On-chain case-related fund identification method, device and control system

Abstract

The invention relates to a chain case-related fund identification method and device and a control system. The method comprises the following steps: receiving, caching and queuing request data of a user; the request data comprises a fund collection address; carrying out on-chain full transaction search on the deposit collection address, extracting a transaction link of an initial address and an end address, constructing a transaction network diagram, and carrying out multi-dimensional feature construction on the transaction address; constructing a rule model, and scoring the transaction link by using the rule model to obtain a scoring result of the destination address; performing community core point detection on the transaction network graph by using a graph mining algorithm to obtain a community detection result; and determining and displaying a suspicious address according to a scoring result and a community detection result. All transaction links are determined by performing on-chain full-amount transaction search on the fund collection address, and addresses possibly related to the flow direction of the involved funds are identified and tracked in massive downstream transactions. The method can be directly applied to block chain transaction data, and the application range of the analysis method is expanded.

Description

Technical Field

[0001] The present disclosure relates to the field of blockchain technology, and in particular to a method, device and control system for identifying funds involved in a case on a chain. Background Art

[0002] At present, the analysis of financial transaction data can basically achieve a certain degree of accuracy, but it can usually only be modeled and analyzed based on transaction data of legal currency. Since most blockchain transactions involve cryptocurrencies, different monetary systems lead to incompatible data analysis and cannot be directly extended to blockchain transaction data, limiting the monitoring and analysis of emerging financial fields. In addition, it usually relies too much on manually constructed transaction risk models, making it difficult to effectively respond to new transaction patterns and irregular behaviors in evolution. Summary of the invention

[0003] In view of this, the present application proposes a method, device and control system for identifying funds involved in a case on the chain to solve the above problems.

[0004] On the one hand, this application proposes a method for identifying funds involved in a case on the chain, including the following steps:

[0005] Receive, cache and queue the user's request data; wherein the request data includes the deposit collection address;

[0006] Conduct a full transaction search on the chain for the deposit collection address, extract the transaction links of the starting address and the end address, construct a transaction network diagram, and construct multi-dimensional features for the transaction address;

[0007] Constructing a rule model, and using the rule model to score the transaction link to obtain a scoring result of the destination address;

[0008] Using a graph mining algorithm to perform community core point detection on the transaction network graph to obtain a community detection result;

[0009] The suspicious address is determined and displayed based on the scoring result and the community detection result.

[0010] As an optional implementation scheme of the present application, optionally, after receiving, caching and queuing the user's request data, it also includes:

[0011] Real-time monitoring of server resource status;

[0012] When the resource status meets the preset condition, a piece of the request data is read.

[0013] As an optional implementation scheme of the present application, optionally, the multidimensional features include statistical features and graph features.

[0014] As an optional implementation scheme of the present application, optionally, the constructing of a rule model, using the rule model to score the transaction link, and obtaining a scoring result of the destination address includes:

[0015] Build rule models;

[0016] Presetting the scoring rules of the rule model using a decision tree method;

[0017] All the transaction links are scored based on the scoring rules, summed and the top 10% are extracted to obtain the scoring result of the destination address.

[0018] As an optional implementation scheme of the present application, optionally, the using of a graph mining algorithm to perform community core point detection on the transaction network graph to obtain a community detection result includes:

[0019] Acquire the transaction network graph; wherein the transaction network graph represents the user addresses on the chain through nodes, and represents the transaction relationship between the user addresses on the chain through edges;

[0020] A graph mining algorithm is used to perform community detection on the transaction network graph to determine the core points of the community.

[0021] As an optional implementation scheme of the present application, optionally, after performing community detection on the transaction network graph using a graph mining algorithm to determine the community core point, the method further includes:

[0022] The Louvain algorithm is used to divide the transaction network graph into communities.

[0023] As an optional implementation scheme of the present application, optionally, determining and displaying a suspicious address according to the scoring result and the community detection result includes:

[0024] Sort the transaction addresses according to the scoring results and the community detection results to determine suspicious addresses;

[0025] Display the transaction link between the deposit collection address and the suspicious address.

[0026] In another aspect, the present application provides a device for implementing any of the above-mentioned methods for identifying funds involved in a case on a chain, including:

[0027] A message queue module is configured to receive, cache and queue user request data; wherein the request data includes a deposit collection address;

[0028] The on-chain retrieval module is configured to perform an on-chain full transaction search for the deposit collection address, extract the transaction links of the start address and the end address, construct a transaction network diagram, and construct multi-dimensional features for the transaction address;

[0029] A model reasoning module is configured to construct a rule model, and use the rule model to score the transaction link to obtain a scoring result of the end point address;

[0030] A community discovery module is configured to detect community core points on the transaction network graph using a graph mining algorithm to obtain a community detection result;

[0031] The result presentation module is configured to determine and present a suspicious address based on the scoring result and the community detection result.

[0032] In another aspect, the present application provides a control system, comprising:

[0033] processor;

[0034] a memory for storing processor-executable instructions;

[0035] Wherein, the processor is configured to implement any of the above-mentioned methods for identifying funds involved in a case on the chain when executing the executable instructions.

[0036] On another aspect of the present application, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the on-chain method for identifying funds involved in a case as described in any one of the above items is implemented.

[0037] Technical effects of the present invention:

[0038] This application conducts a full transaction search on the chain for the deposit collection address to determine all transaction links between the starting address and the ending address, and identifies and tracks addresses that may be involved in the flow of funds involved in the case in massive downstream transactions. Among them, the transaction links are scored using a pre-built rule model combined with multi-dimensional features extracted from the transaction address, and a graph mining algorithm is used to discover communities in the transaction network and evaluate the correlation between addresses, thereby identifying potential misconduct personnel. Then, based on the rule model scoring and community discovery results, suspicious addresses are identified and displayed, thereby achieving the purpose of assisting in case investigations. It is no longer limited to legal currency transaction data and can be directly applied to blockchain transaction data, thereby expanding the scope of application of the analysis method and better adapting to the monitoring and analysis requirements of emerging financial fields.

[0039] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0041] Figure 1 The figure shows a schematic diagram of the process of the on-chain case-related funds identification method of the present invention;

[0042] Figure 2 A schematic diagram showing the application results of the on-chain case-related funds identification method of the present invention is shown;

[0043] Figure 3 The figure shows a schematic diagram of the implementation process of the on-chain case-related funds identification method of the present invention;

[0044] Figure 4 It is a schematic diagram of the work flow of the message queue module in the on-chain case-related funds identification method of the present invention;

[0045] Figure 5 Shown is a diagram showing the identification results of the on-chain involved funds identification method of the present invention. DETAILED DESCRIPTION

[0046] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0047] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0048] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0049] The existing financial transaction data analysis methods are usually based on legal currency transaction data, which limits their applicability in processing blockchain transaction data. They also rely too much on manually constructed transaction risk models and have poor adaptability to new transaction models. Moreover, the current financial transaction data analysis methods usually do not provide a visual operation platform and a visual display platform, which makes it difficult for law enforcement agencies and investigators to intuitively understand and analyze complex transaction data based on the interface, making it difficult to better guide investigations.

[0050] Therefore, this application aims to assist in the tracking of suspects in financial transactions, and to provide a method, device and control system for identifying funds involved in a case on a blockchain that can be applied to the blockchain. By giving a case deposit collection address on a chain, the addresses that may be involved in the flow of funds involved in the case can be identified and tracked in massive downstream transactions to assist in criminal case investigations. By collecting transaction data related to the deposit collection address on the blockchain and using a variety of analysis techniques to build a complete address network, potential improper activities can be identified and visual support can be provided.

[0051] Example 1

[0052] like Figure 1 , Figure 2 and Figure 3 As shown, on the one hand, this application proposes a method for identifying funds involved in a case on the chain, including the following steps:

[0053] S100, receiving, caching and queuing the user's request data; wherein the request data includes a deposit collection address;

[0054] S200, performing a full transaction search on the chain for the deposit collection address, extracting the transaction links of the start address and the end address, constructing a transaction network diagram, and constructing multi-dimensional features for the transaction address;

[0055] S300, constructing a rule model, and using the rule model to score the transaction link to obtain a scoring result of the destination address;

[0056] S400, using a graph mining algorithm to perform community core point detection on the transaction network graph to obtain a community detection result;

[0057] S500: Determine and display a suspicious address based on the scoring result and the community detection result.

[0058] In this embodiment, by searching the full transaction volume on the chain for the deposit collection address, all transaction links between the starting address and the ending address are determined, and the addresses that may be involved in the flow of funds involved in the case are identified and tracked in the massive downstream transactions. For example, after the gambler's deposit address is collected, it passes through the first-layer money laundering address and the second-layer money laundering address to reach the exchange user. This application searches the full volume of the above addresses to identify and track the address of the flow of funds involved in the case, query the transaction network data and the statistical feature data of the two parties to the transaction and read them. Among them, the transaction link is scored using the pre-built rule model combined with the multi-dimensional features extracted from the transaction address, and the graph mining algorithm is used to discover the community in the transaction network, evaluate the correlation between the addresses, and thus identify potential misconduct implementers. Then, according to the rule model scoring and community discovery results, the suspicious address is determined and displayed, thereby achieving the purpose of assisting the case investigation. It is no longer limited to the transaction data of legal currency, and can be directly applied to blockchain transaction data, thereby expanding the scope of application of the analysis method and better adapting to the monitoring and analysis requirements of the emerging financial field.

[0059] Specifically, through step S100, the user's request data is received, cached and queued; wherein the request data includes the deposit collection address. Among them, the present application uses a message queue module to receive, cache and queue the user's request data. In order to ensure the orderly processing of user requests and maintain the stability of server system resources, the user's request is queued through the message queue module, and the user's request data includes information about the deposit collection address, which is used to trigger subsequent on-chain retrieval and analysis operations.

[0060] First, the user's request data will be sent to the message queue for queuing. Before requesting a service, you need to set parameters, including the minimum amount, backward query link length, etc. After the settings are completed, the user's request data enters the message queue through the API. As an optional implementation scheme of the present application, after receiving, caching and queuing the user's request data, it also includes: real-time monitoring of server resource status; when the resource status meets the preset conditions, read a piece of the request data. That is, Figure 4 As shown in the figure, after the user request data enters the message queue, the main program monitors the server resource status in real time to determine whether the resource status meets the preset conditions. When the resource status meets the condition that the number of currently running tasks is less than 100 or the remaining memory is greater than 2GB, a request data is read from the message queue and the model inference task is executed.

[0061] Subsequently, through step S200, a full transaction search is performed on the deposit collection address on the chain, the transaction links of the start address and the end address are extracted, a transaction network diagram is constructed, and multi-dimensional features are constructed for the transaction address.

[0062] As an optional implementation scheme of the present application, optionally, the multidimensional features include statistical features and graph features.

[0063] In this embodiment, the on-chain retrieval module is used to perform on-chain full transaction retrieval on the deposit collection address, and the retrieved results are used to construct a transaction network graph. Among them, the nodes in the transaction network graph are used to represent the on-chain user addresses, and the edges in the transaction network graph are used to represent the transaction behaviors of two on-chain user addresses.

[0064] It should be noted that in the process of searching for all transactions on the deposit collection address chain, the transaction links of the starting address and the end address are first queried, and all transaction records related to these transaction addresses are recorded. Subsequently, multi-dimensional features are constructed for the transaction address, including the construction of statistical features, such as the number of transactions of the address, the total transaction amount and the active time, etc.; it also includes the construction of graph features, such as the degree centrality, betweenness centrality or clustering centrality of the node. Among them, the degree centrality of the node measures the number of connections between a node and other nodes, that is, its degree. Nodes with higher degree centrality are generally considered to have more direct connections in the network. The betweenness centrality of the node is used to determine the importance of the node in the network in the shortest path connecting other nodes. The higher the betweenness centrality of the node, the more it plays a key bridge role in the shortest path connecting different parts of the network. This ensures that the subsequent use of multi-dimensional features related to the transaction address for modeling in this application can more intuitively express the transaction characteristics and discover the gangs involved in the case.

[0065] Further, through step S300, a rule model is constructed, and the transaction link is scored using the rule model to obtain a scoring result of the destination address. The present application constructs a rule model through a model reasoning module, wherein the rule model scores the link between the starting address and the destination address based on the multi-dimensional characteristics of the transaction to determine the suspicious address.

[0066] As an optional implementation scheme of the present application, optionally, the constructing of a rule model, using the rule model to score the transaction link, and obtaining a scoring result of the destination address includes:

[0067] S310, constructing a rule model;

[0068] S320, presetting the scoring rules of the rule model by using a decision tree method;

[0069] S330: Score all the transaction links based on the scoring rule, sum them up and extract the top 10% to obtain the scoring result of the destination address.

[0070] Among them, when executing step S330 and building the rule model, first obtain the basic data through step S200, that is, perform downstream transaction search level by level based on the deposit address, and use the path search algorithm to find all transaction links between the starting address and the end address. For the nodes in each link, take two nodes at a time according to the address order in the link, obtain the corresponding transaction information from the database, and perform feature engineering to obtain the processed transaction data and features. For example, we found address B through the transaction link of address A, and then obtained the transaction information between A and B. Among them, the transaction information includes statistical features such as the amount of transactions between the two nodes, the proportion of the amount in each transfer, the transaction time, the use and activation of the address, and the ratio of the transaction time of both parties to the address activation time. Then start to build the rule model: by combining the distribution statistics of historical business data, take the mode as the threshold of the rule. Some scoring rules are as follows:

[0071] (1) The proportion of funds held by the source address and the destination address. A high proportion will result in a high score, and a low proportion will result in a low score.

[0072] (2) The single transaction amount between the address pairs. The higher the amount, the higher the score.

[0073] (3) Compare the fund ratio of the two transactions of the node on the link. The closer the ratio is to 1:1, the higher the score.

[0074] After determining the scoring rules, sum the scores on all links between the starting address and the end address, extract the top 10%, complete the reasoning of the end address, and obtain the suspicious score. Traverse the starting address to find each exchange address and obtain it, then split the link, use the model to predict the score of each edge, sort all links of a certain exchange address in reverse order by number of copies, and extract the top 10% of the exchange addresses. It should be noted that the online reasoning stage directly uses the model constructed in the above manner for reasoning to obtain a list of end addresses in descending order by number of copies. The higher the ranking, the more suspected it is. It should also be noted that the selection of the threshold in this embodiment can also be implemented using a machine learning algorithm, such as a decision tree, random forest, and other algorithms that can implement threshold selection. The selection of rules can also be selected by methods such as CART tree, Bayesian optimization, etc., which can achieve the selection purpose. At this point, the rule model is built.

[0075] Furthermore, through step S400, community core point detection is performed on the transaction network graph using a graph mining algorithm to obtain a community detection result.

[0076] As an optional implementation scheme of the present application, optionally, the using of a graph mining algorithm to perform community core point detection on the transaction network graph to obtain a community detection result includes:

[0077] S410, obtaining the transaction network graph; wherein the transaction network graph represents the user addresses on the chain through nodes, and represents the transaction relationship between the user addresses on the chain through edges;

[0078] S420: Perform community detection on the transaction network graph using a graph mining algorithm to determine the core points of the community.

[0079] As an optional implementation scheme of the present application, optionally, after performing community detection on the transaction network graph using a graph mining algorithm to determine the community core point, the method further includes:

[0080] The Louvain algorithm is used to divide the transaction network graph into communities.

[0081] It should be noted that this application uses a graph mining algorithm through a community discovery module to discover communities in the transaction network graph, evaluate the correlation between addresses, and thus identify potential misconduct implementers. Among them, the community discovery module will generate information about community results and members for subsequent analysis.

[0082] First, a virtual currency transaction network diagram is obtained through step S200. The topology diagram can display the transaction relationship between addresses on different chains, forming a network structure in which nodes represent user addresses on the chain and edges represent transaction relationships between addresses.

[0083] Secondly, the core points of the community are detected, with the goal of finding the core points of the wrongdoers, that is, the key wallet addresses or transaction nodes. Since these core points are usually related to wrongdoing activities, the nodes with importance and influence can be identified through the virtual currency transaction network graph. In this embodiment, the graph mining algorithm is preferably pagerank and katz algorithm.

[0084] Finally, the Louvain algorithm is used to divide communities. By optimizing the density of connections within communities and the sparseness of connections between communities, the network is divided into multiple communities with the best internal connectivity. This can effectively distinguish between high-involvement addresses in the case and other wallet addresses, and further help understand the organization and relationships within the network.

[0085] In step S500, a suspicious address is determined and displayed according to the scoring result and the community detection result.

[0086] As an optional implementation scheme of the present application, optionally, determining and displaying a suspicious address according to the scoring result and the community detection result includes:

[0087] S510, sorting the transaction addresses according to the scoring results and the community detection results to determine suspicious addresses;

[0088] S520: Display the transaction link between the deposit collection address and the suspicious address.

[0089] In this embodiment, the links between the deposit address and the suspicious address are displayed on the blockchain detection visualization platform to assist in case investigation, so that law enforcement officers can better understand and track the potential flow of funds involved in the case. It should be noted that in this embodiment, the suspicious addresses are determined and sorted according to the scoring results of the rule model and the community discovery results, so as to identify the suspicious addresses with the highest correlation with the deposit address and support the investigation and action of law enforcement agencies.

[0090] To further verify the accuracy of this application, Figure 5 As shown, all nodes showing "verified" are highly suspicious nodes selected by senior analysts, and the TopN suspect addresses are addresses with a relatively high probability of being involved in the case inferred by the model. It can be seen that the overlap between the verified addresses and the Top5 addresses is very high. Therefore, it can be seen that the method provided in this application can accurately identify the funds involved in the case on the chain.

[0091] In summary, the on-chain method for identifying funds involved in the case of the present application is no longer limited to the transaction data of legal currency, and can be directly applied to blockchain transaction data, including transactions involving cryptocurrency, thereby expanding the scope of application of the analysis method and better adapting to the monitoring and analysis needs of the emerging financial field. Among them, the present application adopts a multidimensional feature analysis method, which is no longer overly dependent on manually constructed rules, saving labor costs, thereby improving the generalization ability of the model, and can effectively identify and respond to new transaction patterns and improper behavior strategies, which helps to improve the effective crackdown on improper behavior. At the same time, the present application uses graph features for modeling, which can intuitively show transaction characteristics and can also discover the gangs involved in the case. Finally, the present invention provides a visual operation platform and a visual display platform to provide an intuitive interface for law enforcement agencies and investigators. This enables them to understand and analyze complex transaction data more easily, effectively guide investigations, and improve the convenience and efficiency of practical applications.

[0092] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment method can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned control methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated as: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0093] Example 2

[0094] Based on the implementation principle of Example 1, the present application, on the other hand, provides a device for implementing any of the above-mentioned methods for identifying funds involved in a case on a chain, including:

[0095] A message queue module is configured to receive, cache and queue user request data; wherein the request data includes a deposit collection address;

[0096] The on-chain retrieval module is configured to perform an on-chain full transaction search for the deposit collection address, extract the transaction links of the start address and the end address, construct a transaction network diagram, and construct multi-dimensional features for the transaction address;

[0097] A model reasoning module is configured to construct a rule model, and use the rule model to score the transaction link to obtain a scoring result of the end point address;

[0098] A community discovery module is configured to detect community core points on the transaction network graph using a graph mining algorithm to obtain a community detection result;

[0099] The result presentation module is configured to determine and present a suspicious address based on the scoring result and the community detection result.

[0100] Example 3

[0101] Furthermore, in another aspect, the present application provides a control system, comprising:

[0102] processor;

[0103] a memory for storing processor-executable instructions;

[0104] Wherein, the processor is configured to implement any of the above-mentioned methods for identifying funds involved in a case on the chain when executing the executable instructions.

[0105] The disclosed embodiment of the control system includes a processor and a memory for storing processor executable instructions. The processor is configured to implement any of the above-mentioned on-chain involved funds identification methods when executing the executable instructions.

[0106] Here, it should be noted that the number of processors can be one or more. At the same time, in the control system of the embodiment of the present disclosure, an input device and an output device may also be included. Among them, the processor, memory, input device and output device may be connected through a bus or in other ways, which are not specifically limited here.

[0107] As a computer-readable storage medium, the memory can be used to store software programs, computer executable programs and various modules, such as the program or module corresponding to the on-chain involved funds identification method of the embodiment of the present disclosure. The processor executes various functional applications and data processing of the control system by running the software programs or modules stored in the memory.

[0108] The input device can be used to receive input numbers or signals. The signal can be a key signal related to user settings and function control of the device / terminal / server. The output device can include a display device such as a display screen.

[0109] Example 4

[0110] On another aspect of the present application, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the on-chain method for identifying funds involved in a case as described in any one of the above items is implemented.

[0111] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for identifying funds involved in a case on a chain, characterized in that: The steps include: Receive, cache and queue the user's request data; wherein the request data includes the deposit collection address; Conduct a full transaction search on the chain for the deposit collection address, extract the transaction links of the starting address and the end address, construct a transaction network diagram, and construct multi-dimensional features for the transaction address; Constructing a rule model, and using the rule model to score the transaction link to obtain a scoring result of the destination address; Using a graph mining algorithm to perform community core point detection on the transaction network graph to obtain a community detection result; The suspicious address is determined and displayed based on the scoring result and the community detection result.

2. The on-chain method for identifying funds involved in a case according to claim 1, characterized in that: After receiving, caching and queuing the user's request data, it also includes: Real-time monitoring of server resource status; When the resource status meets the preset condition, a piece of the request data is read.

3. The on-chain method for identifying funds involved in a case according to claim 1, characterized in that: The multidimensional features include statistical features and graph features.

4. The on-chain method for identifying funds involved in a case according to claim 1, characterized in that: The constructing of the rule model, and using the rule model to score the transaction link to obtain the scoring result of the destination address include: Build rule models; Presetting the scoring rules of the rule model using a decision tree method; All the transaction links are scored based on the scoring rules, summed and the top 10% are extracted to obtain the scoring result of the destination address.

5. The on-chain method for identifying funds involved in a case according to claim 1, characterized in that: The method of using a graph mining algorithm to perform community core point detection on the transaction network graph to obtain a community detection result includes: Acquire the transaction network graph; wherein the transaction network graph represents the user addresses on the chain through nodes, and represents the transaction relationship between the user addresses on the chain through edges; A graph mining algorithm is used to perform community detection on the transaction network graph to determine the core points of the community.

6. The on-chain method for identifying funds involved in a case according to claim 5 is characterized in that: After performing community detection on the transaction network graph using a graph mining algorithm to determine the community core point, the method further includes: The Louvain algorithm is used to divide the transaction network graph into communities.

7. The on-chain method for identifying funds involved in a case according to claim 1, characterized in that: The determining and displaying of suspicious addresses according to the scoring results and the community detection results includes: Sort the transaction addresses according to the scoring results and the community detection results to determine suspicious addresses; Display the transaction link between the deposit collection address and the suspicious address.

8. A device for implementing the on-chain case-related funds identification method as described in any one of claims 1 to 7, characterized in that: include: A message queue module is configured to receive, cache and queue user request data; wherein the request data includes a deposit collection address; The on-chain retrieval module is configured to perform an on-chain full transaction search for the deposit collection address, extract the transaction links of the start address and the end address, construct a transaction network diagram, and construct multi-dimensional features for the transaction address; A model reasoning module is configured to construct a rule model, and use the rule model to score the transaction link to obtain a scoring result of the end point address; A community discovery module is configured to detect community core points on the transaction network graph using a graph mining algorithm to obtain a community detection result; The result presentation module is configured to determine and present a suspicious address based on the scoring result and the community detection result.

9. A control system, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the on-chain method for identifying funds involved in a case as described in any one of claims 1 to 7 when executing the executable instructions.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by the processor, the on-chain method for identifying funds involved in a case as described in any one of claims 1 to 7 is implemented.

Images