Pump and Dump transaction detection method, equipment and product based on time sequence behavior graph

Abstract

The invention discloses a Pump and Dump detection method based on a time sequence behavior graph, equipment and a product. The method comprises the following steps: firstly, constructing original transaction data into a time sequence behavior graph G (N, E); wherein N is a set of accounts in the graph G; e is a set of transaction information in the graph G. And then extracting statistical characteristics of each account and each transaction. Calculating real-time account embedding by aggregating the transaction information of the account and the characteristics of the multi-order neighbors, and splicing the account embedding, the account statistical characteristics and the transaction statistical characteristics of the two transaction parties to obtain the real-time embedding of each transaction; then, two sets of historical normal transactions and Pump and Dump transactions are constructed respectively, and the distinguishability of the two sets is enhanced through comparative learning; and finally, predicting whether each transaction is abnormal or not by using the real-time embedding obtained by reinforcement. According to the method, whether each transaction is abnormal or not can be detected, and the problem of pseudo-ring formation caused by the fact that one user controls multiple accounts is solved to a certain extent.

Description

Technical Field

[0001] The present invention belongs to the field of Ethereum technology and deep learning technology, and relates to a Pump and Dump transaction detection method, device and product based on a timing behavior graph, and specifically to a Pump and Dump transaction detection method, device and product based on a smart contract (Smart Contract) and a graph neural network (Graph Neural Network). Background Art

[0002] ERC-20 tokens are standardized tokens implemented on the Ethereum blockchain through smart contracts. Smart contracts run on the Ethereum Virtual Machine (EVM) and define and execute ERC-20 standard interfaces, including functions such as total supply, account balance query, token transfer, and authorization. By following the ERC-20 standard, these smart contracts ensure that all tokens have consistent behavior, enabling them to interoperate seamlessly between different decentralized applications (DApps), wallets, and exchanges. The Ethereum blockchain provides a decentralized, secure, and transparent infrastructure to support the creation and execution of these smart contracts.

[0003] Due to the lack of effective supervision and transparency, there is a "Pump and Dump" phenomenon in the ERC-20 token market. Manipulators make quick profits by manipulating token prices, causing investors to face huge risks and losses in a short period of time, seriously affecting investor confidence and market stability, and also damaging the credibility and transparency of the overall market. Summary of the invention

[0004] In order to detect the existence of "Pump and Dump" in the ERC-20 token market, the present invention uses smart contract technology and graph neural network technology to provide a Pump and Dump transaction detection method, device and product based on a time-series behavior graph.

[0005] The technical solution adopted by the method of the present invention is: a Pump and Dump transaction detection method based on a time series behavior diagram, comprising the following steps:

[0006] Step 1: Construct the original transaction data into a time series behavior graph G(N,E); where N is the set of accounts in graph G, used to store accounts in transactions; E is the set of transaction information in graph G, used to store transaction relationships between accounts and transaction information during transactions, including token type, transaction amount, transaction time, and token accuracy;

[0007] Step 2: Extract the statistical features α of each account i from the time series behavior graph Gi , the statistical characteristics of each transaction eβ e , and behavioral characteristics of each transaction e , and store these features in the transaction graph G;

[0008] Step 3: By aggregating the transaction behavior characteristics of each account and the characteristics of multi-order neighbors, a real-time account embedding emb is calculated for both parties of each transaction e∈E n (n∈N), and embed emb by splicing the source account src 、Embed the target account dst , Source account statistical characteristics α src , Target account statistical characteristics α dst And transaction statistics characteristics β e Get real-time embeds of every transaction e ;

[0009] Step 4: Construct historical normal transactions and Pump and Dump transactions into two sets respectively. By calculating the Euclidean distance of real-time embeddings in the two sets and the Euclidean distance between the two sets respectively, minimize the Euclidean distance within the two sets and maximize the Euclidean distance between the sets, thereby maximizing the similarity within the sets and the difference between the sets, and enhancing the distinguishability of the real-time embedding generated by the time series behavior graph G;

[0010] Step 5: The real-time embedding obtained after reinforcement will be used to predict whether each transaction is abnormal or not

[0011] Preferably, in step 2, the statistical feature α of each account i ,include:

[0012] closeness_centrality, which is used to measure the inverse of the average distance between an account and other accounts, reflecting the proximity of an account in the network;

[0013] betweenness_centrality, which measures the importance of an account as a bridge in the network, i.e., how often an account appears in the shortest path;

[0014] indegree_centrality, which measures the degree to which the target account receives the number of connections in the directed network;

[0015] outdegree_centrality, which measures the degree to which the target account sends the number of connections in the directed network;

[0016] degree_centrality, which is the degree centrality of the account, i.e. the number of connections of the account;

[0017] eigenvector_centrality, the centrality of an account is related to the centrality of its neighbor accounts, emphasizing the connection between an account and highly central accounts;

[0018] Pagerank, used to measure the importance of a target account by calculating its stable state probability;

[0019] tx_per_account, which is the number of target account’s trading accounts / the number of target account’s transactions, and is used to measure the degree of diversity of the target account’s trading accounts;

[0020] In step 2, the statistical feature β of each transaction e ,include:

[0021] counts is the number of historical transactions between the two parties within the detection window up to the transaction;

[0022] mean, is the historical transaction mean of both parties within the detection window up to the transaction;

[0023] var is the historical transaction variance between the two parties within the detection window up to the transaction;

[0024] In step 2, the behavioral characteristics of each transaction ξ e ,include:

[0025] time, the time when the transaction occurred;

[0026] value, the amount of the transaction;

[0027] token_decimals, the precision of the tokens involved in the transaction;

[0028] token is the token contract address involved in this transaction.

[0029] As a preferred method, in step 3, a layer of real-time embedding z of account i at time t is generated. i The specific implementation of (t) includes the following sub-steps:

[0030] Step 3.1: Account feature transformation;

[0031] X′=XW n ;

[0032] in, is the account memory matrix, N is the number of accounts, F n is the dimension of account memory, is the linear transformation weight matrix of the account features, F′ is the feature dimension output by each attention head, and H is the number of attention heads;

[0033] Step 3.2: Transaction feature splicing;

[0034] The behavioral characteristics of all transactions are constructed as a matrix ξ and compared with the time difference φ(tt - ) together to obtain the behavioral feature matrix E of all transactions:

[0035] E=concat(ξ,φ(tt - ));

[0036] Among them, t is the timestamp of each transaction, t - The time when the memory of the source account of each transaction was last updated;

[0037] Step 3.3: Transaction feature transformation;

[0038] E′=EW e ;

[0039] in, is the behavioral feature matrix of transactions, M is the number of transactions, F e is the behavioral characteristic dimension of the transaction, is the linear transformation weight matrix of transaction features;

[0040] Step 3.4: Calculate the attention score e based on the transformed account features and transaction features;

[0041] e=LeakyReLU(X′a l +X′a r +E′a e );

[0042] Among them, a l ,a r ,a e ∈R F′×H×1 is the attention parameter matrix;

[0043] Step 3.5: Use the softmax function to normalize the attention score to obtain the attention weight a of each account and its neighbor account;

[0044]

[0045] in, represents the set of neighbor accounts of account i, e k represents the attention score of account i’s neighbor account k;

[0046] Step 3.6: Use the calculated attention weights to perform weighted summation on the features of neighbor accounts to achieve message passing and feature aggregation, and obtain the real-time embedding of one of the attention heads.

[0047]

[0048] Among them, h∈(1,…,H) is the serial number of the attention head, X j ′ represents the account feature transformation matrix of the neighbor accounts of account i;

[0049] Step 3.7: Concatenate the output features of all heads to get the real-time embedding of account i Here, H is the number of attention heads.

[0050] As a preferred embodiment, in step 4, by adopting neighbor account sampling, time encoder, message mechanism, and memory mechanism, account embedding and transaction embedding are generated, the historical transaction behaviors of the source account src and the target account dst are learned, and the detection capability of Pump and Dump transaction behaviors is enhanced;

[0051] The time encoder uses a finite Fourier series to encode time t:

[0052] φ(t)=[cos(w1t+ψ1),cos(w2t+ψ2),…,cos(w η t+ψ η )];

[0053] Where η is the dimension of the Fourier series after encoding at time t; weight ω j and bias ψ j is a learnable parameter, j∈{1,…,η};

[0054] The message mechanism, at any time t, for an interaction event e(t) involving the source account src and the target account dst, will generate a message msg(t) to update the memory of the source account src and the target account dst:

[0055] msg(t)=concat(m src (t - ),m dst (t - ),e(t),φ(t));

[0056] Among them, m src (t - ) is the account memory of the source account src before it is updated at time t, m dst (t - ) is the account memory of the target account dst before it is updated at time t, and e(t) is the behavioral characteristic ξ of the transaction E ; Update the memory of the source account src and the destination account dst using the same message msg(t);

[0057] For t1,…,t b ≤t, account i uses the aggregation mechanism to aggregate message msg i (t1),…,msg i (t b ):

[0058]

[0059] According to the memory mechanism, the memory of any account i will be updated after an event involving account i occurs; for an interaction event e(t) between a source account src and a target account dst, the memory of the source account src and the target account dst will be updated as follows after the event occurs:

[0060]

[0061] Among them, mem is a learnable memory update function that can maintain the order information of the sequence while capturing the temporal dependencies in the sequence data, thereby identifying and understanding the dynamic change patterns of the input data over time.

[0062] Preferably, the neighbor account sampling first generates a generated subgraph g′ according to the sampling account set seed_nodes initial account set in the given graph to be sampled g, and then filters out transactions that do not meet the conditions according to the timestamp filter ts; then, according to the setting of the number of neighbors fanouts to be sampled for each account in each layer of the graph neural network, the size of the sampling neighborhood is determined, and the corresponding frontier subgraph list frontier is returned;

[0063] The specific implementation includes the following sub-steps:

[0064] (1) The number of neighbors to be sampled for each account in each layer of the graph neural network, fanouts, is assigned to the sampling frontier list frontiers, indicating the number of neighbors to be sampled;

[0065] (2) The sampled frontier list frontiers is set to empty;

[0066] (3) Traverse the fanouts and determine whether the transaction timestamp is less than the timestamp filter ts;

[0067] If so, continue to determine whether the frontiers are full. If the frontiers are not full, add the transaction to the frontiers. If the frontiers are full, keep the latest frontiers.

[0068] If not, the transaction is discarded.

[0069] As a preferred embodiment, for the interaction event e(t) between the source account src and the target account dst, after obtaining the real-time embedding z of the source account src and the target account dst src (t) and z dst (t), the real-time embedding h of the interactive event e(t) is obtained as follows e (t):

[0070] h e (t) = concat(z src (t),z dst (t),β e ,α src ,α dst );

[0071] Among them, β e is the statistical feature of the transaction level between the source account src and the target account dst, α src and α dst It is the statistical characteristics of the source account src and the target account dst at the account level.

[0072] Preferably, in step 4, the contrast loss function used in contrastive learning is:

[0073]

[0074] in, Calculate the positive sample set S P Internal sample h i 、h j The average of the sum of squared Euclidean distances between them; Calculate the negative sample set S N Internal sample h i 、h j The average of the sum of squared Euclidean distances between them; Calculate the distance difference between positive samples and negative samples. By setting a threshold margin, if the distance between positive samples and negative samples is less than this threshold, a positive loss is generated to distinguish the two types of samples.

[0075] The technical solution adopted by the device of the present invention is: a Pump and Dump transaction detection device based on a timing behavior diagram, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the Pump and Dump transaction detection method based on the timing behavior diagram is implemented when the processor executes the program.

[0076] The technical solution adopted by the product of the present invention is: a Pump and Dump transaction detection product based on a timing behavior diagram, including a computer program, and when the computer program is executed by a processor, the Pump and Dump transaction detection method based on the timing behavior diagram is implemented.

[0077] Compared with the prior art, the beneficial effects of the present invention include:

[0078] (1) The present invention proposes a transaction-based temporal behavior graph to detect pump and dump behaviors in the ERC-20 token market, extending the detection of pump and dump behaviors in traditional centralized exchanges off-chain to the blockchain.

[0079] (2) The present invention uses the token type as one of the parameters of the model, constructs the transactions of different tokens into graphs respectively, and selects the native token of each token as its value scale, which effectively avoids the interference of inconsistent precision and unstable exchange rates between different tokens on the model.

[0080] (3) The present invention introduces a memory mechanism that can keenly capture suspicious transactions of a certain account by learning and recording the historical transaction behavior of each ERC-20 account, and further refine the detection granularity of pump and dump events from "an event occurred" to "one of the transactions", which is of great significance for maintaining the credit of the ERC-20 token market.

[0081] (4) The present invention proposes a pump and dump detection model based on the transaction timing behavior graph, which combines the graph neural network and the time information of the transaction, so as to effectively capture and predict the evolution process of the edges in the graph, and can timely detect the sequential and sudden pump and dump behaviors in the timing. And to a certain extent, it can solve the "pseudo-loop" problem caused by one user controlling multiple accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0083] Figure 1 A schematic diagram of a method according to an embodiment of the present invention;

[0084] Figure 2 A schematic diagram of a neighbor account sampling mechanism according to an embodiment of the present invention;

[0085] Figure 3 A schematic diagram of a message mechanism according to an embodiment of the present invention;

[0086] Figure 4 A schematic diagram of an account memory mechanism according to an embodiment of the present invention;

[0087] Figure 5 A schematic diagram of generating account embedding according to an embodiment of the present invention. DETAILED DESCRIPTION

[0088] In order to facilitate ordinary technicians in the field to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0089] This embodiment detects the Pump and Dump behavior in the ERC-20 token market based on the time series behavior graph of transactions. First, the ERC-20 token transactions are constructed into a graph, and the statistical characteristics of the trading accounts and their transactions are collected on this basis. Then, the trading behavior of the account will be used to generate the embedding of each transaction. For a transaction e at time t, the n-order frontier subgraphs of the source account src and the target account dst before time t are respectively screened out, and the messages are aggregated layer by layer from the n-order neighbors toward the source account src and the target account dst, and the memory is updated to generate the embedding emb of the source account src and the target account dst. src and emb dst , and concatenate the source account statistical features α src , Target account statistical characteristics α dst And transaction statistics characteristics β e Get real-time embeds of every transaction e Subsequently, by comparing Pump and Dump transactions with normal transactions, the distinction between the two transactions is expanded and the embedding representation of the two is enhanced. Finally, the LightGBM model is used to distinguish Pump and Dump transactions from normal transactions.

[0090] Please see Figure 1 , this embodiment provides a Pump and Dump transaction detection method based on a timing behavior diagram, comprising the following steps:

[0091] Step 1: Construct the original transaction data into a time series behavior graph G(N,E); where N is the set of accounts in graph G, used to store accounts in transactions; E is the set of transaction information in graph G, used to store transaction relationships between accounts and transaction information during transactions, including token type, transaction amount, transaction time, and token accuracy;

[0092] In one embodiment, the DGL library is used to construct the raw transaction data into a graph. Considering that new tokens appear in the ERC-20 token market every day, and different tokens have different transaction characteristics in the trading market (for example, some tokens have higher precision and daily transaction volume), the transactions of each token are constructed into graphs separately, and in different transaction graphs, the same ERC-20 account will be marked as a different account, so that the transaction graphs composed of different tokens are completely isolated from each other.

[0093] Step 2: Extract the statistical features α of each account i from the time series behavior graph G i , the statistical characteristics of each transaction eβ e , and behavioral characteristics of each transaction e , and store these features in the transaction graph G;

[0094] In one embodiment,

[0095] By collecting the statistical characteristics of accounts and transactions in the transaction graph and the behavior of transactions, the embedding capability of each transaction is enhanced.

[0096] Among them, the statistical feature α of each account i include:

[0097] closeness_centrality: measures the inverse of the average distance from an account to other accounts, reflecting how close an account is in the network.

[0098] betweenness_centrality: Measures the importance of an account as a bridge in the network, that is, how often the account appears in the shortest path.

[0099] indegree_centrality: Measures the degree to which the target account receives the number of connections in the directed network.

[0100] outdegree_centrality: A measure of how far the target account outsources the number of connections in the directed network.

[0101] degree_centrality: The degree centrality of an account, i.e. the number of connections of the account.

[0102] eigenvector_centrality: The centrality of an account is related to the centrality of its neighbor accounts, emphasizing the connection between an account and highly central accounts.

[0103] PageRank: measures the importance of a target account by calculating its stable state probability.

[0104] tx_per_account: the number of target account's trading accounts / the number of target account's transactions, used to measure the degree of diversity of the target account's trading accounts.

[0105] The statistical characteristics of each transaction β e ,include:

[0106] counts: The number of historical transactions between the two parties within the detection window before this transaction.

[0107] mean: the mean of historical transactions between the two parties within the detection window up to the transaction.

[0108] var: The historical transaction variance between the two parties within the detection window before the transaction.

[0109] The behavioral characteristics of each transaction e ,include:

[0110] time: The time when the transaction occurred.

[0111] value: the amount of the transaction.

[0112] token_decimals: The precision of the tokens involved in this transaction.

[0113] token: The token contract address involved in this transaction.

[0114] Among them, the behavioral features at the transaction level will be used for embedded learning based on the transaction-based temporal behavior graph.

[0115] Step 3: By aggregating the transaction behavior characteristics of each account and the characteristics of multi-order neighbors, a real-time account embedding emb is calculated for both parties of each transaction e∈E n (n∈N), and embed emb by splicing the source account src 、Embed the target account dst , Source account statistical characteristics α src , Target account statistical characteristics α dst And transaction statistics characteristics β e Get real-time embeds of every transaction e ;

[0116] In one implementation, by adopting neighbor account sampling, time encoder, message mechanism, and memory mechanism, account embedding and transaction embedding are generated, historical transaction behaviors of source account src and target account dst are learned, and the detection capability of Pump and Dump transaction behaviors is enhanced;

[0117] In one embodiment, the neighbor account sampling, graph neural network faces the problem of computational complexity and memory consumption when processing large-scale graph data. In order to cope with these challenges, sampling is usually required. Figure 2 As shown in the figure, it first generates a generated subgraph g′ according to the given sampling account set seed_nodes initial account set in the graph to be sampled g, and then filters out transactions that do not meet the conditions according to the timestamp filter ts; then, according to the setting of the number of neighbors to be sampled for each account in each layer of the graph neural network, fanouts, it determines the size of the sampling neighborhood and returns the corresponding frontier subgraph list frontier;

[0118] The following is a formal definition of neighbor account sampling:

[0119] The image to be sampled g

[0120] The sample account set seed_nodes in the graph to be sampled

[0121] The number of neighbors to be sampled for each account in each layer of the graph neural network, fanouts

[0122] Timestamp filter ts for sampling

[0123] List of sampled frontiers frontiers

[0124] The specific algorithm is shown in Algorithm 1:

[0125]

[0126] In one embodiment, the time encoder encodes the time t using a finite Fourier series:

[0127] φ(t)=[cos(w1t+ψ1),cos(w2t+ψ2),…,cos(w η t+ψ η )];

[0128] Where η is the dimension of the Fourier series after encoding at time t; weight ω j and bias ψ j is a learnable parameter, j∈{1,…,η};

[0129] In one embodiment, the message mechanism refers to a method of transmitting information in a dynamic graph, which is used to process the evolution of accounts and transactions over time. This mechanism allows the model to effectively transmit and aggregate information while considering the structure and time changes of the graph, thereby improving the modeling ability and prediction performance of dynamic graph data.

[0130] At any time t, for an interaction event e(t) involving the source account src and the target account dst, a message msg(t) will be generated to update the memory of the source account src and the target account dst:

[0131] msg(t)=concat(m src (t - ),m dst (t - ),e(t),φ(t));

[0132] Among them, m src (t - ) is the account memory of the source account src before it is updated at time t, m dst (t - ) is the account memory of the target account dst before it is updated at time t, and e(t) is the behavioral characteristic ξ of the transaction E ; Use the same message msg(t) to update the memory of the source account src and the target account dst. This approach can record the direction relationship of the interaction event and reduce the extra time overhead in calculating the source account src and the target account dst messages separately.

[0133] like Figure 3 As shown in Figure 2, batch processing for efficiency reasons may result in multiple events involving the same account i in the same batch. Since the model generates a message for each event, for t1,…,t b ≤tUse aggregation mechanism to aggregate message msg i (t1),…,msg i (t b ):

[0134]

[0135] Among them, the max method is called "latest retention", which means retaining the latest message of a given account i.

[0136] In one embodiment, if Figure 4 As shown, the memory mechanism records the account memory m of all accounts i encountered up to time t. i (t). The memory of any account i will be updated after an event involving account i occurs (such as interaction with another account or change to the account itself). This module is able to memorize the long-term behavior habits of each account in the graph and can be seen as a compressed representation of the account's historical behavior. When encountering a new account, its memory will be initialized to a zero vector and updated for each event involving the account during training and testing.

[0137] The memory of any account i will be updated after an event involving account i occurs; for an interaction event e(t) involving a source account src and a target account dst, the memory of the source account src and the target account dst will be updated as follows after the event occurs:

[0138]

[0139] Among them, mem is a learnable memory update function that can maintain the order information of the sequence while capturing the temporal dependencies in the sequence data, thereby identifying and understanding the dynamic change patterns of the input data over time.

[0140] In one embodiment, the generating of account embedding is used to generate a real-time embedding z of account i at any time t. i (t). The embedding module can avoid the so-called “memory aging” problem, that is, since the memory of account i is only updated when the account is involved in an interaction event, the memory of account i will become stale when there are no events for a long time.

[0141] The account embedding module introduces an attention mechanism to more effectively integrate the features of accounts and transactions. Figure 5 As shown in Figure 2, it receives a graph account memory matrix and transaction feature matrix as input, generates a new feature representation for each account by aggregating neighbor account features and performing feature transformation. The output is the account feature matrix after convolution and transformation, which retains the graph structure information and enhances the expressiveness of account features.

[0142] Generate a real-time embedding z of account i at time t using the following method i (t):

[0143] Step 3.1: Account feature transformation;

[0144] X′=XW n ;

[0145] in, is the account memory matrix, N is the number of accounts, F n is the dimension of account memory, is the linear transformation weight matrix of the account features, F′ is the feature dimension output by each attention head, and H is the number of attention heads;

[0146] Step 3.2: Transaction feature splicing;

[0147] The behavioral characteristics of all transactions are constructed as a matrix ξ and compared with the time difference φ(tt - ) together to obtain the behavioral feature matrix E of all transactions:

[0148] e=concat(ξ,φ(tt - ));

[0149] Among them, t is the timestamp of each transaction, t - The time when the memory of the source account of each transaction was last updated;

[0150] Step 3.3: Transaction feature transformation;

[0151] E′=EW e ;

[0152] in, is the behavioral feature matrix of transactions, M is the number of transactions, F e is the behavioral characteristic dimension of the transaction, is the linear transformation weight matrix of transaction features;

[0153] Step 3.4: Calculate the attention score e based on the transformed account features and transaction features;

[0154] e=LeakyReLU(X′a l +X′a r +E′a e );

[0155] Among them, a l ,a r ,a e ∈R F′×H×1 is the attention parameter matrix;

[0156] Step 3.5: Use the softmax function to normalize the attention score to obtain the attention weight a of each account and its neighbor account;

[0157]

[0158] in, represents the set of neighbor accounts of account i, e k represents the attention score of account i’s neighbor account k;

[0159] Step 3.6: Use the calculated attention weights to perform weighted summation on the features of neighbor accounts to achieve message passing and feature aggregation, and obtain the real-time embedding of one of the attention heads.

[0160]

[0161] Among them, h∈(1,…,H) is the serial number of the attention head, X j ′ represents the account feature transformation matrix of the neighbor accounts of account i;

[0162] Step 3.7: Multi-head aggregation

[0163]

[0164] Where H is the number of attention heads. The output features of all heads are concatenated to obtain the real-time embedding of account i.

[0165] In one embodiment, the transaction embedding is generated, for an interaction event e(t) between a source account src and a target account dst, after obtaining the real-time embedding z of the source account src and the target account dst. src (t) and z dst (t), the real-time embedding h of the interactive event e(t) is obtained as follows e (t):

[0166] h e (t) = concat(z src (t),z dst (t),β e ,α src ,α dst );

[0167] Among them, β e is the statistical feature of the transaction level between the source account src and the target account dst, α src and α dst It is the statistical characteristics of the source account src and the target account dst at the account level.

[0168] Step 4: Construct historical normal transactions and Pump and Dump transactions into two sets respectively. By calculating the Euclidean distance of real-time embeddings in the two sets and the Euclidean distance between the two sets respectively, minimize the Euclidean distance within the two sets and maximize the Euclidean distance between the sets, thereby maximizing the similarity within the sets and the difference between the sets, and enhancing the distinguishability of the real-time embedding generated by the time series behavior graph G;

[0169] In one embodiment, the contrast loss function used in the contrast learning is:

[0170]

[0171] in, Calculate the positive sample set S P Internal sample h i 、h j The average of the sum of squared Euclidean distances between them; Calculate the negative sample set S N Internal sample h i 、h j The average of the sum of squared Euclidean distances between them; Calculate the distance difference between positive samples and negative samples. By setting a threshold margin, if the distance between positive samples and negative samples is less than this threshold, a positive loss is generated to distinguish the two types of samples.

[0172] Step 5: The real-time embedding obtained after enhancement will be used to predict whether each transaction is abnormal or not.

[0173] In one implementation, a LightGBM model is used as a downstream classifier. LightGBM is an efficient decision tree-based gradient boosting framework designed for fast training and low memory consumption. It was developed by Microsoft and performs well in handling large-scale datasets and high-dimensional data.

[0174] This embodiment also provides a Pump and Dump transaction detection device based on a timing behavior diagram, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the Pump and Dump transaction detection method based on the timing behavior diagram is implemented.

[0175] This embodiment also provides a Pump and Dump transaction detection product based on a timing behavior diagram, including a computer program. When the computer program is executed by a processor, the Pump and Dump transaction detection method based on a timing behavior diagram is implemented.

[0176] The present invention is further described below through specific experiments.

[0177] The data set used in this embodiment covers the period from December 1, 2022 to December 31, 2022, and includes 858 tokens and 924,508 transactions, of which 799,518 are normal transactions, accounting for 86.48%; and 124,990 are Pump and Dump transactions, accounting for 13.52%.

[0178] The parameters used in this embodiment are given below:

[0179] Training set ratio: 70%;

[0180] Validation set ratio: 15%;

[0181] Test set ratio: 15%;

[0182] Training rounds: 30;

[0183] Batch size: 512;

[0184] Optimizer: Adam;

[0185] Learning rate: 0.0001;

[0186] Account embedding dimension: 128;

[0187] Account memory dimension; 128;

[0188] Time encoding dimension: 128;

[0189] Transaction embedding dimension: 275;

[0190] Account memory update method: GRU;

[0191] Message aggregation method: latest update;

[0192] Neighbor sampling set size: 10;

[0193] Neighbor sampling method: latest sampling;

[0194] Number of attention heads: 4;

[0195] Multi-stage neighbor sampling hop count: 2;

[0196] Contrast learning margin: 0.5;

[0197] LightGBM leaf count: 127;

[0198] LightGBM learning rate: 0.1;

[0199] The present invention includes the following modules for detecting Pump and Dump transactions:

[0200] Module 1, constructs the original transaction data into a time series behavior graph G(N,E); where N is the set of accounts in graph G, used to store accounts in transactions; E is the set of transaction information in graph G, used to store transaction relationships between accounts and transaction information during transactions, including token type, transaction amount, transaction time, and token accuracy;

[0201] Module 2: Extract the statistical features of each account from the time series behavior graph G N Statistical features of each transaction E , and store these features in the transaction graph G;

[0202] Module 3, in each round of training, for a transaction e at time t, with source account src and target account dst as the source points, the transactions before time t are filtered out respectively, and the second-order frontier subgraphs of source account src and target account dst are generated. Then, starting from the second-order neighbors, messages are aggregated layer by layer toward the source account src and target account dst, the account memory is updated, and the account embedding module is used to generate the embedding emb of the source account src and target account dst.src and emb dst , and concatenate the source account statistical features α src , Target account statistical characteristics α dst And transaction statistics characteristics β e Get real-time embeds of every transaction e .

[0203] Module 4: construct historical normal transactions and Pump and Dump transactions into two sets respectively. By calculating the Euclidean distance of real-time embeddings in the two sets and the Euclidean distance between the two sets respectively, the Euclidean distance within the two sets is minimized and the Euclidean distance between the sets is maximized, thereby maximizing the similarity within the sets and the difference between the sets, strengthening the distinguishability of the real-time embedding generated by the time series behavior graph G, and recording the loss value generated by the comparative learning module of this round;

[0204] Module 5, compare the loss value of this training with the loss value of the last training. If the loss value of this training is reduced, save the parameters of each module of this training; otherwise, save the parameters of each module of the last training. If the training is not completed after 30 rounds, continue to execute module 3, and transfer the gradient in the reverse direction according to the loss value to optimize the parameters of each module; otherwise, end the training and execute module 6;

[0205] Module 6 uses the enhanced real-time embedding to train the LightGBM model, implements the "early stopping" training strategy, and retains the optimal training results of the LightGBM model.

[0206] Module 7 executes modules 1-6 on the test set, generates prediction results for each transaction, and uses FPR, FNR, and BAC values ​​to measure the detection effect of the present invention on Pump and Dump transactions.

[0207] In this embodiment, the prediction of the data set achieved FPR=0.077, FNR=0.077, and BAC=0.927.

[0208] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0209] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A Pump and Dump transaction detection method based on a time series behavior diagram, characterized in that: The following steps are involved: Step 1: Construct the original transaction data into a time series behavior graph G(N,E); where N is the set of accounts in graph G, used to store accounts in transactions; E is the set of transaction information in graph G, used to store transaction relationships between accounts and transaction information during transactions, including token type, transaction amount, transaction time, and token accuracy; Step 2: Extract the statistical features α of each account i from the time series behavior graph G i , the statistical characteristics of each transaction eβ e , and behavioral characteristics of each transaction e , and store these features in the transaction graph G; Step 3: By aggregating the transaction behavior characteristics of each account and the characteristics of multi-order neighbors, calculate the real-time account embedding emb for both parties of each transaction e∈E n , n∈N, and embeds emb by concatenating the source accounts src 、Embed the target account dst , Source account statistical characteristics α src , Target account statistical characteristics α dst and transaction statistics β e Get real-time embeds of every transaction e ; Step 4: Construct historical normal transactions and Pump and Dump transactions into two sets respectively. By calculating the Euclidean distance of real-time embeddings in the two sets and the Euclidean distance between the two sets respectively, minimize the Euclidean distance within the two sets and maximize the Euclidean distance between the sets, thereby maximizing the similarity within the sets and the difference between the sets, and enhancing the distinguishability of the real-time embedding generated by the time series behavior graph G; Step 5: The real-time embedding obtained after enhancement will be used to predict whether each transaction is abnormal or not.

2. The Pump and Dump transaction detection method based on the timing behavior diagram according to claim 1 is characterized in that: In step 2, the statistical feature α of each account i ,include: closeness_centrality, which is used to measure the inverse of the average distance between an account and other accounts, reflecting the proximity of an account in the network; betweenness_centrality, which measures the importance of an account as a bridge in the network, i.e., how often an account appears in the shortest path; indegree_centrality, which measures the degree to which the target account receives the number of connections in the directed network; outdegree_centrality, which measures the degree to which the target account sends the number of connections in the directed network; degree_centrality, which is the degree centrality of the account, i.e. the number of connections of the account; eigenvector_centrality, the centrality of an account is related to the centrality of its neighbor accounts, emphasizing the connection between an account and highly central accounts; Pagerank, used to measure the importance of a target account by calculating its stable state probability; tx_per_account, which is the number of target account’s trading accounts / the number of target account’s transactions, and is used to measure the degree of diversity of the target account’s trading accounts; The statistical characteristics of each transaction β e ,include: counts is the number of historical transactions between the two parties within the detection window up to the transaction; mean, is the historical transaction mean of both parties within the detection window up to the transaction; var is the historical transaction partner of both parties within the detection window up to the transaction; The behavioral characteristics of each transaction e ,include: time, the time when the transaction occurred; value, the amount of the transaction; token_decimals, the precision of the tokens involved in the transaction; token is the token contract address involved in this transaction.

3. The Pump and Dump transaction detection method based on the timing behavior diagram according to claim 1 is characterized in that: In step 3, a layer of real-time embedding z of account i at time t is generated i The specific implementation of (t) includes the following sub-steps: Step 3.1: Account feature transformation; X′=XW n ; in, is the account memory matrix, N is the number of accounts, F n is the dimension of account memory, is the linear transformation weight matrix of the account features, F′ is the feature dimension output by each attention head, and H is the number of attention heads; Step 3.2: Transaction feature splicing; The behavioral characteristics of all transactions are constructed as a matrix ξ and compared with the time difference φ(tt - ) together to obtain the behavioral feature matrix E of all transactions: E=concat(ξ,φ(t-t - )); Among them, t is the timestamp of each transaction, t - The time when the memory of the source account of each transaction was last updated; Step 3.3: Transaction feature transformation; E′=EW e ; in, is the behavioral feature matrix of transactions, M is the number of transactions, F e is the behavioral characteristic dimension of the transaction, is the linear transformation weight matrix of transaction features; Step 3.4: Calculate the attention score e based on the transformed account features and transaction features; e=LeakyReLU(X′a l +X′a r +E′a e ); Among them, a l ,α r ,a e ∈R F′×H×1 is the attention parameter matrix; Step 3.5: Use the softmax function to normalize the attention score to obtain the attention weight a of each account and its neighbor account; in, represents the set of neighbor accounts of account i, e k represents the attention score of account i’s neighbor account k; Step 3.6: Use the calculated attention weights to perform weighted summation on the features of neighbor accounts to achieve message passing and feature aggregation, and obtain the real-time embedding of one of the attention heads. Among them, h∈(1,…,H) is the serial number of the attention head, X j ′ represents the account feature transformation matrix of the neighbor accounts of account i; Step 3.7: Concatenate the output features of all heads to get the real-time embedding of account i Here, H is the number of attention heads.

4. The Pump and Dump transaction detection method based on the timing behavior diagram according to claim 1, characterized in that: In step 4, by adopting neighbor account sampling, time encoder, message mechanism, and memory mechanism, account embedding and transaction embedding are generated, the historical transaction behaviors of the source account src and the target account dst are learned, and the detection capability of Pump and Dump transaction behaviors is enhanced; The time encoder uses a finite Fourier series to encode time t: φ(t)=[cos(w1t+ψ1),cos(w2t+ψ2),…,cos(w η t+ψ η )]; Where η is the dimension of the Fourier series after encoding at time t; weight ω j and bias ψ j is a learnable parameter, j∈{1,…,η}; The message mechanism, at any time t, for an interaction event e(t) involving the source account src and the target account dst, will generate a message msg(t) to update the memory of the source account src and the target account dst: msg(t)=concat(m src (t - ),m dst (t - ),e(t),φ(t)); Among them, m src (t - ) is the account memory of the source account src before it is updated at time t, m dst (t - ) is the account memory of the target account dst before it is updated at time t, and e(t) is the behavioral characteristic ξ of the transaction E ; Update the memory of the source account src and the destination account dst using the same message msg(t); For t1,…,t b ≤t, account i uses the aggregation mechanism to aggregate message msg i (t1),…,msg i (t b ): According to the memory mechanism, the memory of any account i will be updated after an event involving account i occurs; for an interaction event e(t) between a source account src and a target account dst, the memory of the source account src and the target account dst will be updated as follows after the event occurs: Among them, mem is a learnable memory update function that can maintain the order information of the sequence while capturing the temporal dependencies in the sequence data, thereby identifying and understanding the dynamic change patterns of the input data over time.

5. The Pump and Dump transaction detection method based on the timing behavior diagram according to claim 4 is characterized in that: The neighbor account sampling first generates a generated subgraph g′ according to the sampling account set seed_nodes initial account set in the given graph to be sampled g, and then filters out transactions that do not meet the conditions according to the timestamp filter ts; then, according to the setting of the number of neighbors to be sampled for each account in each layer of the graph neural network, fanouts, the size of the sampling neighborhood is determined, and the corresponding frontier subgraph list frontier is returned; The specific implementation includes the following sub-steps: (1) The number of neighbors to be sampled for each account in each layer of the graph neural network, fanouts, is assigned to the sampling frontier list frontiers, indicating the number of neighbors to be sampled; (2) The sampled frontier list frontiers is set to empty; (3) Traverse the fanouts and determine whether the transaction timestamp is less than the timestamp filter ts; If so, continue to determine whether the frontiers are full. If the frontiers are not full, add the transaction to the frontiers; if the frontiers are full, keep the latest frontiers; If not, the transaction is discarded.

6. The Pump and Dump transaction detection method based on the timing behavior diagram according to claim 4 is characterized in that: For the interaction event e(t) between the source account src and the target account dst, after obtaining the real-time embedding z of the source account src and the target account dst src (t) and z dst (t), the real-time embedding h of the interactive event e(t) is obtained as follows e (t): h e (t)=concat(z src (t),z dst (t),β e ,α src ,α dst ); Among them, β e is the statistical feature of the transaction level between the source account src and the target account dst, α src and α dst It is the statistical characteristics of the source account src and the target account dst at the account level.

7. The Pump and Dump transaction detection method based on a timing behavior diagram according to any one of claims 1 to 6, characterized in that: In step 4, the contrast loss function used in contrastive learning is: in, Calculate the positive sample set S P Internal sample h i 、h j The average of the sum of squared Euclidean distances between them; Calculate the negative sample set S N Internal sample h i 、h j The average of the sum of squared Euclidean distances between them; Calculate the distance difference between positive samples and negative samples. By setting a threshold margin, if the distance between positive samples and negative samples is less than this threshold, a positive loss is generated to distinguish the two types of samples.

8. A Pump and Dump transaction detection device based on a timing behavior diagram, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the Pump and Dump transaction detection method based on the timing behavior diagram as described in any one of claims 1 to 7 is implemented.

9. A Pump and Dump transaction detection product based on a time series behavior diagram, comprising a computer program, characterized in that: When the computer program is executed by a processor, the Pump and Dump transaction detection method based on a timing behavior diagram as described in any one of claims 1 to 7 is implemented.

Images