Block chain address and under-chain intelligence linkage deanonymization method based on feature recognition

Abstract

The invention discloses a block chain address and under-chain intelligence linkage deanonymization method based on feature recognition, and relates to the technical field of block chains, and the method comprises the steps: obtaining a public group link based on a telegraph, obtaining message data in a public group based on the public group link, and obtaining first information from the message data; obtaining intelligence data from the webpage, and obtaining an intelligence data type and whether the intelligence data comprises address information based on the intelligence data; obtaining transfer related data based on the preset message content, obtaining a transaction screening condition based on the transfer related data, and obtaining second transaction data based on the transaction screening condition; judging whether the intelligence data comprises a related on-chain address or not, and if yes, adding an identifier to the related on-chain address; if there is no on-chain address and there is a part of character string of the on-chain address, obtaining a related on-chain address based on the intelligence data, then identifying a transaction network of the related on-chain address, and judging whether a transaction behavior of the related on-chain address accords with the type of the intelligence data; matching the first information with the second transaction data to obtain a user address; and storing the user address obtained by matching, the related on-chain address obtained by matching and the information of the related on-chain address. The problem that in the prior art, deanonymization of transaction users on a block chain cannot be achieved in time, and deanonymization of transaction users on the block chain cannot be achieved under the low-risk condition can be solved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition. Background Art

[0002] Blockchain is decentralized and has no centralized control organization. Its data storage and verification are completed by many nodes and it is tamper-proof. Once the data is recorded, it is difficult to tamper with. It is a distributed ledger and data is stored in multiple nodes. A consensus mechanism is used to allow nodes to reach a consensus on transaction and data validity. It has a certain degree of anonymity. In an anonymous environment, the source and destination of funds are difficult to accurately track and monitor, creating a relatively hidden space for invalid behavior, increasing the difficulty of supervision, and may lead to smoother circulation and operation of illegally obtained funds, posing a threat to social order and economic security.

[0003] Existing methods for de-anonymizing and obtaining blockchain addresses can be divided into three categories: the first is to obtain the identity information of the relevant address through open source channels, but it is usually limited by the slow update of channel data and the lack of information to obtain valid information; the second is to assist relevant departments in cooperative analysis of cases and assist in analyzing related invalid behavior cases, but the data confidentiality involved in such methods will not be disclosed to the public, and depends on the specific circumstances and case categories of the cases obtained by the relevant department personnel. Some cases beyond the jurisdiction cannot be handled; the third is that intelligence analysts register relevant accounts and then operate on the relevant invalid behavior platforms or websites, but the operation of such platforms is generally not protected by law and there are great risks. Summary of the invention

[0004] In order to solve the problem that the prior art cannot achieve timely deanonymization of transaction users on the blockchain, and cannot deanonymize transaction users on the blockchain under low-risk conditions, the present invention provides a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition, the method comprising:

[0005] S1. Off-chain data identification, including:

[0006] Obtaining a guarantee platform related to a preset business in the telegram, obtaining a public group link corresponding to the preset business in the guarantee platform, obtaining message data in the public group based on the public group link, obtaining first information related to the transaction from the message data and storing it in a database;

[0007] Acquire transaction-related intelligence data from a web page, analyze the intelligence data, obtain the type of intelligence data and whether the intelligence data includes address information, and store the intelligence data, the content of the intelligence data, and whether the intelligence data includes address information in a database;

[0008] S2. On-chain data acquisition and intelligence data processing, including:

[0009] The on-chain data acquisition includes: obtaining preset message content, obtaining transfer-related data based on the preset message content, preprocessing the transfer-related data to obtain transaction screening conditions, filtering and obtaining first transaction data from the blockchain based on the transaction screening conditions, and filtering and processing the first transaction data to obtain second transaction data;

[0010] Processing of intelligence data: Determine whether the intelligence data includes the relevant on-chain address. If so, add an identifier to the relevant on-chain address. If there is no on-chain address but a partial string of the on-chain address, obtain the relevant on-chain address based on the transaction time and transaction amount in the intelligence data, and then identify the transaction network of the relevant on-chain address to determine whether the transaction behavior of the relevant on-chain address meets the type of intelligence data.

[0011] S3, matching and saving the on-chain and off-chain data, including: matching the first information with the second transaction data to obtain the user address;

[0012] S4. The matched user address and the matched related on-chain address, as well as the information of the related on-chain address are stored.

[0013] Guarantee platform: a third-party guarantee trading platform that provides guarantee services.

[0014] Principle of the invention: The method monitors the message data related to fund transactions in the guarantee platform in real time, obtains the latest valid information based on business rules and matches it with the on-chain transaction data in time, so as to quickly find out the user information and on-chain addresses involved in the fund transactions, mark the on-chain addresses, and achieve the purpose of linkage deanonymization; monitors the intelligence data related to fund transactions in relevant intelligence websites in real time, obtains the relevant on-chain addresses based on feature recognition and matching of transaction time and transaction amount in the intelligence data, and marks them, and links them with the on-chain addresses to improve the deanonymization degree of the on-chain addresses; obtains message data and intelligence data in real time to obtain more valid information; obtains user addresses by matching on-chain and off-chain data, locks off-chain user addresses, and achieves the purpose of off-chain address deanonymization; and the method obtains data from the guarantee platform and intelligence website, is not restricted by confidential data, does not need to invest funds in invalid behavior platforms for operation, and achieves the purpose of timely and effective deanonymization without risk.

[0015] Furthermore, the method also includes: analyzing the relevant on-chain addresses to obtain the flow information of relevant funds, and obtaining the core on-chain address based on the flow information of funds. The outflow path of the fund transaction of the invalid behavior case is extracted to make the flow of funds clearer and improve the identification of the flow of funds of the invalid behavior transaction.

[0016] Furthermore, the method also includes: obtaining corresponding off-chain intelligence information based on the core on-chain address, correlating the off-chain intelligence information to obtain correlation results, and judging whether the corresponding preset business activities belong to the same organization based on the correlation results. According to the key address, the corresponding off-chain intelligence is found, and it is linked with the on-chain address to improve the de-anonymization degree of the address on the blockchain.

[0017] Further, based on the public group link, the message data in the public group is obtained, specifically including: applying for an application programming interface from the telegram platform, obtaining the required interface name and interface hash according to the authorization, connecting to the client through the interface name and interface hash, generating an interactive session file between the browser and the server, connecting the client of the monitored account to conduct real-time monitoring according to the interface name, interface hash and interactive session file between the browser and the server of the monitored account, and subsequent monitoring based on the time node when the previous monitoring ended, monitoring the newly added group chat data after the time node, and obtaining the group chat data after monitoring to obtain the message data. The telegram platform is frequently used to discuss fund transactions because of its characteristics of super large group chats, cloud storage of chat records and no censorship. Monitoring the group chat data involving fund transactions in the telegram platform can obtain more effective information. This method improves the efficiency of the acquired group chat data by extracting a large number of messages in the group chat in real time, and ensures the real-time nature of the acquired group chat data.

[0018] Furthermore, the message data includes: the name of the message sender, the time of message sending, the mobile phone number of the message sender and the content of the message sent, and the first information includes: address information, transfer information, bank card information and account book data. By identifying the above information in the group, valid information can be extracted to facilitate matching with the transaction data on the chain.

[0019] Furthermore, the method of obtaining the first information related to the transaction from the message data is: converting the text image into a structured document format through optical character recognition, and obtaining the first information related to the transaction from the message data using word segmentation and regular matching. This method quickly identifies valid information in group chat data, improves the efficiency of collecting valid information, and facilitates subsequent matching of on-chain transaction data.

[0020] Furthermore, the preprocessing of the transfer-related data includes: obtaining the transaction time and transaction amount in the transfer-related data; and obtaining the transaction screening condition based on the transaction time, transaction amount and a preset floating range. Considering that there may be a time difference between the issuance time and the transaction time, and that there may be decimal places in the issuance time, a floating range is set to obtain transaction data that meets the conditions better.

[0021] Furthermore, the method for obtaining the message data also includes: joining a group chat based on a public group link, obtaining other group chats that members have joined by searching for members in the group chat, screening other group chats that members have joined, screening out group chats involving preset business categories and joining them, and obtaining message data based on all joined group chats. Some group chats involving invalid financial transactions are named with names that are irrelevant to their transactions, which makes it impossible to directly find these group chats. The above method can be used to obtain group chats related to preset business categories that cannot be directly found, and then obtain more message data.

[0022] Furthermore, the preset business category is a preset business category involving fund transactions. Select a group chat related to fund transactions to join, and avoid joining other irrelevant group chats, obtaining group chat data unrelated to fund transactions, and increasing the difficulty of identifying valid information.

[0023] Further, the specific method of screening out group chats involving preset business categories includes: using a telegram group counter to count the members' speeches in the group, displaying the number of messages posted by the members in each group chat in the telegram counter interface, ranking the activity of the group chats in which the members participate in the order of the number of messages posted by the members in each group chat from high to low, and viewing the group chat contents in order of activity from high to low;

[0024] Extract the chat data of the group chat in which the member participates, segment the group chat data, remove stop words, perform word frequency statistics on the segmented group chat data, extract words with a frequency higher than the average word frequency of all segmented sets after statistics, and if there are words related to the preset business category among the words, it is determined that the group chat involves the preset business category.

[0025] By giving priority to viewing group chats with high activity, the efficiency of screening group chats involving preset business categories can be improved when there are too many group chats joined by users; by quickly determining whether the content of a large number of group chats involves preset business categories, the search speed for group chats involving preset business categories can be improved.

[0026] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0027] 1. By monitoring the message data involving fund transactions in the guarantee platform in real time, the latest valid information is obtained and matched and identified with the on-chain transaction data in a timely manner, so as to quickly find out the user information and on-chain address involved in the fund transaction, mark the on-chain address, and achieve the purpose of linkage de-anonymization.

[0028] 2. Real-time monitoring of intelligence data related to fund transactions on relevant intelligence websites, matching the transaction time and transaction amount in the intelligence data to obtain the relevant on-chain addresses, marking them, and linking them with the on-chain addresses to improve the de-anonymization of the on-chain addresses.

[0029] 3. Obtain the user address by matching the on-chain and off-chain data, lock the off-chain user address, and achieve the purpose of deanonymization of the off-chain address.

[0030] 4. This method obtains data from guarantee platforms and intelligence websites, is not restricted by confidential data, does not require the investment of funds in invalid behavior platforms for operation, and achieves the purpose of timely and effective de-anonymization without risk.

[0031] 5. Through feature recognition and business rule recognition, match the on-chain and off-chain information, save the corresponding on-chain and off-chain information, and when analyzing the case and finding the addresses involved in invalid behavior, directly find the off-chain information corresponding to the addresses of invalid behavior from the saved data, quickly identify the relevant personnel, improve the efficiency of analysis and solving cases, and ensure the safety of funds.

[0032] 6. Through feature recognition and business rule recognition, combined with business scenarios, the addresses on the chain that participate in invalid behaviors are analyzed and identified, and the addresses on the chain are de-anonymized and analyzed. After de-anonymization, the transaction address is matched with the user information to obtain the flow of funds under the address, making the flow of funds clear. According to the on-chain information, the corresponding on-chain address is matched, and the addresses on the chain that participate in invalid behaviors are labeled and expanded. At the same time, combined with business rules, the source of funds and outflow path of funds transactions in invalid behavior cases are extracted to improve the identification of the flow of funds for invalid behavior transactions.

[0033] 7. Through monitoring relevant intelligence websites, identify the corresponding intelligence information, link the corresponding intelligence information with the addresses on the chain, improve the de-anonymization level of the addresses on the blockchain, and provide a basis for related analysis.

[0034] 8. Through the analysis of the funds of the on-chain addresses, the core on-chain addresses are found, and the corresponding off-chain intelligence is found according to their addresses, and the on-chain addresses are associated to achieve the deanonymization of the on-chain addresses. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of the present invention, and do not constitute a limitation on the embodiments of the present invention;

[0036] Figure 1 It is a flow chart of a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition in the present invention. DETAILED DESCRIPTION

[0037] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0038] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those within the scope of this description. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0039] Embodiment 1

[0040] refer to Figure 1 , this embodiment provides a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition, the method comprising:

[0041] S1. Off-chain data identification, including:

[0042] Obtain a guarantee platform related to the preset business in the telegram, obtain a public group link corresponding to the preset business in the guarantee platform, obtain message data in the public group based on the public group link, such as by studying official documents, creating a development program to obtain message data in the public group, and obtain the first information related to the transaction from the message data and store it in a database; in this embodiment, the preset business can be a business related to invalid behavior, such as transferring the card back to U: using a bank card to receive funds, and then transferring Tether (USDT) to others, collecting and paying on behalf of others, and running points, etc.

[0043] Among them, obtaining message data in the public group based on the public group link specifically includes: applying for an application programming interface from the telegram platform, obtaining the required interface name and interface hash according to the authorization, and generating an interactive session file between the browser and the server after connecting to the client through the interface name and interface hash, and connecting to the client of the monitored account for real-time monitoring according to the interface name, interface hash and interactive session file between the browser and the server of the monitored account. Subsequent monitoring is based on the time node when the previous monitoring ended, and the newly added group chat data after the time node is monitored, and the group chat data is obtained after monitoring to obtain the message data.

[0044] The message data includes: the name of the message sender, the time when the message was sent, the mobile phone number of the message sender, and the content of the message sent, and the first information includes: address information, transfer information, bank card information, and account book data. In this embodiment, the account book data may include the number of deposits and issuances of USDT tokens, specific time, amount, total deposit amount, rate, fixed exchange rate, and the number of tokens to be issued, issued, and not issued.

[0045] The method of obtaining the first information related to the transaction from the message data is: converting the text image into a structured document format through optical character recognition, and obtaining the first information related to the transaction from the message data using word segmentation and regular matching.

[0046] Obtain transaction-related intelligence data from web pages, such as writing a corresponding intelligence monitoring program based on the data source of the intelligence website, obtaining corresponding intelligence data, analyzing the intelligence data using natural language processing (NLP) and other means, obtaining the type of intelligence data and whether the intelligence data includes address information, and storing the intelligence data, the intelligence data content, and whether the intelligence data includes address data in a database; in this embodiment, the intelligence data may include a title, sender, sent content, source link, etc., and the web page may be a bounty platform, a project announcement, a community forum, etc.

[0047] S2. On-chain data acquisition and intelligence data processing, including:

[0048] On-chain data acquisition includes:

[0049] Obtain preset message content, obtain transfer-related data based on the preset message content, such as obtaining transfer-related data based on transfer amount and transfer time, pre-process the transfer-related data to obtain transaction screening conditions, filter and obtain first transaction data from the blockchain based on the transaction screening conditions, filter the first transaction data, such as filtering out addresses where the interacting party has an identity, which may include institutional identity addresses such as the official address of the exchange and the address of the project party, to obtain second transaction data; in this embodiment, the preset message content may be on-chain data within a preset transaction time range, on-chain data within a preset transaction amount range, or a full amount of on-chain data.

[0050] The preprocessing of the transfer-related data includes: obtaining the transaction time and transaction amount in the transfer-related data; and obtaining transaction screening conditions based on the transaction time, transaction amount and a preset floating range.

[0051] Processing of intelligence data:

[0052] Determine whether the intelligence data includes the relevant on-chain address. If so, add an identifier to the relevant on-chain address. If there is no on-chain address but a partial string of the on-chain address, use regular expressions to match the string to determine whether it contains the partial string. Then, match the transaction time and transaction amount in the intelligence data to obtain the relevant on-chain address. Then, use the graph database to identify the transaction network of the relevant on-chain address and determine whether the transaction behavior of the relevant on-chain address meets the type of intelligence data.

[0053] S3, on-chain and off-chain data matching and preservation, including:

[0054] The first information is matched with the second transaction data to obtain the user address; for example, the group agent address published in the top message of the group chat (the agent address is the on-chain address published by the agent in the group chat for pledging funds to the guarantee platform and issuing funds to users in the group) is matched with the first information and the address in the second transaction data. In this embodiment, the user address can be the user address of the business of exchanging legal currency (such as RMB, USD, etc.) into stable currency, etc.

[0055] S4. The matched user address and the matched related on-chain address, as well as the information of the related on-chain address are stored.

[0056] Embodiment 2

[0057] On the basis of the first embodiment, in this embodiment, the method further includes:

[0058] Analyze the relevant on-chain addresses to obtain the flow information of relevant funds, and obtain the core on-chain address based on the flow information of funds. For example, use graph analysis technology or behavior analysis and machine learning technology to analyze the relevant on-chain addresses, obtain the inflow, outflow, transfer and collection paths of relevant funds, and thus obtain the core on-chain address. In this embodiment, the core on-chain address can be a collection address and a withdrawal address.

[0059] Based on the core chain address, the off-chain intelligence information corresponding to the core chain address is obtained, the off-chain intelligence information is associated to obtain an associated result, and based on the associated result, it is determined whether the corresponding preset business activities belong to the same organization. In this embodiment, the preset business activities can be invalid behaviors such as fraudulent activities.

[0060] Embodiment 3

[0061] On the basis of the above embodiment, in this embodiment, the method for acquiring the message data further includes:

[0062] Join a group chat based on a public group link, find members who have joined the group chat, obtain other group chats that the members have joined, filter the other group chats that the members have joined, filter out group chats involving preset business categories and join them, and obtain message data based on all joined group chats.

[0063] The preset business categories are preset business categories involving fund transactions. In this embodiment, the preset business categories may include bank card cash withdrawal, fake tobacco, alcohol and luxury goods, pledge guarantee and running points.

[0064] The specific methods for filtering out group chats involving preset business categories include:

[0065] Use the Telegram group counter to count the members' speeches in the group. The Telegram counter interface displays the number of messages posted by members in each group chat. The group chats in which members participate are ranked according to the number of messages posted by members in each group chat from high to low. The group chat contents are viewed in descending order of activity;

[0066] Extract the chat data of the group chat in which the member participates, segment the group chat data, remove stop words, perform word frequency statistics on the segmented group chat data, extract words with a frequency higher than the average word frequency of all segmented sets after statistics, and if there are words related to the preset business category among the words, it is determined that the group chat involves the preset business category.

[0067] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0068] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition, characterized in that: The method comprises: S1. Off-chain data identification, including: Obtaining a guarantee platform related to a preset business in the telegram, obtaining a public group link corresponding to the preset business in the guarantee platform, obtaining message data in the public group based on the public group link, obtaining first information related to the transaction from the message data and storing it in a database; Acquire transaction-related intelligence data from a web page, analyze the intelligence data, obtain the type of intelligence data and whether the intelligence data includes address information, and store the intelligence data, the content of the intelligence data, and whether the intelligence data includes address information in a database; S2. On-chain data acquisition and intelligence data processing, including: On-chain data acquisition includes: Obtaining preset message content, obtaining transfer-related data based on the preset message content, preprocessing the transfer-related data to obtain a transaction screening condition, filtering and obtaining first transaction data from the blockchain based on the transaction screening condition, and filtering and processing the first transaction data to obtain second transaction data; Processing of intelligence data: Determine whether the intelligence data includes the relevant on-chain address. If so, add an identifier to the relevant on-chain address. If there is no on-chain address but a partial string of the on-chain address, obtain the relevant on-chain address based on the transaction time and transaction amount in the intelligence data, and then identify the transaction network of the relevant on-chain address to determine whether the transaction behavior of the relevant on-chain address meets the type of intelligence data. S3, on-chain and off-chain data matching and storage, including: Matching the first information with the second transaction data to obtain a user address; S4. The matched user address and the matched related on-chain address, as well as the information of the related on-chain address are stored.

2. According to claim 1, a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition is characterized in that: The method further comprises: Analyze the relevant on-chain addresses to obtain the flow information of relevant funds, and obtain the core on-chain addresses based on the flow information of funds.

3. According to a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition according to claim 2, it is characterized in that: The method further comprises: Based on the core chain address, the corresponding off-chain intelligence information is obtained, the off-chain intelligence information is associated to obtain the associated results, and based on the associated results, it is determined whether the corresponding preset business activities belong to the same organization.

4. According to claim 1, a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition, characterized in that: Based on the public group link, the message data in the public group is obtained, including: Apply for an application programming interface from the telegram platform, obtain the required interface name and interface hash according to the authorization, generate an interactive session file between the browser and the server after connecting to the client through the interface name and interface hash, connect to the client of the monitored account for real-time monitoring based on the interface name, interface hash and interactive session file between the browser and the server of the monitored account, monitor the new group chat data after the time node based on the time node when the previous monitoring ended, obtain the group chat data after the monitoring, and obtain the message data.

5. According to claim 1, a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition, characterized in that: The message data includes: the name of the message sender, the message sending time, the message sender's mobile phone number and the content of the message sent. The first information includes: address information, transfer information, bank card information and account book data.

6. According to claim 1, a method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition is characterized in that: The way to obtain the first information related to the transaction from the message data is: The text image is converted into a structured document format through optical character recognition, and the first information related to the transaction is obtained from the message data using word segmentation and regular matching.

7. The method for deanonymization of blockchain addresses and off-chain intelligence based on feature recognition according to claim 1 is characterized in that: The preprocessing of the transfer-related data includes: Obtain the transaction time and transaction amount in the transfer-related data; Get trade filters based on trade time and trade amount as well as preset floating ranges.

8. The method for deanonymization of blockchain addresses and off-chain intelligence based on feature recognition according to claim 1, characterized in that: The method for obtaining the message data also includes: joining a group chat based on a public group link, obtaining other group chats joined by the members by searching for members who have joined the group chat, screening the other group chats joined by the members, screening out group chats involving preset business categories and joining them, and obtaining message data based on all the joined group chats.

9. The method for deanonymization of blockchain addresses and off-chain intelligence based on feature recognition according to claim 8 is characterized in that: The preset business category is a preset business category involving fund transactions.

10. A method for deanonymization of blockchain addresses and off-chain intelligence linkage based on feature recognition according to claim 9, characterized in that: Specific methods for filtering out group chats involving preset business categories include: Use the Telegram group counter to count the members' speeches in the group. The Telegram counter interface displays the number of messages posted by members in each group chat. The group chats in which members participate are ranked according to the number of messages posted by members in each group chat from high to low. The group chat contents are viewed in descending order of activity; Extract the chat data of the group chat in which the member participates, segment the group chat data, remove stop words, perform word frequency statistics on the segmented group chat data, extract words with a frequency higher than the average word frequency of all segmented sets after statistics, and if there are words related to the preset business category among the words, it is determined that the group chat involves the preset business category.

Images