Ethereum phishing fraud account dynamic detection method, equipment and medium

Abstract

The invention relates to an Ethereum phishing fraud account dynamic detection method and device and a medium, and the method comprises the following steps: obtaining Ethereum block chain data in real time, including account tags and transaction records, and constructing a balanced data set; a transaction time sequence is generated and periodically updated through a dynamic detection strategy, a hypergraph sequence is generated through an adaptive global information hypergraph construction method based on a K-nearest neighbor algorithm, and in the adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm, the weight of an edge between every two accounts is calculated according to a K value dynamically adjusted based on global information; generating a high-dimensional graph structure; the hypergraph sequence is input into a fishing fraud account detection framework, a detection result is obtained, and the fishing fraud account detection framework comprises a hypergraph convolutional neural network, a bidirectional long-short-term memory network, an attention mechanism and a feedforward neural network which are connected in sequence. Compared with the prior art, the detection accuracy and real-time performance can be improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain technology and network security, and in particular to a method, device and medium for dynamically detecting Ethereum phishing fraud accounts. Background Art

[0002] In the digital age, blockchain technology has become a focus of widespread global attention. In recent years, blockchain-based cryptocurrencies have attracted great attention, and their development has had a profound impact on the global financial system. Cryptocurrencies not only provide investors with new investment opportunities, but also promote the innovation and development of financial technology. Among the many cryptocurrency platforms, Ethereum has occupied a core position in the cryptocurrency market with its ability to support smart contracts and decentralized applications. Ethereum's flexibility and innovation make it the first choice for developers and users, attracting a large amount of funds and projects. However, with the rapid expansion of the cryptocurrency market, various threats have gradually emerged, posing severe challenges to the security of the market and user trust, such as phishing scams, which are an attack method that creates fake websites or services, sends misleading information to deceive users' sensitive information, and obtains private keys for fund transfers. Therefore, identifying and preventing these phishing scam accounts on Ethereum has become an important task, which is of great significance for protecting user assets and maintaining market order.

[0003] At present, the following methods are mainly used on Ethereum to identify these phishing fraud accounts: The first is a graph-based method, which first uses the transaction records on Ethereum to build a graph structure, and extracts the topological structure features of the transaction through the algorithm in graph theory. These features can reveal the flow of funds and interaction patterns between accounts. Subsequently, these graph structure features are integrated with the statistical features of the account to form a comprehensive feature set, and the phishing fraud accounts are identified through the classification model. The second method is to introduce timestamp information. Although graph-based methods can identify phishing fraud accounts to a certain extent, they often ignore the time characteristics of transactions. In order to solve this problem, some methods began to attach timestamp information to each edge in the graph structure, so that the feature extraction process can simultaneously consider the timing of transactions, thereby enriching the feature set and improving the recognition accuracy. In addition, there are some methods that obtain the time series data of the account through special techniques and effectively splice it with the graph structure information. This method that combines timestamp information and graph structure analysis can capture the behavior pattern of the account more comprehensively and further improve the recognition accuracy of phishing fraud accounts. In order to further improve the recognition effect, some methods not only consider the topological structure and time series characteristics of the transaction, but also consider multi-dimensional characteristics including account transaction frequency, transaction amount, etc. By combining these characteristics, the behavioral characteristics of phishing fraud accounts can be captured more accurately.

[0004] The above existing methods can detect Ethereum phishing fraud accounts to a certain extent, but they also have some shortcomings, which are mainly reflected in the following four aspects:

[0005] (1) Deficiencies in spatial structure analysis:

[0006] Existing technologies fail to deeply explore the network topology in transaction records, including the source and destination addresses of transactions, the path of fund transfer, and the interactive relationship between accounts. In addition, existing methods are insufficient in understanding the interconnections between transactions, which limits the ability to identify complex fund transfer patterns and also affects the timely identification and prevention of potential fraud networks.

[0007] (2) Insufficient time information acquisition:

[0008] Existing techniques do not fully utilize the time series information of transaction records, ignoring the importance of the time sequence and frequency of transactions for analysis. In addition, current methods cannot capture abnormal transaction patterns in a short period of time, such as rapid fund transfers or frequent small transactions, which may be signals of fraudulent activities.

[0009] (3) Potential lack of behavioral pattern recognition:

[0010] Existing technologies may not fully consider user behavior patterns on the blockchain, which may be associated with fraudulent activities. In addition, current methods lack the ability to conduct in-depth analysis of user behavior and cannot identify potential fraud risks and abnormal behaviors at the user level.

[0011] (4) Lack of real-time monitoring:

[0012] Existing technologies lack effective real-time monitoring mechanisms and are unable to capture and respond to fraud in a timely manner. The rapid changes in fraud methods require technology to quickly adapt and update its recognition model, but existing technologies are not flexible and timely in this regard.

[0013] In summary, there is an urgent need to redesign a dynamic detection method for Ethereum phishing fraud accounts to further improve the accuracy and real-time performance of detection. Summary of the invention

[0014] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a dynamic detection method, device and medium for Ethereum phishing fraud accounts, so as to further improve the accuracy and real-time performance of the detection.

[0015] The purpose of the present invention can be achieved by the following technical solutions:

[0016] The present invention provides a method for dynamically detecting Ethereum phishing fraud accounts, comprising the following steps:

[0017] Obtain blockchain data of each Ethereum account in real time, including account labels and transaction records. Use blockchain data of accounts with account labels suspected of phishing fraud as positive samples, and randomly select blockchain data of other accounts as negative samples according to a set ratio to construct a balanced data set.

[0018] Generate a transaction time series based on the balanced data set, the transaction time series is regularly updated through a dynamic detection strategy, extract statistical features based on the transaction time series, convert the transaction time series into a high-dimensional graph structure through an adaptive global information hypergraph construction method based on a K-nearest neighbor algorithm, and generate a hypergraph sequence. In the adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm, the weight of the edge between every two accounts is calculated according to the K value dynamically adjusted based on global information, thereby generating a high-dimensional graph structure;

[0019] The hypergraph sequence is input into a phishing fraud account detection framework to obtain a detection result. The phishing fraud account detection framework includes a hypergraph convolutional neural network, a bidirectional long short-term memory network, an attention mechanism and a feedforward neural network connected in sequence. The hypergraph convolutional neural network is used to extract the structural features of the hypergraph sequence, and the bidirectional long short-term memory network is used to capture potential information based on the structural features, including transaction patterns and time. The attention mechanism is used to focus on the potential information and obtain key information. The feedforward neural network is used to further enhance the key information.

[0020] Furthermore, the MetaMask tool is used to obtain transaction records in real time and store them in a local transaction database, the account tags are obtained through etherscan.io and stored in a local tag database, and the balance data set is constructed based on the local transaction database and the local tag database.

[0021] Furthermore, the dynamic detection strategy is: to detect whether the transaction increment of each account exceeds a set threshold, and if so, to update and expand the corresponding time series.

[0022] Furthermore, in the adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm, the specific manner of dynamically adjusting the K value based on global information is as follows:

[0023]

[0024] Among them, K i is the K value of the ith account, i.e. the number of neighbors, K min and K max are the minimum and maximum K values ​​of all accounts, respectively, i is the distance from the ith account to its nearest neighbor, Gi is the global information of the ith account, including transaction frequency, transaction amount, number of transaction accounts, transaction mode, account age, account activity, capital inflow and outflow ratio, and transaction distribution. median(D) is the median of the distance from all accounts to their nearest neighbors, and mean(G) is the mean of the global information of all accounts.

[0025] Furthermore, in the adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm, the specific method of calculating the weight of the edge between every two accounts based on the dynamically adjusted K value is as follows:

[0026]

[0027] Among them, ω ij is the weight of the edge between the ith account and the jth account, d ij is the distance between the i-th account and the j-th account, g ij is an adjustment factor based on global information, and α and β are hyperparameters for adjusting weights.

[0028] Furthermore, in the hypergraph convolutional neural network, the data processing process is specifically as follows:

[0029] S311, define the degree of node v and hyperedge e in the high-dimensional graph structure as d(v) and s(e), respectively, using the diagonal matrix D v and D e represents the degree matrix of nodes and hyperedges;

[0030] S312, based on the diagonal matrix D v and D e Define the Laplacian matrix Δ of the hypergraph;

[0031] S313, convolution operation is performed on the hypergraph sequence through the Laplacian matrix to obtain the structural feature y of the hypergraph sequence * .

[0032] Furthermore, in step S312, the expression of the Laplace matrix Δ is specifically as follows:

[0033]

[0034] Among them, H is the incidence matrix and W is the hyperedge weight matrix.

[0035] Furthermore, in step S313, the structural feature y of the hypergraph sequence * The specific expression is as follows:

[0036]

[0037] Among them, X is the feature matrix, σ is the activation function, and Θ is the trainable weight matrix.

[0038] The present invention also provides an electronic device, comprising a memory, a processor, and a program stored in the memory, wherein the processor implements the above method when executing the program.

[0039] The present invention also provides a computer-readable storage medium on which a computer program is stored, and the program implements the above method when executed by a processor.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1. The present invention proposes a dynamic detection method for Ethereum phishing fraud accounts. First, the blockchain data of each Ethereum account is obtained in real time to construct a balanced data set; secondly, a transaction time series is generated based on the balanced data set, and the transaction time series is regularly updated through a dynamic detection strategy. The above steps can ensure the timeliness of transaction data and monitor the transaction behavior of the account in real time, so that the detection method can quickly adapt to the frequently changing transaction activities in the Ethereum network, and effectively reduce the detection error caused by data lag; then, statistical features are extracted based on the transaction time series, and the transaction time series is converted into a high-dimensional graph structure through an adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm to generate a hypergraph sequence. In the adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm, the distance between each two accounts is calculated according to the K value dynamically adjusted based on global information. Weights, determine neighbor nodes according to the weights and then generate a high-dimensional graph structure. The above steps can mine the network topology in the transaction records, which is helpful to understand the mutual connections between transactions and improve the comprehensiveness and accuracy of detection; finally, the hypergraph sequence is input into the phishing fraud account detection network to obtain the detection results. The phishing fraud account detection framework includes a hypergraph convolutional neural network, a bidirectional long short-term memory network, an attention mechanism and a feedforward neural network connected in sequence. Among them, the hypergraph convolutional neural network can extract the structural features of the hypergraph sequence, the bidirectional long short-term memory network can capture potential information based on structural features, the attention mechanism can focus on potential information to obtain key information, and the feedforward neural network can further enhance key information. The above framework can capture the complex interaction relationships and fund transfer patterns between accounts to ensure the accuracy of Ethereum phishing fraud account detection.

[0042] 2. The present invention uses the blockchain data of accounts with account labels suspected of phishing fraud as positive samples, and randomly selects blockchain data of other accounts as negative samples according to a set ratio. The balanced data set constructed based on this can help subsequent networks to conduct more comprehensive learning, improve generalization ability, and reduce false detection rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1is a flow chart of the method of the present invention;

[0044] Figure 2 is a schematic diagram of the data processing process in the method of the present invention,

[0045] Among them, Transaction Database is the local transaction database, Label Database is the local label database, Dataset is the balanced dataset, ASG is the automatic sequence generation method, S is the transaction time series, AGI-HC is the adaptive global information hypergraph construction method, HG is the hypergraph sequence, HGCN is the hypergraph convolutional neural network, Bi-LSTM is the bidirectional long short-term memory network, Attention is the attention mechanism, FNN is the feedforward neural network, and Result is the detection result;

[0046] Figure 3 This is a schematic diagram of the transaction time series generation process.

[0047] Among them, Txn_n represents the unique identifier of the transaction, usually a hash value, Block Number represents the block number of the transaction in the blockchain, Time Stamp represents the timestamp when the transaction is packaged into the block, a, a1, a2, a3, a4, a5, a6 represent the addresses involved in the transaction, which usually include the sender address (a), the receiver address (a1), and possible intermediary addresses or contract addresses (a2, a3, etc.), and value represents the amount of ether transferred in the transaction;

[0048] Figure 4 Schematic diagram of the hypergraph sequence generation process;

[0049] Figure 5 Schematic diagram of the phishing fraud account detection process. DETAILED DESCRIPTION

[0050] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0051] Example:

[0052] This embodiment provides a method for dynamically detecting Ethereum phishing fraud accounts. Figure 1 As shown, the following steps are included:

[0053] S1. Obtain blockchain data of all Ethereum accounts in real time, including account labels and transaction records. Use blockchain data of accounts with account labels suspected of phishing fraud as positive samples, and randomly select blockchain data of other accounts as negative samples according to a set ratio to construct a balanced data set. Figure 2 As shown, the specific steps include:

[0054] S11. Use the MetaMask tool to synchronize Ethereum transaction records, including transaction details and related data, store them in the local transaction database (Transaction Database) and update them in real time to ensure that the transaction history records of all accounts are fully captured.

[0055] S12. Obtain accounts marked as suspected phishing scams through etherscan.io and store them in the local label database (Label Database). In addition, in order to improve the detection accuracy of phishing scam accounts, some accounts are randomly selected from other Ethereum accounts in a certain proportion as negative samples to build a balanced data set. This data set will help train the model to more accurately learn and identify the transaction patterns and behavioral characteristics of scam accounts.

[0056] S2. Generate a transaction time series based on a balanced data set, extract statistical features based on the transaction time series, convert the transaction time series into a high-dimensional graph structure through an adaptive global information hypergraph construction method based on a K-nearest neighbor algorithm, and generate a hypergraph sequence, which specifically includes the following steps:

[0057] S21. Generate a corresponding transaction time series for each Ethereum account through the Automatic Sequence Generation (ASG) method. These sequences not only record the transaction history of the account in detail, but can also be dynamically updated as the account activity increases to ensure the timeliness and accuracy of the data. The specific process is as follows: Set the number of transactions m as the starting point and construct the first sequence s1 = [Txn1,…,Txn m ].like Figure 3 As shown in Figure 1, as the number of account transactions increases, the sequence is updated and extended whenever the set threshold n is reached. For example, the second sequence of an account s2 = [Txn1,…,Txn m ,…,Txn m+n ], the number of transactions will increase to m+n. In this way, the transaction time series S = [s1, s2, …, s t ], where t represents each time point. This sequence not only records the transaction history of the account, but can also be dynamically updated as time goes by.

[0058] S22. Extract the key statistical features of the accounts in each sequence based on the transaction records of each sequence. Construct a feature set X, represented by X = [x1, x2, ..., x t ]. This step ensures that the unique properties and behavior patterns of each sequence are captured.

[0059] S23, using the Adaptive Global Information Hypergraph Construction (AGI-HC) method based on the K-nearest neighbor algorithm to generate a corresponding hypergraph sequence for each transaction sequence. These hypergraph sequences are represented as HG = [hg1, hg2, ..., hg t ], the specific process is as follows:

[0060] (1) Dynamically adjust the K value based on global information.

[0061]

[0062] Among them, K i is the K value of the ith account, i.e. the number of neighbors, K min and K max are the minimum and maximum K values ​​of all accounts, respectively, i is the distance from the ith account to its nearest neighbor, G i is the global information of the ith account (such as global features or structural information), median(D) is the median of the distances from all accounts to their nearest neighbors, and mean(G) is the mean of the global information of all accounts.

[0063] Specifically, in Ethereum phishing fraud account detection, global information includes the following parts:

[0064] (1) Transaction frequency: the frequency with which an account conducts transactions within a certain period of time.

[0065] (2) Transaction amount: the amount involved in the account transaction.

[0066] (3) Number of transaction accounts: the number of other accounts with which transactions occur.

[0067] (4) Transaction pattern: whether the account’s transaction behavior is consistent with normal user’s transaction habits.

[0068] (5) Account age: the length of time since the account was created.

[0069] (6) Account activity: the level of activity of an account over a period of time.

[0070] (7) Cash inflow and outflow ratio: the ratio of account cash inflow to outflow.

[0071] (8) Transaction distribution: The distribution characteristics of account transactions in time or space.

[0072] When constructing a hypergraph, global information can play the following roles:

[0073] (1) Determine the number of neighbors: As shown in the formula, global information can be used to dynamically adjust the value of K, which is the number of neighbors of each account. This helps determine which accounts should be considered neighbors when constructing the hypergraph.

[0074] (2) Calculating edge weights: Global information can be used to calculate the weight of the edge between two nodes (accounts) in the hypergraph. This reflects the similarity or association between accounts.

[0075] (3) Capturing potential patterns: Global information can help the model capture potential patterns in the entire network, such as abnormal transaction behavior, thereby improving the accuracy of detecting phishing fraud accounts.

[0076] For example, if an account's transaction frequency suddenly increases and the transaction amount is abnormal, this may be a sign of a phishing scam account. By incorporating this global information into the hypergraph construction process, the model's ability to identify such abnormal behaviors can be enhanced.

[0077] (2) Calculate the weight of the edge between every two accounts based on the K value.

[0078]

[0079] Among them, ω ij is the weight of the edge between the ith account and the jth account, d ij is the distance between the i-th account and the j-th account, g ij is an adjustment factor based on global information, and α and β are hyperparameters for adjusting weights.

[0080] (3) Generate a hypergraph sequence.

[0081] like Figure 4 As shown, the nearest neighbor account of each account in the sequence is determined by the AGI-HC method, and a hyperedge is constructed:

[0082] HyperEdge i =AGI-HC(X i ), i∈1…t

[0083] All hyperedges are gathered together to form a hyperedge set E:

[0084] E=[HyperEdge1,HyperEdge2,…,HyperEdge t ]

[0085] For each sequence i, construct a hypergraph HG i =(V i ,E i ), where i∈{1…t}. The hypergraph can be represented by the incidence matrix H, which is defined as:

[0086]

[0087] Among them, if the node v belongs to the hyperedge e, the value of the association matrix H is 1, otherwise it is 0.

[0088] The AGI-HC method constructs a hypergraph by dynamically adjusting the K value and combining global information. Unlike the traditional KNN method, this method adaptively adjusts the K value so that it can be optimized according to local data density and global features, thereby more accurately selecting neighbor nodes. Among them, "global features" are the "global information" mentioned above, which refers to certain statistical features of all accounts in the entire data set, such as the median (D) and mean (G) of global information; "local data density" refers to the density of data in a local area, such as the distance D from each account to its nearest neighbor account. This distance can reflect the distribution of data points in space. If the distance from an account to its nearest neighbor is small, then it can be considered that the local area where the account is located has denser data; conversely, if the distance is large, it means that the data is sparser. On the one hand, the AGI-HC method adapts to the density of local data by dynamically adjusting the K value. The K value is a key parameter in the K-nearest neighbor algorithm, which determines the number of neighbors of each data point. In areas with dense data, fewer neighbors may be needed to capture local structures, while in areas with sparse data, more neighbors may be needed. By adjusting the K value, the method can better adapt to the distribution characteristics of local data; on the other hand, the AGI-HC method combines global information to optimize the construction of the hypergraph. By considering global information, such as the median and mean of global features, the method can take into account the characteristics of the entire data set when constructing the hypergraph, thereby improving the expressive power of the hypergraph and the flexibility of the model. In summary, this method can not only capture the local structure of the data, but also effectively integrate global information, improving the expressive power of the hypergraph and the flexibility of the model. This improvement can build a more robust and accurate hypergraph when processing complex, high-dimensional or noisy data, providing a more accurate basis for subsequent graph convolution and node classification. By constructing a hypergraph operation, the transaction activities in the sequence can be presented in the form of a graph, providing a structured perspective for further analysis. Through this method, complex transaction data can be converted into a graphical structure that is easy to process and analyze, laying the foundation for subsequent pattern recognition and behavior prediction.

[0089] S3. Input the hypergraph sequence into the phishing fraud account detection framework to obtain the detection result.

[0090] The present invention designs a phishing fraud account detection framework (HBAF4DPS), such as Figure 5As shown, it includes a Hypergraph Convolution Network (HGCN), a Bi-directional Long Short-Term Memory (Bi-LSTM), an Attention Mechanism, and a Feedforward Neural Network (FNN) connected in sequence. The Hypergraph Convolution Neural Network can be used to extract the structural features of the hypergraph sequence and learn the unique representation of each sequence; the Bi-directional Long Short-Term Memory Network can be used to capture potential information based on the structural features, including transaction patterns and time; the Attention Mechanism can be used to focus on potential information and obtain key information; the Feedforward Neural Network can be used to further enhance key information. By introducing the Bi-directional Long Short-Term Memory Network, the Attention Mechanism, and the Feedforward Neural Network, the representation of the account sequence can be further refined and enhanced. This framework not only improves the model's ability to understand transaction patterns, but also provides rich feature information for subsequent analysis and prediction.

[0091] In the Hypergraph Convolutional Neural Network (HGCN), the data processing process is as follows:

[0092] (1) The degrees of node v and hyperedge e in the high-dimensional graph structure are defined as d(v) and s(e), respectively, which can be expressed as:

[0093]

[0094] (2) Using the diagonal matrix D v and D e Represents the degree matrix of nodes and hyperedges.

[0095] (3) Based on the diagonal matrix D v and D e Define the Laplacian matrix of the hypergraph, the hypergraph HG i The Laplacian matrix of is defined as:

[0096]

[0097] Or equivalently:

[0098]

[0099] Among them, H is the incidence matrix and W is the hyperedge weight matrix.

[0100] (4) Perform convolution operation on the hypergraph sequence through the Laplacian matrix to obtain the structural feature y of the hypergraph sequence * :

[0101]

[0102] Among them, X is the input feature matrix of the node, σ is the activation function, and Θ is the trainable weight matrix.

[0103] Finally, the sequence representation of the structural features can be obtained:

[0104]

[0105] In the Bi-LSTM network, the data processing process is as follows: the sequence representation Input into the Bi-LSTM model, for each sequence i, by combining the forward output of Bi-LSTM and backward output The final expression i∈1……t. Then we get the representation of the entire account time series H=[h1,h2,…h t ].

[0106] The representation obtained by Bi-LSTM is input into the attention mechanism. First, the input sequence is converted into a query vector Q, a key vector K and a value vector V, and then the attention value is calculated. Among them, d k Represents the dimension of the key vector. Scaling by taking the square root can prevent the dot product result from being too large. Then we can get the weighted sequence representation Get the sequence output Y = [y1, y2, ..., y t ], which can highlight the key information in the sequence.

[0108] In order to avoid the quality degradation of the model output, a feedforward neural network (FNN) is added at the end of the framework, and the final output is Result = FNN(Y).

[0109] When training the above framework, the detection results at each time point are obtained. If a higher detection accuracy can be obtained at an earlier time point, the model effect is better.

[0110] S4. Regularly update the transaction time series through a dynamic detection strategy to detect whether the transaction increment of each account exceeds the set threshold. If so, return to step S2 to update and expand the corresponding time series and regenerate a detection result.

[0111] In summary, this embodiment proposes a dynamic detection method for Ethereum phishing fraud accounts based on adaptive global information hypergraph construction from the perspective of dynamic detection. This method effectively improves the accuracy and real-time performance of detection through the following key technical points:

[0112] (1) Automatic sequence generation method (ASG). This method can generate and update the transaction time series of an account in real time, ensuring the timeliness of transaction data, enabling the detection model to quickly adapt to the frequently changing transaction activities in the Ethereum network, and effectively reducing detection errors caused by data lag.

[0113] (2) Adaptive global information hypergraph construction method (AGI-HC). This method generates a more accurate hypergraph representation by dynamically adjusting the K value and combining the global information in the transaction sequence. The hypergraph can capture the complex interaction relationships and fund transfer patterns between accounts, thereby better identifying potential phishing fraud accounts and improving the comprehensiveness of detection.

[0114] (3) Phishing Fraud Account Detection Framework (HBAF4DPS). This framework can integrate multi-dimensional features and hypergraph structure information, perform multi-level feature extraction and interactive relationship modeling through deep learning technology, and timely detect and identify new phishing fraud methods in the Ethereum network, thereby improving the detection accuracy and response speed.

[0115] (4) Dynamic detection strategy. This strategy can monitor the transaction behavior of an account in real time and automatically update the transaction sequence when the number of transactions reaches a preset threshold, re-extract features and train the detection model, ensuring that the model can maintain efficient detection performance when facing rapidly changing transaction patterns.

[0116] If the above method is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0117] The above description of the embodiments is to facilitate the understanding and use of the invention by those skilled in the art. It is obvious that those skilled in the art can easily make various modifications to these embodiments and apply the general principles described herein to other embodiments without creative work. Therefore, the present invention is not limited to the above embodiments, and improvements and modifications made by those skilled in the art based on the disclosure of the present invention without departing from the scope of the present invention should be within the scope of protection of the present invention.

Claims

1. A dynamic detection method for Ethereum phishing fraud accounts, characterized in that: The following steps are involved: Obtain blockchain data of each Ethereum account in real time, including account labels and transaction records. Use blockchain data of accounts with account labels suspected of phishing fraud as positive samples, and randomly select blockchain data of other accounts as negative samples according to a set ratio to construct a balanced data set. Generate a transaction time series based on the balanced data set, the transaction time series is regularly updated through a dynamic detection strategy, extract statistical features based on the transaction time series, convert the transaction time series into a high-dimensional graph structure through an adaptive global information hypergraph construction method based on a K-nearest neighbor algorithm, and generate a hypergraph sequence. In the adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm, the weight of the edge between every two accounts is calculated according to the K value dynamically adjusted based on global information, thereby generating a high-dimensional graph structure; The hypergraph sequence is input into a phishing fraud account detection framework to obtain a detection result. The phishing fraud account detection framework includes a hypergraph convolutional neural network, a bidirectional long short-term memory network, an attention mechanism and a feedforward neural network connected in sequence. The hypergraph convolutional neural network is used to extract the structural features of the hypergraph sequence, and the bidirectional long short-term memory network is used to capture potential information based on the structural features, including transaction patterns and time. The attention mechanism is used to focus on the potential information and obtain key information. The feedforward neural network is used to further enhance the key information.

2. A dynamic detection method for Ethereum phishing fraud accounts according to claim 1, characterized in that: The MetaMask tool is used to obtain transaction records in real time and store them in the local transaction database. The account tags are obtained through etherscan.io and stored in the local tag database. The balance data set is constructed based on the local transaction database and the local tag database.

3. A dynamic detection method for Ethereum phishing fraud accounts according to claim 1, characterized in that: The dynamic detection strategy is: detect whether the transaction increment of each account exceeds the set threshold, and if so, update and expand the corresponding time series.

4. A dynamic detection method for Ethereum phishing fraud accounts according to claim 1, characterized in that: In the adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm, the specific manner of dynamically adjusting the K value based on global information is as follows: Among them, K i is the K value of the ith account, i.e. the number of neighbors, K min and K max are the minimum and maximum K values ​​of all accounts, respectively, i is the distance from the ith account to its nearest neighbor, G i is the global information of the ith account, including transaction frequency, transaction amount, number of transaction accounts, transaction mode, account age, account activity, capital inflow and outflow ratio, and transaction distribution. median(D) is the median of the distance from all accounts to their nearest neighbors, and mean(G) is the mean of the global information of all accounts.

5. A dynamic detection method for Ethereum phishing fraud accounts according to claim 4, characterized in that: In the adaptive global information hypergraph construction method based on the K-nearest neighbor algorithm, the specific method of calculating the weight of the edge between every two accounts based on the dynamically adjusted K value is as follows: Among them, ω ij is the weight of the edge between the ith account and the jth account, d ij is the distance between the i-th account and the j-th account, g ij is an adjustment factor based on global information, and α and β are hyperparameters for adjusting weights.

6. A dynamic detection method for Ethereum phishing fraud accounts according to claim 1, characterized in that: In the hypergraph convolutional neural network, the data processing process is as follows: S311, define the degree of node v and hyperedge e in the high-dimensional graph structure as d(v) and s(e), respectively, using the diagonal matrix D v and D e represents the degree matrix of nodes and hyperedges; S312, based on the diagonal matrix D v and D e Define the Laplacian matrix Δ of the hypergraph; S313, convolution operation is performed on the hypergraph sequence through the Laplacian matrix to obtain the structural feature y of the hypergraph sequence * .

7. A dynamic detection method for Ethereum phishing fraud accounts according to claim 6, characterized in that: In step S312, the expression of the Laplace matrix Δ is as follows: Among them, H is the incidence matrix and W is the hyperedge weight matrix.

8. A dynamic detection method for Ethereum phishing fraud accounts according to claim 6, characterized in that: In step S313, the structural feature y of the hypergraph sequence * The specific expression is as follows: Among them, X is the feature matrix, σ is the activation function, and Θ is the trainable weight matrix.

9. An electronic device comprising a memory, a processor, and a program stored in the memory, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images