Phishing fraud detection methods, equipment, and products for on-chain transaction data

Abstract

The present invention discloses a phishing fraud detection method, device and product for on-chain transaction data. First, all transactions are crawled in the Ethereum database, and phishing account addresses are crawled in Etherscan, an Ethereum-authorized data website. Then, relevant screening rules are formulated based on the phishing account addresses to filter out most of the useless data and alleviate the problem of class imbalance. Then, time series graph generation and time series graph learning are performed. The statistical features and deep features of the nodes in the extracted transaction graph are combined as node representations, and the node representations of the source node and the target node are combined to form an edge representation. Finally, the LightGBM binary classifier is used to classify phishing fraud transactions and normal transactions. The present invention utilizes the advantages of graph neural networks in processing graph structured data, captures the complex time and space dependencies of the Ethereum transaction network, solves the challenges in the existing decentralized environment, and makes it an important tool for detecting Ethereum phishing transactions.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain information security technology, and designs a method, device and product for detecting phishing fraud in on-chain transaction data. Specifically, it relates to a method, device and product for detecting phishing fraud in on-chain transaction data based on a time-series graph neural network. Background Art

[0002] Over the past few years, blockchain technology has been widely adopted across various industries, including cryptocurrency, intellectual property, the Internet of Things, and financial services. As a distributed and trusted data storage technology, blockchain boasts decentralization, tamper-proofing, traceability, and scalability, ensuring the authenticity and security of data records. Furthermore, blockchain technology addresses the issue of distrust between individuals and fosters trust in networks without the need for a trusted third party. Due to these characteristics, blockchain technology is even considered a revolutionary innovation after the internet, poised to transform the way society delivers value and transform the operational logic of industries.

[0003] As the largest blockchain platform supporting smart contracts and the second-largest digital currency platform, Ethereum's anonymity and lack of oversight provide advantages for decentralization, but they also amplify the security risks of crypto assets. Furthermore, Ethereum's rapid development inevitably leads to various cybercrimes, such as smart contract Ponzi schemes, black market transactions, and phishing scams. Phishing scams are one of the most significant threats to transaction security. Therefore, detecting and preventing phishing scams on Ethereum has become a crucial research topic.

[0004] Unlike traditional online fraud, Ethereum phishing scams employ a variety of methods, and content containing phishing messages is distributed in a variety of forms. These differences are significant in the following aspects. First, the targets of Ethereum phishing scams differ. Ethereum phishing scams target Ethereum's token, Ether, rather than real-world fiat currency. Phishing organizations illegally obtain Ether and then trade it for real-world fiat currency. Second, their methods differ. Traditional phishing scams typically create fake websites or software to collect sensitive information, while Ethereum phishing scams often use various methods to spread phishing addresses, tricking ordinary users into transferring funds to designated accounts. Third, their characteristics differ. In Ethereum, users cannot verify their identities through sensitive information; they can only be identified through public keys. Therefore, traditional detection methods are ineffective in identifying the new patterns of Ethereum phishing scams, requiring the design of new detection methods tailored to the specific characteristics of Ethereum. However, in Ethereum, transaction records are publicly visible, providing a new data source for phishing detection. Phishing scams on Ethereum can be detected by analyzing Ethereum account tags and transaction records.

[0005] Traditional machine learning methods focus on statistical features and rely primarily on expertise to extract manually designed features. In 2017, Robert et al. used statistical features extracted from contract code and clustered the contract bytecode using the K-medids algorithm to classify unknown contracts. In 2019, Jung et al. used data mining to obtain code and behavioral characteristics of smart contracts and provided zero-day and full-featured detection models. In 2020, Chen et al. used a graph-based cascade feature extraction method in the transaction graph to extract 219 dimensions of statistical features from the first-order and second-order neighbors of nodes, and employed a double-sampling ensemble machine learning algorithm based on lightGBM to identify phishing nodes.

[0006] Most current work utilizes graph network representations, which fully leverage the node and edge information of transaction graphs. Some researchers have also applied network embedding methods. In 2020, Wu et al. considered the transaction volume and timestamps of the graph and introduced a new network embedding algorithm, Trans2vec, based on Node2vec. This algorithm optimizes the graph sampling process and more effectively extracts node features. In 2020, Yuan et al. used the network embedding method Node2vec to extract latent account features and employed a single-class support vector machine (SVM) for classification. Some researchers have also combined this with graph neural network algorithms. In 2021, Tan et al. proposed using a quantity-based Node2vec algorithm to record transaction volume and the structural characteristics of the transaction network, and using a graph convolutional network (GCN) model to classify addresses within the transaction network. In 2021, Zhou et al. used a graph data augmentation strategy to generate subgraphs, then used a subgraph comparison process to learn the correlation between account subgraphs across different views. Finally, they jointly trained the subgraph comparison and account classification tasks to achieve account identity inference. In 2022, Li et al. used a temporal transaction aggregation graph network to learn transaction features from the temporal edge representation and Edge2node module, structural features from the structural enhancement module, and statistical features from nodes, and then classified them using the LightGBM classifier algorithm.

[0007] Research on phishing fraud detection using on-chain transaction data presents the following challenges: First, Ethereum transactions are large in scale and contain a large amount of transaction data, but there are few labels for accounts or transactions. Second, past research has demonstrated the effectiveness of transaction networks in phishing fraud detection. However, these studies have the following three issues:

[0008] (1) Traditional machine learning methods are rule-based and only use artificially designed features to represent nodes, which results in weak node representation capabilities and limited detection effects.

[0009] (2) Most research works only focus on a single transaction and completely ignore past transaction records, which means that these research works rarely use the time information of transactions and therefore cannot capture the complete edge representation;

[0010] (3) A small number of works have added algorithms for time information, but these algorithms ignore the continuity of time information and do not update nodes in real time. At the same time, if a node does not interact with other nodes for a long time, the node representation will become outdated and cannot meet the real-time and accuracy requirements of node representation. Summary of the Invention

[0011] In order to solve the above problems, the present invention proposes a method, device and product for detecting phishing fraud in on-chain transaction data based on a time-series graph neural network.

[0012] The technical solution adopted by the method of the present invention is: a phishing fraud detection method for on-chain transaction data, comprising the following steps:

[0013] Step 1: Obtain the account addresses of both parties in the on-chain transaction to be identified, obtain the transactions related to the two addresses, and form a first-order subgraph. Further obtain the transactions related to the first-order subgraph address to form a second-order subgraph. The related transactions include all transactions between the source node and the target node, and the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between its first-order neighbors and its second-order neighbors.

[0014] Step 2: Preprocess the nodes, edges and related data of the second-order subgraph in turn;

[0015] Step 3: Extract the statistical features of the nodes, including transaction data features and graph structure features, and generate a time series graph;

[0016] Step 4: Extract the deep features of the nodes based on the temporal graph neural network;

[0017] Step 5: Input the deep features of the node into the binary classifier of the LightGBM algorithm to learn and determine whether the transaction is a phishing fraud transaction.

[0018] Preferably, in step 2, first, the 40-bit hexadecimal data of each node address is re-encoded as a number, starting from 0, and the sequence number of the edge is reset to start from 0; then, the timestamp "year-month-day T hour: minute: second" is formatted as a number, and then the smallest timestamp in the transaction graph is subtracted to represent the time starting from 0; finally, the data of the transaction fields value and gas are standardized, and the mean μ and standard deviation σ of the original data are calculated; for each data point x, its standardized value z = (x-μ) / σ is calculated.

[0019] Preferably, in step 3, the transaction data features include in-degree, out-degree, total degree, incoming transaction amount, outgoing transaction amount, total transaction amount, total number of neighbors, inverse of transaction frequency, percentage of neighbors with all zero transactions, and number of transactions with the most frequently traded neighbor;

[0020] The graph structural features include in-degree centrality, out-degree centrality, degree centrality, average neighbor degree, page rank, average clustering coefficient, eccentricity and number of simple paths.

[0021] Preferably, in step 4, the time series graph-based neural network includes a time encoding module, an aggregated historical node representation module, an aggregated neighbor node representation module, an aggregated node statistical feature module and a comparative learning module.

[0022] The time encoding module includes a time encoding function that can project 1-dimensional time into d t The time representation of the dimension is defined as a learnable parameter.

[0023] The aggregated historical node representation module includes three key functions: message function, aggregation function, and memory function. In the message function, for each transaction, the source node feature, target node feature, edge feature, and time code are concatenated to form a transaction message, whose dimension is d m +d m +d e +d t , where d m is the node memory dimension, d e is the edge feature dimension, d t is the time representation dimension; in the aggregation function, for multiple messages of a node, multiple messages can be merged into one message by average aggregation or latest aggregation; in the memory function, the GRU model is used for learning and memory, the input is the message, the output is the node memory representation, and the GRU receives d m +d m +d e +d t dimension message and update d m Dimensional node memory representation, that is, node history representation.

[0024] The aggregated neighbor node representation module is composed of multiple layers of temporal graph attention layers, where the input of the latter layer is the output of the previous layer, and the input of the first layer is the node history representation. For the temporal graph attention layer, the attention scores of the source node features, edge features (for the convenience of calculation, the time code is spliced ​​into the edge features) and target node features are calculated in sequence based on the multi-head attention mechanism, which are e l 、e e and e r, all three dimensions are mapped to d n *heads, where d n is the final node neighbor aggregation representation dimension, and heads is the number of heads. Then, the e of each transaction l 、e e and e r Add them together, and we have e le =e l +e e ,e ler =e le +e r , through the activation function leaky_relu to aggregate the result e ler Activate and normalize the attention score to the attention weight through softmax. Then, recalculate e based on the attention weight le , and then for each node, the e le Finally, a fully connected layer is used to map the attention output into a node neighbor aggregation representation with a dimension of d n .

[0025] The node statistical feature aggregation module includes a two-layer fully connected layer. First, the first layer maps the node statistical features to d s dimensional node statistical feature representation. Then concatenate it with the node neighbor aggregation representation in the previous step to obtain d s +d n Finally, the second fully connected layer maps the vector representation to d d Dimensional node deep feature representation.

[0026] The contrastive learning module consists of three parts: encoder, mapper and contrastive learning. The encoder consists of four modules: time encoding module, aggregated historical node representation module, aggregated neighbor node representation module and aggregated node statistical feature module. The mapper consists of a two-layer fully connected layer. Contrastive learning is to randomly destroy the original graph to generate the enhanced Figure 1 Kazuko Figure 2 On the basis of, the node representation is obtained by the encoder respectively, and the node representation is further mapped to the projection space by the mapper to maximize the consistency of the node representation between the two graphs for comparative learning.

[0027] Preferably, the specific implementation of step 4 includes the following sub-steps:

[0028] Step 4.1: Use the time encoding function Map time t to a continuously differentiable function φ d (t), the time series information is used as a feature in the graph neural network for learning, and the calculation formula is as follows:

[0029]

[0030] Among them, time t is projected into the feature representation of dimension 2d, φ i is the parameter to be learned, i∈{1,…,d};

[0031] Step 4.2: Aggregate historical node representations;

[0032] For each node i at time t, use vector s i (t) represents its memory state, i.e., the historical interaction record of the node; the memory of a new node is initialized to a zero vector and then dynamically updated for each transaction involving the new node; for transaction e ij (t), that is, when the source node i and the target node j have a transaction at time t, the memory of the two nodes will be updated respectively. The two messages are calculated as follows:

[0033] m i (t) = msg s (s i (t - ),s j (t - ),Δt,e ij (t));

[0034] m j (t) = msg d (s j (t - ),s i (t - ),Δt,e ij (t)(;

[0035] Among them, s i (t - ),s j (t - ) represent the memory of nodes i and j before time t, msg s with msg d It is a learnable message function, implemented by direct concatenation, and Δt is the time difference between this and the previous transaction;

[0036] Batch processing involves multiple transactions m involving the same node i in the same batch i (t1),…,m i (t b ), the calculation formula is as follows:

[0037]

[0038] Among them, t1,…,t b<t; agg represents an aggregation function, which is implemented by aggregating the latest message or the average message.

[0039] Subsequently, processing each transaction involving the node itself updates the node's memory, and the calculation formula is as follows:

[0040]

[0041] Among them, mem represents the memory function, which is implemented by the GRU model.

[0042] Step 4.3: Adopt the temporal graph attention mechanism to learn the node representation by aggregating neighbor node information and temporal information;

[0043] The hidden representation of node i at time t in layer l is The input is the timestamp t, the neighbor node information at layer l - 1 and the feature e i1 (t1),…,e iN (t N ), and the formula for obtaining the node embedding is as follows:

[0044]

[0045] K (l) (t) = V (l) (t) = C (l) (t);

[0046]

[0047] Among them, || is the concatenation operator, φ is the time encoding; Q (l) (t) is a reference node, that is, one of the target node or its l - 一跳 neighbors; K (l) (t) and V (l) (t) are its neighbors; N is the number of neighbor nodes of node i;

[0048] Step 4.4: Use the feed - forward neural network to combine the reference node representation with the aggregated information;

[0049]

[0050] Among them, h <00(00073>(t) is the node depth feature representation, is the node neighbor aggregation representation, is the node statistical data feature;

[0051] Step 4.5: Learn the node representation by maximizing the consistency of the node representations between two graphs, and optimize the model parameters using the contrastive loss to obtain more robust node depth features;

[0052] First, the original transaction graph G is destroyed to generate two subgraphs G1 and G2. Then, the node representations of the subgraphs are obtained through the encoder, which are recorded as U and V respectively. Then, the nodes between the views are compared based on their consistency. For any node v i , which generates the embedding u in a view i is considered as an anchor embedding, the node embedding v generated in another view i For positive samples, except v in two views i Nodes other than are considered as negative samples;

[0053]

[0054] in, Represents the paired targets of the corresponding nodes of the two views; θ(u,v)=s(g(u),g(v)) represents the cosine similarity distance, s is the cosine similarity, g is the nonlinear projection, which can improve the expression ability of the comparison; is the indicator function, which takes the value of 1 when k≠i and 0 otherwise; τ is the temperature parameter;

[0055] The overall objective function is:

[0056]

[0057] Among them, the destruction of the original graph is achieved by randomly deleting some edges and randomly shielding some node features;

[0058] The random deletion of some edges first samples a random masking matrix Each element in the matrix is ​​generated according to Bernoulli distribution; if A ij =1, then the element values ​​in the matrix come from Bernoulli distribution otherwise where p r is the probability of each edge being deleted; the resulting adjacency matrix is: Where (x°y) u =x u y i represents the Hadamard product;

[0059] The random shielding of some node features is first performed on the random vector Sampling is performed, where each dimension value is independently selected from the m is extracted from the Bernoulli distribution, that is, Then, the generated node features Where [·;] represents the splicing operation, (x°y) u =x u y i Represents the Hadamard product.

[0060] Preferably, the temporal graph neural network is a trained network; during training, the memory module and the original information are initialized; then a loop is entered to sequentially obtain the transaction graph of each batch of training sets, randomly destroy its edges and features and generate two enhanced subgraphs; then, information is calculated and information of the same nodes is aggregated to obtain updated memories; then, the temporal graph attention mechanism is used to obtain node embeddings of the two subgraphs respectively; after obtaining the node embeddings, the loss function is calculated by a contrastive learning algorithm at the subgraph node level, and the model parameters are updated by backpropagation; finally, the original information is calculated and saved, and the updated memory is saved.

[0061] The technical solution adopted by the device of the present invention is: a phishing fraud detection device for on-chain transaction data, including a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the phishing fraud detection method for on-chain transaction data when executing the program.

[0062] The technical solution adopted by the product of the present invention is: a phishing fraud detection product for on-chain transaction data, including a computer program, which implements the phishing fraud detection method for on-chain transaction data when executed by a processor.

[0063] Compared with the prior art, the beneficial effects of the present invention include:

[0064] (1) The present invention combines node statistical features and node depth features obtained based on a time-series dynamic graph model to form a node representation, making full use of the transaction information, structural features, and statistical features in the transaction network, thereby improving the accuracy of the model.

[0065] (2) The present invention combines the continuous dynamic graph algorithm to extract the transaction features of the transaction network, draws on the existing contrastive learning algorithm to improve the calculation of the loss function, effectively mines the time information of the transaction network and enriches the representation of nodes and edges.

[0066] (3) This invention takes advantage of the advantages of graph neural networks in processing graph-structured data, captures the complex temporal and spatial dependencies of the Ethereum transaction network, and solves the challenges in the existing decentralized environment, making it an important tool for detecting Ethereum phishing transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] The technical solution of the present invention is further illustrated below using embodiments and specific implementation methods. In addition, some drawings are also used in the process of illustrating the technical solution. For those skilled in the art, other drawings and the intention of the present invention can be obtained based on these drawings without making any creative efforts.

[0068] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0069] Figure 2 A network structure diagram of an embodiment of the present invention;

[0070] Figure 3 A flowchart of an aggregation history node representation for an embodiment of the present invention;

[0071] Figure 4 A flowchart showing aggregating neighbor nodes according to an embodiment of the present invention is shown;

[0072] Figure 5 4 is a flowchart of comparative learning according to an embodiment of the present invention. DETAILED DESCRIPTION

[0073] In order to facilitate ordinary technicians in this field to understand and implement the present invention, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0074] Research indicates that transaction graphs can represent accounts and transaction records on Ethereum. Increases in the number of transactions on Ethereum imply updates to graph nodes and edges. Therefore, by adding a time attribute to the transaction graph and leveraging a continuous dynamic graph, information such as transaction direction, time, and amount can be fully utilized, effectively improving Ethereum's phishing fraud detection capabilities. The key concept of this invention is to use a dynamic graph learning-based approach to represent blockchain transaction data, capturing the complex and ever-changing interaction patterns of the Ethereum transaction network. By predicting whether the next transaction poses a phishing risk, this invention can identify phishing nodes and prevent phishing transactions, potentially saving significant financial losses.

[0075] This example defines Ethereum transaction network phishing fraud detection as a graph node and edge classification problem. Based on Ethereum transaction records, a transaction network G = (V, E) is constructed, where V represents the node set, i.e., the set of Ethereum account addresses, and e represents the edge set in the transaction network, i.e., the set of Ethereum transaction records. A partially labeled Ethereum transaction network is obtained from this. The time matrix Where T represents the timestamp set. Edge feature matrix Where S represents the size of the feature space of each edge. Label matrix Where Y represents the label set. L Learn node embedding features Where d represents the dimension of feature representation. The classifier f:V→Y learns and predicts X through the training data set EThe relationship between f(v) and Y is used to predict whether a transaction is a phishing fraud transaction. In the phishing fraud identification scenario, f is a binary classifier, and Y contains two types of labels, y∈Y={1,0}, where 0 represents a normal transaction label and 1 represents a suspected fraudulent transaction label. Therefore, when f(v)=1, v is defined as an abnormal transaction; otherwise, v is defined as a normal transaction.

[0076] like Figure 1 As shown, this embodiment provides a phishing fraud detection method for on-chain transaction data. First, all transactions are crawled in the Ethereum database, and phishing account addresses are crawled in Etherscan, an Ethereum-authorized data website. Then, relevant screening rules are formulated based on the phishing account addresses to filter out most of the useless data and alleviate the problem of class imbalance. Next, time series graph generation and time series graph learning are performed. The statistical features and deep features of the nodes in the extracted transaction graph are combined as node representations, and the node representations of the source and target nodes are combined to form edge representations. Finally, the LightGBM binary classifier is used to classify phishing fraud transactions and normal transactions.

[0077] The specific steps include:

[0078] Step 1: Obtain the account addresses of both parties in the on-chain transaction to be identified, obtain the transactions related to the two addresses, and form a first-order subgraph. Further obtain the transactions related to the first-order subgraph address to form a second-order subgraph. The related transactions include all transactions between the source node and the target node, and the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between its first-order neighbors and its second-order neighbors.

[0079] In one embodiment, the account addresses of the two parties in the on-chain transaction to be identified are obtained, and then the API for crawling Ethereum transactions is called to obtain transactions related to the two addresses (including all transactions as source nodes and target nodes) to form a first-order subgraph. Similarly, the API for crawling Ethereum transactions is called again to obtain transactions related to the first-order subgraph address (including all transactions as source nodes and target nodes) to form a second-order subgraph. The second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between the first-order neighbors and their second-order neighbors.

[0080] The specific algorithm is shown in Algorithm 1.

[0081]

[0082]

[0083] Step 2: Preprocess the nodes, edges and related data of the second-order subgraph in turn;

[0084] In one embodiment, the second-order subgraph data is preprocessed, and the nodes, edges, and related data are processed in sequence. First, the 40-bit hexadecimal data of each node address is re-encoded as a number, starting from 0, and the sequence number of the edge is reset to start from 0. Next, the timestamp "year-month-day T hour: minute: second" is formatted as a number, and then the smallest timestamp in the transaction graph is subtracted to represent the time starting from 0. Finally, the data of the transaction fields value and gas are standardized, and the mean μ and standard deviation σ of the original data are calculated; for each data point x, its standardized value z = (x-μ) / σ is calculated.

[0085] Step 3: Extract the statistical features of the nodes, including transaction data features and graph structure features, and generate a time series graph;

[0086] In one embodiment, statistical features of nodes are extracted, including transaction data features and graph structural features. Transaction features have 10 dimensions, including in-degree, out-degree, total degree, incoming transaction amount, outgoing transaction amount, total transaction amount, total number of neighbors, inverse of transaction frequency, percentage of neighbors with all zero transactions, and number of transactions with the most frequently transacted neighbor. Graph structural features have 8 dimensions, including in-degree centrality, out-degree centrality, degree centrality, average neighbor degree, page rank, average clustering coefficient, eccentricity, and number of simple paths.

[0087] Step 4: Extract the deep features of the nodes based on the temporal graph neural network;

[0088] In one embodiment, Figure 2 As shown, the time series graph-based neural network includes a time encoding module, an aggregated historical node representation module, an aggregated neighbor node representation module, an aggregated node statistical feature module and a comparative learning module.

[0089] The time encoding module includes a time encoding function that can project 1-dimensional time into d t The time representation of the dimension is defined as a learnable parameter.

[0090] The aggregated historical node representation module includes three key functions: message function, aggregation function, and memory function. In the message function, for each transaction, the source node feature, target node feature, edge feature, and time code are concatenated to form a transaction message, whose dimension is d m +d m +d e +d t , where d m is the node memory dimension, d e is the edge feature dimension, d tis the time representation dimension; in the aggregation function, for multiple messages of a node, multiple messages can be merged into one message by average aggregation or latest aggregation; in the memory function, the GRU model is used for learning and memory, the input is the message, the output is the node memory representation, and the GRU receives d m +d m +d e +d t dimension message and update d m Dimensional node memory representation, that is, node history representation.

[0091] The aggregated neighbor node representation module is composed of multiple layers of temporal graph attention layers, where the input of the latter layer is the output of the previous layer, and the input of the first layer is the node history representation. For the temporal graph attention layer, the attention scores of the source node features, edge features (for the convenience of calculation, the time code is spliced ​​into the edge features) and target node features are calculated in sequence based on the multi-head attention mechanism, which are e l 、e e and e r , all three dimensions are mapped to d n *heads, where d n is the final node neighbor aggregation representation dimension, and heads is the number of heads. Then, the e of each transaction l 、e e and e r Add them together, and we have e le =e l +e e ,e ler =e le +e r , through the activation function leaky_relu to aggregate the result e ler Activate and normalize the attention score to the attention weight through softmax. Then, recalculate e based on the attention weight le , and then for each node, the e le Finally, a fully connected layer is used to map the attention output into a node neighbor aggregation representation with a dimension of d n .

[0092] The node statistical feature aggregation module includes a two-layer fully connected layer. First, the first layer maps the node statistical features to d s dimensional node statistical feature representation. Then concatenate it with the node neighbor aggregation representation in the previous step to obtain d s +d n Finally, the second fully connected layer maps the vector representation to d d Dimensional node deep feature representation.

[0093] The contrastive learning module consists of three parts: encoder, mapper and contrastive learning. The encoder consists of four modules: time encoding module, aggregated historical node representation module, aggregated neighbor node representation module and aggregated node statistical feature module. The mapper consists of a two-layer fully connected layer. Contrastive learning is to randomly destroy the original graph to generate the enhanced Figure 1 Kazuko Figure 2 On the basis of, the node representation is obtained by the encoder respectively, and the node representation is further mapped to the projection space by the mapper to maximize the consistency of the node representation between the two graphs for comparative learning.

[0094] In one embodiment, the specific implementation of step 4 includes the following sub-steps:

[0095] Step 4.1: The TGAT algorithm derives a temporal coding technique from Bochner theory, which can use the time coding function Map time t to a continuously differentiable function φ d (t). The present invention applies the temporal coding technology to the model to learn temporal information as a feature in the graph neural network. The calculation formula is as follows:

[0096]

[0097] Among them, time t is projected into the feature representation of dimension 2d, ω i is the parameter to be learned, i∈{1,…,d};

[0098] Step 4.2: Aggregate historical node representations;

[0099] like Figure 3 As shown, for each node i at time t, use vector s i (t) represents its memory state, i.e., the historical interaction record of the node; the memory of a new node is initialized to a zero vector and then dynamically updated for each transaction involving the new node; for transaction e ij (t), that is, when the source node i and the target node j have a transaction at time t, the memory of the two nodes will be updated respectively. The two messages are calculated as follows:

[0100] m i (t) = msg s (s i (t - ),s j (t - ),Δt,e ij (t));

[0101] m j (t) = msg d (sj (t - ), s i (t - ), Δt, e ij (t));

[0102] Among them, s i (t - ), s j (t - ) respectively represent the memories of nodes i and j before time t, msg s and msg d are message functions, implemented by direct concatenation, and Δt is the time difference between this transaction and the previous one;

[0103] During batch processing, multiple transactions m i (t1), …, m i (t b ) of the same node i in the same batch are involved, and are aggregated using the latest message or the average message. The calculation formula is as follows:

[0104]

[0105] Among them, t1, …, t b < t; agg represents the aggregation function, and is implemented by aggregating the latest message or the average message.

[0106] Subsequently, processing each transaction involving the node itself will update the node's memory. The calculation formula is as follows:

[0107]

[0108] Among them, mem represents the memory function, and is implemented using the GRU model.

[0109] Step 4.3: Adopt the temporal graph attention mechanism to learn node representations by aggregating neighbor node information and temporal information;

[0110] As Figure 4 shown, the hidden representation of node i at time t in layer l is The input is the timestamp t, the neighbor node information at layer l - 1 and the feature e i1 (t1), …, e iN (t N ). The formula for obtaining the node embedding is as follows:

[0111]

[0112] K (l) (t) = V (l) (t) = C (l) (t);

[0113]

[0114] Among them, || is the connection operator, φ is the time code; Q (l) (t) is a reference node, i.e., the target node or one of its l-1 hop neighbors; K (l) (t) and V (l) (t) is its neighbor; N is the number of neighbor nodes of node i;

[0115] Step 4.4: To obtain a comprehensive node representation, extract valid information from the node features obtained by the time series graph generation module for further learning. Similarly, a feedforward neural network is used to process the raw statistical data to extract valid information about the node features, which is then combined with the deep feature representation obtained in the previous section. The specific implementation is as follows:

[0116]

[0117] Among them, h i (t) is the node depth feature representation, is the node neighbor aggregation representation, is the node statistical data feature;

[0118] Step 4.5: Learn node representations by maximizing the consistency of node representations between the two graphs and optimize model parameters using contrastive loss to obtain more robust node depth features.

[0119] like Figure 5 As shown in the figure, the GRACE algorithm, a framework for unsupervised node-level graph contrast learning, can learn node representations by maximizing the consistency of node representations between two graphs.

[0120] First, the original transaction graph G is destroyed to generate two subgraphs G1 and G2. Then, the node representations of the subgraphs are obtained through the encoder, which are recorded as U and V respectively. Then, the nodes between the views are compared based on their consistency. For any node v i , which generates the embedding u in a view i is considered as an anchor embedding, the node embedding v generated in another view i For positive samples, except v in two views i Nodes other than are considered as negative samples;

[0121]

[0122] in, Represents the paired targets of the corresponding nodes of the two views; θ(u,v)=s(g(u),g(v)) represents the cosine similarity distance, s is the cosine similarity, g is the nonlinear projection, which can improve the expression ability of the comparison; is the indicator function, which takes the value of 1 when k≠i and 0 otherwise; τ is the temperature parameter;

[0123] In this algorithm, no negative samples are sampled. Instead, a positive pair is given and negative samples are defined as all other nodes in the two views. Therefore, negative samples come from two sources, inter-view or intra-view nodes, corresponding to the second and third terms in the denominator respectively. Since the two views are symmetric, the loss of the other view is ∂(v i ,u i ) is defined similarly. Then the overall objective to be maximized is defined as the average of all positive pairs, and the overall objective function is:

[0124]

[0125] The subgraph generation method requires destroying the original graph in terms of structure and attributes, so as to construct different node contexts for the model to compare. Therefore, the original graph is destroyed by randomly deleting some edges and randomly masking some node features.

[0126] The random deletion of some edges first samples a random masking matrix Each element in the matrix is ​​generated according to Bernoulli distribution; if A ij =1, then the element values ​​in the matrix come from Bernoulli distribution otherwise where p r is the probability of each edge being deleted; the resulting adjacency matrix is: Where (x°y) i =x i y i represents the Hadamard product;

[0127] The random shielding of some node features is first performed on the random vector Sampling is performed, where each dimension value is independently selected from the m is extracted from the Bernoulli distribution, that is, Then, the generated node features Where [·;] represents the splicing operation, (x°y) i =x i y i Represents the Hadamard product.

[0128] In one embodiment, the temporal graph neural network is a trained network; during training, first, the memory module and the original information are initialized. Then, a loop is entered to sequentially obtain the transaction graph of each batch of training sets, randomly destroy its edges and features, and generate two enhanced subgraphs. Next, information is calculated and information of the same nodes is aggregated to obtain updated memories. Then, the temporal graph attention mechanism is used to obtain the node embeddings of the two subgraphs respectively. After obtaining the node embeddings, the loss function is calculated by the contrastive learning algorithm at the subgraph node level, and the model parameters are updated by backpropagation. Finally, the original information is calculated and saved, and the updated memory is saved. After the model is trained, the model parameters are saved, which can be used to obtain node features;

[0129] The specific algorithm is shown in Algorithm 2.

[0130]

[0131] Step 5: Input the deep features of the node into the binary classifier of the LightGBM algorithm to learn and determine whether the transaction is a phishing fraud transaction.

[0132] In one implementation, the phishing transaction detection module classifies Ethereum transactions, enabling the model to distinguish between phishing fraud transactions and legitimate transactions. The complete representations of the source and destination nodes of each transaction, obtained by the time series graph learning module, are then combined to form an edge representation. Finally, the edge representation is input into the binary classifier of the LightGBM algorithm to learn and determine whether the transaction is a phishing fraud transaction.

[0133] This embodiment also provides a phishing fraud detection device for on-chain transaction data, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the phishing fraud detection method for on-chain transaction data is implemented.

[0134] This embodiment also provides a phishing fraud detection product for on-chain transaction data, including a computer program, which implements the phishing fraud detection method for on-chain transaction data when executed by a processor.

[0135] The present invention is further described below through specific experiments.

[0136] In this example, accounts marked as "phish-hack" (i.e., phishing fraud accounts) were crawled from Etherscan's tag cloud. As of March 2023, a total of 9,355 phishing addresses were crawled. Since the phishing fraud data of phishing nodes often explodes in a period of time, only the transactions of this part of the phishing nodes with a large concentration are retained, and transactions from a long time ago are ignored. The experiment marks these transaction records as positive examples, and the rest are marked as negative examples. The experiment uses these phishing addresses as central nodes and obtains their first-order and second-order neighbors and transactions between them in the Ethereum database. Each transaction includes the following information: (1) From Address; (2) To Address; (3) Timestamp; (4) Value; (5) Gas; (6) Transaction Type. Finally, a total of 7,006 phishing addresses' transaction-related data were obtained in the database, plus the related data of their first-order and second-order neighbors, totaling 209,517,529 Ethereum addresses and 963,969,163 transaction records.

[0137] Module 1: Obtain the account addresses of both parties in the on-chain transaction to be identified, obtain the transactions related to the two addresses, and form a first-order subgraph. Further obtain the transactions related to the first-order subgraph address to form a second-order subgraph. The related transactions include all transactions between the source node and the target node, and the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between its first-order neighbors and its second-order neighbors.

[0138] To limit the size of the second-order subgraph, the experiment used 1,000 phishing addresses as central nodes. The transaction volume of first-order neighbors and second-order neighbors was limited to 50 or less. The resulting dataset used 850 phishing addresses as the training set and 150 phishing addresses as the test set. The specific statistics of the dataset are as follows:

[0139]

[0140] Module 2: Preprocess the second-order subgraph data described above, processing nodes, edges, and related data in turn. First, recode the 40-bit hexadecimal data of each node address into a number, starting at 0. Similarly, reset the edge numbering to start at 0. Next, format the timestamp (year-month-day T hour:minute:second) into a number, subtract the smallest timestamp in the transaction graph, and represent the time starting at 0. Finally, standardize the transaction fields (value and gas) and calculate the mean μ and standard deviation σ of the raw data. For each data point x, calculate its standardized value z = (x-μ) / σ.

[0141] Module 3: Extract statistical features of nodes from the second-order subgraph, including transaction data features and graph structural features. Transaction features have 10 dimensions, including in-degree, out-degree, total degree, incoming transaction amount, outgoing transaction amount, total transaction amount, total number of neighbors, inverse of transaction frequency, percentage of neighbors with all zero transactions, and number of transactions with the most frequently transacted neighbor. Graph structural features have 8 dimensions, including in-degree centrality, out-degree centrality, degree centrality, average neighbor degree, page rank, average clustering coefficient, eccentricity, and number of simple paths. Finally, a time series graph is generated.

[0142] Module 4: In each round and batch of cycles, for a transaction at a certain moment, with the source node and the target node as the center nodes, filter out the transactions before that moment and generate a second-order subgraph of the source node and the target node. Randomly destroy the edges and features of the subgraph to generate an enhanced subgraph. Figure 1 Kazuko Figure 2 .

[0143] Module 4.1: Use temporal coding techniques to Figure 1 Kazuko Figure 2 The transaction time is encoded as the feature representation.

[0144] Module 4.2: Counting pairs individually Figure 1 Kazuko Figure 2 For the historical transaction messages of the same node, the latest message is used to aggregate multiple messages, and finally the memory of each node is updated to obtain the sub- Figure 1 Kazuko Figure 2 Node history representation;

[0145] Module 4.3: Using two layers of time series graph attention layer, for each node, we aggregate its neighbor node information and time series information to obtain sub-nodes. Figure 1 Kazuko Figure 2 Node neighbor aggregation representation;

[0146] Module 4.4: Use feedforward neural network to process raw statistical data and combine it with aggregate information to obtain sub-data. Figure 1 Kazuko Figure 2 The final node deep feature representation;

[0147] Module 4.5: For submodules obtained from modules 4.1-4.4 Figure 1 Kazuko Figure 2 The deep feature representation of nodes in the two graphs is obtained by maximizing the consistency of the node representation between the two graphs as the contrast loss. The parameters of the temporal graph neural network are then optimized through backpropagation of the optimization function, thereby effectively learning the node representation.

[0148] The parameters of the timing graph neural network are set as:

[0149]

[0150] Module 5: For the original subgraph generated by module 4, the node deep feature representation of the subgraph is obtained through modules 4.1-4.4 in sequence, and sent to the LightGBM model for training. The optimal training parameters of the LightGBM model are retained through the "early stopping" strategy.

[0151] The LightGBM model parameters are set to:

[0152]

[0153] In the experiment, the training set data was used to execute modules 1-5 to obtain the trained time series graph neural network and LightGBM model, and the test set data was used to execute modules 1-5 to predict the results of each transaction. The final experimental results achieved an F1 score of 87.23% and an AUC of 98.43%.

[0154] It should be understood that the embodiments described above are only some of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention may be arbitrarily combined with each other to form a feasible technical solution. Such combination is not restricted by the order of steps and / or structural composition mode, but must be based on the ability of ordinary technicians in this field to implement it. When the combination of technical solutions is mutually inconsistent or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0155] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of protection of the patent of the present invention. Under the guidance of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested by the present invention shall be based on the attached claims.

Claims

1. A phishing fraud detection method for on-chain transaction data, characterized in that: The following steps are involved: Step 1: Obtain the account addresses of both parties in the on-chain transaction to be identified, obtain the transactions related to the two addresses, and form a first-order subgraph. Further obtain the transactions related to the first-order subgraph address to form a second-order subgraph. The related transactions include all transactions between the source node and the target node, and the second-order subgraph includes all transactions between the fishing node and its first-order neighbors, and between its first-order neighbors and its second-order neighbors. Step 2: Preprocess the nodes, edges and related data of the second-order subgraph in turn; Step 3: Extract the statistical features of the nodes, including transaction data features and graph structure features, and generate a time series graph; Step 4: Extract the deep features of the nodes based on the temporal graph neural network; The time series graph-based neural network includes a time encoding module, an aggregated historical node representation module, an aggregated neighbor node representation module, an aggregated node statistical feature module, and a comparative learning module; The time encoding module includes a time encoding function that can project 1-dimensional time into d t A temporal representation of the dimension, where the parameters defined are learnable parameters; The aggregated historical node representation module includes a message function, an aggregation function, and a memory function. In the message function, for each transaction, the source node feature, the target node feature, the edge feature, and the time code are concatenated to form a transaction message, whose dimension is d. m +d m +d e +d t , where d m is the node memory dimension, d e is the edge feature dimension, d t is the time representation dimension; in the aggregation function, for multiple messages of a node, multiple messages are merged into one message by average aggregation or latest aggregation; in the memory function, the GRU model is used for learning and memory, the input is the message, and the output is the node memory representation. The GRU model receives d m +d m +d e +d t dimension message and update d m Dimensional node memory representation, that is, node history representation; The aggregated neighbor node representation module consists of multiple layers of temporal graph attention layers, where the input of the latter layer is the output of the previous layer, and the input of the first layer is the node history representation; for the temporal graph attention layer, the attention scores of the source node features, edge features, and target node features are first calculated in sequence based on the multi-head attention mechanism, and are denoted as e l 、e e and e r , all three dimensions are mapped to d n *heads, where d n is the final node neighbor aggregation representation dimension, heads is the number of heads; then, the e of each transaction l 、e e and e r Add them together to get e le =e l +e e ,e ler =e le +e r , through the activation function leaky_relu to aggregate the result e ler Activate and normalize the attention score to the attention weight through softmax; then recalculate e based on the attention weight le , and then for each node, the e le Sum to get the attention output; finally, use the fully connected layer to map the attention output to the node neighbor aggregation representation with dimension d n ; The node statistical feature aggregation module includes a two-layer fully connected layer; first, the first layer maps the node statistical features to d s dimensional node statistical feature representation; then concatenate it with the node neighbor aggregation representation in the previous step to obtain d s +d n Finally, the vector representation is mapped to d through the second fully connected layer. d Dimensional node deep feature representation; The contrastive learning module includes an encoder, a mapper, and contrastive learning. The encoder consists of four modules: a temporal encoding module, an aggregated historical node representation module, an aggregated neighbor node representation module, and an aggregated node statistical feature module. The mapper consists of a two-layer fully connected layer. Contrastive learning is based on randomly destroying the original graph to generate enhanced subgraphs 1 and 2. The encoder obtains node representations, which are then mapped to a projection space by the mapper to maximize the consistency of the node representations between the two graphs for contrastive learning. Step 5: Input the deep features of the node into the binary classifier of the LightGBM algorithm to learn and determine whether the transaction is a phishing fraud transaction.

2. The method for detecting phishing fraud against on-chain transaction data according to claim 1, characterized in that: In step 2, first, the 40-bit hexadecimal data of each node address is recoded as a number, starting from 0, and the edge sequence is reset to start from 0. Next, the timestamp "year-month-day T hour: minute: second" is formatted as a number, and then the smallest timestamp in the transaction graph is subtracted, and the time is represented starting from 0. Finally, the data of the transaction fields value and gas are standardized, and the mean μ and standard deviation σ of the original data are calculated. For each data point x, its standardized value z = (x-μ) / σ is calculated.

3. The method for detecting phishing fraud against on-chain transaction data according to claim 1, characterized in that: In step 3, the transaction data features include in-degree, out-degree, total degree, incoming transaction amount, outgoing transaction amount, total transaction amount, total number of neighbors, inverse of transaction frequency, percentage of neighbors with all zero transactions, and number of transactions with the most frequently transacted neighbor; The graph structural features include in-degree centrality, out-degree centrality, degree centrality, average neighbor degree, page rank, average clustering coefficient, eccentricity and number of simple paths.

4. The phishing fraud detection method for on-chain transaction data according to claim 1 is characterized in that: The specific implementation of step 4 includes the following sub-steps: Step 4.1: Use the time encoding function Map time t to a continuously differentiable function φ d (t), the time series information is used as a feature in the graph neural network for learning, and the calculation formula is as follows: Among them, time t is projected into the feature representation of dimension 2d, ω i is the parameter to be learned, i∈{1,…,d}; Step 4.2: Aggregate historical node representations; For each node i at time t, use vector s i (t) represents its memory state, i.e., the historical interaction record of the node; the memory of a new node is initialized to a zero vector and then dynamically updated for each transaction involving the new node; for transaction e ij (t), that is, when the source node i and the target node j have a transaction at time t, the memory of the two nodes will be updated respectively. The two messages are calculated as follows: m i (t)=msg s (s i (t - ),s j (t - ),Δt,e ij (t)); m j (t)=msg d (s j (t - ),s i (t - ),Δt,e ij (t)); Among them, s i (t - ),s j (t - ) represent the memory of nodes i and j before time t, msg s with msg d is a message function, implemented by direct concatenation, and Δt is the time difference between this and the previous transaction; Batch processing involves multiple transactions m involving the same node i in the same batch i (t1),…,m i (t b ), the calculation formula is as follows: where t1, …, t b <t; agg represents an aggregation function, which is implemented by aggregating the latest message or the average message; Subsequently, processing each transaction involving the node itself will update the node's memory, calculated as follows: Among them, mem represents the memory function, which is implemented using the GRU model; Step 4.3: Use the temporal graph attention mechanism to learn node representation by aggregating neighbor node information and temporal information; The hidden representation of node i at time t in layer l is The input is timestamp t, the neighbor node information at layer l-1 and feature e i1 (t1),…,e iN (t N ), the node embedding formula is as follows: K (l) (t)=V (l) (t)=C (l) (t); Among them, || is the connection operator, φ is the time code; Q (l) (t) is a reference node, i.e., the target node or one of its l-1 hop neighbors; K (l) (t) and V (l) (t) is its neighbor; N is the number of neighbor nodes of node i; FFN() represents the feedforward neural network, FFN (l) () represents the feedforward neural network of layer l; φ(t-t1) represents the time code at time t-t1; MultiHeadAttention (l) () represents the multi-head attention mechanism of layer l; Step 4.4: Combine the reference node representation with the aggregated information using a feedforward neural network. Among them, h i (t) is the node depth feature representation, is the node neighbor aggregation representation, is the node statistical data feature; Step 4.5: Learn node representations by maximizing the consistency of node representations between the two graphs and optimize model parameters using contrastive loss to obtain more robust node deep features; First, the original transaction graph G is destroyed to generate two subgraphs G1 and G2. Then, the node representations of the subgraphs are obtained through the encoder, which are recorded as U and V respectively. Then, the nodes between the views are compared based on their consistency. For any node v i , which generates the embedding u in a view i is considered as an anchor embedding, the node embedding v generated in another view i For positive samples, except v in two views i Nodes other than are considered as negative samples; Among them, l(u i ,v i ) represents the paired targets of the corresponding nodes of the two views; θ(u,v)=s(g(u),g(v)) represents the cosine similarity distance, s is the cosine similarity, g is the nonlinear projection, which can improve the expression ability of the comparison; is the indicator function, which takes the value of 1 when k≠i and 0 otherwise; τ is the temperature parameter; The overall objective function is: Among them, the destruction of the original graph is achieved by randomly deleting some edges and randomly shielding some node features; The random deletion of some edges first samples a random masking matrix Each element in the matrix is ​​generated according to Bernoulli distribution; if A ij =1, then the element values ​​in the matrix come from Bernoulli distribution otherwise where p r is the probability of each edge being deleted; the resulting adjacency matrix is: in represents the Hadamard product; The random shielding of some node features is first performed on the random vector Sampling is performed, where each dimension value is independently selected from the m is extracted from the Bernoulli distribution, that is, Then, the generated node features Among them, [·;] represents the splicing operation, Represents the Hadamard product.

5. The method for detecting phishing fraud based on on-chain transaction data according to any one of claims 1 to 4, characterized in that: The time series graph neural network is a trained network; During training, the memory module and original information are initialized; then a loop is entered to obtain the transaction graph of each batch of training sets in turn, randomly destroy its edges and features, and generate two enhanced subgraphs; then, information is calculated and aggregated, and the updated memory is obtained from it; then, the temporal graph attention mechanism is used to obtain the node embeddings of the two subgraphs respectively; after obtaining the node embeddings, the loss function is calculated through the contrastive learning algorithm at the subgraph node level, and the model parameters are updated through backpropagation; finally, the original information is calculated and saved, and the updated memory is saved.

6. A phishing fraud detection device for on-chain transaction data, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the phishing fraud detection method for on-chain transaction data as described in any one of claims 1 to 5 is implemented.

7. A phishing fraud detection product for on-chain transaction data, comprising a computer program, characterized in that: When the computer program is executed by a processor, the method for detecting phishing fraud for on-chain transaction data as described in any one of claims 1 to 5 is implemented.

Images