User identification method and device

Abstract

The invention discloses a user identification method and device, and relates to the technical field of block chains. A specific embodiment of the method comprises the steps of obtaining block chain transaction information; inputting the block chain transaction information into the trained graph neural network to obtain a first graph embedding feature corresponding to the block chain transaction information; the graph neural network is obtained by training a transaction network corresponding to the historical transaction information, and the transaction network takes the block chain users as nodes and the transaction relationship between the block chain users as edges; according to the first graph embedding feature, identifying a risk user in the block chain transaction information by using a random forest model; the random forest model is obtained by training according to a second graph embedding feature corresponding to the transaction network and positive and negative tags of each node in the transaction network, and the positive and negative tags of the nodes are determined according to positive and negative tags of transaction input addresses and / or transaction output addresses corresponding to the nodes. According to the embodiment, the accuracy of identifying the risk user is improved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a user identification method and device. Background Art

[0002] In the application of blockchain technology, risk identification of blockchain addresses or blockchain users is an important issue.

[0003] To solve this problem, related technologies use machine learning to identify the identity of blockchain addresses. However, due to the large amount of data in blockchain transactions, the large number of blockchain addresses involved, and the fact that each blockchain address corresponds to a large number of unrelated neighbor addresses, the effect of machine learning is poor, and the accuracy of identifying risky users is poor. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a user identification method and device, which constructs a transaction network according to blockchain users as nodes and transaction relationships between blockchain users as edges, and trains a graph neural network according to the transaction network. Thus, the blockchain addresses are clustered according to the user dimension, which not only reduces the amount of training data, but also reduces the influence of weakly correlated data or irrelevant data on training, thereby improving the training efficiency and training accuracy of the graph neural network. In addition, the second graph embedding feature of the transaction network and the positive and negative labels of each node in the transaction network are obtained by using the graph neural network to train a random forest model, so that the influence of irrelevant or weakly correlated data is also reduced during the training process of the random forest model, thereby also improving the accuracy of the random forest model. Thus, the first graph embedding feature corresponding to the blockchain transaction information is obtained by using the trained graph neural network, and the risk user in the blockchain transaction information is identified by using the random forest model based on the first graph embedding feature. This process not only improves the extraction accuracy of the first graph embedding feature through the trained graph neural network, but also improves the probability prediction accuracy through the trained random forest model, thereby improving the accuracy of identifying risky users.

[0005] To achieve the above objective, according to one aspect of an embodiment of the present invention, a user identification method is provided. The user identification method of the embodiment of the present invention comprises: obtaining blockchain transaction information;

[0006] Input the blockchain transaction information into the trained graph neural network to obtain the first graph embedding feature corresponding to the blockchain transaction information; the graph neural network is trained based on the transaction network corresponding to the historical transaction data, and the transaction network has blockchain users as nodes and transaction relationships between blockchain users as edges;

[0007] According to the first graph embedding features, a random forest model is used to identify risky users in blockchain transaction information; the random forest model is trained based on the second graph embedding features corresponding to the transaction network and the positive and negative labels of each node in the transaction network, and the positive and negative labels of the nodes are determined based on the positive and negative labels of the transaction input address and / or transaction output address corresponding to the node.

[0008] Optionally, the training steps of the graph neural network include:

[0009] Obtain multiple sets of sample data, each set of sample data corresponding to a plurality of blockchain transactions, and each set of sample data includes one or more transaction input addresses and one or more transaction output addresses;

[0010] For each blockchain transaction: determine the first blockchain user corresponding to one or more transaction input addresses, and the second blockchain user corresponding to one or more transaction output addresses;

[0011] The first blockchain user and the second blockchain user corresponding to the multiple blockchain transactions are respectively used as nodes;

[0012] An edge is formed according to the transaction relationship between the first blockchain user and the second blockchain user, and an edge weight is determined according to the transaction amount and the number of transactions between the blockchain users to obtain a transaction network;

[0013] The transaction network is used as the input of the graph neural network to train the graph neural network.

[0014] Optionally, determining the first blockchain users to which the one or more transaction input addresses respectively correspond includes: determining that multiple transaction input addresses in the same blockchain transaction correspond to the same first blockchain user.

[0015] Optionally, determining the first blockchain users corresponding to the one or more transaction input addresses respectively includes: determining a change address, and determining that the change address and the transaction input address in the same blockchain transaction correspond to the same first blockchain user.

[0016] Optionally, the method further includes: when the first blockchain user corresponds to a transaction input address with any negative label, determining that the first blockchain user is a negative label; when the second blockchain user corresponds to a transaction output address with any negative label, determining that the second blockchain user is a negative label.

[0017] Optionally, the method further includes: determining a target node and an out-edge adjacent point corresponding to the target node from each node according to the out-degree and in-degree of each node in the transaction network; the in-degree of the target node is greater than a first threshold and the out-degree is greater than a second threshold;

[0018] Delete the outgoing adjacent points corresponding to the target node to optimize the transaction network;

[0019] The optimized transaction network is used as the input of the graph neural network.

[0020] Optionally, the graph neural network is constructed based on a graph attention network, and training the graph neural network includes:

[0021] For each node in the transaction network: determine the node's neighbor nodes;

[0022] The first feature information of the node is concatenated with the second feature information of the corresponding neighbor node and the edge weight to obtain a feature vector;

[0023] The attention score of the neighbor node is obtained by using a parameterized corrected linear function based on the feature vector;

[0024] Aggregate neighbor nodes according to the attention score to obtain the target feature information corresponding to the node;

[0025] The graph neural network is trained according to the target feature information of each node.

[0026] Optionally, training the graph neural network further includes:

[0027] The loss function of the graph neural network is constructed based on the focal loss function and the L1 norm regularization term.

[0028] Optionally, a focusing degree parameter for negative samples in the focal loss function is positively correlated with the ratio of positive to negative nodes.

[0029] To achieve the above-mentioned purpose, according to another aspect of an embodiment of the present invention, a user identification device is provided. A user identification device of an embodiment of the present invention comprises: an information acquisition module, a feature determination module and a risk user identification module; wherein:

[0030] The information acquisition module is configured to acquire blockchain transaction information;

[0031] The feature determination module is configured to input the blockchain transaction information into the trained graph neural network to obtain a first graph embedding feature corresponding to the blockchain transaction information; the graph neural network is trained based on the transaction network, and the transaction network has blockchain users as nodes and transaction relationships between blockchain users as edges;

[0032] The risky user identification module is configured to identify risky users in blockchain transaction information using a random forest model based on the first graph embedding features; the random forest model is trained based on the second graph embedding features corresponding to the transaction network and the positive and negative labels of each node in the transaction network, and the positive and negative labels of the nodes are determined based on the positive and negative labels of the transaction input address and / or transaction output address corresponding to the node.

[0033] To achieve the above purpose, according to another aspect of an embodiment of the present invention, an electronic device for identifying a user is provided. An electronic device for identifying a user according to an embodiment of the present invention comprises: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement a user identification method according to an embodiment of the present invention.

[0034] To achieve the above object, according to another aspect of the embodiments of the present invention, a computer-readable storage medium is provided. A computer-readable storage medium according to the embodiments of the present invention stores a computer program, which, when executed by a processor, implements a user identification method according to the embodiments of the present invention.

[0035] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, which implements a user identification method of an embodiment of the present invention when executed by a processor.

[0036] One embodiment of the above invention has the following advantages or beneficial effects: a transaction network is constructed according to blockchain users as nodes and transaction relationships between blockchain users as edges, and a graph neural network is trained according to the transaction network. Thus, the blockchain addresses are clustered according to the user dimension, which not only reduces the amount of training data, but also reduces the impact of weakly correlated data or irrelevant data on training, thereby improving the training efficiency and training accuracy of the graph neural network. In addition, the second graph embedding feature of the transaction network and the positive and negative labels of each node in the transaction network are obtained by using the graph neural network to train a random forest model, so the impact of irrelevant or weakly correlated data is also reduced during the training process of the random forest model, thereby also improving the accuracy of the random forest model. Thus, the first graph embedding feature corresponding to the blockchain transaction information is obtained by using the trained graph neural network, and the risky users in the blockchain transaction information are identified by using the random forest model based on the first graph embedding feature. This process not only improves the extraction accuracy of the first graph embedding feature through the trained graph neural network, but also improves the probability prediction accuracy through the trained random forest model, thereby improving the accuracy of identifying risky users.

[0037] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0039] Figure 1 is a schematic diagram of main steps of a user identification method according to an embodiment of the present invention;

[0040] Figure 2 is a schematic diagram of a transaction network with blockchain users as nodes according to an embodiment of the present invention;

[0041] Figure 3 is a schematic diagram of another transaction network with blockchain users as nodes according to an embodiment of the present invention;

[0042] Figure 4 is a schematic diagram of another transaction network with blockchain users as nodes according to an embodiment of the present invention;

[0043] FIG5( a ) is a schematic diagram of connections corresponding to target nodes in a transaction network according to an embodiment of the present invention;

[0044] FIG5( b ) is a schematic diagram of connections corresponding to target nodes in another transaction network according to an embodiment of the present invention;

[0045] Figure 6 is a schematic diagram of main steps of another user identification method according to an embodiment of the present invention;

[0046] Figure 7 is a schematic diagram of main modules of a user identification device according to an embodiment of the present invention;

[0047] Figure 8 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0048] Fig. 9 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0050] It should be pointed out that the embodiments of the present invention and the technical features therein may be combined with each other without conflict.

[0051] Figure 1 A user identification method according to an embodiment of the present invention mainly comprises the following steps:

[0052] Step S101: Obtain blockchain transaction information.

[0053] Step S102: Input the blockchain transaction information into the trained graph neural network to obtain the first graph embedding feature corresponding to the blockchain transaction information; the graph neural network is trained based on the transaction network corresponding to the historical transaction data, and the transaction network has blockchain users as nodes and transaction relationships between blockchain users as edges.

[0054] Step S103: Based on the first graph embedding features, a random forest model is used to identify risky users in blockchain transaction information; the random forest model is trained based on the second graph embedding features corresponding to the transaction network and the positive and negative labels of each node in the transaction network, and the positive and negative labels of the nodes are determined based on the positive and negative labels of the transaction input address and / or transaction output address corresponding to the node.

[0055] Among them, the training steps of the graph neural network may include: obtaining multiple groups of sample data, the multiple groups of sample data correspond to multiple blockchain transactions respectively, and each group of sample data includes one or more transaction input addresses and one or more transaction output addresses; for each blockchain transaction: determining the first blockchain user corresponding to the one or more transaction input addresses, and the second blockchain user corresponding to the one or more transaction output addresses; taking the first blockchain user and the second blockchain user corresponding to the multiple blockchain transactions as nodes, forming edges according to the transaction relationship between the first blockchain user and the second blockchain user, and determining the edge weight according to the transaction amount and number of transactions between the first blockchain user and the second blockchain user, to obtain a transaction network; taking the transaction network as the input of the graph neural network, and training the graph neural network.

[0056] In an embodiment of the present invention, by extracting all transaction data within a specific historical time range on the blockchain and performing pre-processing such as deduplication and denoising, sample data corresponding to multiple blockchain transactions can be obtained, wherein each sample data includes transaction information such as transaction input address, transaction output address, transaction amount, and transaction number.

[0057] For example, when the payer does not have a large enough unspent transaction amount in his wallet to satisfy the payment amount, but the total amount of his multiple wallets satisfies the payment amount, he can make the payment based on the balances of multiple wallets. The blockchain transaction corresponding to such payment corresponds to multiple transaction input addresses. For such blockchain transactions, the common input heuristic rule can be used to cluster the transaction addresses in the blockchain transactions, such as Figure 2As shown, a sample data may include three transaction input addresses and one transaction output address, where transaction input address 1, transaction input address 2 and transaction input address 3 correspond to the same blockchain user A (payer), and transaction output address 1 corresponds to blockchain user B (receiver). In the implementation of the present invention, multiple transaction input addresses are aggregated according to the user dimension so that a transaction network can be constructed based on user nodes in the later stage.

[0058] In addition, during the blockchain transaction process, the amount sent by the payee is usually not all sent to the payee, and the remaining funds are usually returned to the payee's transaction address as the change amount. In other words, there may be a change address corresponding to the payee in the transaction output address of a transaction. When the change amount corresponding to the change address is small, the change address may not be used as the input address of subsequent transactions or only as the input address of a few transactions. Therefore, if it is used as the transaction output address to train the graph neural network, since it may only be used once and only appear in a few blockchain transactions, it may not bring about an improvement in accuracy while increasing the amount of training data. In order to avoid the above problems, in an embodiment of the present invention, a heuristic rule for change address detection is used for clustering related blockchain addresses for such transactions. Specifically, the change address is determined from one or more transaction output addresses, and it is determined that the change address corresponds to the same first blockchain user as the transaction input address in the same blockchain transaction, so as to reduce the amount of training data and reduce the impact of weakly correlated data on training. For example, when a blockchain transaction includes multiple transaction output addresses, the transaction output address with the smallest amount and lower than the preset threshold of other output amounts (such as the output amount is lower than one thousandth of other output amounts) can be determined from the multiple transaction output addresses and used as the change address. Figure 3 As shown in the figure, a blockchain transaction includes transaction input address 4, transaction output address 2 and transaction output address 3. The amount of transaction output address 2 is the smallest, and its output amount (such as 0.0001BTC) is less than one thousandth of the output amount of transaction output address 3 (such as 0.15BTC). Then, transaction output address 3 can be determined as the change address. The change address should belong to the same first blockchain user as the transaction input address, such as Figure 3 In the example, if there is a blockchain user C in the transaction, and the transaction output address 2 corresponds to the second blockchain (blockchain user D), an edge can be formed between blockchain user C and blockchain user D to build a transaction network.

[0059] It should be understood that the above-mentioned multiple transaction input addresses correspond to the same first blockchain user, and the change address and transaction input address correspond to the same first blockchain user, which may occur in the same blockchain transaction. Figure 4As shown, transaction input address 5 and transaction input address 6 correspond to the same blockchain user E, and transaction output address 5 is the change address. It is determined that the change address also corresponds to blockchain user E. Therefore, when constructing the transaction network, an edge is constructed between blockchain user E and blockchain user F corresponding to transaction output address 4.

[0060] According to the above embodiments, it can be seen that by clustering blockchain addresses according to user dimensions through heuristic rules, and using blockchain users as nodes of the transaction network according to the clustering results, compared with the method of directly using blockchain addresses to build a transaction network, it not only reduces the amount of training data, but also reduces the impact of weakly related data or irrelevant data on training. Figure 2 In the example, the transaction network is constructed in the user dimension, and the blockchain transaction corresponds to 2 nodes and 1 edge, which reduces the amount of training data compared to the address dimension, which forms 4 nodes and 3 edges. It can be understood that the sample data obtained is a plurality of blockchain transactions, so the method provided by the embodiment of the present invention can reduce the amount of training data exponentially. In the process of clustering by heuristic rules, since the accuracy of the heuristic rules decreases with the increase of the number of expansions, in the embodiment of the present invention, in order to ensure the accuracy of the results, the heuristic rules can be looped twice to avoid too many loops resulting in a decrease in the accuracy of the clustering results.

[0061] After clustering the blockchain addresses according to the user dimension, the positive and negative labels of the user nodes can be determined according to the positive and negative labels of the transaction addresses. Among them, the label of the risky address is a negative label, and the label of the normal address is a positive label. However, since the proportion of risky addresses in the transaction addresses is relatively small relative to normal addresses, there are fewer negative samples in the training data. In order to increase the proportion of negative samples and improve the training accuracy, in one embodiment of the present invention, when determining the positive and negative labels of the user nodes, if the first blockchain user corresponds to a transaction input address with any negative label, the first blockchain user is determined to be a negative label; if the second blockchain user corresponds to a transaction output address with any negative label, the second blockchain user is determined to be a negative label. In this embodiment of the present invention, the first blockchain user and the second blockchain user are distinguished only for the convenience of describing the blockchain users corresponding to the transaction input address and the transaction output address respectively. The two may correspond to the same blockchain user or different blockchain users in different transactions. In this embodiment, if the same blockchain user corresponds to both a normal address and a risky address, the label of the blockchain user is a negative label. Therefore, after a blockchain user uses any blockchain address to conduct a risky transaction, its label is a negative label. This not only realizes the clustering and expansion of positive and negative samples, which is conducive to increasing the proportion of negative samples in training samples, but also marks users who have conducted risky transactions as negative labels, which is also conducive to improving the accuracy of identifying risky users.

[0062] Thus, it is possible to construct a transaction network with the identifier of the blockchain user as a node, construct edges between the nodes of the blockchain users who have conducted transactions, and determine the edge weights according to the transaction amount and number of transactions between the blockchain users. The user nodes that have conducted risky transactions in the transaction network are negatively labeled, and the user nodes that have conducted normal transactions are positively labeled. It can be understood that the characteristics of each user node in the transaction network include the basic portrait characteristics of the user in addition to the above-mentioned edge weights and positive and negative label characteristics. Among them, the basic portrait characteristics can be calculated by using different statistical functions for a variety of transaction parameters, such as the transaction amount, transaction time period, number of transactions, number of counterparties, and transaction frequency, etc., through statistical functions such as counting, sum, average, standard deviation, maximum, minimum, mode, skewness, relative proportion of transfers in and out, etc. Furthermore, in order to reduce the number of parameters in the training process of the graph neural network, filter irrelevant features, avoid overfitting, and reduce the amount of calculation and memory, the basic image features of each node can be normalized, and PCA (Principal Component Analysis) can be used for dimensionality reduction, thereby forming a transaction network with normalized transaction amounts and transaction times as edge weights, and normalized and reduced basic user portraits and positive and negative labels as node features. After the transaction network is constructed, it can be used as the input of the graph neural network for training. Since the transaction network has clustered the blockchain addresses according to the user dimension, and clustered and expanded the positive and negative samples, it is conducive to improving the training accuracy of the graph neural network.

[0063] In the embodiment of the present invention, in order to further improve the training accuracy of the graph neural network, in the embodiment of the present invention, the transaction network can also be optimized based on the transaction characteristics of the exchange in the blockchain transaction. Specifically, the out-degree and in-degree of each node in the transaction network can be determined, and the target node and the out-edge adjacent point corresponding to the target node can be determined from each node, and the in-degree of the target node is greater than the first threshold and the out-degree is greater than the second threshold, and then the out-edge adjacent point corresponding to the target node is deleted to optimize the transaction network, and the optimized transaction network is used as the input of the graph neural network.

[0064] Among them, the number of outgoing edges of each node in the transaction network is called the out-degree of the node, and the number of incoming edges of the node is called the in-degree of the node. As shown in Figure 5(a), the in-degree of the target node K is n, and the out-degree is m. Correspondingly, the node connected to the other end of the in-edge of node K is the in-edge adjacent point of node K (i.e., node N1~Nn), and the node connected to the other end of the out-edge of node K is the out-edge adjacent point of node K, i.e., node M1~node Mm. It should be understood that the in-degree of a node is the same as the number of its in-edge adjacent points, and the out-degree of a node is the same as the number of its out-edge adjacent points. In the blockchain transaction scenario, the exchange will receive deposits and withdrawals from a large number of users, which usually have a large number of incoming and outgoing transactions. Therefore, the nodes corresponding to the exchange have higher out-degree and in-degree in the transaction network. Based on this, the target node corresponding to the exchange can be determined from the transaction network based on the out-degree and in-degree. However, since the blockchain address corresponding to the exchange does not represent an individual or entity, and the exchange generally uses address clustering technology to manage internal wallets and blockchain addresses, this may also cause blockchain users who are not real transactions to be associated together. Therefore, if it is used as a user node to train the graph neural network, it may bring noise. Therefore, the embodiment of the present invention deletes the outbound edge adjacent points and the corresponding edges of the target node corresponding to the exchange to avoid non-real transactions interfering with the training accuracy. Continuing to refer to Figure 5(a), the target node corresponds to n inbound edge adjacent points and m outbound edge adjacent points, where n is greater than the first threshold and m is greater than the second threshold. The first threshold and the second threshold can be set according to historical experience or actual needs, and the two can be equal or unequal. In order to avoid non-real transactions interfering with the training accuracy, after determining the target node corresponding to the exchange according to the high in-degree and high out-degree features, the embodiment of the present invention can delete its m outbound edge adjacent points to optimize the transaction network. The optimized transaction network is shown in Figure 5(b). Thereafter, the optimized transaction network can be used to train the graph neural network.

[0065] In an embodiment of the present invention, the graph neural network can be constructed based on GAT (Graph Attention Network), GCN (Graph Convolutional Network) or GraphSAGE (Graph Sample and Aggregate).

[0066] Since the embodiments of the present invention are applied to the scenario of identifying risky blockchain users, there are many neighbor nodes with different risk levels for risky blockchain users. For example, in the transaction scenario of an underground bank, assuming that a risky user node corresponds to a currency trader, other user nodes that trade with the user node may include: resellers, merchants used for foreign trade settlement, ordinary users who urgently need foreign exchange, etc. Among them, resellers are high-risk neighbor nodes, and merchants and ordinary users are normal users with low risk levels. In order to accurately capture the neighbor information corresponding to each node in the transaction network, in one embodiment of the present invention, a graph neural network is constructed based on GAT. Therefore, the attention mechanism based on GAT ranks the importance of the neighbor nodes of each node in the transaction network, which is conducive to accurately capturing high-risk neighbor nodes and removing the impact of irrelevant neighbor nodes on the training process.

[0067] Specifically, in this implementation, for each node in the transaction network: determine the neighbor nodes of the node, concatenate the first feature information of the node with the second feature information of its corresponding neighbor nodes and the edge weight to obtain a feature vector; use the PReLU (Parametric Rectified Linear Unit) function based on the feature vector to obtain the attention score of the neighbor node, and then aggregate the neighbor nodes based on the attention score to obtain the target feature information corresponding to the node; after obtaining the target feature information corresponding to each node, the graph neural network can be trained according to the target feature information of each node.

[0068] Among them, the first characteristic information of the node may include basic portrait features that characterize transaction parameters such as transaction amount, transaction time period, number of transactions, transaction frequency, and number of counterparties, and the basic portrait features are obtained by calculating and processing the transaction parameters using statistical functions. In addition, in blockchain transactions, there are situations where lower-level users frequently transfer large amounts of illegal funds to upper-level users. Therefore, the edge weights that characterize the transaction amount and number of transactions between two nodes can provide important information for calculating the correlation of neighbor nodes. The embodiment of the present invention concatenates the edge weights with the second characteristic information of the neighbor node itself when calculating the attention score of the neighbor node, thereby facilitating the accuracy of the attention scoring function in capturing important neighbor nodes.

[0069] Then, the concatenated feature vector is processed using the PReLU function to obtain the attention score of the neighbor node. The calculation method of the attention score can be expressed by the following formula (1):

[0070] e ij =PReLU(a T [Wh i ||Whj ||r ij ])…………(1)

[0071] Among them, e ij Represents the attention score of the jth neighbor node corresponding to the i-th node; a T Represents a learnable weight vector, which can be set according to actual needs; Wh i Characterizes the first feature information of the i-th node; Wh j Characterize the second feature information of the jth neighbor node; r ij Represents the edge weight between the i-th node and its j-th neighbor node.

[0072] There may be many types of risky transactions in blockchain transaction scenarios, such as centralized transfer and aggregation of encrypted assets, stripped chain transactions, and mixed currency transactions. The address features corresponding to different transaction types are different. For example, mixed currency transactions usually correspond to multiple transaction input addresses and multiple transaction output addresses, and stripped chain transactions usually correspond to one transaction input address and two transaction output addresses. In order to improve the generalization ability for different transaction types, the embodiment of the present invention adopts the PreLU function to calculate the attention score of neighbor nodes. Since the PReLU function uses a learnable parameter α to adjust the slope value, compared with the default activation function of GAT (such as LeakyReLU) that uses a fixed slope value (such as 0.01), the embodiment of the present invention adopts the PReLU method to improve the generalization ability of different transaction methods, so that the graph neural network can more accurately capture the characteristics of sample data and converge faster during training.

[0073] After calculating the attention scores of each neighbor node, the attention scores can be normalized and then aggregated to obtain the target feature information corresponding to the node according to the aggregation results. Specifically, the attention score e ij The attention weight α is obtained by normalizing it through the following formula (2): ij .

[0074]

[0075] Among them, α ij The normalized processing result (attention weight) representing the attention score of the jth neighbor node corresponding to the i-th node; e ik represents the attention score of the jth neighbor node corresponding to the i-th node; N represents the set of neighbor nodes corresponding to the i-th node; e ik Represents the attention score of the kth neighbor node corresponding to the i-th node.

[0076] Then, the information of neighbor nodes can be further aggregated according to the size of the attention weight to obtain the target feature information of node i, thereby making the weight of important neighbor information in the target feature information of node i larger, which is conducive to improving the accuracy of the graph neural network. Among them, the target feature information of node i can be expressed by the following formula (3):

[0077] h′ i =σ(∑ j∈N α ij W j )...........(3)

[0078] Among them, h′ i represents the target feature information corresponding to node i, N represents the set of neighbor nodes corresponding to the i-th node, α ij Represents the normalized processing result (attention weight) of the attention score of the jth neighbor node corresponding to the i-th node, Wh j Characterize the first feature information of the j-th neighbor node.

[0079] Thereafter, the graph neural network can be trained according to the target feature information of each node. The anonymity of blockchain transactions increases the difficulty of sample labeling, resulting in an unbalanced ratio of positive and negative samples. The number of positive samples may be dozens or even tens of thousands of times that of negative samples, so the loss function is less affected by negative samples. Therefore, during training, the graph neural network may have a better effect on positive samples and a worse effect on negative samples, but the loss function shows that the training effect is good and the training is stopped. In order to avoid this situation as much as possible, the loss function used in the training process of the graph neural network in the embodiment of the present invention is constructed based on the focal loss function and the L1 norm regularization term, as shown in the following formula (4):

[0080]

[0081] Among them, L represents the loss function of the graph neural network; is the expression of the focal loss function, is the expression of the L1 norm regularization term. i Represents the prediction accuracy of node i. When the label of node i is positive, p i represents the probability that node i is a normal user. When the node label is negative, p i Represents the probability that node i is a risky user; γ represents the degree of focus of the graph neural network on difficult-to-classify samples (such as negative samples representing risky users), where the larger the γ value, the higher the attention of the graph neural network to difficult-to-classify samples (such as negative samples representing risky users); α ij represents the attention weight of the jth neighbor node corresponding to the ith node, and λ1 represents the weight of the L1 norm regularization term.

[0082] In this embodiment, the focus loss function that dynamically focuses on difficult-to-classify samples (such as negative samples) is used as the loss function. When the graph neural network is very confident about node i, the probability p of predicting node i as an illegal or normal user is i As it approaches 1, it is multiplied by a smaller factor (1-p i ) γ , thereby reducing the influence of easy-to-classify samples on the loss function, allowing more attention to difficult-to-classify samples during training. Therefore, in blockchain transaction scenarios where positive and negative samples are extremely unbalanced, the training process can increase the focus on a smaller number of negative samples and improve the training accuracy of the graph neural network.

[0083] Among them, the parameter γ of the focus degree for negative samples in the focus loss function is positively correlated with the ratio of positive and negative nodes, for example, it can be obtained by taking the logarithm of the ratio of positive and negative nodes. In one embodiment of the present invention, the value range of γ can be determined according to the following formula (5):

[0084]

[0085] Among them, majority represents the number of majority samples (such as positive samples), and minority represents the number of minority samples (such as negative samples). The γ value is calculated by taking the square root of the multiples of majority samples (positive samples) and minority samples (negative samples) and calculating the ln value. When the positive and negative samples are more unbalanced, more attention is paid to the smaller number of negative samples during training, thereby improving the accuracy of the graph neural network. Usually, since the number of positive samples may be dozens or even tens of thousands times that of negative samples, the value range of γ is between 0 and 5.

[0086] Furthermore, by adding an L1 norm regularization term including attention weights to the loss function, the graph neural network tends to assign attention weights of 0 to unimportant neighbor nodes. Therefore, when there are more low-risk neighbor nodes than high-risk neighbor nodes, the weights of more than half of the neighbor nodes are 0. This not only retains the core structure of the graph neural network, but also eliminates the need to perform the next step of calculations on unimportant neighbor nodes, thereby saving the amount of computation and memory required for the training process. In addition, when visualizing the trading network, only neighbor nodes with non-zero weights can be displayed, making the trading network more interpretable. If the graph neural network does not work well on a certain type of sample, the graph structure of such difficult-to-classify samples can be quickly understood through the visualized trading network for the next step of adjustment and optimization.

[0087] Thus, the graph neural network is trained by the training method provided in the above embodiment, and the training is terminated when the loss function meets the preset threshold. After training the graph neural network, the historical transaction data can be input into the trained graph neural network to obtain the second graph embedding feature corresponding to the historical transaction data using the graph neural network, such as using the trained graph neural network to predict risk users for the historical transaction data, and extracting the input features of the classification layer as the second graph embedding feature. Then the random forest model is trained using the second graph embedding feature, such as splicing the second embedding feature with the basic portrait feature of the user, and using it as the training sample data of the random forest model. Thus, the random forest model is used as a classifier to train on the fusion feature set, and the probability of the user being a risky user is predicted. Since the second graph embedding feature is more complex, it can capture the nonlinear complex interaction relationship between different nodes in the transaction network, so it is conducive to improving the classification accuracy. In order to further improve the accuracy of the random forest model, the tree depth of the random forest model can be increased so that the random forest model can accurately learn the high-order complex feature interaction included in the second graph embedding feature. Exemplarily, the tree depth of the random forest model in the related art is generally 5 to 10, while the tree depth used in the embodiment of the present invention is 15 to 20. In practical applications, K-fold cross validation can also be used to select the optimal tree depth.

[0088] It should be understood that during the training process, the method of first training the graph neural network and then training the random forest model can be adopted, or the method of simultaneously training the graph neural network and the random forest model can be adopted, and the embodiment of the present invention does not limit this. In practical applications, the GAT and the random forest model can be combined to form a hybrid model, and the hybrid model can be trained using a multi-task learning method.

[0089] After the training is completed, the trained graph neural network and random forest model can be used to predict the risky users in the newly acquired blockchain transaction information. Specifically, the first graph embedding feature corresponding to the blockchain transaction information of the risky user to be predicted can be obtained through the graph neural network, such as extracting the input feature of the classification layer of the graph neural network and using it as the first graph embedding feature. Then, the first graph embedding feature is spliced ​​with the basic user portrait feature of each user node, and based on the spliced ​​features, the trained random forest model is used to identify the risky users in the blockchain transaction.

[0090] The following takes the identification of risky users in the blockchain as an example to further illustrate the user identification method provided by the embodiment of the present invention. Figure 6 As shown, the user identification method may include the following steps S601-S612:

[0091] Step S601: Obtain multiple sets of sample data corresponding to multiple blockchain transactions.

[0092] Each set of sample data includes one or more transaction input addresses and one or more transaction output addresses.

[0093] Step S602: For each set of sample data: determine that multiple transaction input addresses in the same blockchain transaction correspond to the same first blockchain user, and determine that the change address and the transaction input address in the same blockchain transaction correspond to the same first blockchain user.

[0094] Step S603: When the first blockchain user corresponds to a transaction input address with any negative label, the first blockchain user is determined to be a negative label; when the second blockchain user corresponds to a transaction output address with any negative label, the second blockchain user is determined to be a negative label.

[0095] Step S604: The first blockchain user and the second blockchain user corresponding to the multiple blockchain transactions are respectively taken as nodes, and the positive label or negative label of the node is determined; an edge is formed according to the transaction relationship between the first blockchain user and the second blockchain user, and the edge weight is determined according to the transaction amount and the number of transactions between the blockchain users to obtain a transaction network.

[0096] Step S605: According to the out-degree and in-degree of each node in the transaction network, determine the target node and the out-edge adjacent points corresponding to the target node from each node; delete the out-edge adjacent points corresponding to the target node to optimize the transaction network.

[0097] The in-degree of the target node is greater than a first threshold and the out-degree is greater than a second threshold, and the first thresholds may be equal or different. The target node generally corresponds to an exchange.

[0098] Step S606: Use the optimized transaction network as the input of GAT, and for each node in the transaction network: determine the neighbor nodes of the node, and concatenate the first feature information of the node with the second feature information of its corresponding neighbor nodes and the edge weight to obtain a feature vector.

[0099] Step S607: Obtain the attention score of the neighbor node using the PReLU function according to the feature vector, and aggregate the neighbor nodes according to the attention score to obtain the target feature information corresponding to the node.

[0100] Step S608: GAT is trained according to the target feature information until the loss function meets the preset conditions, wherein the loss function is constructed based on the focal loss function and the L1 norm regularization term, and the focus degree parameter for negative samples in the focal loss function is positively correlated with the ratio of positive and negative nodes in the transaction network.

[0101] Step S609: Obtain the second graph embedding features corresponding to the transaction network according to the trained GAT, and train the random forest model according to the second graph embedding features and the positive and negative labels of each node in the transaction network.

[0102] Step S610: After obtaining the blockchain transaction information of the risk user to be identified, determine the basic portrait features of the user node in the blockchain transaction information.

[0103] The process of determining the user node is basically the same as the process of determining the user node in the sample data, and will not be repeated here. The basic portrait features of the user node can be calculated by using different statistical functions on a variety of transaction parameters.

[0104] Step S611: Input the blockchain transaction information into the trained GAT to obtain the first image embedding feature corresponding to the blockchain transaction information, and concatenate the first image embedding feature with the basic portrait feature.

[0105] Step S612: Input the splicing result into the trained random forest model to use the random forest model to identify risky users in the blockchain transaction information.

[0106] In the above steps, steps S601 to S609 are the training phase, and steps S610 to S612 are the prediction phase. It is understandable that after the training of the GAT and random forest models is completed, step S610 can be directly executed for each newly acquired blockchain transaction information, without having to execute steps S601 to S609 for each prediction.

[0107] According to a user identification method of an embodiment of the present invention, it can be seen that a transaction network is constructed according to blockchain users as nodes and transaction relationships between blockchain users as edges, and a graph neural network is trained according to the transaction network. Thus, the blockchain addresses are clustered according to the user dimension, which not only reduces the amount of training data, but also reduces the impact of weakly correlated data or irrelevant data on training, thereby improving the training efficiency and training accuracy of the graph neural network. In addition, the second graph embedding feature of the transaction network and the positive and negative labels of each node in the transaction network are used to train a random forest model, so the impact of irrelevant or weakly correlated data is also reduced during the training process of the random forest model, thereby improving the accuracy of the random forest model. Thus, the first graph embedding feature corresponding to the blockchain transaction information is obtained by using the trained graph neural network, and the risk user in the blockchain transaction information is identified by using the random forest model based on the first graph embedding feature. This process not only improves the extraction accuracy of the first graph embedding feature through the trained graph neural network, but also improves the probability prediction accuracy through the trained random forest model, thereby improving the accuracy of identifying risky users. In addition, after a blockchain user uses any blockchain address for risky transactions, it is marked as a negative label, which not only realizes the clustering and expansion of positive and negative samples, but also helps to improve the accuracy of identifying risky users. In addition, the embodiment of the present invention ranks the importance of the neighbor nodes of each node in the transaction network based on the attention mechanism of GAT, which is conducive to accurately capturing high-risk neighbor nodes and removing the impact of irrelevant neighbor nodes on the training process. The outbound adjacent points of the target node corresponding to the exchange and its corresponding edges are also deleted, thereby improving the accuracy of the graph neural network. Furthermore, the embodiment of the present invention adopts the PReLU method to improve the generalization ability of different transaction methods, so that the graph neural network can more accurately capture the characteristics of sample data and converge faster during the training process. And the loss function used in the training process of the graph neural network is constructed based on the focal loss function and the L1 norm regularization term. In the blockchain transaction scenario where the positive and negative samples are extremely unbalanced, it can improve the focus on a small number of negative samples and also improve the accuracy of the graph neural network.

[0108] Based on the same inventive concept as the above embodiments, the embodiment of the present invention further provides a user identification device, such as Figure 7 As shown, the user identification device 700 includes: an information acquisition module 701, a feature determination module 702, and a risk user identification module 703; wherein,

[0109] The information acquisition module 701 is configured to acquire blockchain transaction information;

[0110] The feature determination module 702 is configured to input the blockchain transaction information into the trained graph neural network to obtain a first graph embedding feature corresponding to the blockchain transaction information; the graph neural network is trained based on a transaction network corresponding to historical transaction data, and the transaction network has blockchain users as nodes and transaction relationships between blockchain users as edges;

[0111] The risky user identification module 703 is configured to identify risky users in blockchain transaction information using a random forest model based on the first graph embedding features; the random forest model is trained based on the second graph embedding features corresponding to the transaction network and the positive and negative labels of each node in the transaction network, and the positive and negative labels of the nodes are determined based on the positive and negative labels of the transaction input address and / or transaction output address corresponding to the node.

[0112] In one embodiment of the present invention, the user identification device also includes a training module 704; wherein the training module 704 is configured to obtain multiple groups of sample data, each of which corresponds to multiple blockchain transactions, and each group of sample data includes one or more transaction input addresses and one or more transaction output addresses; for each blockchain transaction: determine the first blockchain user corresponding to the one or more transaction input addresses, and the second blockchain user corresponding to the one or more transaction output addresses; use the first blockchain user and the second blockchain user corresponding to the multiple blockchain transactions as nodes; form edges according to the transaction relationship between the first blockchain user and the second blockchain user, and determine the edge weight according to the transaction amount and transaction number between the blockchain users to obtain a transaction network; use the transaction network as the input of the graph neural network to train the graph neural network.

[0113] In one embodiment of the present invention, the training module 704 is configured to determine that multiple transaction input addresses in the same blockchain transaction correspond to the same first blockchain user.

[0114] In one embodiment of the present invention, the training module 704 is configured to determine the change address, and determine that the change address and the transaction input address in the same blockchain transaction correspond to the same first blockchain user.

[0115] In one embodiment of the present invention, the training model 704 is configured to determine that the first blockchain user is negatively labeled when the first blockchain user corresponds to a transaction input address with any negative label; and to determine that the second blockchain user is negatively labeled when the second blockchain user corresponds to a transaction output address with any negative label.

[0116] In one embodiment of the present invention, the training module 704 is also configured to determine the target node and the out-edge adjacent points corresponding to the target node from each node according to the out-degree and in-degree of each of the nodes in the transaction network; the in-degree of the target node is greater than a first threshold and the out-degree is greater than a second threshold; delete the out-edge adjacent points corresponding to the target node to optimize the transaction network; and use the optimized transaction network as the input of the graph neural network.

[0117] In one embodiment of the present invention, the graph neural network is constructed based on the graph attention network, and the training module 704 is also configured to, for each node in the transaction network: determine the neighbor nodes of the node; concatenate the first feature information of the node with the second feature information of the corresponding neighbor node and the edge weight to obtain a feature vector; obtain the attention score of the neighbor node according to the feature vector using a parameterized modified linear function; aggregate the neighbor nodes according to the attention score to obtain the target feature information corresponding to the node; and train the graph neural network according to the target feature information of each node.

[0118] In one embodiment of the present invention, the training module 704 is configured to construct a loss function of the graph neural network based on the focal loss function and the L1 norm regularization term.

[0119] In one embodiment of the present invention, the focusing degree parameter for negative samples in the focus loss function is positively correlated with the ratio of positive to negative nodes.

[0120] According to a user identification device provided by the above embodiment, it can be seen that a transaction network is constructed according to the blockchain users as nodes and the transaction relationships between blockchain users as edges, and the graph neural network is trained according to the transaction network. Thus, the blockchain addresses are clustered according to the user dimension, which not only reduces the amount of training data, but also reduces the impact of weakly correlated data or irrelevant data on training, thereby improving the training efficiency and training accuracy of the graph neural network. In addition, the second graph embedding feature of the transaction network and the positive and negative labels of each node in the transaction network are obtained by using the graph neural network to train a random forest model, so the impact of irrelevant or weakly correlated data is also reduced during the training process of the random forest model, thereby also improving the accuracy of the random forest model. Thus, the first graph embedding feature corresponding to the blockchain transaction information is obtained by using the trained graph neural network, and the risk users in the blockchain transaction information are identified by using the random forest model based on the first graph embedding feature. This process not only improves the extraction accuracy of the first graph embedding feature through the trained graph neural network, but also improves the probability prediction accuracy through the trained random forest model, thereby improving the accuracy of identifying risky users. In addition, after a blockchain user uses any blockchain address to conduct a risky transaction, it is marked as a negative label, which not only realizes the clustering and expansion of positive and negative samples, but also helps to improve the accuracy of identifying risky users. In addition, the embodiment of the present invention sorts the importance of the neighbor nodes of each node in the transaction network based on the attention mechanism of GAT, which is conducive to accurately capturing the neighbor nodes with high risks and removing the impact of irrelevant neighbor nodes on the training process. The outbound adjacent points and their corresponding edges of the target node corresponding to the exchange are also deleted, thereby improving the accuracy of the graph neural network. Furthermore, the embodiment of the present invention adopts the PReLU method to improve the generalization ability of different transaction methods, so that the graph neural network can more accurately capture the characteristics of sample data and converge faster during the training process. And the loss function used in the training process of the graph neural network is constructed based on the focal loss function and the L1 norm regularization term. In the blockchain transaction scenario where the positive and negative samples are extremely unbalanced, it can improve the focus on a small number of negative samples and also improve the accuracy of the graph neural network.

[0121] Figure 8 An exemplary system architecture 800 is shown to which the user identification method or the user identification device according to the embodiment of the present invention can be applied.

[0122] like Figure 8As shown, the system architecture 800 may include a blockchain 801, a network 802, and servers 803, 804, and 805. The network 804 is used to provide a medium for communication links between the servers 803, 804, and 805 and between the servers 803, 804, and 805 and the blockchain 801. The network 804 may include various connection types, such as wired or wireless communication links or optical fiber cables, etc. The servers 803, 804, and 805 may obtain historical transaction information from the blockchain 801 through the network 802 to form sample data, and obtain blockchain transaction information from the blockchain 801 to identify risky users.

[0123] It should be understood that Figure 8 The number of nodes, networks, and servers on the blockchain is only illustrative. Depending on the implementation needs, there can be any number of blockchain nodes, networks, and servers.

[0124] Reference below Fig. 9 , which shows a schematic diagram of the structure of a computer system 900 of a terminal device suitable for implementing an embodiment of the present invention. Fig. 9 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0125] like Fig. 9 As shown, the computer system 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the system 900 are also stored. The CPU 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0126] The following components are connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage section 908 as needed.

[0127] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the central processing unit (CPU) 901, the above-mentioned functions defined in the system of the present invention are executed.

[0128] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0129] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0130] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The described system may also be set in a processor, for example, it may be described as: a processor includes an information acquisition module, a feature determination module and a risk user identification module. The names of these modules do not constitute a limitation on the modules themselves in some cases, for example, the risk user identification module may also be described as a "module for identifying risky users".

[0131] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: obtaining blockchain transaction information; inputting the blockchain transaction information into a trained graph neural network to obtain a first graph embedding feature corresponding to the blockchain transaction information; the graph neural network is trained based on a transaction network, the transaction network has blockchain users as nodes and transaction relationships between the blockchain users as edges; based on the first graph embedding feature, a random forest model is used to identify risky users in the blockchain transaction information; the random forest model is trained based on the second graph embedding feature corresponding to the transaction network and the positive and negative labels of each node in the transaction network, and the positive and negative labels of the nodes are determined based on the positive and negative labels of the transaction input address and / or transaction output address corresponding to the node.

[0132] According to the technical solution of the embodiment of the present invention, a transaction network is constructed according to the blockchain users as nodes and the transaction relationships between blockchain users as edges, and a graph neural network is trained according to the transaction network. Thus, the blockchain addresses are clustered according to the user dimension, which not only reduces the amount of training data, but also reduces the impact of weakly correlated data or irrelevant data on training, thereby improving the training efficiency and training accuracy of the graph neural network. In addition, the second graph embedding feature of the transaction network and the positive and negative labels of each node in the transaction network are obtained by using the graph neural network to train a random forest model, so the impact of irrelevant or weakly correlated data is also reduced during the training process of the random forest model, thereby also improving the accuracy of the random forest model. Thus, the first graph embedding feature corresponding to the blockchain transaction information is obtained by using the trained graph neural network, and the risk users in the blockchain transaction information are identified by using the random forest model based on the first graph embedding feature. This process not only improves the extraction accuracy of the first graph embedding feature through the trained graph neural network, but also improves the probability prediction accuracy through the trained random forest model, thereby improving the accuracy of identifying risky users.

[0133] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A user identification method, characterized in that: include: Get blockchain transaction information; Inputting the blockchain transaction information into the trained graph neural network to obtain a first graph embedding feature corresponding to the blockchain transaction information; The graph neural network is trained based on a transaction network corresponding to historical transaction data, wherein the transaction network has blockchain users as nodes and transaction relationships between blockchain users as edges; According to the first graph embedding feature, using a random forest model to identify risky users in the blockchain transaction information; The random forest model is trained based on the second graph embedding features corresponding to the transaction network and the positive and negative labels of each node in the transaction network, and the positive and negative labels of the nodes are determined based on the positive and negative labels of the transaction input addresses and / or transaction output addresses corresponding to the nodes.

2. The method according to claim 1, characterized in that The training steps of the graph neural network include: Acquire multiple sets of sample data, each of which corresponds to a plurality of blockchain transactions, and each set of sample data includes one or more transaction input addresses and one or more transaction output addresses; For each blockchain transaction: determining a first blockchain user corresponding to the one or more transaction input addresses, and a second blockchain user corresponding to the one or more transaction output addresses; The first blockchain user and the second blockchain user respectively corresponding to the multiple blockchain transactions are used as nodes; Forming an edge according to the transaction relationship between the first blockchain user and the second blockchain user, and determining the edge weight according to the transaction amount and transaction number between the blockchain users, to obtain the transaction network; The transaction network is used as the input of the graph neural network to train the graph neural network.

3. The method according to claim 2, characterized in that The determining the first blockchain user corresponding to the one or more transaction input addresses respectively includes: Determining that multiple transaction input addresses in the same blockchain transaction correspond to the same first blockchain user; and / or, Determine a change address, and determine that the change address and the transaction input address in the same blockchain transaction correspond to the same first blockchain user.

4. The method according to claim 2, characterized in that: The method also includes: if the first blockchain user corresponds to a transaction input address with any negative label, determining that the first blockchain user is a negative label; if the second blockchain user corresponds to a transaction output address with any negative label, determining that the second blockchain user is a negative label.

5. The method according to claim 2, characterized in that: Also includes: According to the out-degree and in-degree of each of the nodes in the transaction network, determine a target node and an out-edge adjacent point corresponding to the target node from each of the nodes; The in-degree of the target node is greater than a first threshold and the out-degree is greater than a second threshold; Deleting the outgoing edge adjacent point corresponding to the target node to optimize the transaction network; The optimized transaction network is used as the input of the graph neural network.

6. The method according to claim 2, characterized in that The graph neural network is constructed based on a graph attention network, and the training of the graph neural network includes: For each node in the transaction network: determining a neighboring node of the node; Concatenate the first feature information of the node with the second feature information of the corresponding neighbor node and the edge weight to obtain a feature vector; Obtaining the attention score of the neighbor node using a parameterized corrected linear function according to the feature vector; Aggregating the neighbor nodes according to the attention scores to obtain target feature information corresponding to the nodes; The graph neural network is trained according to the target feature information of each node.

7. The method according to claim 2, characterized in that The training of the graph neural network further includes: The loss function of the graph neural network is constructed based on the focal loss function and the L1 norm regularization term.

8. The method according to claim 7, characterized in that The focusing degree parameter for negative samples in the focal loss function is positively correlated with the ratio of positive and negative nodes.

9. A user identification device, characterized in that: include: Information acquisition module, feature determination module and risk user identification module; among which, The information acquisition module is configured to acquire blockchain transaction information; The feature determination module is configured to input the blockchain transaction information into a trained graph neural network to obtain a first graph embedding feature corresponding to the blockchain transaction information; the graph neural network is trained based on a transaction network, wherein the transaction network has blockchain users as nodes and transaction relationships between the blockchain users as edges; The risky user identification module is configured to identify risky users in the blockchain transaction information using a random forest model based on the first graph embedding feature; the random forest model is trained based on the second graph embedding feature corresponding to the transaction network and the positive and negative labels of each node in the transaction network, and the positive and negative labels of the nodes are determined based on the positive and negative labels of the transaction input address and / or transaction output address corresponding to the node.

10. An electronic device for identifying a user, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the user identification method as described in any one of claims 1-8.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the user identification method according to any one of claims 1 to 8 is implemented.

Images