Virtual currency-oriented fraud detection method and system based on Transform

Abstract

The invention provides a virtual currency-oriented fraud detection method and system based on Transform, and solves the technical problems that the dynamic state and behavior change of an account cannot be captured and the detection effect is limited in the existing fraud detection technology. The method comprises the following steps: carrying out transaction data preprocessing on archived original transaction data to obtain a newly generated CSV file; transaction features are obtained after transaction feature extraction, then feature coding is carried out to obtain a feature matrix, then random downsampling is carried out to obtain a feature matrix data set after equalization processing, and finally supervised learning training is carried out to generate a prediction result of a corresponding account; the transaction data preprocessing comprises the steps of acquiring transaction data of virtual currency, classifying the transaction data and de-duplicating the transaction data. The method can be widely applied to the technical field of virtual currency fraud detection.

Description

Technical Field

[0001] The present application belongs to the technical field of virtual currency fraud detection, and more specifically, to a fraud detection method and system for virtual currency. Background Art

[0002] With the rapid development of blockchain technology and the popularity of virtual currencies, criminals have begun to turn from traditional financial fraud methods to virtual currency fraud. Virtual currencies, due to their anonymity, decentralization and high dispersion, provide new channels and tools for criminal activities. These characteristics enable criminals to conceal their true identities and the flow of funds. Through virtual currencies, they take advantage of their fast transactions and difficulty in tracking to commit fraud. These activities not only cause financial losses to individuals and companies, but also pose a threat to the stability of the financial system.

[0003] Traditional fraud detection methods usually rely on graph neural networks for detection. These methods capture the complex relationships between transactions by constructing transaction network graphs. However, graph neural networks have some limitations. For example, they have difficulty effectively capturing the temporal order patterns inherent in transactions, which is crucial for many time-sensitive fraud behaviors. In addition, graph-based methods mainly focus on static relationships and cannot fully capture the dynamic state and behavioral changes of accounts, thus limiting their application effect in dynamic fraud detection. Therefore, it is necessary to provide a fraud detection method and system for virtual currency based on Transformer to solve the technical problem that existing fraud detection technologies cannot capture the dynamic state and behavioral changes of accounts, limiting the detection effect. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a Transformer-based fraud detection method and system for virtual currency, so as to solve the technical problem that the existing fraud detection technology cannot capture the dynamic status and behavior changes of the account, thereby limiting the detection effect.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application provides a fraud detection method for virtual currency based on Transformer, comprising the following steps:

[0006] The archived original transaction data is preprocessed to obtain a newly generated CSV file; transaction features are extracted to obtain transaction features, and then feature encoding is performed to obtain a feature matrix, followed by random downsampling to obtain a feature matrix data set after equalization, and finally supervised learning training is performed to generate the prediction results of the corresponding account;

[0007] Transaction data preprocessing includes obtaining transaction data of virtual currency, classifying transaction data, and deduplicating transaction data;

[0008] Transaction data deduplication refers to aggregating consecutive repeated transactions with the same address, the same input / output type and initiated within 72 hours, that is, filtering out unnecessary transaction sequences, retaining the original timestamp, and having corresponding time characteristics;

[0009] Feature encoding is performed by the pre-trained language model BERT with an improved InfoNCE loss function;

[0010] The specific formula of the improved InfoNCE loss function is:

[0011]

[0012] Where N is the number of samples, i and j are the account numbers, and q i is the characteristic of the target sample, k i+ is the feature corresponding to the positive sample, k i- is the feature corresponding to the negative sample, and τ is the temperature coefficient used to control the emphasis on negative samples in the model training process.

[0013] Preferably, feature encoding refers to converting data in transaction features into feature vectors, i.e., feature matrices, using a pre-trained language model BERT with an improved InfoNCE loss function.

[0014] Preferably, the transaction feature extraction includes input embedding and position encoding;

[0015] Input embedding refers to converting the data in the newly generated CSV file into a feature vector representation;

[0016] Position encoding means adding corresponding position information to the transaction sequence in the newly generated CSV file;

[0017] Transaction characteristics include account address, transaction type, input and output types, timestamp, transaction fee and location information.

[0018] Preferably, the specific implementation of random downsampling is:

[0019] Divide the feature matrix into positive and negative samples, and select the majority class negative sample matrix;

[0020] Randomly select a certain number of minority class positive sample matrices from the majority class negative sample matrix;

[0021] All feature matrices of the minority class positive sample matrix and all feature matrices of the majority class negative sample matrix are merged to form a feature matrix dataset.

[0022] Preferably, the specific implementation of supervised learning training includes:

[0023] Import the feature matrix data set and convert the data in the positive and negative samples in the feature matrix data set into types that meet the requirements of the XGBoost classifier;

[0024] Perform random downsampling to obtain the feature matrix data set and use the XGBoost model for training;

[0025] After training, the XGBoost model integrates multiple weak learners and votes based on the weights of transaction records;

[0026] Integrate the weighted average of the voting results of each weak learner to get the prediction result of the corresponding account.

[0027] Preferably, the specific implementation method of the XGBoost model for training is: inputting a feature matrix data set and making judgments based on candidate features, evaluating the values ​​of possible splitting points of the features and their values ​​of each feature matrix data set, and selecting the optimal splitting point for distinction based on the evaluation value, so as to train the XGBoost model;

[0028] Before training the XGBoost model, the weights of positive and negative samples and the focal loss function should be adjusted to deal with the imbalance problem of the XGBoost model;

[0029] Adjusting the weights of positive and negative samples means setting the weight ratio to the ratio of positive samples to negative samples;

[0030] The focal loss function is used to increase the distance between positive and negative samples, and distinguish the features of positive and negative sample accounts.

[0031] Preferably, obtaining the transaction data of virtual currency refers to actively scanning and obtaining the archived original transaction data, and extracting a structured transaction data table, that is, an original CSV file.

[0032] Preferably, the transaction data classification refers to classifying the transaction data in the original CSV file according to the transaction role and time sequence to obtain the transaction output file and the transaction input file.

[0033] Preferably, the prediction result for the corresponding account includes a probability score that the transaction is a fraudulent account.

[0034] A second aspect of the embodiment of the present application provides a fraud detection system for virtual currency based on Transformer, including: a transaction data preprocessing module, a transaction feature extraction module, a feature encoding module, a random downsampling module, a supervised learning training module, a result evaluation module, a database management module, a system monitoring module, an information display module and a fraud information publishing module;

[0035] The transaction data preprocessing module is used to actively scan and obtain the archived original transaction data to obtain the original CSV file, then determine the role of each account in the transaction in the original CSV file, and obtain the transaction output file and transaction input file according to the time sequence of the transaction data, and finally perform aggregation processing to obtain the newly generated CSV file;

[0036] Transaction feature extraction module, used to extract transaction features from the newly generated CSV file;

[0037] The feature encoding module is used to transform the transaction feature data into a vector representation with rich semantic information, namely, a feature matrix, using the pre-trained language model BERT with an improved InfoNCE loss function;

[0038] A random downsampling module is used to process the feature matrix by a random downsampling method to obtain a feature matrix data set;

[0039] Supervised learning training module, used to perform supervised learning training on the XGBoost model;

[0040] The result evaluation module is used to evaluate the prediction results of the corresponding account;

[0041] The database management module is used to query and integrate the newly discovered suspicious transaction information and insert it into the suspicious transaction database;

[0042] System monitoring module, used to monitor the number of threads used in the test, average system response time, CPU usage, database data volume, and log data volume in real time;

[0043] An information display module is used to visually display key data and test results of virtual currency transactions;

[0044] The fraud information publishing module is used to publish the virtual currency transaction account addresses identified as fraudulent to relevant websites.

[0045] The beneficial effect of the present application is that: the present invention proposes a fraud detection method and system for virtual currency to effectively address the shortcomings of traditional fraud detection methods and the complexity of blockchain virtual currency data.

[0046] First, the Transformer structure is used to replace the traditional detection method based on graph neural network (GNN), which can better capture the time sequence and dynamic changes in transactions and improve the accuracy and flexibility of anomaly detection.

[0047] Secondly, the high repetitiveness and uneven distribution problems common in blockchain token data are solved through transaction aggregation technology. Specifically, addresses with high transaction frequency are regarded as negative samples, and the challenge of data imbalance is effectively alleviated by introducing transaction classification methods. This method improves the generalization ability of the model, enabling it to more accurately identify abnormal transaction patterns.

[0048] Thirdly, the BERT model has been specially improved by introducing a temperature coefficient based on the InfoNCE loss function, so that it can adapt to the learning needs of blockchain token data during the process of data imbalance. Through these adjustments, the BERT model can better capture the characteristics and patterns of blockchain data, and enhance the model's performance in identifying abnormal behavior.

[0049] Finally, in the feature encoding stage, an improved XGBoost model is used, and the focal Loss loss function is used to widen the gap between positive and negative samples and deal with the problem of data imbalance. By optimizing the loss function of the model and adjusting the sampling strategy, the performance of the detection model on imbalanced data is significantly improved, ensuring high accuracy and robustness of fraud detection in various scenarios. These innovations enable the present invention to achieve excellent results in processing complex virtual currency transaction data and detecting fraudulent behavior.

[0050] In summary, the present invention uses the BERT model for feature extraction in the encoding stage, which can efficiently capture complex features in the data. By encoding the features of each account, a feature matrix is ​​generated, which fully describes the behavior and transaction characteristics of the account. In the feature encoding, XGBoost model supervised learning training and equalization processing stages, the extracted features are combined with machine learning algorithms to detect fraudulent activities. Compared with the traditional graph neural network method, the Transformer-based pre-trained language model BERT is better at processing sequence data and can capture the time sequence pattern in the transaction. At the same time, the machine learning algorithm performs well in processing complex nonlinear relationships and dynamic changes, and can more accurately identify abnormal behaviors. Therefore, a fraud detection method for virtual currency based on Transformer provided in this application has achieved significant results in abnormal detection, improving the accuracy and flexibility of fraud detection. Through this improvement, the limitations of traditional methods are overcome, and comprehensive detection of dynamic changes and time series is achieved, making fraud detection more efficient and accurate. This innovative method is not only suitable for the detection of virtual currency fraud, but also provides powerful tools and support for the identification of abnormal behavior in a wide range of financial fields.

[0051] Moreover, in order to effectively deal with the existing virtual currency fraud phenomenon, the present invention has built a powerful fraud detection system by integrating valuable transaction data from different blockchain networks and different transaction types, which can quickly and efficiently detect the risk information and scenario characteristics of fraudulent behavior. Through efficient data integration and Transformer intelligent feature extraction, the present invention can effectively deal with complex fraud problems in the field of virtual currency, and provide users with a high-performance and highly flexible fraud detection solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0053] Figure 1 A schematic diagram of the overall process of a fraud detection method for virtual currency provided in one embodiment of the present application;

[0054] Figure 2 A schematic diagram of aggregation processing provided in one embodiment of the present application;

[0055] Figure 3 A feature extraction flow chart provided for an embodiment of the present application;

[0056] Figure 4 A feature coding flow chart provided for an embodiment of the present application;

[0057] Figure 5 A flowchart of supervised learning training provided for an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0059] See also Figure 1 , is a schematic diagram of the overall process of a fraud detection method for virtual currency provided by an embodiment of the present application, including:

[0060] S1: Transaction data preprocessing, including obtaining virtual currency transaction data, transaction data classification and transaction data deduplication;

[0061] In one embodiment, obtaining virtual currency transaction data refers to using the Ethereum-ETL tool to actively scan and obtain from the archived original transaction data, and extracting a structured transaction data table, i.e., the original CSV file. This method can not only efficiently obtain virtual currency transaction data, but also ensure the comprehensiveness and accuracy of virtual currency transaction data, laying a solid foundation for subsequent transaction data classification.

[0062] In one embodiment, the transaction data classification refers to classifying the transaction data in the original CSV file according to transaction roles and time sequence.

[0063] Specifically, first, determine the role of each account in the transaction in the original CSV file to clarify whether it is the initiator or recipient of the transaction. Then, sort in descending order according to the timestamp of each transaction to ensure the time sequence of the transaction data, and obtain the transaction output file and transaction input file. This classification method not only helps to understand the trend of transactions, but also provides a clear logical structure for further pattern recognition and analysis.

[0064] In one embodiment, transaction data deduplication is specifically implemented by aggregating consecutive repeated transactions with the same address, the same input / output type and initiated within 72 hours.

[0065] The aggregation process designed by the present invention is different from the traditional method of integrating all transactions into one transaction edge based on graph neural network. The aggregation process designed by the present invention can retain some time features while reducing the transaction sequence when integrating transactions.

[0066] The specific implementation of the aggregation processing of the present invention is as follows: first, the Python language is used to define the paths of the transaction output files and transaction input files obtained by classifying the transaction data, and the transaction output files and transaction input files are imported into the cache; secondly, the type is judged according to the input / output type of the header in the transaction output file and the transaction input file combined with the timestamp; further, the transactions with the same address, the same input / output type and the continuous repeated transactions started within 72 hours are integrated by the Python language. Through the integration of transactions, unnecessary transaction sequences are screened out, and the initial timestamp is retained, so that the corresponding time characteristics exist; finally, the above-mentioned continuous repeated transactions with the same address, the same input / output type and started within 72 hours are aggregated to obtain a newly generated CSV file and save it. Among them, the transaction (transfer between accounts) obtained by the aggregation processing is called a transaction, and its timestamp is set to the first timestamp of the original transaction. This deduplication strategy effectively reduces data redundancy, ensures the simplicity of the data set, and retains key transaction time information, providing more accurate basic data for subsequent analysis.

[0067] S2: Transaction feature extraction, which includes account address, transaction type, input and output type, timestamp, transaction fee and location information.

[0068] Specifically, the Transormer model feature extraction module includes input embedding and position encoding. Input embedding refers to converting the newly generated CSV file into a dense vector representation for processing by the Transormer model. Position encoding refers to embedding the transaction sequence to add position information so that the Transormer model can understand the position information in the transaction sequence.

[0069] The Transormer feature extraction module is used to preprocess the transaction data to obtain a newly generated CSV file for transaction feature extraction, and the extracted transaction features are limited to transaction feature dimensions, which are limited to 64 dimensions. Such standardization and integration processing can ensure the uniformity and comparability of data formats of different features.

[0070] S3: Encode the transaction features after standardization and integration to obtain a feature matrix.

[0071] The pre-trained language model BERT (Bidirectional Encoder Representations from Transformers) is used for training, and the account address obtained in S2 is combined with the transaction process (transfers between accounts), and the LSTM mechanism is used to learn the features of the context of the transaction sequence. BERT is a powerful natural language processing tool that captures the semantic information of words in context through a bidirectional attention mechanism, allowing the pre-trained language model BERT to better understand and generate account features.

[0072] Specifically, the present invention adopts an 8-layer Transformer Encoder, sets the number of attention heads to 2, and sets the maximum sequence length to 100.

[0073] In the process of feature learning, the pre-trained language model BERT can effectively convert transaction feature data into vector representations with rich semantic information, making it able to capture data more accurately and improving its ability to capture transaction features.

[0074] In order to further optimize the performance of the pre-trained language model BERT, the loss function was improved by replacing the traditional focal Loss loss function with the InfoNCE loss function.

[0075] InfoNCE Loss (Noise Contrastive Estimation Loss) is a loss function used for self-supervised learning, usually used for learning feature representation or representation learning. Based on the idea of ​​information theory, the parameters of the pre-trained language model BERT are learned by comparing the similarities between positive and negative samples.

[0076] The present invention introduces a temperature coefficient based on the InfoNCE loss function. The temperature coefficient is a parameter used to adjust the probability distribution of the model output, which can effectively increase the distinction between positive and negative samples. By introducing the temperature coefficient, we can make the pre-trained language model BERT more sensitive to the subtle differences between fraudulent and non-fraudulent accounts during the training process, thereby improving the overall detection accuracy. The traditional temperature coefficient is used as a fixed value, while the present invention uses the temperature coefficient as a hyperparameter so that it can change with the training process.

[0077] The formula of the improved InfoNCE loss function is as follows:

[0078]

[0079] Where N is the number of samples, i and j are the account numbers, and q i is the characteristic of the target sample, k i+ is the feature corresponding to the positive sample, k i- is the feature corresponding to the negative sample, and τ is the temperature coefficient used to control the emphasis on negative samples in the model training process.

[0080] If the temperature coefficient is set too small, the BERT pre-trained language model will focus on particularly difficult negative samples, that is, samples that the BERT pre-trained language model cannot identify during training. Those negative samples identified by the BERT pre-trained language model are likely to be potential positive samples. This will make it difficult for the BERT pre-trained language model to converge or have poor generalization ability.

[0081] To avoid this phenomenon, we use the temperature coefficient as a hyperparameter instead of the traditional fixed value. The temperature coefficient used in the traditional InfoNCE loss function is a fixed value. For the pre-trained language model BERT training, when the data distribution changes, the temperature coefficient often needs to be manually adjusted by the experimenter. This is difficult to be applicable in the blockchain transaction scenario, where adding a transaction to an account will change a large number of features. Therefore, using the temperature coefficient as a hyperparameter to allow the pre-trained language model BERT to adjust itself is of great significance to this field.

[0082] In addition, special consideration is given to the potential impact of high-frequency addresses on the performance of the pre-trained language model BERT. High-frequency addresses usually appear in a large number of transactions, which may cause the pre-trained language model BERT to be biased towards these addresses, causing the pre-trained language model BERT to over-focus on high-frequency samples. To solve this problem, high-frequency addresses are treated as negative samples, and addresses of other frequencies are treated as positive samples, and the positive-negative sample ratio is set to 1:5000. In this way, the interference of high-frequency addresses on the pre-trained language model BERT is effectively reduced, avoiding its negative impact, thereby improving the robustness and reliability of the pre-trained language model BERT in practical applications.

[0083] The specific implementation method of feature coding is as follows Figure 3 As shown, the transaction features are input into the LSTM mechanism, the transaction features are recursively operated, and the output and hidden state of each time step are calculated using the following formula:

[0084] i t =σ(W i ·[h t-1 ,e t ]+b i );

[0085] f t =σ(W f ·[h t-1 ,e t ]+b f );

[0086] o t =σ(W o ·[h t-1 ,e t ]+b o );

[0087]

[0088]

[0089] h t =o t *tanh(C t );

[0090] In the formula, i t is the input gate, f t For the forget gate, t is the output gate, is the candidate memory cell state, C t is the memory cell state at the current time step, h t is the feature matrix, W i is the weight of the output gate, W fis the weight of the forget gate, W o is the weight of the output gate, W c is the weight of the candidate memory cell state, b i is the bias term of the input gate, b f is the bias term of the forget gate, b o is the bias term of the output gate, b c is the bias term of the candidate memory cell state, h t-1 is the hidden state of the previous time step, C t-1 is the memory cell state of the previous time step, e t is the error at each time step t, which is used to calculate the gradient and update the parameters.

[0091] After the LSTM mechanism, each time step will get a hidden state h t , represented as the feature matrix for each account.

[0092] S4: Randomly downsample the feature matrix to obtain a feature matrix dataset.

[0093] Since the proportion of normal transactions in virtual currency transaction data is much greater than that of fraudulent transactions, it is necessary to balance the feature matrix in S3. This method uses random downsampling to deal with the imbalance problem.

[0094] In one embodiment, random downsampling reduces the difference in the number of positive and negative samples, and reduces the ratio between fraudulent transactions (positive samples) and normal transaction behaviors (negative samples), which has a better effect on virtual currency transactions. Random downsampling is a method for balancing the number of positive and negative samples, and is particularly suitable for minority positive sample problems such as virtual currency transaction fraud detection. In this process, samples are randomly extracted from normal transaction behaviors (negative samples) to reduce their number and make them closer to minority positive samples (such as fraudulent transactions). This method reduces the difference in the number of positive and negative samples, thereby alleviating the situation where the supervised learning model is biased towards the majority class. Through random downsampling, the supervised learning model can learn positive and negative samples more evenly during training, improve the recognition ability of minority positive samples (such as fraudulent transactions), and thus improve the overall detection effect.

[0095] Specifically, the specific steps of using the random downsampling method to deal with the imbalance of the feature matrix are as follows:

[0096] According to the obtained feature matrix, positive and negative samples are divided and the majority class negative sample matrix is ​​selected;

[0097] Randomly select a certain number of sample matrices from the majority class negative sample matrix. The number of these sample matrices is usually equal to or close to the number of samples in the minority class positive sample matrix. The purpose is to make the category distribution of the feature matrix data set more balanced.

[0098] All sample feature matrices of the minority class positive sample matrix and the randomly selected sample feature matrices from the majority class negative sample matrix are merged to form a new, class-balanced feature matrix dataset.

[0099] S5: Use the XGBoost model for supervised learning training, adopt the decision tree mechanism, use N nodes to vote to determine whether it is a fraud node, and generate the prediction results of the corresponding account, including the probability score of the transaction being a fraud account.

[0100] Since the proportion of normal transaction behavior in virtual currency transaction data is much greater than that of fraudulent transactions, the XGBoost model needs to be balanced. The present invention uses the adjustment of positive and negative sample weights and focal loss function to deal with the imbalance problem of the XGBoost model.

[0101] In one embodiment, adjusting the weights of positive and negative samples refers to setting the weight ratio to the ratio of normal transaction behavior (negative sample) to fraudulent transaction (positive sample). This is because fraudulent transactions are usually relatively rare positive samples, while normal transaction behaviors are a large number of negative samples. If not adjusted during the training process, the XGBoost model tends to learn the majority class, i.e., normal transaction behavior (negative sample), thereby ignoring the fraudulent transactions (positive sample) of the minority class.

[0102] To avoid this problem, we set the weights of samples according to their number. Specifically, for fewer positive samples, we can give them higher weights, so that the XGBoost model pays more attention to these fewer positive samples during training. Conversely, for more negative samples, we can give them lower weights, so as to reduce the dominant effect of negative samples on the XGBoost model.

[0103] This weight setting method can effectively improve the XGBoost model's ability to identify fraudulent transactions (positive samples), so that it can still keenly capture potential fraudulent transactions (positive samples) when faced with a large number of normal transactions. In this way, the XGBoost model can not only learn different categories in the data more balanced, but also detect fraudulent transactions (positive samples) more accurately in practical applications.

[0104] In one embodiment, in order to solve the problem of sample imbalance, the focal loss function is used to increase the distance between positive and negative samples, and the accounts marked as fraudulent transactions (positive samples) and accounts with normal transaction behaviors (negative samples) are distinguished by features: the focal loss function is an effective method for dealing with the problem of positive and negative sample imbalance. Unlike traditional loss functions, the focal loss function gives higher weights to minority class positive samples that are difficult to classify, and lower weights to majority class negative samples that are easy to classify. Through this adjustment, the focal loss function can increase the distance between positive and negative samples, so that the XGBoost model is more focused on identifying difficult-to-detect positive samples during training, thereby improving the detection accuracy of minority class positive samples. In this way, the XGBoost model can better distinguish between positive and negative samples and effectively improve the ability to detect minority class positive samples.

[0105] In one embodiment, random downsampling reduces the difference in the number of positive and negative samples, reduces the ratio between fraudulent transactions (positive samples) and normal transaction behaviors (negative samples), and has a better effect on virtual currency transactions. Random downsampling is a method for balancing the number of positive and negative samples, and is particularly suitable for minority positive sample problems such as virtual currency transaction fraud detection. In this process, samples are randomly extracted from normal transaction behaviors (negative samples) to reduce their number and make them closer to minority positive samples (fraudulent transactions). This method reduces the difference in the number of positive and negative samples, thereby alleviating the situation where the XGBoost model is biased towards the majority class. Through random downsampling, the XGBoost model can learn positive and negative samples more evenly during training, improve the recognition ability of minority positive samples (fraudulent transactions), and thus improve the overall detection effect.

[0106] Among them, the specific implementation method of using the XGBoost model for supervised learning training is:

[0107] First, the feature matrix dataset is used as training data, and the ratio of training data to test data is set to 7:3. The decision tree mechanism is used to perform supervised learning training on the training data. This process involves inputting known fraud account data and non-fraud account data into the decision tree model so that the XGBoost model can learn to distinguish the characteristics of these two types of accounts. Then, the trained XGBoost model is used to verify the experimental effect of positive and negative samples with hidden labels to evaluate the performance of the model in practical applications. This method can effectively improve the accuracy and efficiency of detecting fraud accounts and provide strong support for anti-fraud work.

[0108] This method uses XGBoost as a supervised learning trainer. With its efficient gradient boosting algorithm, powerful feature selection ability and ability to process heterogeneous data, XGBoost can quickly capture complex relationships in the data and automatically filter out the most important features for the target variable. In addition, XGBoost has the robustness to handle missing values, the mechanism to avoid overfitting, fast training and prediction speed, and high scalability. These advantages can accurately identify potential fraud accounts in a large amount of complex transaction data and maintain stable operation under high load conditions.

[0109] See also Figure 5 , supervised learning training using the XGBoost model includes the following steps:

[0110] Import the positive and negative samples with hidden labels into the supervised learning model, and convert the data in the positive and negative samples into the type that meets the XGBoost classifier and perform necessary standardization, such as unifying the number of rows and columns;

[0111] Perform random downsampling to obtain the feature matrix data set as the input of the XGBoost model;

[0112] Next, we adjust the weights of positive and negative samples and the focal loss function to deal with the imbalance problem of the XGBoost model.

[0113] Then, the XGBoost model is trained using the feature matrix dataset;

[0114] After training, the XGBoost model votes by integrating multiple weak learners (such as decision trees). Each weak learner predicts whether the transaction record is a fraudulent account and votes based on the weight of the transaction record. The final result is the weighted average of the voting results of each weak learner. After the voting mechanism, the system automatically generates the prediction results of the corresponding account, including the probability score of the transaction being a fraudulent account. According to the preset threshold, transactions above the threshold are marked as potential fraudulent behavior and the corresponding alarm is output.

[0115] Specifically, the main steps of training the XGBoost model include: inputting the feature matrix data set into the XGBoost classifier in the XGBoost model to train the XGBoost model, wherein the XGBoost classifier makes judgments based on the candidate features, evaluates the features of each feature matrix data set and the possible splitting points of its values, and selects the optimal splitting point to distinguish between normal transaction behaviors (negative samples) and fraudulent transactions (positive samples), thereby training the XGBoost model;

[0116] The specific implementation of the decision tree judgment and weighted summation in the XGBoost classifier is as follows:

[0117] At each non-leaf node in the XGBoost classifier decision tree, the XGBoost classifier will make a judgment based on the candidate features. Evaluate the possible splitting points of the features and their values ​​of each feature matrix dataset, and select the optimal splitting point based on the evaluation value. The splitting point will divide the feature matrix dataset into two subsets, so that the samples in different subsets perform better on a certain target (such as error, information gain or other loss function), and pass it down to the leaf node.

[0118] Once a leaf node is reached, the XGBoost classifier will determine the value of the leaf node by minimizing the focal loss function. This value is the weighted average gradient of the samples at the current leaf node and is used to adjust the prediction result.

[0119] The path from the root node to the leaf node represents the final decision process made by the XGBoost classifier. Each internal node makes a split judgment on the sample based on the feature value of the sample, and sends the sample to the next child node according to the split condition until the sample reaches a leaf node. The final prediction result for the corresponding account is the accumulation of the output values ​​of the leaf nodes of all decision trees.

[0120] The second aspect of the embodiment of the present application provides a fraud detection system for virtual currency, including: a transaction data preprocessing module, a feature encoding module, a sample imbalance processing module, a supervised learning training module, a result evaluation module, and also includes a database management module, a system monitoring module, an information display module and a fraud information release module.

[0121] In one embodiment, the database management module: during the data update phase, the user can choose between a regular scanning mode and an in-depth mining mode. If the user chooses to perform a regular scan of the transaction, and the transaction information already exists in the suspicious transaction library, the system will no longer operate; if the user chooses to deeply mine potential fraudulent transactions, and the transaction is not recorded in the suspicious transaction library, the system will query and integrate the newly discovered suspicious transaction information and insert it into the suspicious transaction library. The user can set a custom update interval, and the system will regularly update the information in the suspicious transaction library at this interval. If not set, the system will update and maintain it at the default update interval. Through these processes, the system can efficiently manage the transaction database, ensure timely detection and response to potential virtual currency fraud, and improve transaction security.

[0122] In one embodiment, the system monitoring module is used to monitor the number of test threads, the average system response time, the CPU usage, the database data volume, and the log data volume in real time. If the user customizes the alarm threshold, the alarm is triggered according to the user-defined threshold, otherwise the alarm is triggered according to the system default threshold.

[0123] In one embodiment, the information display module is designed to intuitively present the key data and detection results of virtual currency transactions, helping users to grasp the transaction process and the progress of fraud detection in real time. This module uses advanced data visualization technology to fully display information such as transaction account address, transaction type, number and name of transaction tokens. For transactions identified as fraudulent, the system displays the fraud process in detail, and compares the current transaction data with historical data or normal transaction patterns through the abnormal comparison function to find out the abnormalities. The system also updates and displays the latest status of the fraud data set in real time to ensure that users understand the timeliness and completeness of the data. Key system monitoring indicators will also be displayed so that users can monitor the operating status and performance of the system in real time. At the same time, the system uses charts and animations to fully visualize the fraud detection results, test progress and test information, allowing users to quickly understand the effectiveness of the detection and the overall progress of the test. Through the integration of these technologies, the information display module provides users with comprehensive and real-time virtual currency transactions and fraud detection information, improving users' ability to control transaction security.

[0124] In one embodiment, the fraud information publishing module is used to publish the virtual currency transaction account addresses identified as fraudulent to relevant websites, and adopts advanced automation technology to achieve efficient information publishing and updating. The module uses automated scripts to interact with external platforms through RESTful APIs, and can obtain fraud account information updated by the system at regular intervals, and publish it to designated websites safely and quickly. The system also uses SSL / TLS encryption protocols to ensure the security of data transmission, and is equipped with an intelligent task scheduler and error handling mechanism to ensure the timeliness and accuracy of information release. In addition, the module supports multi-platform publishing functions, which can synchronize fraud account information to multiple related websites and expand the scope of information dissemination. Through the integration of these technologies, the system not only improves the security of virtual currency transactions, but also provides strong technical support for combating virtual currency fraud.

[0125] Specific embodiment 1: simulate a fraud detection.

[0126] Use the Etherum-ETL tool to extract the structured transaction data table and obtain the original CSV file.

[0127] The original CSV file is judged and classified to identify the initiator and recipient of the transaction, and the transaction output file and transaction input file are obtained.

[0128] The transaction output file and the transaction input file are aggregated using the Python language to obtain a newly generated CSV file and save it.

[0129] The newly generated CSV file is used to extract transaction features using the Transormer model feature extraction module to obtain transaction features, including account address, transaction type, input and output type, timestamp, transaction fee and location information.

[0130] The improved pre-trained language model BERT is used to perform contextual learning on transaction features. In the improved pre-trained language model BERT, the number of Transformer layers is set to 8, the number of attention heads is set to 2, and the maximum sequence length is 100. The number of linear layers of the generator and the discriminator in the generative adversarial network is 3, and the learning rate is 0.0001. The feature matrix is ​​obtained through contextual learning of the LSTM mechanism in the pre-trained language model BERT.

[0131] For example, assume that the transaction feature data is encoded by the improved pre-trained language model BERT. In this process, each transaction is converted into a multi-dimensional feature matrix. These feature matrices are combined into two sub-matrices H 1 , H 2 , each sub-matrix consists of a series of feature matrices.

[0132] Among them, H 1 =[h 1 ,h 2 ,…,h n ], H 2 =[h 1 ,h 2 ,…,h n ], where h represents the feature matrix of each transaction feature. The first feature matrix h 1 Contains the information of the transaction account address, the second feature matrix h 2 May contain information about the transaction type, and so on, up to h n Contains information about the last feature of the transaction.

[0133] The feature matrix is ​​randomly downsampled to obtain a feature matrix data set.

[0134] Specifically, when the improved pre-trained language model BERT is trained, the npy file (i.e., feature matrix) of the corresponding account will be obtained.

[0135] At this time, random downsampling is performed to supplement the samples, and the samples are divided into 7:3 in proportion. Then, the XGBoost model is used for supervised learning training. The XGBoost model is set as follows: the maximum depth of the decision tree is 9, and the learning rate is 0.15.

[0136] In the blockchain fraud detection scenario, there is often a certain correlation between transaction records.

[0137] For example, users with similar consumption habits and basic information may show similar transaction patterns. In addition, transaction records of the same initiator usually have certain regularities. Transaction records of single transaction amount, transaction frequency, and transaction type often have certain similarities. Therefore, the patterns and regularities of fraudulent transactions can be mined by defining multiple time features, and these time features can be classified and predicted using the XGBoost model.

[0138] First, the XGBoost model is used to detect abnormal transaction points in multiple first data features, which are different from other transactions in terms of transaction amount or frequency. Then, the XGBoost model is used to identify time series anomalies in the second data feature, which are abnormal transactions that cannot be explained by normal time series feature patterns. Combining these abnormal time series features with the detection results of the XGBoost model can more accurately identify potential fraudulent behavior.

[0139] During the training process of the supervised learning model, the XGBoost model iteratively builds a series of decision trees. Each decision tree votes on the error predicted by the previous round of the XGBoost model (i.e., the omission or false positive of fraudulent transactions) and makes improvements to obtain improved adaptive parameters to improve the performance of the next round of the XGBoost model. Therefore, the output of each round of decision trees will further optimize and improve the overall performance.

[0140] After training, the XGBoost model votes by integrating multiple weak learners (such as decision trees). Each weak learner predicts whether the transaction record is a fraudulent account and votes according to the weight of the transaction record to obtain the weighted average of the corresponding accounts of the voting results of each weak learner (i.e., the prediction result), including the probability score of the transaction being a fraudulent account. According to the previously preset threshold, transactions above the threshold are marked as potential fraudulent behavior and the corresponding alarm is output. In this way, the simulation completes a fraud detection.

[0141] Specific embodiment 2: supervised learning model performance analysis.

[0142] Supervised learning training The feature matrix obtained by BERT pre-training was input into the training set preprocessing and XGBoost classifier. Each experiment was repeated eight times, and the threshold of XGBoost classifier was set to 0.3 to report the best score of F1 value. The threshold of the comparison method (Diff2Vec, GSAGE, GAT) was set to 0.3-0.5, and the best score of F1 value was taken for comparison. The results are shown in Table 1.

[0143] Table 1

[0144]

[0145] It can be seen from Table 1 that the improved supervised learning model of the present invention has the highest precision, the highest recall rate, and the highest F1 value score. Therefore, the improved supervised learning model of the present invention is better and can accurately identify potential fraud accounts, and has a better ability to identify positive samples.

[0146] Specific Example 3: Result evaluation.

[0147] Save the XGBoost model trained by supervised learning and use the test data to output the prediction results. The evaluation indicators are measured by precision, recall and F1 value.

[0148] Precision refers to the prediction results, which indicates the proportion of samples correctly predicted as positive. The formula for precision is: The recall rate refers to the original sample, which indicates the proportion of samples correctly predicted as positive to all samples that are actually positive. The formula for the recall rate is: F1 can combine the precision and recall of a class into the same indicator, so the F1 value score is used for evaluation. The F1 value score can be regarded as a weighted average of the accuracy and recall of the XGBoost model. The formula is:

[0149] The present invention uses the F1 value score as a test threshold to determine whether the probability score of the transaction being a fraudulent account is greater than a preset score threshold. The confusion matrix is ​​shown in Table 2:

[0150] Table 2 Confusion matrix

[0151]

[0152] In the table, TP (True Positive) refers to the number of samples correctly predicted as positive by the XGBoost model, FP (False Positive) refers to the number of negative samples incorrectly predicted as positive by the XGBoost model, FN (False Negative) refers to the number of positive samples incorrectly predicted as negative by the XGBoost model, and TN (True Negative) refers to the number of samples correctly predicted as negative by the XGBoost model.

[0153] The present invention proposes a fraud detection method and system for virtual currency to effectively address the shortcomings of traditional fraud detection methods and the complexity of blockchain virtual currency data.

[0154] First, the Transformer structure is used to replace the traditional detection method based on graph neural network (GNN), which can better capture the time sequence and dynamic changes in transactions and improve the accuracy and flexibility of anomaly detection.

[0155] Secondly, the high repetitiveness and uneven distribution problems common in blockchain token data are solved through transaction aggregation technology. Specifically, addresses with high transaction frequency are regarded as negative samples, and the challenge of data imbalance is effectively alleviated by introducing transaction classification methods. This method improves the generalization ability of the model, enabling it to more accurately identify abnormal transaction patterns.

[0156] Thirdly, the BERT model has been specially improved by introducing a temperature coefficient based on the InfoNCE loss function, so that it can adapt to the learning needs of blockchain token data during the process of data imbalance. Through these adjustments, the BERT model can better capture the characteristics and patterns of blockchain data, and enhance the model's performance in identifying abnormal behavior.

[0157] Finally, in the feature encoding stage, an improved XGBoost model is used, and the focal Loss loss function is used to widen the gap between positive and negative samples and deal with the problem of data imbalance. By optimizing the loss function of the model and adjusting the sampling strategy, the performance of the detection model on imbalanced data is significantly improved, ensuring high accuracy and robustness of fraud detection in various scenarios. These innovations enable the present invention to achieve excellent results in processing complex virtual currency transaction data and detecting fraudulent behavior.

[0158] In summary, the present invention uses the BERT model for feature extraction in the encoding stage, which can efficiently capture complex features in the data. By encoding the features of each account, a feature matrix is ​​generated, which fully describes the behavior and transaction characteristics of the account. In the feature encoding, XGBoost model supervised learning training and equalization processing stages, the extracted features are combined with machine learning algorithms to detect fraudulent activities. Compared with the traditional graph neural network method, the Transformer-based pre-trained language model BERT is better at processing sequence data and can capture the time sequence pattern in the transaction. At the same time, the machine learning algorithm performs well in processing complex nonlinear relationships and dynamic changes, and can more accurately identify abnormal behaviors. Therefore, a fraud detection method for virtual currency based on Transformer provided in this application has achieved significant results in abnormal detection, improving the accuracy and flexibility of fraud detection. Through this improvement, the limitations of traditional methods are overcome, and comprehensive detection of dynamic changes and time series is achieved, making fraud detection more efficient and accurate. This innovative method is not only suitable for the detection of virtual currency fraud, but also provides powerful tools and support for the identification of abnormal behavior in a wide range of financial fields.

[0159] Moreover, in order to effectively deal with the existing virtual currency fraud phenomenon, the present invention has built a powerful fraud detection system by integrating valuable transaction data from different blockchain networks and different transaction types, which can quickly and efficiently detect the risk information and scenario characteristics of fraudulent behavior. Through efficient data integration and Transformer intelligent feature extraction, the present invention can effectively deal with complex fraud problems in the field of virtual currency, and provide users with a high-performance and highly flexible fraud detection solution.

[0160] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A fraud detection method for virtual currency based on Transformer, characterized in that: include: Perform transaction data preprocessing on the archived original transaction data to obtain a newly generated CSV file; After extracting transaction features, we get the transaction features, then perform feature encoding to get the feature matrix, then perform random downsampling to get the feature matrix data set after equalization, and finally perform supervised learning training to generate the prediction results of the corresponding account; The transaction data preprocessing includes obtaining transaction data of virtual currency, classifying transaction data and deduplicating transaction data; The deduplication of transaction data refers to aggregating consecutive repeated transactions with the same address, the same input / output type and initiated within 72 hours, that is, filtering out unnecessary transaction sequences, retaining the original timestamp, and having corresponding time characteristics; The feature encoding is performed by the pre-trained language model BERT with an improved InfoNCE loss function; The specific formula of the improved InfoNCE loss function is: ； In the formula, is the number of samples, i and j are the labels of accounts, q i is the characteristic of the target sample, is the feature corresponding to the positive sample, is the feature corresponding to the negative sample, The temperature coefficient is used to control the emphasis on negative samples during the model training process.

2. A fraud detection method for virtual currency based on Transformer as claimed in claim 1, characterized in that: The feature encoding refers to using the pre-trained language model BERT with an improved InfoNCE loss function to convert the data in the transaction features into feature vectors for representation, namely, feature matrices.

3. The fraud detection method for virtual currency based on Transformer as claimed in claim 1, characterized in that: The transaction feature extraction includes input embedding and position encoding; The input embedding refers to converting the data in the newly generated CSV file into a feature vector representation; The position coding refers to adding corresponding position information to the transaction sequence in the newly generated CSV file; The transaction characteristics include account address, transaction type, input and output type, timestamp, transaction fee and location information.

4. The fraud detection method for virtual currency based on Transformer as claimed in claim 1, characterized in that: The specific implementation of the random downsampling is: Divide the feature matrix into positive and negative samples, and select the majority class negative sample matrix; Randomly select a certain number of minority class positive sample matrices from the majority class negative sample matrix; All feature matrices of the minority class positive sample matrix and all feature matrices of the majority class negative sample matrix are merged to form the feature matrix data set.

5. The fraud detection method for virtual currency based on Transformer as claimed in claim 1, characterized in that: The specific implementation of the supervised learning training includes: Import the feature matrix data set and convert the data in the positive and negative samples in the feature matrix data set into types that meet the requirements of the XGBoost classifier; Perform the random downsampling to obtain a feature matrix data set and train it using an XGBoost model; After training, the XGBoost model integrates multiple weak learners and votes based on the weights of transaction records; The weighted average of the voting results of each weak learner is integrated to obtain the prediction result of the corresponding account.

6. A fraud detection method for virtual currency based on Transformer as claimed in claim 5, characterized in that: The specific implementation method of the XGBoost model training is as follows: inputting a feature matrix data set and making judgments based on candidate features, evaluating the values ​​of possible splitting points of the features and their values ​​of each feature matrix data set, and selecting the optimal splitting point for distinction based on the evaluation value, so as to train the XGBoost model; Before training the XGBoost model, the positive and negative sample weights and focal loss function are adjusted to deal with the imbalance problem of the XGBoost model. Adjusting the weights of positive and negative samples refers to setting the weight ratio to the ratio of positive samples to negative samples; The focal loss function is used to increase the distance between positive and negative samples, and distinguish the features of the positive sample accounts and the negative sample accounts.

7. The fraud detection method for virtual currency based on Transformer as claimed in claim 1, characterized in that: The acquisition of virtual currency transaction data refers to actively scanning and acquiring archived original transaction data, and extracting a structured transaction data table, namely, an original CSV file.

8. A fraud detection method for virtual currency based on Transformer as claimed in claim 7, characterized in that: The transaction data classification refers to classifying the transaction data of the original CSV file according to the transaction role and time sequence to obtain a transaction output file and a transaction input file.

9. The fraud detection method for virtual currency based on Transformer as claimed in claim 1, characterized in that: The prediction result of the corresponding account includes a probability score that the transaction is a fraudulent account.

10. A fraud detection system for virtual currency based on Transformer, characterized in that: include: Transaction data preprocessing module, transaction feature extraction module, feature encoding module, random downsampling module, supervised learning training module, result evaluation module, database management module, system monitoring module, information display module and fraud information release module; The transaction data preprocessing module is used to actively scan and obtain the archived original transaction data to obtain the original CSV file, then determine the role of each account in the transaction in the original CSV file, and obtain the transaction output file and the transaction input file according to the time sequence of the transaction data, and finally perform aggregation processing to obtain a newly generated CSV file; The transaction feature extraction module is used to extract transaction features from the newly generated CSV file; The feature encoding module is used to convert the transaction feature data into a vector representation with rich semantic information, i.e., a feature matrix, by using the pre-trained language model BERT with an improved InfoNCE loss function; The random downsampling module is used to process the feature matrix by a random downsampling method to obtain a feature matrix data set; The supervised learning training module is used to perform supervised learning training on the XGBoost model; The result evaluation module is used to evaluate the prediction result of the corresponding account; The database management module is used to query and integrate the newly discovered suspicious transaction information and insert it into the suspicious transaction database; The system monitoring module is used to monitor the number of threads used in the test, the average system response time, the CPU usage, the amount of database data, and the amount of log data in real time; The information display module is used to intuitively display key data and detection results of virtual currency transactions; The fraud information publishing module is used to publish the virtual currency transaction account address identified as fraudulent to the relevant website.

Images