A data-driven blockchain anomaly detection method and terminal

Abstract

The present invention provides a data-driven blockchain anomaly detection method and terminal. The method runs a blockchain node to be tested and synchronizes its historical data. Labels are added to the blockchain node to be tested. The nodes of the blockchain in the historical block data are used as graph nodes to establish a transaction graph. A corresponding multi-view feature vector is generated for each graph node in the transaction graph. The multi-view feature vectors are aggregated into an aggregate vector, retaining important information of different nodes in different views. An anomaly detection model is then trained based on the aggregate vector and the label, thereby improving the classification accuracy of the account corresponding to the blockchain node. The anomaly detection model is deployed on the blockchain node to be tested, and then detection is performed based on real-time data to obtain anomaly detection results. Therefore, the nodes on the blockchain are used as graph nodes, and all historical transaction data are modeled on a graph. This method is particularly suitable for blockchains based on account models, improving the efficiency of anomaly detection.

Description

Technical Field

[0001] The present invention relates to the field of blockchain detection, and in particular to a data-driven blockchain anomaly detection method and terminal. Background Art

[0002] With the rapid development of blockchain platforms, the research and application of blockchain technology has also seen exponential growth, and governments around the world have introduced various policies to support its application and development. Due to its decentralized, transparent, and tamper-resistant nature, blockchain technology has been widely used in finance, the Internet of Things, smart manufacturing, and other fields. While blockchain technology is rapidly developing, we must also pay attention to potential issues within it, particularly security. With public blockchains, criminals can arbitrarily join the network and publish illegal transactions, disrupting the normal operation of the network. With consortium and private blockchains, criminals can potentially compromise weaker nodes within the system to publish illegal transactions, steal data, and infringe upon the interests of consortium organizations. Therefore, monitoring and analyzing transaction data within the blockchain to quickly identify illegal transactions and nodes is crucial and essential for maintaining the healthy and stable operation of the blockchain system.

[0003] Traditional system anomaly detection methods typically use fixed threshold anomaly judgments. This involves setting thresholds for key indicators, and the system then flags potentially abnormal behaviors based on the thresholds. These anomalies are then manually processed by experts. This approach: (1) relies on expert expertise, resulting in low reliability; (2) fixed thresholds result in low flexibility and an inability to cope with diverse scenarios; and (3) manual processing is inefficient and unable to quickly process the large amounts of data generated in blockchains.

[0004] Recent research has begun incorporating machine learning methods into blockchain anomaly detection. These methods can accurately identify anomalous transactions and uncover patterns that are hidden from traditional methods, improving the accuracy of anomaly detection. However, the performance of machine learning-based detection methods often depends on the data's features. Extracting useful data features is challenging and relies heavily on expert knowledge and experience. Furthermore, blockchain data is complex and high-dimensional, making it difficult for simple machine learning models to learn this complex information, resulting in poor model performance. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a data-driven blockchain anomaly detection method and terminal, which can improve the efficiency and accuracy of blockchain anomaly detection.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A data-driven blockchain anomaly detection method comprises the following steps:

[0008] Run the blockchain node to be tested and synchronize historical block data, and add a label to the blockchain node to be tested;

[0009] Based on the historical block data, a transaction graph is established using nodes of the blockchain as graph nodes, a corresponding multi-view feature vector is generated for each graph node in the transaction graph, the multi-view feature vectors are aggregated into an aggregate vector, and an anomaly detection model is trained based on the aggregate vector and the label;

[0010] The anomaly detection model is deployed on the blockchain node to be tested, and the real-time data in the blockchain node to be tested is detected to obtain anomaly detection results.

[0011] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0012] A data-driven blockchain anomaly detection terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0013] Run the blockchain node to be tested and synchronize historical block data, and add a label to the blockchain node to be tested;

[0014] Based on the historical block data, a transaction graph is established using nodes of the blockchain as graph nodes, a corresponding multi-view feature vector is generated for each graph node in the transaction graph, the multi-view feature vectors are aggregated into an aggregate vector, and an anomaly detection model is trained based on the aggregate vector and the label;

[0015] The anomaly detection model is deployed on the blockchain node to be tested, and the real-time data in the blockchain node to be tested is detected to obtain an anomaly detection result.

[0016] The beneficial effects of the present invention are as follows: running the blockchain node to be tested and synchronizing its historical data, adding labels to the blockchain node to be tested, using the nodes of the blockchain in the historical block data as graph nodes, establishing a transaction graph, generating corresponding multi-view feature vectors for each graph node in the transaction graph, and aggregating the multi-view feature vectors into aggregate vectors, which can retain important information of different nodes in different views, and then training an anomaly detection model based on the aggregate vectors and labels, thereby improving the classification accuracy of the accounts corresponding to the blockchain nodes. The anomaly detection model is deployed on the blockchain node to be tested, and then detected based on real-time data to obtain anomaly detection results. Therefore, by using machine learning methods to assist anomaly detection, using the nodes on the blockchain as graph nodes, and modeling all historical transaction data on a graph, the complexity of graph generation can be reduced. Moreover, using blockchain nodes as graph nodes, this anomaly detection method is particularly applicable to blockchains based on account models, improving the efficiency of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of a data-driven blockchain anomaly detection method according to an embodiment of the present invention;

[0018] Figure 2 Schematic diagram of a data-driven blockchain anomaly detection terminal according to an embodiment of the present invention;

[0019] Figure 3 This is a flowchart of the specific steps of a data-driven blockchain anomaly detection method according to an embodiment of the present invention;

[0020] Figure 4 This is a flowchart of real-time anomaly detection of blockchain according to an embodiment of the present invention;

[0021] Figure 5 Schematic diagram of a UTXO-based transaction according to an embodiment of the present invention;

[0022] Figure 6 A schematic diagram of an account-based transaction according to an embodiment of the present invention;

[0023] Description of labels:

[0024] 1. A data-driven blockchain exception terminal; 2. Memory; 3. Controller. DETAILED DESCRIPTION

[0025] To illustrate the technical content, achieved objectives and effects of the present invention in detail, the following description is given in conjunction with the embodiments and accompanying drawings.

[0026] Please refer to Figure 1 , an embodiment of the present invention provides a data-driven blockchain anomaly detection method, comprising the steps of:

[0027] Run the blockchain node to be tested and synchronize historical block data, and add a label to the blockchain node to be tested;

[0028] Based on the historical block data, a transaction graph is established using nodes of the blockchain as graph nodes, a corresponding multi-view feature vector is generated for each graph node in the transaction graph, the multi-view feature vectors are aggregated into an aggregate vector, and an anomaly detection model is trained based on the aggregate vector and the label;

[0029] The anomaly detection model is deployed on the blockchain node to be tested, and the real-time data in the blockchain node to be tested is detected to obtain an anomaly detection result.

[0030] As can be seen from the above description, the beneficial effects of the present invention are as follows: running the blockchain node to be tested and synchronizing its historical data, adding labels to the blockchain node to be tested, using the blockchain nodes in the historical block data as graph nodes, establishing a transaction graph, generating a corresponding multi-view feature vector for each graph node in the transaction graph, and aggregating the multi-view feature vectors into an aggregate vector, which can retain important information of different nodes in different views. Subsequently, an anomaly detection model is trained based on the aggregate vector and labels, thereby improving the classification accuracy of the accounts corresponding to the blockchain node. The anomaly detection model is deployed on the blockchain node to be tested, and then detected based on real-time data to obtain anomaly detection results. Therefore, using machine learning methods to assist anomaly detection, treating the nodes on the blockchain as graph nodes, and modeling all historical transaction data on a single graph can reduce the complexity of graph generation. Moreover, using blockchain nodes as graph nodes, this anomaly detection method is particularly applicable to blockchains based on account models, improving the efficiency of anomaly detection.

[0031] Furthermore, obtaining an anomaly detection model through the historical block data and the label training includes:

[0032] Building a transaction graph based on the historical block data using the nodes of the blockchain as graph nodes includes:

[0033] Construct the historical block data into a transaction graph G = (V, E, W, T);

[0034] Where V represents the graph node of the transaction graph, corresponding to the addresses of the blockchain nodes of the two parties to the transaction, E represents the directed edge of the transaction graph, W represents the weight of the directed edge, and T represents the time corresponding to the directed edge.

[0035] From the above description, we can see that modeling block data into a transaction graph and using the blockchain's transaction nodes as the nodes of the graph can intuitively obtain the specific information of the block data, and facilitate the subsequent multi-dimensional feature extraction based on each node of the transaction graph, making it applicable to the blockchain based on account transactions.

[0036] Furthermore, generating a corresponding multi-view feature vector for each graph node in the transaction graph includes:

[0037] Calculate statistical features of each graph node in the transaction graph based on the number of transactions and transaction amount, compose a first feature matrix from the statistical features generated by each graph node, input the first feature matrix and its adjacency matrix into a graph neural network, and obtain a first latent variable of each graph node in the first view;

[0038] Extracting time series features of historical transactions for each graph node in the transaction graph through a neural network, composing the time series features generated by each graph node into a second feature matrix, inputting the second feature matrix and its adjacency matrix into the graph neural network, and obtaining a second latent variable for each graph node in the second view;

[0039] Generate a corresponding representation vector for each graph node in the transaction graph through a graph neural network, obtain a topological structure sequence vector based on the representation vector, and use the topological structure sequence vector of each graph node as the third latent variable of each graph node in the third view;

[0040] An attention mechanism is used to aggregate the first latent variable, the second latent variable, and the third latent variable of each graph node in the transaction graph to obtain an aggregated vector for each graph node in the transaction graph.

[0041] As can be seen from the above description, since the original transaction graph does not have node attribute information, a multi-view approach is used to generate multiple latent variables for each node in the transaction graph, and the attention mechanism is used to aggregate them into an aggregate vector; among them, the first view corresponds to the transaction statistical features, the second view corresponds to the transaction timing features, and the third view corresponds to the node graph topology features. Therefore, multiple methods are used during feature extraction to capture the multi-dimensional features of transaction data. The graph nodes correspond to blockchain nodes, that is, the user's transaction accounts. Using the attention mechanism method to capture the multi-dimensional features of transaction data can improve the accuracy of account classification.

[0042] Furthermore, the detecting of the real-time data in the blockchain node to be tested to obtain an anomaly detection result includes:

[0043] Establish a real-time transaction graph based on the real-time data in the blockchain node to be tested, generate a real-time feature vector from the real-time transaction graph, and input the real-time feature vector into the anomaly detection model to obtain an anomaly detection result;

[0044] Obtaining the abnormality detection result includes:

[0045] If the anomaly detection result is a detection anomaly, the corresponding blockchain node to be tested is verified, and the verification result is used as the label of the blockchain node to be tested;

[0046] The anomaly detection model is updated according to the label of the blockchain node to be tested.

[0047] From the above description, it can be seen that the abnormal blockchain node to be tested will be verified, and the verification result will be used as the true label of the blockchain node to be tested, which will facilitate subsequent model updates and improve the accuracy of the model.

[0048] Furthermore, updating the anomaly detection model according to the label of the blockchain node to be tested includes:

[0049] If the anomaly detection model is updated within a first time interval from its last update or a preset number of verification results have been obtained, updating the anomaly detection model according to the label of the blockchain node to be tested obtained from the verification result;

[0050] If the anomaly detection model is last updated a second time interval away, the anomaly detection model is retrained, and the first time interval is smaller than the second time interval.

[0051] From the above description, it can be seen that using a small amount of data that is not used for training for real-time updates and regularly retraining the anomaly detection model to complete regular updates can improve the update efficiency.

[0052] Please refer to Figure 2 Another embodiment of the present invention provides a data-driven blockchain anomaly detection terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0053] Run the blockchain node to be tested and synchronize historical block data, and add a label to the blockchain node to be tested;

[0054] Based on the historical block data, a transaction graph is established using nodes of the blockchain as graph nodes, a corresponding multi-view feature vector is generated for each graph node in the transaction graph, the multi-view feature vectors are aggregated into an aggregate vector, and an anomaly detection model is trained based on the aggregate vector and the label;

[0055] The anomaly detection model is deployed on the blockchain node to be tested, and the real-time data in the blockchain node to be tested is detected to obtain an anomaly detection result.

[0056] As can be seen from the above description, the blockchain node under test is run and its historical data is synchronized. Labels are added to the blockchain node under test, and a transaction graph is constructed using the blockchain nodes in the historical block data as graph nodes. A corresponding multi-view feature vector is generated for each graph node in the transaction graph, and the multi-view feature vectors are aggregated into an aggregate vector. This preserves important information about different nodes in different views. An anomaly detection model is then trained based on the aggregate vectors and labels, thereby improving the classification accuracy of accounts corresponding to the blockchain node. The anomaly detection model is deployed on the blockchain node under test and then tested against real-time data to obtain anomaly detection results. Therefore, using machine learning to assist anomaly detection, treating blockchain nodes as graph nodes and modeling all historical transaction data on a single graph can reduce the complexity of graph generation. Furthermore, using blockchain nodes as graph nodes, this anomaly detection method is particularly applicable to blockchains based on account models, improving the efficiency of anomaly detection.

[0057] Furthermore, obtaining an anomaly detection model through the historical block data and the label training includes:

[0058] Building a transaction graph based on the historical block data using the nodes of the blockchain as graph nodes includes:

[0059] Construct the historical block data into a transaction graph G = (V, E, W, T);

[0060] Where V represents the graph node of the transaction graph, corresponding to the addresses of the blockchain nodes of the two parties to the transaction, E represents the directed edge of the transaction graph, W represents the weight of the directed edge, and T represents the time corresponding to the directed edge.

[0061] From the above description, we can see that modeling block data into a transaction graph and using the blockchain's transaction nodes as the nodes of the graph can intuitively obtain the specific information of the block data, and facilitate the subsequent multi-dimensional feature extraction based on each node of the transaction graph, making it applicable to the blockchain based on account transactions.

[0062] Furthermore, generating a corresponding multi-view feature vector for each graph node in the transaction graph includes:

[0063] Calculate statistical features of each graph node in the transaction graph based on the number of transactions and transaction amount, compose a first feature matrix from the statistical features generated by each graph node, input the first feature matrix and its adjacency matrix into a graph neural network, and obtain a first latent variable of each graph node in the first view;

[0064] Extracting time series features of historical transactions for each graph node in the transaction graph through a neural network, composing the time series features generated by each graph node into a second feature matrix, inputting the second feature matrix and its adjacency matrix into the graph neural network, and obtaining a second latent variable for each graph node in the second view;

[0065] Generate a corresponding representation vector for each graph node in the transaction graph through a graph neural network, obtain a topological structure sequence vector based on the representation vector, and use the topological structure sequence vector of each graph node as the third latent variable of each graph node in the third view;

[0066] An attention mechanism is used to aggregate the first latent variable, the second latent variable, and the third latent variable of each graph node in the transaction graph to obtain an aggregated vector for each graph node in the transaction graph.

[0067] As can be seen from the above description, since the original transaction graph does not have node attribute information, a multi-view approach is used to generate multiple latent variables for each node in the transaction graph, and the attention mechanism is used to aggregate them into an aggregate vector; among them, the first view corresponds to the transaction statistical features, the second view corresponds to the transaction timing features, and the third view corresponds to the node graph topology features. Therefore, multiple methods are used during feature extraction to capture the multi-dimensional features of transaction data. The graph nodes correspond to blockchain nodes, that is, the user's transaction accounts. Using the attention mechanism method to capture the multi-dimensional features of transaction data can improve the accuracy of account classification.

[0068] Furthermore, the detecting of the real-time data in the blockchain node to be tested to obtain an anomaly detection result includes:

[0069] Establish a real-time transaction graph based on the real-time data in the blockchain node to be tested, generate a real-time feature vector from the real-time transaction graph, and input the real-time feature vector into the anomaly detection model to obtain an anomaly detection result;

[0070] Obtaining the abnormality detection result includes:

[0071] If the anomaly detection result is a detection anomaly, the corresponding blockchain node to be tested is verified, and the verification result is used as the label of the blockchain node to be tested;

[0072] The anomaly detection model is updated according to the label of the blockchain node to be tested.

[0073] From the above description, it can be seen that the abnormal blockchain node to be tested will be verified, and the verification result will be used as the true label of the blockchain node to be tested, which will facilitate subsequent model updates and improve the accuracy of the model.

[0074] Furthermore, updating the anomaly detection model according to the label of the blockchain node to be tested includes:

[0075] If the anomaly detection model is updated within a first time interval from its last update or a preset number of verification results have been obtained, updating the anomaly detection model according to the label of the blockchain node to be tested obtained from the verification result;

[0076] If the anomaly detection model is last updated a second time interval away, the anomaly detection model is retrained, and the first time interval is smaller than the second time interval.

[0077] From the above description, it can be seen that using a small amount of data that is not used for training for real-time updates and regularly retraining the anomaly detection model to complete regular updates can improve the update efficiency.

[0078] The data-driven blockchain anomaly detection method and terminal described above in the present invention propose a universal blockchain abnormal account detection model. This model is applicable to all blockchains, especially to account-based blockchains. It can improve the efficiency and accuracy of blockchain anomaly detection and is used to detect abnormal behaviors and abnormal accounts that may exist in the blockchain, ensuring the safe and stable operation of the blockchain system. The following is an explanation of the specific implementation method:

[0079] Example 1

[0080] Please refer to Figure 1 , a data-driven blockchain anomaly detection method, comprising the steps of:

[0081] S1. Run the blockchain node to be tested and synchronize historical block data, and add a label to the blockchain node to be tested.

[0082] Specifically, a blockchain node is run to synchronize blockchain block data. Transaction data is parsed and extracted from the blocks, generating structured data that is stored in a local file or database. Manual labeling is required for the blockchain nodes under test, i.e., transaction nodes. Labels are used to identify transaction nodes as abnormal for subsequent model training.

[0083] S2. Based on the historical block data, a transaction graph is established with the nodes of the blockchain as graph nodes, a corresponding multi-view feature vector is generated for each graph node in the transaction graph, the multi-view feature vectors are aggregated into an aggregate vector, and an anomaly detection model is obtained by training based on the aggregate vector and the label.

[0084] S21. Construct the historical block data into a transaction graph G = (V, E, W, T);

[0085] Where V represents the graph node of the transaction graph, corresponding to the addresses of the blockchain nodes of the two parties to the transaction, E represents the directed edge of the transaction graph, W represents the weight of the directed edge, and T represents the time corresponding to the directed edge.

[0086] In this embodiment, two transaction graph examples are provided: Figure 5 This is a simple diagram of "UTXO-based transactions". Figure 6 The following is a simple diagram of "account-based transactions", where the ellipse represents the transaction address and the rectangle represents the transaction. Figure 5 In the example, tokens from addresses a1 and a2 are combined and spent in transaction T1, and further output to addresses a3 and a4. Then, address a3 participates in transaction T2, and addresses a6 and a7 receive output from transaction T2. ​​In other words, all transaction tokens come from one or more transactions before UTXO, that is, tokens flow between transactions. Figure 6 In the process, token transfer occurs between two accounts.

[0087] Therefore, in this embodiment, each transaction node on the blockchain corresponds to a user account. The transaction nodes on the blockchain are used as nodes of the transaction graph, and all historical transactions are modeled on a graph to obtain a static transaction graph, reducing the complexity of transaction graph generation.

[0088] S22. Generate a corresponding multi-view feature vector for each graph node in the transaction graph:

[0089] Among them, multi-view node feature vectors are generated based on the attention mechanism. Since there is no node attribute information in the original transaction graph, a multi-view approach is used to generate a multi-view feature vector for each node in the transaction graph, and the attention mechanism is used to aggregate the multi-view feature vectors into an aggregated vector.

[0090] S221. Calculate the statistical features of each graph node in the transaction graph based on the number of transactions and transaction amount of each graph node, compose the statistical features generated by each graph node into a first feature matrix, input the first feature matrix and its adjacency matrix into the graph neural network, and obtain the first latent variable of each graph node in the first view.

[0091] Specifically, we use statistical methods to generate the characteristics of node i, such as node transaction frequency, total expenditure amount, average expenditure amount, total transaction number, total expenditure transaction number, total expenditure amount and average expenditure amount, and obtain a feature vector Traverse all nodes to generate their feature vectors to form a feature matrix X 1 . The feature matrix X 1 Its adjacency matrix A 1Input a graph neural network GNN, denoted as H1, and we can get the latent variable representation of each node in the first view, where the latent variable of node i is denoted as

[0092] S222. Extract the time series features of the historical transactions of each graph node in the transaction graph through a neural network, form the time series features generated by each graph node into a second feature matrix, input the second feature matrix and its adjacency matrix into the graph neural network, and obtain the second latent variable of each graph node in the second view.

[0093] Specifically, time series is an important characteristic of transactions, that is, transactions occur in a certain order. We can use methods such as LSTM neural networks to extract the time series features of the node's historical transactions and obtain a feature vector. The transaction time series composed of all the historical transaction data of the node is "(a i ,t i ), where i is the number of transactions, a i <0 means expenditure, a i >0 indicates income", input the transaction time series into a time series network model such as LSTM model, obtain the time series features of the node's transaction, and obtain a feature vector Traverse all nodes to generate their feature vectors to form a feature matrix X 2 . The feature matrix X 2 and the adjacency matrix A 2 Input a graph neural network GNN, denoted as H2, and we can get the latent variable representation of each node in the second view, where the latent variable of node i is denoted as

[0094] S223. Generate a corresponding representation vector for each graph node in the transaction graph through a graph neural network, obtain a topological structure sequence vector based on the representation vector, and use the topological structure sequence vector of each graph node as the third latent variable of each graph node in the third view.

[0095] Specifically, we capture the structural relationship between nodes and use graph neural networks such as GCN to generate a representation vector for each node in the transaction graph. This vector is the topological structure representation of the node in the graph. This module is used to learn the information of the transaction objects in the node's historical transactions. The historical transaction objects of a node are the neighbor nodes of the node in the transaction graph. Therefore, we choose to input the transaction graph into a DeepWalk model, denoted as H3, to learn the topological structure features of the node in the transaction graph and obtain a feature vector in the third view.

[0096] S224. Use the attention mechanism to aggregate the first latent variable, the second latent variable, and the third latent variable of each graph node in the transaction graph to obtain an aggregated vector for each graph node in the transaction graph.

[0097] Specifically, the attention mechanism aggregation is based on the third-order transaction subgraph. The attention mechanism is used to aggregate the node feature vectors under the three views into a single vector. The use of the attention mechanism based on the third-order transaction subgraph is to retain the important information of different nodes in different views. It mainly includes the following three parts:

[0098] S2241, MLP projection. The feature vectors obtained under the above three views are respectively mapped to the same vector space through the same MLP, denoted as F1, to obtain

[0099] S2242, importance vector generation. First, sample and generate the third-order transaction subgraph of target node i in the original transaction graph (i.e., the subgraph composed of nodes whose distance to node i is less than three), denoted as graph SG i ; Then the graph SG i Input a GNN network, denoted as H4, to obtain the feature matrix of the transaction subgraph; finally, input the feature matrix into an MLP network, denoted as F2, to obtain an importance vector a=(a1,a2,a3), where a i Indicates the importance of view i.

[0100] S2243, vector aggregation. Aggregate the three views to obtain an aggregate vector, which is the learned node vector. For node i, its aggregate vector is

[0101] In this embodiment, the time series features can be used to compensate for some of the information that may be lost in the static transaction graph.

[0102] S23. Obtain an anomaly detection model based on the aggregated vector and the label training.

[0103] Specifically, a machine learning classification model such as the SVM model is used as an anomaly detection model. The generated node aggregation vector is used as data input, the manually labeled data is used as the true label, and the dataset is divided into a training set and a test set.

[0104] Select a machine learning classification model, such as an SVM model, as the anomaly detection model. Use the cross-entropy loss function as the model's loss function. Train the model using the training set and use the backpropagation algorithm to update the model parameters in step S22. Use the test set to test and evaluate the model.

[0105] S3. Deploy the anomaly detection model on the blockchain node to be tested, detect the real-time data in the blockchain node to be tested, and obtain anomaly detection results.

[0106] For details, please refer to Figure 4 , the historical transaction data in the blockchain is constructed into a transaction graph network G, and a multi-view feature generation model M1 and anomaly classification detection model M2 based on the attention mechanism are trained.

[0107] To detect real-time transaction data in the blockchain network, the specific steps are as follows:

[0108] (1) Deploy the feature generation model M1 and the anomaly classification detection model M2 on a node in the blockchain. The node synchronously obtains real-time transaction data from the blockchain, adds the transaction data to the transaction graph network G, and stores it in a local file or database.

[0109] (2) Use the feature generation model M1 to generate the corresponding feature vectors of the transaction participant nodes (including the initiator and the recipient).

[0110] (3) Input the feature vectors of both transaction parties into the anomaly detection model M2 to obtain the anomaly detection results.

[0111] The real-time transaction data of the blockchain is displayed in a visual way, focusing on the nodes detected as abnormal and the transactions related to the nodes, and issuing early warning information.

[0112] If the anomaly detection result is a detected anomaly, the corresponding blockchain node to be tested will be verified, and the verification result will be used as the label of the blockchain node to be tested. The anomaly detection model will be updated according to the label of the blockchain node to be tested.

[0113] Specifically, the blockchain system administrator verifies the node detected as abnormal by the system. After multi-party verification, the administrator will confirm whether the node is an abnormal node and record the administrator's identification result as the node's true label in the database for subsequent model updates.

[0114] If the anomaly detection model is updated within a first time interval from its last update or a preset number of verification results have been obtained, updating the anomaly detection model according to the label of the blockchain node to be tested obtained from the verification result;

[0115] If the anomaly detection model is last updated a second time interval away, the anomaly detection model is retrained, and the first time interval is smaller than the second time interval.

[0116] Specifically, the model needs to be updated regularly to ensure its accuracy. Model updates are divided into two steps: 1. Real-time update: After a first time interval (such as 1 hour or 24 hours) or after a preset number of unused training data has been accumulated, the accumulated transaction data during this period is input into the model for training, and the parameters of the feature generation model M1 and the anomaly classification detection model M2 are updated. 2. Periodic update: After a second time interval (such as one week or three days), the model is retrained using all the data and the original feature generation model M1 and anomaly classification detection model M2 are replaced.

[0117] Among them, real-time update is to update the parameters of the model using a small amount of data; while periodic update is to retrain a model using all the data.

[0118] Therefore, in this embodiment, the transaction nodes (accounts) on the blockchain are used as nodes of the graph, the edges represent transactions, all transactions are modeled on a graph, and the timing feature extraction module is used to learn the timing information in the transactions; it is applicable to all blockchains, especially blockchains based on account models, that is, each user has his own account, and transactions are directly represented as transfers between two accounts. When extracting features, multi-view learning combined with the attention mechanism is used to capture the multi-dimensional features of transaction data, thereby improving the accuracy of account classification; machine learning methods are used to assist in anomaly detection and improve detection efficiency.

[0119] Example 2

[0120] Please refer to Figure 2 A data-driven blockchain anomaly detection terminal 1 includes a memory 2, a processor 3, and a computer program stored in the memory 2 and executable on the processor 3. When the processor 3 executes the computer program, each step of a data-driven blockchain anomaly detection method of embodiment 1 is implemented.

[0121] In summary, the present invention provides a data-driven blockchain anomaly detection method and terminal. This method runs a blockchain node to be tested and synchronizes its historical data. Labels are added to the blockchain node to be tested, using the blockchain nodes in the historical block data as graph nodes to establish a transaction graph. A corresponding multi-view feature vector is generated for each graph node in the transaction graph, and the multi-view feature vectors are aggregated into an aggregate vector. This can retain important information about different nodes in different views. An anomaly detection model is then trained based on the aggregate vectors and labels, thereby improving the classification accuracy of accounts corresponding to blockchain nodes. The anomaly detection model is deployed on the blockchain node to be tested, and then detected based on real-time data to obtain anomaly detection results. Therefore, by using machine learning to assist anomaly detection, treating the nodes on the blockchain as graph nodes and modeling all historical transaction data on a single graph, the complexity of graph generation can be reduced. Furthermore, using blockchain nodes as graph nodes, this anomaly detection method is particularly applicable to blockchains based on account models, improving the efficiency of anomaly detection.

[0122] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's description and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data-driven blockchain anomaly detection method, characterized in that: Including steps: Run the blockchain node to be tested and synchronize historical block data, and add a label to the blockchain node to be tested; Based on the historical block data, a transaction graph is established using nodes of the blockchain as graph nodes, a corresponding multi-view feature vector is generated for each graph node in the transaction graph, the multi-view feature vectors are aggregated into an aggregate vector, and an anomaly detection model is trained based on the aggregate vector and the label; Deploy the anomaly detection model on the blockchain node to be tested, detect the real-time data in the blockchain node to be tested, and obtain anomaly detection results; Building a transaction graph based on the historical block data using the nodes of the blockchain as graph nodes includes: Construct the historical block data into a transaction graph G=(V, E, W, T); Where V represents the graph node of the transaction graph, corresponding to the addresses of the blockchain nodes of the two parties to the transaction, E represents the directed edge of the transaction graph, W represents the weight of the directed edge, and T represents the time corresponding to the directed edge; Generating a corresponding multi-view feature vector for each graph node in the transaction graph, and aggregating the multi-view feature vectors into an aggregate vector includes: Calculate statistical features of each graph node in the transaction graph based on the number of transactions and transaction amount, compose a first feature matrix from the statistical features generated by each graph node, input the first feature matrix and its adjacency matrix into a graph neural network, and obtain a first latent variable of each graph node in the first view; Extracting time series features of historical transactions for each graph node in the transaction graph through a neural network, composing the time series features generated by each graph node into a second feature matrix, inputting the second feature matrix and its adjacency matrix into the graph neural network, and obtaining a second latent variable for each graph node in the second view; Generate a corresponding representation vector for each graph node in the transaction graph through a graph neural network, obtain a topological structure sequence vector based on the representation vector, and use the topological structure sequence vector of each graph node as the third latent variable of each graph node in the third view; An attention mechanism is used to aggregate the first latent variable, the second latent variable, and the third latent variable of each graph node in the transaction graph to obtain an aggregated vector for each graph node in the transaction graph.

2. A data-driven blockchain anomaly detection method according to claim 1, characterized in that: The real-time data in the blockchain node to be tested is detected to obtain an abnormality detection result including: Establish a real-time transaction graph based on the real-time data in the blockchain node to be tested, generate a real-time feature vector from the real-time transaction graph, and input the real-time feature vector into the anomaly detection model to obtain an anomaly detection result; Obtaining the abnormality detection result includes: If the anomaly detection result is a detection anomaly, the corresponding blockchain node to be tested is verified, and the verification result is used as the label of the blockchain node to be tested; The anomaly detection model is updated according to the label of the blockchain node to be tested.

3. A data-driven blockchain anomaly detection method according to claim 2, characterized in that: Updating the anomaly detection model according to the label of the blockchain node to be tested includes: If the anomaly detection model is updated within a first time interval from its last update or a preset number of verification results have been obtained, updating the anomaly detection model according to the label of the blockchain node to be tested obtained from the verification result; If the anomaly detection model is last updated a second time interval away, the anomaly detection model is retrained, and the first time interval is smaller than the second time interval.

4. A data-driven blockchain anomaly detection terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: Run the blockchain node to be tested and synchronize historical block data, and add a label to the blockchain node to be tested; Based on the historical block data, a transaction graph is established using nodes of the blockchain as graph nodes, a corresponding multi-view feature vector is generated for each graph node in the transaction graph, the multi-view feature vectors are aggregated into an aggregate vector, and an anomaly detection model is trained based on the aggregate vector and the label; Deploy the anomaly detection model on the blockchain node to be tested, detect the real-time data in the blockchain node to be tested, and obtain anomaly detection results; Building a transaction graph based on the historical block data using the nodes of the blockchain as graph nodes includes: Construct the historical block data into a transaction graph G=(V, E, W, T); Where V represents the graph node of the transaction graph, corresponding to the addresses of the blockchain nodes of the two parties to the transaction, E represents the directed edge of the transaction graph, W represents the weight of the directed edge, and T represents the time corresponding to the directed edge; Generating a corresponding multi-view feature vector for each graph node in the transaction graph, and aggregating the multi-view feature vectors into an aggregate vector includes: Calculate statistical features of each graph node in the transaction graph based on the number of transactions and transaction amount, compose a first feature matrix from the statistical features generated by each graph node, input the first feature matrix and its adjacency matrix into a graph neural network, and obtain a first latent variable of each graph node in the first view; Extracting time series features of historical transactions for each graph node in the transaction graph through a neural network, composing the time series features generated by each graph node into a second feature matrix, inputting the second feature matrix and its adjacency matrix into the graph neural network, and obtaining a second latent variable for each graph node in the second view; Generate a corresponding representation vector for each graph node in the transaction graph through a graph neural network, obtain a topological structure sequence vector based on the representation vector, and use the topological structure sequence vector of each graph node as the third latent variable of each graph node in the third view; An attention mechanism is used to aggregate the first latent variable, the second latent variable, and the third latent variable of each graph node in the transaction graph to obtain an aggregated vector for each graph node in the transaction graph.

5. A data-driven blockchain anomaly detection terminal according to claim 4, characterized in that: The real-time data in the blockchain node to be tested is detected to obtain an abnormality detection result including: Establish a real-time transaction graph based on the real-time data in the blockchain node to be tested, generate a real-time feature vector from the real-time transaction graph, and input the real-time feature vector into the anomaly detection model to obtain an anomaly detection result; Obtaining the abnormality detection result includes: If the anomaly detection result is a detection anomaly, the corresponding blockchain node to be tested is verified, and the verification result is used as the label of the blockchain node to be tested; The anomaly detection model is updated according to the label of the blockchain node to be tested.

6. A data-driven blockchain anomaly detection terminal according to claim 5, characterized in that: Updating the anomaly detection model according to the label of the blockchain node to be tested includes: If the anomaly detection model is updated within a first time interval from its last update or a preset number of verification results have been obtained, updating the anomaly detection model according to the label of the blockchain node to be tested obtained from the verification result; If the anomaly detection model is last updated a second time interval away, the anomaly detection model is retrained, and the first time interval is smaller than the second time interval.

Images