Method for tracking direction of stolen fund on chain based on block chain transaction analysis

Abstract

The invention discloses a method for tracking the destination of stolen funds on a chain based on block chain transaction analysis, and relates to the technical field of block chain virtual currency, and the method comprises the steps: obtaining first transaction data on all nodes of a block chain, carrying out the analysis of the first transaction data, and obtaining a transaction behavior and a transaction purpose; analyzing the first transaction data based on the transaction behavior and the transaction purpose to obtain a node address; judging the node identity of the node address; obtaining a suspected hacker address based on the node identity, marking a node level of the suspected hacker address, and analyzing second transaction data after the suspected hacker address receives stolen funds to obtain a final drop point address; and generating a stolen fund graph based on the final drop point address and the node hierarchy, and obtaining a tracking result of the current stolen fund based on the stolen fund graph, so that the problem that specific data related to the stolen fund cannot be efficiently and accurately screened and analyzed for a large amount of transaction data can be solved. And transactions related to the stolen funds cannot be accurately identified in a complex block chain transaction network.

Description

Technical Field

[0001] The present invention relates to the field of blockchain virtual currency, and in particular to a method for tracking the whereabouts of stolen funds on a blockchain based on blockchain transaction analysis. Background Art

[0002] With the widespread application and popularity of blockchain technology, its value has gradually become prominent. The market size of cryptocurrency has continued to expand, and the huge amount of money in its transaction process has also become the target of hacker attacks. Hackers stealing coins from exchanges, wallets and Dapps have occurred frequently. By tracking the flow of stolen funds, victims can recover their economic losses as much as possible. Tracking stolen funds can provide important clues for law enforcement agencies, help combat hacker crimes, and maintain social security and stability.

[0003] Existing illegal transaction analysis methods usually involve intervention from clues provided by victims, manual analysis, or analysis of specific levels based on pre-set illegal transaction business rules. However, this method has the following problems:

[0004] If there are many levels in the path of illegal funds, the flow of funds becomes more complicated and difficult to track as the number of levels increases. Each additional level of transfer may add more uncertainty and interference factors. In addition, a large number of levels may lead to the loss or ambiguity of information, and there may be some false transaction clues to mislead the analysis, or some key fund transfer nodes or important details are hidden in the layers of transactions, which are difficult to accurately identify, or are omitted or misinterpreted in the layers of transmission, making it impossible to obtain a complete information chain in the final analysis. In addition, the difficulty of analysis will also increase exponentially, and it will take a lot of time and energy to sort out and identify transactions at each level. During this period, misjudgments may occur or key links may be omitted, thus affecting the accuracy and comprehensiveness of the final conclusion. In actual situations, this will greatly hinder the work of law enforcement and regulatory departments, making it more difficult to locate and crack down on illegal funds;

[0005] Fund tracking analysis usually focuses more on value coins because they have higher liquidity and market value in the blockchain network. However, non-value coins may also be used for money laundering activities. Although they have lower market value, they can be converted and exchanged multiple times to conceal the source and destination of funds, making them more difficult to track and monitor. Usually for some non-value coins, these non-value coins are mixed with other assets through a series of complex transactions and transfers, and finally exchanged for legal currency or other value coins to achieve the purpose of money laundering. This method can make the source and destination of funds unclear, increasing the difficulty of tracking and investigation. Summary of the invention

[0006] In order to solve the problem that it is impossible to efficiently and accurately screen and analyze specific data related to stolen funds in the face of a large amount of transaction data, and it is impossible to accurately identify transactions related to stolen funds in a complex blockchain transaction network, the present invention provides a method for tracking the whereabouts of stolen funds on the chain based on blockchain transaction analysis, the method comprising: obtaining clues of stolen funds, parsing the stolen funds clues to obtain profit addresses and attack times; building a blockchain full node, parsing the transaction data on the blockchain full node based on the profit addresses and the attack time, and obtaining profit currencies and profit amounts; obtaining first transaction data on the blockchain full node, parsing the first The transaction data is parsed to obtain the transaction behavior and the transaction purpose; the first transaction data is parsed based on the transaction behavior, the transaction purpose and the profit address to obtain the node address; the address feature of the node address is obtained; based on the address feature, the node identity of the node address is determined; based on the node identity, a suspected hacker address is obtained, the node level of the suspected hacker address is marked, and the second transaction data after the suspected hacker address receives the stolen funds is parsed to obtain the final landing address; a stolen funds map is generated based on the final landing address and the node level, and the tracking result of the current stolen funds is obtained based on the stolen funds map.

[0007] The principle of the present invention is as follows: the hacker address and attack time are found according to the clue information, and then the transaction purpose of the relevant transaction is parsed according to the full node of the blockchain to find the node address, and the node identity of the node address is determined according to the address characteristics, and the suspected hacker address is continued to be tracked, and its level is marked, and then all addresses in the entire path are tracked, and a stolen funds transaction network map is constructed according to the above data, and specific data related to the stolen funds are efficiently and accurately screened and analyzed, and transactions related to the stolen funds are accurately identified in a complex blockchain transaction network, so that the flow of funds in the entire stolen funds network is clear at a glance, which can assist law enforcement agencies in identifying and analyzing the flow of funds for illegal transactions, control the flow of illegal funds, and improve the efficiency of solving cases.

[0008] Furthermore, the specific method of obtaining the first transaction data is: based on the transaction data on the full node of the blockchain, the preset transaction data of the first preset address is deleted to obtain the first transaction data. When parsing, irrelevant addresses such as the currency exchange contract address and the routing address are eliminated, and only the last token receiving address is retained, which can more efficiently and accurately screen and analyze specific data related to the stolen funds, and more accurately identify transactions related to the stolen funds.

[0009] Furthermore, the specific method of obtaining the transaction behavior and transaction purpose is: obtaining several transaction information of the first transaction data, obtaining the target address based on the currency and amount of each transaction information, judging the first identity of the target address based on the behavior characteristics, obtaining the transaction behavior based on the first identity, and obtaining the transaction purpose based on the transaction behavior, wherein the behavior characteristics include authorization characteristics, token exchange characteristics, receiving funds characteristics, transferring funds characteristics, transferring to the project party address characteristics, and cross-chain characteristics. The behavior and purpose of all hacker transactions are judged according to the behavior characteristics, such as authorization, token exchange, receiving funds, converting funds, transferring to the project party address, and cross-chain, etc., and each transaction information is identified and analyzed, which increases the accuracy of the identity identification of the transaction nodes of the stolen funds path, and facilitates the subsequent processing and analysis of the transaction data after aggregation.

[0010] Furthermore, the specific method of obtaining the final landing address is as follows: the flow direction of the stolen funds received in the second transaction data is parsed to obtain the flow path; based on the flow path, the suspected hacker address is searched until the first landing address with funds inflow but no funds outflow is obtained, or the second landing address where funds are transferred to the second preset address is obtained, and the final landing address is obtained based on the first landing address or the second landing address. By parsing the transactions after the suspected hacker address receives the stolen funds, the flow direction of the received stolen funds is found, and the suspected hacker address is searched according to the flow direction, and the final landing address with only funds inflow but no outflow is found, or the address transferred to the project party, exchange address or cross-chain bridge address for money laundering and cashing out is found, and finally the entire path of the hacker funds is found.

[0011] Furthermore, a specific method for finding a suspected hacker address is as follows: obtaining a path node address of the flow path, obtaining a path address feature of the path node address, determining a path node identity of the path node address based on the path address feature, obtaining a first suspected hacker address based on the path node identity, marking a path node level of the first suspected hacker address, parsing the flow direction of the stolen funds received in the third transaction data after the first suspected hacker address receives the stolen funds, obtaining a first flow path, and updating the flow path to the first flow path.

[0012] Furthermore, the path address feature and the address feature are obtained by adopting a feature obtaining method; the path node identity and the node identity determination method are both adopted by an identity determination method; the path node level and the node level are obtained by adopting a level obtaining method.

[0013] Furthermore, the feature acquisition method is as follows: obtain the transfer funds of the node address, calculate the first proportion of the transfer funds to the profit amount; based on the first preset time range, obtain the fund balance of the node address before the attack time occurs, and calculate the second proportion of the transfer funds to the fund balance; obtain the first transaction time, number of transactions and number of counterparties of the node address; obtain the address feature based on the first proportion, the second proportion, the first transaction time, the number of transactions and the number of counterparties. By mining and analyzing the stolen funds flow in combination with the address features, the outflow path of the funds transaction in the illegal case can be accurately extracted, and the node address of the illegal transaction funds flow on the chain can be effectively identified.

[0014] Furthermore, the identity identification method is as follows: if the first transaction time occurs after the attack time, the first proportion exceeds the first threshold, and the number of transactions and the number of counterparties are both within the preset range, then the node identity is determined to be a suspected hacker address; if the number of transactions and the number of counterparties both exceed the first threshold range, the second proportion is lower than the second threshold, the first transaction time occurs within the second preset time range, and the node address has transactions in each preset time interval within the third preset time range, then the node identity is determined to be the project party address; if the first proportion is lower than the third threshold or the second proportion is lower than the fourth threshold, then the node identity is determined to be an address with too low acceptance ratio. De-anonymization analysis is performed on the node address to distinguish the illegal addresses, making the flow of illegal funds clearer and improving the analysis and identification of the flow of illegal transaction funds by law enforcement agencies.

[0015] Since hackers often use complex fund splitting and aggregation, there will often be subsequent hacker addresses that transfer funds to the hacker addresses of the previous level through operations such as currency exchange and transfer. There will also be suspected hacker addresses at different levels that transfer funds to the same hacker address. In order to solve the above problems, the present invention determines the location of the addresses that appear in the subsequent fund map by confirming the address level.

[0016] Furthermore, the level acquisition method is: obtain the capital path of the suspected hacker address, mark the level of the suspected hacker address based on the capital path, and obtain the node level. The node addresses in the transaction network are marked in combination with the blockchain address label to enhance the accuracy of the illegal capital map, improve the accuracy of the solution results, and make the subsequent capital path map more complete, and the labeling of the node addresses with subsequent unknown labels is more accurate and more in line with the business scenario.

[0017] Furthermore, the specific method of generating the stolen funds map is as follows: constructing a label library, the label library includes several address labels; obtaining the stolen funds path based on the final landing address, the funds path and the flow path; generating the stolen funds map based on the label library, the stolen funds path and the node level. Constructing a stolen funds transaction network map makes the flow of funds in the entire stolen funds network clear at a glance, which can assist law enforcement agencies in identifying and analyzing the flow of funds for illegal transactions, controlling the flow of illegal funds, and improving the efficiency of solving cases.

[0018] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0019] 1. Find the hacker address and attack time based on the clue information, then parse the relevant transactions based on the blockchain full node, find the node address, determine the node identity of the node address based on the address characteristics, and then track all the addresses in the entire path. Build a stolen funds transaction network map based on the above data, so that the flow of funds in the entire stolen funds network is clear at a glance, which can assist law enforcement agencies in identifying and analyzing the flow of funds for illegal transactions, control the flow of illegal funds, and improve the efficiency of solving cases.

[0020] 2. Transaction identification and analysis are used to identify and analyze each transaction information, which increases the accuracy of identity recognition of transaction nodes in the stolen funds path. The stolen funds flow is mined and analyzed in combination with address characteristics, as well as the transaction purpose and node identity identification method. The outflow path of funds in illegal cases can be accurately extracted, and the node addresses of illegal transaction funds on the chain can be effectively identified. The node addresses are de-anonymized and analyzed to distinguish the illegal addresses, making the flow of illegal funds clearer and improving the analysis and identification of the flow of illegal funds by law enforcement agencies.

[0021] 3. Combine blockchain address labels to mark node addresses in the transaction network, enhance the accuracy of the illegal funds map, improve the accuracy of the solution results, and make the subsequent construction of the funds path map more complete. The labels of subsequent node addresses with unknown labels are more accurate and more in line with business scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of the present invention, and do not constitute a limitation on the embodiments of the present invention;

[0023] Figure 1 It is a flowchart of a method for tracking the whereabouts of stolen funds on the chain based on blockchain transaction analysis in the present invention;

[0024] Figure 2It is a simplified fund flow diagram of a method for tracking the whereabouts of stolen funds on the chain based on blockchain transaction analysis in the present invention, wherein a, b, c, d, e, f and g all represent transaction addresses, and A, B and C represent different currencies;

[0025] Figure 3 A schematic diagram of simple scenarios such as currency exchange in transaction analysis of a method for tracing the whereabouts of stolen funds on the chain based on blockchain transaction analysis in the present invention. DETAILED DESCRIPTION

[0026] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0027] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those within the scope of this description. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0028] Embodiment 1

[0029] refer to Figure 1-Figure 2 This embodiment provides a method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis, the method comprising:

[0030] Obtaining clues of stolen funds, analyzing the stolen funds clues to obtain the profit address and attack time; stolen funds clues refer to a series of information or signs that can lead or help discover the facts, evidence or solve the problem of stolen funds, which can come from clues provided by the police or clues provided by the victim;

[0031] Building a full blockchain node, parsing the transaction data on the full blockchain node based on the profit address and the attack time, and obtaining the profit currency and profit amount;

[0032] Obtaining first transaction data on the full node of the blockchain, parsing the first transaction data, and obtaining transaction behavior and transaction purpose, wherein transaction behavior refers to transaction activities between two addresses, such as currency exchange, receiving funds, transferring funds, and cross-chain, and transaction purpose refers to the goal or motivation for conducting the transaction;

[0033] The specific method of obtaining the first transaction data is: based on the transaction data on the full node of the blockchain, deleting the preset transaction data of the first preset address to obtain the first transaction data;

[0034] Among them, the specific method of obtaining the transaction behavior and the transaction purpose is: obtaining several transaction information of the first transaction data, obtaining the target address based on the currency and amount of each transaction information, judging the first identity of the target address based on the behavior characteristics, obtaining the transaction behavior based on the first identity, and obtaining the transaction purpose based on the transaction behavior. The behavior characteristics include authorization characteristics, token exchange characteristics, receiving funds characteristics, transferring funds characteristics, transferring to the project party address characteristics and cross-chain characteristics; the target address refers to the address related to each transaction information. In this embodiment, the authorization characteristics can be related characteristics for authorization control of the transaction, and the token exchange characteristics can be related characteristics for transferring the token to the project party. The features of the exchange of A tokens for other types of tokens, the receiving funds feature can be the relevant features of the receiving address receiving funds, the transferring funds feature can be the relevant features of transferring funds to other places, the transferring to the project party address feature can be the relevant features of transferring funds to the project party address, and the cross-chain feature can be the relevant features of directly circulating funds across the barriers between blockchains; if the target address converts part of A tokens into B tokens by calling the routing address of the currency exchange contract; then converts another part of A tokens into C tokens, then converts C tokens into B tokens, and finally converts B tokens into D tokens, then the purpose of the transaction is token conversion, converting A address into D coin;

[0035] The first transaction data is parsed based on the transaction behavior, the transaction purpose and the profit address to obtain a node address; the address feature of the node address is obtained; based on the address feature, the node identity of the node address is determined; based on the node identity, a suspected hacker address is obtained, the node level of the suspected hacker address is marked, and the second transaction data after the suspected hacker address receives the stolen funds is parsed to obtain the final landing address; the node address refers to the address into which the stolen funds first flow after flowing out of the profit address, the address feature refers to the feature related to the proportion of the amount of funds received by the node address, the transaction time and the transaction quantity, the node identity refers to the category of the node address, and the node level refers to the sequence number of the node address that first appears in the funds outflow path;

[0036] The specific method for obtaining the final landing address is as follows: the flow direction of the stolen funds received in the second transaction data is parsed to obtain the flow path; based on the flow path, a suspected hacker address is searched until a first landing address with funds flowing in but not flowing out is obtained, or a second landing address where funds are transferred to a second preset address is obtained, and the final landing address is obtained based on the first landing address or the second landing address; in this embodiment, the second preset address may be a project party address, an exchange address, or a cross-chain bridge address;

[0037] Among them, the specific method of finding the suspected hacker address is: obtaining the path node address of the flow path, obtaining the path address feature of the path node address, determining the path node identity of the path node address based on the path address feature, obtaining a first suspected hacker address based on the path node identity, marking the path node level of the first suspected hacker address, parsing the flow direction of the stolen funds received in the third transaction data after the first suspected hacker address receives the stolen funds, obtaining a first flow path, and updating the flow path to the first flow path; the path node address refers to the address where funds flow in or out of the outflow path, the path address feature refers to the feature related to the proportion of the amount of funds received by the path node address, the transaction time and the transaction amount, the path node identity refers to the category of the path node address, and the path node level refers to the sequence number of the path node address that first appears in the outflow path;

[0038] Among them, the path address feature and the address feature are both obtained by a feature acquisition method; the feature acquisition method is: obtain the transfer funds of the node address, and calculate the first proportion of the transfer funds to the profit amount; based on the first preset time range, obtain the fund balance of the node address before the attack time occurs, and calculate the second proportion of the transfer funds to the fund balance; obtain the first transaction time, the number of transactions and the number of counterparties of the node address; obtain the address feature based on the first proportion, the second proportion, the first transaction time, the number of transactions and the number of counterparties. The number of counterparties refers to the number of other parties who conduct transactions with the node address.

[0039] The identification methods of the path node identity and the node identity both adopt the identity identification method; the identity identification method is: if the first transaction time occurs after the attack time, the first proportion exceeds the first threshold, and the number of transactions and the number of trading counterparties are both within the preset range, then the node identity is determined to be a suspected hacker address; if the number of transactions and the number of trading counterparties both exceed the first threshold range, the second proportion is lower than the second threshold, the first transaction time occurs within the second preset time range, and the node address has transactions in each preset time interval within the third preset time range, then the node identity is determined to be the project party address; if the first proportion is lower than the third threshold or the second proportion is lower than the fourth threshold, then the node identity is determined to be an address with too low acceptance ratio.

[0040] For example: the first transaction time of the stolen funds receiving address is after the attack time, the proportion of transferred funds to the entire stolen funds exceeds a certain threshold, the number of transactions and the number of counterparties are within the set threshold range, the stolen funds receiving address is identified as a suspected hacker address, and the part of the funds transferred to this address continues to be tracked; the number of transactions and the number of counterparties of the stolen funds receiving address exceed the threshold range, the proportion of transferred funds to the balance of the stolen funds receiving address before the attack time is lower than the threshold, the first transaction time of the stolen funds receiving address is early, and there have been transactions recently, which is equivalent to throwing part of the money into a large pool. The stolen funds receiving address is considered to be the project party address, and this type of address will no longer be tracked; the proportion of transferred funds to the balance of the stolen funds receiving address before the attack time is too low or the proportion of the entire stolen funds at the transfer point is lower than the threshold, the stolen funds receiving address is considered to be an address with too low receiving ratio, and this type of address will no longer be tracked.

[0041] The path node level and the node level are both obtained by a level obtaining method; the level obtaining method is: obtaining the capital path of the suspected hacker address, marking the level of the suspected hacker address based on the capital path, and obtaining the node level.

[0042] A stolen funds map is generated based on the final landing address and the node level, and a tracking result of the current stolen funds is obtained based on the stolen funds map.

[0043] like Figure 2 , point a is the hacker's first profit address, which can be marked as level 1. The following addresses are sorted in order of first appearance. According to the capital relationship connection line of the address, the hacker address splits the profit funds to points b, c, d and e, and then the subsequent addresses transfer the funds to the exchange or money laundering platform through a series of operations for confusion, and some funds will also be deposited on a certain address. Among them, the specific generation method of the stolen funds map is: construct a label library, the label library includes several address labels; obtain the stolen funds path based on the final landing address, the capital path and the flow path; generate the stolen funds map based on the label library, the stolen funds path and the node level.

[0044] Embodiment 2

[0045] refer to Figure 3 , this figure is a classic scenario of fund conversion and transfer, Figure 3 The upper part of the picture shows the exchange of coins and the transfer of funds. The router contract refers to a contract used in blockchain development, which records transaction information routed through the blockchain network; the lower part of the picture shows one or more exchanges of different currencies.

[0046] The stolen funds are transferred to themselves or multiple different addresses through currency swap contracts or cross-chain bridge contracts after one or more exchange transfers. By analyzing the exchange and transfer of internal currencies, the intermediate currency swap contract addresses are filtered out, and the final funds stay address is found. Based on the label library data and address characteristics, it is determined whether this funds stay address needs to be further mined and tracked.

[0047] Construct and analyze address features, find the address where funds stay through transaction analysis, that is, the address that receives hacker funds (i.e., the path node address), and determine whether the path node address needs to be further mined based on the proportion of the currency amount received by the receiving address to the total illegal funds, the proportion of the received currency amount to the historical amount received by the receiving address, the number and amount of transactions of the receiving address before and after the attack, and other features.

[0048] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0049] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis, characterized in that: The method comprises: Obtaining stolen funds clues, parsing the stolen funds clues to obtain the profit address and attack time; Building a full blockchain node, parsing the transaction data on the full blockchain node based on the profit address and the attack time, and obtaining the profit currency and profit amount; Obtaining first transaction data on the full node of the blockchain, parsing the first transaction data, and obtaining transaction behavior and transaction purpose; The first transaction data is parsed based on the transaction behavior, the transaction purpose and the profit address to obtain a node address; the address feature of the node address is obtained; based on the address feature, the node identity of the node address is determined; based on the node identity, a suspected hacker address is obtained, the node level of the suspected hacker address is marked, and the second transaction data after the suspected hacker address receives the stolen funds is parsed to obtain the final landing address; A stolen funds map is generated based on the final landing address and the node level, and a tracking result of the current stolen funds is obtained based on the stolen funds map.

2. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis according to claim 1, characterized in that: The specific method of obtaining the first transaction data is: Based on the transaction data on the full node of the blockchain, the preset transaction data of the first preset address is deleted to obtain the first transaction data.

3. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis according to claim 2, characterized in that: The specific methods of obtaining transaction behavior and transaction purpose are: Acquire several pieces of transaction information of the first transaction data, obtain the target address based on the currency and amount of each piece of the transaction information, determine the first identity of the target address based on behavioral characteristics, obtain the transaction behavior based on the first identity, and obtain the transaction purpose based on the transaction behavior, wherein the behavioral characteristics include authorization characteristics, token exchange characteristics, fund receiving characteristics, fund transfer characteristics, transfer to project party address characteristics, and cross-chain characteristics.

4. According to claim 1, a method for tracking the whereabouts of stolen funds on the chain based on blockchain transaction analysis is characterized in that: The specific method of obtaining the final landing address is: The flow direction of the stolen funds received in the second transaction data is parsed to obtain a flow path; based on the flow path, a suspected hacker address is searched until a first landing address with capital inflow but no capital outflow is obtained, or a second landing address where funds are transferred to a second preset address is obtained, and the final landing address is obtained based on the first landing address or the second landing address.

5. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis according to claim 4, characterized in that: The specific method to find suspected hacker addresses is: Obtain a path node address of the flow path, obtain a path address feature of the path node address, determine a path node identity of the path node address based on the path address feature, obtain a first suspected hacker address based on the path node identity, mark the path node level of the first suspected hacker address, parse the flow direction of the stolen funds received in the third transaction data after the first suspected hacker address receives the stolen funds, obtain a first flow path, and update the flow path to the first flow path.

6. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis according to claim 5, characterized in that: The path address feature and the address feature are both obtained in a feature obtaining manner; The identification methods of the path node identity and the node identity both adopt the identity identification method; The path node level and the node level are both obtained by using a level obtaining method.

7. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis according to claim 6, characterized in that: The feature acquisition method is: Obtain the transferred funds of the node address, and calculate the first proportion of the transferred funds to the profit amount; based on the first preset time range, obtain the fund balance of the node address before the attack time occurs, and calculate the second proportion of the transferred funds to the fund balance; obtain the first transaction time, number of transactions, and number of counterparties of the node address; The address feature is obtained based on the first proportion, the second proportion, the first transaction time, the number of transactions and the number of transaction counterparties.

8. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis according to claim 7, characterized in that: The identity determination method is: If the first transaction time occurs after the attack time, the first proportion exceeds the first threshold, and the number of transactions and the number of counterparties are both within a preset range, the node is determined to be a suspected hacker address; If the number of transactions and the number of counterparties both exceed the first threshold range, the second proportion is lower than the second threshold, the first transaction time occurs within the second preset time range, and the node address has transactions in each preset time interval within the third preset time range, then the node identity is determined to be the project party address; If the first proportion is lower than the third threshold or the second proportion is lower than the fourth threshold, the node identity is determined to be an address with too low acceptance ratio.

9. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis according to claim 8, characterized in that: The levels are obtained as follows: The capital path of the suspected hacker address is obtained, and the level of the suspected hacker address is marked based on the capital path to obtain the node level.

10. A method for tracking the whereabouts of stolen funds on the blockchain based on blockchain transaction analysis according to claim 6, characterized in that: The specific method of generating the stolen funds map is as follows: Building a label library, wherein the label library includes a plurality of address labels; Obtaining a stolen funds path based on the final landing address, the funds path, and the flow path; The stolen funds graph is generated based on the tag library, the stolen funds path and the node hierarchy.

Images