Virtual currency wallet address anomaly detection method and system based on adaptive disparate message aggregation

Abstract

The invention discloses a virtual currency wallet address anomaly detection method and system based on self-adaptive different matching message aggregation, and the method comprises the steps: firstly, processing initial transaction data, obtaining the characteristics of nodes, carrying out the data normalization, converting the original data into an original transaction graph, carrying out the random walk sampling of the original transaction graph, obtaining the training graph data of a model, and carrying out the random walk sampling of the training graph data; carrying out information transmission among the nodes by adopting a graph neural network operator of self-adaptive disparity aggregation to obtain embedded vectors of the nodes; taking the obtained embedded vector of the node as the input of a prediction model; constructing a node prediction model by adopting a plurality of linear layers, and carrying out stochastic gradient descent parameter optimization on prediction of a node category probability score and calculation of node disparity; and finally, obtaining a virtual currency wallet address anomaly detection model through training, and detecting an abnormal wallet address in the virtual currency transaction network by using the model. According to the invention, the wallet address with illegal transaction in the virtual currency transaction network can be accurately identified.

Description

Technical Field

[0001] The present invention belongs to the field of graph neural networks and virtual currency anti-fraud, and relates to a virtual currency wallet address anomaly detection method and system based on adaptive heterogeneous message aggregation. Background Art

[0002] Blockchain technology, due to its decentralization and immutable transaction features, has effectively improved the security, transparency and efficiency of virtual currency transactions, and promoted financial innovation and the development of the global economy. Thanks to its open and immutable transaction data, it can provide a unique and responsible channel for financial forensics. It is particularly important to detect transaction addresses that have illegal behavior in virtual currency transactions through known public transaction information.

[0003] With the development of machine learning, some common machine learning methods have been applied to anomaly detection of virtual currency transactions, such as XGboost and RandomForest. These methods use the transaction features of the transaction address to train anomaly detection models to detect abnormal addresses. However, this method often only uses the node features of the transaction and cannot effectively utilize the graph structure generated by the transaction, resulting in unsatisfactory detection results.

[0004] In order to make full use of the graph data generated by transactions between wallet addresses, the graph anomaly detection method based on Graph Neural Networks (GNN) has been applied to the virtual currency wallet address anomaly detection task. Common GNN methods usually combine the feature information of a node with the feature information of its neighboring nodes, and make full use of the topological structure and feature information between nodes to learn node representation, so as to effectively propagate and learn information in graph data. In many real-world networks, edges tend to connect similar nodes: users in social networks tend to connect users with similar interests, and papers in citation networks mostly cite works from the same research field. This property is usually called homogeneity (the opposite is called heterogeneity). Early work on GNN focused on homogeneous graphs. However, GNNs that perform well on homogeneous graphs often have a sharp drop in performance on heterogeneous graphs. This is because GNNs often do not consider the homogeneity of neighbor nodes when aggregating neighbor information. Directly aggregating nodes of different categories will lead to information loss because nodes of different categories may have different characteristics and meanings. In the virtual currency trading network, fraudsters rarely establish connections with other fraudsters, but prefer to establish connections with normal users. Therefore, the virtual currency trading network is a typical heterogeneous graph, which leads to the poor performance of common machine learning and graph neural network methods in virtual currency address anomaly detection. Summary of the invention

[0005] To solve the above problems, the present invention provides a method and system for detecting anomalies in virtual currency wallet addresses based on adaptive heterogeneous message aggregation.

[0006] The present invention takes into account the structural characteristics of the virtual currency trading network, models the transaction data as graph data, obtains the node penetration of the graph through an adaptive heterogeneous message aggregation operator, and proposes a task of calculating the heterogeneity of messages on the graph based on the node anomaly detection task, so as to adaptively consider the information of neighbors with different heterogeneity when GNN performs neighbor aggregation. The technical solution of the invention is:

[0007] The first aspect of the present invention relates to a method for detecting anomalies in virtual currency wallet addresses based on adaptive heterogeneous message aggregation, comprising the following steps:

[0008] 1. Preprocessing of node feature data;

[0009] Based on the existing original transaction information, pyspark is used to aggregate the data within a specific time window to calculate the transaction characteristics of each address in different time windows;

[0010] 2. Construct transaction network graph data; use wallet addresses as nodes and transactions between wallet addresses as edges to obtain the original graph structure; perform random walk sampling on the original graph to obtain the training graph data of the model;

[0011] 3. Calculate the deep node embedding vector on the graph; after initializing the node features in the graph, design a graph neural network operator with adaptive heterogeneity aggregation to transfer information between nodes. In the process of message transmission, different weights are assigned when considering whether neighbor nodes are homogeneous or heterogeneous;

[0012] 4. Calculate the loss function of heterogeneity perception; use multiple linear layers to get the final prediction result, input the node embedding vector generated in step 3, output the C-dimensional output score, C is the number of categories, and obtain the probability score of the node through softmax ,For the calculation of heterogamy and the prediction of node category probability scores, the cross entropy classification loss function and the mean square error loss function are used for optimization respectively;

[0013] 5. Carry out node prediction tasks; divide the nodes in the virtual currency transaction data set into training set, validation set and test set; divide the minibatch and send the data into the model in batches for multiple Epoch training, use the stochastic gradient descent method to iteratively update the model parameters, record the performance of each Epoch model, evaluate the performance of the model, select the model parameters with the best average performance, and finally obtain the virtual currency address anomaly detection model.

[0014] Preferably, step 1 specifically includes: the total transaction amount of the address, the total number of transactions of the address, the total transaction amount of the address as the sender, the total transaction amount of the address as the receiver, the number of addresses that have transactions with the current address, the USDT amount sent by the address as the sender, the TRX amount sent by the address as the sender, the USDT amount received by the address as the receiver, the TRX amount received by the address as the receiver, the number of addresses that have frequent transactions with the current address, and the time interval between the first transaction and the last transaction of the address; the above-mentioned USDT represents the name of a virtual currency in the transaction process, and TRX is the transaction fee of the platform. The obtained feature columns are normalized to the maximum and minimum.

[0015] Furthermore, the address that has frequent transactions with the current address refers to the address with more than 5 transactions; the TRX amount and USDT amount mentioned above include the maximum, minimum and average amounts.

[0016] Preferably, the random walk sampling of the original graph described in step 2 is performed with thousands of original abnormal wallet addresses as the original node set S for random walk sampling, and the sampling steps are as follows:

[0017] Step 21: Select an abnormal node as the original node ,by As the starting point.

[0018] Step 22: Starting from the current node, randomly select a neighbor node, select the next node, and move to that node. Repeat this step until the specified walk length is reached.

[0019] Step 23: During the random walk, record the nodes passed and obtain a point set.

[0020] Step 24: Repeat the above steps to obtain multiple point sets, merge all point sets and remove duplicates, and finally retain these nodes and the edges related to these nodes from the original graph to obtain the subgraph required for model training.

[0021] Finally, we get the training graph data ,in represents N nodes, and node feature data Represents a feature matrix, which contains N nodes, and each node corresponds to a d-dimensional feature.

[0022] Preferably, step 3 specifically includes:

[0023] First, for the current node , sample its neighbor nodes, and in order to balance the ratio of black and white samples in the neighbor nodes, downsample the white samples and upsample the black samples to obtain a balanced neighbor set of the node. The original features of the node and the neighbor nodes are used as input, and the class probability of the node is output after passing through the multi-layer perceptron MLP. , for nodes and each of its neighbor nodes The cosine similarity is calculated as a measure of heterogamy, and the calculation formula is as follows:

[0024] (1)

[0025] Obtain heterogametic After that, the information is transmitted between neighbor nodes. In each k-th layer of GNN, the message passing function embeds the source node in and the heterogeneity of the source node and its neighbor nodes As input:

[0026] (2)

[0027] Where MEAN is the average aggregation function, is the heterogamety measure calculated in the previous step, Is a node neighbor nodes.

[0028] Node embedding at layer k Updated to:

[0029] (3)

[0030] in is a trainable weight and CONCAT is a vector concatenation function.

[0031] In passing After the iterative calculation, the final node embedding vector can be obtained to generate the edge prediction input features;

[0032] Preferably, in the transaction anomaly detection model of step 4, C = 2, and the probability score of the node is obtained through softmax , for the calculation of heterogeneity metric and the prediction of node category probability score, the cross entropy classification loss function and mean square error loss function are used for optimization respectively. The specific formulas are as follows:

[0033] (4)

[0034] in is the cross entropy classification loss function, is the mean square error loss function, is the true label of the node, is the model's predicted value, is the true relationship between nodes, if and If they are the same type of nodes, the value is 1, otherwise -1. is the heterogamety calculated based on the model prediction results.

[0035] Preferably, in step 5, all nodes in the virtual currency transaction data set are divided into a training set, a validation set, and a test set according to a ratio of 70%, 15%, and 15%; the performance of the Epoch model is evaluated using the performance of the accuracy, precision, recall, and F1 value.

[0036] A second aspect of the present invention relates to a virtual currency wallet address anomaly detection system for adaptive heterogeneous message aggregation, comprising:

[0037] The node feature data preprocessing module includes: based on the existing original transaction information, using pyspark to aggregate the data within a specific time window, and calculating the transaction features of each address in different time windows;

[0038] The transaction network graph data construction module includes: using wallet addresses as nodes and transactions between wallet addresses as edges to obtain the original graph structure; performing random walk sampling on the original graph to obtain the training graph data of the model;

[0039] The deep node embedding vector module on the computation graph includes: after initializing the node features in the graph, designing a graph neural network operator for adaptive heterogeneity aggregation to transmit information between nodes. In the process of message transmission, different weights are assigned when considering whether neighbor nodes are homogeneous or heterogeneous;

[0040] The training loss function calculation module includes: using multiple linear layers to obtain the final prediction result, inputting the node embedding vector generated in step 3, outputting the C-dimensional output score, where C is the number of categories, and obtaining the probability score of the node through softmax ,For the calculation of heterogamy and the prediction of node category probability scores, the cross entropy classification loss function and the mean square error loss function are used for optimization respectively;

[0041] The node prediction task module includes: dividing the nodes in the virtual currency transaction data set into training set, validation set and test set; dividing the minibatch to send the data into the model in batches for multiple Epoch training, using the stochastic gradient descent method to iteratively update the model parameters, recording the performance of each Epoch model, evaluating the performance of the model, selecting the model parameters with the best average performance, and finally obtaining the virtual currency address anomaly detection model.

[0042] The third aspect of the present invention relates to a virtual currency wallet address anomaly detection device based on adaptive heterogeneous message aggregation, comprising a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the virtual currency wallet address anomaly detection method based on adaptive heterogeneous message aggregation of the present invention.

[0043] A fourth aspect of the present invention relates to a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the virtual currency wallet address anomaly detection method based on adaptive heterogeneous message aggregation of the present invention.

[0044] The advantages of the present invention are: virtual currency transaction data is modeled as graph data, and the transaction characteristics of the nodes are combined, so as to make full use of the structural information and node feature information of the transaction. Secondly, a multi-task loss function of heterogeneity perception is adopted, and node anomaly detection and edge node heterogeneity prediction tasks are performed simultaneously, thereby improving the efficiency and generalization ability of the model. In view of the problem that the original graph structure is too large, a random walk sampling method is adopted to effectively reduce the scale of the graph and improve the computational efficiency. In the process of message transmission, the imbalance and heterogeneity of neighbor nodes are considered, and the representation ability of the model is enhanced. Finally, a flexible model evaluation method is adopted, which comprehensively considers multiple indicators such as accuracy, precision, recall rate and F1 value, and can comprehensively evaluate the performance of the model, and well completes the task of detecting abnormal wallet addresses. Through the anomaly detection model, the wallet addresses of illegal transactions in the virtual currency transaction network can be accurately identified, thereby providing an effective tool for regulatory authorities to achieve control of transactions and risk prevention. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flow chart of the method of the present invention.

[0046] Figure 2 It is a schematic diagram of converting the original transaction data of the present invention into graph data.

[0047] Figure 3 It is a schematic diagram of neighbor adaptive message aggregation of the present invention.

[0048] Figure 4 It is a schematic diagram of the system structure of the present invention.

[0049] Figure 5 It is a structural schematic diagram of the device of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] It should be noted that, in the absence of conflict, the features in the following embodiments and implementations may be combined with each other.

[0052] Example 1

[0053] Figure 1 A flowchart of a method for detecting anomaly in a virtual currency wallet address based on adaptive heterogeneous message aggregation provided by an embodiment of the present invention. Figure 1 As shown, a method for detecting anomaly of a virtual currency wallet address based on adaptive heterogeneous message aggregation in this embodiment includes the following steps:

[0054] 1. Preprocessing of node feature data;

[0055] The original transaction data mainly includes the following fields: sender wallet address, receiver wallet address, transaction currency information, transaction amount, etc. Based on the original transaction information of several months, such as Figure 2 As shown in the figure, pyspark is used to aggregate the data within a specific time window, and the transaction features of each address in different time windows are calculated. The specific features are as follows:

[0056] Total transaction amount of the address, total number of transactions of the address, total transaction amount of the address as the sender, total transaction amount of the address as the receiver, number of addresses with which the current address has transactions, USDT amount sent by the address as the sender (including maximum, minimum, and average amount), TRX amount sent by the address as the sender (including maximum, minimum, and average amount), USDT amount received by the address as the receiver (including maximum, minimum, and average amount), TRX amount received by the address as the receiver (including maximum, minimum, and average amount), number of addresses with frequent transactions with the current address (number of transactions greater than 5), time interval between the first and last transactions of the address. The above-mentioned USDT represents the name of a virtual currency in the transaction process, and TRX is the transaction fee of the platform. Perform maximum and minimum normalization on the obtained feature columns

[0057] 2. Construct transaction network graph data;

[0058] The virtual currency transaction network is a natural graph structure, with wallet addresses as nodes and transactions between wallet addresses as edges, resulting in the original graph structure. Since the graph structure is too large and the ratio of black and white samples is extremely uneven, the original graph is randomly sampled to obtain the training graph data of the model. The original thousands of abnormal wallet addresses are used as the original node set S for random walk sampling. The sampling steps are as follows:

[0059] Step 21: Select an abnormal node as the original node ,by As the starting point.

[0060] Step 22: Starting from the current node, randomly select a neighbor node, select the next node, and move to that node. Repeat this step until the specified walk length is reached.

[0061] Step 23: During the random walk, record the nodes passed through to obtain a point set.

[0062] Step 24: Repeat the above steps to obtain multiple point sets, merge all point sets and remove duplicates, and finally retain these nodes and the edges related to these nodes from the original graph to obtain the subgraph required for model training.

[0063] Finally, we get the training graph data ,in represents N nodes, and node feature data Represents a feature matrix, which contains N nodes, and each node corresponds to a d-dimensional feature.

[0064] 3. Calculate the deep node embedding vector on the graph;

[0065] After initializing the node features in the graph, such as Figure 3 As shown in the figure, a graph neural network operator with adaptive heterogeneity aggregation is designed to transfer information between nodes. In the process of message transmission, different weights are assigned when considering whether neighbor nodes are homogeneous or heterogeneous. The specific steps are as follows:

[0066] First, for the current node , sample its neighbor nodes, and in order to balance the ratio of black and white samples in the neighbor nodes, downsample the white samples and upsample the black samples to obtain a balanced neighbor set of the node. The original features of the node and the neighbor nodes are used as input, and the multi-layer perceptron MLP is used to output the category probability of the node. , for nodes and each of its neighbor nodes The cosine similarity is calculated as a measure of heterogamy, and the calculation formula is as follows:

[0067] (1)

[0068] Obtain heterogametic After that, the information is transmitted between neighbor nodes. In each k-th layer of GNN, the message passing function embeds the source node in and the heterogeneity of the source node and its neighbor nodes As input:

[0069] (2)

[0070] Where MEAN is the average aggregation function, is the heterogamety calculated in the previous step, Is a node neighbor nodes.

[0071] Node embedding at layer k Updated to:

[0072] (3)

[0073] in is a trainable weight and CONCAT is a vector concatenation function.

[0074] In passing After the iterative calculation, the final node embedding vector can be obtained to generate the edge prediction input features;

[0075] 4. Calculate the loss function of heterogametic perception;

[0076] Multiple linear layers are used to obtain the final prediction result. The input is the node embedding vector generated in step 3, and the output is the C-dimensional output score. C is the number of categories. In the transaction anomaly detection model, C = 2. The probability score of the node is obtained through softmax. , for the calculation of heterogeneity and the prediction of node category probability scores, the cross entropy classification loss function and the mean square error loss function are used for optimization respectively. The specific formulas are as follows:

[0077] (4)

[0078] in is the cross entropy classification loss function, is the mean square error loss function, is the true label of the node, is the model's predicted value, is the true relationship between nodes, if and If they are the same type of nodes, the value is 1, otherwise -1. is the heterogamety calculated based on the model prediction results.

[0079] 5. Perform node prediction tasks;

[0080] All nodes in the virtual currency transaction data set are divided into training set, validation set and test set according to the ratio of 70%, 15% and 15%. The data is divided into minibatches and sent to the model in batches for multiple Epoch training. The stochastic gradient descent method is used to iteratively update the model parameters. In this process, the performance of each Epoch model is recorded, and the performance of the model is evaluated using the performance of the accuracy, precision, recall and F1 value. The model parameters with the best average performance are selected, and finally the virtual currency address anomaly detection model is obtained. Using this anomaly detection model, the wallet addresses of illegal transactions in the virtual currency transaction network can be accurately identified, thereby providing effective tools for regulatory authorities to achieve transaction control and risk prevention.

[0081] Example 2

[0082] This embodiment relates to a virtual currency wallet address anomaly detection system for adaptive heterogeneous message aggregation, such as Figure 4 The system comprises:

[0083] The node feature data preprocessing module includes: based on the existing original transaction information, using pyspark to aggregate the data within a specific time window, and calculating the transaction features of each address in different time windows;

[0084] The transaction network graph data construction module includes: using wallet addresses as nodes and transactions between wallet addresses as edges to obtain the original graph structure; performing random walk sampling on the original graph to obtain the training graph data of the model;

[0085] The deep node embedding vector module on the computation graph includes: after initializing the node features in the graph, designing a graph neural network operator for adaptive heterogeneity aggregation to transmit information between nodes. In the process of message transmission, different weights are assigned when considering whether neighbor nodes are homogeneous or heterogeneous;

[0086] The training loss function calculation module includes: using multiple linear layers to obtain the final prediction result, inputting the node embedding vector generated in step 3, outputting the C-dimensional output score, where C is the number of categories, and obtaining the probability score of the node through softmax ,For the calculation of heterogamy and the prediction of node category probability scores, the cross entropy classification loss function and the mean square error loss function are used for optimization respectively;

[0087] The node prediction task module includes: dividing the nodes in the virtual currency transaction data set into training set, validation set and test set; dividing the minibatch to send the data into the model in batches for multiple Epoch training, using the stochastic gradient descent method to iteratively update the model parameters, recording the performance of each Epoch model, evaluating the performance of the model, selecting the model parameters with the best average performance, and finally obtaining the virtual currency address anomaly detection model.

[0088] Example 3

[0089] like Figure 5 As shown, this embodiment relates to a virtual currency wallet address anomaly detection device based on adaptive heterogeneous message aggregation, including a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, it is used to implement the virtual currency wallet address anomaly detection method based on adaptive heterogeneous message aggregation of Example 1.

[0090] At the hardware level, the device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Of course, in addition to the software implementation, the present invention does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0091] For the improvement of a technology, it can be clearly distinguished whether it is a hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or a software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0092] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0093] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0094] For the convenience of description, the above device is described as being divided into various units according to their functions. Of course, when implementing the present invention, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0095] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0096] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0100] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0101] Example 4

[0102] The present embodiment relates to a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the method for detecting anomalies in virtual currency wallet addresses based on adaptive heterogeneous message aggregation of embodiment 1 is implemented.

[0103] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] The present invention may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0107] Each embodiment of the present invention is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0108] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A virtual currency wallet address anomaly detection method based on adaptive heterogeneous message aggregation includes the following steps: S1. Preprocessing of node feature data: Based on the existing original transaction information, use pyspark to aggregate the data within a specific time window and calculate the transaction features of each address in different time windows; S2. Construct transaction network graph data; use wallet addresses as nodes and transactions between wallet addresses as edges to obtain the original graph structure; perform random walk sampling on the original graph to obtain the training graph data of the model; S3. Calculate the deep node embedding vector on the graph; after initializing the node features in the graph, design a graph neural network operator with adaptive heterogeneity aggregation to transfer information between nodes. In the process of message transmission, different weights are assigned when considering whether neighbor nodes are homogeneous or heterogeneous; S4. Calculate the loss function of heterogeneity perception; use multiple linear layers to get the final prediction result, input the node embedding vector generated in step S3, output the C-dimensional output score, C is the number of categories, and obtain the probability score of the node through softmax ,For the calculation of heterogamy and the prediction of node category probability scores, the cross entropy classification loss function and the mean square error loss function are used for optimization respectively; S5. Perform node prediction tasks; divide the nodes in the virtual currency transaction data set into training set, validation set and test set; divide the data into minibatches and send them into the model in batches for multiple Epoch training. Use the stochastic gradient descent method to iteratively update the model parameters, record the performance of each Epoch model, evaluate the performance of the model, select the model parameters with the best average performance, and finally obtain the virtual currency address anomaly detection model.

2. The method for detecting anomaly of virtual currency wallet addresses based on adaptive heterogeneous message aggregation according to claim 1, characterized in that: Step S1 specifically includes: The total transaction amount of the address, the total number of transactions of the address, the total transaction amount of the address as the sender, the total transaction amount of the address as the receiver, the number of addresses that have transactions with the current address, the USDT amount sent by the address as the sender, the TRX amount sent by the address as the sender, the USDT amount received by the address as the receiver, the TRX amount received by the address as the receiver, the number of addresses that have frequent transactions with the current address, and the time interval between the first and last transactions of the address; the above-mentioned USDT represents the name of a virtual currency in the transaction process, and TRX is the transaction fee of the platform; the obtained feature columns are normalized to the maximum and minimum.

3. The method for detecting anomaly of virtual currency wallet addresses based on adaptive heterogeneous message aggregation as claimed in claim 2, characterized in that: The addresses that have frequent transactions with the current address refer to addresses with more than 5 transactions; the TRX amount and USDT amount mentioned above include the maximum, minimum and average amounts.

4. The method for detecting anomaly of virtual currency wallet addresses based on adaptive heterogeneous message aggregation according to claim 1, characterized in that: In step S2, the original graph is randomly sampled by random walk, and thousands of original abnormal wallet addresses are used as the original node set S for random walk sampling. The sampling steps are as follows: Step 21: Select an abnormal node as the original node ,by as a starting point; Step 22: Starting from the current node, randomly select a neighbor node, select the next node, and move to that node; repeat this step until the specified walk length is reached; Step 23: During the random walk, record the nodes passed through to obtain a point set; Step 24: Repeat the above steps to obtain multiple point sets, merge all point sets and remove duplicates, and finally retain these nodes and the edges related to these nodes from the original graph to obtain the subgraph required for model training; Finally, we get the training graph data ,in represents N nodes, and node feature data Represents a feature matrix, which contains N nodes, and each node corresponds to a d-dimensional feature.

5. The method for detecting anomaly of virtual currency wallet addresses based on adaptive heterogeneous message aggregation according to claim 1, characterized in that: Step S3 specifically includes: first, for the current node , sample its neighbor nodes, and in order to balance the ratio of black and white samples in the neighbor nodes, downsample the white samples and upsample the black samples to obtain a balanced neighbor set of the node; take the original features of the node and the neighbor nodes as input, pass through the multi-layer perceptron MLP, and output the category probability of the node , for nodes and each of its neighbor nodes The cosine similarity is calculated as a measure of heterogamy, and the calculation formula is as follows: （1） Obtain heterogametic After that, the information is transmitted between neighbor nodes. In each k-th layer of GNN, the message passing function embeds the source node ,in , and the heterogeneity of the source node and its neighbor nodes As input: （2） Where MEAN is the average aggregation function, is the heterogamety calculated in the previous step, Is a node Neighbor nodes of Node embedding at layer k Updated to: （3） in are trainable weights, is the vector concatenation function; In passing After iterative calculations, the final node embedding vector can be obtained to generate edge prediction input features.

6. The method for detecting anomaly of virtual currency wallet addresses based on adaptive heterogeneous message aggregation according to claim 1, characterized in that: In the transaction anomaly detection model of step S4, C = 2, and the probability score of the node is obtained through softmax , for the calculation of heterogeneity and the prediction of node category probability scores, the cross entropy classification loss function and the mean square error loss function are used for optimization respectively. The specific formulas are as follows: （4） in is the cross entropy classification loss function, is the mean square error loss function, is the true label of the node, is the predicted value of the model, is the true relationship between nodes, if and If they are the same type of nodes, the value is 1, otherwise -1. is the heterogamety calculated based on the model prediction results.

7. The method for detecting anomaly of virtual currency wallet addresses based on adaptive heterogeneous message aggregation according to claim 1, characterized in that: In step S5, all nodes in the virtual currency transaction data set are divided into a training set, a validation set, and a test set according to a ratio of 70%, 15%, and 15%.

8. The method for detecting anomaly of virtual currency wallet addresses based on adaptive heterogeneous message aggregation according to claim 1, characterized in that: In step S5, the performance of the Epoch model is expressed using the accuracy, precision, recall, and F1 value.

9. A virtual currency wallet address anomaly detection system based on adaptive heterogeneous message aggregation, characterized in that: include: The node feature data preprocessing module includes: based on the existing original transaction information, using pyspark to aggregate the data within a specific time window, and calculating the transaction features of each address in different time windows; The transaction network graph data construction module includes: using wallet addresses as nodes and transactions between wallet addresses as edges to obtain the original graph structure; performing random walk sampling on the original graph to obtain the training graph data of the model; The deep node embedding vector module on the computation graph includes: after initializing the node features in the graph, designing a graph neural network operator for adaptive heterogeneity aggregation to transmit information between nodes. In the process of message transmission, different weights are assigned when considering whether neighbor nodes are homogeneous or heterogeneous; The training loss function calculation module includes: using multiple linear layers to obtain the final prediction result, inputting the node embedding vector generated by the deep node embedding vector module on the calculation graph, outputting the C-dimensional output score, where C is the number of classification categories, and obtaining the probability score of the node through softmax. ,For the calculation of heterogamy and the prediction of node category probability scores, the cross entropy classification loss function and the mean square error loss function are used for optimization respectively; The node prediction task module includes: dividing the nodes in the virtual currency transaction data set into training set, validation set and test set; dividing the minibatch to send the data into the model in batches for multiple Epoch training, using the stochastic gradient descent method to iteratively update the model parameters, recording the performance of each Epoch model, evaluating the performance of the model, selecting the model parameters with the best average performance, and finally obtaining the virtual currency address anomaly detection model.

10. A virtual currency wallet address anomaly detection device based on adaptive heterogeneous message aggregation, characterized in that: It includes a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, it is used to implement the virtual currency wallet address anomaly detection method based on adaptive heterogeneous message aggregation as described in any one of claims 1-8.

Images