Fishing fraud detection method, device and product for on-chain transaction data

Abstract

The invention discloses a phishing fraud detection method, device and product for on-chain transaction data, and the method comprises the steps: firstly crawling all transactions in an Ethereum database, and crawling a phishing account address in a data website Etherscan authorized by the Ethereum; and then a related screening rule is made according to the phishing account address, so that most useless data is filtered out, and the problem of class imbalance is relieved. Generating a time sequence diagram and learning the time sequence diagram, combining the extracted statistical features and depth features of the nodes in the transaction diagram as node representation, and synthesizing the node representation of the source node and the node representation of the target node to form edge representation; and finally, classifying phishing fraud transactions and normal transactions by adopting a LightGBM binary classifier. According to the method, the advantages of the graph neural network in the aspect of processing graph structure data are utilized, complex time and space dependence of the Ethereum transaction network is captured, challenges in an existing decentralized environment are solved, and the method becomes an important tool for detecting Ethereum phishing transactions.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain information security technology, and designs a phishing fraud detection method, device and product for on-chain transaction data, and specifically relates to a phishing fraud detection method, device and product for on-chain transaction data based on a time-series graph neural network. Background Art

[0002] In the past few years, blockchain technology has been widely used in various industries, such as cryptocurrency, intellectual property, Internet of Things, financial services, etc. As a distributed and trusted data storage technology, blockchain has the characteristics of decentralization, tamper-proof, traceability, and scalability, which can ensure the authenticity and security of data records. In addition, blockchain technology solves the problem of distrust between individuals and can generate trust in the network without the need for a trusted third party. Benefiting from these characteristics, blockchain technology is even regarded as another revolutionary innovation technology after the Internet, which will change the mode of social value delivery and the operating logic of the industry.

[0003] As the largest blockchain platform supporting smart contracts and the second largest digital currency platform, Ethereum's anonymity and unsupervised mechanism achieve the advantages of decentralization, but also amplify the security risks of encrypted assets. At the same time, the rapid development of Ethereum also makes it inevitable that there are various cyber crimes, such as smart contract Ponzi schemes, black market transactions, and phishing frauds. Among them, phishing fraud is one of the main threats to transaction security. Therefore, detecting and preventing phishing fraud on Ethereum has become a crucial research topic.

[0004] Unlike traditional online fraud, Ethereum phishing fraud uses a variety of methods to implement, and the content with phishing information is also spread in a variety of forms. There are significant differences in the following aspects. First, the targets of the two are different. The target of Ethereum phishing fraud is not the real legal currency, but the token of Ethereum, namely Ether. The phishing organization illegally obtains Ether and then trades it for the real legal currency. Second, the methods of the two are different. Traditional phishing fraud usually sets up fake websites or software to collect sensitive information, while phishing fraud on Ethereum often takes various methods to spread phishing addresses and induce ordinary users to transfer money to designated accounts. Third, the characteristics of the two are different. In Ethereum, users cannot confirm their identities through sensitive information, but can only be identified through public keys. Therefore, traditional detection methods cannot effectively identify the new patterns of Ethereum phishing fraud, and new detection methods need to be designed based on the characteristics of Ethereum. In Ethereum, transaction records are publicly visible, which provides a new data source for phishing detection. Phishing fraud on Ethereum can be detected by analyzing Ethereum account tags and transaction records.

[0005] Traditional machine learning methods focus on statistical features and rely mainly on expertise to extract manually designed features. In 2017, Robert et al. used statistical features extracted from contract code to cluster the bytecode of contracts using the K-medids algorithm to classify unknown contracts. In 2019, Jung et al. used data mining to obtain the code features and behavioral features of smart contracts, and used this to provide 0-day and full-featured detection models. In 2020, Chen et al. used a graph-based cascade feature extraction method in the transaction graph to extract 219 dimensions of statistical features from the first-order and second-order neighbors of nodes, and used a double sampling ensemble machine learning algorithm based on lightGBM to identify phishing nodes.

[0006] Most of the current work uses graph network representation methods, which can make full use of the node information and edge information of the transaction graph. Some scholars apply some network embedding methods. In 2020, Wu et al. considered the transaction volume and timestamp of the graph, and introduced a new network embedding algorithm Trans2vec based on Node2vec, which can optimize the sampling process of the graph and extract the features of the nodes more effectively. In 2020, Yuan et al. used the network embedding method Node2vec to extract the potential features of the account and used a single-class support vector machine (One Class SVM) for classification. Some scholars combined the graph neural network algorithm. In 2021, Tan et al. proposed to record the transaction volume and the structural features of the transaction network through the quantity-based Node2vec algorithm, and use the graph convolutional network GCN model to classify the addresses in the transaction network. In 2021, Zhou et al. used a graph data enhancement strategy to generate subgraphs, and then used the subgraph comparison process to learn the correlation of account subgraphs in different views, and finally jointly trained the subgraph comparison and account classification tasks to achieve account identity inference. In 2022, Li et al. used a temporal transaction aggregation graph network to learn transaction features from the temporal edge representation and Edge2node module, structural features from the structural enhancement module, and statistical features from nodes, and then classified them using the LightGBM classifier algorithm.

[0007] The main challenges in studying the problem of phishing fraud detection in on-chain transaction data are as follows: First, Ethereum transactions are large in scale and transaction data is large, but there are few labels for accounts or transactions; second, past research has proven the effectiveness of transaction networks in phishing fraud detection. However, these works have the following three problems:

[0008] (1) Traditional machine learning methods are rule-based and only use artificially designed features to represent nodes, which results in weak node representation capabilities and limited detection effects;

[0009] (2) Most research works only focus on a single transaction and completely ignore past transaction records, which means that these research works rarely use the time information of transactions and therefore cannot capture the complete edge representation;

[0010] (3) A small number of works have added algorithms for time information, but these algorithms ignore the continuity of time information and do not update nodes in real time. At the same time, if a node does not interact with other nodes for a long time, the node representation will become outdated and cannot meet the real-time and accuracy requirements of node representation. Summary of the invention

[0011] In order to solve the above problems, the present invention proposes a method, device and product for detecting phishing fraud of on-chain transaction data based on a time-series graph neural network.

[0012] The technical solution adopted by the method of the present invention is: a phishing fraud detection method for on-chain transaction data, comprising the following steps:

[0013] Step 1: Obtain the account addresses of both parties in the on-chain transaction to be identified, obtain the transactions related to the two addresses, and form a first-order subgraph; further obtain the transactions related to the first-order subgraph address to form a second-order subgraph; wherein the related transactions include all transactions as source nodes and target nodes, and the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between the first-order neighbors and the second-order neighbors;

[0014] Step 2: Preprocess the nodes, edges and related data of the second-order subgraph in turn;

[0015] Step 3: Extract the statistical features of the nodes, including transaction data features and graph structure features, and generate a time series graph;

[0016] Step 4: Extract the deep features of the nodes based on the temporal graph neural network;

[0017] Step 5: Input the deep features of the node into the binary classifier of the LightGBM algorithm to learn and determine whether the transaction is a phishing fraud transaction.

[0018] Preferably, in step 2, first, the 40-bit hexadecimal data of each node address is re-encoded as a number, starting from 0, and the edge number is reset to start from 0; then, the timestamp "year-month-day T hour: minute: second" is formatted as a number, and then the smallest timestamp in the transaction graph is subtracted to represent the time starting from 0; finally, the data of the transaction fields value and gas are standardized, and the mean μ and standard deviation σ of the original data are calculated; for each data point x, its standardized value z = (x-μ) / σ is calculated.

[0019] Preferably, in step 3, the transaction data features include in-degree, out-degree, total degree, inbound transaction amount, outbound transaction amount, sum of transaction amounts, total number of neighbors, inverse of transaction frequency, percentage of neighbors with all zero transactions, and number of transactions with the most frequently traded neighbors;

[0020] The graph structural features include in-degree centrality, out-degree centrality, degree centrality, average neighbor degree, page rank, average clustering coefficient, eccentricity and number of simple paths.

[0021] Preferably, in step 4, the time-series graph-based neural network includes a time encoding module, an aggregated historical node representation module, an aggregated neighbor node representation module, an aggregated node statistical feature module and a comparative learning module.

[0022] The time encoding module includes a time encoding function that can project 1-dimensional time into d t A temporal representation of the dimension, where the parameters defined are learnable parameters.

[0023] The aggregated historical node representation module includes three key functions: message function, aggregation function and memory function. In the message function, for each transaction, the source node feature, target node feature, edge feature and time code are concatenated to form a transaction message, whose dimension is d m +d m +d e +d t , where d m is the node memory dimension, d e is the edge feature dimension, d t is the time representation dimension; in the aggregation function, for multiple messages of a node, multiple messages can be merged into one message by average aggregation or latest aggregation; in the memory function, the GRU model is used for learning and memory, the input is the message, the output is the node memory representation, and the GRU receives d m +d m +d e +d t dimension message and update d m Dimensional node memory representation, that is, node history representation.

[0024] The aggregated neighbor node representation module is composed of multiple layers of time-series graph attention layers, where the input of the latter layer is the output of the previous layer, and the input of the first layer is the node history representation. For the time-series graph attention layer, firstly, the attention scores of the source node features, edge features (for the convenience of calculation, the time code is spliced ​​in the edge features) and target node features are calculated in turn based on the multi-head attention mechanism, which are e l 、e e and e r, all three dimensions are mapped to d n *heads, where d n is the dimension for the final node neighbor aggregation representation, and heads is the number of heads. Then, the e of each transaction is l 、e e and e r Add them together, and we have e le =e l +e e ,e ler =e le +e r , through the activation function leaky_relu to aggregate the result e ler Activate and normalize the attention score to the attention weight through softmax. Then, recalculate e based on the attention weight le , and then for each node, based on the e of its neighboring nodes le Finally, a fully connected layer is used to map the attention output into a node neighbor aggregation representation with a dimension of d. n .

[0025] The node statistical feature aggregation module includes a two-layer fully connected layer. First, the first layer maps the node statistical features into d s Then concatenate it with the node neighbor aggregation representation in the previous step to get d s +d n Finally, the second fully connected layer maps the vector representation to d d Dimensional node deep feature representation.

[0026] The contrastive learning module includes three parts: encoder, mapper and contrastive learning. The encoder consists of four modules: time encoding module, aggregated historical node representation module, aggregated neighbor node representation module and aggregated node statistical feature module. The mapper consists of a two-layer fully connected layer. Contrastive learning is to randomly destroy the original graph to generate the enhancer. Figure 1 Kazuko Figure 2 On the basis of, the node representation is obtained by the encoder respectively, and the node representation is further mapped to the projection space by the mapper to maximize the consistency of the node representation between the two graphs for comparative learning.

[0027] Preferably, the specific implementation of step 4 includes the following sub-steps:

[0028] Step 4.1: Use the time encoding function Map time t to a continuously differentiable function φ d (t), the time series information is used as a feature to learn in the graph neural network. The calculation formula is as follows:

[0029]

[0030] Among them, time t is projected into a feature representation of dimension 2d, φ i is the parameter to be learned, i∈{1,…,d};

[0031] Step 4.2: Aggregate historical node representations;

[0032] For each node i at time t, use the vector s i (t) represents its memory state, i.e., the historical interaction record of the node; the memory of a new node is initialized to a zero vector and then dynamically updated for each transaction involving the new node; for transaction e ij (t), that is, when a transaction occurs between source node i and target node j at time t, the memory of the two nodes will be updated respectively. The two messages are calculated as follows:

[0033] m i (t) = msg s (s i (t - ),s j (t - ),Δt,e ij (t));

[0034] m j (t) = msg d (s j (t - ),s i (t - ),Δt,e ij (t)(;

[0035] Among them, s i (t - ),s j (t - ) represent the memory of nodes i and j before time t, msg s With msg d It is a learnable message function, which is implemented by direct concatenation. Δt is the time difference between this transaction and the previous one.

[0036] Batch processing involves multiple transactions m involving the same node i in the same batch i (t 1 ), …, m i (t b ), the calculation formula is as follows:

[0037]

[0038] Among them, t 1 ,…,tb <t; The agg represents an aggregation function, which is implemented by aggregating the latest message or the average message.

[0039] Subsequently, processing each transaction involving the node itself will update the node's memory, and the calculation formula is as follows:

[0040]

[0041] Among them, mem represents the memory function, which is implemented by the GRU model.

[0042] Step 4.3: Adopt the temporal graph attention mechanism to learn the node representation by aggregating the neighbor node information and the temporal information;

[0043] The hidden representation of node i at time t in layer l is The input is the timestamp t, the neighbor node information at layer l - 1 and the feature e i1 (t 1 ), …, e iN (t N ). The formula for obtaining the node embedding is as follows:

[0044]

[0045] K (l) (t) = V (l) (t) = C (l) (t);

[0046]

[0047] Among them, || is the concatenation operator, and φ is the time encoding; Q (l) (t) is a reference node, that is, one of the target node or its l - 1 hop neighbors; K (l) (t) and V (l) (t) are its neighbors; N is the number of neighbor nodes of node i;

[0048] Step 4.4: Use the feed - forward neural network to combine the reference node representation with the aggregated information;

[0049]

[0050] Among them, h i (t) is the node depth feature representation, is the node neighbor aggregation representation, is the node statistical data feature;

[0051] Step 4.5: Learn the node representation by maximizing the consistency of the node representation between the two graphs and optimize the model parameters using contrastive loss to obtain more robust node deep features;

[0052] First, by destroying the original transaction graph G, two subgraphs G are generated 1 and G 2 ; Then the encoder is used to obtain the node representation of the subgraph, which are recorded as U and V respectively; then the nodes between views are compared according to their consistency. For any node v i , which generates the embedding u in a view i Treated as anchor embeddings, the node embedding v generated in another view i is a positive sample, except v in the two views i Nodes other than are regarded as negative samples;

[0053]

[0054] in, Represents the paired targets of the corresponding nodes of the two views; θ(u,v)=s(g(u),g(v)) represents the cosine similarity distance, s is the cosine similarity, g is the nonlinear projection, which can improve the expression ability of the comparison; is the indicator function, which takes the value of 1 when k≠i and 0 otherwise; τ is the temperature parameter;

[0055] The overall objective function is:

[0056]

[0057] Among them, the destruction of the original graph is achieved by randomly deleting some edges and randomly shielding some node features;

[0058] The random deletion of some edges first samples a random masking matrix Each element in the matrix is ​​generated according to Bernoulli distribution; if A ij =1, then the element values ​​in the matrix come from Bernoulli distribution otherwise where p r is the probability of each edge being deleted; then the resulting adjacency matrix is: Where (x°y) u =x u y i represents the Hadamard product;

[0059] The random masking of some node features firstly performs random vector The sampling is performed, where each dimension value is independently selected from the probability 1-p m The Bernoulli distribution is extracted, that is, Then, the generated node features Where [·;] represents the concatenation operation, (x°y) u =x u y i Represents the Hadamard product.

[0060] Preferably, the time-series graph neural network is a trained network; during training, the memory module and the original information are initialized; then a loop is entered to obtain the transaction graph of each batch of training sets in turn, randomly destroy its edges and features and generate two enhanced subgraphs; then, the information is calculated and the information of the same nodes is aggregated to obtain the updated memory; then, the time-series graph attention mechanism is used to obtain the node embeddings of the two subgraphs respectively; after obtaining the node embeddings, the loss function is calculated by the contrastive learning algorithm at the subgraph node level, and the model parameters are updated by back propagation; finally, the original information is calculated and saved, and the updated memory is saved.

[0061] The technical solution adopted by the device of the present invention is: a phishing fraud detection device for on-chain transaction data, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the phishing fraud detection method for on-chain transaction data when executing the program.

[0062] The technical solution adopted by the product of the present invention is: a phishing fraud detection product for on-chain transaction data, including a computer program, which implements the phishing fraud detection method for on-chain transaction data when executed by a processor.

[0063] Compared with the prior art, the beneficial effects of the present invention include:

[0064] (1) The present invention combines node statistical features and node depth features obtained based on a time-series dynamic graph model to form a node representation, making full use of the transaction information, structural features and statistical features in the transaction network, thereby improving the accuracy of the model.

[0065] (2) The present invention combines the continuous dynamic graph algorithm to extract the transaction features of the transaction network, draws on the existing contrastive learning algorithm to improve the calculation of the loss function, effectively mines the time information of the transaction network and enriches the representation of nodes and edges.

[0066] (3) The present invention utilizes the advantages of graph neural networks in processing graph structured data, captures the complex temporal and spatial dependencies of the Ethereum transaction network, and solves the challenges in the existing decentralized environment, making it an important tool for detecting Ethereum phishing transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0068] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0069] Figure 2 A network structure diagram of an embodiment of the present invention;

[0070] Figure 3 A flowchart of the aggregation history node representation of an embodiment of the present invention;

[0071] Figure 4 A flow chart showing the aggregation of neighbor nodes according to an embodiment of the present invention;

[0072] Figure 5 The figure is a flow chart of comparative learning according to an embodiment of the present invention. DETAILED DESCRIPTION

[0073] In order to facilitate ordinary technicians in the field to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0074] According to research, the transaction graph can represent the accounts and transaction records on Ethereum, and the increase in the number of transactions on Ethereum means the update of graph nodes and edges. Therefore, by adding time attributes to the transaction graph, the direction, time, amount and other information of the transaction can be fully utilized through continuous dynamic graphs, effectively improving Ethereum's phishing fraud detection capabilities. The key idea of ​​the present invention is to use a method based on dynamic graph learning to represent blockchain transaction data and capture the ever-changing complex interaction patterns of the Ethereum transaction network. By predicting whether the next transaction has a phishing risk, the present invention can identify phishing nodes and prevent phishing transactions, which can recover huge economic losses.

[0075] This embodiment defines Ethereum transaction network phishing fraud detection as a graph node and edge classification problem. Based on Ethereum transaction records, a transaction network G = (V, E) is constructed, where V represents the node set, i.e., the Ethereum account address set, and e represents the edge set in the transaction network, i.e., the transaction record set based on Ethereum. A partially labeled Ethereum transaction network is obtained from it. Time matrix Where T represents the timestamp set. Edge feature matrix Where S represents the size of the feature space of each edge. Label matrix Where Y represents the label set. LLearn node embedding features Where d represents the dimension of feature representation. The classifier f:V→Y learns and predicts X through the training data set E The relationship between f(v) and Y is to predict whether the transaction is a phishing fraud transaction. In the phishing fraud identification scenario, f is a binary classifier, and Y contains two types of labels, y∈Y={1,0}, where 0 represents a normal transaction label and 1 represents a suspected fraudulent transaction label. Therefore, when f(v)=1, v is defined as an abnormal transaction; otherwise, v is defined as a normal transaction.

[0076] like Figure 1 As shown, this embodiment provides a phishing fraud detection method for on-chain transaction data. First, all transactions are crawled in the Ethereum database, and phishing account addresses are crawled in Etherscan, a data website authorized by Ethereum. Then, relevant screening rules are formulated according to the phishing account addresses to filter out most of the useless data and alleviate the problem of class imbalance. Next, the timing graph is generated and the timing graph is learned. The statistical features and deep features of the nodes in the extracted transaction graph are combined as node representations, and the node representations of the source nodes and the target nodes are combined to form edge representations. Finally, the LightGBM binary classifier is used to classify phishing fraud transactions and normal transactions.

[0077] The specific steps include:

[0078] Step 1: Obtain the account addresses of both parties in the on-chain transaction to be identified, obtain the transactions related to the two addresses, and form a first-order subgraph; further obtain the transactions related to the first-order subgraph address to form a second-order subgraph; wherein the related transactions include all transactions as source nodes and target nodes, and the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between the first-order neighbors and the second-order neighbors;

[0079] In one embodiment, the account addresses of both parties in the on-chain transaction to be identified are obtained, and then the API for crawling Ethereum transactions is called to obtain transactions related to the two addresses (including all transactions as source nodes and target nodes) to form a first-order subgraph. Similarly, the API for crawling Ethereum transactions is called again to obtain transactions related to the first-order subgraph address (including all transactions as source nodes and target nodes) to form a second-order subgraph. Among them, the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between the first-order neighbors and the second-order neighbors;

[0080] The specific algorithm is shown in Algorithm 1.

[0081]

[0082]

[0083] Step 2: Preprocess the nodes, edges and related data of the second-order subgraph in turn;

[0084] In one embodiment, the second-order subgraph data is preprocessed, and the nodes, edges, and related data are processed in turn. First, the 40-bit hexadecimal data of each node address is re-encoded as a number, starting from 0, and the sequence number of the edge is reset to start from 0. Next, the timestamp "year-month-day T hour: minute: second" is formatted as a number, and then the smallest timestamp in the transaction graph is subtracted to represent the time starting from 0. Finally, the data of the transaction fields value and gas are standardized, and the mean μ and standard deviation σ of the original data are calculated; for each data point x, its standardized value z = (x-μ) / σ is calculated.

[0085] Step 3: Extract the statistical features of the nodes, including transaction data features and graph structure features, and generate a time series graph;

[0086] In one embodiment, statistical features of nodes are extracted, including transaction data features and graph structure features. The transaction features have 10 dimensions, including in-degree, out-degree, total degree, inbound transaction amount, outbound transaction amount, sum of transaction amounts, total number of neighbors, inverse of transaction frequency, percentage of neighbors with all zero transactions, and number of transactions with the most frequent neighbors. The graph structure features have 8 dimensions, including in-degree centrality, out-degree centrality, degree centrality, average neighbor degree, page rank, average clustering coefficient, eccentricity, and number of simple paths.

[0087] Step 4: Extract the deep features of the nodes based on the temporal graph neural network;

[0088] In one embodiment, Figure 2 As shown, the time-series graph-based neural network includes a time encoding module, an aggregated historical node representation module, an aggregated neighbor node representation module, an aggregated node statistical feature module and a comparative learning module.

[0089] The time encoding module includes a time encoding function that can project 1-dimensional time into d t A temporal representation of the dimension, where the parameters defined are learnable parameters.

[0090] The aggregated historical node representation module includes three key functions: message function, aggregation function and memory function. In the message function, for each transaction, the source node feature, target node feature, edge feature and time code are concatenated to form a transaction message, whose dimension is d m +d m +d e +d t , where d m is the node memory dimension, d eis the edge feature dimension, d t is the time representation dimension; in the aggregation function, for multiple messages of a node, multiple messages can be merged into one message by average aggregation or latest aggregation; in the memory function, the GRU model is used for learning and memory, the input is the message, the output is the node memory representation, and the GRU receives d m +d m +d e +d t dimension message and update d m Dimensional node memory representation, that is, node history representation.

[0091] The aggregated neighbor node representation module is composed of multiple layers of time-series graph attention layers, where the input of the latter layer is the output of the previous layer, and the input of the first layer is the node history representation. For the time-series graph attention layer, firstly, the attention scores of the source node features, edge features (for the convenience of calculation, the time code is spliced ​​in the edge features) and target node features are calculated in turn based on the multi-head attention mechanism, which are e l 、e e and e r , all three dimensions are mapped to d n *heads, where d n is the dimension for the final node neighbor aggregation representation, and heads is the number of heads. Then, the e of each transaction is l 、e e and e r Add them together, and we have e le =e l +e e ,e ler =e le +e r , through the activation function leaky_relu to aggregate the result e ler Activate and normalize the attention score to the attention weight through softmax. Then, recalculate e based on the attention weight le , and then for each node, based on the e of its neighboring nodes le Finally, a fully connected layer is used to map the attention output into a node neighbor aggregation representation with a dimension of d. n .

[0092] The node statistical feature aggregation module includes a two-layer fully connected layer. First, the first layer maps the node statistical features into d s Then concatenate it with the node neighbor aggregation representation in the previous step to get d s +d n Finally, the second fully connected layer maps the vector representation to d dDimensional node deep feature representation.

[0093] The contrastive learning module includes three parts: encoder, mapper and contrastive learning. The encoder consists of four modules: time encoding module, aggregated historical node representation module, aggregated neighbor node representation module and aggregated node statistical feature module. The mapper consists of a two-layer fully connected layer. Contrastive learning is to randomly destroy the original graph to generate the enhancer. Figure 1 Kazuko Figure 2 On the basis of, the node representation is obtained by the encoder respectively, and the node representation is further mapped to the projection space by the mapper to maximize the consistency of the node representation between the two graphs for comparative learning.

[0094] In one implementation, the specific implementation of step 4 includes the following sub-steps:

[0095] Step 4.1: The TGAT algorithm derives a temporal coding technique from Bochner theory that can use the time coding function Map time t to a continuously differentiable function φ d (t). The present invention applies the time series coding technology to the model to learn the time series information as a feature in the graph neural network. The calculation formula is as follows:

[0096]

[0097] Among them, time t is projected into a feature representation of dimension 2d, ω i is the parameter to be learned, i∈{1,…,d};

[0098] Step 4.2: Aggregate historical node representations;

[0099] like Figure 3 As shown, for each node i at time t, use vector s i (t) represents its memory state, i.e., the historical interaction record of the node; the memory of a new node is initialized to a zero vector and then dynamically updated for each transaction involving the new node; for transaction e ij (t), that is, when a transaction occurs between source node i and target node j at time t, the memory of the two nodes will be updated respectively. The two messages are calculated as follows:

[0100] m i (t) = msg s (s i (t - ),s j (t - ),Δt,e ij (t));

[0101] m j(t) = msg d (s j (t - ), s i (t - ), Δt, e ij (t));

[0102] Among them, s i (t - ), s j (t - ) respectively represent the memories of nodes i and j before time t, msg s and msg d are message functions, implemented by direct concatenation, and Δt is the time difference between this transaction and the previous one;

[0103] In batch processing, multiple transactions m i (t 1 ), …, m i (t b ) of the same node i in the same batch are involved, and they are aggregated using the latest message or the average message. The calculation formula is as follows:

[0104]

[0105] Among them, t 1 , …, t b < t; agg represents the aggregation function, which is implemented by aggregating the latest message or the average message.

[0106] Subsequently, processing each transaction involving the node itself will update the node's memory. The calculation formula is as follows:

[0107]

[0108] Among them, mem represents the memory function, which is implemented using the GRU model.

[0109] Step 4.3: Adopt the temporal graph attention mechanism to learn node representations by aggregating neighbor node information and temporal information;

[0110] As Figure 4 shown, the hidden representation of node i at time t in layer l is The input is the timestamp t, the neighbor node information at layer l - 1 and the feature e i1 (t 1 ), …, e iN (t N ). The formula for obtaining the node embedding is as follows:

[0111]

[0112] K (l) (t) = V (l) (t) = C (l) (t);

[0113]

[0114] Among them, || is the connection operator, φ is the time code; Q (l) (t) is a reference node, i.e., the target node or one of its l-1-hop neighbors; K (l) (t) and V (l) (t) is its neighbor; N is the number of neighbor nodes of node i;

[0115] Step 4.4: In order to obtain a comprehensive node representation, extract effective information from the node features obtained by the timing graph generation module for further learning. Similarly, a feedforward neural network is used to process the original statistical data to extract effective information of the node features, and then splice it with the deep feature representation obtained in the previous section. The specific implementation is as follows:

[0116]

[0117] Among them, h i (t) is the node depth feature representation, is the node neighbor aggregation representation, is the node statistical data feature;

[0118] Step 4.5: Learn the node representation by maximizing the consistency of the node representation between the two graphs, and optimize the model parameters using contrastive loss to obtain more robust node depth features;

[0119] like Figure 5 As shown in the figure, the GRACE algorithm, a framework for unsupervised node-level graph contrast learning, can learn node representations by maximizing the consistency of node representations between two graphs.

[0120] First, by destroying the original transaction graph G, two subgraphs G are generated 1 and G 2 ; Then the encoder is used to obtain the node representation of the subgraph, which are recorded as U and V respectively; then the nodes between views are compared according to their consistency. For any node v i , which generates the embedding u in a view i Treated as anchor embeddings, the node embedding v generated in another view i is a positive sample, except v in the two views i Nodes other than are regarded as negative samples;

[0121]

[0122] in, Represents the paired targets of the corresponding nodes of the two views; θ(u,v)=s(g(u),g(v)) represents the cosine similarity distance, s is the cosine similarity, g is the nonlinear projection, which can improve the expression ability of the comparison; is the indicator function, which takes the value of 1 when k≠i and 0 otherwise; τ is the temperature parameter;

[0123] In this algorithm, no negative samples are sampled. Instead, a positive pair is given and negative samples are defined as all other nodes in the two views. Therefore, negative samples come from two sources, nodes between views or nodes within views, corresponding to the second and third terms in the denominator, respectively. Since the two views are symmetric, the loss of the other view is ′(v i ,u i ) is defined similarly. Then the overall objective to be maximized is defined as the average of all positive pairs, and the overall objective function is:

[0124]

[0125] The subgraph generation method needs to destroy the original graph in terms of structure and attributes, so as to build different node contexts for the model to compare. Therefore, the destruction of the original graph is achieved by randomly deleting some edges and randomly masking some node features.

[0126] The random deletion of some edges first samples a random masking matrix Each element in the matrix is ​​generated according to Bernoulli distribution; if A ij =1, then the element values ​​in the matrix come from Bernoulli distribution otherwise where p r is the probability of each edge being deleted; then the resulting adjacency matrix is: Where (x°y) i =x i y i represents the Hadamard product;

[0127] The random masking of some node features firstly performs random vector The sampling is performed, where each dimension value is independently selected from the probability 1-p m The Bernoulli distribution is extracted, that is, Then, the generated node features Where [·;] represents the concatenation operation, (x°y) i =x i y i Represents the Hadamard product.

[0128] In one embodiment, the time-series graph neural network is a trained network; during training, first, the memory module and the original information are initialized. Then, a loop is entered to obtain the transaction graph of each batch of training sets in turn, randomly destroy its edges and features, and generate two enhanced subgraphs. Next, the information is calculated and the information of the same nodes is aggregated to obtain the updated memory. Then, the node embeddings of the two subgraphs are obtained respectively using the time-series graph attention mechanism. After obtaining the node embeddings, the loss function is calculated by the contrastive learning algorithm at the subgraph node level, and the model parameters are updated by back propagation. Finally, the original information is calculated and saved, and the updated memory is saved. After the model is trained, the parameters of the model are saved, which can be used to obtain node features;

[0129] The specific algorithm is shown in Algorithm 2.

[0130]

[0131] Step 5: Input the deep features of the node into the binary classifier of the LightGBM algorithm to learn and determine whether the transaction is a phishing fraud transaction.

[0132] In one embodiment, in the phishing transaction detection module, Ethereum transactions are classified so that the model can distinguish between phishing fraud transactions and normal transactions. Then, the complete representations of the source node and the target node of each transaction obtained by the time series graph learning module are combined to form the representation of the edge. Finally, the representation of the edge is input into the binary classifier of the LightGBM algorithm to learn and determine whether the transaction is a phishing fraud transaction.

[0133] This embodiment also provides a phishing fraud detection device for on-chain transaction data, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the phishing fraud detection method for on-chain transaction data when executing the program.

[0134] This embodiment also provides a phishing fraud detection product for on-chain transaction data, including a computer program, which implements the phishing fraud detection method for on-chain transaction data when executed by a processor.

[0135] The present invention is further described below through specific experiments.

[0136] In this embodiment, accounts marked as "phish-hack", i.e., phishing fraud accounts, were crawled from the tag cloud of Etherscan. As of March 2023, a total of 9,355 phishing addresses were crawled. Since the phishing fraud data of phishing nodes often explodes in a period of time, only the transactions of this part of the phishing nodes with more clusters are retained, and transactions from a long time ago are ignored. The experiment marks this part of the transaction records as positive examples, and the rest are marked as negative examples. The experiment uses these phishing addresses as central nodes to obtain their first-order and second-order neighbors and transactions between them in the Ethereum database. Each transaction includes the following information: (1) From Address; (2) To Address; (3) Timestamp; (4) Value; (5) Gas; (6) Transcation Type. Finally, a total of 7,006 phishing addresses' transaction-related data were obtained in the database, plus the related data with its first-order and second-order neighbors, totaling 209,517,529 Ethereum addresses and 963,969,163 transaction records.

[0137] Module 1: Obtain the account addresses of both parties of the on-chain transaction to be identified, obtain the transactions related to the two addresses, and form a first-order subgraph; further obtain the transactions related to the first-order subgraph address to form a second-order subgraph; wherein the related transactions include all transactions as source nodes and target nodes, and the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between the first-order neighbors and the second-order neighbors;

[0138] In order to limit the size of the second-order subgraph, the experiment took 1,000 phishing addresses as the central nodes for the experiment, and the first-order neighbor transaction volume and the second-order neighbor transaction volume were limited to 50. The data set obtained took out the relevant data of 850 phishing addresses as the training set, and the relevant data of 150 phishing addresses as the test set. The specific statistics of the data set are:

[0140]

[0141] Module 2: Preprocess the above second-order subgraph data, and process the nodes, edges and related data in turn. First, recode the 40-bit hexadecimal data of each node address into numbers, starting from 0, and reset the sequence of the edges, starting from 0. Next, format the timestamp "year-month-day T hour: minute: second" into a number, subtract the smallest timestamp in the transaction graph, and represent the time starting from 0. Finally, standardize the data of the transaction fields value and gas, and calculate the mean μ and standard deviation σ of the original data; for each data point x, calculate its standardized value z = (x-μ) / σ.

[0142] Module 3: Extract the statistical features of the nodes of the above second-order subgraph, including transaction data features and graph structure features. The transaction features have 10 dimensions, including in-degree, out-degree, total degree, incoming transaction amount, outgoing transaction amount, sum of transaction amounts, total number of neighbors, inverse of transaction frequency, percentage of neighbors with all zero transactions, and number of transactions with the most frequent neighbors. The graph structure features have 8 dimensions, including in-degree centrality, out-degree centrality, degree centrality, average neighbor degree, page rank, average clustering coefficient, eccentricity, and number of simple paths. Finally, a time series graph is generated.

[0143] Module 4: In each round and batch of cycles, for a transaction at a certain moment, take the source node and the target node as the central nodes, filter out the transactions before that moment, and generate the second-order subgraph of the source node and the target node. Randomly destroy the edges and features of the subgraph to generate an enhanced subgraph. Figure 1 Kazuko Figure 2 .

[0144] Module 4.1: Use time coding technology to Figure 1 Kazuko Figure 2 The transaction time is encoded as the feature representation.

[0145] Module 4.2: Counting pairs individually Figure 1 Kazuko Figure 2 For multiple messages of the same node, the latest message is used to aggregate them, and finally the memory of each node is updated to obtain the sub- Figure 1 Kazuko Figure 2 Node history representation of ;

[0146] Module 4.3: Using two layers of time-series graph attention layers, for each node, aggregate its neighbor node information and time-series information to obtain sub- Figure 1 Kazuko Figure 2 Node neighbor aggregation representation;

[0147] Module 4.4: Use feedforward neural networks to process raw statistical data and combine them with aggregate information to obtain sub-data. Figure 1 Kazuko Figure 2 The final node deep feature representation;

[0148] Module 4.5: For sub-modules 4.1-4.4 Figure 1 Kazuko Figure 2 The node deep feature representation of the two graphs is maximized by using the consistency of the node representation between the two graphs as the contrast loss. Then, the parameters of the temporal graph neural network are optimized by back propagation through the optimization function, so as to effectively learn the node representation.

[0149] The parameters of the time series graph neural network are set as:

[0150]

[0151] Module 5: For the original subgraph generated by module 4, the node deep feature representation of the subgraph is obtained through modules 4.1-4.4 in sequence, and sent to the LightGBM model for training. The optimal training parameters of the LightGBM model are retained through the "early stopping" strategy.

[0152] The LightGBM model parameters are set as:

[0154]

[0155] In the experiment, the training set data was used to execute modules 1-5 to obtain the trained time series graph neural network and LightGBM model, and the test set data was used to execute modules 1-5 to predict the results of each transaction. The final experimental results achieved an F1 score of 87.23% and an AUC of 98.43%.

[0156] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0157] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A phishing fraud detection method for on-chain transaction data, characterized in that: The following steps are involved: Step 1: Obtain the account addresses of both parties in the on-chain transaction to be identified, obtain the transactions related to the two addresses, and form a first-order subgraph; further obtain the transactions related to the first-order subgraph address to form a second-order subgraph; wherein the related transactions include all transactions as source nodes and target nodes, and the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between the first-order neighbors and the second-order neighbors; Step 2: Preprocess the nodes, edges and related data of the second-order subgraph in turn; Step 3: Extract the statistical features of the nodes, including transaction data features and graph structure features, and generate a time series graph; Step 4: Extract the deep features of the nodes based on the temporal graph neural network; Step 5: Input the deep features of the node into the binary classifier of the LightGBM algorithm to learn and determine whether the transaction is a phishing fraud transaction.

2. The phishing fraud detection method for on-chain transaction data according to claim 1 is characterized in that: In step 2, first, the 40-bit hexadecimal data of each node address is re-encoded as a number, starting from 0, and the edge number is reset to start from 0; then, the timestamp "year-month-day T hour: minute: second" is formatted as a number, and then the smallest timestamp in the transaction graph is subtracted to represent the time starting from 0; finally, the data of the transaction fields value and gas are standardized, and the mean μ and standard deviation σ of the original data are calculated; for each data point x, its standardized value z = (x-μ) / σ is calculated.

3. The phishing fraud detection method for on-chain transaction data according to claim 1 is characterized in that: In step 3, the transaction data features include in-degree, out-degree, total degree, inbound transaction amount, outbound transaction amount, total transaction amount, total number of neighbors, inverse of transaction frequency, percentage of neighbors with all zero transactions, and number of transactions with the most frequently traded neighbors; The graph structural features include in-degree centrality, out-degree centrality, degree centrality, average neighbor degree, page rank, average clustering coefficient, eccentricity and number of simple paths.

4. The phishing fraud detection method for on-chain transaction data according to claim 1 is characterized in that: In step 4, the time-series graph-based neural network includes a time encoding module, an aggregated historical node representation module, an aggregated neighbor node representation module, an aggregated node statistical feature module, and a comparative learning module; The time encoding module includes a time encoding function capable of projecting 1-dimensional time into d t A temporal representation of the dimension, where the parameters defined are learnable parameters; The aggregated historical node representation module includes a message function, an aggregation function, and a memory function. In the message function, for each transaction, the source node feature, the target node feature, the edge feature, and the time code are concatenated to form a transaction message, whose dimension is d m +d m +d e +d t , where d m is the node memory dimension, d e is the edge feature dimension, d t is the time representation dimension; in the aggregation function, for multiple messages of a node, multiple messages are merged into one message by average aggregation or latest aggregation; in the memory function, the GRU model is used for learning and memory, the input is the message, and the output is the node memory representation. The GRU model receives d m +d m +d e +d t dimension message and update d m Dimensional node memory representation, i.e. node history representation; The aggregated neighbor node representation module is composed of multiple layers of temporal graph attention layers, where the input of the latter layer is the output of the previous layer, and the input of the first layer is the node history representation; for the temporal graph attention layer, firstly, the attention scores of the source node features, edge features and target node features are calculated in turn based on the multi-head attention mechanism, which are denoted as e l 、e e and e r , all three dimensions are mapped to d n *heads, where d n is the final node neighbor aggregation representation dimension, heads is the number of heads; then, e of each transaction is l 、e e and e r Add them together to get e le =e l +e e ,e ler =e le +e r , through the activation function leaky_relu to aggregate the result e ler Activate and normalize the attention score to the attention weight through softmax; then recalculate e based on the attention weight le , and then for each node, based on the e of its neighboring nodes le Sum to get the attention output; finally, use the fully connected layer to map the attention output to a node neighbor aggregation representation with a dimension of d n ; The node statistical feature aggregation module includes a two-layer fully connected layer. First, the first layer maps the node statistical features into d s The node statistical feature representation of the dimension is then concatenated with the node neighbor aggregation representation of the previous step to obtain d s +d n dimensional vector representation; finally, the second fully connected layer maps the vector representation to d d Dimensional node deep feature representation; The contrastive learning module includes three parts: an encoder, a mapper and contrastive learning; the encoder is composed of four modules: a time encoding module, an aggregated historical node representation module, an aggregated neighbor node representation module and an aggregated node statistical feature module; the mapper is composed of a two-layer fully connected layer; contrastive learning is based on the enhanced subgraph 1 and subgraph 2 generated by randomly destroying the original graph, and the node representation is obtained through the encoder respectively, and the node representation is further mapped to the projection space through the mapper to maximize the consistency of the node representation between the two graphs to perform contrastive learning.

5. The phishing fraud detection method for on-chain transaction data according to claim 1 is characterized in that: The specific implementation of step 4 includes the following sub-steps: Step 4.1: Use the time encoding function Map time t to a continuously differentiable function φ d (t), the time series information is used as a feature to learn in the graph neural network. The calculation formula is as follows: Among them, time t is projected into a feature representation of dimension 2d, ω i are the parameters that need to be learned, i∈{1,…,d}; Step 4.2: Aggregate historical node representations; For each node i at time t, use the vector s i (t) represents its memory state, i.e., the historical interaction record of the node; the memory of a new node is initialized to a zero vector and then dynamically updated for each transaction involving the new node; for transaction e ij (t), that is, when a transaction occurs between source node i and target node j at time t, the memory of the two nodes will be updated respectively. The two messages are calculated as follows: m i (t)=msg s (s i (t - ),s j (t - ),Δt,e ij (t)); m j (t)=msg d (s j (t - ),s i (t - ),Δt,e ij (t)); Among them, s i (t - ),s j (t - ) represent the memory of nodes i and j before time t, msg s With msg d is a message function, implemented by direct concatenation, and Δt is the time difference between this transaction and the previous one; Batch processing involves multiple transactions m involving the same node i in the same batch i (t1),…,m i (t b ), the calculation formula is as follows: where t1,…,t b <t; agg represents an aggregation function, which is implemented by aggregating with the latest message or the average message; Subsequently, processing each transaction involving the node itself will update the node's memory, calculated as follows: Among them, mem represents the memory function, which is implemented by the GRU model; Step 4.3: Adopt the temporal graph attention mechanism to learn node representation by aggregating neighbor node information and temporal information; The hidden representation of node i at time t in layer l is The input is timestamp t, neighbor node information at layer l-1 and feature e i1 (t1),…,e iN (t N ), the node embedding formula is as follows: K (l) (t)=V (l) (t)=C (l) (t); Among them, || is the connection operator, φ is the time code; Q (l) (t) is a reference node, i.e., the target node or one of its l-1-hop neighbors; K (l) (t) and V (l) (t) is its neighbor; N is the number of neighbor nodes of node i; Step 4.4: Combine the reference node representation with the aggregate information using a feed-forward neural network. Among them, h i (t) is the node depth feature representation, is the node neighbor aggregation representation, is the node statistical data feature; Step 4.5: Learn the node representation by maximizing the consistency of the node representation between the two graphs and optimize the model parameters using contrastive loss to obtain more robust node deep features; First, the original transaction graph G is destroyed to generate two subgraphs G1 and G2. Then, the node representations of the subgraphs are obtained through the encoder, which are recorded as U and V respectively. Then, the nodes between the views are compared based on their consistency. For any node v i , which generates the embedding u in a view i Treated as anchor embeddings, the node embedding v generated in another view i is a positive sample, except v in the two views i Nodes other than are regarded as negative samples; Among them, l(u i ,v i ) represents the paired targets of the corresponding nodes of the two views; θ(u,v)=s(g(u),g(v)) represents the cosine similarity distance, s is the cosine similarity, g is the nonlinear projection, which can improve the expression ability of the comparison; is the indicator function, which takes the value of 1 when k≠i and 0 otherwise; τ is the temperature parameter; The overall objective function is: Among them, the destruction of the original graph is achieved by randomly deleting some edges and randomly shielding some node features; The random deletion of some edges first samples a random masking matrix Each element in the matrix is ​​generated according to Bernoulli distribution; if A ij =1, then the element values ​​in the matrix come from Bernoulli distribution otherwise where p r is the probability of each edge being deleted; then the resulting adjacency matrix is: in represents the Hadamard product; The random masking of some node features firstly performs random vector The sampling is performed, where each dimension value is independently selected from the probability 1-p m The Bernoulli distribution is extracted, that is, Then, the generated node features Among them, [·;] represents the splicing operation, Represents the Hadamard product.

6. The phishing fraud detection method for on-chain transaction data according to any one of claims 1 to 5, characterized in that: The time-series graph neural network is a trained network; During training, the memory module and original information are initialized; then a loop is entered to obtain the transaction graph of each batch of training sets in turn, randomly destroy its edges and features and generate two enhanced subgraphs; then, the information is calculated and aggregated, and the updated memory is obtained from it; then, the temporal graph attention mechanism is used to obtain the node embeddings of the two subgraphs respectively; after obtaining the node embeddings, the loss function is calculated through the contrastive learning algorithm at the subgraph node level, and the model parameters are updated through backpropagation; finally, the original information is calculated and saved, and the updated memory is saved.

7. A phishing fraud detection device for on-chain transaction data, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the phishing fraud detection method for on-chain transaction data is implemented as described in any one of claims 1 to 6.

8. A phishing fraud detection product for on-chain transaction data, comprising a computer program, characterized in that: When the computer program is executed by a processor, it implements the phishing fraud detection method for on-chain transaction data as described in any one of claims 1 to 6.

Images