Transaction network anomaly detection method, electronic device, and storage medium

Abstract

The application provides an abnormality detection method of a transaction network, an electronic device and a storage medium. The method comprises the following steps: constructing a plurality of token transaction networks, wherein a node in the token transaction network represents an account, an edge connecting the nodes in the token transaction network represents that there is a transaction between the accounts, the direction of the edge represents the direction of the transaction flow, the weight of the edge represents the transaction amount, and the edge records a timestamp; extracting a plurality of transaction sub-networks from the plurality of token transaction networks; taking a node in the plurality of transaction sub-networks as a target node, and obtaining attribute features of the target node; recombining the plurality of transaction sub-networks into a snapshot graph network under each timestamp; inputting the snapshot graph network and the attribute features into a pre-constructed detection model to obtain an abnormality detection result of the snapshot graph network. The application can improve the accuracy of abnormality detection of the transaction network.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, specifically relating to an anomaly detection method, electronic device, and storage medium for a transaction network. Background Technology

[0002] When constructing a blockchain transaction network, nodes represent transaction addresses (or accounts), and edges represent transactions between addresses. Existing methods for detecting anomalies in blockchain transaction networks are mainly divided into two categories: (1) Traditional machine learning-based manual feature extraction methods: These methods first manually extract features of the transaction network (node ​​degree, etc.); then, they use some traditional machine learning classification methods to perform anomaly detection. However, these feature engineering methods require domain expert knowledge, the detection results mainly depend on manually extracted features, and existing methods ignore the structural information of the transaction network, which leads to poor accuracy in anomaly detection.

[0003] (2) Node embedding method: Existing methods of this type use random walk node representation learning or graph neural network (GNN) technology to automatically learn deep features in the transaction network to obtain low-dimensional embeddings of each node, and perform classification tasks based on the obtained low-dimensional embeddings. However, this method only considers one token transaction network at a time and ignores the timestamp and transaction flow direction information of the transaction, resulting in poor accuracy of anomaly detection. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide an anomaly detection method, electronic device and storage medium for transaction networks, which can improve the accuracy of anomaly detection in transaction networks.

[0005] The present invention includes a method for detecting anomalies in a transaction network, comprising:

[0006] Construct multiple token transaction networks, where nodes in the token transaction network represent accounts, edges connecting nodes in the token transaction network represent transactions between accounts, the direction of the edges represents the direction of the transaction flow, the weight of the edges represents the transaction volume, and the edges are recorded with timestamps;

[0007] Extract multiple transaction sub-networks from the multiple token transaction networks;

[0008] The nodes in the multiple transaction sub-networks are used as target nodes, and the attribute characteristics of the target nodes are obtained;

[0009] The multiple transaction sub-networks are recombined into a snapshot graph network under each timestamp;

[0010] input the snapshot graph network and the attribute feature into a pre-constructed detection model to obtain an anomaly detection result of the snapshot graph network.

[0011] Optionally, the constructing a plurality of token transaction networks comprises:

[0012] Obtaining a plurality of token transaction record data, the token transaction record data comprising a starting account, a destination account, a transaction volume and a timestamp of a transaction;

[0013] According to each token transaction record data, a token transaction network is constructed.

[0014] Optionally, the extracting a plurality of transaction sub-networks from the plurality of token transaction networks comprises:

[0015] Removing nodes and edges connected thereto in each token transaction network with a transaction frequency less than a preset value to obtain a plurality of transaction sub-networks.

[0016] Optionally, the obtaining the attribute feature of the target node comprises:

[0017] Counting the in-degree number, the out-degree number and the total degree number of the target node, the in-degree number being a transaction number of the target node as a destination account in the plurality of transaction sub-networks, the out-degree number being a transaction number of the target node as a starting account in the plurality of transaction sub-networks, and the total degree number being a sum of the in-degree number and the out-degree number;

[0018] Normalizing a transaction volume between the target node and a neighbor node of the target node in the plurality of transaction sub-networks;

[0019] Taking the in-degree number, the out-degree number, the total degree number and the normalized transaction volume as the attribute feature of the target node.

[0020] Optionally, the recombining the plurality of transaction sub-networks into a snapshot graph network under each timestamp comprises:

[0021] Splitting each transaction sub-network into a snapshot network under different timestamps;

[0022] Merging snapshot networks under the same timestamp in the plurality of transaction sub-networks into one snapshot graph network.

[0023] Optionally, the detection model comprises a graph encoder and a classifier, the graph encoder comprising a graph convolution layer and a graph pooling layer.

[0024] The inputting the snapshot graph network and the attribute feature into a pre-constructed detection model to obtain an anomaly detection result of the snapshot graph network comprises:

[0025] The snapshot graph network and the attribute features are subjected to graph convolution operation of the graph convolution layer to obtain the low-dimensional representation vector of the target node;

[0026] The low-dimensional representation vector of the target node is processed by the graph pooling operation of the graph pooling layer to obtain the low-dimensional representation vector of the snapshot graph network.

[0027] The low-dimensional representation vector of the snapshot image network is input into the classifier to obtain the anomaly detection result of the snapshot image network.

[0028] Optionally, the step of performing a graph convolution operation on the snapshot graph network and the attribute features through the graph convolutional layer to obtain the low-dimensional representation vector of the target node includes:

[0029] Based on the attribute characteristics of the target node, determine the low-dimensional embedding vector of the target node;

[0030] The attention weights of the target node's neighboring nodes are calculated based on the low-dimensional embedding vectors of the target node and its neighboring nodes in the plurality of transaction sub-networks.

[0031] The low-dimensional representation vector of the target node is calculated based on the low-dimensional embedding vectors of its neighboring nodes and the attention weights.

[0032] Optionally, the formula for calculating the low-dimensional representation vector of the target node is:

[0033] ;

[0034] in, For the target node The low-dimensional representation vector, For the target node The set of all neighboring nodes in multiple transaction subnetworks; For the target node neighboring nodes The low-dimensional embedding vector; For the target node Its neighboring nodes Between the first There are three normalized attention coefficients, where K is the total number of attention points. For the first One attention learning parameter;

[0035] ;

[0036] ;

[0037] in, For the target node neighbor nodes of the target node a attention weight, a attention parameter matrix, a attention learning parameter matrix, a low-dimensional embedding vector of the target node an activation function.

[0038] The application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned anomaly detection method of the transaction network when executing the program.

[0039] The application also provides a non-transitory computer readable storage medium, which stores computer instructions for making the computer execute the above-mentioned anomaly detection method of the transaction network.

[0040] The application has the beneficial effect that multiple token transaction networks are constructed, multiple transaction sub-networks are extracted from the multiple token transaction networks, nodes in the multiple transaction sub-networks are taken as target nodes, attribute features of the target nodes are obtained, and the multiple transaction sub-networks are recombined into a snapshot graph network under each timestamp, the snapshot graph network and the attribute features are input into a pre-constructed detection model, and an anomaly detection result of the snapshot graph network is obtained, thereby effectively improving the accuracy of anomaly detection. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0042] Figure 1 A flowchart of the anomaly detection method of the transaction network provided by the embodiments of the present application.

[0043] Figure 2 A schematic diagram of multiple token transaction networks in the anomaly detection method of the transaction network provided by the embodiments of the present application.

[0044] Figure 3 A schematic diagram of step 102 in the anomaly detection method of the transaction network provided by the embodiments of the present application.

[0045] Figure 4A schematic diagram of step 104 in the transaction network anomaly detection method provided by the embodiments of the present application.

[0046] Figure 5 A schematic diagram of aggregating neighbor node information based on a multi-head attention mechanism in the transaction network anomaly detection method provided by the embodiments of the present application.

[0047] Figure 6 A schematic diagram of the principle of the transaction network anomaly detection method provided by the embodiments of the present application.

[0048] Figure 7 A schematic diagram of the structure of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0050] As shown in the accompanying Figure 1 The embodiments of the present application provide a transaction network anomaly detection method, which includes steps 101 to 105, and specifically as follows:

[0051] Step 101, constructing a plurality of token transaction networks, wherein the nodes in the token transaction network represent accounts, the edges connecting the nodes in the token transaction network represent that there is a transaction between the accounts, the direction of the edge represents the direction of the transaction flow, the weight of the edge represents the transaction volume, and the edge records a timestamp.

[0052] The plurality of token transaction networks are constructed based on different token transaction record data, that is, one token transaction record data can construct one token transaction network. Specifically, the step 101 of constructing a plurality of token transaction networks includes:

[0053] Obtaining a plurality of token transaction record data, wherein the token transaction record data includes a starting account, a destination account, a transaction volume, and a timestamp;

[0054] According to each token transaction record data, a token transaction network is constructed.

[0055] For example, based on the addresses of three tokens—BNB (0xB8c77482e45F1F44dE1745F52C74426C631bDD52), LNK (0x514910771AF9Ca656af840dff83E8264EcF986CA), and USDT (0xdAC17F958D2ee523a2206206994597C13D831ec7)—transaction records for each token are retrieved from the etherscan.io website. Each token transaction record includes multiple transaction details, each of which includes token_address, from_address, to_address, amount, transaction_hash, log_index, and block_number, representing the token address, starting account address (i.e., the starting account), destination account address (i.e., the destination account), transaction amount, transaction hash, log index, and block number, respectively. The timestamp of each transaction (from_address, to_address) can be obtained based on the block number.

[0056] Each token transaction record can construct a token transaction network, which consists of nodes and edges connecting different nodes. Nodes represent addresses (accounts), edges represent transactions between accounts, the direction of the edge indicates the direction of the token transaction flow, and the weight of the edge represents the transaction volume between accounts.

[0057] like Figure 2 As shown, two token transaction networks are constructed: token transaction network 1 and token transaction network 2. Token transaction network 1 has 10 nodes, representing 10 accounts, and token transaction network 2 has 8 nodes, representing 8 accounts. Each edge in the two token transaction networks records an amount and a timestamp. The amount represents the transaction volume between two accounts, and the timestamp represents the timestamp of the transaction edge.

[0058] Step 102: Extract multiple transaction sub-networks from the multiple token transaction networks.

[0059] The scale of the token transaction network is so massive that ordinary GPUs cannot process such large amounts of data. Taking BNB token transaction records as an example, the number of new accounts added daily reached approximately 10,000 at its peak, making the token transaction network extremely large. Therefore, in order to maintain a reasonable computation time and meet the computing requirements of GPUs, this embodiment uses a sampling method to extract a sub-network, or transaction sub-network, from each token transaction network. In other words, one transaction sub-network is extracted from each token transaction network, resulting in multiple transaction sub-networks.

[0060] Specifically, step 102, which involves extracting multiple transaction sub-networks from the multiple token transaction networks, includes:

[0061] Remove nodes and their connected edges in each token transaction network whose transaction frequency is less than a preset value to obtain multiple transaction subnetworks.

[0062] To reduce computational time and GPU overhead while maximizing the preservation of token transaction network information, for a given token transaction network, a fixed number of nodes are sampled based on transaction frequency to obtain the transaction subnetwork of each token transaction network. Transaction frequency can be defined as the number of transactions. Specifically, nodes in the token transaction network with fewer than a preset value of transactions and their connected edges are removed. That is, if a node in the token transaction network has fewer than a preset value of transactions with other nodes, then that node and its edges connecting to other nodes are removed. Figure 3 As shown, nodes with fewer than two transactions and the edges connected to those nodes in token transaction network 1 are removed, specifically node 6 and the edge connecting node 6 to node 2, and node 5 and the edge connecting node 5 to node 1, resulting in transaction sub-network 1.

[0063] In the L transaction subnetworks, the first The transaction subnetwork extracted from a token transaction network can be represented as follows: That is, the first Each transaction subnetwork is .based on Performing subsequent anomaly detection not only reduces computation time and lowers GPU requirements, but also preserves as many important features of the original transaction network as possible.

[0064] Step 103: Select the nodes in the multiple transaction sub-networks as target nodes and obtain the attribute characteristics of the target nodes.

[0065] The transaction sub-network is a weighted directed network, which only contains the structural information of the network and cannot be directly applied to the graph neural network technology. Therefore, the embodiment first converts the feature information (such as transaction volume and transaction flow direction information) of the edges in the transaction sub-network into the attribute features of the target nodes (i.e. the nodes in the transaction sub-network), so that the attribute features of each target node include the in-degree, the out-degree, the total degree and the normalized transaction volume.

[0066] Specifically, the attribute features of the target nodes are obtained, including:

[0067] The in-degree, the out-degree and the total degree of the target node are counted, the in-degree is the number of transactions in which the target node is a destination account in the plurality of transaction sub-networks, the out-degree is the number of transactions in which the target node is a starting account in the plurality of transaction sub-networks, and the total degree is the sum of the in-degree and the out-degree;

[0068] The transaction volume between the target node and its neighbor nodes in the plurality of transaction sub-networks is normalized;

[0069] The in-degree, the out-degree, the total degree and the normalized transaction volume are taken as the attribute features of the target node.

[0070] Wherein, for a given target node, the degree represents the first-order field. For a given target node, the in-degree represents the in-edge, and in the transaction sub-network, the in-degree represents the number of transactions sent by other target nodes to the given target node. For a given target node, the out-degree represents the out-edge, and in the transaction sub-network, the out-degree represents the number of transactions sent by the given target node to other target nodes. In the transaction sub-network, the total degree represents the total number of edges of the given target node. The total degree can reflect the activity degree of the target node, i.e. the transaction frequency to some extent. The normalized transaction volume (i.e. the transaction amount) can be taken as the weight of the edge. In order to simplify the calculation and for comparison, the transaction volume is normalized to [0, 1].

[0071] The calculation formula of the transaction volume normalization processing is:

[0072] .

[0073] Wherein, represents the target node and its neighbor nodes between the normalized transaction volume, represents the transaction volume between the target node and its neighbor nodes , represents the transaction volume between the target node and its neighbor nodes , a set of all neighbor nodes of the target node . Wherein, the neighbor node refers to a target node in the transaction subnetwork having a transaction with the target node.

[0074] The attribute features of all target nodes in the plurality of transaction subnetworks are constructed into an attribute matrix, denoted as , wherein represents the number of target nodes in the plurality of transaction subnetworks, represents the dimension of the attribute features of the target nodes, and in the embodiment is 4.

[0075] Step 104, recombining the plurality of transaction subnetworks into a snapshot graph network under each timestamp.

[0076] The transactions in the plurality of transaction subnetworks under the same timestamp are integrated to obtain a snapshot graph network under the timestamp.

[0077] Specifically, the recombination of the plurality of transaction subnetworks into a snapshot graph network under each timestamp in step 103 includes:

[0078] splitting each transaction subnetwork into snapshot networks under different timestamps;

[0079] merging the snapshot networks under the same timestamp in the plurality of transaction subnetworks into one snapshot graph network.

[0080] For a given th transaction subnetwork , first, according to the timestamp of each edge in the transaction subnetwork timestamp and the time window , the transaction subnetwork is split into a series of snapshot networks, denoted as , wherein , there are timestamps in total. Wherein, can be one day (24 hours), i.e., the transaction subnetwork is split according to the natural day. As shown in Figure 4 , transaction subnetwork 1 is split into snapshot networks, i.e., snapshot network 1 to snapshot network T. Each transaction subnetwork in the L transaction subnetworks can be split into T snapshot networks. As shown in Figure 4 , transaction subnetwork 1 can be split into a plurality of snapshot networks according to the timestamp, and the plurality of snapshot networks can be arranged according to the time axis.

[0081] One account often has transaction information on multiple cryptocurrency ledgers. Therefore, considering the information of multiple token transaction networks can obtain more comprehensive transaction information, and thus improve the results of anomaly detection. This embodiment combines the snapshot networks at the same timestamp in the L transaction sub-networks into one snapshot graph network , The snapshot graph network at the same timestamp is composed of .

[0082] Step 105, input the snapshot graph network and the attribute features into a pre-constructed detection model to obtain the anomaly detection result of the snapshot graph network.

[0083] The detection model is constructed to guide the graph classification graph analysis task, and the detection model is trained by optimizing the objective function.

[0084] For each target node in the transaction sub-network, the influence weight between the target node itself and its field is learned first, and then the field is aggregated according to the obtained weight. Since a node (account) usually transacts with multiple nodes (accounts) at the same time, and the nodes with transactions usually have similar features. For example, if a node is a black node in the black market, the nodes that have direct transactions with the black node may also be black nodes. In addition, the attribute features of the target node obtained in step 103 are relatively sparse, and if only the structural features of the target node itself and the attribute features of the target node itself are considered, the node embedding result will be unsatisfactory. In order to solve this problem, this embodiment is based on the property that there is similarity between the nodes with interaction, and uses the neighborhood information to integrate the information of the neighborhood to the target node through aggregation operation. However, different neighbors have different influences on the target node, so this embodiment uses a multi-head attention mechanism to capture the differences in the contributions of different neighborhood information to the target node, and then performs aggregation operation. As shown in Figure 5 , the target node C has five neighbor nodes, and the target node C has two heads of attention with each neighbor node, such as the two heads of attention coefficients of the target node C and the neighbor node 1 and .

[0085] First, this embodiment trains the detection model by minimizing the cross-entropy loss function, and the learning parameters in the detection model are , which can be simplified as , and K is the total number of attentions. The cross-entropy loss function is as follows:

[0086] .

[0087] wherein represents a training sample set, represents a set of labels, representing the number of detection categories. represents the abnormal and normal states of the snapshot graph network under the timestamp, represents the detection result of the snapshot graph network, represents the number of detection categories.

[0088] After the detection model is trained, the structure information of the snapshot graph network and the attribute features of the target nodes in the transaction sub-network can be input into the trained detection model. As shown in Figure 6 After the multiple transaction sub-networks 11 are recombined into multiple snapshot graph networks 12 (the multiple snapshot graph networks 12 can be arranged in time sequence), and the attribute matrix 13 composed of all target nodes in the multiple transaction sub-networks 11 is obtained, the multiple snapshot graph networks 12 and the attribute matrix 13 are input into the detection model 14.

[0089] The detection model 14 can include a graph encoder 15 and a classifier 16. The input of the snapshot graph network and the attribute features into the pre-constructed detection model in step 105 to obtain the abnormal detection result of the snapshot graph network includes:

[0090] inputting the snapshot graph network and the attribute features into the graph encoder to obtain a low-dimensional representation vector of the snapshot graph network;

[0091] inputting the low-dimensional representation vector of the snapshot graph network into the classifier to obtain the abnormal detection result of the snapshot graph network.

[0092] In the token transaction network, one address (account) can be involved in multiple token transaction networks. Therefore, different token transaction networks contain some common features. Therefore, the same graph encoder is used to encode the information of the transaction sub-network in this embodiment, and the common features of the multiple transaction sub-networks under the same timestamp, i.e., the low-dimensional representation vector of the snapshot graph network, can be obtained.

[0093] Specifically, the graph encoder 15 includes a graph convolution layer 151 and a graph pooling layer 153.

[0094] The input of the snapshot graph network and the attribute features into the graph encoder to obtain a low-dimensional representation vector of the snapshot graph network includes:

[0095] performing graph convolution operation on the snapshot graph network and the attribute features through the graph convolution layer to obtain a low-dimensional representation vector of the target node;

[0096] performing graph pooling operation on the low-dimensional representation vector of the target node through the graph pooling layer to obtain a low-dimensional representation vector of the snapshot graph network.

[0097] As shown in Figure 6As shown, multiple snapshot graph networks 12 and attribute matrices 13 are passed through two graph convolutional layers 151 in the graph encoder 15 to obtain a low-dimensional representation vector 152 for each target node. Then, the low-dimensional representation vector 152 of each target node is passed through a graph pooling layer 153 in the graph encoder 15 to obtain a low-dimensional representation vector 154 for each snapshot graph network 12.

[0098] Specifically, the step of performing a graph convolution operation on the snapshot graph network and the attribute features through the graph convolution layer to obtain the low-dimensional representation vector of the target node includes:

[0099] Based on the attribute characteristics of the target node, determine the low-dimensional embedding vector of the target node;

[0100] The attention weights of the target node's neighboring nodes are calculated based on the low-dimensional embedding vectors of the target node and its neighboring nodes in the plurality of transaction sub-networks.

[0101] The low-dimensional representation vector of the target node is calculated based on the low-dimensional embedding vectors of its neighboring nodes and the attention weights.

[0102] For a given target node Its first-order neighborhood is represented as , i.e., target node The set of all neighboring nodes in the transaction subnetwork. A neighboring node is a node in the transaction subnetwork that is closest to the target node. There is a target node for the transaction. Assume the target node... One of its neighboring nodes is ,Right now Then the target node neighboring nodes The attention weights can be expressed as:

[0103] ;

[0104] in, For the target node neighboring nodes The Each attention weight, For the target node The low-dimensional embedding vector can be based on the target node. The attributes and characteristics of the node are obtained by aggregating the attributes of its neighboring nodes. Neighboring nodes Low-dimensional embedding vectors can be based on neighbor nodes. The attributes and characteristics of the node are obtained by aggregating the attributes of its neighboring nodes. For the first An attention parameter matrix, is the th attention learning parameter matrix, is the transpose of the matrix, denotes the series operation, is an activation function, such as a LeakyReLU function.

[0105] Using the same method, the weight of all neighbor nodes of the target node can be obtained.

[0106] Then, the influence weight of the neighbor node is normalized to [0, 1] by using the softmax function:

[0107] .

[0108] wherein, is the th normalized attention coefficient between the target node and its neighbor node , and is the th attention weight of the neighbor node of the node . Finally, the low-dimensional representation vector of the target node can be obtained by aggregating the information of the neighborhood through multi-head attention weighting:

[0109] .

[0110] wherein, is the low-dimensional representation vector of the target node

[0111] after aggregating the neighbor information (i.e., new features), K is the total number of attentions, is the th attention learning parameter. After the aggregation operation through the multi-head attention mechanism, the low-dimensional representation vector of each target node in the transaction sub-network can be obtained, and thus the low-dimensional representation vector of each target node in the snapshot graph network can be obtained. The low-dimensional representation vectors of all target nodes in the snapshot graph network are subjected to average pooling operation to obtain the low-dimensional representation vector of the snapshot graph network. Then, as shown in FIG. 16, the low-dimensional representation vector 154 of the snapshot graph network at different time stamps is subjected to the downstream classifier 16 to obtain the classification result of the snapshot graph network at different time stamps, i.e., the abnormality detection result, i.e., the detection result is displayed as normal or abnormal.

[0112]

[0113] Figure 6

[0114] ​​​​​​In summary, the embodiment of the present application constructs multiple token transaction networks, extracts multiple transaction sub-networks from the multiple token transaction networks, takes nodes in the multiple transaction sub-networks as target nodes, obtains attribute features of the target nodes, and recombines the multiple transaction sub-networks into a snapshot graph network under each timestamp, inputs the snapshot graph network and the attribute features into a pre-constructed detection model, and obtains an anomaly detection result of the snapshot graph network, thereby effectively improving the accuracy of anomaly detection.

[0115] Figure 7 A specific electronic device hardware structure schematic diagram provided by the embodiment is shown. The device can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 for internal communication.

[0116] The processor 1010 can be implemented in the form of a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is used to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0117] The memory 1020 can be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 1020 and called and executed by the processor 1010.

[0118] The input / output interface 1030 is used to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0119] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to realize the communication interaction between the device and other devices. The communication module can realize communication through wired mode (such as USB, network cable, etc.), or realize communication through wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0120] The bus 1050 includes a path for transmitting information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0121] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain the components necessary to implement the embodiments of the present application, and does not have to contain all the components shown in the figure.

[0122] The non-transitory computer-readable storage medium of the embodiment of the present application stores a plurality of instructions, which can be loaded by a processor to execute the steps in any of the anomaly detection methods of the transaction network provided by the embodiments of the present application.

[0123] The non-transitory computer-readable medium of the embodiment includes permanent and non-permanent, removable and non-removable media, which can be realized by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0124] Those skilled in the art should understand that the above discussion of any of the embodiments is only exemplary and is not intended to limit the scope of the present disclosure (including claims) to these examples; under the idea of the present application, the above embodiments or technical features in different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of different aspects of the present application as described above. In order to be brief, they are not provided in detail.

[0125] In addition, to simplify the description and discussion, and so as not to obscure the application, well-known power / ground connections to integrated circuit (IC) chips and other components can or can not be shown in the provided figures. Furthermore, devices can be shown in block diagram form in order to avoid obscuring the application, and this also is intended to include the fact that embodiments of the apparatus can include many options, modifications and alterations to the described devices, as will become apparent to those of ordinary skill in the art. Where specific details are set forth in order to describe an illustrative embodiment of the application, it will be apparent to those of ordinary skill in the art that the application can be practiced without, or with variations of, these specific details. The description is thus to be considered in all respects only as illustrative and not restrictive.

[0126] While the application has been described in connection with specific embodiments thereof, many alternatives, modifications and variations will be apparent to those of ordinary skill in the art. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0127] Embodiments of the application are intended to cover all such alternatives, modifications and variations as falling within the scope of the appended claims. Accordingly, any omission, modification, equivalent replacement, improvement, etc. made in the spirit and principle of the present application should be included in the scope of the present application.

Claims

1. An anomaly detection method of a transaction network, comprising: constructing a plurality of token transaction networks, wherein nodes in the token transaction networks represent accounts, edges connecting the nodes in the token transaction networks represent transactions between the accounts, directions of the edges represent directions of transaction flows, weights of the edges represent transaction amounts, and the edges are recorded with timestamps; extracting a plurality of transaction sub-networks from the plurality of token transaction networks; obtaining attribute features of a target node in the plurality of transaction sub-networks; recombining the plurality of transaction sub-networks into a snapshot graph network at each timestamp; inputting the snapshot graph network and the attribute features into a pre-constructed detection model to obtain an anomaly detection result of the snapshot graph network.

2. The anomaly detection method for a transaction network as described in claim 1, characterized in that, The constructing of the plurality of token transaction networks comprises: obtaining a plurality of token transaction record data, wherein the token transaction record data comprises a starting account, a destination account, a transaction amount, and a timestamp of a transaction; constructing a token transaction network according to each token transaction record data.

3. The anomaly detection method for a transaction network as described in claim 1, characterized in that, The extracting of the plurality of transaction sub-networks from the plurality of token transaction networks comprises: removing nodes and edges connected thereto in each token transaction network with a transaction frequency less than a preset value to obtain a plurality of transaction sub-networks.

4. The anomaly detection method for a transaction network as described in claim 1, characterized in that, The obtaining of the attribute features of the target node comprises: counting in-degree, out-degree, and total degree of the target node, wherein the in-degree is a transaction number of the target node as a destination account in the plurality of transaction sub-networks, the out-degree is a transaction number of the target node as a starting account in the plurality of transaction sub-networks, and the total degree is a sum of the in-degree and the out-degree; normalizing transaction amounts between the target node and neighbor nodes thereof in the plurality of transaction sub-networks; taking the in-degree, the out-degree, the total degree, and the normalized transaction amounts as the attribute features of the target node.

5. The anomaly detection method for a transaction network as described in claim 1, characterized in that, The recombining of the plurality of transaction sub-networks into the snapshot graph network at each timestamp comprises: splitting each transaction sub-network into snapshot networks at different timestamps; merging snapshot networks at the same timestamp in the plurality of transaction sub-networks into one snapshot graph network.

6. The anomaly detection method for a transaction network as described in claim 1, characterized in that, The detection model comprises a graph encoder and a classifier, and the graph encoder comprises a graph convolution layer and a graph pooling layer. The inputting of the snapshot graph network and the attribute features into the pre-constructed detection model to obtain the anomaly detection result of the snapshot graph network comprises: performing graph convolution operation on the snapshot graph network and the attribute features through the graph convolution layer to obtain a low-dimensional representation vector of the target node; performing graph pooling operation on the low-dimensional representation vector of the target node through the graph pooling layer to obtain a low-dimensional representation vector of the snapshot graph network; inputting the low-dimensional representation vector of the snapshot graph network into the classifier to obtain the anomaly detection result of the snapshot graph network.

7. An electronic device, characterized by comprising: Computer program product, comprising a memory, a processor and a computer program stored on the memory and loadable into the processor, characterized in that the processor executes the program to implement the method for detecting anomalies in a transaction network according to any one of claims 1 to 6.

8. A non-transitory computer-readable storage medium, comprising: The non-transitory computer readable storage medium stores computer instructions for causing the computer to perform the method for detecting anomalies in a transaction network according to any one of claims 1 to 6.

Images