Ethereum money laundering detection method based on graph embedding

Abstract

The invention discloses an Ethereum money laundering detection method based on graph embedding, and relates to the technical field of block chains, and the method comprises the steps: firstly obtaining the data of Ethereum full nodes and the address of a money laundering account from an Ethereum client and an authoritative Ethereum block browser Etherscan; by mining the transaction record, the behavior pattern of the money laundering person and the structural information of the transaction network are comprehensively considered, and the characteristics of the money laundering address can be automatically extracted. Specifically, the invention fuses the gas Price and the timestamp in the transaction record into a new weight, sets appropriate return parameters and exploration parameters to regulate and control the sampling tendency of random walk, and characterizes money laundering nodes. A data set is constructed by using Ethereum real data, and the effectiveness of the method is evaluated on the data set through various classifiers such as random forest. Experimental results show that the money laundering account can be accurately and effectively identified, and the method is superior to other graph embedding methods.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain, and in particular to an Ethereum money laundering detection method based on graph embedding. Background Art

[0002] At present, in the regulatory research on money laundering crimes, some studies consider improving the review and verification costs of the existing anti-money laundering (AML) system. Eddin et al. (Eddin AN, Bono J, Aparício D, et al. Anti-Money Laundering Alert Optimization Using Machine Learning with Graphs[J].arXiv preprint arXiv:2112.07508, 2021.) proposed a machine learning classification model to reduce the false positives of the AML rule-based system, but did not replace the rule-based system, and was only used to handle alarm events. On the other hand, some studies consider using machine learning methods to identify illegal behaviors such as money laundering, but their detection targets are coarse-grained, treating multiple financial crimes as a whole. Steven et al. (Farrugia S, Ellul J, Azzopardi G. Detection of illicit accounts over the Ethereum blockchain [J]. Expert Systems with Applications, 2020, 150: 113318.) used the XGboost classifier to detect malicious accounts based on Ethereum's transaction history. Compared with these methods, the present invention no longer uses traditional feature learning methods, but chooses to use graph embedding technology to automatically extract features.

[0003] In recent years, there have also been studies that use graph embedding technology for anomaly detection in Ethereum. Lin et al. (Lin D, Wu J, Xuan Q, et al. Ethereum transaction tracking: Inferring evolution of transaction networks via link prediction [J]. Physica A: Statistical Mechanics and its Applications, 2022, 600: 127504.) proposed a link prediction framework based on biased random walks to study transaction tracking, proving the impact of transaction frequency and transaction amount on the evolution of transaction networks. Wu et al. (Wu J, Yuan Q, Lin D, et al. Who are the phishers? Phishing seam detection on ethereum via network embedding [J]. IEEE Transactions on Systems, Man, and Cybernetics: Systems, 2020, 52 (2): 1156-1166.) proposed a new network embedding model trans2vec for detecting phishing scams on Ethereum by combining the transaction amount and timestamp. Although these studies used graph embedding technology, they targeted other financial crimes on Ethereum. Considering that the behavioral patterns of several financial crimes vary greatly, the effectiveness of these methods in money laundering detection remains to be proven. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides an Ethereum money laundering detection method based on graph embedding, comprising the following steps

[0005] S1. Crawl the transaction records and money laundering account addresses of the blocks through the Ethereum client and Ethereum block resource browser etherscan; and randomly select an equal amount of normal addresses without money laundering marks from the account addresses of the blocks;

[0006] S2. Use the money laundering account address and the normal address as source nodes, and obtain all transaction records within the second-order neighbor nodes starting from each source node;

[0007] S3. Remove duplicate transactions and delete transaction entries with failed transaction status;

[0008] S4. Extract money laundering features based on transaction records;

[0009] S5. Extract money laundering features based on the transaction network structure and design a random walk search method for the Ethereum transaction network;

[0010] S6. Embed the nodes into the input classification model to identify and detect money laundering nodes.

[0011] The technical solution further defined in the present invention is:

[0012] Furthermore, in step S1, the addresses of 815 externally owned accounts EOA and smart contract accounts with Upbit tags are obtained according to the Ethereum block resource browser Etherscan.

[0013] In the aforementioned Ethereum money laundering detection method based on graph embedding, in step S2, each transaction record contains the source address, target address, transaction hash, timestamp, Gas price and transaction amount of the transaction.

[0014] In the aforementioned Ethereum money laundering detection method based on graph embedding, in step S2, a directed weighted subgraph is constructed through each source node, the subgraphs are connected, and finally a directed weighted financial transaction graph is constructed as the input of the graph embedding method; by inputting a given directed weighted financial transaction graph G and specifying the dimension d, a node-to-node embedding mapping function is learned.

[0015] In the aforementioned Ethereum money laundering detection method based on graph embedding, in step S4, the gas price and timestamp information related to the money launderer's behavior in the transaction record is used as auxiliary information of the graph; in the directed weighted financial transaction graph G constructed in step S2, the gas price and timestamp of the latest transaction from node to node are retained, the gasprice and timestamp of each transaction edge are normalized, and the balance parameter α is set to merge the two into a new weight, and the transition probability in the random walk process is calculated based on this.

[0016] In the aforementioned Ethereum money laundering detection method based on graph embedding, the balance parameter α is set to 0.7.

[0017] The aforementioned Ethereum money laundering detection method based on graph embedding, step S5 includes the following sub-steps

[0018] S5.1. Define the return parameter p and the exploration parameter q. In a random walk, the size of the parameter p determines whether to return to the previous node in the next step, and the size of the parameter q determines whether the neighborhood sampling tends to be BFS or IFS.

[0019] S5.2, calculating the transition probability by combining the new weights fused in step S4 and the structural information of the transaction network;

[0020] S5.3. Perform r biased random walks of length l from each source node, where each step is selected based on the transition probability;

[0021] S5.4. Use word2vec’s skip-gram method to learn node representations and learn to predict neighboring nodes.

[0022] In the aforementioned Ethereum money laundering detection method based on graph embedding, in step S5.1, the return parameter p is set to and the exploration parameter q is set to 0.8.

[0023] The beneficial effects of the present invention are:

[0024] In the present invention, the money laundering behavior pattern can be analyzed in a more fine-grained manner, and the features on the transaction records that are most closely related to money laundering activities are extracted; at the same time, the gas price and timestamp in the Ethereum transaction network are used as auxiliary information for graph embedding, and the structural information of the graph and the behavior pattern of the money laundering account are fully considered, so that the features of the money laundering address in Ethereum can be accurately extracted; thus, the classification task is performed on the real Ethereum data set, and the recognition effect of the money laundering node is better than other advanced graph embedding methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a schematic diagram of the overall process of the present invention. DETAILED DESCRIPTION

[0026] This embodiment provides an Ethereum money laundering detection method based on graph embedding. The current AML system usually causes a large number of legitimate transactions to be mistakenly believed to involve money laundering, which requires a lot of extra time and manpower costs for verification; however, in previous research related to Ethereum anomaly detection, multiple types of financial crimes are usually regarded as a whole, and there is a lack of solutions specifically for detecting money laundering accounts. Therefore, the present invention hopes to be able to accurately extract the characteristics of money launderers at a more fine-grained level.

[0027] like Figure 1 As shown, the present embodiment provides an Ethereum money laundering detection method based on graph embedding. First, the full node transaction records and the marked money laundering account addresses are crawled from Ethereum and etherscan, and then a large directed weighted financial transaction graph is constructed with the money laundering and non-money laundering addresses as the source points; the transition probability is calculated according to the gas price and timestamp information of the transaction edge in the graph, as well as the structural information of the graph, and the transition probability is used as the selection basis to perform a biased random walk in the graph, search the neighborhood of each node, and capture the information of the node and network structure in the form of a node sequence; then the skip-gram architecture is used to embed the node sequence, and the prediction of the neighboring nodes is learned. Finally, the node embedding is input into the classification model to identify and detect the money laundering node.

[0028] This embodiment is an Ethereum money laundering detection method based on graph embedding, which constructs Ethereum data as a graph, considers the local structure and global structure of the transaction graph, and uses the gas price and timestamp information of the transaction record to promote embedding, automatically extracts the features of each Ethereum money laundering account address in the graph, and provides reliable input for subsequent node identification.

[0029] First, all transaction records up to June 2022 were synchronized through the Geth client. Each transaction record contains information such as the addresses of the sender and receiver of the transaction, transaction hash value, transaction amount, gas price, and timestamp. At the same time, according to the authoritative Ethereum block resource browser Etherscan, the addresses of 815 externally owned accounts EOA and smart contract accounts with the Upbit label were obtained.

[0030] The detection of Ethereum money laundering accounts can be modeled as a binary classification problem. Therefore, this embodiment randomly selects 815 account addresses without money laundering labels from the block span involved in the data with money laundering labels as normal data.

[0031] Secondly, this embodiment obtains the second-order transaction records of 815 money laundering addresses and 815 normal addresses, with account addresses as nodes and transactions between accounts as connecting edges. By taking 1630 nodes as center points and tracing all transactions from each center point to its second-order neighbors, a large number of directed weighted subgraphs are constructed.

[0032] After cleaning duplicate transactions and all failed transactions, all subgraphs are spliced ​​together to construct a large directed weighted financial transaction graph as the data set required for the experiment. In order to obtain the most timely information, this embodiment only retains the latest transactions from node to node; after cleaning again, the final data set size is 45585 nodes and 53356 edges.

[0033] Money laundering feature extraction based on transaction records and network structure: Gas price is the cost of executing transactions on the Ethereum network, which determines the cost of transactions and is related to transaction speed and credibility to a certain extent. A high gas price indicates that the transaction may involve a larger amount of money. Moreover, criminals are usually eager to remit illegal funds to financial institutions. By setting a higher gas price, transactions can be processed with priority. The timestamp contains the time information of each transaction. In the stage of dispersing and transferring the stolen money, criminals are strategic in choosing transaction times and recipients. Understanding the time pattern of money laundering transactions helps to extract the features of money laundering accounts. Therefore, the gas price and timestamp information in the transaction records that are closely related to the behavior of money launderers are used as auxiliary information of the graph.

[0034] This embodiment defines three parameters in the algorithm, namely, the return parameter p, the exploration parameter q and the balance parameter α. In a random walk process, the size of the parameter p determines whether to return to the previous node in the next step; the parameter q can determine whether the neighborhood sampling is closer to the breadth-first search BFS or the depth-first search DFS; the parameter α can balance the weights of the gas price and the timestamp in the transition probability. Through these three parameters, this embodiment comprehensively considers the key factors that may affect the embedding of the money laundering node and calculates the transition probability in the biased random walk.

[0035] According to the transition probability, this embodiment performs r random walks of length l for each node, and then uses the skip-gram architecture for embedding. In the experiment, this embodiment studies the influence of various parameters on the embedding performance, and finally sets p=1, q=0.8, α=0.7, which can most accurately characterize the money laundering node.

[0036] Finally, the extracted node features are input into the classification model for validity verification, and a variety of classification models are used, such as random forest, logistic regression, naive Bayes, and support vector machine. At the same time, two advanced graph embedding methods, DeepWalk and Node2vec, are selected as baseline methods for comparison. The experimental results are shown in Table 1 below. The best results of the three methods are compared, and the evaluation indicators are Accuracy, Precision, Recall, and F1-Score:

[0037] Table 1 Summary of classification results of three methods

[0038] Graph Embedding Methods Accuracy Precision Recall F1-Score Deepwalk 0.939 0.951 0.929 0.940 Node2vec 0.942 0.946 0.940 0.943 Ours 0.957 0.953 0.964 0.959

[0039] The experimental results show that the method of this embodiment is the most effective in detecting Ethereum money laundering nodes, with an average accuracy of 95.7%, which is significantly higher than the other two methods. This shows that comprehensive consideration of the local and global structures of the network can effectively improve the embedding performance, while gas price and timestamp can significantly improve the characterization effect of money laundering nodes.

[0040] In addition to the above embodiments, the present invention may also have other implementation modes. Any technical solution formed by equivalent replacement or equivalent transformation falls within the protection scope required by the present invention.

Claims

1. An Ethereum money laundering detection method based on graph embedding, characterized by: The following steps are included S1. Crawl the transaction records and money laundering account addresses of the blocks through the Ethereum client and Ethereum block resource browser etherscan; and randomly select an equal amount of normal addresses without money laundering marks from the account addresses of the blocks; S2. Use the money laundering account address and the normal address as source nodes, and obtain all transaction records within the second-order neighbor nodes starting from each source node; S3. Remove duplicate transactions and delete transaction entries with failed transaction status; S4. Extract money laundering features based on transaction records; S5. Extract money laundering features based on the transaction network structure and design a random walk search method for the Ethereum transaction network; S6. Embed the nodes into the input classification model to identify and detect money laundering nodes.

2. The Ethereum money laundering detection method based on graph embedding according to claim 1, characterized in that: In step S1, the addresses of 815 externally owned accounts EOA and smart contract accounts with Upbit tags are obtained according to the Ethereum block resource browser Etherscan.

3. The Ethereum money laundering detection method based on graph embedding according to claim 1, characterized in that: In step S2, each transaction record includes the source address, target address, transaction hash, timestamp, Gas price and transaction amount of the transaction.

4. The Ethereum money laundering detection method based on graph embedding according to claim 1, characterized in that: In the step S2, a directed weighted subgraph is constructed through each source node, and the subgraphs are connected to finally construct a directed weighted financial transaction graph as the input of the graph embedding method; by inputting a given directed weighted financial transaction graph G and specifying the dimension d, a node-to-node embedding mapping function is learned.

5. The Ethereum money laundering detection method based on graph embedding according to claim 1, characterized in that: In step S4, the gas price and timestamp information related to the money launderer's behavior in the transaction record is used as auxiliary information of the graph; in the directed weighted financial transaction graph G constructed in step S2, the gas price and timestamp of the latest transaction from node to node are retained, the gas price and timestamp of each transaction edge are normalized, and the balance parameter α is set to merge the two into a new weight, and the transition probability in the random walk process is calculated based on this.

6. The Ethereum money laundering detection method based on graph embedding according to claim 1, characterized in that: The balance parameter α is set to 0.

7.

7. The Ethereum money laundering detection method based on graph embedding according to claim 1, characterized in that: The step S5 comprises the following sub-steps S5.

1. Define the return parameter p and exploration parameter q. In a random walk, the size of parameter p determines whether to return to the previous node in the next step, and the size of parameter q determines whether the neighborhood sampling tends to be BFS or DFS. S5.2, calculating the transition probability by combining the new weights fused in step S4 and the structural information of the transaction network; S5.

3. Perform r biased random walks of length l from each source node, where each step is selected based on the transition probability; S5.

4. Use word2vec’s skip-gram method to learn node representations and learn to predict neighboring nodes.

8. The Ethereum money laundering detection method based on graph embedding according to claim 7 is characterized in that: In step S5.1, the return parameter p is set to , and the exploration parameter q is set to 0.8.

Images