Bitcoin abnormal transaction detection method based on transaction graph characteristics

Abstract

The invention relates to a Bitcoin abnormal transaction detection method based on transaction graph features, and belongs to the field of blockchain application technology security. According to the method, studies are carried out by utilizing tagged bitcoin transaction data, a transaction network graph is constructed, nodes and edges in the graph are analyzed by utilizing a graph attention mechanism and a graph convolutional neural network, and a transaction network structure and time sequence information are fused. Accurate identification of abnormal transactions is realized through multi-layer graph convolution operation. The method is superior to a traditional detection method in the aspects of precision and generalization ability, and aims at efficiently and accurately identifying the abnormal transaction entity in the bitcoin field with a low missed judgment rate.

Description

Technical Field

[0001] The present invention relates to the field of blockchain application security, and aims to effectively detect abnormal transaction behaviors on the Bitcoin blockchain by using machine learning, deep learning and data analysis technologies based on the characteristics of Bitcoin transaction entities and their transaction graphs. Background Art

[0002] Blockchain technology is a new application model that is the result of the integration of computer technologies such as distributed data storage, P2P networks, consensus mechanisms, and encryption algorithms. Its essence is a new type of distributed shared ledger technology, or it can be called a new type of distributed database. Because the underlying blockchain technology uses a large number of scientific technologies such as cryptography and consensus mechanisms, blockchain applications have the characteristics of decentralization, immutability, full traceability, traceability, collective maintenance, and openness and transparency. These characteristics enable blockchain technology to achieve trusted transactions in a mutually distrustful environment and improve collaboration efficiency.

[0003] With the popularization and application of blockchain technology, more and more cryptocurrency financial transactions are conducted on blockchain. However, financial transactions using cryptocurrency are different from traditional financial transactions. For example, cryptocurrency applications such as Bitcoin and Ethereum have decentralized and anonymous characteristics. Everyone can create multiple accounts, and the accounts are highly anonymous, resulting in a large number of financial crimes in such cryptocurrency applications. These illegal activities are usually manifested in the form of abnormal transactions. Abnormal transactions refer to those transactions that are significantly deviated from normal transaction behaviors, including but not limited to money laundering, fraud, illegal fundraising, etc. Due to the anonymity and decentralization of blockchain transactions, abnormal transactions are more likely to occur and more difficult to detect and combat. These abnormal transactions may have serious negative effects on blockchain systems and participants, such as undermining trust, damaging system stability, and affecting the interests of participants. These illegal activities will not only damage the interests of individuals and institutions, but also undermine the credibility and stability of blockchain. Therefore, how to detect and prevent abnormal transaction behaviors on blockchain in a timely and accurate manner has become an important issue in the blockchain field.

[0004] At present, traditional financial regulators mainly rely on manual review and monitoring systems to detect and prevent abnormal transactions. However, these methods have problems such as high labor costs, low efficiency and prone to errors. Therefore, studying how to use machine learning, deep learning, graph theory and other technologies to automatically detect and prevent abnormal trading behaviors has become a hot topic and difficulty in current research.

[0005] The present invention focuses on abnormal Bitcoin transactions. First, due to the huge and growing volume of Bitcoin transaction data, large-scale data processing and analysis are required, which poses challenges to traditional data processing technologies and algorithms, including storing, indexing, querying and analyzing large amounts of transaction data. Second, abnormal transaction detection requires accurate identification of abnormal patterns and behaviors. However, the complexity and diversity of Bitcoin transactions make it difficult to extract effective features and accurately identify abnormal patterns, and it is necessary to develop more accurate feature extraction methods and efficient pattern recognition algorithms. Finally, existing abnormal transaction data sets may be affected by errors, fraud or malicious behavior, resulting in data reliability and accuracy issues. In abnormal transaction detection, data quality issues need to be addressed, including data outliers and missing value processing.

[0006] The present invention is studied based on Bitcoin transaction entities. The purpose is to design a Bitcoin abnormal transaction detection method based on transaction graph features. After obtaining Bitcoin historical transaction data, each transaction is used as a node, and the Bitcoin flow between transactions is used as an edge to construct a transaction network graph. Then, the graph attention mechanism is used to guide the transfer of nodes to selectively select neighbor nodes, and then the graph convolutional neural network is used to aggregate the information of the neighbor nodes of the target node. After multi-layer graph convolution, the binary classification results of each node are output. It fully integrates the structural information of the transaction network and the temporal information of the transaction records, showing accuracy and generalization ability that are superior to traditional detection methods. Summary of the invention

[0007] The present invention aims to identify abnormal transaction entities in the Bitcoin field with high efficiency, high accuracy and low missed detection rate. Through the characteristics of abnormal Bitcoin transaction entities, a method of detecting abnormal Bitcoin transactions based on transaction graph features is proposed by using graph attention mechanism and graph convolutional neural network. Specifically, the following steps are included:

[0008] Step 1: Get real data about Bitcoin transactions from ellipitic.co, a website that collects historical transaction records of the Bitcoin transaction network. It is presented in the form of a topological graph. In the graph, a node represents a Bitcoin transaction, an edge represents the Bitcoin flow between two transactions, and the node contains 166 features, which are marked as "legal", "illegal" and "unknown".

[0009] Step 2: Read the original transaction data, including transaction category information, transaction edge information, and transaction feature information. Here, the specific transaction graph is defined as G = (V, E), where V represents the set of nodes in the graph, E represents the set of edges in the graph, and each node is associated with a set of 166-dimensional feature matrices and a label.

[0010] Step 3: Since each node in the transaction data is divided into a time step, there are 1 to 49 time steps in total, each time step is about two weeks apart, and there is no edge connection between transactions in different time steps, so the transactions are grouped by time step. Each group of transactions is mapped into the form of an adjacency matrix. The value in the adjacency matrix represents whether there is a directed edge between two transactions, 1 indicates yes, and 0 indicates no.

[0011] Step 4: The graph attention mechanism guides the transfer of nodes during the random walk, selects the next node to be visited according to the weight, and thus selects neighboring nodes for the next stage of feature aggregation in a targeted manner. Further, step 4 is implemented using the following steps:

[0012] Step 4.1: Biased sampling strategy based on transaction amount:

[0013]

[0014] Among them, A(u,x) represents the number of bitcoins transferred from node u to node x, that is, the transaction amount, and ∑x'∈A(u,x') represents the sum of the number of bitcoins transferred from node u to all its neighboring nodes.

[0015] Step 4.2: Time-based biased sampling strategy:

[0016]

[0017] Where T(u,x) represents the transaction timestamp between node u and node x, and ∑x'∈T(u,x') represents the sum of the timestamps of transactions initiated by node u to all its neighboring nodes.

[0018] Step 4.3: Normalize the transition probabilities:

[0019]

[0020] Here, α is a balancing factor ranging from 0 to 1, which allows the sampling procedure to adjust its deviation between time and amount.

[0021] Step 5: According to the biased sampling strategy in step 4, use the graph convolutional neural network to aggregate neighbor nodes and obtain the information of neighbor nodes to update the representation of the nodes. The main steps of graph convolution are as follows:

[0022] Step 5.1: Perform a linear transformation on the feature matrix of the node to map the features of each node to a new feature space, thereby aggregating the original features of the node and the features of the neighboring nodes to generate a more complex node representation.

[0023] Step 5.2: Use a nonlinear activation function to perform nonlinear mapping on the results of linear transformation, so that the model can learn more complex node relationships and feature expressions.

[0024] The above two steps can be expressed by the following formula:

[0025]

[0026] Among them, H (l) is the node feature matrix of the lth layer, which represents the matrix composed of the feature vectors of all nodes in the graph. Each row corresponds to a node, and each column corresponds to a feature dimension.

[0027] It is an adjacency matrix with added self-connections, which represents the connection relationship between nodes in the graph. It is obtained by adding self-connection to the original adjacency matrix A, that is, setting the diagonal elements of A to 1. The purpose of this is to retain the characteristic information of each node itself.

[0028] is a degree matrix, where each element represents the degree of a node (i.e., the number of edges connected to the node), The definition is

[0029] W (l) It is the weight matrix of the lth layer, which is used to perform linear transformation on node features.

[0030] σ(·) is the activation function, which performs nonlinear mapping on the result of linear transformation.

[0031] Step 6: In the last layer of graph convolution, nodes are classified and predicted, and the fully connected layer or other classifiers are mainly used to further process and predict the features of the nodes. In this invention, the softmax function is mainly used to map the features of the nodes to the category distribution, and then the nodes are classified according to the category with the largest probability value:

[0032]

[0033] This formula represents the node classification of a two-layer graph convolutional neural network, where H is the input node feature matrix, which represents the matrix composed of the feature vectors of all nodes in the graph. Each row corresponds to a node, and each column corresponds to a feature dimension.

[0034] A is the adjacency matrix, which represents the connection relationship between nodes in the graph.

[0035] It is the adjacency matrix with self-connection added after normalizing the adjacency matrix. In general, The calculation method is That is, softmax normalization is performed on each row of the adjacency matrix A.

[0036] W (0) and W (1) Are two weight matrices used to linearly transform the input features.

[0037] ReLU(·) is the Rectified Linear Unit activation function, which sets the input value less than zero to zero and keeps the value greater than or equal to zero unchanged.

[0038] Softmax(·) is the softmax function, which is used in the last layer of the graph convolutional neural network. It maps the feature vector of the node to the category probability distribution of the node, and then selects the category with the highest probability as the predicted label of the node.

[0039] Compared with the existing technology, the present invention has the following advantages:

[0040] (1) The present invention considers the relationship between nodes in the Bitcoin transaction network graph, and adopts the graph attention mechanism and graph convolutional neural network to effectively capture the complex relationship and interaction pattern between nodes. The graph convolutional neural network can aggregate and integrate the features of a node with the features of its neighboring nodes by performing convolution operations on the graph structure, thereby better understanding the dependencies and interaction patterns between transactions. This ability to consider the relationship between nodes makes abnormal transaction detection more accurate and robust.

[0041] (2) Traditional methods require manual design and selection of features for abnormal transaction detection. Using graph convolutional neural networks, through multi-layer graph convolution operations, the feature representation of nodes can be gradually changed to capture implicit features and patterns in transaction data. Compared with manually designed features, GCN can more comprehensively utilize the features in the transaction graph and has adaptability and generalization capabilities.

[0042] (3) Experiments have shown that the present invention has achieved a recognition accuracy rate of over 93% on the existing Bitcoin transaction graph dataset, which is a significant improvement over traditional methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a workflow diagram of a method for detecting abnormal Bitcoin transactions based on transaction graph features of the present invention.

[0044] Figure 2 This is a model overall framework diagram of a method for detecting abnormal Bitcoin transactions based on transaction graph features of the present invention. DETAILED DESCRIPTION

[0045] The technical solution of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Embodiment 1:

[0047] This embodiment describes the application of the detection method based on transaction graph features to the scenario of abnormal Bitcoin transactions. The data of abnormal Bitcoin transactions contains three csv files, which describe transaction category information, transaction feature information and transaction side information respectively. Among them, the transaction categories include legal categories (exchanges, wallet providers, legal services, etc.) and illegal categories (fraud, malware, ransomware, Ponzi schemes, etc.) and unknown categories. Two percent (4545) of the transactions are marked as illegal, twenty-one percent (42019) are marked as legal, and the rest are unknown; the transaction side information implies the structure of the transaction graph, which consists of 203769 nodes and 234355 edges; the transaction feature information is based on each transaction node, describing the features of each transaction node, and each node contains 166 features, including transaction id, timestamp, transaction input quantity, transaction output quantity, transaction fee, transaction hash value, transaction input address, transaction output address, etc.

[0048] in accordance with Figure 1 The workflow of the present invention, when implementing the method of the present invention, mainly includes the following steps:

[0049] Step 1: Use the open source Python data processing library Pandas to read three csv files and store them as three DataFrame data structures classes, edgelist, and features, which represent transaction categories, transaction features, and transaction edges, respectively.

[0050] Step 2: Load the data and construct the adjacency matrix list, the feature list with labels, and the category list with labels. Specifically:

[0051] Step 2.1: Get the number of feature columns and transactions, store the indexes of all transactions in the total_tx list, filter the transactions with labels, store their labels in labeled_classes, and store their indexes in the labeled_tx list.

[0052] Step 2.2: Select the features of a specific timestamp based on the specific timestamp range (the timestamp range in the original data is 1-49) and store its index in the tx_ts list.

[0053] Step 2.3: Select the transactions with the label among the transactions at the given timestamp and store them in the labelled_tx_ts list.

[0054] Step 2.4: Create an empty adjacency matrix adj_mat and fill the relevant positions of the matrix with the transactions with the label. Build the adjacency matrix based on the filtered transaction identifiers, traverse the rows in edgelist related to the marked transactions, and set the corresponding adjacency matrix elements to 1.

[0055] Step 2.5: Select the sub-adjacency matrix and corresponding features based on the transactions with labels and add them to the adj_mats, features_labelled_ts, and classes_ts lists.

[0056] Step 2.6: Get adj_mats (a list of adjacency matrices), features_labelled_ts (a list of features with labels), and classes_ts (a list of classes with labels).

[0057] Step 3: Define the graph attention layer based on the two biased sampling strategies mentioned above, so that the subsequent graph convolution operation can more specifically aggregate the features of different neighbor nodes. Specifically:

[0058] Step 3.1: Initialize the attention weights in the graph attention layer (usually a column vector of all zeros).

[0059] Step 3.2: According to The attention coefficient is calculated by the normalized transition probability, where α is initialized to 0.5, indicating that the amount and time are considered with the same attention.

[0060] Step 3.3: The attention coefficient is processed through the nonlinear activation function LeakyReLU to introduce nonlinear properties.

[0061] Step 3.4: Perform softmax normalization on the attention coefficients to ensure that the sum of the attention weights is 1.

[0062] Step 3.5: Use the normalized weights to perform weighted aggregation on the features of neighboring nodes to obtain a new feature representation of the node itself.

[0063] Step 4: Define the graph convolution layer, which performs feature propagation, neighbor feature aggregation, and feature update on the graph data after the above-mentioned graph attention layer. Specifically:

[0064] Step 4.1: Add the self-connected matrix A to the original adjacency matrix and use The degree matrix of the node of and Perform matrix multiplication.

[0065] Step 4.2: Multiply the result of the above operation by the node’s feature matrix H to obtain the node’s neighbor feature representation.

[0066] Step 4.3: Perform weighted aggregation on the node’s neighbor nodes based on the weight W obtained from the graph attention layer to highlight the important neighbor nodes considered in biased sampling.

[0067] Step 4.4: Use the nonlinear activation function ReLu to process the features, fuse the aggregated neighbor features with the features of the current node, and generate a new feature representation.

[0068] Step 5: Add a fully connected layer and a softmax function to map node features to predefined categories, output the classification probability distribution of the nodes, and select the category with the highest prediction probability as the predicted label of the node.

[0069] According to the experimental results, a graph attention layer and a graph convolution layer are used, and a fully connected layer and a softmax function are used as the model of the classifier. The number of hidden layers is set to 100 in the training process, and the cross entropy loss function and the Adam optimizer are used to optimize the training process. 70% of the data are used as the training set and 30% of the data are used as the test set. After 15 rounds of training, the classification accuracy on the training set is 95.3%, the classification accuracy on the test set is 89.4%, the recall rate is 94.0%, and the F1 score is 93.4%. These results show that the detection method based on the transaction graph feature mentioned in the present invention has a good effect on the detection of abnormal Bitcoin transactions. It can integrate the information of neighboring nodes and the transaction network structure information while taking into account the characteristics of the transaction node itself, so as to achieve more accurate identification of abnormal transactions.

[0070] Embodiment 2:

[0071] This example compares the method of the present invention with a variety of traditional machine learning and deep learning methods to verify that the method has a better Bitcoin abnormal transaction detection effect than other methods.

[0072] Considering the use of the same dataset, Logistic Regression, Random Forest and traditional graph convolutional neural network model (GCN) are used as comparison models, and the corresponding experimental results are shown in Table 1.

[0073] Table 1: Comparison of results of different models for detecting abnormal Bitcoin transactions under the same dataset

[0074]

[0075]

[0076] The first model of comparison, Logistic Regression, is a machine learning algorithm for solving classification problems. It can realize the binary classification of abnormal transaction categories and normal transaction categories. Its goal is to predict the probability of a sample belonging to a certain category based on the input features. Based on a special function form called "logic function" or "sigmoid function", the output of the linear regression model is converted by a logistic function. In the present invention, the LogisticRegression module in the open source machine learning library scikit-learn of Python is used as a classifier, and the parameters are set to the default parameters. After multiple training and testing, the classification accuracy obtained on the test set is 75.4%, the recall rate is 65.1%, and the F1 score is 69.9%. Obviously, the method described in the present invention has higher accuracy and recall rate than Logistic Regression.

[0077] The second model Random Forest is an integrated learning method for solving classification and regression problems. It consists of multiple decision trees, and the final prediction results are generated by voting or averaging the prediction results of each decision tree. Its advantages are processing high-dimensional data and large-scale data, as well as good robustness to missing values ​​and unbalanced data. In the present invention, the RandomForestClassifier classifier in the scikit-learn library is used, the number of decision trees is set to 50, the maximum depth of each decision tree is set to 100, and a random seed is set to ensure the repeatability of the results. After multiple training and testing, the classification accuracy obtained on the test set is 98.4%, the recall rate is 64.7%, and the F1 score is 78.1%. By comparison, the classification accuracy of the method of the present invention is slightly inferior to that of Random Forest, but the recall rate is higher and the F1 score is higher, indicating that the accuracy of the method in identifying positive samples (i.e., detecting abnormal transactions of the target) is higher and the average performance of the model is better.

[0078] The third model for comparison is the traditional GCN, that is, the traditional graph convolutional neural network without the graph attention mechanism described in the present invention. The traditional GCN is based on the principles of neighbor aggregation and feature propagation, and uses the neighbor information of the node to perform graph convolution operations, but adopts a fixed neighbor aggregation strategy, that is, the features of the neighbor nodes of each node are simply averaged or summed. This aggregation method ignores the relationship weights and importance between different nodes and cannot capture the fine-grained relationship between nodes. In the present invention, before the aggregation operation in the graph convolution layer, the biased sampling operation of the graph attention layer is not introduced. For each node, its own features are weighted averaged with the features of the neighbor nodes, and then the aggregated features are used as new node representations for subsequent calculations. The remaining model training parameters are the same as those in Example 1, and the classification accuracy obtained is 91.2%, the recall rate is 67.5%, and the F1 score is 77.5%. The results show that the method described in the present invention has higher accuracy and recall than the traditional graph convolutional neural network.

[0079] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting abnormal Bitcoin transactions based on transaction graph features. Features: The following steps are involved: S1. Based on the real data set of historical Bitcoin transactions with labels, a directed transaction graph is constructed. The vertices in the graph represent Bitcoin transactions, and the directed edges represent the flow of Bitcoin between two transactions. The vertices are described by the feature vectors corresponding to the transaction information, and the label corresponding to each vertex is "legal", "illegal" or "unknown"; S2. Divide the directed transaction graph into several transaction subgraphs, and then represent each subgraph as an adjacency matrix; S3. According to the biased walk strategy, the graph attention mechanism is used to select neighbor nodes from each adjacency matrix, and then the graph convolutional neural network is used to aggregate the selected neighbor nodes, and the new features of the neighbor nodes are obtained to update the feature vector of the node. Finally, a fully connected layer is used to classify and predict the nodes to realize the detection of abnormal Bitcoin transactions.

2. A method for detecting abnormal Bitcoin transactions based on transaction graph features as claimed in claim 1, Features: The eigenvalues ​​of each dimension of the eigenvector of the vertex in S1 represent the transaction id, timestamp, transaction input quantity, transaction output quantity, transaction fee, transaction hash value, transaction input address, transaction output address, etc.

3. A method for detecting abnormal Bitcoin transactions based on transaction graph features as claimed in claim 1, Features: In S2, the steps to represent the directed transaction graph as an adjacency matrix are: S2.

1. Divide the time period in which all transactions in the data set occur into time steps of equal length; S2.

2. The directed transaction graph is divided into several subgraphs according to the time step. The vertices of each subgraph are transactions belonging to the same time step, and each subgraph is represented as an adjacency matrix. The rows and columns of the adjacency matrix correspond to the vertices of the subgraph. The value in the adjacency matrix indicates whether there is a directed edge between two vertices. 1 indicates yes, and 0 indicates no. Two vertices with a directed edge are neighbor nodes.

4. A method for detecting abnormal bit transactions based on transaction graph features as claimed in claim 1, Features: In S3, the biased walking strategy refers to: comprehensively considering the biased sampling strategies based on amount and time, and obtaining the normalized transfer strategy: Among them, PA ux represents the transfer probability of the current node u to the neighboring node x based on the amount, PT ux It represents the time-based transfer probability of the current node u to the neighboring node x. α is the balance factor, which ranges from 0 to 1, indicating the trade-off between the amount and time of the attention mechanism.

Images