Block chain centralized exchange address mining expansion method based on rule identification

Abstract

The invention discloses a method for mining and expanding a block chain centralized exchange address based on rule identification, and relates to the technical field of block chains, and the method comprises the steps: building a block chain full node, obtaining first transaction data on the block chain full node, and processing the first transaction data based on a first rule to obtain a money filling address; obtaining second transaction data of the coin filling address, and obtaining a service charge address based on the second transaction data; and obtaining third transaction data of the service charge address, obtaining a hot wallet address based on the third transaction data, and obtaining an expansion result based on the hot wallet address, so that the problem that fund penetration analysis is inaccurate due to the fact that comprehensive data of a centralized exchange cannot be obtained in an existing method can be solved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification. Background Art

[0002] Fund penetration refers to the act in which criminals or bad actors take advantage of loopholes in the exchange during the transaction process to launder, transfer or conceal the source of illegally obtained funds through the exchange.

[0003] Centralized exchanges (cex) serve as the core of the digital currency market and play an important role in digital asset transactions. However, with the continuous development of the digital currency market, centralized exchanges have encountered a series of challenges, including the problem of fund penetration. In the process of blockchain transactions, illegal cases such as pyramid schemes, fraud and money laundering have emerged in an endless stream, posing an increasingly serious threat to financial institutions and regional financial security. Blockchain account addresses have the characteristics of divergence and anonymity, which makes the illegal transaction model of blockchain complex and hidden. By conducting fund penetration analysis on centralized exchanges and finding relevant hot wallet addresses, it can help law enforcement agencies effectively control the transaction path of illegal funds and improve the speed of solving cases by relevant personnel.

[0004] Existing methods can be divided into two categories: one is to obtain the official address of the centralized exchange based on open source channels, with the help of official browsers or other third-party data tag libraries, but this method is subject to the update frequency of the acquisition channel and the credibility of the channel data, so it is difficult to obtain more comprehensive and timely data; the second is to use offline deposits and withdrawals for specific exchanges, track the subsequent deposit funds path, and then find the exchange hot wallet address information, but this method is inefficient, and there is a certain threshold for trading operations. Subsequent fund tracking and address identification also require manual attention and judgment, and only the exchange address of deposits and withdrawals can be obtained. In addition, due to the existence of Gas (handling fee) fees for on-chain transactions, the Gas fees of some chains are relatively high, which is also a waste of funds. Therefore, this method depends on the proficiency of the deposit and withdrawal personnel in on-chain transactions, as well as expansion for specific exchanges, so it is impossible to obtain more comprehensive data. Summary of the invention

[0005] In order to solve the problem that the existing methods cannot obtain comprehensive data of centralized exchanges, resulting in inaccurate capital penetration analysis, the present method provides a mining and expansion method for blockchain centralized exchange addresses based on rule identification, the method includes building a blockchain full node, obtaining first transaction data on the blockchain full node, processing the first transaction data based on a first rule to obtain a deposit address; obtaining second transaction data of the deposit address, and obtaining a handling fee address based on the second transaction data; obtaining third transaction data of the handling fee address, obtaining a hot wallet address based on the third transaction data, and obtaining an expansion result based on the hot wallet address.

[0006] Principle of this method: Based on the first rule, the label data is expanded to obtain the known hot wallet address, which can de-anonymize the address and obtain more comprehensive data; based on the business rules, the features are constructed to conduct a penetration analysis of the centralized exchange funds, extract the transaction data of the target exchange's hot wallet address, obtain the deposit address, and then apply specific rules and construct features to classify the addresses in the blockchain, find the exchange fee address, and mine and expand the exchange's hot wallet address based on the exchange's fee address, which increases the scope of de-anonymization of the blockchain address and makes the flow of funds clearly visible. It can accurately extract the source and outflow path of funds for illegal case transactions, improve the accuracy of fund penetration analysis, and improve the efficiency of law enforcement agencies in identifying the flow of funds for illegal transactions and solving cases.

[0007] Furthermore, the specific steps of obtaining the deposit address include: matching the first transaction data based on the first rule to obtain a known hot wallet address, and obtaining the first inbound transaction data of the known hot wallet address; obtaining an inbound address based on the first inbound transaction data, constructing a first feature of the inbound address, classifying the inbound address based on the first feature and the second rule to obtain a classified address, marking the classified address, and obtaining the deposit address based on the classified address.

[0008] Furthermore, the specific steps of obtaining the fee address include: obtaining second inbound transaction data of the deposit address based on the second transaction data, obtaining a suspected fee address based on the second inbound transaction data, constructing a second feature of the suspected fee address, analyzing the suspected fee address based on the second feature and a third rule, and obtaining the fee address.

[0009] Furthermore, the specific steps of obtaining the hot wallet address include: obtaining a full address for receiving handling fees based on the third transaction data, obtaining a first address based on the full address, obtaining outgoing transaction data of the first address, and obtaining a collection address based on the outgoing transaction data; obtaining a suspected hot wallet address based on the collection address, constructing a third feature of the suspected hot wallet address, obtaining a proportion of the suspected hot wallet address that is a hot wallet address, and obtaining the hot wallet address based on the third feature, the proportion and a fourth rule.

[0010] Furthermore, the specific steps of constructing the first feature include: obtaining first data of the incoming address, the first data including the number of local currency transactions, the number of token transactions, the number of inflow addresses, the first number of outflow addresses, the first amount of funds flowing to the exchange, and the total number of outflow transactions; calculating the first ratio of the first amount to the total number of outflow transactions; and constructing the first feature based on the first data and the first ratio.

[0011] Furthermore, the second rule specifically includes: if the total number of fund outflow transactions is less than a first preset number, the number of inflow addresses and the first number of outflow addresses are both less than a second preset number, and the funds of the inbound address flow to the hot wallet address of the same exchange, then the inbound address is judged to be a deposit address.

[0012] Furthermore, the specific steps of constructing the second feature include: obtaining the outflow address from which funds flow out of the suspected fee address, obtaining the second outflow address number and fourth transaction data of the outflow address, and obtaining a known deposit address and an unknown identity address based on the fourth transaction data; obtaining the second number of the known deposit address, the first transaction number of funds from the known deposit address flowing to the suspected fee address, and the second transaction number of funds from the known deposit address flowing to non-suspected fee addresses; obtaining the third number of the unknown identity address, the third transaction number of funds from the unknown identity address flowing to the suspected fee address, and the fourth transaction number of funds from the unknown identity address flowing to non-suspected fee addresses; constructing the second feature based on the second outflow address number, the second number, the first transaction number, the second transaction number, the third number, the third transaction number, and the fourth transaction number.

[0013] Furthermore, the third rule specifically includes: obtaining the transaction amount of the suspected fee address; if the transaction amount is within a preset range, the suspected fee address is the fee address; if the transaction amount exceeds the preset range, obtaining recovered funds based on the transaction amount and the preset range, and obtaining the flow address of the recovered funds, and if the flow address is the hot wallet address or the known hot wallet address, the suspected fee address is the fee address.

[0014] Furthermore, the specific steps of constructing the third feature include: obtaining the fifth transaction data of the suspected hot wallet address, and obtaining the incoming opponent address and the outgoing opponent address based on the fifth transaction data; obtaining the second proportion of the incoming opponent address being the charging address of the suspected hot wallet address; obtaining the third proportion of the incoming opponent address being the charging address of the suspected hot wallet address, and the source of funds of the incoming opponent address is a known fee address; obtaining the fourth proportion of the incoming opponent address funds flowing to a non-suspected hot wallet address; obtaining the fifth proportion of the incoming opponent address being an unknown address; obtaining the sixth proportion of the incoming opponent address being an unknown address, and the source of funds of the incoming opponent address is a known fee address; based on the second proportion, the third proportion, the fourth proportion, the fifth proportion and the sixth proportion, construct the third feature.

[0015] Furthermore, the fourth rule specifically includes: obtaining the funds inflow address and hot wallet exchange of the suspected hot wallet address, and obtaining the first hot wallet address in the hot wallet exchange that is not the suspected hot wallet address; judging whether the funds inflow address is the deposit address or the known deposit address, and if there is a transaction between the funds inflow address and the first hot wallet address, then the suspected hot wallet address is a hot wallet address.

[0016] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0017] 1. Based on the first rule, the label data is expanded to obtain the known hot wallet address, which can be de-anonymized to obtain more comprehensive data; based on the business rules, the features are constructed to conduct a penetration analysis of the centralized exchange funds, extract the transaction data of the target exchange's hot wallet address, obtain the deposit address, and then apply specific rules and construct features to classify the addresses in the blockchain, find the exchange fee address, and mine and expand the exchange's hot wallet address based on the exchange's fee address, which increases the scope of blockchain address de-anonymization and makes the flow of funds clearly visible. It can accurately extract the source and outflow path of funds for illegal case transactions, improve the accuracy of fund penetration analysis, and improve the efficiency of law enforcement agencies in identifying the flow of funds for illegal transactions and solving cases.

[0018] 2. The first, second and third features are constructed based on business rules, which adds identity recognition of some transaction addresses, more accurately labels subsequent unknown transaction nodes, and is more in line with business scenarios. Combined with the second, third and fourth rules, the node addresses are de-anonymized and analyzed, which can accurately explore and expand the sources and outflow paths of funds for illegal transactions, and improve law enforcement agencies' identification of the flow of funds for illegal transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of the present invention, and do not constitute a limitation on the embodiments of the present invention;

[0020] Figure 1 It is a flow chart of a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification in the present invention;

[0021] Figure 2 It is a relationship diagram of deposit addresses of centralized exchanges;

[0022] Figure 3 This is the relationship diagram of the fee addresses of centralized exchanges;

[0023] Figure 4 This is a relationship diagram of suspected hot wallet addresses of centralized exchanges. DETAILED DESCRIPTION

[0024] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0025] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those within the scope of this description. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0026] Embodiment 1

[0027] refer to Figure 1-Figure 4 This embodiment provides a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification, the method comprising:

[0028] A blockchain full node is built, first transaction data on the blockchain full node is obtained, and the first transaction data is processed based on a first rule to obtain a charging address; the specific steps of obtaining the charging address include: matching the first transaction data based on the first rule to obtain a known hot wallet address, and obtaining first inbound transaction data of the known hot wallet address; obtaining an inbound address based on the first inbound transaction data, constructing a first feature of the inbound address, classifying the inbound address based on the first feature and a second rule to obtain a classified address, marking the classified address, and obtaining the charging address based on the classified address.

[0029] In this embodiment, the first rule may be address label matching, such as transaction frequency, number of transaction counterparties, and liquidity of funds; classified addresses may include deposit addresses, hot wallet addresses, and suspected hot wallet addresses.

[0030] The deposit address refers to the address used to receive cryptocurrency. It is generated and provided by the exchange for the user. The private key of the deposit address is controlled by the exchange. The user transfers the corresponding virtual currency to the corresponding deposit address. After the user withdraws the currency and performs other operations, the exchange will collect the funds in the corresponding deposit address into the wallet held by the user.

[0031] The handling fee refers to the transaction fee that is consumed in a certain amount of local currency when conducting any on-chain transaction. When the exchange collects the funds of the deposit address, it will provide the corresponding handling fee to the deposit address. The address that provides the handling fee is controlled by the exchange. Usually, the hot wallet address of the exchange and the handling fee recovery address are the same.

[0032] A hot wallet address refers to a wallet address controlled by an exchange for deposits and withdrawals. It is usually used to collect funds from deposit addresses and transfer funds out after users withdraw their funds. It also generally provides fees for deposit addresses and recovers fees.

[0033] The incoming address is the address from which the currency comes.

[0034] Among them, the specific steps of constructing the first feature include: obtaining the first data of the incoming address, the first data including the number of local currency transactions, the number of token transactions, the number of inflow addresses, the first number of outflow addresses, the first amount of funds flowing to the exchange and the total number of outflow transactions; calculating the first ratio of the first amount to the total number of outflow transactions; constructing the first feature based on the first data and the first ratio.

[0035] In this implementation, local currency transactions refer to transactions in which virtual currencies (such as Bitcoin, Ethereum, etc.) are transferred to other addresses, that is, the capital path for transferring the corresponding Bitcoin and Ethereum in and out on the blockchain platform. Token transactions refer to various tokens issued on the corresponding blockchain platform, such as ERC-20 tokens, that is, the capital path for transferring the corresponding ERC-20 tokens in and out on the blockchain platform.

[0036] The number of inflow addresses refers to the number of addresses where funds flow from external addresses to inbound addresses, and the number of outflow addresses refers to the number of addresses where funds flow from inbound addresses to external addresses.

[0037] Among them, the second rule specifically includes: if the total number of fund outflow transactions is less than a first preset number, the number of inflow addresses and the first outflow address are both less than a second preset number, and the funds of the inflow address flow to the hot wallet address of the same exchange, then the inflow address is judged to be a deposit address.

[0038] Obtain the second transaction data of the deposit address, and obtain the handling fee address based on the second transaction data; the specific steps of obtaining the handling fee address include: obtaining the second inbound transaction data of the deposit address based on the second transaction data, obtaining a suspected handling fee address based on the second inbound transaction data, constructing a second feature of the suspected handling fee address, analyzing the suspected handling fee address based on the second feature and a third rule, and obtaining the handling fee address.

[0039] Among them, the specific steps of constructing the second feature include: obtaining the outflow address from which funds flow out of the suspected fee address, obtaining the second outflow address number and fourth transaction data of the outflow address, and obtaining a known deposit address and an unknown identity address based on the fourth transaction data; obtaining the second number of the known deposit address, the first transaction number of funds flowing from the known deposit address to the suspected fee address, and the second transaction number of funds flowing from the known deposit address to non-suspected fee addresses; obtaining the third number of the unknown identity address, the third transaction number of funds flowing from the unknown identity address to the suspected fee address, and the fourth transaction number of funds flowing from the unknown identity address to non-suspected fee addresses; constructing the second feature based on the second outflow address number, the second number, the first transaction number, the second transaction number, the third number, the third transaction number, and the fourth transaction number.

[0040] In this embodiment, the outflow address refers to the address from which funds flow into the outside world from the suspected fee address.

[0041] Among them, the third rule specifically includes: obtaining the transaction amount of the suspected fee address; if the transaction amount is within a preset range, the suspected fee address is the fee address; if the transaction amount exceeds the preset range, obtaining the recovered funds based on the transaction amount and the preset range, and obtaining the flow address of the recovered funds, such as the transaction amount minus the maximum value of the preset range to obtain the recovered funds, and if the flow address is the hot wallet address or the known hot wallet address, the suspected fee address is the fee address.

[0042] The third transaction data of the handling fee address is obtained, a hot wallet address is obtained based on the third transaction data, and an expansion result is obtained based on the hot wallet address.

[0043] Among them, the specific steps of obtaining the hot wallet address include: obtaining the full address for receiving the handling fee based on the third transaction data, obtaining the first address based on the full address, obtaining the outgoing transaction data of the first address, and obtaining the collection address based on the outgoing transaction data; obtaining the suspected hot wallet address based on the collection address, constructing the third feature of the suspected hot wallet address, obtaining the proportion of the suspected hot wallet address being a hot wallet address, and obtaining the hot wallet address based on the third feature, the proportion and the fourth rule. In this embodiment, the first address may include a known deposit address and an unknown identity address. The collection address refers to the address where the funds finally flow into.

[0044] Among them, the specific steps of constructing the third feature include: obtaining the fifth transaction data of the suspected hot wallet address, and obtaining the incoming opponent address and the outgoing opponent address based on the fifth transaction data; obtaining the second proportion of the incoming opponent address being the charging address of the suspected hot wallet address; obtaining the third proportion of the incoming opponent address being the charging address of the suspected hot wallet address, and the source of funds of the incoming opponent address is a known fee address; obtaining the fourth proportion of the incoming opponent address funds flowing to a non-suspected hot wallet address; obtaining the fifth proportion of the incoming opponent address being an unknown address; obtaining the sixth proportion of the incoming opponent address being an unknown address, and the source of funds of the incoming opponent address is a known fee address; based on the second proportion, the third proportion, the fourth proportion, the fifth proportion and the sixth proportion, construct the third feature.

[0045] The inbound counterparty address refers to the address of the trading party whose funds enter the suspected hot wallet address from the outside, and the outbound counterparty address refers to the address of the trading party whose funds enter the external transaction from the suspected hot wallet address.

[0046] Among them, the fourth rule specifically includes: obtaining the funds inflow address and hot wallet exchange of the suspected hot wallet address, and obtaining the first hot wallet address in the hot wallet exchange that is not the suspected hot wallet address; judging whether the funds inflow address is the deposit address or the known deposit address, and there is a transaction between the funds inflow address and the first hot wallet address, then the suspected hot wallet address is a hot wallet address.

[0047] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0048] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for mining and expanding blockchain centralized exchange addresses based on rule identification, characterized in that: The method comprises: Building a blockchain full node, obtaining first transaction data on the blockchain full node, and processing the first transaction data based on a first rule to obtain a deposit address; Acquire second transaction data of the deposit address, and obtain a handling fee address based on the second transaction data; The third transaction data of the handling fee address is obtained, a hot wallet address is obtained based on the third transaction data, and an expansion result is obtained based on the hot wallet address.

2. According to claim 1, a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification is characterized in that: The specific steps of obtaining the deposit address include: Based on the first rule, the first transaction data is matched to obtain a known hot wallet address, and first inbound transaction data of the known hot wallet address is obtained; based on the first inbound transaction data, an inbound address is obtained, a first feature of the inbound address is constructed, and based on the first feature and second rules, the inbound address is classified to obtain a classified address, the classified address is marked, and the deposit address is obtained based on the classified address.

3. According to claim 1, a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification, characterized in that: The specific steps to obtain the handling fee address include: Based on the second transaction data, second inbound transaction data of the deposit address is obtained; based on the second inbound transaction data, a suspected fee address is obtained; a second feature of the suspected fee address is constructed; based on the second feature and a third rule, the suspected fee address is analyzed to obtain the fee address.

4. According to a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification according to claim 1, it is characterized in that: The specific steps of obtaining the hot wallet address include: Based on the third transaction data, a full address for receiving the handling fee is obtained; based on the full address, a first address is obtained; outbound transaction data of the first address is obtained; and a collection address is obtained based on the outbound transaction data; a suspected hot wallet address is obtained based on the collection address, a third feature of the suspected hot wallet address is constructed, a proportion of the suspected hot wallet address being a hot wallet address is obtained, and based on the third feature, the proportion and a fourth rule, the hot wallet address is obtained.

5. According to claim 2, a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification is characterized in that: The specific steps of constructing the first feature include: Obtaining first data of the inbound address, the first data including the number of local currency transactions, the number of token transactions, the number of inbound addresses, the first number of outbound addresses, the first amount of funds flowing to the exchange, and the total number of outbound transactions; Calculating a first ratio of the first amount to the total number of fund outflow transactions; The first feature is constructed based on the first data and the first ratio.

6. According to claim 5, a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification is characterized in that: The second rule specifically includes: If the total number of fund outflow transactions is less than a first preset number, the number of inflow addresses and the first outflow address are both less than a second preset number, and the funds of the inflow address flow to the hot wallet address of the same exchange, then the inflow address is determined to be a deposit address.

7. According to claim 3, a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification is characterized in that: The specific steps of constructing the second feature include: Obtain an outflow address from which funds flow out of the suspected handling fee address, obtain a second outflow address number and fourth transaction data of the outflow address, and obtain a known deposit address and an unknown identity address based on the fourth transaction data; Obtaining a second number of the known deposit addresses, a first number of transactions where funds from the known deposit addresses flow to the suspected fee address, and a second number of transactions where funds from the known deposit addresses flow to a non-suspected fee address; Obtaining a third number of the unknown identity address, a third number of transactions in which funds from the unknown identity address flow to the suspected fee address, and a fourth number of transactions in which funds from the unknown identity address flow to a non-suspected fee address; The second feature is constructed based on the second outflow address number, the second quantity, the first transaction number, the second transaction number, the third quantity, the third transaction number and the fourth transaction number.

8. According to claim 7, a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification is characterized in that: The third rule specifically includes: Obtain the transaction amount of the suspected fee address; If the transaction amount is within the preset range, the suspected fee address is the fee address; If the transaction amount exceeds the preset range, recovered funds are obtained based on the transaction amount and the preset range, and the flow address of the recovered funds is obtained. If the flow address is the hot wallet address or the known hot wallet address, the suspected fee address is the fee address.

9. According to claim 4, a method for mining and expanding addresses of blockchain centralized exchanges based on rule identification is characterized in that: The specific steps of constructing the third feature include: Acquire fifth transaction data of the suspected hot wallet address, and obtain an incoming counterparty address and an outgoing counterparty address based on the fifth transaction data; Obtaining a second ratio of the incoming counterparty address to the deposit address of the suspected hot wallet address; Obtaining a third proportion of the incoming counterparty address being a deposit address of the suspected hot wallet address, and the source of funds of the incoming counterparty address being a known fee address; Obtaining a fourth ratio of the funds flowing into the opponent's address to a non-suspected hot wallet address; Obtaining a fifth ratio of the incoming opponent addresses being unknown addresses; The sixth proportion of the incoming counterparty address being an unknown address and the source of funds of the incoming counterparty address being a known fee address; The third feature is constructed based on the second ratio, the third ratio, the fourth ratio, the fifth ratio and the sixth ratio.

10. A method for mining and expanding blockchain centralized exchange addresses based on rule identification according to claim 9, characterized in that: The fourth rule specifically includes: Obtain the funds inflow address and hot wallet exchange of the suspected hot wallet address, and obtain a first hot wallet address in the hot wallet exchange that is not the suspected hot wallet address; determine whether the funds inflow address is the deposit address or the known deposit address, and if there is a transaction between the funds inflow address and the first hot wallet address, then the suspected hot wallet address is a hot wallet address.

Images