Analysis method for intelligently discovering potential suspicious fund opponents based on visual address points in canvas

Abstract

The invention discloses an analysis method for intelligently discovering a potential suspicious fund opponent based on a visual address point in a canvas, and relates to the technical field of block chains, the method comprises the following steps: constructing a transaction network based on a known block chain address and transaction data, and obtaining a first address of the transaction network; identifying the first address to obtain a first role; dividing the first role to obtain a mutually exclusive role group, obtaining a second role based on the mutually exclusive role group and the transaction network, and obtaining a labeling data set based on the second role; obtaining an address feature of the first role based on the key feature, obtaining a first feature vector of the first address based on the address feature, and obtaining a training set based on the first feature vector and the annotation data set; the multi-classification model is obtained based on the preset kernel function and the training set, and the address roles of the to-be-classified addresses are obtained by classifying the to-be-classified addresses based on the multi-classification model, so that the problems that an existing block chain address classification method is low in classification precision and lacks adaptive capacity to a rapid change transaction strategy under complex transaction behaviors can be solved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to an analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas. Background Art

[0002] In blockchain applications, especially in the financial industry, traditional address association analysis methods mainly focus on the analysis of direct transaction pairs, identifying suspicious activities by tracking and monitoring direct transactions between addresses. Although this method is effective in some cases, it usually relies on static rules and simple connection analysis, and therefore faces many challenges in dynamic and complex blockchain environments. Since traditional methods mainly use known illegal transaction features to judge transaction counterparties and transaction addresses, their simple judgment methods lead to low classification accuracy in complex scenarios, and they often cannot adapt to the rapid changes in transaction behavior. When trading strategies change, they cannot detect potential abnormal opponents in a timely manner. Summary of the invention

[0003] In order to solve the problems of low classification accuracy and lack of adaptability to rapidly changing transaction strategies in existing blockchain address classification methods under complex transaction behaviors, the present invention provides an analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas, the method comprising: obtaining a known blockchain address and transaction data of the blockchain address, constructing a transaction network based on the blockchain address and the transaction data, and obtaining a first address of the transaction network; constructing an identification rule, identifying the first address based on the identification rule, and obtaining a first role; dividing the first role based on a preset division rule to obtain a plurality of mutually exclusive role groups, obtaining a second role based on all the mutually exclusive role groups and the transaction network, and obtaining a labeled data set based on the second role; presetting a key feature of the first role, obtaining an address feature of the first role based on the key feature, obtaining a first feature vector of the first address based on the address feature, and obtaining a training set based on the first feature vector and the labeled data set; obtaining a multi-classification model based on a preset kernel function and the training set, classifying the address to be classified based on the multi-classification model, and obtaining the address role of the address to be classified.

[0004] The principle of the present invention is as follows: the address roles are preliminarily identified by constructing identification rules, the absolutely mutually exclusive roles are divided into a group, the address features of each role in the group are determined, a training set is obtained based on the address features and the labeled data set, the training is carried out in mutually exclusive groups, a classifier is trained for each role in the group, wherein the role is used as a positive class, and all other roles are combined as negative classes, the optimal parameters are obtained, and each independent classifier is ensured to achieve the best performance on its corresponding binary classification task, thereby obtaining a multi-classification model, and a support vector machine is used in combination with a one-versus-the-rest splitting strategy (One-versus-the-rest, OVR) for multi-classification, which can effectively handle a variety of address roles with mutually exclusive and mutually inclusive relationships, thereby more accurately identifying and classifying blockchain addresses with complex transaction behaviors, improving the judgment ability of a single address, and improving the classification accuracy under multiple roles and complex scenarios; the role with the highest score is selected from each group as the prediction result of each group, the prediction results of each group are integrated, and combined with business rules, the outputs of multiple classifiers are integrated to provide a more accurate role classification result.

[0005] Furthermore, the specific steps of constructing the transaction network include: presetting the maximum number of expansion layers and expansion rules of the transaction network, obtaining the counterparty of the blockchain address based on the transaction data; based on the maximum number of expansion layers, the expansion rules and the counterparty, taking the blockchain address as the starting point, constructing a directed counterparty network graph; converting the counterparty network graph into a format to obtain the transaction network. This effectively depicts the transaction relationship between addresses and provides a basis for subsequent role identification.

[0006] Furthermore, the specific steps of obtaining a plurality of mutually exclusive role groups include: dividing the first role based on the preset division rule to obtain a plurality of first groups, adding an unknown role to each of the first groups, and obtaining all the mutually exclusive role groups.

[0007] Furthermore, the specific steps of obtaining the multi-classification model include: obtaining each third role in each of the mutually exclusive role groups; based on the training set, obtaining the first transaction data of the third role to obtain a positive sample, and obtaining the second transaction data of the third role not being the third role to obtain a negative sample; training a classifier for each third role based on the preset kernel function, the positive sample and the negative sample; obtaining the optimal parameters of each classifier, optimizing each classifier based on the optimal parameters to obtain an optimized classifier, and obtaining the multi-classification model based on all the optimized classifiers.

[0008] Furthermore, the specific steps of obtaining the address role of the address to be classified include: each of the optimized classifiers identifies the address to be classified to obtain several first prediction scores, obtains a first prediction result for each of the mutually exclusive role groups based on all the first prediction scores, integrates all the first prediction results to obtain a prediction role classification; obtains confidence based on all the first prediction scores, and obtains the address role based on preset business rules, the confidence and the prediction role classification.

[0009] Furthermore, the method also includes: obtaining a new role, determining whether the new role is mutually exclusive with any of the mutually exclusive role groups; if so, adding the new role to the mutually exclusive role group to obtain a first new mutually exclusive role group, training a first classifier for each role in the first new mutually exclusive role group, obtaining a first new classification model based on the first classifier, and updating the classification model to the first new classification model; if not, adding an anti-class role that is mutually exclusive with the new role, obtaining a second new mutually exclusive role group based on the new role and the anti-class role, training a second classifier for each role in the second new mutually exclusive role group, obtaining a second new classification model based on the second classifier, and updating the classification model to the second new classification model.

[0010] For new roles, there is no need to retrain all roles. If the role is mutually exclusive with any group, you only need to retrain the classifier of the group. If the role is not mutually exclusive with any group, you only need to add the mutually exclusive opposite role and then train a new classifier. This is simple and fast, and is more conducive to the expansion and adjustment of the model.

[0011] Furthermore, the method also includes: constructing a visualization canvas based on the transaction network, obtaining the number of canvas nodes in the visualization canvas and the node status of each canvas node, wherein the node status includes addition, deletion and update; detecting the canvas nodes based on the detection mechanism to obtain trigger nodes, obtaining node data of the trigger nodes, analyzing the node data to obtain node analysis results, wherein the node data includes connection nodes connected to the trigger nodes, node relationships between the trigger nodes and the connection nodes, historical transaction data and interactive opponents outside the visualization canvas.

[0012] By building a visualization canvas based on the mined clue addresses and constructing a global view, potential counterparties outside the canvas can be identified based on the analysis of existing nodes in the canvas. The data of multiple nodes and their counterparties can be comprehensively compared, and potential counterparties can be continuously expanded to realize a dynamic and scalable transaction network, which can reveal potential complex transaction relationships.

[0013] Furthermore, the method also includes: obtaining a first node outside the visualization canvas connected to the canvas node, obtaining an extended node based on an extension rule and the first node, expanding the visualization canvas based on the extended node to obtain a first canvas, and updating the visualization canvas to the first canvas; calculating key elements of each node outside the visualization canvas and inside the visualization canvas to obtain key nodes, wherein the key elements include degree centrality, connection strength, and PageRank value; if the key node is located inside the visualization canvas, marking the key node; if the key node is located outside the visualization canvas, expanding the visualization canvas based on the key node to obtain a second canvas, and updating the visualization canvas to the second canvas.

[0014] Build a global view, based on the topological structure, and associate multiple addresses to identify the correlation and influence between counterparties. This can effectively identify hidden counterparties that may exist in complex market environments, thereby providing support for subsequent risk management and decision-making. It can be applied to different trading scenarios, has strong flexibility and scalability, and helps to improve the transparency and security of transactions.

[0015] Furthermore, the method also includes: obtaining a first ordered transaction pair of the first address based on the transaction data, aggregating the first ordered transaction pair to obtain a first transaction pair, obtaining a first transaction feature of the first transaction pair, and obtaining a role feature of each role based on the first transaction feature; obtaining a first feature of each of the first roles based on the role feature, splicing the first features to obtain a second feature vector, and constructing a first feature matrix based on the second feature vector; obtaining a DBSCAN model of each role based on the first feature matrix; obtaining a second ordered transaction pair of the address to be identified, aggregating the second ordered transaction pair to obtain a second transaction pair, obtaining a second feature of the second transaction pair based on the address role, splicing the second features to obtain a third feature vector, and constructing a second feature matrix based on the third feature vector; clustering the address to be identified using the DBSCAN model based on the address role and the second feature matrix to obtain a number of clusters; screening all the cluster pairs based on preset screening rules to obtain abnormal transaction pairs.

[0016] The DBSCAN model refers to a model trained using a density-based clustering algorithm (DBSCAN, Density-Based Spatial Clustering of Applications with Noise).

[0017] Based on heuristic rules, we define the characteristic focus points of different roles to obtain role characteristics, and obtain the characteristics of trading pairs of different roles through role characteristics. We deeply analyze the complex characteristics of trading pairs, thereby distinguishing different trading behaviors of different roles, improving the analysis accuracy of role behaviors, and more accurately identifying and tracking counterparty addresses related to trading addresses; we use unsupervised clustering algorithms to cluster the characteristic vectors of trading pairs, revealing hidden patterns and similarities between trading pairs, enhancing the ability to detect abnormal trading behaviors, and improving the accuracy of identifying and predicting fraudulent behaviors; the analysis method combining heuristic rules with unsupervised clustering algorithms screens out counterparties whose addresses need attention, and improves adaptability to rapidly changing trading strategies.

[0018] Furthermore, the specific steps of obtaining the DBSCAN model of each role include: clustering the feature vectors in the first feature matrix based on preset parameters to obtain several clustering results; evaluating each of the clustering results to obtain evaluation results, obtaining optimal parameters based on the evaluation results, and obtaining the DBSCAN model based on the optimal parameters and the first feature matrix.

[0019] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0020] 1. Preliminary identification of address roles is performed by constructing identification rules, and absolutely mutually exclusive roles are divided into a group. The address features of each role in the group are determined. A training set is obtained based on the address features and the labeled data set. The training is carried out in mutually exclusive groups. A classifier is trained for each role in the group, where the role is used as the positive class and all other roles are combined as the negative class. The optimal parameters are obtained to ensure that each independent classifier can achieve the best performance on its corresponding binary classification task, thereby obtaining a multi-classification model. The support vector machine is combined with a one-to-the-rest splitting strategy for multi-classification, which can effectively handle a variety of address roles with mutually exclusive and mutually inclusive relationships, thereby more accurately identifying and classifying blockchain addresses with complex transaction behaviors, and improving the classification accuracy under multiple roles and complex scenarios; the role with the highest score is selected from each group as the prediction result of each group, and the prediction results of each group are integrated, and combined with business rules, the outputs of multiple classifiers are integrated to provide more accurate role classification results.

[0021] 2. Based on heuristic rules, define the characteristic focus points of different roles to obtain role characteristics, obtain the characteristics of trading pairs of different roles through role characteristics, deeply analyze the complex characteristics of trading pairs, so as to distinguish different trading behaviors of different roles, improve the analysis accuracy of role behaviors, and more accurately identify and track counterparty addresses related to trading addresses; use unsupervised clustering algorithms to cluster the characteristic vectors of trading pairs, reveal hidden patterns and similarities between trading pairs, enhance the detection ability of abnormal trading behaviors, and improve the accuracy of identifying and predicting fraudulent behaviors; the analysis method combining heuristic rules with unsupervised clustering algorithms can screen out counterparties whose addresses need to be paid attention to, and improve the adaptability to rapidly changing trading strategies.

[0022] 3. For new roles, there is no need to retrain all roles. If the role is mutually exclusive with any group, only the classifier of the group needs to be retrained. If the role is not mutually exclusive with any group, only the mutually exclusive opposite role needs to be added and a new classifier needs to be trained. This is simple and fast, and is more conducive to the expansion and adjustment of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of the present invention, and do not constitute a limitation on the embodiments of the present invention;

[0024] Figure 1 It is a flow chart of the analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in the canvas in the present invention. DETAILED DESCRIPTION

[0025] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0026] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those within the scope of this description. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0027] Embodiment 1

[0028] refer to Figure 1 This embodiment provides an analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas, and the method includes:

[0029] Obtaining a known blockchain address, such as an exchange, wallet service, and gambling platform, and transaction data of the blockchain address, building a transaction network based on the blockchain address and the transaction data, and obtaining a first address of the transaction network;

[0030] The specific steps of constructing the transaction network include: presetting the maximum number of expansion layers and expansion rules of the transaction network to reduce the problem of difficulty in management and visualization due to too many nodes, such as setting the maximum number of layers of network expansion to 3 layers, which can ensure the depth of analysis while controlling the complexity of the graph, and the expansion rules can include setting a minimum transaction amount limit to exclude invalid or meaningless nodes with small transaction volumes, and setting random neighbor extraction to limit each node to randomly extract up to 20 trading counterparts as neighbors to control the scale of the graph; obtaining the trading counterpart of the blockchain address based on the transaction data; based on the maximum number of expansion layers, the expansion rules and the trading counterpart, taking the blockchain address as the starting point, constructing a directed trading counterpart network graph, that is, the nodes in the graph represent addresses, and the edges represent trading activities between nodes; converting the trading counterpart network graph to obtain the trading network, such as converting the trading counterpart network graph to a usable data set format, wherein each node contains necessary metadata, such as the total amount of transfers in and out and the total number of transfers in and out, and each edge contains necessary metadata, such as the total transaction amount and the total number of transactions.

[0031] Constructing an identification rule, as shown in Table 1, preliminarily identifying the first address based on the identification rule to obtain a first role; dividing the first role based on a preset division rule to obtain a plurality of mutually exclusive role groups, re-identifying based on all the mutually exclusive role groups and the transaction network to obtain a second role, obtaining a labeled data set based on the second role, and identifying the second role to obtain a labeled data set;

[0032] The specific step of obtaining a plurality of mutually exclusive role groups includes: dividing the first role based on the preset division rule to obtain a plurality of first groups, adding an unknown role to each of the first groups, and obtaining all the mutually exclusive role groups. In this embodiment, the preset division rule can be presetting which roles are absolutely mutually exclusive.

[0033] Absolute mutual exclusion means that the addresses of mutually exclusive roles have no intersection.

[0034] Table 1 Identification rules

[0035]

[0036] Where I(v) represents the number of transfer-in counterparties, O(v) represents the number of transfer-out counterparties, and v represents the address. Indicates the average retention time of funds, Τ v Indicates total capital flow, D v Indicates the number of days the address is used.

[0037] Preset key features of the first role, and obtain address features of the first role based on the key features, such as presetting key features that affect role classification, and obtaining specific address features of each role based on the key features; obtain a first feature vector of the first address based on the address features, such as concatenating address features to obtain feature vectors of each address, obtain a training set based on the first feature vector and the annotated data set, and combine the feature vector and the annotated data set to obtain a data set ultimately used for training the model; in this embodiment, the key features and address features may include transaction frequency, average transaction amount, number of inbound and outbound counterparties, inbound and outbound counterparty ratio, and first and last transaction time, etc.;

[0038] Based on a preset kernel function and the training set, a multi-classification model is obtained, and the addresses to be classified are classified based on the multi-classification model to obtain the address roles of the addresses to be classified.

[0039] Among them, the specific steps of obtaining the multi-classification model include: obtaining each third role in each mutually exclusive role group; based on the training set, obtaining the first transaction data of the third role to obtain a positive sample, and obtaining the second transaction data of the third role to obtain a negative sample, that is, taking the mutually exclusive group as a unit, training a classifier for each role in the group, wherein the role is used as a positive class, and all other roles are combined as negative classes; training the classifier of each third role based on the preset kernel function, the positive sample and the negative sample; in this embodiment, a suitable kernel function can be selected according to data characteristics, such as selecting a kernel function according to the angles of high-dimensional data characteristics, nonlinearity, complex and asymmetric boundaries, and uneven category distribution density, wherein the radial basis function (RBF) is particularly suitable for solving nonlinear problems due to its flexibility, so in a preferred embodiment, the kernel function uses the radial basis function, and its calculation method can be:

[0040] K(x i ,x j )=exp(-γ‖x i -x j ‖ 2 );

[0041] Among them, K(x i ,x j ) represents the similarity between sample points, ‖x i -x j ‖ represents the Euclidean distance, x i and x j Both represent input samples, γ represents the free parameter of the kernel function, and i and j represent serial numbers.

[0042] The optimal parameters of each classifier are obtained by grid search and cross validation, and the calculation method can be as follows:

[0043] (C* ,γ * )=argmax C,γ CV_Score(C,γ);

[0044] Among them, C represents the regularization parameter of the classifier, which is used to balance the trade-off between interval maximization and classification error, CV_Score represents cross validation, γ represents the free parameter of the kernel function, and X * and γ * represent the optimal regularization parameter and the optimal free parameter respectively.

[0045] Each of the classifiers is optimized based on the optimal parameters to obtain an optimized classifier, and the multi-classification model is obtained based on all the optimized classifiers.

[0046] The specific step of obtaining the address role of the address to be classified includes: each of the optimized classifiers identifies the address to be classified to obtain a plurality of first prediction scores, and the calculation method for obtaining the prediction scores may be:

[0047]

[0048] Among them, s(x) represents the prediction score, α i represents the weight of the classifier, y i represents the category label of the classifier, K(x i ,x) represents the kernel function, x i Represents the existing sample, x represents the input sample, b represents the bias term, d represents the number of classifiers, and i represents the sequence number.

[0049] A positive score indicates a preference for the positive class of the classifier, while a negative score indicates a preference for the negative class.

[0050] Based on all the first prediction scores, a first prediction result of each mutually exclusive role group is obtained, such as each intra-group classifier selects the category with the highest score as the intra-group prediction result of the sample, all the first prediction results are integrated to obtain a predicted role classification, and the predicted role classification is obtained by combining the prediction results of each group;

[0051] A confidence level is obtained based on all of the first prediction scores, and the address role is obtained based on preset business rules, such as the rules shown in Table 1, the confidence level and the prediction role classification.

[0052] In this embodiment, the classifier may be a support vector machine (SVM), and during the training process, the performance of each classifier may be evaluated by calculating indicators such as the precision, recall rate, and F1 score (F1 Score) of each classifier, and the classifier may be further optimized by adjusting parameters, sample features, and sample balance.

[0053] Embodiment 2

[0054] On the basis of the first embodiment, in this embodiment, the method further includes:

[0055] Based on the transaction data, a first ordered transaction pair of the first address is obtained, such as aggregating all transactions of transferring funds from address A to address B to obtain T AB , which can be expressed as Represents an ordered trading pair;

[0056] Aggregate the first ordered transaction pairs to obtain the first transaction pair. Then the first transaction pair T of address A A It can be expressed as:

[0057] T A =∪ B≠1 (T AB ∪T BA );

[0058] Obtain the first transaction feature of the first transaction pair, obtain the role feature of each role based on the first transaction feature, and determine the feature that each role mainly focuses on; for example, the first transaction feature can be expressed as F pair ={f′ 1 ,f′ 2 ,...,f′ n}, the role characteristics can be expressed as F r ={f′ 1 ,f′ 2 ,..,f′ k |f′∈F pair ,k≤n}, where n represents the number of features.

[0059] Based on the role feature, the first feature of each of the first roles is obtained, based on the role feature, the address feature of each specific role is obtained, the first features are concatenated to obtain a second feature vector, and a first feature matrix is ​​constructed based on the second feature vector. The first feature matrix can be expressed as: in, represents the mth second eigenvector, where m represents the sequence number;

[0060] Based on the first feature matrix, a DBSCAN model of each role is obtained; wherein the specific steps of obtaining the DBSCAN model of each role include:

[0061] Based on preset parameters, which may include the neighborhood radius ∈ and the minimum number of neighborhood points MinPts of the core point, the unsupervised clustering technology DBSCAN is used to cluster the feature vectors in the first feature matrix to obtain several clustering results. The calculation method of the clustering can be expressed as: |N∈ (p)|≥MinPts, p represents the core point, N ∈ (p) represents the number of reachable points of point p;

[0062] That is, each node is first regarded as a core point, the distance is calculated through features and the surrounding points are merged, the algorithm is iterated, and finally as many clusters as possible that satisfy ∈ and MinPts are formed;

[0063] Each clustering result is evaluated, and the evaluation result is obtained using the silhouette coefficient, which can be calculated as follows:

[0064]

[0065] Among them, S represents the silhouette coefficient, a represents the average distance between the sample and other samples in the same cluster, and b represents the average distance between the sample and the sample in the nearest cluster. The higher the value of the silhouette coefficient, the better the clustering effect.

[0066] Based on the evaluation results, the optimal parameters, that is, the optimal neighborhood radius ∈ and the minimum number of neighborhood points MinPts, are obtained. Based on the optimal parameters and the first feature matrix, the DBSCAN model is obtained, which can be expressed as:

[0067] DBSCAN r = DBSCAN(X′ r ,∈r,MinPts r ),r∈R,R represents the role set;

[0068] Among them, DBSCAN r represents the DBSCAN model of role r, DBSCAN() represents the clustering function, X′ represents the first feature matrix of role r, ∈ r and MinPts r They represent the neighborhood radius ∈ and the minimum number of neighborhood points MinPts of the role r respectively.

[0069] Obtain a second ordered transaction pair of the address to be identified, aggregate the second ordered transaction pair to obtain a second transaction pair, obtain a second feature of the second transaction pair based on the address role, concatenate the second features to obtain a third feature vector, and construct a second feature matrix based on the third feature vector;

[0070] Based on the address roles and the second feature matrix, the DBSCAN model clusters the addresses to be identified to obtain a number of clusters, which can be expressed as:

[0071] {C 1 ,C 2 ,..C n = DBSCAN r1 .fit(X′r1 );

[0072] Among them, {C 1 ,C 2 ,..C n} represents a set of clusters, DBSCAN r represents the DBSCAN model of role r1, and .fit() means applying the DBSCAN model to the second feature matrix of role r1, X′ r1 Represents the second characteristic matrix of role r1, where r1 represents the address role.

[0073] All the cluster pairs are screened based on preset screening rules to obtain abnormal transaction pairs. The preset screening rules may include:

[0074] 1) Division based on feature size

[0075] Screening target: Divide by feature distribution, such as amount and number of transactions, and retain the transaction pairs in the cluster that meet the distribution;

[0076] Screened counterparties: counterparties that are representative in certain characteristics can be screened out, such as counterparties with common large transactions;

[0077] 2) Partitioning based on specific instances

[0078] Screening target: select a specified trading pair and keep the trading pairs in the same cluster as it;

[0079] Screened counterparties: Able to identify all counterparties related to a specified key trading pair, suitable for tracking specific capital flows or key trading behaviors;

[0080] 3) Division based on label information

[0081] Screening target: retain clusters with specific labels, such as exchanges and wallets among opponents;

[0082] Screened counterparties: can identify counterparties that transact with a specific type of entity, suitable for sector-specific analysis;

[0083] 4) Partitioning based on cluster size:

[0084] Screening target: divide according to the number of trading pairs in the cluster, such as retaining the cluster with the most (favorable for selecting commonalities) or the least (favorable for selecting abnormalities);

[0085] Screened opponents: opponents who participate in a large number of trading pairs (common opponents) or a small number of trading pairs (abnormal opponents) can be identified;

[0086] 5) Filtering based on inter-cluster distance:

[0087] Screening target: clusters that are far away from other clusters. The distance can be the centroid distance between two clusters, the average distance between each node of the two clusters, the shortest distance, and the longest distance, etc.

[0088] Screened counterparties: independent or anomalous counterparties whose trading behaviors are significantly different from other clusters.

[0089] In this embodiment, the first transaction feature, the role feature, the first feature and the second feature may include the total amount, the total number of transactions, the average transaction amount and the average daily transaction amount, etc.

[0090] The above preset screening rules based on numerical features are difficult to cope with complex business scenarios. In order to expand opponents with specific values, the following rules can be added:

[0091] 1) Providing counterparties based on initial fees:

[0092] If the first transfer amount of address A is the handling fee, then the payer B of the handling fee is the counterparty providing the initial handling fee, and the focus is on the transaction pair (A, B);

[0093] 2) Counterparties based on amounts with special significance:

[0094] If the transaction amount between address A and address B contains special amounts such as "1314", "888", "520", then focus on the transaction pair (A, B);

[0095] 3) Counterparties that use a specific amount based on high frequency:

[0096] If a certain amount x frequently appears in transactions between address A and address B, then focus on the transaction pair (A, B).

[0097] Embodiment 3

[0098] Based on the above embodiment, in this embodiment, the method further includes:

[0099] The first eigenvector, the second eigenvector, and the third eigenvector are standardized, a training set is obtained based on the standardized first eigenvector and the labeled data set, and the second eigenmatrix and the second eigenmatrix are constructed based on the standardized second eigenvector and the third eigenvector, respectively. Eigenvector standardization unifies the feature scale and facilitates the construction of subsequent data.

[0100] The calculation method for normalizing the first eigenvector, the second eigenvector and the third eigenvector is:

[0101]

[0102] Among them, v′ ij represents the normalized feature vector, v ij represents the feature vector before normalization, σ and μ represent related parameters, n represents the number of trading pairs, x ij It represents the jth feature of the i-th sample, where i and j both represent serial numbers.

[0103] Embodiment 4

[0104] Based on the above embodiment, in this embodiment, the method further includes:

[0105] Acquire a new role, determine whether the new role is mutually exclusive with any of the mutually exclusive role groups, and if so, add the new role to the mutually exclusive role group to obtain a first new mutually exclusive role group, train a first classifier for each role in the first new mutually exclusive role group, obtain a first new classification model based on the first classifier, and update the classification model to the first new classification model;

[0106] Otherwise, add an anti-class role that is mutually exclusive with the new role, obtain a second new mutually exclusive role group based on the new role and the anti-class role, train a second classifier for each role in the second new mutually exclusive role group, obtain a second new classification model based on the second classifier, and update the classification model to the second new classification model.

[0107] Embodiment 5

[0108] Based on the above embodiment, in this embodiment, the method further includes:

[0109] A visualization canvas is constructed based on the transaction network. For example, the nodes of the transaction network are used as the addresses of the visualization canvas, and the transaction pairs are used as the connections of the visualization canvas. It can be understood that the transaction network has nodes A and B, then A and B are the addresses of the visualization canvas, and the transaction pair between nodes A and B is the connection between the addresses A and B in the visualization canvas. The time-driven architecture of the university is used to obtain the number of nodes of the canvas node in the visualization canvas and the node status of each canvas node, and the node status includes addition, deletion and update;

[0110] Based on the detection mechanism, the canvas node is detected to obtain a trigger node, node data of the trigger node is obtained, and the node data is analyzed to obtain a node analysis result, wherein the node data includes a connection node connected to the trigger node, a node relationship between the trigger node and the connection node, historical transaction data, and interactive opponents outside the visualization canvas.

[0111] In this embodiment, the detection mechanism may be based on a time interval, the number of network nodes, the number of newly added nodes, or user-defined conditions for detection, and may specifically be:

[0112] 1) Time interval: Set a timer to detect at fixed time intervals. This method ensures that changes in the canvas are evaluated regularly.

[0113] 2) Number of network nodes: When the number of nodes in the canvas reaches the set threshold, change detection is triggered. You can also set upper and lower limits. The lower limit avoids invalid analysis due to too few nodes, and the upper limit avoids too many nodes affecting the system load.

[0114] 3) Changes in the number of nodes: Whenever a new node is added to the canvas, the changed nodes are automatically checked and recorded for subsequent extended analysis;

[0115] 4) User-defined conditions: Users can set specific trigger conditions for canvas change detection according to their needs, such as setting detection when the number of network nodes increases by 10.

[0116] When a node change is detected, an incremental analysis is performed on the association between the changed node and the existing node. Only the changed node and its connection relationship (the transaction pair of the node) are analyzed instead of re-analyzing the entire network, which can reduce the repeated consumption of computing resources.

[0117] Embodiment 6

[0118] Based on the above embodiment, in this embodiment, the method further includes:

[0119] Acquire a first node outside the visualization canvas connected to the canvas node, obtain an extension node based on an extension rule and the first node, expand the visualization canvas based on the extension node to obtain a first canvas, and update the visualization canvas to the first canvas;

[0120] In this embodiment, the extension rule may be based on the topological relationship between addresses, and may specifically be:

[0121] 1) Common source or destination adversary: ​​If the address Y outside the canvas appears in the incoming or outgoing address of the k addresses in the canvas at the same time, then the Y address is marked as to be expanded, which can be expressed as:

[0122] if|{X i ∈Canvas|X i ∈N(Y)}|≥k,thenE add Y;

[0123] Among them, X i represents a canvas node, k represents an integer greater than or equal to 2, N(Y) represents the same-direction neighbors of address Y outside the canvas, and E represents the set to be expanded;

[0124] 2) Shorter path opponent: If the address Y outside the canvas connects the addresses A and B in the canvas and makes the path between them shorter, then the Y address is marked as to be expanded, which can be expressed as:

[0125] if d(A,Y)+d(Y,B) <d(A,B),then E add Y;

[0126] Where d() represents the path length between addresses;

[0127] 3) Loop opponent: If the address Y outside the canvas forms a loop with the node in the canvas, the Y address is marked as to be expanded, which can be expressed as:

[0128] If A→B→Y→A,then E add Y;

[0129] Among them, → means that a certain address can reach another address.

[0130] Calculating key elements of each node outside the visualization canvas and inside the visualization canvas to obtain key nodes, wherein the key elements include degree centrality, connection strength, and PageRank value;

[0131] Degree centrality: The number of direct connections (out-degree and in-degree) of a node reflects the activity of the node. The specific calculation method is:

[0132] C D (v) = k v ;

[0133] Among them, C D (v) represents the degree centrality of node v, v represents the node, k v represents the degree of node v;

[0134] Connection strength: The sum of the weights of all connections of a node, reflecting the influence of the node. The specific calculation method is:

[0135] S(v)=∑ u∈N(v) W vu ;

[0136] Where S(v) represents the connection strength of node v, u represents the nodes connected to node v, N(v) represents the set of nodes connected to node v, and W vu Represents the weight of the edge between node v and node u;

[0137] PageRank value: The PageRank value of a node reflects the high risk level of the node in the network. The specific calculation method can be:

[0138]

[0139] Among them, PR(v) represents the PageRank value of node v, d represents the damping factor, PR(u) represents the PageRank value of node u, C out (u) represents the out-degree of node u.

[0140] If the key node is located within the visualization canvas, the key node is marked; if the key node is located outside the visualization canvas, the visualization canvas is expanded based on the key node to obtain a second canvas, and the visualization canvas is updated to the second canvas.

[0141] In this embodiment, the node information of the key nodes and the extended nodes may be integrated to generate corresponding text prompts. The node information may include the node source, the reason for being marked and the importance, etc. The text prompts may include the address role and address extension, etc.

[0142] The file prompt may be displayed in the user interface, such as in a sidebar area of ​​the user interface, and the related nodes are displayed in a specific color to highlight the node and attract the user's attention.

[0143] The user clicks according to the prompt to view the opponent information in the analysis results expanded by each text prompt, thereby improving the interactive experience and the effectiveness of the information. For example, the user can click the "Assist" button to display the current analysis results, and each analysis result is a text prompt.

[0144] Users can also customize the priority of prompts, adjust the frequency and content of prompt display according to user needs, and provide feedback on the relevance and practicality of prompts to further enhance the user experience.

[0145] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0146] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. An analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in the canvas, characterized in that: The method comprises: Obtaining a known blockchain address and transaction data of the blockchain address, building a transaction network based on the blockchain address and the transaction data, and obtaining a first address of the transaction network; Constructing an identification rule, identifying the first address based on the identification rule to obtain a first role; dividing the first role based on a preset division rule to obtain a plurality of mutually exclusive role groups, obtaining a second role based on all the mutually exclusive role groups and the transaction network, and obtaining a labeled data set based on the second role; Preset a key feature of the first role, obtain an address feature of the first role based on the key feature, obtain a first feature vector of the first address based on the address feature, and obtain a training set based on the first feature vector and the annotated data set; Based on a preset kernel function and the training set, a multi-classification model is obtained, and the addresses to be classified are classified based on the multi-classification model to obtain the address roles of the addresses to be classified.

2. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 1, characterized in that: The specific steps to build a transaction network include: The maximum number of extension layers and the extension rules of the transaction network are preset, and the counterparty of the blockchain address is obtained based on the transaction data; based on the maximum number of extension layers, the extension rules and the counterparty, a directed counterparty network graph is constructed with the blockchain address as the starting point; the counterparty network graph is formatted to obtain the transaction network.

3. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 1, characterized in that: The specific steps to obtain several mutually exclusive role groups include: The first roles are divided based on the preset division rule to obtain a plurality of first groups, and an unknown role is added to each of the first groups to obtain all the mutually exclusive role groups.

4. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 1, characterized in that: The specific steps to obtain a multi-classification model include: Obtain each third role in each mutually exclusive role group; based on the training set, obtain the first transaction data of the third role to obtain a positive sample, and obtain the second transaction data of the third role other than the third role to obtain a negative sample; train a classifier for each third role based on the preset kernel function, the positive sample and the negative sample; The optimal parameters of each classifier are obtained, each classifier is optimized based on the optimal parameters to obtain an optimized classifier, and the multi-classification model is obtained based on all the optimized classifiers.

5. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 4 is characterized in that: The specific steps of obtaining the address role of the address to be classified include: Each of the optimized classifiers identifies the address to be classified to obtain a number of first prediction scores, obtains a first prediction result for each of the mutually exclusive role groups based on all of the first prediction scores, and integrates all of the first prediction results to obtain a predicted role classification; A confidence level is obtained based on all of the first prediction scores, and the address role is obtained based on a preset business rule, the confidence level and the prediction role classification.

6. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 4, characterized in that: The method further comprises: Acquire a new role, determine whether the new role is mutually exclusive with any of the mutually exclusive role groups, and if so, add the new role to the mutually exclusive role group to obtain a first new mutually exclusive role group, train a first classifier for each role in the first new mutually exclusive role group, obtain a first new classification model based on the first classifier, and update the classification model to the first new classification model; Otherwise, add an anti-class role that is mutually exclusive with the new role, obtain a second new mutually exclusive role group based on the new role and the anti-class role, train a second classifier for each role in the second new mutually exclusive role group, obtain a second new classification model based on the second classifier, and update the classification model to the second new classification model.

7. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 2, characterized in that: The method further comprises: Building a visualization canvas based on the transaction network, obtaining the number of canvas nodes in the visualization canvas and the node status of each canvas node, wherein the node status includes adding, deleting and updating; Based on the detection mechanism, the canvas node is detected to obtain a trigger node, node data of the trigger node is obtained, and the node data is analyzed to obtain a node analysis result, wherein the node data includes a connection node connected to the trigger node, a node relationship between the trigger node and the connection node, historical transaction data, and interactive opponents outside the visualization canvas.

8. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 7, characterized in that: The method further comprises: Acquire a first node outside the visualization canvas connected to the canvas node, obtain an extension node based on an extension rule and the first node, expand the visualization canvas based on the extension node to obtain a first canvas, and update the visualization canvas to the first canvas; Calculating key elements of each node outside the visualization canvas and inside the visualization canvas to obtain key nodes, wherein the key elements include degree centrality, connection strength, and PageRank value; If the key node is located within the visualization canvas, the key node is marked; if the key node is located outside the visualization canvas, the visualization canvas is expanded based on the key node to obtain a second canvas, and the visualization canvas is updated to the second canvas.

9. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 1, characterized in that: The method further comprises: Obtain a first ordered transaction pair of the first address based on the transaction data, aggregate the first ordered transaction pairs to obtain a first transaction pair, obtain a first transaction feature of the first transaction pair, and obtain a role feature of each role based on the first transaction feature; Based on the character features, a first feature of each of the first characters is obtained, the first features are concatenated to obtain a second feature vector, and a first feature matrix is ​​constructed based on the second feature vector; based on the first feature matrix, a DBSCAN model of each character is obtained; Obtain a second ordered transaction pair of the address to be identified, aggregate the second ordered transaction pair to obtain a second transaction pair, obtain a second feature of the second transaction pair based on the address role, concatenate the second features to obtain a third feature vector, and construct a second feature matrix based on the third feature vector; Based on the address roles and the second feature matrix, the DBSCAN model clusters the addresses to be identified to obtain a plurality of clusters; All the cluster pairs are screened based on preset screening rules to obtain abnormal transaction pairs.

10. The analysis method for intelligently discovering potential suspicious financial opponents based on visible address points in a canvas according to claim 9, characterized in that: The specific steps to obtain the DBSCAN model for each role include: Based on preset parameters, the eigenvectors in the first feature matrix are clustered to obtain several clustering results; each of the clustering results is evaluated to obtain an evaluation result, optimal parameters are obtained based on the evaluation results, and the DBSCAN model is obtained based on the optimal parameters and the first feature matrix.

Images