] In one example, such as Figure 3 As shown, step 200 includes steps 210-230:

[0083] Step 210: Based on the on-chain transaction graph and the optimized parameters α, β, and γ, pre-calculate the transition probability of each edge according to the transition probability calculation method defined in the invention, thus forming an on-chain transaction graph with transition probabilities.

[0084] Step 220: Based on the on-chain transaction graph with transition probabilities The number of samples r for a single node and the sampling step size l are determined using Alias ​​sampling technology. The biased sampling sequence is formed to obtain the behavioral process sequence.

[0085] Step 230: By performing one-hot encoding on the behavioral process sequence, and based on the context size k and dimension d, the stochastic gradient descent algorithm is used to maximize the likelihood function of the model, i.e. We obtain the optimal mapping function f and learn its node embedding features f(v), where v∈V.

[0086] Thus, the embedding features f(v) of all nodes, v∈V, are obtained.

[0087] Step 300: On-chain malicious behavior detection.

[0088] This step uses supervised machine learning to classify node embedding features, thereby enabling the detection of new malicious behaviors. For example... Figure 3 As shown, steps 310-370 are included.

[0089] Step 310: Perform bootstrap sampling with replacement. Let the total number of samples (node ​​embedding features f(v), v∈V and node labels) be N. Use a single decision tree to extract n samples with replacement from the total samples as training samples for the single decision tree.

[0090] Step 320: Select m features from the d-dimensional graph embedding features, where m << d, and split them at each node of each decision tree. Select the optimal split from the m input features (measured by information gain and Gini index). m remains unchanged during the construction of a single tree.

[0091] Step 330: Continue splitting until all training examples at a certain node belong to the same class, at which point the single decision tree is trained and a single weak classifier is formed.

[0092] Step 340: t decision trees, each decision tree outputs a category l i ∈L, i∈[1, t], L={0, 1}.

[0093] Step 350: Form a random forest from t decision trees. Calculate the number of trees that output 0 as num0 and the number of trees that output 1 as num1. If num0 ≥ num1, output 0; otherwise, output 1.

[0094] At this point, the Random Forest (RF) classifier training is complete.

[0095] Step 360: Randomly select K blocks and repeat steps 100 and 200 to obtain a new transaction network graph G′. trans = (V′, E′, F′) and its node embedding features f′(v′), v′∈V′.

[0096] Step 370: Using the Random Forest RF trained in Step 350, obtain the labels l of nodes in K randomly selected blocks, where 1 indicates anomaly and 0 indicates normal behavior, in order to detect new malicious behavior on the blockchain.

[0097] This invention also discloses a blockchain malicious behavior detection device, including a graph construction module, a feature extraction module, a classifier training module, and a behavior detection module, comprising the following steps:

[0098] Step 100, Graph Construction Module. Specific steps include:

[0099] Step 110: Using Python's request and json libraries for web scraping, extract all malicious addresses from three blockchain intelligence databases (Crytoscamdb, Etherplorer, and Etherscan) and store them in... middle.

[0100] Step 120: Use Python's pandas library to compare... A malicious address that appeared more than twice was extracted and used to form V. evil Mark V evil All nodes in the dataset are labeled L=1. V is crawled from Etherscan. evil The transaction information within a certain period is processed using Python's networkx library to obtain the attribute F = {n}. out n in balance max balance min R(n), A(n), timestamp n , D(n), E(n), Nty(n)}, and label L, to form a seed dataset.

[0101] Step 130, using Python's networkx library, with V evil Derivation of a graph around a central point, Vevil Add a set of nodes V to the graph, and within a period of time V evil All transactions are treated as the first hop of the derivation, and their transaction addresses are added to the graph node set V with step=0.

[0102] Step 140: Determine if a hop has a node that is an exchange, a coin mixing service, has no subsequent output, or step > max_generate_step (where max_generate_step defaults to 10), then stop the derivation and return to graph G. trans = (V, E, F), where V represents an address node, E = {(v1, v2); v1, v2 ∈ V} represents a transaction (including contract calls, transfer transactions, etc.), and F is a node attribute. Otherwise, iterate through all transactions containing the address txs in the current step. step .address, find all TSSs from the chain step For the transaction corresponding to .address, add the address from the transaction to node V in the graph, forming an edge E with the original node in the graph (ignore any duplicates), obtain and calculate feature F from the transaction information, and after traversal, step += 1.

[0103] The transaction network diagram is now complete.

[0104] Step 200, Feature Extraction Module. Specific steps include:

[0105] Step 210, using the graph G constructed in step 100 trans The transition probabilities of each node in the graph are pre-calculated.

[0106] Step 220: After obtaining the transition probabilities of each edge in the graph, perform biased walk Alias ​​sampling to obtain the behavioral process sequence.

[0107] Step 230: After one-hot encoding, the sampled sequence is input into the Skip-Gram model, and the likelihood function of the model is maximized using stochastic gradient descent. Finally, the optimal mapping function f is obtained.

[0108] Step 240: Calculate G using the optimal mapping function. trans The embedding features f(v) of each node, where v∈V.

[0109] Step 300, Classifier Training Module. Specific steps include:

[0110] Step 310: Using the sklearn library in Python, perform bootstrap sampling with replacement. Let the total number of samples (node ​​embedding features f(v), v∈V and node labels) be N. Use a single decision tree to extract n samples with replacement from the total samples as training samples for the single decision tree.

[0111] Step 320: Select m features from the d-dimensional graph embedding features, where m << d, and split them at each node of each decision tree. Select the optimal split from the m input features (measured by information gain and Gini index). m remains unchanged during the construction of a single tree.

[0112] Step 330: Splitting continues until all training examples at a certain node belong to the same class, at which point the single decision tree is trained and a single weak classifier is formed.

[0113] Step 340: t decision trees, each decision tree outputs a category l. i ∈L, i∈[1, t], L={0, 1}.

[0114] Step 350: t decision trees form a random forest. Calculate the number of trees that output 0 as num0 and the number of trees that output 1 as num1. If num0 ≥ num1, output 0; otherwise, output 1.

[0115] At this point, the Random Forest (RF) classifier training is complete.

[0116] Step 400, Behavior Detection Module. Specific steps include:

[0117] Step 410: Randomly select K blocks and repeat steps 100 and 200 to obtain a new transaction network graph G′. trans = (V′, E′, F′) and its node embedding features f′(v′), v′∈V′.

[0118] Step 420: Using the Random Forest RF trained in step 300, obtain the labels l of nodes in K randomly selected blocks, where 1 indicates anomaly and 0 indicates normal behavior, in order to detect new malicious behavior on the blockchain.

[0119] Experimental data:

[0120] Extensive experiments have demonstrated the effectiveness and practicality of this blockchain malicious behavior detection method and system.

[0121] Specifically, experiments revealed that, at the node embedding method level, this invention compared two graph representation learning methods and two graph deep learning methods to test the stability of the obtained transaction subgraph in horizontal methods, namely DeepWalk, node2vec, GCN, and GraphSage; at the graph construction method level, this invention compared the currently popular blockchain graph construction methods, namely, graph construction methods based on random time periods, random addresses, and policy-based selective address methods, to test the advantages of the obtained transaction subgraph in vertical methods. It was found that under different feature representation methods and different graph construction methods, the precision, recall, and F1 score of this method remained stable at a high level. The method is robust horizontally and has advantages vertically. The experimental results are shown in Table 1.

[0122]

[0123] Table 1 shows the robustness of the graph construction method proposed in this invention under different feature representation methods.

[0124] method Accuracy Recall rate F1 value Only the ratio of in and out 0.248 0.820 0.381 Maliciousness only 0.608 0.928 0.114 Total transaction amount only 0.275 0.748 0.402 Total number of transactions only 0.143 0.725 0.239 Trading Time Only 0.106 0.769 0.186 Only the zero factor 0.168 0.561 0.258 In / out ratio + malice 0.264 0.798 0.397 Total transaction amount + Total number of transactions 0.351 0.851 0.497 Trading time + splitting factor 0.301 0.863 0.446 All attributes 0.619 0.876 0.725

[0125] Table 2 shows the overall detection performance of the feature extraction method proposed in this invention without embedding.

[0126] method Accuracy Recall rate F1 value Deepwalk 0.911 0.729 0.810 Node2vec 0.864 0.842 0.853 Trans2vec 0.905 0.823 0.862 GraphSage 0.949 0.851 0.897 GCN 0.984 0.848 0.911 Network structure offset walk only 0.887 0.776 0.830 Pure semantic offset walk 0.877 0.792 0.832 Mixed time offset walks only 0.869 0.808 0.837 This invention 0.977 0.957 0.967

[0127] Table 3 shows the overall detection performance of the feature extraction method proposed in this invention on the dataset constructed in this invention.

[0128] <![CDATA[Number of nodes (log 10 units)]]> <![CDATA[Sampling time (log 10 seconds)]]> <![CDATA[Sampling + Optimization Time (log 10 seconds)]]> 2 -0.37 -0.35 3 0.59 0.63 4 1.62 1.64 5 2.63 2.64

[0129] Table 4. Scalability of the method proposed in this invention on the dataset constructed in this invention.

[0130] Using the detection method of this invention, on a blockchain transaction network of 100,000 consecutive blocks (718,145 transactions, 249,680 nodes), 4,249 nodes were detected to be related to malicious behavior, and 13,188 transactions were associated with them. The experimental results are shown in Table 5.

[0131]

[0132] Table 5 shows the detection results of the detection method proposed in this invention on a blockchain transaction network over a random period of time.

[0133] In summary, the graph construction method of this invention preserves a more complete malicious chain, and the resulting pruned blockchain transaction graph data lays a solid data foundation for the accuracy of the classifier. Simultaneously, the feature extraction method proposed in this invention eliminates the interference of complex on-chain record information, directly targeting the features affected by malicious behavior, thereby improving detection accuracy, recall, and F1 score.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail using examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A blockchain malicious behavior detection method, comprising the steps of: Constructing a transaction graph G of a blockchain trans =(V,E,F), wherein V represents a node set obtained based on an address node of the blockchain, E represents an edge set obtained based on a transaction between any two address nodes, and F represents a node attribute set, the node attributes including: network structure attributes, pure semantic attributes, and mixed time attributes, the network structure attributes including: an out-in degree ratio D(n) and a malicious degree E(n), n representing a node, n∈V, the pure semantic attributes including: a total transaction amount A(n) and a total transaction times R(n), and the mixed time attributes including: a maximum timestamp timestamp n and a break factor Nty(n), the break factor Max represents a daily maximum balance of the address node n, and Min represents a daily minimum balance of the address node n. pre-compute transition probabilities π for each edge based on the set of node attributes to form a transaction graph with transition probabilities and compute node embedding features for each node in the transaction graph in the transaction graph classifying the node embedding features to obtain address nodes with malicious behaviors.

2. The method of claim 1, wherein, the maliciousness 3. The method of claim 1, wherein, calculating the transition probability π of each edge based on the node attribute set, comprising: respectively setting the offset parameter α of the network structure attribute, the offset parameter β of the pure semantic attribute and the offset parameter γ of the mixed time attribute; the transition probability from the current node v to the next node n before normalization wherein Pr D denotes the transition probability from the current node v to the next node n considering only the out-in degree ratio D(n), Pr E denotes the transition probability from the current node v to the next node n considering only the maliciousness E(n), Pr A denotes the transition probability from the current node v to the next node n considering only the total transaction amount A(n), Pr R denotes the transition probability from the current node v to the next node n considering only the total transaction number R(n), Pr T denotes the transition probability from the current node v to the next node n considering only the transaction time, Pr Nty denotes the transition probability from the current node v to the next node n considering only the break factor Nty(n), v e V, ω denotes the graph weight; normalizing the transition probabilities π vn to obtain the transition probabilities π.

4. The method of claim 3, wherein, transition probabilities nbr v set of neighbor nodes of node v; transition probabilities 5. The method of claim 1, wherein, the computing the transaction graph the node embedding features of the nodes in the graph, comprising: based on the transition probabilities p in the transaction graph Alias sampling with biased walk to get behavior sequence; one-hot encoding the behavior sequence; based on the context size and dimension of the one-hot encoding, using the stochastic gradient descent algorithm to maximize the likelihood function of the Skip-Gram model to obtain the optimal mapping function; According to the optimal mapping function, the transaction graph is obtained The node embedding features of the nodes in the graph.

6. The method of claim 1, wherein, the step of classifying the node embedding features to obtain address nodes with malicious behaviors, comprising: selecting an address of a malicious website as a center address for derivation to construct a sample transaction graph G' trans ; According to the sample transaction graph G′ trans , the sample transaction graph G′ is calculated , sample node embedding features of each node in the sample transaction graph G′ are calculated Sample transaction graph-based The sample node embedding features of each node in the middle are supervised machine learning training to obtain a classification model. classifying the node embedding features based on the classification model to obtain address nodes with malicious behaviors.

7. The method of claim 6, wherein, The machine learning method comprises a random forest.

8. A storage medium having stored therein a computer program, wherein, The computer program executes any one of the methods of claims 1-7. 9.An electronic device comprising a memory and a processor, the memory having stored therein a computer program, the processor being arranged to run the computer program to execute any one of the methods of claims 1-7.

Images