Risk operation identification method, device and equipment

Abstract

The invention discloses a risk operation identification method, device and equipment, and the method comprises the steps: obtaining a target prototype graph convolutional network model through training a pre-trained prototype graph convolutional network model, inputting to-be-detected operation data to the target prototype graph convolutional network model when the to-be-detected operation data is obtained, and outputting a corresponding category; training is carried out through the following modes: firstly, constructing a plurality of sampling sub-graphs based on operation data; secondly, for each sampling sub-graph, node embedding is determined through a graph convolutional network, and a category corresponding to each node embedding is determined; and finally, determining prototype embedding of each category, determining the category of the nodes based on the prototype embedding, and optimizing the pre-trained prototype graph convolutional network model based on the loss function to obtain a target prototype graph convolutional network model. According to the method and the device, the pre-trained prototype graph convolutional network model is trained to identify the risk operation which does not occur, so that the accuracy of identifying the risk operation is improved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a method, device and equipment for identifying risky operations. Background Art

[0002] Blockchain technology has outstanding advantages in decentralization, unforgeability, anonymity, and openness, and is widely used in various fields, and the most important application is digital cryptocurrency. With the support of blockchain technology, Ethereum, as an emerging digital cryptocurrency trading platform, has achieved great development.

[0003] Ethereum supports users to perform operations such as querying blockchain status and sending transactions, which greatly enriches the levels and scenarios of cryptocurrency trading. However, at the same time, Ethereum has gradually become the main target of criminals, seriously affecting the blockchain financial ecology on Ethereum. In the existing technology, risk operations are usually identified based on feature engineering methods or random walk graph representation learning methods. However, this method cannot accurately identify risk operations that have not occurred, which leads to the problem of low accuracy in identifying risk operations. Summary of the invention

[0004] The present invention provides a risk operation identification method, device and equipment to solve the problem in the prior art that risk operations that have not occurred cannot be accurately identified, thereby resulting in low accuracy in identifying risk operations.

[0005] The method of the present invention comprises:

[0006] In a first aspect, the present application provides a method for identifying risky operations, comprising:

[0007] Obtaining the operation data to be detected;

[0008] Input the operation data to be detected into the target prototype graph convolutional network model, and output the category corresponding to the operation data to be detected;

[0009] The target prototype graph convolutional network model is trained in the following way:

[0010] Based on the obtained operation data of the Ethereum blockchain, multiple sampling subgraphs are constructed;

[0011] For each sampled subgraph, determining a node embedding corresponding to each sampled subgraph by using a graph convolutional network, wherein the node embedding is used to characterize a feature of the sampled subgraph;

[0012] Determine the category corresponding to each node embedding;

[0013] Based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function to realize the training of the pre-trained prototype graph convolutional network model and obtain the target prototype graph convolutional network model.

[0014] In a possible implementation, constructing a plurality of sampling subgraphs based on the acquired operation data of the Ethereum blockchain includes:

[0015] Based on the operation data, construct an Ethereum graph through a graph database or a graph data structure;

[0016] Based on the Ethereum graph, multiple sampling subgraphs are constructed by a breadth-first search method.

[0017] In a possible implementation, for each sampled subgraph, determining the node embedding corresponding to each sampled subgraph by using a graph convolutional network includes:

[0018] For each node of the sampled subgraph, determining an adjacency matrix corresponding to each node;

[0019] Aggregating node features of each node based on the adjacency matrix to obtain node features corresponding to each node;

[0020] Standardizing the node features based on a degree matrix;

[0021] The standardized node features are transformed based on the weight matrix and the activation function to obtain the node embedding corresponding to each sampled subgraph.

[0022] In a possible implementation, determining the prototype embedding of each category based on the node embedding in each category includes:

[0023] For multiple node embeddings corresponding to the same category, the average of the multiple node embeddings is calculated, and the average is used as the prototype embedding.

[0024] In a possible implementation, determining the category of the node based on prototype embedding includes:

[0025] For each node, calculate the distance value between the node and each prototype embedding;

[0026] The category of the prototype embedding corresponding to the minimum distance value is taken as the category of the node.

[0027] In a second aspect, an embodiment of the present application further provides a risk operation identification device, including:

[0028] A category determination unit, configured to obtain the operation data to be detected; input the operation data to be detected into a target prototype graph convolutional network model, and output a category corresponding to the operation data to be detected;

[0029] A model training unit is used to construct multiple sampling subgraphs based on the obtained operation data of the Ethereum blockchain; for each sampling subgraph, determine the node embedding corresponding to each sampling subgraph through a graph convolutional network, wherein the node embedding is used to characterize the characteristics of the sampling subgraph; determine the category corresponding to each node embedding; based on the node embedding in each category, determine the prototype embedding of each category, and based on the prototype embedding, determine the category of the node, and optimize the pre-trained prototype graph convolutional network model based on the triple loss function and the prototype loss function to realize the training of the pre-trained prototype graph convolutional network model to obtain the target prototype graph convolutional network model.

[0030] In a possible implementation manner, the model training unit is specifically used to:

[0031] Based on the operation data, construct an Ethereum graph through a graph database or a graph data structure;

[0032] Based on the Ethereum graph, multiple sampling subgraphs are constructed by a breadth-first search method.

[0033] In a possible implementation manner, the model training unit is specifically used to:

[0034] For each node of the sampled subgraph, determining an adjacency matrix corresponding to each node;

[0035] Aggregating node features of each node based on the adjacency matrix to obtain node features corresponding to each node;

[0036] Standardizing the node features based on a degree matrix;

[0037] The standardized node features are transformed based on the weight matrix and the activation function to obtain the node embedding corresponding to each sampled subgraph.

[0038] In a possible implementation manner, the model training unit is specifically used to:

[0039] For multiple node embeddings corresponding to the same category, the average value of the multiple node embeddings is calculated, and the average value is used as the prototype embedding.

[0040] In a possible implementation manner, the model training unit is specifically used to:

[0041] For each node, calculate the distance value between the node and each prototype embedding;

[0042] The category of the prototype embedding corresponding to the minimum distance value is taken as the category of the node.

[0043] In the third aspect, an embodiment of the present application also provides a risk operation identification device, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the risk operation identification method provided in the first aspect of the embodiment of the present application.

[0044] In a fourth aspect, an embodiment of the present application further provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the risk operation identification method provided in the first aspect of the embodiment of the present application.

[0045] The beneficial effects of the present invention are as follows:

[0046] The present application provides a method, device and equipment for identifying risky operations. The present application obtains a target prototype graph convolutional network model by training a pre-trained prototype graph convolutional network model. When the operation data to be detected is obtained, the operation data to be detected is input into the target prototype graph convolutional network model, and the category corresponding to the operation data to be detected is output; the pre-trained prototype graph convolutional network model is trained in the following manner: first, based on the obtained operation data, multiple sampling subgraphs are constructed; second, for each sampling subgraph, the node embedding corresponding to each sampling subgraph is determined by the graph convolutional network, and the category corresponding to each node embedding is determined; finally, based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function to obtain the target prototype graph convolutional network model. The present application trains the pre-trained prototype graph convolutional network model to realize the identification of risky operations that have never occurred, thereby improving the accuracy of risky operation identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 A flowchart of a risk operation identification method provided in an embodiment of the present application;

[0049] Figure 2A schematic diagram of a process flow of a method for training a target prototype graph convolutional network model provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of a flow chart of another method for training a target prototype graph convolutional network model provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of a flow chart of another method for training a target prototype graph convolutional network model provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of a risk operation identification device provided in an embodiment of the present application;

[0053] Figure 6 A schematic diagram of a risk operation identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] Blockchain technology has outstanding advantages in decentralization, unforgeability, anonymity, and openness, and is widely used in various fields, and the most important application is digital cryptocurrency. With the support of blockchain technology, Ethereum, as an emerging digital cryptocurrency trading platform, has achieved great development.

[0056] Ethereum supports users to perform operations such as querying blockchain status and sending transactions, which greatly enriches the levels and scenarios of cryptocurrency trading. However, at the same time, Ethereum has gradually become the main target of criminals, seriously affecting the blockchain financial ecology on Ethereum. In the existing technology, risk operations are usually identified based on feature engineering methods or random walk graph representation learning methods. However, this method cannot accurately identify risk operations that have not occurred, which leads to the problem of low accuracy in identifying risk operations.

[0057] Based on this, an embodiment of the present application provides a risk operation identification method, which obtains a target prototype graph convolutional network model by training a pre-trained prototype graph convolutional network model. When the operation data to be detected is obtained, the operation data to be detected is input into the target prototype graph convolutional network model, and the category corresponding to the operation data to be detected is output; the pre-trained prototype graph convolutional network model is trained specifically in the following manner: first, based on the obtained operation data, multiple sampling subgraphs are constructed; secondly, for each sampling subgraph, the node embedding corresponding to each sampling subgraph is determined by the graph convolutional network, and the category corresponding to each node embedding is determined; finally, based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function to obtain the target prototype graph convolutional network model. The present application trains the pre-trained prototype graph convolutional network model to realize the identification of risk operations that have never occurred, thereby improving the accuracy of risk operation identification.

[0058] For ease of understanding, the technical terms involved in the embodiments of the present application are explained as follows:

[0059] (1) Graph Convolutional Network (GCN): It is a machine learning algorithm for processing graph structured data. GCN is an end-to-end learning framework. After each layer of convolution, a node aggregates its own information and that of its neighbors, thereby continuously updating the obtained node information and obtaining the best node information.

[0060] (2) Prototype Graph Convolutional Network (PGCN): Prototype Graph Convolutional Network is an improvement and extension of GCN. The core idea of ​​PGCN is to introduce prototype nodes as intermediate representations to better capture the local structural information in graph data.

[0061] (3) Prototype graph convolutional network model: a model based on the prototype graph convolutional network.

[0062] The risk operation identification method provided by this application is described in detail below with reference to the accompanying drawings.

[0063] Figure 1 A flow chart of a risk operation identification method provided in an embodiment of the present application is as follows: Figure 1 As shown, a risk operation identification method provided in an embodiment of the present application specifically includes the following process

[0064] S101, obtaining the operation data to be detected;

[0065] In the embodiment of the present application, the operation data to be detected is obtained from the Ethereum blockchain through the Ethereum RPC interface.

[0066] S102, inputting the operation data to be detected into the target prototype graph convolutional network model, and outputting the category corresponding to the operation data to be detected;

[0067] In the embodiment of the present application, the target prototype graph convolutional network model is obtained by training the pre-trained prototype graph convolutional network model. When the operation data to be detected is obtained, the operation data to be detected is input into the target prototype graph convolutional network model, and the category corresponding to the operation data to be detected is output. The pre-trained prototype graph convolutional network model is trained to identify risky operations that have never occurred, thereby improving the accuracy of risky operation identification.

[0068] Specifically, the target prototype graph convolutional network model is trained in the following way: Figure 2 As shown, a flow chart of a method for training a target prototype graph convolutional network model provided in an embodiment of the present application includes the following steps:

[0069] S201, constructing multiple sampling subgraphs based on the obtained operation data of the Ethereum blockchain;

[0070] In a specific embodiment, Figure 3 As shown, it is a flowchart of another method for training a target prototype graph convolutional network model provided in an embodiment of the present application.

[0071] S301. Based on the operation data, construct an Ethereum graph through a graph database or a graph data structure;

[0072] In some embodiments, operation data is obtained from the Ethereum blockchain through an Ethereum RPC interface, the obtained operation data is cleaned and sorted, and an Ethereum graph is constructed by using a graph database or a graph data structure.

[0073] Among them, an upper limit threshold is set for the amount of operation data obtained from the Ethereum blockchain to improve the processing efficiency of the operation data.

[0074] Specifically, the operation data includes data information such as the initiator of the operation, the recipient, the operation amount, and the timestamp.

[0075] S302. Based on the Ethereum graph, construct multiple sampling subgraphs through a breadth-first search method.

[0076] In some embodiments, due to the large scale of the Ethereum transaction graph, multiple sampling subgraphs are constructed by a breadth-first search method. That is, a node is selected as the starting node in the Ethereum transaction graph, all nodes of the Ethereum transaction graph are traversed, and the visited nodes are recorded to avoid repeated visits. During the traversal process, a sampling subgraph is constructed based on the visited nodes. The size of the sampling subgraph is preset, and when the constructed sampling subgraph reaches the preset size, the construction of the sampling subgraph is stopped.

[0077] It should be noted that the larger the amount of operation data obtained, the more sampling subgraphs are generated. The smaller the preset size of the pre-set sampling subgraph, the more sampling subgraphs are generated. In addition, the distribution of operation data and the topological structure of the Ethereum graph will also affect the number of sampling subgraphs. For example, areas with dense operation data may generate more sampling subgraphs, while areas with sparse operation data may generate fewer sampling subgraphs.

[0078] S202, for each sampled subgraph, determining a node embedding corresponding to each sampled subgraph through a graph convolutional network, wherein the node embedding is used to characterize features of the sampled subgraph;

[0079] In a specific embodiment, the graph convolutional network determines the node embedding corresponding to each sampled subgraph through node feature aggregation, degree matrix normalization and feature transformation.

[0080] For example, taking any sampled subgraph as a given graph G = (Node, Edge), where Node is a node set and Edge is an edge set, the graph convolutional network uses the following formula to calculate the node embedding corresponding to each sampled subgraph.

[0081]

[0082] Where Matrix s is the node feature matrix of the sth layer, is the adjacency matrix, is the degree matrix, W s is the weight matrix of the sth layer, is the activation function. Graph convolutional networks capture complex patterns in sampled subgraphs by aggregating information about each node and its neighboring nodes and transforming node features through multiple graph convolutional network layers.

[0083] Among them, the complex patterns in the sampling subgraphs refer to the high-order features hidden in the Ethereum graph, which reflect more complex operational behaviors and network structures.

[0084] In some embodiments, the features of each node and its neighboring nodes are aggregated by a node feature aggregation method. Figure 4As shown, it is a flowchart of another method for training a target prototype graph convolutional network model provided in an embodiment of the present application.

[0085] S401: for each node of the sampled subgraph, determine the adjacency matrix corresponding to each node

[0086] S402, based on the adjacency matrix Aggregate node features for each node to obtain node features corresponding to each node;

[0087] Based on the adjacency matrix In the process of aggregating node features for each node, you can also use the adjacency matrix Increase the connection of the node itself to ensure that the node feature aggregation contains its own information, rather than just relying on neighboring nodes.

[0088] S403, based on degree matrix Standardize node features;

[0089] Usage Matrix Standardizing the aggregated node features can control the influence of the connection strength between each node

[0090] S404, based on the weight matrix W s And the activation function Matrix s The standardized node features are transformed to obtain the node embedding corresponding to each sampled subgraph.

[0091] Feature transformation is used to gradually extract high-level features at different levels when the graph convolutional network calculates the node embedding corresponding to each sampled subgraph. Among them, the multi-level node feature aggregation and feature transformation process can more effectively capture the complex patterns in the sampled subgraph.

[0092] S203, determining the category corresponding to each node embedding;

[0093] In a specific embodiment, the operation data from the Ethereum blockchain is labeled as different categories, for example, it can be labeled as risky operations or benign operations. In this application, based on the operation data labeled as risky operations or benign operations, the pre-trained prototype graph convolutional network model is trained to obtain a target prototype graph convolutional network model. When the operation data to be detected is obtained, the operation data to be detected is input into the target prototype graph convolutional network model, and the category corresponding to the operation data to be detected is output.

[0094] S204. Based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function to implement the training of the pre-trained prototype graph convolutional network model and obtain the target prototype graph convolutional network model.

[0095] In a specific embodiment, based on the node embeddings in each category, the prototype embedding of each category is determined, including: for multiple node embeddings corresponding to the same category, calculating the average value of the multiple node embeddings, and using the average value as the prototype embedding.

[0096] In some embodiments, a representative embedding of each category is determined by calculating a prototype embedding, which represents the center of the category. The formula is as follows:

[0097]

[0098] Among them, H c is the prototype embedding calculated for category c, m c is the number of samples in category c, is the node embedding of the ith sample in category c.

[0099] For example, for the operation data of category c as risk operation, if the number of samples embedded in the node marked as risk operation is m c The number of nodes is 50, and the average embedding value H of these 50 nodes is calculated. c , the calculated average value H c Embed as a prototype.

[0100] For example, for the operation data of category c being benign operation, if the number of samples embedded in the node marked as benign operation is m c The number of nodes is 200, and the average embedding value H of these 200 nodes is calculated. c , the calculated average value H c Embed as a prototype.

[0101] In a specific embodiment, determining the category of a node based on prototype embedding includes: for each node, calculating the distance value between the node and each prototype embedding; and taking the category of the prototype embedding corresponding to the minimum distance value as the category of the node.

[0102] Specifically,

[0103] Among them, y n is the category of the node calculated by node n, is the node embedding of the nth sample, H c is the prototype embedding calculated for the same category.

[0104] That is, for all nodes, the category of the node is determined based on the distance between the node embedding of the node and the prototype embedding of each category. Specifically, the distance between the node embedding of each node and the prototype embedding of all categories is measured, and it is assigned to the category with the smallest distance.

[0105] In some embodiments, the purpose of constructing a prototype embedding is to obtain a representative embedding representing each category during the model training process. After the training is completed, the category of the unlabeled node is determined by calculating the distance from the prototype embedding, so that the classification of the unlabeled node can be achieved. It should be noted that constructing a prototype embedding for the same category and classifying the nodes to determine the category of the node together constitute the training process of the model.

[0106] In addition, in the specific implementation, during the model training process, the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function through the course weighted algorithm.

[0107] In some embodiments, a triple loss function is used during model training to optimize the representation of node embeddings so that nodes of the same type are closer in the embedding space and nodes of different types are farther away. The triple loss is used to ensure that the embedding distance between the anchor node and the positive sample node is as small as possible, and the embedding distance between the anchor node and the negative sample node is as large as possible, thereby effectively distinguishing different categories.

[0108] Specifically,

[0109] Among them, Loss t Used to represent the triple loss function, Node x It is an anchor node. p Is a Node x Positive nodes with similar characteristics, one with Node x Dissimilar negative nodes, is the node embedding of the anchor node, is the node embedding of the positive node, is the node embedding of the negative node.

[0110] In optimizing the pre-trained prototype graph convolutional network model, the triple loss function is used to randomly select a node as an anchor node, and then select nodes with similar features as positive nodes and nodes that are dissimilar to it as negative nodes. The purpose of using triple loss is to ensure that the anchor node Node x With positive nodeNode p The node embedding distance of Node is as small as possible, and the distance between Node q The node embedding distance is as large as possible to effectively distinguish different categories.

[0111] In some embodiments, prototype loss is used during model training to make the node embedding of each category as close as possible to the prototype embedding of its category, thereby enhancing the discrimination of the category.

[0112] Specifically,

[0113]

[0114] Among them, Loss p It is used to represent the prototype loss function, m is the total number of node embeddings, H y is the prototype embedding calculated for category y, is the node embedding in category y, Nc is the number of node embeddings in each category, is the node embedding in category c, H c is the prototype embedding calculated for category c.

[0115] In optimizing the pre-trained prototype graph convolutional network model, the prototype loss Loss p and triple loss t The optimization can improve the classification ability of the target prototype graph convolutional model.

[0116] In some embodiments, the prototype loss Loss is taken into account by calculating the total loss Loss p and triple loss t The impact of this method can further improve the overall classification performance of the target prototype graph convolutional network model.

[0117] Specifically, the total loss Loss is the prototype loss Loss p and triple loss t The coefficient θ is introduced to adjust the weight between the two losses, where a higher θ emphasizes the prototype loss Loss p , lower θ emphasizes triple loss Loss t :

[0118] Loss = θLoss t +(1-θ)Loss p

[0119] In order to lose the prototype p and triple loss t To smoothly transition the emphasis between the two, a course-weighted algorithm is used to adjust the weights at different training epochs:

[0120] Weight(t)=1 / (1+exp(-α(t-δ)))

[0121] Weight(t) is the weight of the course weighting algorithm, α is the scaling factor, and δ is the offset parameter. The course weighting scheme dynamically adjusts the prototype loss Loss according to different stages of training p and triple loss t to balance their contributions to the optimization of the target prototype graph convolutional network model.

[0122] Weighted triplet loss and prototype loss They are defined as follows:

[0123]

[0124] In the above, based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function to obtain the target prototype graph convolutional network model. When the operation data to be detected is obtained, the operation data to be detected is input into the target prototype graph convolutional network model, and the category corresponding to the operation data to be detected is output.

[0125] Specifically, through the Ethereum RPC interface, the operation data to be detected is obtained from the Ethereum blockchain, and the operation data to be detected is input into the target prototype graph convolutional network model. The target prototype graph convolutional network model constructs multiple sampling subgraphs based on the obtained detection operation data; for each sampling subgraph, the node embedding corresponding to each sampling subgraph is determined by the graph convolutional network; the node embedding is compared with all the prototype embeddings in the target prototype graph convolutional network model, and the prototype embedding closest to the node embedding is found, and the category corresponding to the prototype embedding is used as the category of the operation data to be detected. For example, if the category corresponding to the prototype embedding closest to the node embedding is a risk operation, then the category of the operation data to be detected is determined to be a risk operation, and the target prototype graph convolutional network model outputs a category of a risk operation. If the category corresponding to the prototype embedding closest to the node embedding is a benign operation, then the category of the operation data to be detected is determined to be a benign operation, and the target prototype graph convolutional network model outputs a category of a benign operation. In this way, risk operations that have never occurred can be identified, thereby improving the accuracy of risk operation identification.

[0126] The present application provides a method for identifying risky operations. The present application obtains a target prototype graph convolutional network model by training a pre-trained prototype graph convolutional network model. When the operation data to be detected is obtained, the operation data to be detected is input into the target prototype graph convolutional network model, and the category corresponding to the operation data to be detected is output; the pre-trained prototype graph convolutional network model is trained specifically in the following manner: first, based on the obtained operation data, multiple sampling subgraphs are constructed; second, for each sampling subgraph, the node embedding corresponding to each sampling subgraph is determined by the graph convolutional network, and the category corresponding to each node embedding is determined; finally, based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function to obtain the target prototype graph convolutional network model. The present application trains the pre-trained prototype graph convolutional network model to realize the identification of risky operations that have never occurred, thereby improving the accuracy of risky operation identification.

[0127] Based on the same inventive concept, the embodiment of the present application also provides a risk operation identification device, the principle of the risk operation device is similar to the above-mentioned risk operation method, and the repeated parts are not repeated. Figure 5 FIG. 1 is a schematic diagram of a risk operation identification device provided in an embodiment of the present application, comprising:

[0128] The category determination unit 501 is used to obtain the operation data to be detected; input the operation data to be detected into the target prototype graph convolutional network model, and output the category corresponding to the operation data to be detected;

[0129] The model training unit 502 is used to construct multiple sampling subgraphs based on the obtained operation data of the Ethereum blockchain; for each sampling subgraph, determine the node embedding corresponding to each sampling subgraph through a graph convolutional network, wherein the node embedding is used to characterize the characteristics of the sampling subgraph; determine the category corresponding to each node embedding; based on the node embedding in each category, determine the prototype embedding of each category, and based on the prototype embedding, determine the category of the node, and optimize the pre-trained prototype graph convolutional network model based on the triple loss function and the prototype loss function to realize the training of the pre-trained prototype graph convolutional network model to obtain the target prototype graph convolutional network model.

[0130] In a possible implementation manner, the model training unit 502 is specifically used to:

[0131] Based on the operation data, construct an Ethereum graph through a graph database or a graph data structure;

[0132] Based on the Ethereum graph, multiple sampling subgraphs are constructed by a breadth-first search method.

[0133] In a possible implementation manner, the model training unit 502 is specifically used to:

[0134] For each node of the sampled subgraph, determining an adjacency matrix corresponding to each node;

[0135] Aggregating node features of each node based on the adjacency matrix to obtain node features corresponding to each node;

[0136] Standardizing the node features based on a degree matrix;

[0137] The standardized node features are transformed based on the weight matrix and the activation function to obtain the node embedding corresponding to each sampled subgraph.

[0138] In a possible implementation manner, the model training unit 502 is specifically used to:

[0139] For multiple node embeddings corresponding to the same category, the average of the multiple node embeddings is calculated, and the average is used as the prototype embedding.

[0140] In a possible implementation manner, the model training unit 502 is specifically used to:

[0141] For each node, calculate the distance value between the node and each prototype embedding;

[0142] The category of the prototype embedding corresponding to the minimum distance value is taken as the category of the node.

[0143] The present application provides a risk operation identification device. The present application obtains a target prototype graph convolution network model by training a pre-trained prototype graph convolution network model. When the operation data to be detected is obtained, the operation data to be detected is input into the target prototype graph convolution network model, and the category corresponding to the operation data to be detected is output; the pre-trained prototype graph convolution network model is trained specifically in the following manner: first, based on the obtained operation data, multiple sampling subgraphs are constructed; second, for each sampling subgraph, the node embedding corresponding to each sampling subgraph is determined by the graph convolution network, and the category corresponding to each node embedding is determined; finally, based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolution network model is optimized based on the triple loss function and the prototype loss function to obtain the target prototype graph convolution network model. The present application trains the pre-trained prototype graph convolution network model to realize the identification of risk operations that have never occurred, thereby improving the accuracy of risk operation identification.

[0144] Based on the same inventive concept, an embodiment of the present application also provides a risk operation identification device. The principle of the risk operation device is similar to that of the above-mentioned risk operation method, and the repeated parts will not be repeated.

[0145] like Figure 6 As shown, it is a schematic diagram of a risk operation identification device provided in an embodiment of the present application, and the device includes at least one processor 601; and a memory 602 communicatively connected to the at least one processor; in the embodiment of the present application, the memory 602 stores instructions that can be executed by the at least one processor 601, and the instructions are executed by the at least one processor 601 so that the at least one processor 601 can execute the risk operation method in the above-mentioned embodiment.

[0146] The processor 601 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 601 is used to implement the risk operation test method in the above embodiment when calling the computer program stored in the memory 602 .

[0147] In one possible design, the memory 602 may be a volatile memory, such as a random-access memory (RAM); the memory 602 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 602 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 602 may be a combination of the above memories.

[0148] The specific connection medium between the memory 602 and the processor 601 is not limited in the embodiment of the present application. Figure 6 In the embodiment, the memory 602 and the processor 601 are connected via a bus 603. The bus 603 is connected to the processor 601 via a bus 603. Figure 6 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. Bus 603 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0149] Based on the same inventive concept, an embodiment of the present application also provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a risk operation identification method discussed above.

[0150] In some possible implementations, various aspects of a risk operation identification method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a risk operation identification method according to various exemplary implementations of the present application described above in this specification.

[0151] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0152] The present application provides a method, device and equipment for identifying risky operations. The present application obtains a target prototype graph convolutional network model by training a pre-trained prototype graph convolutional network model. When the operation data to be detected is obtained, the operation data to be detected is input into the target prototype graph convolutional network model, and the category corresponding to the operation data to be detected is output; the pre-trained prototype graph convolutional network model is trained in the following manner: first, based on the obtained operation data, multiple sampling subgraphs are constructed; second, for each sampling subgraph, the node embedding corresponding to each sampling subgraph is determined by the graph convolutional network, and the category corresponding to each node embedding is determined; finally, based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function to obtain the target prototype graph convolutional network model. The present application trains the pre-trained prototype graph convolutional network model to realize the identification of risky operations that have never occurred, thereby improving the accuracy of risky operation identification.

[0153] The present application is described above with reference to the block diagrams and / or flow charts showing the methods, devices (systems) and / or computer program products according to the embodiments of the present application. It should be understood that a block of the block diagram and / or flow chart diagram and a combination of blocks of the block diagram and / or flow chart diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer and / or other programmable data processing device to produce a machine, so that the instructions executed by the computer processor and / or other programmable data processing device create a method for implementing the functions / actions specified in the block diagram and / or flow chart block.

[0154] Accordingly, the present application may also be implemented with hardware and / or software (including firmware, resident software, microcode, etc.). Furthermore, the present application may take the form of a computer program product on a computer-usable or computer-readable storage medium, which has a computer-usable or computer-readable program code implemented in the medium, for use by an instruction execution system or in conjunction with an instruction execution system. In the context of the present application, a computer-usable or computer-readable medium may be any medium that may contain, store, communicate, transmit, or convey a program for use by an instruction execution system, device, or apparatus, or in conjunction with an instruction execution system, device, or apparatus.

[0155] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for identifying risky operations, characterized in that: The method comprises: Obtaining the operation data to be detected; Input the operation data to be detected into the target prototype graph convolutional network model, and output the category corresponding to the operation data to be detected; The target prototype graph convolutional network model is trained in the following way: Based on the obtained operation data of the Ethereum blockchain, multiple sampling subgraphs are constructed; For each sampled subgraph, determining a node embedding corresponding to each sampled subgraph by using a graph convolutional network, wherein the node embedding is used to characterize a feature of the sampled subgraph; Determine the category corresponding to each node embedding; Based on the node embedding in each category, the prototype embedding of each category is determined, and based on the prototype embedding, the category of the node is determined, and the pre-trained prototype graph convolutional network model is optimized based on the triple loss function and the prototype loss function to realize the training of the pre-trained prototype graph convolutional network model and obtain the target prototype graph convolutional network model.

2. The method according to claim 1, characterized in that The method constructs multiple sampling subgraphs based on the obtained operation data of the Ethereum blockchain, including: Based on the operation data, construct an Ethereum graph through a graph database or a graph data structure; Based on the Ethereum graph, multiple sampling subgraphs are constructed by a breadth-first search method.

3. The method according to claim 1, characterized in that The step of determining, for each sampled subgraph, a node embedding corresponding to each sampled subgraph by using a graph convolutional network comprises: For each node of the sampled subgraph, determining an adjacency matrix corresponding to each node; Aggregating node features of each node based on the adjacency matrix to obtain node features corresponding to each node; Standardizing the node features based on a degree matrix; The standardized node features are transformed based on the weight matrix and the activation function to obtain the node embedding corresponding to each sampled subgraph.

4. The method according to claim 1, characterized in that The method of determining a prototype embedding of each category based on the node embedding in each category includes: For multiple node embeddings corresponding to the same category, the average value of the multiple node embeddings is calculated, and the average value is used as the prototype embedding.

5. The method according to claim 1, characterized in that Determining the category of the node based on prototype embedding includes: For each node, calculate the distance value between the node and each prototype embedding; The category of the prototype embedding corresponding to the minimum distance value is taken as the category of the node.

6. A risk operation identification device, characterized in that: The device comprises: A category determination unit, configured to obtain the operation data to be detected; input the operation data to be detected into a target prototype graph convolutional network model, and output a category corresponding to the operation data to be detected; A model training unit is used to construct multiple sampling subgraphs based on the obtained operation data of the Ethereum blockchain; for each sampling subgraph, determine the node embedding corresponding to each sampling subgraph through a graph convolutional network, wherein the node embedding is used to characterize the characteristics of the sampling subgraph; determine the category corresponding to each node embedding; based on the node embedding in each category, determine the prototype embedding of each category, and based on the prototype embedding, determine the category of the node, and optimize the pre-trained prototype graph convolutional network model based on the triple loss function and the prototype loss function to realize the training of the pre-trained prototype graph convolutional network model to obtain the target prototype graph convolutional network model.

7. The device according to claim 6, characterized in that The model training unit is specifically used for: Based on the operation data, construct an Ethereum graph through a graph database or a graph data structure; Based on the Ethereum graph, multiple sampling subgraphs are constructed by a breadth-first search method.

8. The device according to claim 6, characterized in that The model training unit is specifically used for: For each node of the sampled subgraph, determining an adjacency matrix corresponding to each node; Aggregating node features of each node based on the adjacency matrix to obtain node features corresponding to each node; Standardizing the node features based on a degree matrix; The standardized node features are transformed based on the weight matrix and the activation function to obtain the node embedding corresponding to each sampled subgraph.

9. A risk operation identification device, characterized in that: The invention comprises at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 5.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program for causing a computer to execute the method according to any one of claims 1 to 5.

Images