An Ethereum network phishing detection method, system, electronic device and medium
By constructing an Ethereum transaction graph and combining graph convolutional networks and conditional random fields, the problem of identifying phishing scams on the Ethereum network was solved, achieving higher detection accuracy and recall rates, and improving the security of the Ethereum network.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- INNER MONGOLIA UNIVERSITY
- Filing Date
- 2022-11-16
- Publication Date
- 2026-05-19
AI Technical Summary
Existing traditional methods struggle to effectively identify Ethereum network phishing scams, especially due to the challenges posed by Ethereum's openness and account anonymity. Traditional graph convolutional networks cannot constrain accounts with the same labels to learn similar representations.
By constructing an Ethereum transaction graph, using a depth walk algorithm to extract initial node features, and combining graph convolutional networks and conditional random fields for feature learning, a classification model is finally used to identify phishing accounts.
It improves the accuracy and recall rate of Ethereum phishing detection, effectively identifies phishing accounts, and enhances the security of the blockchain ecosystem.
Smart Images
Figure CN115906080B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security, and in particular to a method, system, electronic device, and medium for detecting Ethereum network phishing based on graph neural networks and conditional random fields. Background Technology
[0002] Since Satoshi Nakamoto first proposed Bitcoin in 2008, blockchain technology, as its underlying technology, has attracted widespread attention and is now widely used across various industries. Currently, Ethereum is the largest blockchain platform supporting smart contracts, with over 1.6 billion transactions. However, due to a lack of regulation, illegal activities on Ethereum are rampant, and its ecosystem has been severely threatened by phishing scams. Statistics show that since 2017, over 50% of illegal activities on Ethereum have been phishing scams. Therefore, conducting research on phishing scam detection is particularly important for preventing economic losses to Ethereum accounts, maintaining the security of the blockchain ecosystem, and promoting the development of the blockchain industry.
[0003] Traditional phishing detection methods rely on websites, web pages, emails, and URLs (Uniform Resource Locator). However, Ethereum phishing attacks are diverse in meaning and form, making traditional methods unsuitable for Ethereum phishing detection. Currently, Ethereum's openness facilitates phishing detection, allowing researchers to access all transaction records as experimental data. However, the fact that Ethereum accounts are uncharacteristic strings and users rely on pseudonyms for data transmission presents significant challenges to phishing detection.
[0004] To address the aforementioned challenges, some researchers have proposed graph-based modeling methods, transforming phishing scam detection into a problem of node classification through graph learning. However, these methods do not consider the entire graph; instead, they extract node features by sampling samples according to a pre-defined strategy, which has some drawbacks. Graph convolutional networks (GCNNs), as a method for automatically and comprehensively learning from graph-structured data, have achieved good experimental results in distinguishing phishing accounts. However, GCNNs cannot constrain accounts with the same labels to learn similar representations. Summary of the Invention
[0005] The purpose of this invention is to provide an Ethereum phishing detection method, system, electronic device, and medium that can effectively identify phishing scams on Ethereum.
[0006] To achieve the above objectives, the present invention provides the following solution:
[0007] An Ethereum phishing detection method includes:
[0008] Retrieve transaction records in Ethereum; each transaction record includes accounts and transaction relationships between accounts.
[0009] Based on the transaction records, a transaction graph is constructed with account nodes and transaction relationships as edges;
[0010] Extract the initial features of each node in the transaction graph;
[0011] Based on the transaction graph and the initial features of each node in the transaction graph, the final features of each node in the transaction graph are determined using a feature learning model; the feature learning model includes a first graph convolutional network, a conditional random field, and a second graph convolutional network connected in sequence.
[0012] Based on the final features of each node, the category of each node is determined using a classification model; the category of a node is either a phishing account or a non-phishing account; the classification model is obtained by pre-training LightGBM using a training sample set; the training sample set includes multiple sample features and the category of each sample feature.
[0013] Optionally, the extraction of initial features of each node in the transaction graph specifically includes:
[0014] The initial features of each node in the transaction graph are determined using a depth-first search algorithm.
[0015] Optionally, determining the final features of each node in the transaction graph based on the initial features of the transaction graph and each node in the transaction graph, using a feature learning model, specifically includes:
[0016] Based on the transaction graph and the initial feature matrix, a first feature matrix is obtained by learning the features of each node through a first graph convolutional network; the initial feature matrix includes the initial features of each node; the first feature matrix includes the first features of each node.
[0017] Based on the first feature matrix, feature learning is performed on each node using a conditional random field to obtain a second feature matrix; the second feature matrix includes the second features of each node.
[0018] Based on the second feature, feature learning is performed on each node through a second graph convolutional network to obtain the final feature matrix; the final feature matrix includes the final features of each node.
[0019] Optionally, the first characteristic matrix can be determined using the following formula:
[0020] ;
[0021] in, Let be the first feature matrix, and σ(·) be the activation function. The degree diagonal matrix of the transaction graph. Let the adjacency matrix of the transaction graph be... The initial feature matrix, This is the weight matrix of the convolutional network in the first graph.
[0022] To achieve the above objectives, the present invention also provides the following solution:
[0023] An Ethereum phishing detection system includes:
[0024] The transaction record acquisition unit is used to acquire transaction records in Ethereum; each transaction record includes accounts and the transaction relationships between accounts.
[0025] The transaction graph construction unit, connected to the transaction record acquisition unit, is used to construct a transaction graph based on the transaction records, with account nodes and transaction relationships as edges;
[0026] An initial feature extraction unit, connected to the transaction graph construction unit, is used to extract the initial features of each node in the transaction graph;
[0027] A feature learning unit, connected to the initial feature extraction unit, is used to determine the final features of each node in the transaction graph based on the initial features of the transaction graph and each node in the transaction graph, and on the feature learning model. The feature learning model includes a first graph convolutional network, a conditional random field, and a second graph convolutional network connected in sequence.
[0028] A classification unit, connected to the feature learning unit, is used to determine the category of each node based on the final features of each node and the classification model; the category of the node is either a phishing account or a non-phishing account; the classification model is obtained by pre-training LightGBM using a training sample set; the training sample set includes multiple sample features and the category of each sample feature.
[0029] Optionally, the feature learning unit includes:
[0030] The first feature learning module, connected to the initial feature extraction unit, is used to learn features of each node through a first graph convolutional network based on the transaction graph and the initial feature matrix to obtain a first feature matrix; the initial feature matrix includes the initial features of each node; the first feature matrix includes the first features of each node.
[0031] The second feature learning module is connected to the first feature learning module and is used to learn features of each node through a conditional random field based on the first feature matrix to obtain a second feature matrix; the second feature matrix includes the second features of each node.
[0032] The third feature learning module, connected to the second feature learning module, is used to learn features of each node through the second graph convolutional network based on the second feature to obtain the final feature matrix; the final feature matrix includes the final features of each node.
[0033] To achieve the above objectives, the present invention also provides the following solution:
[0034] An electronic device includes a memory and a processor, the memory storing a computer program, and the processor running the computer program to cause the electronic device to perform the Ethereum phishing detection method described above.
[0035] To achieve the above objectives, the present invention also provides the following solution:
[0036] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the Ethereum network phishing detection method described above.
[0037] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects: Based on transaction records in Ethereum, a transaction graph is constructed with account nodes and transaction relationships as edges, and then the initial features of each node in the transaction graph are extracted; based on the transaction graph and the initial features of each node in the transaction graph, the final features of each node in the transaction graph are determined based on a feature learning model (including a first graph convolutional network, a conditional random field, and a second graph convolutional network connected in sequence); finally, based on the final features of each node, the category of each node is determined based on a classification model; by combining graph convolutional networks and conditional random fields, phishing accounts on Ethereum can be effectively identified. Attached Figure Description
[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0039] Figure 1 This is a flowchart of the Ethereum network phishing detection method of the present invention;
[0040] Figure 2 This is a schematic diagram of the Ethereum network phishing detection system of the present invention.
[0041] Symbol explanation:
[0042] Transaction record acquisition unit-1, transaction graph construction unit-2, initial feature extraction unit-3, feature learning unit-4, classification unit-5. Detailed Implementation
[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0044] The purpose of this invention is to provide an Ethereum phishing detection method, system, electronic device, and medium that effectively identifies phishing accounts on Ethereum by combining graph convolutional networks and conditional random fields.
[0045] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0046] Example 1
[0047] like Figure 1 As shown, the Ethereum network phishing detection method of the present invention includes:
[0048] S1: Retrieve transaction records in Ethereum. Each transaction record includes accounts and the transaction relationships between accounts.
[0049] S2: Based on the transaction records, construct a transaction graph with account nodes and transaction relationships as edges.
[0050] S3: Extract the initial features of each node in the transaction graph.
[0051] Due to the anonymity of blockchain, nodes in the transaction graph lack descriptive information. Since GCN (Graph Convolution Network) requires basic features as input to aggregate node structural features, this invention uses DeepWalk to extract initial features for each node.
[0052] DeepWalk is a graph structure pattern mining algorithm based on truncated random walks, mainly consisting of two parts: random walk and generation of representation vectors. Starting from a specific node, each step randomly selects an edge connecting to the current node, moves along the selected edge to the next node, and repeats this process to obtain a node sequence from the transaction graph. Then, referencing natural language processing, the generated node sequence is treated as a sentence composed of words, and all sequences are considered as a large corpus. Finally, a skip-gram model is used to represent each node as a d-dimensional vector, representing the initial features of each node.
[0053] S4: Based on the transaction graph and the initial features of each node in the transaction graph, determine the final features of each node in the transaction graph using a feature learning model. The feature learning model includes a first graph convolutional network, a conditional random field, and a second graph convolutional network connected in sequence.
[0054] GCN is a method for learning graph-structured data. It is based on a variant of convolutional neural networks that can encode the features of graph structures and nodes, enabling automatic and efficient learning of representations (features) from topological information.
[0055] GCN aggregation uses symmetric normalization, and its rules are as follows:
[0056] ;
[0057] in, For the first l The feature matrix of layer +1 Let the adjacency matrix of the transaction graph be... The degree diagonal matrix of the transaction graph. For the first l The layer's weight matrix, where σ(·) is the activation function. For the first l The activation matrix (feature matrix) of the layer.
[0058] In practical applications, a 2-layer GCN model with a softmax function is used to learn node features for phishing scam detection, as shown in the following formula:
[0059] ;
[0060] in, , X It is the characteristic matrix. It is the weight matrix of the first layer (in this embodiment, the first graph convolutional network). Z is the weight matrix of the second layer (in this embodiment, the second graph convolutional network), and Z is the probability distribution of the classification.
[0061] This invention incorporates a Conditional Random Field (CRF) between two layers of graph convolutional networks. While GCNs can include connectivity information, the results are often not accurate enough. With the help of CRFs, nodes can learn more hidden representations, improving classification performance.
[0062] In this embodiment, firstly, based on the transaction graph and the initial feature matrix, a first graph convolutional network is used to learn the features of each node to obtain a first feature matrix. The initial feature matrix includes the initial features of each node; the first feature matrix includes the first features of each node.
[0063] Specifically, the first characteristic matrix is determined using the following formula:
[0064] ;
[0065] in, Let be the first feature matrix, and σ(·) be the activation function. The degree diagonal matrix of the transaction graph. Let the adjacency matrix of the transaction graph be... The initial feature matrix, This is the weight matrix of the convolutional network in the first graph.
[0066] Then, based on the first feature matrix, feature learning is performed on each node using a conditional random field to obtain a second feature matrix. The second feature matrix includes the second features of each node.
[0067] Specifically, the rules of CRF are as follows:
[0068] ;
[0069] in, For conditional random fields, It is a node from the first GCN layer. v The representation of (i.e., nodes in the first characteristic matrix) v (first characteristic) It is a node v The new representation, namely the nodes in the second characteristic matrix of the conditional random field output. v The second characteristic is that Z(·) is the normalization factor. E (·) represents the energy function.
[0070] For nodes u Set its neighbor as N Its energy function E (·) is defined as follows:
[0071] ;
[0072] in, For nodes u A new representation, namely the nodes in the second characteristic matrix of the conditional random field output. u The second characteristic, For nodes from the first GCN layer u The representation of (i.e., nodes in the first characteristic matrix) u The first characteristic, f uv For nodes u and nodes v Similarity between themα and β It's a hyperparameter.
[0073] The CRF is optimized using the mean-field approximation method, resulting in a Gaussian function:
[0074] ;
[0075] By calculating the expectation of the above formula, the second characteristic matrix is obtained. Update rules:
[0076] ;
[0077] in, k The integer represents the number of iterations. U Indicates nodes that have passed through CRF u , For the first k At the +1st iteration, the node u The second characteristic.
[0078] By utilizing the constraints provided by CRF, nodes with the same label can learn similar features as much as possible, thereby improving classification performance.
[0079] Finally, based on the second feature, feature learning is performed on each node through a second graph convolutional network to obtain the final feature matrix. The final feature matrix includes the final features of each node.
[0080] In summary, this invention employs a three-layer model, where the first and third layers are GCNs, the second layer is a CRF, and the output of the CRF serves as the input to the third-layer GCN, ultimately yielding the probability distribution Z (final feature matrix) of the nodes, which is then input into the classification model.
[0081] S5: Based on the final features of each node, determine the category of each node using a classification model. The category of a node is either a phishing account or a non-phishing account. The classification model is obtained by pre-training LightGBM using a training sample set. The training sample set includes multiple sample features and the category of each sample feature.
[0082] In the Ethereum phishing detection problem, there is a lack of features that can be directly used for detection. This invention models transactions as a graph and uses graph convolutional networks to extract the structural information of nodes. Simultaneously, conditional random fields are used to compensate for the coarse-grained nature of graph convolutional networks, helping the convolutional layers better learn node features and improving classification accuracy. Extensive experiments show that this invention outperforms other existing methods in both accuracy and recall, demonstrating its effective ability to identify phishing scams on Ethereum.
[0083] Example 2
[0084] In order to implement the method corresponding to Embodiment 1 above and achieve the corresponding functions and technical effects, an Ethereum network phishing detection system is provided below.
[0085] like Figure 2 As shown, the Ethereum phishing detection system provided in this embodiment includes: a transaction record acquisition unit 1, a transaction graph construction unit 2, an initial feature extraction unit 3, a feature learning unit 4, and a classification unit 5.
[0086] Transaction record acquisition unit 1 is used to acquire transaction records in Ethereum. Each transaction record includes accounts and the transaction relationships between accounts.
[0087] The transaction graph construction unit 2 is connected to the transaction record acquisition unit 1. The transaction graph construction unit 2 is used to construct a transaction graph based on the transaction records, with account nodes and transaction relationships as edges.
[0088] The initial feature extraction unit 3 is connected to the transaction graph construction unit 2, and the initial feature extraction unit 3 is used to extract the initial features of each node in the transaction graph.
[0089] Feature learning unit 4 is connected to the initial feature extraction unit 3. Feature learning unit 4 is used to determine the final features of each node in the transaction graph based on the initial features of the transaction graph and each node in the transaction graph, and based on the feature learning model. The feature learning model includes a first graph convolutional network, a conditional random field, and a second graph convolutional network connected in sequence.
[0090] Specifically, the feature learning unit 4 includes: a first feature learning module, a second feature learning module, and a third feature learning module.
[0091] The first feature learning module is connected to the initial feature extraction unit 3. The first feature learning module is used to learn features from each node using a first graph convolutional network based on the transaction graph and the initial feature matrix, thereby obtaining a first feature matrix. The initial feature matrix includes the initial features of each node. The first feature matrix includes the first features of each node.
[0092] The second feature learning module is connected to the first feature learning module. The second feature learning module is used to learn features from each node using a conditional random field based on the first feature matrix, thereby obtaining a second feature matrix. The second feature matrix includes the second features of each node.
[0093] The third feature learning module is connected to the second feature learning module. The third feature learning module is used to learn features from each node using the second graph convolutional network based on the second features, to obtain the final feature matrix. The final feature matrix includes the final features of each node.
[0094] Classification unit 5 is connected to feature learning unit 4. Classification unit 5 is used to determine the category of each node based on the final features of each node and the classification model. The category of a node is either a phishing account or a non-phishing account. The classification model is obtained by pre-training LightGBM using a training sample set. The training sample set includes multiple sample features and the category of each sample feature.
[0095] Example 3
[0096] This embodiment provides an electronic device, including a memory and a processor. The memory stores a computer program, and the processor runs the computer program to enable the electronic device to execute the Ethereum phishing detection method of Embodiment 1.
[0097] Alternatively, the aforementioned electronic device may be a server.
[0098] In addition, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the Ethereum network phishing detection method of Embodiment 1.
[0099] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0100] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A method for detecting phishing attacks on the Ethereum network, characterized in that, The Ethereum phishing detection method includes: Retrieve transaction records in Ethereum; each transaction record includes accounts and transaction relationships between accounts. Based on the transaction records, a transaction graph is constructed with account nodes and transaction relationships as edges; Extract the initial features of each node in the transaction graph; Based on the transaction graph and the initial features of each node in the transaction graph, the final features of each node in the transaction graph are determined using a feature learning model; the feature learning model includes a first graph convolutional network, a conditional random field, and a second graph convolutional network connected in sequence. Specifically, the final features of each node in the transaction graph are determined based on the initial features of each node and a feature learning model. This process includes: learning features from each node using a first graph convolutional network based on the transaction graph and the initial feature matrix to obtain a first feature matrix; the initial feature matrix includes the initial features of each node; the first feature matrix includes the first features of each node; learning features from each node using a conditional random field based on the first feature matrix to obtain a second feature matrix; the second feature matrix includes the second features of each node; and learning features from each node using a second graph convolutional network based on the second features to obtain a final feature matrix; the final feature matrix includes the final features of each node. Based on the final features of each node, the category of each node is determined using a classification model; the category of a node is either a phishing account or a non-phishing account; the classification model is obtained by pre-training LightGBM using a training sample set; the training sample set includes multiple sample features and the category of each sample feature.
2. The Ethereum phishing detection method according to claim 1, characterized in that, The extraction of initial features from each node in the transaction graph specifically includes: The initial features of each node in the transaction graph are determined using a depth-first search algorithm.
3. The Ethereum phishing detection method according to claim 1, characterized in that, The first characteristic matrix is determined using the following formula: ； in, Let be the first feature matrix, and σ(·) be the activation function. Let be the degree diagonal matrix of the transaction graph. Let the adjacency matrix of the transaction graph be... The initial characteristic matrix, This is the weight matrix of the convolutional network in the first graph.
4. An Ethereum phishing detection system, characterized in that, The Ethereum phishing detection system includes: The transaction record acquisition unit is used to acquire transaction records in Ethereum; each transaction record includes accounts and the transaction relationships between accounts. The transaction graph construction unit, connected to the transaction record acquisition unit, is used to construct a transaction graph based on the transaction records, with account nodes and transaction relationships as edges; An initial feature extraction unit, connected to the transaction graph construction unit, is used to extract the initial features of each node in the transaction graph; A feature learning unit, connected to the initial feature extraction unit, is used to determine the final features of each node in the transaction graph based on the initial features of the transaction graph and each node in the transaction graph, and on the feature learning model. The feature learning model includes a first graph convolutional network, a conditional random field, and a second graph convolutional network connected in sequence. The feature learning unit includes: The first feature learning module, connected to the initial feature extraction unit, is used to learn features of each node through a first graph convolutional network based on the transaction graph and the initial feature matrix to obtain a first feature matrix; the initial feature matrix includes the initial features of each node; the first feature matrix includes the first features of each node. The second feature learning module is connected to the first feature learning module and is used to learn features of each node through a conditional random field based on the first feature matrix to obtain a second feature matrix; the second feature matrix includes the second features of each node. The third feature learning module, connected to the second feature learning module, is used to learn features of each node through the second graph convolutional network based on the second feature to obtain the final feature matrix; the final feature matrix includes the final features of each node. A classification unit, connected to the feature learning unit, is used to determine the category of each node based on the final features of each node and the classification model; the category of the node is either a phishing account or a non-phishing account; the classification model is obtained by pre-training LightGBM using a training sample set; the training sample set includes multiple sample features and the category of each sample feature.
5. An electronic device, characterized in that, The device includes a memory and a processor, the memory being used to store a computer program, and the processor running the computer program to cause the electronic device to perform the Ethereum phishing detection method according to any one of claims 1 to 3.
6. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the Ethereum phishing detection method as described in any one of claims 1 to 3.