A method and system for auxiliary tracking of abnormal capital flow in Ethereum

Abstract

The present invention provides an auxiliary tracking method and system for abnormal fund flow in Ethereum, the method comprising the following steps: obtaining the initial address of the case, obtaining the relevant addresses with fund transfer relationship from the database based on each initial address, and constructing a local directed graph based on each initial address and the relevant addresses of each initial address; constructing a global graph based on all local directed graphs, and determining the embedding vector of each node in the global graph based on the node2vec algorithm; inputting the embedding vector of each node and the node characteristic parameter into a preset calculation model to obtain the predicted probability of each node, screening the nodes in the global graph based on the predicted probability, and determining the predicted nodes in the global graph; constructing multiple candidate paths based on the predicted nodes, and calculating the confidence of the candidate paths based on the predicted probability of each node in the candidate paths. In this scheme, investigators can further investigate the candidate paths according to the confidence, thereby improving the efficiency of investigators.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to an auxiliary tracking method and system for abnormal fund flows in Ethereum. Background Art

[0002] In the field of blockchain, especially on platforms such as Ethereum, fund flow tracking is to identify and track the flow of funds by analyzing blockchain transactions. Due to the openness and transparency of blockchain, all transaction records are publicly available, which provides investigators with a new means of fund flow. However, due to the anonymity of blockchain, there are also certain challenges and limitations in tracking abnormal fund flows. Therefore, this technology usually needs to be combined with other investigative methods to more effectively track fund flows.

[0003] For a long time, the tracing process often requires a large number of investigators to participate manually. Investigators will repeatedly study and judge the characteristics of these capital flows, and finally trace them back through some auxiliary information. However, each time the investigators complete a tracing process, they often start from scratch, which leads to low efficiency of the investigators. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides an auxiliary tracking method for abnormal fund flows in Ethereum to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of the present invention provides a method for assisting in tracking abnormal fund flows in Ethereum, the method comprising the following steps:

[0006] Obtaining the initial address of the case, obtaining related addresses with fund transfer relationships from the database based on each initial address, and constructing a local directed graph based on each initial address and the related addresses of each initial address;

[0007] Constructing a global graph based on all local directed graphs, and determining an embedding vector of each node in the global graph based on a node2vec algorithm;

[0008] Inputting the embedding vector of each node and the characteristic parameters of the node into a preset calculation model to obtain the prediction probability of each node, and screening the nodes in the global graph based on the prediction probability to determine the predicted nodes in the global graph;

[0009] A plurality of candidate paths are constructed based on the predicted nodes, and the confidence of the candidate paths is calculated based on the predicted probability of each node in the candidate paths.

[0010] Adopting the above scheme, this scheme first determines the global graph based on the transfer relationship of funds. The nodes in the global graph correspond to an address, and the edges between nodes correspond to the fund transfer between nodes. Then, the prediction probability of each prediction node is calculated through the node2vec algorithm and the calculation model, and the prediction nodes are screened out based on the prediction probability. The prediction nodes are connected in order to construct multiple candidate paths, and the confidence of each candidate path is determined. Investigators can conduct further selective investigations on the candidate paths according to the confidence of the candidate paths, thereby improving the efficiency of investigators.

[0011] In some embodiments of the present invention, in the step of constructing a local directed graph based on each initial address and the related addresses of each initial address, the addresses within 2 hops or 3 hops from the initial address are obtained, the node corresponding to the initial address is used as the initial node, and each other address is used as a node to construct the local directed graph.

[0012] In some embodiments of the present invention, each address corresponds to a node in a local directed graph. In the step of constructing a local directed graph based on each initial address and the related addresses of each initial address, if there are multiple transactions with the same transfer direction between two addresses with a funds transfer relationship, the transaction data of the multiple transactions with the same transfer direction are merged, and the transaction data are assigned to the edge between the nodes corresponding to the two addresses in the local directed graph.

[0013] In some embodiments of the present invention, in the step of constructing a global graph based on all local directed graphs, each local directed graph is constructed into a global graph based on the same nodes in each local directed graph.

[0014] In some embodiments of the present invention, the step of determining the embedding vector of each node in the global graph based on the node2vec algorithm includes:

[0015] Perform biased walking based on the preset walking strategy to obtain a walking sequence;

[0016] Based on the walk sequence, the Skip-gram algorithm is used to determine the embedding vector of each node.

[0017] In some embodiments of the present invention, in the step of performing biased walking based on a preset walking strategy to obtain a walking sequence, the walking sequence is obtained based on a weight parameter calculated by logistic regression.

[0018] In some embodiments of the present invention, in the step of screening the nodes in the global graph based on the predicted probability to determine the predicted nodes in the global graph, the nodes in the global graph are screened based on a preset predicted probability threshold to determine the predicted nodes in the global graph.

[0019] In some embodiments of the present invention, in the step of calculating the confidence of the candidate path based on the predicted probability of each node in the candidate path, the layer gain value is determined based on the position of the node in the global graph, and the confidence of the candidate path is calculated based on the layer gain value and the predicted probability of each node in the candidate path.

[0020] In some embodiments of the present invention, in the step of determining the layer gain value based on the position of the node in the global graph, the layer of the node is determined based on the distance between the node and the nearest initial node in the global graph, and then the layer gain value is determined.

[0021] In some embodiments of the present invention, in the step of calculating the confidence of the candidate path based on the layer gain value and the predicted probability of each node in the candidate path, the confidence of the candidate path is calculated using the following formula:

[0022]

[0023] Among them, β represents the confidence of the candidate path, N is the number of nodes in the candidate path, i represents any node in the candidate path, and Prd i represents the predicted probability of node i in the candidate path, delta v Indicates the layer gain value corresponding to the layer where node i is located in the candidate path.

[0024] The second aspect of the present invention also provides an auxiliary tracking system for abnormal fund flows in Ethereum, the system comprising a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, the processor being used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the system implements the steps implemented by the method described above.

[0025] The third aspect of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps implemented by the aforementioned auxiliary tracking method for abnormal fund flows in Ethereum.

[0026] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention can be specifically pointed out and obtained in the specification and the accompanying drawings.

[0027] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention.

[0029] Figure 1 A schematic diagram of an implementation method of an auxiliary tracking method for abnormal fund flows in Ethereum of the present invention;

[0030] Figure 2 This is a schematic diagram of the image walking in this scheme;

[0031] Figure 3 Schematic diagram of an image including candidate paths in this scheme. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0033] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0034] like Figure 1 As shown, the present invention proposes an auxiliary tracking method for abnormal fund flow in Ethereum, which includes the following steps:

[0035] Step S100, obtaining the initial address of the case, obtaining related addresses with fund transfer relationship from the database based on each initial address, and constructing a local directed graph based on each initial address and the related addresses of each initial address;

[0036] In some embodiments of the present invention, a case often has several reporting addresses as initial addresses, and investigators usually start from these initial addresses and obtain the fund transfer paths of the relevant addresses from the database.

[0037] In the specific implementation process, the local directed graph also includes nodes marked with expert judgment addresses determined by investigators, and one case corresponds to one case number. Since a case may have multiple initial addresses at the beginning of the report, one case number may correspond to multiple initial addresses. For each initial address, the investigator will make a judgment based on the address and then give a series of expert judgment addresses.

[0038] Step S200, constructing a global graph based on all local directed graphs, and determining an embedding vector of each node in the global graph based on a node2vec algorithm;

[0039] In the specific implementation process, the node2vec algorithm is divided into two parts. The first part is to generate a context sequence of a node through random walk, and the second part is to generate the embedding vectors of each node through the SkipGram algorithm. In the first part, the preference of random walk is mainly related to several parameters, namely p, q, and W. Among them, W is the weight of the edge. For example, for Figure 2 the node B shown, there are four choices for random walking to the next node. For each choice, there is a certain probability, which is determined by the three parameters p, q, and W. p and q determine whether the random walk is biased towards breadth-first walk or depth-first walk. When p > q, it is biased towards depth-first, and when p < q, it is biased towards breadth-first walk. For this solution, the global graph is composed of local directed graphs, so this solution tends to breadth-first walk. Empirically, p = 2 and q = 4 are set. The W parameter represents the weight of this edge, which is determined by the weight of the merged edge.

[0040] This solution has three dimensions of merged data, namely transaction amount, transaction time, and Gas price, which are respectively denoted as W amount 、W interval and W GasPrice , and the linear combination of these parameters is used to determine W.

[0041] The definitions of Z and F(Z) are as follows.

[0042] Z = a 1 *W amount + a 2 *W interval + a 3 *W GasPrice + b ；

[0043]

[0044] W = P * F(Z) ；

[0045] a 1 、a 2 、a 3 and b are all preset calculation parameters, P is the penalty coefficient, and the steps of the above formula are the logistic regression process. When the investigator marks the expert judgment address, it is equivalent to marking the edge between addresses, forming a judgment path. When walking, it tends to discover certain features along the direction of these judgment paths. This solution makes the transition probability in these directions higher. That is, logistic regression is performed on the "edge" dataset to minimize the loss to determine a 1 、a 2 、a 3and b values. Specifically, the penalty coefficient is 0.75 in the reverse direction and 1.0 in the forward direction. Since the value range of F(Z) is [0,1], the value range of W is also [0,1].

[0046] Step S300, inputting the embedding vector of each node and the characteristic parameters of the node into a preset calculation model to obtain the prediction probability of each node, and screening the nodes in the global graph based on the prediction probability to determine the predicted nodes in the global graph;

[0047] In a specific implementation process, the computing model may be a classification model trained by an SVM algorithm, and the classification model outputs the prediction probability of each node.

[0048] In the specific implementation process, the node characteristic parameters include the number of transactions at the node, the output amount of the node, and the input amount of the node.

[0049] Specifically, Support Vector Machine (SVM) is a powerful supervised learning algorithm that is widely used in classification and regression problems. The basic idea of ​​SVM is to map the input data into a high-dimensional feature space and then find a hyperplane that maximizes the interval between data points of different categories. This interval is called the "support vector" and is the core of the SVM algorithm. By maximizing the interval, SVM aims to find a decision boundary with good generalization ability for unknown data. SVM has several advantages, such as efficient and effective processing of high-dimensional data and strong processing capabilities for nonlinear problems. By introducing kernel functions, SVM is able to handle nonlinearly separable data sets, further expanding its scope of application. In addition, SVM is also highly robust and insensitive to noise and outliers.

[0050] Step S400: construct multiple candidate paths based on the predicted nodes, and calculate the confidence of the candidate paths based on the predicted probability of each node in the candidate paths.

[0051] Adopting the above scheme, this scheme first determines the global graph based on the transfer relationship of funds. The nodes in the global graph correspond to an address, and the edges between nodes correspond to the fund transfer between nodes. Then, the prediction probability of each prediction node is calculated through the node2vec algorithm and the calculation model, and the prediction nodes are screened out based on the prediction probability. The prediction nodes are connected in order to construct multiple candidate paths, and the confidence of each candidate path is determined. Investigators can conduct further selective investigations on the candidate paths according to the confidence of the candidate paths, thereby improving the efficiency of investigators.

[0052] In some embodiments of the present invention, in the step of constructing a local directed graph based on each initial address and the related addresses of each initial address, the addresses within 2 hops or 3 hops from the initial address are obtained, the node corresponding to the initial address is used as the initial node, and each other address is used as a node to construct the local directed graph.

[0053] In some embodiments of the present invention, each address corresponds to a node in a local directed graph. In the step of constructing a local directed graph based on each initial address and the related addresses of each initial address, if there are multiple transactions with the same transfer direction between two addresses with a funds transfer relationship, the transaction data of the multiple transactions with the same transfer direction are merged, and the transaction data are assigned to the edge between the nodes corresponding to the two addresses in the local directed graph.

[0054] In the specific implementation process, a local directed graph is constructed for each initial address. For each initial address, the initial address is taken as the 0th layer, a 3-layer graph is constructed and the corresponding expert judgment address is marked in the graph. The address with which funds have been exchanged is found with the initial address as the center of the circle. The initial address is defined as the 0th layer, the address with funds directly exchanged with the 0th layer is the 1st layer, the address with funds directly exchanged with the 1st layer is the 2nd layer, and so on. In the process of constructing the entire local directed graph, there may be multiple edges between two nodes, which means that there are multiple transactions between two addresses. This scheme merges the above-mentioned multiple edges. After the merger, two nodes have only one edge in one direction. For each edge to be merged, three dimensions are merged, namely, transaction amount, Gas price and transaction time; for the transaction amount: the merger is carried out in the form of cumulative sum. Specifically, the transaction amount of the merged edge is equal to the cumulative amount of each transaction before the merger; the Gas price is merged by taking the median. Specifically, the Gas price of the merged edge is equal to the median of the Gas price of each transaction before the merger; the transaction time is sorted in ascending order for each transaction, and then the intervals between these transaction times are calculated one by one. If there are n transactions before the merger, the difference between the previous and the next will generate n-1 time intervals, and the average of these intervals is taken as the transaction time after the merger.

[0055] In some embodiments of the present invention, in the step of constructing a global graph based on all local directed graphs, each local directed graph is constructed into a global graph based on the same nodes in each local directed graph.

[0056] In some embodiments of the present invention, the step of determining the embedding vector of each node in the global graph based on the node2vec algorithm includes:

[0057] Perform biased walking based on the preset walking strategy to obtain a walking sequence;

[0058] Based on the walk sequence, the Skip-gram algorithm is used to determine the embedding vector of each node.

[0059] In some embodiments of the present invention, in the step of performing biased walking based on a preset walking strategy to obtain a walking sequence, the walking sequence is obtained based on a weight parameter calculated by logistic regression.

[0060] In some embodiments of the present invention, in the step of screening the nodes in the global graph based on the predicted probability to determine the predicted nodes in the global graph, the nodes in the global graph are screened based on a preset predicted probability threshold to determine the predicted nodes in the global graph.

[0061] In a specific implementation process, the prediction probability threshold may be 50%.

[0062] In some embodiments of the present invention, in the step of calculating the confidence of the candidate path based on the predicted probability of each node in the candidate path, the layer gain value is determined based on the position of the node in the global graph, and the confidence of the candidate path is calculated based on the layer gain value and the predicted probability of each node in the candidate path.

[0063] In some embodiments of the present invention, in the step of determining the layer gain value based on the position of the node in the global graph, the layer of the node is determined based on the distance between the node and the nearest initial node in the global graph, and then the layer gain value is determined.

[0064] Specifically, based on a preset corresponding relationship, each layer corresponds to a preset gain value.

[0065] In some embodiments of the present invention, in the step of calculating the confidence of the candidate path based on the layer gain value and the predicted probability of each node in the candidate path, the confidence of the candidate path is calculated using the following formula:

[0066]

[0067] Among them, β represents the confidence of the candidate path, N is the number of nodes in the candidate path, i represents any node in the candidate path, and Prd i represents the predicted probability of node i in the candidate path, delta v Indicates the layer gain value corresponding to the layer where node i is located in the candidate path.

[0068] In the specific implementation process, Figure 3As shown in the figure, B is the initial node. In the process of selecting candidate paths, the candidate paths must include the initial node, and the candidate paths must be in the same direction. The three candidate paths include ABEFG, BEFG and CBEFG. Next, the confidence of these paths is calculated. If the predicted probability of the i-th node on a path is recorded as Prd i . Let the level gain value delta v Indicates the layer gain value corresponding to the layer where node i is located in the candidate path. Specifically, delta v It can be 0, 0.3 or 0.5. Specifically, the gain value can be set according to the following Table 1, that is, the 0th layer is set to 0, the 1st layer is set to 0, the 2nd layer is set to 0.3, and the 3rd layer is set to 0.5;

[0069] Table 1

[0070] <![CDATA[delta 0 ]]> 0 <![CDATA[delta 1 ]]> 0 <![CDATA[delta 2 ]]> 0.3 <![CDATA[delta 3 ]]> 0.5

[0071] Among the three paths, ABEFG, BEFG and CBEFG, the BEFG path has the highest confidence and can be promoted as a priority.

[0072] By adopting the above scheme, this scheme can first construct a local graph based on each initial address and further construct a global graph. The node in the global graph corresponds to an address, and the edge between the nodes corresponds to the fund transfer between the nodes. The prediction probability of each prediction node is then calculated through the node2vec algorithm and the calculation model, and the prediction nodes are screened out based on the prediction probability. The prediction nodes are connected in order to construct multiple candidate paths, and the confidence of each candidate path is calculated. Specifically, the multiple paths can be sorted from high to low according to the confidence. Investigators can make further identification based on the above sorting results, so that investigators can selectively further investigate the candidate paths according to the confidence of the candidate paths, thereby improving the efficiency of investigators.

[0073] The beneficial effects of this program include:

[0074] 1. Based on the data set, multiple local directed graphs are generated using data preprocessing methods;

[0075] 2. This scheme merges multiple local directed graphs into an overall graph. In this graph, the node2vec algorithm is used to extract feature vectors.

[0076] 3. Use the SVM training model on the training data set to implement a binary classification prediction model for nodes.

[0077] 4. The path completion model is added to the prediction model to complete the path and integrated into an overall model. At this time, the path prediction can be realized.

[0078] 5. When a new address is given, this solution will generate a local directed graph and generate features that are input into the path prediction model. The model will give a predicted path with the highest confidence. Investigators can conduct research and judgment based on this predicted path to improve their work efficiency.

[0079] An embodiment of the present invention also provides an auxiliary tracking system for abnormal fund flows in Ethereum, the system comprising a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, the processor being used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the system implements the steps implemented by the method described above.

[0080] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps implemented by the auxiliary tracking method of abnormal fund flow in Ethereum are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0081] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0082] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0083] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0084] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for assisting in tracking abnormal fund flows in Ethereum, characterized in that: The method comprises the following steps: Obtaining the initial address of the case, obtaining related addresses with fund transfer relationships from the database based on each initial address, and constructing a local directed graph based on each initial address and the related addresses of each initial address; Constructing a global graph based on all local directed graphs, and determining an embedding vector of each node in the global graph based on a node2vec algorithm; The embedding vector and node characteristic parameters of each node are input into a preset calculation model to obtain the prediction probability of each node, and the nodes in the global graph are screened based on the prediction probability to determine the prediction nodes in the global graph. The calculation model is a classification model trained by the SVM algorithm, and the node characteristic parameters include the number of transactions, output amount, and input amount of the node; Based on the predicted nodes, multiple candidate paths are constructed, and the confidence of the candidate paths is calculated based on the predicted probability of each node in the candidate paths. The layer gain value is determined based on the position of the node in the global graph. The confidence of the candidate paths is calculated based on the layer gain value and the predicted probability of each node in the candidate paths. The confidence of the candidate paths is calculated using the following formula: in, represents the confidence of the candidate path, N is the number of nodes in the candidate path, represents any node in the candidate path, Represents the nodes in the candidate path The predicted probability of Represents the nodes in the candidate path The layer gain value corresponding to the layer.

2. The auxiliary tracking method for abnormal fund flow in Ethereum according to claim 1 is characterized in that: In the step of constructing a local directed graph based on each initial address and the related addresses of each initial address, the addresses within 2 hops or 3 hops from the initial address are obtained, the node corresponding to the initial address is used as the initial node, and each other address is used as a node to construct the local directed graph.

3. The auxiliary tracking method for abnormal fund flow in Ethereum according to claim 1 is characterized in that: Each address corresponds to a node in the local directed graph. In the step of constructing a local directed graph based on each initial address and the related addresses of each initial address, if there are multiple transactions with the same transfer direction between two addresses with a fund transfer relationship, the transaction data of the multiple transactions with the same transfer direction are merged, and the transaction data are assigned to the edge between the nodes corresponding to the two addresses in the local directed graph.

4. The auxiliary tracking method for abnormal fund flow in Ethereum according to claim 1 is characterized in that: In the step of constructing a global graph based on all the local directed graphs, each local directed graph is constructed into a global graph based on the same nodes in each local directed graph.

5. The auxiliary tracking method of abnormal fund flow in Ethereum according to claim 1 is characterized in that: The step of determining the embedding vector of each node in the global graph based on the node2vec algorithm includes: Perform biased walking based on the preset walking strategy to obtain a walking sequence; Based on the walk sequence, the Skip-gram algorithm is used to determine the embedding vector of each node.

6. The auxiliary tracking method of abnormal fund flow in Ethereum according to claim 1 is characterized in that: In the step of screening the nodes in the global graph based on the predicted probability to determine the predicted nodes in the global graph, the nodes in the global graph are screened based on a preset predicted probability threshold to determine the predicted nodes in the global graph.

7. The auxiliary tracking method of abnormal fund flow in Ethereum according to claim 1 is characterized in that: In the step of determining the layer gain value based on the position of the node in the global graph, the layer where the node is located is determined based on the distance between the node and the nearest initial node in the global graph, and then the layer gain value is determined.

8. An auxiliary tracking system for abnormal fund flows in Ethereum, characterized in that: The system includes a computer device, which includes a processor and a memory, wherein the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps implemented by the method as described in any one of claims 1 to 7.

Images