Rugpull fraud token risk monitoring method and system for on-chain transaction data

Abstract

The invention discloses an on-chain transaction data-oriented rubpull fraud token risk monitoring method and system, and the method comprises the steps: obtaining token transaction data from a block chain, and constructing a token transaction data set; and then the data is processed, node attributes are enriched by analyzing the centrality and transaction frequency of nodes, a dynamic graph representing token transaction is constructed, and a complex transaction network is captured. Then, a token feature representation extraction model is utilized, and token feature representation is learned through historical representation aggregation based on a memory mechanism and neighbor node representation aggregation based on an attention mechanism in combination with statistical features of tokens; finally, a classifier is applied to the representations to identify the rugpull fraud tokens. According to the method, not only are the advantages of the graph neural network in the aspect of processing graph structure data utilized to capture time and space dependence of complex transactions, but also specific challenges in a decentralized financial environment are solved, so that the method is suitable for the decentralized financial environment which develops rapidly.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain information security technology, and relates to a fraud risk monitoring method and system for on-chain transaction data, and specifically to a rugpull fraud token risk monitoring method and system based on a dynamic graph neural network. Background Art

[0002] With the combination of blockchain technology and the rapidly developing smart contract technology, decentralized financial technology has emerged as an emerging financial technology in the blockchain scenario. Decentralized Finance (DeFi) refers to a financial system in which users can use services such as trading and lending without going through centralized financial entities. Compared with centralized exchanges that rely on access mechanisms, such as Huobi and Binance, in decentralized exchanges, users can freely create and destroy tokens simply, free of charge, and without auditing, and the user's capital flow and trading mechanism are also completely open to public access. Decentralized exchanges use deterministic smart contracts for transactions. There is no centralized third-party intervention in the entire process, and the transparency of the underlying trading mechanism can also be guaranteed. However, the pseudo-anonymity and permissionlessness of blockchain allow attackers, scammers, and illegal money transferors to act unscrupulously. The popularity of DeFi technology has also brought a series of security risks, the most common of which is the threat of rugpull fraud.

[0003] Rugpull is a malicious operation of decentralized trading. The attacker uses marketing means to attract investors to join a newly created token contract project. After a large number of victim users join this token project, the attacker uses token liquidity withdrawal, token selling restrictions, or sells all tokens, causing the project value to drop sharply and the tokens to be worthless, thus disappearing without a trace and taking away the funds of investors and users. In the cryptocurrency market, many emerging projects are subject to uncertainty and risk. Investors often find it difficult to accurately assess the value and potential risks of projects. In addition, the lack of legitimate regulatory agencies in the cryptocurrency market makes it easier for scammers to evade punishment. With the rise of decentralized finance, this type of fraud has become more and more common, and investors have suffered greatly and suffered huge losses, leaving them with a pile of worthless assets.

[0004] Therefore, studying how to detect rugpull fraud and monitor the risk of rugpull fraud has become an important issue in decentralized finance. Currently, the methods for detecting fraudulent tokens are mainly divided into rule-based methods and methods based on machine learning and deep neural networks.

[0005] Xia et al. described scam tokens on Ethereum, obtained blockchain data, and expanded the dataset by using the guilt-by-association heuristic, then trained a machine learning model and ran a classifier on the expanded dataset, finding over 11,182 scam tokens.

[0006] Mazorra et al. expanded the above dataset and designed a theoretical classification of different malicious operations in the Uniswap protocol after manually analyzing the data. They observed different ways to perform rugpull and proposed a classification of rugpull, namely simple, selling and trapdoor rugpull, proposed new features of tokens, liquidity pools and transaction graphs, and proposed a new attention-based machine learning algorithm called FT-Transformer, which uses pool state-related features and token distribution among users to predict rugpull fraud.

[0007] Cernera et al. studied the life cycle of tokens and the creators of tokens and explored the correlation between the two. They selected all liquidity pools that showed evidence of fraud from the dataset and used the retrieved data to dissect them, analyzing them from multiple perspectives, and developed a method to systematically look for operations that follow the same pattern explored in the case study, formalizing rugpull activities and using the dataset to systematically identify rugpull.

[0008] Existing research has achieved certain results, describing various characteristics of fraud tokens and rugpull fraud, and also proposed some methods for fraud detection, but it still has certain limitations, such as small data sets, relying mostly on manual verification, and machine learning-based detection relying on historical transactions of fraud tokens, which may not be able to quickly adapt to the changing strategies of fraudsters, affecting their real-time prediction accuracy and limiting the use scenarios. In addition, current research methods lack consideration of time factors, and most of them classify tokens after rugpull occurs, which cannot achieve early warning before rugpull occurs, and as market trends change, these algorithms will have to be retrained to continuously add new information.

[0009] Therefore, studying how to detect rugpull fraud and monitor rugpull fraud risks remains an important issue, and more adaptive methods or models are needed to improve detection results. Summary of the invention

[0010] In order to solve the above problems, the present invention proposes a method and system for predicting the token risk of rugpull fraud in the DeFi system, which monitors token transactions and predicts the risk of rugpull fraud for each token by utilizing dynamic graph learning technology based on attention mechanism and memory mechanism.

[0011] The technical solution adopted by the method of the present invention is: a rugpull fraud token risk monitoring method for on-chain transaction data, comprising the following steps:

[0012] Step 1: Get token transaction data from the blockchain, including token address, sender and receiver addresses, transaction amount, transaction time, and transaction hash;

[0013] Step 2: Preprocess the obtained data set and extract node attributes by analyzing the centrality and transaction frequency of the nodes, and then construct a dynamic graph representing token transactions to capture the complex transaction network between addresses;

[0014] Step 3: Using the token feature representation extraction model, the token feature representation is learned by combining the statistical features of the token with the historical representation aggregation based on the memory mechanism and the neighbor node representation aggregation based on the attention mechanism;

[0015] Step 4: The token feature representation is passed through a classifier to identify rugpull fraud tokens.

[0016] Preferably, in step 2, the data is preprocessed by first standardizing the transaction timestamp into a unified format and converting the alphanumeric addresses of tokens and investors into digital indexes; then z-score standardization is performed on the transaction data to ensure consistency between different tokens; and finally, the transaction records are reconstructed and represented as transactions from the sender to the token address and from the token address to the receiver.

[0017] Preferably, in step 2, the node attributes are extracted by extracting a set of network-based features to capture the interaction information of each node in the transaction network; including the node's in-degree, out-degree, degree centrality, closeness centrality, betweenness centrality and eigenvector centrality, which measure the characteristics of the token node from aspects such as the incoming transaction volume, outgoing transaction volume, overall connectivity with other nodes, connection closeness and importance of the address corresponding to the node.

[0018] Preferably, in step 3, the token feature representation extraction model includes a time encoder module, a memory module, a message passing module, a memory update module, an embedding layer module and an output layer module, and the model structure is as follows: Figure 2 shown.

[0019] The time encoder module includes a linear transformation layer whose input data dimension is 1 and whose output data dimension is a given time feature dimension. The time difference between two events is input into the linear layer, and the cosine encoding is calculated using a series of cosine functions with different phases and frequencies.

[0020] The memory module is used to store the historical state of the node, including the last update time and historical state vector of each node. The node state will be updated in the memory update module based on the new interaction information and the existing memory state.

[0021] The message transmission module is used to calculate the messages of the nodes corresponding to the interactive events and aggregate the messages generated by the same node due to different events. The last update time and memory state of the node stored in the memory module are attached to the node data of the subgraph, and the historical state vector of the source node and the historical state vector of the target node stored in the memory module, the edge features and the time coding vector output by the time encoder module are concatenated to obtain the message of the corresponding node, and the latest message of each node is selected or all messages are averaged to obtain the aggregated node message.

[0022] The memory update module is used to obtain a new node state by combining the node message obtained by the message transmission module with the node history state stored in the memory module through a gated recurrent unit whose input data dimension is the message dimension and whose hidden layer dimension is the node state vector dimension. The gated recurrent unit is composed of an update gate, a reset gate and a candidate hidden state. The input node history state and the new message are respectively passed through the fully connected layer of the update gate and the reset gate to perform matrix multiplication and sigmoid operation to obtain the output of the update gate and the reset gate. The output of the reset gate is multiplied bit by bit with the input node history state to obtain the reset hidden state, and the output is matrix multiplied with the input new message and the tanh activation function to obtain the candidate hidden state. The candidate hidden state and the node history state are weighted averaged through the output of the update gate to output the final hidden state. The gated recurrent unit uses independent weight matrices for different times to gradually process the new information generated in the node interaction and update the state of the corresponding node.

[0023] The embedding layer module includes two attention layers, which connect the time encoding vector output by the time encoder module to the edge feature to obtain the edge feature of the fused time feature. The edge feature of the fused time feature and the node history state stored in the memory module pass through two attention layers in turn, and the node features are weighted and aggregated to obtain the node feature representation. The attention layer is used to randomly discard the node features and edge features respectively, and then linearly transform them through a fully connected layer and reconstruct them into a multi-head form; the reconstructed node features and edge features are matrix multiplied with the weight parameters applied to the source node features, target node features and edge features respectively, and then summed to calculate the attention scores of the nodes and edges; the source node features, edge features, and target node features are summed and softmaxed to obtain the final attention weights; the attention weights are used to weight the corresponding source node features and edge features to obtain the weighted features of each attention head, and the weighted features from the neighboring nodes are aggregated to obtain the hidden neighbor representation, and then residual connections are performed to aggregate the original node features after the linear transformation of the fully connected layer into the hidden neighbor representation, and activation operations are performed to obtain the final output.

[0024] The output layer module is used to pass the node features output by the embedding layer module through a two-layer fully connected network with a hidden layer and combine the original statistical features of the nodes to obtain the final node feature representation; the node embeddings of the source node and the target node are linearly transformed through the fully connected layer respectively, and the addition is activated and then passed through another fully connected layer to generate a link prediction score for training the model.

[0025] Preferably, in step 3, a memory mechanism is used to store the states of all nodes, and each node has a separate state vector s i (t), dynamically updated according to the node transactions that occurred; for the interaction event e between node i and node j ij (t), calculate two messages for node i and node j respectively:

[0026] m i (t) = msg s (s i (t - ),s j (t - ),Δt,e ij (t));

[0027] m j (t) = msg d (s j (t - ),s i (t - ),Δt,eij (t));

[0028] Among them, s i (t - ) is the state of node i before time t, s j (t - ) is the state of node j before time t, msg s and msg d is a learnable message function, Δt is the interaction event e ij (t) The time interval between the occurrence time t and the last interaction time of the node.

[0029] For the message m generated by different events on the same node in the batch i (t1),...,m i (t n ) to form a single message:

[0030]

[0031] Among them, Agg is an aggregation function, which can adopt RNN model or attention mechanism, etc. Here, the latest message is retained or all calculated messages are averaged.

[0032] After receiving the message generated by the event involving the node, integrate the new information from the recent interaction and update the node status:

[0033]

[0034] Among them, GRU is a gated recurrent unit model.

[0035] As a preference, in step 3, the representation of neighboring nodes is aggregated using the attention mechanism to learn the token feature representation; first, the time information is embedded, and the time embedding z of node i at time t is generated using time projection and time graph attention. i (t) to learn the temporal representation; the graph attention layer calculates the embedding of node i by aggregating the node’s neighbor information:

[0036]

[0037] Among them, Φ(·) is the time encoding function, which is used to convert the time interval into a time embedding. The time features are concatenated and forward-propagated to three different linear mappings to obtain the query vector query, the key vector key and the value vector value;

[0038]

[0039] Among them, [z(t)]0 and is the embedding generated by the current node in the previous layer at time t, [z(t)] 1:N is the neighbor node embedding, is the embedding of the neighbor node at time t1 generated by the previous layer, N is the node number; W Q , W K , W V is the learnable parameter weight matrix.

[0040] Attention weight α i It can be expressed as:

[0041]

[0042] Among them, q is the query vector in the attention mechanism, corresponding to the above q(t), K is the key vector in the attention mechanism, corresponding to the above K(t), K i is the key vector corresponding to node i, α i Represents the influence weight of node i on node v0.

[0043] Then, the hidden neighbor representation is obtained by summing up the attention output; where each attention head h in the multi-head attention mechanism (i) The output is:

[0044] h (i) (t) = Attn (i) (q (i) (t),K (i) (t),V (i) (t));

[0045] Among them, q (i) (t),K (i) (t),V (i) (t) represents the attention head h (i) Corresponding q(t),K(t),V(t).

[0046] Finally, a two-layer fully connected network is used to learn node embeddings from the outputs of different attention heads:

[0047]

[0048] Among them, x0 represents the original feature of the node, x n Represents the statistical characteristics of the target node.

[0049] Preferably, in step 4, a machine learning classifier is used to utilize the rich feature representation of the labeled tokens in the early analysis stage to predict the risk of rugpull fraud in the tokens.

[0050] Preferably, the token feature representation extraction model is a trained model; batch processing is used during the training process; a subgraph for training is obtained by sampling in each batch, and the timestamps of the nodes in the subgraph are connected with the subgraph edge features through time coding to form edge features that incorporate time coding; node messages are calculated based on interaction information, and messages generated by different interactions of the same node in the same batch are aggregated, and the memory is updated using the aggregated messages; then, the updated node memory state and the previously obtained messages are used together with the added node attribute features to calculate the node feature representation; finally, the interactions of the current batch are stored as original information in the original information storage area for use in subsequent batches, and predictions are made based on the obtained node embeddings, and the loss value is calculated based on the prediction results to optimize the model.

[0051] The technical solution adopted by the system of the present invention is: a rugpull fraud token risk monitoring system for on-chain transaction data, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the rugpull fraud token risk monitoring method for on-chain transaction data when executing the program.

[0052] The key idea is to use a dynamic graph learning-based approach to represent blockchain transaction data and capture the ever-changing complex interaction patterns between tokens. This proactive prediction capability is crucial for early identification of potential rugpull fraud tokens, allowing relevant personnel to take preventive measures before fraud occurs.

[0053] Compared with the prior art, the beneficial effects of the present invention include:

[0054] 1. This paper proposes a new scheme for predicting the risk of rugpull fraud tokens in the DeFi system. It monitors token transactions and predicts the risk of rugpull fraud for each token by using dynamic graph learning technology based on attention mechanism and memory mechanism. The key idea is to use a dynamic graph learning-based method to represent blockchain transaction data and capture the ever-changing complex interaction patterns between tokens. This proactive prediction capability is crucial for early identification of potential rugpull fraud tokens, allowing relevant personnel to take preventive measures before fraud occurs.

[0055] 2. The present invention integrates memory mechanism and attention mechanism to analyze transaction patterns and anomalies, and uses historical transaction data and neighbor node representation of tokens to learn the feature representation of tokens. In addition, node attributes such as transaction frequency and centrality measurement are used to enrich the feature analysis of tokens and enhance the ability to identify potential rugpull fraud tokens. This method not only takes advantage of the advantages of graph neural networks in processing graph structured data and capturing the complex temporal and spatial dependencies of token transactions, but also solves the unique challenges in the decentralized financial environment, making it a tool suitable for the rapidly developing decentralized financial environment and protecting investment security. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0057] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0058] Figure 2 This is a structural diagram of a token feature representation extraction model according to an embodiment of the present invention;

[0059] Figure 3 It is a flowchart of token feature representation extraction according to an embodiment of the present invention;

[0060] Figure 4 A schematic diagram of an example of token feature representation extraction according to an embodiment of the present invention;

[0061] Figure 5 This is a flowchart of token classification and identification according to an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to facilitate ordinary technicians in the field to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0063] At present, how to detect rugpull fraud and monitor the risk of rugpull fraud has become an important issue in decentralized finance. Through research in this area, we can better understand the characteristics and patterns of this fraudulent behavior and design effective detection methods to help investors better assess the risks of projects and prevent them from suffering losses from rugpull fraud. At the same time, it can also promote the healthy development of the cryptocurrency market and improve the transparency and stability of the market.

[0064] The main problem solved by the present invention is the risk monitoring of rugpull fraud tokens facing on-chain transaction data, that is, detecting whether some tokens are rugpull fraud tokens through on-chain token transaction data. Intuitively, entity abstraction can be performed based on each address or account in the token contract and token transaction, connecting them into a directed graph to represent the transaction relationship between them, and constructing a dynamic graph to represent the transaction data of one or more tokens, where the edge represents specific transaction information, the node represents the address of the token issued or the address of the token received, and the transaction data such as the transaction amount is used as the initial feature of the edge, and the node's in-degree, out-degree and centrality are used as the features of the point. Therefore, the rugpull fraud token risk monitoring task can be regarded as a token classification task that predicts the label of the node representing the token in the transaction graph.

[0065] like Figure 1 As shown, the present invention provides a rugpull fraud token risk monitoring method for on-chain transaction data. First, token transaction data is obtained from the blockchain to construct a comprehensive token transaction data set. Then the data is processed, data preprocessing and normalization are performed, and node attributes are enriched by analyzing the centrality and transaction frequency of the nodes, and then a dynamic graph representing token transactions is constructed to capture the complex transaction network between addresses. Next, the token feature representation learning module uses the token feature representation extraction model to learn the token feature representation through historical representation aggregation based on the memory mechanism and neighbor node representation aggregation based on the attention mechanism combined with the statistical characteristics of the token. Finally, the classifier is applied to these representations to identify rugpull fraud tokens.

[0066] The specific steps include:

[0067] Step 1: Get token transaction data from the blockchain, including token address, sender and receiver addresses, transaction amount, transaction time, and transaction hash;

[0068] In one embodiment, web3.py, an interface library for interacting with Ethereum nodes and retrieving real-time blockchain data, is used to collect Ethereum token transaction data, extract ERC-20 token transactions, capture detailed information including token addresses, sender and receiver addresses, transaction amounts, transaction times, and transaction hashes, and construct a token transaction dataset.

[0069] Step 2: Preprocess the obtained data set and extract node attributes by analyzing the centrality and transaction frequency of the nodes, and then construct a dynamic graph representing token transactions to capture the complex transaction network between addresses;

[0070] In one implementation, the data is first preprocessed, and then node attributes are extracted by analyzing node centrality to construct a dynamic graph.

[0071] In the data preprocessing stage, transaction timestamps are first standardized into a unified format, the alphanumeric addresses of tokens and investors are converted into digital indexes, and the transaction data is z-score standardized to ensure consistency between different tokens. Finally, the transaction records are reconstructed and represented as transactions from the sender to the token address and from the token address to the receiver, which is convenient for building dynamic graphs.

[0072] In the node attribute extraction phase, a set of network-based features are extracted to capture the interaction information of each node in the transaction network. These include the node's in-degree, out-degree, degree centrality, closeness centrality, betweenness centrality, and eigenvector centrality, etc., which measure the characteristics of the token node from the aspects of the incoming transaction volume, outgoing transaction volume, overall connectivity with other nodes, connection closeness, and importance of the corresponding address of the node.

[0073] Step 3: Using the token feature representation extraction model, the token feature representation is learned by combining the statistical features of the token with the historical representation aggregation based on the memory mechanism and the neighbor node representation aggregation based on the attention mechanism;

[0074] In one embodiment, see Figure 2 , the token feature representation extraction model includes a time encoder module, a memory module, a message passing module, a memory update module, an embedding layer module and an output layer module.

[0075] The time encoder module includes a linear transformation layer whose input data dimension is 1 and whose output data dimension is a given time feature dimension. The time difference between two events is input into the linear layer, and the cosine encoding is calculated using a series of cosine functions with different phases and frequencies.

[0076] The memory module is used to store the historical state of the node, including the last update time and historical state vector of each node. The node state will be updated in the memory update module based on the new interaction information and the existing memory state.

[0077] The message transmission module is used to calculate the messages of the nodes corresponding to the interactive events and aggregate the messages generated by the same node due to different events. The last update time and memory state of the node stored in the memory module are attached to the node data of the subgraph, and the historical state vector of the source node and the historical state vector of the target node stored in the memory module, the edge features and the time coding vector output by the time encoder module are concatenated to obtain the message of the corresponding node, and the latest message of each node is selected or all messages are averaged to obtain the aggregated node message.

[0078] The memory update module is used to obtain a new node state by combining the node message obtained by the message transmission module with the node history state stored in the memory module through a gated recurrent unit whose input data dimension is the message dimension and whose hidden layer dimension is the node state vector dimension. The gated recurrent unit is composed of an update gate, a reset gate and a candidate hidden state. The input node history state and the new message are respectively passed through the fully connected layer of the update gate and the reset gate to perform matrix multiplication and sigmoid operation to obtain the output of the update gate and the reset gate. The output of the reset gate is multiplied bit by bit with the input node history state to obtain the reset hidden state, and the output is matrix multiplied with the input new message and the tanh activation function to obtain the candidate hidden state. The candidate hidden state and the node history state are weighted averaged through the output of the update gate to output the final hidden state. The gated recurrent unit uses independent weight matrices for different times to gradually process the new information generated in the node interaction and update the state of the corresponding node.

[0079] The embedding layer module includes two attention layers, which connect the time encoding vector output by the time encoder module to the edge feature to obtain the edge feature of the fused time feature. The edge feature of the fused time feature and the node history state stored in the memory module pass through two attention layers in turn, and the node features are weighted and aggregated to obtain the node feature representation. The attention layer is used to randomly discard the node features and edge features respectively, and then linearly transform them through a fully connected layer and reconstruct them into a multi-head form; the reconstructed node features and edge features are matrix multiplied with the weight parameters applied to the source node features, target node features and edge features respectively, and then summed to calculate the attention scores of the nodes and edges; the source node features, edge features, and target node features are summed and softmaxed to obtain the final attention weights; the attention weights are used to weight the corresponding source node features and edge features to obtain the weighted features of each attention head, and the weighted features from the neighboring nodes are aggregated to obtain the hidden neighbor representation, and then residual connections are performed to aggregate the original node features after the linear transformation of the fully connected layer into the hidden neighbor representation, and activation operations are performed to obtain the final output.

[0080] The output layer module is used to pass the node features output by the embedding layer module through a two-layer fully connected network with a hidden layer and combine the original statistical features of the nodes to obtain the final node feature representation; the node embeddings of the source node and the target node are linearly transformed through the fully connected layer respectively, and the addition is activated and then passed through another fully connected layer to generate a link prediction score for training the model.

[0081] The token feature representation extraction model is a key component that uses the capabilities of graph neural networks to analyze and predict token transactions. It aims to aggregate neighbor node information and account original features, learn node feature representations, and use memory mechanisms and attention mechanisms to capture the interactive relationships and dynamic characteristics between tokens. Among them, the memory mechanism is used to update the state of each node according to the transaction history of the token, and the attention mechanism is used to learn the feature representation of the node by aggregating the information of neighbor nodes, thereby encoding the complex transaction data of the token and the transaction information and transaction relationship between investors into a vector representation, combined with the added node attributes as the feature representation of the token, for subsequent token classification detection.

[0082] Use memory mechanism to store the states of all nodes, each node has a separate state vector s i (t), is dynamically updated according to the node transactions that occur. For the interaction event e between node i and node j ij (t), calculate two messages for node i and node j respectively:

[0083] m i (t) = msg s (s i (t - ),s j (t - ),Δt,e ij (t));

[0084] m j (t) = msg d (s j (t - ),s i (t - ),Δt,e ij (t));

[0085] Among them, s i (t - ) is the state of node i before time t, s j (t - ) is the state of node j before time t, msg s and msg d is a learnable message function, Δt is the interaction event e ij (t) The time interval between the occurrence time t and the last interaction time of the node.

[0086] For the message m generated by different events on the same node in the batch i (t1),...,m i (t n ) to form a single message:

[0087]

[0088] Among them, Agg is an aggregation function, which can adopt RNN model or attention mechanism, etc. Here, the latest message is retained or all calculated messages are averaged.

[0089] After receiving the message generated by the event involving the node, the gated recurrent unit model is used to integrate the new information from the recent interaction and update the node status:

[0090]

[0091] Among them, GRU is a gated recurrent unit model.

[0092] The embedding layer uses the attention mechanism to aggregate the representations of neighboring nodes to learn token feature representations. First, the time information is embedded, and the time embedding z of node i at time t is generated using time projection and time graph attention. i (t) to learn the temporal representation. The graph attention layer calculates the embedding of node i by aggregating the node’s neighbor information:

[0093]

[0094] Among them, Φ(·) is the time encoding function, which is used to convert the time interval into a time embedding. The time features are concatenated and forward-propagated to three different linear mappings to obtain the query vector query, the key vector key and the value vector value;

[0095]

[0096] Among them, [z(t)]0 and is the embedding generated by the current node in the previous layer at time t, [z(t)] 1:N is the neighbor node embedding, is the embedding of the neighbor node at time t1 generated by the previous layer, N is the node number; W Q , W K , W V is the learnable parameter weight matrix;

[0097] Attention weight α i for:

[0098]

[0099] Among them, q is the query vector in the attention mechanism, corresponding to the above q(t), K is the key vector in the attention mechanism, corresponding to the above K(t), K i is the key vector corresponding to node i, α i Represents the influence weight of node i on node v0.

[0100] Then, the hidden neighbor representation is obtained by summing up the attention output; where each attention head h in the multi-head attention mechanism (i) The output is:

[0101] h (i) (t) = Attn (i) (q (i) (t),K (i) (t),V (i) (t));

[0102] Among them, q (i) (t),K (i) (t),V (i) (t) represents the attention head h (i) Corresponding q(t),K(t),V(t).

[0103] Finally, a two-layer fully connected network is used to learn node embeddings from the outputs of different attention heads:

[0104]

[0105] Among them, x0 represents the original feature of the node, x n Represents the statistical characteristics of the target node.

[0106] In one embodiment, the token feature representation extraction model is a trained model; the model training is performed in a self-supervised manner, and the specific training process is as follows: Figure 3 As shown in the figure. Batch processing is used in the training process. In each batch, a subgraph for training is obtained by sampling. The timestamps of the nodes in the subgraph are connected with the edge features of the subgraph through time coding to form edge features that integrate time coding. At the same time, these subgraphs are also used for memory update. The messages of related nodes are calculated by the message function from the original information stored in the previous batch. Since batch processing is adopted in the experiment, there may be multiple interactions involving the same node in the same batch, that is, the same node may have different messages, so it is necessary to aggregate the messages generated by different interactions of the same node in the same batch, and use the aggregated messages to update the memory. Then, the updated node memory state and the previously obtained messages are used together with the added node attribute features to calculate the node feature representation. Finally, the interactions of the current batch are stored as original information in the original information storage area for use in subsequent batches, and predictions are made based on the obtained node embeddings. The loss value is calculated based on the prediction results to optimize the model.

[0107] The specific algorithm is shown in Algorithm 1.

[0108]

[0109] Figure 4An example of feature representation extraction in a transaction graph is shown. Here, a subgraph with node transactions at time t1 and t2 is taken as an example. The transaction nodes are divided into first-order neighbors and second-order neighbors according to their distance. Each node updates its state s through a memory mechanism. i (t), aggregated interaction message m i (t), uses the attention mechanism to measure the importance of neighbors and thus capture the dynamic transaction patterns of nodes.

[0110] Step 4: The token feature representation is passed through a classifier to identify rugpull fraud tokens.

[0111] In one embodiment, a machine learning classifier is used to leverage the rich feature representation of tokens in the early analysis phase to predict the risk of tokens committing rugpull fraud. The token classification detection process is as follows: Figure 5 As shown, the token feature representation extraction module is used to obtain the feature representation of the token using the labeled dataset, and the feature representation of the token and its corresponding label are obtained to form the dataset of the token classification task, and then the classifier is connected to classify the token. In order to prevent problems that may be caused by an unbalanced dataset, the classification dataset is sampled using SMOTETomek comprehensive sampling, and complex classification algorithms such as the k-nearest neighbor algorithm, support vector machine algorithm, decision tree algorithm, and AdaBoost algorithm are used to evaluate and identify tokens with rugpull risks.

[0112] The present invention is further described below through specific experiments.

[0113] This embodiment collects two different data sets from Ethereum token transactions from 2019 to 2022. The main data set is an unlabeled data set containing 1,882,114 transaction records, each of which includes data such as the token address, sender and receiver addresses, transaction amount, and timestamp. The labeled data set includes 128,819 transaction records, including data from 500 normal tokens and the same number of authenticated rugpull tokens. "1" in the data set label represents rugpull token data, and "0" represents normal token data. The data set is divided into a training set, a validation set, and a test set according to the 70%-15%-15% division method. The unlabeled data is used to train the token feature representation extraction model, and the labeled data is used to train the token classification detection model.

[0114] Step 1: Use web3.py, an interface library for interacting with Ethereum nodes and retrieving real-time blockchain data, to collect data from Ethereum token transactions, extract transactions of ERC-20 tokens, capture detailed information including token addresses, sender and receiver addresses, transaction amounts, and transaction hashes, and construct the above unlabeled and labeled datasets. To limit the size of the dataset, in the unlabeled dataset, a maximum of 500 transaction data are collected for each token, and in the labeled dataset, a maximum of 200 transaction data are collected for each token.

[0115] Step 2: Preprocess the data set. First, standardize the "year-month-day T hour: minute: second" format of the transaction time to a digital timestamp format, convert the alphanumeric addresses of tokens and investors to digital indexes, and perform z-score standardization on the transaction data. Finally, reconstruct the transaction records and represent them as transactions from the sender to the token address and from the token address to the receiver. Then, extract the statistical features of the token nodes by analyzing the node centrality and transaction frequency of the token nodes, including the amount of transfer-in transactions, the amount of transfer-out transactions, the node in-degree, the node out-degree, the degree centrality, the closeness centrality, the betweenness centrality, and the eigenvector centrality. Finally, construct a dynamic graph representing the token transaction.

[0116] Step 3: Utilize the token feature representation extraction model to learn the token feature representation through historical representation aggregation based on the memory mechanism and neighbor node representation aggregation based on the attention mechanism combined with the statistical characteristics of the token nodes.

[0117] In each batch, a subgraph for training is obtained by sampling. The timestamps of the nodes in the subgraph are connected with the subgraph edge features through time coding to form edge features that integrate time coding.

[0118] At the same time, these subgraphs are also used for memory updates. The original information stored in the previous batch is used through the message passing module to calculate the messages of related nodes, and the messages generated by different events on the same node in the same batch are aggregated. The aggregated messages are used to update the memory, that is, to update the node status.

[0119] Then, two attention layers are used to aggregate the neighbor node information of each node based on the attention mechanism. The node neighbor aggregation representation is obtained by using the updated node memory state and the node message obtained by the message passing module, and the final token feature representation is obtained by combining the statistical features of the node.

[0120] During the model training process, link prediction is performed based on the node embeddings of the source node and the target node, and the loss value is calculated based on the prediction results to optimize the model.

[0121] In this example, the Adam optimizer is used, the learning rate is 0.0001, and the batch size is set to 128 during model training. The dropout rate of the graph learning model is set to 0.1, the node time feature dimension, node memory dimension, and token feature representation dimension are all set to 64, the number of attention heads is set to 8, the number of aggregated neighbors is set to 10, the number of layers is set to 2, and the number of training rounds is set to 50.

[0122] Step 4: The labeled data set is loaded with the token feature representation extraction model trained in step 3, and steps 1-3 are executed to obtain the feature representation of the token, and the feature representation of the token and its corresponding label are obtained to form a token classification data set. The classification data set is sampled using the SMOTETomek comprehensive sampling method, and then the classifier is connected to classify the token and calculate its model score. In this embodiment, four classification algorithms, including K nearest neighbor algorithm, support vector machine, decision tree and AdaBoost, are used, and the F1 score (f1_score) and balanced accuracy (balanced_accuracy_score) are used as evaluation indicators. The final experimental results are shown in the following table:

[0123]

[0124] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0125] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A rugpull fraud token risk monitoring method for on-chain transaction data, characterized in that: The following steps are involved: Step 1: Get token transaction data from the blockchain, including token address, sender and receiver addresses, transaction amount, transaction time, and transaction hash; Step 2: Preprocess the obtained data set and extract node attributes by analyzing the centrality and transaction frequency of the nodes, and then construct a dynamic graph representing token transactions to capture the complex transaction network between addresses; Step 3: Using the token feature representation extraction model, the token feature representation is learned by combining the statistical features of the token with the historical representation aggregation based on the memory mechanism and the neighbor node representation aggregation based on the attention mechanism; Step 4: The token feature representation is passed through a classifier to identify rugpull fraud tokens.

2. The rugpull fraud token risk monitoring method for on-chain transaction data according to claim 1 is characterized in that: In step 2, the data is preprocessed by first standardizing the transaction timestamps into a unified format and converting the alphanumeric addresses of tokens and investors into digital indexes; then z-score normalizing the transaction data to ensure consistency between different tokens; and finally reconstructing the transaction records, representing them as transactions from the sender to the token address and from the token address to the receiver.

3. The rugpull fraud token risk monitoring method for on-chain transaction data according to claim 1 is characterized in that: In step 2, the node attributes are extracted to extract a set of network-based features to capture the interaction information of each node in the transaction network; these include the node's in-degree, out-degree, degree centrality, closeness centrality, betweenness centrality and eigenvector centrality, which measure the characteristics of the token node from the aspects of the incoming transaction volume, outgoing transaction volume, overall connectivity with other nodes, connection closeness and importance of the address corresponding to the node.

4. The rugpull fraud token risk monitoring method for on-chain transaction data according to claim 1 is characterized in that: In step 3, the token feature representation extraction model includes a time encoder module, a memory module, a message passing module, a memory update module, an embedding layer module and an output layer module; The time encoder module includes a linear transformation layer whose input data dimension is 1 and whose output data dimension is a given time feature dimension, wherein the time difference between two events is input into the linear transformation layer, and a series of cosine functions with different phases and frequencies are used to calculate the cosine encoding; The memory module is used to store the historical state of the node, including the last update time and the historical state vector of each node; The message transmission module is used to calculate the messages of the nodes corresponding to the interactive events and aggregate the messages generated by the same node due to different events; The last update time and memory state of the node stored in the memory module are attached to the node data of the subgraph, the historical state vector of the source node and the historical state vector of the target node stored in the memory module, the edge feature and the time coding vector output by the time encoder module are concatenated to obtain the message of the corresponding node, and the latest message of each node is selected or all messages are averaged to obtain the aggregated node message; The memory update module is used to obtain a new node state by combining the node message obtained by the message transmission module with the node history state stored in the memory module through a gated recurrent unit whose input data dimension is the message dimension and whose hidden layer dimension is the node state vector dimension; the gated recurrent unit is composed of an update gate, a reset gate and a candidate hidden state, and the input node history state and the new message are respectively passed through the fully connected layer of the update gate and the reset gate to perform matrix multiplication and sigmoid operation to obtain the output of the update gate and the reset gate; the output of the reset gate is multiplied bit by bit with the input node history state to obtain the reset hidden state, and the reset hidden state is matrix multiplied with the input new message and the candidate hidden state is obtained through the tanh activation function; the candidate hidden state and the node history state are weighted averaged through the output of the update gate to output the final hidden state; The gated recurrent unit uses independent weight matrices at different times to gradually process new information generated in node interactions and update the states of corresponding nodes; The embedding layer module includes two attention layers, which connect the time encoding vector output by the time encoder module to the edge feature to obtain the edge feature fused with the time feature; The edge features of the fused time features and the node history states stored in the memory module are sequentially passed through two attention layers to perform weighted aggregation on the node features to obtain a node feature representation; the attention layer is used to randomly discard the node features and edge features, respectively, and then perform linear transformation through a fully connected layer and reconstruct them into a multi-head form; the reconstructed node features and edge features are respectively matrix multiplied with the weight parameters applied to the source node features, target node features and edge features, and then a sum operation is performed to calculate the attention scores of the nodes and edges; the source node features, edge features, and target node features are summed and softmax operated to obtain the final attention weights; the attention weights are used to weight the corresponding source node features and edge features to obtain the weighted features of each attention head, and the weighted features from the neighboring nodes are aggregated to obtain a hidden neighbor representation, and then a residual connection is performed to aggregate the original node features after the linear transformation of the fully connected layer into the hidden neighbor representation, and an activation operation is performed to obtain the final output; The output layer module is used to pass the node features output by the embedding layer module through a two-layer fully connected network with one hidden layer and combine them with the original statistical features of the nodes to obtain the final node feature representation; The node embeddings of the source node and the target node are linearly transformed through the fully connected layer respectively, added together through the activation operation and then passed through another fully connected layer to generate the link prediction score for training the model.

5. The rugpull fraud token risk monitoring method for on-chain transaction data according to claim 1 is characterized in that: In step 3, a memory mechanism is used to store the states of all nodes, and each node has a separate state vector s i (t), dynamically updated according to the node transactions that occurred; for the interaction event e between node i and node j ij (t), calculate two messages for node i and node j respectively: m i (t)=msg s (s i (t - ),s j (t - ),Δt,e ij (t)); m j (t)=msg d (s j (t - ),s i (t - ),Δt,e ij (t)); Among them, s i (t - ) is the state of node i before time t, s j (t - ) is the state of node j before time t, msg s and msg d is a learnable message function, Δt is the interaction event e ij (t) The time interval between the occurrence time t and the last interaction time of the node; For the message m generated by different events on the same node in the batch i (t1),...,m i (t n ) to form a single message: Among them, Agg is the aggregation function; After receiving the message generated by the event involving the node, integrate the new information from the recent interaction and update the node status: Among them, GRU is a gated recurrent unit model.

6. The rugpull fraud token risk monitoring method for on-chain transaction data according to claim 1 is characterized in that: In step 3, the attention mechanism is used to aggregate the representations of neighboring nodes to learn the token feature representation; first, the time information is embedded, and the time embedding z of node i at time t is generated using time projection and time graph attention i (t) to learn the temporal representation; the graph attention layer calculates the embedding of node i by aggregating the node’s neighbor information: Among them, Φ(·) is the time encoding function, which is used to convert the time interval into a time embedding. The time features are concatenated and forward-propagated to three different linear mappings to obtain the query vector query, the key vector key and the value vector value; Among them, [z(t)]0 and is the embedding generated by the current node in the previous layer at time t, [z(t)] 1:N is the neighbor node embedding, is the embedding of the neighbor node at time t1 generated by the previous layer, N is the sequence number of the neighbor node; W Q , W K , W V is the learnable parameter matrix; Attention weight α i for: Among them, q is the query vector in the attention mechanism, corresponding to the above q(t), K is the key vector in the attention mechanism, corresponding to the above K(t), K i is the key vector corresponding to node i, α i Represents the influence weight of node i on node v0; Then, the hidden neighbor representation is obtained by summing up the attention output; where each attention head h in the multi-head attention mechanism (i) The output is: h (i) (t)=Attn (i) (q (i) (t),K (i) (t),V (i) (t)); Among them, q (i) (t),K (i) (t),V (i) (t) represents the attention head h (i) Corresponding q(t), K(t), V(t); Finally, a two-layer fully connected network is used to learn node embeddings from the outputs of different attention heads: Among them, x0 represents the original feature of the node, x n Represents the statistical characteristics of the target node.

7. The rugpull fraud token risk monitoring method for on-chain transaction data according to claim 1 is characterized in that: In step 4, a machine learning classifier is used to leverage the rich feature representation of the labeled tokens from the early analysis phase to predict the risk of rugpull fraud in the tokens.

8. The rugpull fraud token risk monitoring method for on-chain transaction data according to any one of claims 1 to 7, characterized in that: The token feature representation extraction model is a trained model; Batch processing is used during training. In each batch, a subgraph for training is obtained through sampling. The timestamps of the nodes in the subgraph are connected with the subgraph edge features through time coding to form edge features that integrate time coding. Node messages are calculated based on interaction information, and messages generated by different interactions of the same node in the same batch are aggregated, and the memory is updated using the aggregated messages. Then, the updated node memory state and the previously obtained messages are used together with the added node attribute features to calculate the node feature representation. Finally, the interactions of the current batch are stored as raw information in the raw information storage area for use in subsequent batches. Predictions are made based on the obtained node embeddings, and the loss value is calculated based on the prediction results to optimize the model.

9. A rugpull fraud token risk monitoring system for on-chain transaction data, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the rugpull fraud token risk monitoring method for on-chain transaction data as described in any one of claims 1 to 8.

Images