Ethereum user fraud behavior identification method and device, equipment and storage medium
By extracting the first-order subgraph features of the target node in the Ethereum trading network, combining local attention and pooling operations, and combining Mamba framework to filter irrelevant information, the low accuracy of traditional graph neural networks in identifying Ethereum fraud behavior is solved. The problem has been achieved to achieve more efficient identification of fraud.
Patent Information
- Application Number
- CN202410681707.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-05-29
- Publication Date
- 2024-12-17
AI Technical Summary
When the existing technology recognizes fraud on the Ethereum platform, the traditional graph neural network model is difficult to effectively capture key transaction patterns due to the heterogeneity of local adjacent accounts and the restricted receptive field, and is easily avoided by anti-reconnaissance methods. This results in low recognition accuracy.
By extracting the first-order subgraph of the target node from the original graph, using local attention operations and pooling operations to generate features, combining the Mamba framework to filter irrelevant information, sorting node degrees to identify fraudulent behavior, and integrating local and global information.
It improves the accuracy of identification of fraudulent behaviors of anonymous accounts on Ethereum, can capture the local interaction mode and long-distance dependence of accounts, and enhances the ability to detect fraudulent behaviors.
Smart Images
Figure CN119151541A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method, device, equipment and storage medium for identifying fraudulent behavior of Ethereum users. Background Art
[0002] Ethereum is a platform based on blockchain technology. Ethereum's blockchain technology allows users to create and execute smart contracts on the platform. Blockchain technology ensures the security and transparency of transactions. The Ethereum platform provides support for smart contracts and DApps, allowing users to perform various decentralized transactions on the platform. However, in the Ethereum platform, accounts are pseudonymous addresses. These addresses are meaningless strings, and the entities behind them are unknown. Although the privacy of users is protected, this anonymous transaction also leads to an increase in fraud on the platform.
[0003] At present, most of the existing technologies use machine learning methods based on manual features to identify fraudulent behavior. However, manual feature engineering is highly dependent on the prior knowledge of feature designers, and this method ignores the interactive information between accounts and is easily evaded by anti-reconnaissance means. To address this problem, the existing technology uses graph neural network models to identify different categories of accounts. Traditional graph neural network models transmit messages in a local range. When applied to the heterogeneous Ethereum transaction network, the performance is limited because local adjacent accounts may have different characteristics. In addition, traditional graph neural networks encode subtrees around nodes. This limited receptive field limits its perception of some key transaction patterns. Although the Graph Transformer method allows nodes to conceptually pay attention to all nodes in the graph, the Graph Transformer method is easily distracted by irrelevant context when processing dense data, resulting in low accuracy in identifying fraudulent behavior.
[0004] Therefore, how to improve the accuracy of identifying fraudulent behavior of Ethereum users has become a technical problem that needs to be solved urgently by technicians in this field. Summary of the invention
[0005] In view of the above, the present application provides a method, device, equipment and storage medium for identifying fraudulent behavior of Ethereum users, which aims to solve the above technical problems.
[0006] In a first aspect, the present application provides a method for identifying fraudulent behavior of Ethereum users, the method comprising:
[0007] Extracting first-order subgraphs of multiple target nodes from the original graph respectively, wherein the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes;
[0008] Based on local attention and pooling operations, the first-order subgraph features of each target node are generated;
[0009] According to the sum of the degrees of all nodes in each first-order subgraph, the first-order subgraphs are sorted to obtain the sequence of target nodes;
[0010] Filter irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain a target feature of each target node;
[0011] Identify whether the target node has fraudulent behavior based on the target feature.
[0012] In a second aspect, the present application provides a device for identifying fraudulent behavior of Ethereum users, the device comprising:
[0013] Extraction module: used to extract first-order subgraphs of multiple target nodes from the original graph, wherein the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes;
[0014] Generation module: used to generate the first-order subgraph features of each target node based on local attention operation and pooling operation;
[0015] Sorting module: used to sort the first-order subgraphs according to the sum of the degrees of all nodes in each first-order subgraph to obtain the sequence of target nodes;
[0016] Filtering module: used to filter irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain the target features of each target node;
[0017] Identification module: used to identify whether the target node has fraudulent behavior based on the target characteristics.
[0018] In a third aspect, the present application provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;
[0019] Memory, used to store computer programs;
[0020] The processor is used to implement the method for identifying fraudulent behavior of Ethereum users as described in any one of the embodiments of the first aspect when executing the program stored in the memory.
[0021] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for identifying fraudulent behavior of Ethereum users as described in any embodiment of the first aspect is implemented.
[0022] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art:
[0023] This application extracts the first-order subgraphs of multiple target nodes from the original graph, where the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes, and generates the first-order subgraph features of each target node based on local attention operations and pooling operations. The local attention operation enables the node to focus on important neighbors in the local structure, thereby capturing the local relationship and pattern between nodes. According to the sum of the degrees of all nodes in each first-order subgraph, the first-order subgraph is sorted to obtain a sequence of target nodes, and the irrelevant information of the first-order subgraph features is filtered based on the sequence of target nodes to obtain the target features of each target node, and then identify whether the target node has fraudulent behavior. This application can capture the local interaction mode of the account according to the graph structure, and at the same time establish long-distance dependencies between target nodes, integrate local information and global information, and improve the accuracy of identifying whether the Ethereum anonymous account has fraudulent behavior. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0026] Figure 1 This is a flow chart of an embodiment of a method for identifying fraudulent behavior of Ethereum users in this application;
[0027] Figure 2 A schematic diagram of a first-order subgraph of an original graph and a target node in an embodiment of the present application;
[0028] Figure 3 A schematic diagram of calculating feature information of each node in a first-order subgraph using a local attention operation in an embodiment of the present application;
[0029] Figure 4 A schematic diagram of sorting the sum of the degrees of all nodes in each first-order subgraph according to an embodiment of the present application;
[0030] Figure 5 This is a module diagram of an embodiment of a device for identifying fraudulent behavior of Ethereum users in this application;
[0031] Figure 6 A schematic diagram of an electronic device embodiment of the present application;
[0032] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0033] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0034] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.
[0035] This application provides a method for identifying fraudulent behavior of Ethereum users. Figure 1 , which is a method flow diagram of an embodiment of the method for identifying fraudulent behavior of Ethereum users of the present application. The method can be executed by an electronic device, and the electronic device can be implemented by software and / or hardware. The method for identifying fraudulent behavior of Ethereum users includes:
[0036] Step S10: extracting first-order subgraphs of multiple target nodes from the original graph respectively, wherein the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes;
[0037] Step S20: Generate first-order subgraph features of each target node based on local attention operation and pooling operation;
[0038] Step S30: sorting the first-order subgraphs according to the sum of the degrees of all nodes in each first-order subgraph to obtain a sequence of target nodes;
[0039] Step S40: filtering irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain target features of each target node;
[0040] Step S50: Identify whether the target node has any fraudulent behavior according to the target feature.
[0041] Since the account design in the Ethereum platform is a pseudonymous address, the entity behind it is unknown. Although the privacy of users can be protected, this anonymous transaction also increases the fraud on the platform. For this reason, the present application proposes a method for identifying fraudulent behavior of Ethereum users to identify users with fraudulent behavior in the Ethereum platform. Specifically, a first-order subgraph of multiple target nodes is extracted from the original graph, and the target node refers to a node to be identified, which may refer to a plurality of randomly selected nodes to be identified, or all nodes in the original graph are used as nodes to be identified. The original graph refers to an undirected graph constructed as a node by a user with transaction behavior in Ethereum, a user corresponding to a node of the original graph, and a connected node indicates a user with a transaction relationship or other association relationship, that is, users with a relationship are connected by an edge.
[0042] Ginseng Figure 2 As shown, it is a schematic diagram of the first-order subgraph of the original graph and the target node in an embodiment of the present application, and all nodes directly adjacent to the target node, that is, the nodes directly connected to the target node, are found. These nodes constitute a first-order neighbor node set, and a subgraph is constructed based on the target node and its first-order neighbor nodes. The subgraph includes the target node, all first-order neighbor nodes of the target node, and the edges connecting these nodes. For example, if user 1 in the original graph is the target node, then the first-order subgraph of the target node user 1 includes the target node user 1, neighbor nodes user 2, user 6 and user 7, and the edges connecting each neighbor node to the target node user 1.
[0043] The first-order subgraph feature representation of each target node is generated by using local attention operation and pooling operation. Local attention operation is a mechanism that can calculate attention weights in a local range, which enables nodes to focus on important neighbors in the local structure, thereby capturing local relationships and patterns between nodes. Specifically, based on local attention operation and pooling operation, the first-order subgraph features of each target node are generated, including:
[0044] Based on the local attention operation, the feature information of each node in each first-order subgraph is calculated;
[0045] According to the feature information of each node in each first-order subgraph, the first-order subgraph feature of each target node is generated.
[0046] Taking the first-order subgraph of the target node (user 1) as an example, the local attention algorithm is applied to user 1, user 2, user 6 and user 7 of the first-order subgraph respectively to calculate the feature information of each node of user 1, user 2, user 6 and user 7 in the first-order subgraph of user 1. According to the feature information of each node in the first-order subgraph, the first-order subgraph feature representation of the target node (user 1) is aggregated to generate the first-order subgraph feature representation of each target node.
[0047] Among them, based on the local attention operation, the feature information of each node in each first-order subgraph is calculated, including:
[0048] Calculate the attention weight coefficients of each node and its neighboring nodes in each first-order subgraph respectively;
[0049] The features of the neighboring nodes of each node are weighted according to the attention weight coefficient to obtain the weighted features of the neighboring nodes corresponding to each node;
[0050] The features of each node itself and the weighted features of its corresponding neighboring nodes are weightedly calculated to obtain the feature information of each node in each first-order subgraph.
[0051] Ginseng Figure 3 As shown, it is a schematic diagram of calculating the feature information of each node in the first-order subgraph using the local attention operation in an embodiment of the present application. Taking the first-order subgraph of the target node (user 1) as an example, according to the connection and relationship between the nodes, the attention weight coefficient of user 1 and its neighboring nodes in the first-order subgraph is calculated, and the features of the neighboring nodes of user 1 are weighted according to the attention weight coefficient to obtain the weighted features of the neighboring nodes corresponding to user 1, and the features of user 1 itself and the weighted features of the neighboring nodes corresponding to user 1 are weighted to obtain the feature information representation of user 1.
[0052] Calculate the attention weight coefficients of user 2 and its neighbor nodes in the first-order subgraph, perform weighted calculation on the features of user 2's neighbor nodes according to the attention weight coefficients, obtain the weighted features of the neighbor nodes corresponding to user 2, perform weighted calculation on the features of user 2 itself and the weighted features of user 2's neighbor nodes, and obtain the feature information representation of user 2. Similarly, the feature information representations corresponding to user 6 and user 7 can be obtained. By performing local attention calculation on each node, each node will obtain a feature representation that takes into account the neighbor nodes, which helps to capture the local relationship and importance between the node and its neighbor nodes, and can better utilize the local correlation information between nodes.
[0053] Among them, according to the feature information of each node in each first-order subgraph, the first-order subgraph feature of each target node is generated, including:
[0054] The feature information of each node in each first-order subgraph is aggregated through pooling operation to generate the first-order subgraph features of each target node.
[0055] After generating the feature information of each node in the first-order subgraph of the target node, a pooling operation (e.g., average pooling) is performed on the first-order subgraph to generate the first-order subgraph features of the target node. Taking the first-order subgraph of the target node (user 1) as an example, the feature information of user 1, user 2, user 6, and user 7 is aggregated to generate the first-order subgraph feature representation of the target node (user 1). By analogy, the first-order subgraph feature representation of each target node can be obtained. The pooling operation can effectively capture the overall features of the first-order subgraph, thereby accurately capturing the complex transaction patterns between Ethereum users.
[0056] According to the sum of the degrees of all nodes in each first-order subgraph, the first-order subgraph is sorted to obtain the sequence of target nodes. The degree of a node refers to the number of edges connected to the node. Figure 4 As shown, it is a schematic diagram of sorting the sum of the degrees of all nodes in each first-order subgraph according to an embodiment of the present application. Taking the first-order subgraph of the target node (user 2) as an example, the first-order subgraph contains user 1, user 2 and user 3, the degree of user 1 is 1, the degree of user 2 is 2, and the degree of user 3 is 1, so the sum of the degrees of all nodes in the first-order subgraph is 4. After determining the sum of the degrees of all nodes in each first-order subgraph, the first-order subgraphs of all target nodes are sorted according to the order of the sum of the degrees from low to high to obtain a sequence of target nodes.
[0057] Since the Mamba framework can be used to filter irrelevant information in the first-order subgraph features later, and the Mamba architecture is designed for sequential data, each node is updated based on the hidden state from the previous node, and the nodes that enter Mamba early capture less sequence context information, while the nodes that enter Mamba later capture almost the entire sequence information. Therefore, the sequence is sorted according to the importance of the nodes, and the subgraph structure contains more information than the subtree structure, which is more important in downstream tasks. In addition, the sum of the node degrees contained in the subgraph extracted from the same target node is greater than the sum of the node degrees contained in the subtree, so the target nodes are sorted according to the total degree of all nodes on the subgraph.
[0058] Mamba is a framework for processing sequence data. The Mamba framework combines the Selective State Spaces (SSS) model to filter out irrelevant information through a selective mechanism, retaining only key information that is useful for the task. This mechanism ensures that the model can work efficiently in a large data set, so that it performs well in identifying fraud in Ethereum platform transactions. This embodiment uses the Mamba model to update the first-order subgraph features to filter out irrelevant information of the first-order subgraph features, and uses the updated first-order subgraph features as the final feature representation of the target node, that is, the account representation of the Ethereum user. Specifically, the irrelevant information of the first-order subgraph features is filtered based on the sequence of the target node to obtain the target features of each target node, including:
[0059] Mapping each first-order subgraph feature into a state vector according to the order of the sequence;
[0060] The state vector is mapped through a parameter matrix to obtain the target feature of each target node.
[0061] Assume that the sequence of target nodes is [x1,x2,...,x n ], x i Represents the i-th target node. The Mamba model can map each first-order subgraph feature into a state vector, and obtain [h1,h2,...,h t ].
[0062] The formula for mapping each first-order subgraph feature into a state vector includes:
[0063] h t =(1-g t )h t-1 +g t x t
[0064] Among them, h t represents the state vector, x t represents the first-order subgraph feature of the current input, g t Indicates the control of x t and the previous state vector h t-1 The gating weights are balanced between. When updating the state vector h t When t Control the current input x t and the previous context h t-1 The balance between , thereby filtering out information irrelevant to downstream tasks. t =sigmoid(wx t ), w is a learnable weight parameter, sigmoid(x)=1 / (1+e -x) is an activation function that can map variables to between [0,1]. This formula is established by t With input data x t The final state vector h i The target feature y of the target node is obtained by mapping it to the updated node representation through a parameter matrix i .
[0065] The Mamba model is used to densely transmit messages in the global context window, and the selection mechanism is used to filter out irrelevant information, continuously integrating important information on a global scale to ensure that important information will not be lost in a complex transaction network. This solves the problem in the existing technology that the Graph Transformer-based method is easily distracted by irrelevant context.
[0066] Get the target features of the target node [y1,y2,...,y n ], it is possible to identify whether the target node has fraudulent behavior according to the target feature. Specifically, identifying whether the target node has fraudulent behavior according to the target feature includes:
[0067] The target feature is input into a multi-layer perceptron model to obtain a recognition result of the target node, wherein the recognition result represents whether the target node has fraudulent behavior or does not have fraudulent behavior.
[0068] The target features [y1,y2,...,y n ] Input the multi-layer perceptron model for identification, and the multi-layer perceptron model will output a value between 0 and 1, which indicates the probability that the account corresponding to the target node has fraudulent behavior. If the value is close to 1, it indicates that the model determines that this account has a high probability of being involved in fraudulent behavior. If it is close to 0, the account's transaction behavior is considered normal. This application can capture the local interaction mode of the account based on the graph structure, establish long-distance dependencies between target nodes, integrate local information with global information, and improve the accuracy of identifying whether the Ethereum anonymous account has fraudulent behavior.
[0069] Reference Figure 5 , which is a schematic diagram of the functional modules of the fraud behavior identification device 100 for Ethereum users of the present application.
[0070] The fraudulent behavior identification device 100 for Ethereum users described in this application can be installed in an electronic device. According to the functions implemented, the fraudulent behavior identification device 100 for Ethereum users may include an extraction module 110, a generation module 120, a sorting module 130, a filtering module 140 and an identification module. The module described in this application may also be referred to as a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.
[0071] In this embodiment, the functions of each module / unit are as follows:
[0072] Extraction module 110: used to extract first-order subgraphs of multiple target nodes from the original graph, wherein the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes;
[0073] Generating module 120: used to generate first-order subgraph features of each target node based on local attention operation and pooling operation;
[0074] Sorting module 130: used to sort the first-order subgraphs according to the sum of the degrees of all nodes in each first-order subgraph to obtain a sequence of target nodes;
[0075] Filtering module 140: used to filter irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain the target features of each target node;
[0076] Identification module 150: used to identify whether the target node has fraudulent behavior according to the target feature.
[0077] In one embodiment, the generating of the first-order subgraph features of each target node based on the local attention operation and the pooling operation includes:
[0078] Based on the local attention operation, the feature information of each node in each first-order subgraph is calculated;
[0079] According to the feature information of each node in each first-order subgraph, the first-order subgraph feature of each target node is generated.
[0080] In one embodiment, the feature information of each node in each first-order subgraph is calculated based on the local attention operation, including:
[0081] Calculate the attention weight coefficients of each node and its neighboring nodes in each first-order subgraph respectively;
[0082] The features of the neighboring nodes of each node are weighted according to the attention weight coefficient to obtain the weighted features of the neighboring nodes corresponding to each node;
[0083] The features of each node itself and the weighted features of its corresponding neighboring nodes are weightedly calculated to obtain the feature information of each node in each first-order subgraph.
[0084] In one embodiment, generating the first-order subgraph feature of each target node according to the feature information of each node in each first-order subgraph includes:
[0085] The feature information of each node in each first-order subgraph is aggregated through pooling operation to generate the first-order subgraph features of each target node.
[0086] In one embodiment, filtering irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain the target features of each target node includes:
[0087] Mapping each first-order subgraph feature into a state vector according to the order of the sequence;
[0088] The state vector is mapped through a parameter matrix to obtain the target feature of each target node.
[0089] In one embodiment, each first-order subgraph feature is mapped to a state vector using a formula, the formula comprising:
[0090] h t =(1-g t )h t-1 +g t x t
[0091] Among them, h t represents the state vector, x t represents the first-order subgraph feature of the current input, g t Indicates the control of x t and the previous state vector h t-1 The gating weights are balanced between
[0092] In one embodiment, the step of identifying whether the target node has fraudulent behavior according to the target feature includes:
[0093] The target feature is input into a multi-layer perceptron model to obtain a recognition result of the target node, wherein the recognition result represents whether the target node has fraudulent behavior or does not have fraudulent behavior.
[0094] Reference Figure 6 , which is a schematic diagram of a preferred embodiment of the electronic device of the present application.
[0095] The electronic device includes a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other via the communication bus 114;
[0096] Memory 113, used to store computer programs, for example, a fraud identification program for Ethereum users;
[0097] The processor 111 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 111 is generally used to control the overall operation of the electronic device, such as performing control and processing related to data interaction or communication. In this embodiment, the processor 111 is used to run the program code stored in the memory 113 or process data, such as running the program code of the fraud behavior identification program of Ethereum users.
[0098] The communication interface 112 may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface), and the communication interface 112 may also be used to establish a communication connection between the electronic device and other electronic devices.
[0099] The memory 113 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 113 can be an internal storage unit of the electronic device, such as a hard disk or memory of the electronic device. In other embodiments, the memory 113 can also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped with the electronic device. Of course, the memory 113 can also include both the internal storage unit of the electronic device and its external storage device. In this embodiment, the memory 11 is generally used to store the operating system and various computer programs installed in the electronic device, such as the program code of the fraud behavior identification program of the Ethereum user, etc. In addition, the memory 113 can also be used to temporarily store various types of data that have been output or are to be output.
[0100] Figure 6Only an electronic device having components 111 - 114 is shown, but it is understood that implementing all of the components shown is not a requirement, and more or fewer components may alternatively be implemented.
[0101] In one embodiment of the present application, the processor 111 is used to execute the program stored in the memory 113 to implement the method for identifying fraudulent behavior of Ethereum users provided by any of the aforementioned method embodiments, including:
[0102] Extracting first-order subgraphs of multiple target nodes from the original graph respectively, wherein the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes;
[0103] Based on local attention and pooling operations, the first-order subgraph features of each target node are generated;
[0104] According to the sum of the degrees of all nodes in each first-order subgraph, the first-order subgraphs are sorted to obtain the sequence of target nodes;
[0105] Filter irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain a target feature of each target node;
[0106] Identify whether the target node has fraudulent behavior based on the target feature.
[0107] For a detailed description of the above steps, please refer to the above Figure 1 Description of a flowchart of an embodiment of a method for identifying fraudulent behavior of Ethereum users.
[0108] In addition, the embodiment of the present application also proposes a computer-readable storage medium, which may be non-volatile or volatile. The computer-readable storage medium includes a data storage area and a program storage area, and the program storage area stores a fraudulent behavior identification program of an Ethereum user. When the fraudulent behavior identification program of an Ethereum user is executed by a processor, the following operations are implemented:
[0109] Extracting first-order subgraphs of multiple target nodes from the original graph respectively, wherein the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes;
[0110] Based on local attention and pooling operations, the first-order subgraph features of each target node are generated;
[0111] According to the sum of the degrees of all nodes in each first-order subgraph, the first-order subgraphs are sorted to obtain the sequence of target nodes;
[0112] Filter irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain a target feature of each target node;
[0113] Identify whether the target node has fraudulent behavior based on the target feature.
[0114] The specific implementation of the computer-readable storage medium of the present application is roughly the same as the specific implementation of the above-mentioned method for identifying fraudulent behavior of Ethereum users, and will not be repeated here.
[0115] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0116] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0117] It should be noted that the descriptions involving "first", "second", etc. in this application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.
[0118] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.
[0119] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.
Claims
1. A method for identifying fraudulent behavior of Ethereum users, characterized in that: The method comprises: Extracting first-order subgraphs of multiple target nodes from the original graph respectively, wherein the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes; Based on local attention and pooling operations, the first-order subgraph features of each target node are generated; According to the sum of the degrees of all nodes in each first-order subgraph, the first-order subgraphs are sorted to obtain the sequence of target nodes; Filter irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain a target feature of each target node; Identify whether the target node has fraudulent behavior based on the target feature.
2. The method for identifying fraudulent behavior of Ethereum users as claimed in claim 1, characterized in that: The first-order subgraph features of each target node are generated based on the local attention operation and the pooling operation, including: Based on the local attention operation, the feature information of each node in each first-order subgraph is calculated; According to the feature information of each node in each first-order subgraph, the first-order subgraph feature of each target node is generated.
3. The method for identifying fraudulent behavior of Ethereum users as claimed in claim 2, characterized in that: Based on the local attention operation, the feature information of each node in each first-order subgraph is calculated, including: Calculate the attention weight coefficients of each node and its neighboring nodes in each first-order subgraph respectively; The features of the neighboring nodes of each node are weighted according to the attention weight coefficient to obtain the weighted features of the neighboring nodes corresponding to each node; The features of each node itself and the weighted features of its corresponding neighboring nodes are weightedly calculated to obtain the feature information of each node in each first-order subgraph.
4. The method for identifying fraudulent behavior of Ethereum users as claimed in claim 2, characterized in that: The step of generating the first-order subgraph feature of each target node according to the feature information of each node in each first-order subgraph includes: The feature information of each node in each first-order subgraph is aggregated through pooling operation to generate the first-order subgraph features of each target node.
5. The method for identifying fraudulent behavior of Ethereum users as claimed in claim 1, characterized in that: The filtering of irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain the target features of each target node includes: Mapping each first-order subgraph feature into a state vector according to the order of the sequence; The state vector is mapped through a parameter matrix to obtain the target feature of each target node.
6. The method for identifying fraudulent behavior of Ethereum users as claimed in claim 5, characterized in that: Each first-order subgraph feature is mapped to a state vector using a formula, the formula comprising: h t =(1-g t )h t-1 +g t x t Among them, h t represents the state vector, x t represents the first-order subgraph feature of the current input, g t Indicates the control of x t and the previous state vector h t-1 The gating weights are balanced between 7. The method for identifying fraudulent behavior of Ethereum users according to any one of claims 1 to 6, characterized in that: The step of identifying whether the target node has fraudulent behavior according to the target feature includes: The target feature is input into a multi-layer perceptron model to obtain a recognition result of the target node, wherein the recognition result represents whether the target node has fraudulent behavior or does not have fraudulent behavior.
8. A fraudulent behavior identification device for Ethereum users, characterized in that: The device comprises: Extraction module: used to extract first-order subgraphs of multiple target nodes from the original graph, wherein the original graph represents an undirected graph constructed with users who have transaction behaviors in Ethereum as nodes; Generation module: used to generate the first-order subgraph features of each target node based on local attention operation and pooling operation; Sorting module: used to sort the first-order subgraphs according to the sum of the degrees of all nodes in each first-order subgraph to obtain the sequence of target nodes; Filtering module: used to filter irrelevant information of the first-order subgraph features based on the sequence of the target nodes to obtain the target features of each target node; Identification module: used to identify whether the target node has fraudulent behavior based on the target characteristics.
9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method for identifying fraudulent behavior of an Ethereum user according to any one of claims 1 to 7 when executing a program stored in a memory.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying fraudulent behavior of Ethereum users as described in any one of claims 1 to 7 is implemented.