Blockchain phishing node identity recognition method based on graph-gated recurrent neural network

Abstract

The application is suitable for the field of blockchain technology, and provides a blockchain phishing node identity recognition method based on a graph gated recurrent neural network, which comprises the following steps: constructing blockchain original transaction data into a dynamic transaction graph; using a GRU module to extract time information in the dynamic transaction graph, using a transaction graph G t As an input of a single time point, a graph convolution operation is coupled for feature extraction, and the GRU module finally outputs H T ; an Output module applies an average pooling operation to calculate a feature representation H G of the entire graph, uses a full connection layer to calculate a predicted label, and uses a cross-entropy loss function as a training target. The application introduces a function of learning topological information of a graph data structure, and retains the original ability of a recurrent neural network to extract time information, can fully utilize space-time information to learn a transaction behavior mode of a node, and improves the accuracy of a phishing node identity recognition algorithm and the recognition efficiency of a task.

Description

Technical Field

[0001] This invention belongs to the field of blockchain technology, and in particular relates to a blockchain phishing node identification method based on graph-gated recurrent neural networks. Background Technology

[0002] Blockchain technology has gained increasing recognition due to its advantages in decentralization, distributed storage, traceability, and data tamper-proofing. Simultaneously, as blockchain technology matures, its application scenarios continue to expand, including electronic cryptocurrencies, financial services, and distributed storage. However, the inherent value of blockchain technology itself has attracted numerous criminals to attack blockchain platforms, leading to a surge in phishing scams and flash loan attacks. Phishing scams have become the most serious type of crime on blockchain platforms, causing incalculable losses to both users and platforms. Therefore, financial security has become a top priority in the blockchain ecosystem, necessitating the development of effective methods for identifying phishing nodes to implement effective market regulation.

[0003] Existing methods first acquire raw transaction data from the blockchain to construct a transaction graph. Nodes in the transaction graph represent the blockchain's transaction accounts, and edges represent transactions between accounts. In actual transactions, multiple transactions may exist between two accounts. Existing methods filter these transactions using different metrics, such as transaction amount and number of transactions, retaining only one transaction as an edge in the transaction graph as needed; or they use calculation methods, such as average transaction amount, to obtain meaningful data between accounts as edges in the graph. After constructing the transaction graph, it is used as input to a deep learning model specifically for identifying phishing nodes. These methods optimize the model structure based on graph neural networks, resulting in a new deep learning model. For example, they incorporate multi-channel and pooling operations, attention mechanisms, graph reconstruction methods, and transaction time density matrices to improve the learning performance of node features. Finally, the node's feature representation is used as the basis for node identity classification, and a classifier is used to obtain the predicted node identity label. However, in blockchain platforms, transactions between nodes have a temporal sequence. Time information reflects the complexities of transactions in the actual environment; therefore, the lack of time-series information leads to a significant loss of information about the true flow of transactions. Most existing methods do not use time information, but instead focus on improving the ability to extract graph topology information and continuously optimize the structure of deep learning models.

[0004] Another approach, while utilizing temporal information, relies on a simple concatenation of different deep learning models. For instance, it uses graph neural networks or recurrent neural networks to extract spatial and temporal information from the transaction graph, then uses the output of one model as input to the other, ultimately obtaining the feature representation of the blockchain transaction node. Therefore, these models fail to achieve a deep fusion of graph structural and temporal information. To address this, we propose a blockchain phishing node identification method based on graph-gated recurrent neural networks. Summary of the Invention

[0005] The purpose of this invention is to provide a blockchain phishing node identification method based on graph-gated recurrent neural networks, aiming to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A blockchain phishing node identification method based on graph-gated recurrent neural networks includes the following steps:

[0008] First, the original blockchain transaction data is constructed into a set of dynamic transaction graphs, which include the time sequence of the original transactions and the topological information of the transaction graph itself.

[0009] The GRU module is used as an external framework to extract time information from the dynamic transaction graph. A transaction graph G from a time segment within the dynamic transaction graph is then used. t As input at a single time point, coupled graph convolution operations are then performed for feature extraction, and the GRU module ultimately outputs H. T ;

[0010] The Output module uses average pooling to calculate the feature representation H of the entire graph. G The system utilizes fully connected layers to calculate predicted labels and uses the cross-entropy loss function as the training objective.

[0011] Furthermore, the input to the GRU module is a set of dynamic transaction graphs, consisting of a two-dimensional adjacency matrix and the original feature matrix for each node. Compared to the original GRU's one-dimensional sequence input, the state update formula of this method is designed to calculate a two-dimensional matrix. For each node in the dynamic transaction graph, the calculation process is weight-shared. The GRU module updates the Cell state H at time segment t. t It is a previous time segment state H t-1 and candidate states Linear interpolation:

[0012]

[0013] Where ⊙ represents the Hartmann product; z t It is the update gate that determines how much of the cell's state is updated, and the calculation formula is:

[0014] z t =σ(W z X t +U z H t-1 +b z );

[0015] Where X t W is the input at time segment t, i.e., the feature matrix of the transaction graph; z and U z It is a learnable weight matrix; b z It is a learnable offset vector;

[0016] Candidate state The calculation formula is:

[0017]

[0018] in Candidate state intermediate computational cost, b h This is a learnable offset vector.

[0019] Furthermore, the intermediate computational complexity of the candidate states It contains the topological structure information of the transaction graph, calculated by the GCN module. The calculation formula is:

[0020]

[0021] Where A t The time segment t is the transaction chart G. t The adjacency matrix consists of nodes and edges; r t It is a set of reset doors, and the calculation formula is as follows:

[0022] r t =σ(W r X t +U r H t-1 +b r ).

[0023] Furthermore, the GCN module redesigned and used the reset gate r of the GRU module when calculating the intermediate computational cost of candidate states. t Compared to the previous time segment state H t-1 Using the Hartmann product as one of the inputs, we obtain The calculated value; the GCN module includes multiple graph convolutional layers, and the output of the l-th layer is calculated as follows:

[0024]

[0025] in It is the adjacency matrix A t The sum of the identity matrix I; yes The degree matrix, for Input, for W t is a learnable parameter matrix.

[0026] Furthermore, the final output H of the GRU module T That is, the feature matrix output by the Cell corresponding to the last time point T is the feature matrix of n nodes in the dynamic transaction graph. The Output module first applies average pooling operation to calculate the feature representation H of the entire graph. G :

[0027] H G =Average_Pooling(H T );

[0028] Then, a fully connected layer is used to connect H G Mapped to Perform graph classification:

[0029]

[0030] Among them W G and b G It is the parameter matrix of the fully connected layer;

[0031] The cross-entropy loss function is used as the training objective:

[0032]

[0033] Where y is the actual identity label of the node. This is the predicted label result.

[0034] Furthermore, the specific definition of the dynamic transaction graph is as follows:

[0035] Let V = {v} i {i = 1, 2, ..., n} is a set of account nodes in the blockchain; E = {e pq Let {p,q∈V} be a set of timestamped transactions, where e pqLet be the edge between accounts p and q, representing the transactions between accounts p and q; X represents the original feature matrix constructed for each node based on the information of the original transactions. Then, all transactions are divided into T time segments, and all transactions within each time segment t construct a transaction graph G associated with that time segment. t Then, T time segments construct a set of dynamic transaction graphs G; the dynamic transaction graph G on V, E, and X is defined as:

[0036] G = {G t}={(V,E t ,X t )},t=1,2,...,T;

[0037] Where E t X is the set of transactions in the t-th time segment; t It is the feature matrix of the node in the t-th time segment.

[0038] Furthermore, the original feature matrix has a dimension of 12, specifically including: the in-degree, out-degree, total number of neighbors, number of income transactions, number of expenditure transactions, total number of transactions, income transaction amount, expenditure transaction amount, total transaction amount, average income amount, average expenditure amount, and average total transaction amount of each node.

[0039] Compared with the prior art, the beneficial effects of the present invention are:

[0040] This blockchain phishing node identification method based on graph-gated recurrent neural networks introduces graph convolution operations to enable the recurrent neural network framework to learn the topological information of graph data structures, while retaining the original ability of recurrent neural networks to extract temporal information. In the process of blockchain phishing node identification, it can make full use of spatiotemporal information to learn the transaction behavior patterns of nodes, thereby improving the accuracy of the phishing node identification algorithm and enhancing the identification efficiency of the task. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0043] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0044] An embodiment of the present invention provides a blockchain phishing node identification method based on a graph-gated recurrent neural network, comprising the following steps:

[0045] First, the original blockchain transaction data is constructed into a set of dynamic transaction graphs, which include the time sequence of the original transactions and the topological information of the transaction graph itself.

[0046] The GRU module is used as an external framework to extract time information from the dynamic transaction graph. A transaction graph G from a time segment within the dynamic transaction graph is then used. t As input at a single time point, coupled graph convolution operations are then performed for feature extraction, and the GRU module ultimately outputs H. T ;

[0047] The Output module uses average pooling to calculate the feature representation H of the entire graph. G The system utilizes fully connected layers to calculate predicted labels and uses the cross-entropy loss function as the training objective.

[0048] In this embodiment of the invention, preferably, because a dynamic transaction graph contains a set of transaction graph sequences that change dynamically over time, the present invention selects a gated recurrent unit (GRU) module as the external framework to extract rich temporal information from the dynamic transaction graph. However, unlike the original GRU which uses a single vector as the input to each cell, the present invention uses the transaction graph G of a time segment in the dynamic transaction graph. t As input at a single time point, coupled graph convolution operations are then used for feature extraction, allowing node neighborhood information to be utilized during state updates.

[0049] In a preferred embodiment of the present invention, the dynamic transaction graph is specifically defined as follows:

[0050] Let V = {v} i {i = 1, 2, ..., n} is a set of account nodes in the blockchain; E = {e pq Let {p,q∈V} be a set of timestamped transactions, where e pq Let be the edge between accounts p and q, representing the transactions between accounts p and q; X represents the original feature matrix constructed for each node based on the original transaction information. The original feature matrix has a dimension of 12 and specifically includes: the node's in-degree, out-degree, total number of neighbors (total degree), number of income transactions, number of expenditure transactions, total number of transactions, income transaction amount, expenditure transaction amount, total transaction amount, average income amount, average expenditure amount, and average total transaction amount. Then, all transactions are divided into T time segments, and all transactions within each time segment t construct a transaction graph G associated with that time segment. t Then, T time segments construct a set of dynamic transaction graphs G; the dynamic transaction graph G on V, E, and X is defined as:

[0051] G = {G t}={(V,E t ,X t )},t=1,2,...,T (1)

[0052] Where E t X is the set of transactions in the t-th time segment; t It is the feature matrix of the node in the t-th time segment.

[0053] In a preferred embodiment of the present invention, the input to the GRU module is a set of dynamic transaction graphs, which consists of a two-dimensional adjacency matrix and an original feature matrix related to the nodes. Compared to the original GRU's one-dimensional sequence input, the state update formula of this method is designed to calculate a two-dimensional matrix. For each node in the dynamic transaction graph, the calculation process is weight-shared. The GRU module updates the Cell state H at time segment t. t It is a previous time segment state H t-1 and candidate states Linear interpolation:

[0054]

[0055] Where ⊙ represents the Hartmann product; z t It is the update gate that determines how much of the cell's state is updated, and the calculation formula is:

[0056] z t =σ(W z X t +U z H t-1 +b z (3)

[0057] Where X t W is the input at time segment t, i.e., the feature matrix of the transaction graph; z and U z It is a learnable weight matrix; b Z It is a learnable offset vector;

[0058] Candidate state The calculation formula is:

[0059]

[0060] in Candidate state intermediate computational cost, b h This is a learnable offset vector.

[0061] As a preferred embodiment of the present invention, the intermediate computational amount of the candidate state The topological structure information of the transaction graph is included and is calculated by the graph convolutional network (GCN) module. The calculation formula is:

[0062]

[0063] Where A t The time segment t is the transaction chart G. t The adjacency matrix consists of nodes and edges; r t It is a set of reset doors, and the calculation formula is as follows:

[0064] r t =σ(W r X t +U r H t-1 +b r (6).

[0065] In a preferred embodiment of the present invention, the GCN module redesigned and used the reset gate r of the GRU module when calculating the intermediate computational amount of the candidate state. t Compared to the previous time segment state H t-1 Using the Hartmann product as one of the inputs, we obtain The calculated value is as follows. The GCN module includes multiple graph convolutional layers, and the output of the l-th layer is calculated as follows:

[0066]

[0067] in It is the adjacency matrix A t The sum of the identity matrix I; yes The degree matrix, for Input, for W t is a learnable parameter matrix.

[0068] As a preferred embodiment of the present invention, the final output H of the GRU module T That is, the feature matrix output by the Cell corresponding to the last time point T is the feature matrix of n nodes in the dynamic transaction graph. Since this invention defines phishing node detection as a graph classification problem, the average pooling operation is first applied in the Output module to calculate the feature representation H of the entire graph. G :

[0069] H G =Average_Pooling(H T(8)

[0070] Then, a fully connected layer is used to connect H G Mapped to Perform graph classification:

[0071]

[0072] Among them W G and b G It is the parameter matrix of the fully connected layer;

[0073] The cross-entropy loss function is used as the training objective:

[0074]

[0075] Where y is the actual identity label of the node. This is the predicted label result.

[0076] Example 1: In this invention, open-source transaction data is obtained from a blockchain platform. All transaction data consists of actual transaction records related to a known identity node, and is divided into multiple groups based on the associated target node. The data is then cleaned, filtered, and standardized. A single original transaction can be represented as a quadruple:

[0077] q_t=(add_from,add_to,amount,timestamp),

[0078] The elements in the tuple represent the source address, destination address, transaction amount, and transaction timestamp, respectively. Then, the dataset is divided into training, validation, and test sets.

[0079] Using a target node in the training set as an implementation example, the technical solution of the present invention is clearly and completely described. The embodiments of the present invention include, but are not limited to, the implementation example given.

[0080] The processed raw dataset stores the original transaction information according to the address of the target node. Taking address 0x0a0ba7a46a…b7627c as an example, all the original transaction data related to this address are arranged in chronological order according to their timestamps, and then divided into T time segments. 0x0a0ba7a46a…b7627c contains a total of t_q... add If there are 100 transaction data points, then the number of data points contained in each time segment is... Then, based on |t_q| for each time segment... t add |Construct a transaction graph G corresponding to each time segment using transaction data. tUnder the condition t = 1, 2, ..., T, a set of dynamic transaction graphs G = {G} is formed. t}

[0081] As mentioned above, the transaction chart G t It contains an adjacency matrix A t and the initial feature matrix X of the node t Using the initial feature matrix X of the node t And the reset gate r1 and update gate z1 of the cell corresponding to the first time segment are calculated using the randomly initialized H0:

[0082] r1=σ(W r X1+U r H0+b r )

[0083] z1=σ(W z X1+U z H0+b z )

[0084] Calculate using reset gate r1, adjacency matrix A1, and initial characteristic matrix X1

[0085]

[0086] The GCN module includes two graph convolutional layers, for The output of each layer can be calculated as follows:

[0087]

[0088]

[0089] for The output of each layer can be calculated as follows:

[0090]

[0091]

[0092]

[0093] Then use Calculate candidate states

[0094]

[0095] Candidate state Used to calculate the state H1 of this time segment t=1:

[0096]

[0097] Repeat the above calculation process until time segment T is calculated, and obtain H. T :

[0098] By performing average pooling on the features of each node, we obtain the graph embedding H with respect to address 0x0a0ba7a46a…b7627c. G :

[0099] H G =Average_Pooling(H T )

[0100] The predicted labels are computed using fully connected layers, and the cross-entropy loss function is used as the training objective.

[0101]

[0102]

[0103] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention, and these should also be considered within the scope of protection of the present invention. These modifications and improvements will not affect the effectiveness of the implementation of the present invention or the practicality of the patent.

Claims

1. A blockchain phishing node identification method based on graph-gated recurrent neural networks, characterized in that, Includes the following steps: First, the original blockchain transaction data is constructed into a set of dynamic transaction graphs, which include the time sequence of the original transactions and the topological information of the transaction graph itself. The GRU module is used as an external framework to extract time information from the dynamic transaction graph. A transaction graph G from a time segment within the dynamic transaction graph is then used. t As input at a single time point, coupled graph convolution operations are then performed for feature extraction, and the GRU module ultimately outputs H. T ; The Output module uses average pooling to calculate the feature representation H of the entire graph. G The fully connected layer is used to calculate the predicted label and the cross-entropy loss function is used as the training objective. The input to the GRU module is a set of dynamic transaction graphs, which are two-dimensional adjacency matrices and original feature matrices related to the nodes. The GRU module in Cell state H during time segment t t It is a previous time segment state H t-1 and candidate states Linear interpolation: ； Where ⊙ represents the Hartmann product; z t It is the update gate that determines how much of the cell's state is updated, and the calculation formula is: ； Where X t W is the input at time segment t, i.e., the feature matrix of the transaction graph; z and U z It is a learnable weight matrix; b z It is a learnable offset vector; Candidate state The calculation formula is: ； in Candidate state intermediate computational cost, b h It is a learnable offset vector; The intermediate computational cost of the candidate states It contains the topological structure information of the transaction graph, calculated by the GCN module. The calculation formula is: ； Where A t The time segment t is the transaction chart G. t The adjacency matrix consists of nodes and edges; r t It is a set of reset doors, and the calculation formula is as follows: 。 2. The blockchain phishing node identification method based on graph-gated recurrent neural networks according to claim 1, characterized in that, The GCN module calculates the intermediate computational cost of candidate states. When using the reset gate of the GRU module Compared to the previous time segment state Using the Hartmann product as one of the inputs, we obtain The calculated value; the GCN module includes multiple graph convolutional layers, for the first... The layer's output is calculated as follows: ； in It is the adjacency matrix A t The sum of the identity matrix I; yes The degree matrix, ;for Input, ,for , W t is a learnable parameter matrix.

3. The blockchain phishing node identification method based on graph-gated recurrent neural networks according to claim 1, characterized in that, The final output H of the GRU module T That is, the feature matrix output by the Cell corresponding to the last time point T is the feature matrix of n nodes in the dynamic transaction graph. The Output module first applies average pooling operation to calculate the feature representation H of the entire graph. G : ； Then, a fully connected layer is used to connect H G Mapped to Perform graph classification: ； Among them W G and b G It is the parameter matrix of the fully connected layer; The cross-entropy loss function is used as the training objective: ； Where y is the actual identity label of the node. This is the predicted label result.

4. The blockchain phishing node identification method based on graph-gated recurrent neural networks according to claim 1, characterized in that, The specific definition of the dynamic transaction graph is as follows: Let V = {v i {i = 1, 2, …, n} is a set of account nodes in the blockchain; E = {e pq Let {p, q∈V} be a timestamped set of transactions, where e pq Let be the edge between accounts p and q, representing the transactions between accounts p and q; X represents the original feature matrix constructed for each node based on the information of the original transactions. Then, all transactions are divided into T time segments, and all transactions within each time segment t construct a transaction graph G associated with that time segment. t Then, T time segments construct a set of dynamic transaction graphs G; the dynamic transaction graph G on V, E, and X is defined as: ； Where E t X is the set of transactions in the t-th time segment; t It is the feature matrix of the node in the t-th time segment.

5. The blockchain phishing node identification method based on graph-gated recurrent neural networks according to claim 4, characterized in that, The original feature matrix has a dimension of 12 and specifically includes: the in-degree, out-degree, total number of neighbors, number of income transactions, number of expenditure transactions, total number of transactions, income transaction amount, expenditure transaction amount, total transaction amount, average income amount, average expenditure amount, and average total transaction amount of each node.

Images