Ethereum phishing account detection method and system based on multi-dimensional comparative learning

Abstract

The invention discloses an Ethereum phishing account detection method and system based on multi-dimensional comparative learning, and mainly relates to the technical field of information security. Comprising the following steps: obtaining transaction addresses of a normal account and a phishing account and a transaction record of a transaction account; performing a time longitudinal data enhancement algorithm according to the transaction record of the transaction account; performing feature extraction on the transaction account from three dimensions of space, time sequence and transaction attribute; constructing an Ethereum transaction graph, and obtaining enhanced features of three dimensions of space, time sequence and transaction attribute; and carrying out feature fusion by adopting a multi-head attention mechanism, and detecting the fused feature embedding. The method has the beneficial effects that characteristics in the model can be fully extracted while the generalization ability and accuracy of the model are improved, and the explanatory property of the model is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an Ethereum phishing account detection method and system based on multi-dimensional comparative learning. Background Art

[0002] With the rapid development of blockchain technology, Ethereum, as a representative platform, provides users around the world with a wealth of smart contracts and cryptocurrency trading services. However, with the popularity of the Ethereum platform, phishing attacks are becoming increasingly rampant, becoming a major threat to user asset security. At present, the detection method for Ethereum phishing accounts is mainly based on reasoning, analysis, and detection based on the natural graph structure of the Ethereum transaction network. The existing methods have the following problems: 1. The imbalance of transaction data in phishing accounts will lead to deviation in model generalization ability and distortion of accuracy indicators; 2. Failure to perform data differentiation during feature embedding and over-reliance on embedding models such as graph convolutional networks result in insufficient feature extraction and insufficient model interpretability.

[0003] Therefore, there is an urgent need for an Ethereum phishing account detection method and system based on multi-dimensional comparative learning to solve the above problems. Summary of the invention

[0004] The purpose of the present invention is to provide an Ethereum phishing account detection method and system based on multi-dimensional contrastive learning, which can fully extract features in the model and improve the model interpretability while improving the generalization ability and accuracy of the model.

[0005] In order to achieve the above object, the present invention is implemented through the following technical solutions: On the one hand, the present invention provides an Ethereum phishing account detection method based on multi-dimensional comparative learning, comprising the following steps: Obtain the transaction addresses of normal accounts and phishing accounts based on the open source labeled dataset in GitHub, and crawl the transaction records of transaction accounts in the Ethereum browser; According to the transaction records of the trading accounts, a transaction quantity threshold is set, and for the transaction account data with a transaction quantity less than the threshold, a time-based data enhancement algorithm is performed based on the transaction cycle characteristics of the Ethereum phishing account; Extract features from trading accounts from three dimensions: space, time series, and transaction attributes; According to the characteristics of the transaction account, the Ethereum transaction graph is constructed, and comparative learning of the weighted sample group is performed based on the Siamese triplet model to obtain enhanced features in three dimensions: space, time series, and transaction attributes; A multi-head attention mechanism is used for feature fusion, and the fused feature embedding is tested.

[0006] Preferably, the transaction record of the transaction account includes: transaction time, sender, receiver and transaction amount information.

[0007] Preferably, the time-based data enhancement based on the transaction cycle characteristics of the Ethereum phishing account includes: The transaction records of each crawled account are equally divided into 10 time periods. Based on the collected transaction accounts, the proportion of account transactions in each time period is obtained. By calculating the ratio difference between the sample to be enhanced and the statistic, it is determined whether the sample is incomplete and whether data enhancement is needed in each time period. The adversarial generative model is used to generate simulated transaction data in these time periods. If a transaction data needs to be added in the second time period, the statistical data of the second time period is input into the adversarial generative model to construct new data.

[0008] Preferably, the feature extraction of the transaction account from three dimensions of space, time sequence and transaction attribute is specifically as follows: Extract features from trading accounts from the spatial dimension: convert the acquired phishing transaction records into a directed transaction graph according to the transaction direction, weight the edges of the network according to the transaction amount, number of transactions and transaction frequency, and input the weighted graph into the anti-generation model to obtain its feature embedding vector; Extract features of trading accounts from the time series dimension: Divide the account's transaction records into 10 time periods, input the transaction data of each time period into the bidirectional LSTM model, and obtain the time series features of the account's entire transaction life cycle; Extract features from trading accounts from the transaction attribute dimension: count the in-degree, out-degree, in-degree-out-degree ratio, input value, output value, input-value-to-output value ratio, average input value, average output value, minimum input value, minimum output value, maximum input value, and maximum output value of trading accounts.

[0009] Preferably, the construction of the Ethereum transaction graph is specifically as follows: constructing the graph according to the natural graph structure of the transaction network, the nodes in the graph represent transaction accounts, the edges represent transaction relationships, and the edges are weighted according to the transaction characteristics between the nodes.

[0010] Preferably, the comparative learning of the weighted sample group based on the Siamese triplet model includes: Construct positive and negative sample groups based on the transaction characteristics of the account, and calculate the distance between different samples; A threshold is set to distinguish similar samples from different samples, and enhanced features of three dimensional features are obtained through comparative learning:

[0011] in, Represents anchor point samples With positive samples The distance between Represents anchor point samples With negative samples The distance between is the set interval.

[0012] Preferably, it is characterized in that the use of a multi-head attention mechanism for feature fusion includes:

[0013] in, denote the query vector, key vector and value vector respectively, is a learnable weight matrix used to perform a linear transformation on the concatenated output. The calculation formula for each head is as follows:

[0014] in, , They are The query, key, and value transformation matrices of the head. Attention is the attention calculation function, using scaled dot product attention. The specific calculation formula is as follows:

[0015] in, is the dimension of the key vector, used to scale the dot product result, The function is used to normalize the dot product result to obtain the attention weight.

[0016] Preferably, the detection of the fused feature embedding is specifically as follows: A deep neural network is constructed to detect the fused feature embedding obtained by the multi-head attention mechanism and classify the detected samples as normal or malicious.

[0017] On the other hand, a ground fault line identification system is also provided, comprising: The grounding test line experience ranking module is used to: pre-generate a grounding line test ranking table and sort the test lines; The phase current dynamic comparison module is used to generate the maximum value of the fault phase current mutation according to the time when the fault phase current occurs; Ground fault line determination module: determines the ground fault line according to the maximum value of the fault phase current mutation.

[0018] On the other hand, a detection system based on the Ethereum phishing account detection method based on multi-dimensional contrastive learning is provided, comprising: The data acquisition module is used to obtain the transaction addresses of normal accounts and phishing accounts based on the open source labeled data set in GitHub, and crawl the transaction records of transaction accounts in the Ethereum browser Ethereum; The data processing module is used to: set a transaction quantity threshold according to the transaction records of the transaction account, and perform a time-vertical data enhancement algorithm based on the transaction cycle characteristics of the Ethereum phishing account for the transaction account data whose transaction quantity is less than the threshold; extract features of the transaction account from three dimensions: space, time sequence, and transaction attributes; construct an Ethereum transaction graph based on the characteristics of the transaction account, and perform comparative learning of the weighted sample group based on the Siamese triplet model to obtain enhanced features in three dimensions: space, time sequence, and transaction attributes; The feature detection module is used to: use the multi-head attention mechanism to fuse features and detect the fused feature embeddings.

[0019] Compared with the prior art, the beneficial effects of the present invention are: 1. Effectively solve the long-tail problem of transaction data: By designing a time-based data enhancement module, this technical solution can effectively enhance account data with too few transactions, solving the long-tail problem in Ethereum transaction data. This not only improves the quality and integrity of the data, but also provides a richer and more reliable data foundation for subsequent feature extraction and model training; 2. Accurately capture the characteristics of the phishing account attack cycle: This technical solution takes into account the characteristic differences of phishing accounts throughout the attack cycle. By equally dividing the time periods and applying the Generative Adversarial Network (GAN) model, it can simulate and supplement the missing transaction data, thereby more accurately reflecting the attack behavior of phishing accounts. This innovation makes the model more sensitive and accurate in detecting phishing accounts. 3. Effective extraction and fusion of multi-dimensional features: Through feature extraction in three dimensions, namely space, time series, and transaction attributes, this technical solution can fully capture the multi-dimensional features of trading accounts. At the same time, it uses a multi-head attention mechanism for feature fusion, so that features of different dimensions can complement each other and improve the representation ability of feature embedding. Compared with the traditional single-dimensional feature extraction method, this method has stronger feature expression ability and higher detection performance; 4. Constructing a weighted sample group for comparative learning: This technical solution conducts comparative learning of weighted sample groups based on the Siamese triplet model. By calculating the distance between different samples and setting a threshold, similar samples and different samples are distinguished. This method can further extract and enhance the differentiated information in the feature representation, and improve the model's ability to identify phishing accounts. 5. Improve model detection performance and generalization ability: Through the comprehensive application of the above innovations, this technical solution constructs a deep neural network model that can effectively detect the fused feature embedding obtained by the multi-head attention mechanism and classify the detected samples as normal or malicious. Compared with the existing technology, this model has higher accuracy, sensitivity and generalization ability when detecting Ethereum phishing accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a flow chart of the method of the present invention; Figure 2 It is the overall model structure diagram of the present invention; Figure 3 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0021] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the application equally.

[0022] In the present invention, terms such as "upper", "lower", "left", "right", "front", "back", "vertical", "horizontal", "side", "bottom", etc. indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings. They are relational words determined only for the convenience of describing the structural relationships of the various parts or elements of the present invention, and do not specifically refer to any part or element in the present invention and should not be understood as limitations on the present invention.

[0023] Example: The number of transactions in Ethereum trading accounts shows a long tail phenomenon, that is, there are few accounts with high transaction volume, but many accounts with low transaction volume. This phenomenon exists in both normal trading accounts and phishing accounts. Some current structure-based methods, such as random walks, GNN and other graph representation methods, need to extract potential structural features based on sufficiently rich transaction structures. Some work directly discards account data with too little trading volume, which is obviously very unreasonable. In addition, some work uses autoregression to supplement data. Through testing and analysis, it is found that each phishing attack account has a different attack cycle. Regression through high-level accounts will mix transactions in different periods together, which will cause the effect of autoregression to be insignificant. In order to solve this problem, based on the phishing attack transaction cycle, the attack time of different phishing accounts is set to the same scale, and the transaction occurrence of the entire cycle is calculated and divided into different time periods. Through the longitudinal transaction situation of the same time period, an adversarial generation model is designed, and the transactions in this time period are input to generate the corresponding simulated transaction data. For the overall account, a minimum transaction volume threshold is set. For accounts that do not meet the minimum threshold, the transaction volume difference between the account and the overall account is analyzed, and the time period with the least number is obtained. For example, the overall data has the largest transaction volume in the first time period, but the account with a small transaction volume has only one transaction in the first time period. The adversarial generation model is used to generate the data for this time period, and then the data is calculated and generated again after adding this data. Due to the complexity of Ethereum phishing transactions, some VAE generation using the overall time series performed poorly, so we chose to switch from horizontal cycles to vertical time.

[0024] In addition to the difference in the number of transactions in Ethereum accounts, the characteristics of the entire attack cycle of phishing accounts are very different. Previous work has pointed out that phishing account nodes have more incoming transactions in the early and middle stages, and more outgoing transactions in the later stages. Although many accounts follow this rule, there are also many accounts that have very even in-and-out transactions throughout the cycle because they directly transfer out after receiving the in-transfer amount. Some accounts will transfer out large amounts, but some accounts will transfer out small amounts multiple times. Such differentiated transactions will cause the loss of differentiated high-dimensional features in conventional graph representation. In order to solve this problem, a multimodal triplet siamese model is designed during feature extraction. Feature extraction is performed from three dimensions: space, time series, and attributes. Taking space as an example, the distance between the sample to be detected and the positive and negative samples is calculated respectively to extract unique features. However, in order to calculate the distance between differentiated samples, positive and negative samples are processed in advance, the distance between different samples is calculated and a threshold is set. Samples less than this threshold are identified as similar samples and merged, and samples greater than the threshold are retained. Finally, a sample group with different transaction patterns can be obtained. The sample to be tested is compared with the positive and negative sample groups to obtain the feature embedding of the spatial module. After obtaining the embedding of the three modules, a multi-head attention mechanism is added to perform feature fusion to enhance the representation ability of feature embedding.

[0025] like Figure 1 As shown, this embodiment provides an Ethereum phishing account detection method based on multi-dimensional comparative learning, comprising the following steps: Obtain the transaction addresses of normal accounts and phishing accounts based on the open source labeled dataset in GitHub, and crawl the transaction records of transaction accounts in the Ethereum browser; According to the transaction records of the trading accounts, a transaction quantity threshold is set, and for the transaction account data with a transaction quantity less than the threshold, a time-longitudinal data enhancement algorithm is performed based on the transaction cycle characteristics of the Ethereum phishing account; Extract features from trading accounts from three dimensions: space, time series, and transaction attributes; According to the characteristics of the transaction account, the Ethereum transaction graph is constructed, and comparative learning of the weighted sample group is performed based on the Siamese triplet model to obtain enhanced features in three dimensions: space, time series, and transaction attributes; A multi-head attention mechanism is used for feature fusion, and the fused feature embedding is tested.

[0026] Among them, the transaction records of the trading account include: transaction time, sender, receiver and transaction amount information.

[0027] The specific model is built as follows Figure 2 shown.

[0028] For account data with too few transactions, a time-based data enhancement module is implemented based on the transaction cycle characteristics of Ethereum phishing accounts to solve the long-tail problem of Ethereum transaction data: First, the transaction records of each account are equally divided into 10 time periods. Based on the transaction accounts collected in the early stage, the proportion of account transactions in each time period is obtained. By calculating the ratio difference between the sample to be enhanced and the statistic, it is determined whether the sample is incomplete and whether data enhancement is needed in each time period. Then, a generative adversarial model (GAN) is used to generate simulated transaction data within these time periods. For example, if additional transaction data needs to be added in the second time period, some statistical data of the second time period is input into the GAN to construct new data.

[0029] In order to extract the multi-dimensional features of trading accounts, feature extraction is performed from three dimensions: space, time series, and transaction attributes: In the spatial dimension, the acquired phishing transaction records are converted into a directed transaction graph according to the transaction direction, and the edges of the network are weighted according to the transaction amount, number of transactions, transaction frequency, etc., and then the weighted graph is input into the GCN to obtain its feature embedding vector; In the time dimension, the account's transaction records are divided into 10 time periods, and the transaction data of each time period is input into the bidirectional LSTM model to obtain the time series characteristics of the account's entire transaction life cycle; In the transaction attribute dimension, statistics are collected on the transaction account's in-degree, out-degree, in-degree-out-degree ratio, in-value, out-value, in-value-out-value ratio, average in-value, average out-value, minimum in-value, minimum out-value, maximum in-value, and maximum out-value. By extracting features from these three dimensions, a more comprehensive and accurate account feature representation can be obtained.

[0030] After obtaining the transaction data, construct the Ethereum transaction graph: First, we construct a graph according to the natural graph structure of the transaction network. The nodes in the graph represent transaction accounts, and the edges represent transaction relationships. The edges are weighted according to the transaction characteristics between the nodes. In order to more comprehensively represent the interactions between accounts, we introduce multiple types of edges, such as direct transactions, indirect transactions, and similar transaction patterns. However, in order to obtain representative data samples in sample comparison learning, we perform multi-dimensional data embedding and similarity comparison on the acquired data sets to obtain more representative metadata.

[0031] In order to further improve the representation ability of feature embedding, comparative learning of weighted sample groups is performed based on the Siamese triplet model: Construct positive and negative sample groups based on the transaction characteristics of the account, and calculate the distance between different samples; A threshold is set to distinguish similar samples from different samples, and enhanced features of three-dimensional features are obtained through comparative learning. The formula is as follows:

[0032] in, Represents anchor point samples With positive samples The distance between Represents anchor point samples With negative samples The distance between For a set interval, the loss function is used to minimize the distance between the anchor point and the positive sample, while maximizing the distance between the anchor point and the negative sample, and maintaining a certain interval.

[0033] After obtaining the feature embedding of the three modules, a multi-head attention mechanism is used for feature fusion: The multi-head attention mechanism can focus on the importance of different features at the same time, and perform weighted summation according to their weights to obtain a more representative feature representation. Through feature fusion, the features of the three dimensions of space, time series, and attributes can be effectively combined to improve the detection performance of the model. The specific formula is as follows:

[0034] in They represent query vector (query), key vector (key) and value vector (value), respectively. is a learnable weight matrix used to perform a linear transformation on the concatenated output. The calculation formula for each head is as follows:

[0035] in , , They are The query, key, and value transformation matrix of each head, is the attention calculation function, using scaled dot product attention. The specific calculation formula is as follows:

[0036] is the dimension of the key vector, used to scale the dot product result to avoid scores that are too large or too small, The function is used to normalize the dot product result to obtain the attention weight.

[0037] A deep neural network is constructed to detect the fused feature embedding obtained by the multi-head attention mechanism and classify the detected samples as normal or malicious.

[0038] In order to discover Ethereum phishing accounts as early as possible and minimize financial losses, early detection is performed on accounts with short transaction history cycles and fewer transaction records. Specifically: A timestamp-based random walk of early transactions is performed on the meta-sample set in the knowledge base to obtain the early transaction behavior patterns of normal accounts and phishing accounts. The topological transaction subgraph obtained by the random walk is detected through the multi-dimensional Siamese triplet model constructed in the early stage.

[0039] like Figure 3 As shown, this embodiment also provides a detection system based on the above-mentioned Ethereum phishing account detection method based on multi-dimensional comparative learning, including: The data acquisition module is used to obtain the transaction addresses of normal accounts and phishing accounts based on the open source labeled data set in GitHub, and crawl the transaction records of transaction accounts in the Ethereum browser Ethereum; The data processing module is used to: set a transaction quantity threshold according to the transaction records of the transaction account, and perform a time-vertical data enhancement algorithm based on the transaction cycle characteristics of the Ethereum phishing account for the transaction account data whose transaction quantity is less than the threshold; extract features of the transaction account from three dimensions: space, time sequence, and transaction attributes; construct an Ethereum transaction graph based on the characteristics of the transaction account, and perform comparative learning of the weighted sample group based on the Siamese triplet model to obtain enhanced features in three dimensions: space, time sequence, and transaction attributes; The feature detection module is used to: use the multi-head attention mechanism to fuse features and detect the fused feature embeddings.

[0040] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the described embodiments. Technicians in the field of transaction features between nodes can also make various equivalent deformations or substitutions without violating the spirit of the present invention. These equivalent deformations or substitutions are all included in the scope defined by the claims of this application.

Claims

1. An Ethereum phishing account detection method based on multi-dimensional contrastive learning, characterized in that: The following steps are involved: Obtain the transaction addresses of normal accounts and phishing accounts based on the open source labeled dataset in GitHub, and crawl the transaction records of transaction accounts in the Ethereum browser; According to the transaction records of the trading accounts, a transaction quantity threshold is set, and for the transaction account data with a transaction quantity less than the threshold, a time-based data enhancement algorithm is performed based on the transaction cycle characteristics of the Ethereum phishing account; Extract features from trading accounts from three dimensions: space, time series, and transaction attributes; According to the characteristics of the transaction account, the Ethereum transaction graph is constructed, and comparative learning of the weighted sample group is performed based on the Siamese triplet model to obtain enhanced features in three dimensions: space, time series, and transaction attributes; A multi-head attention mechanism is used for feature fusion, and the fused feature embedding is tested.

2. The Ethereum phishing account detection method based on multi-dimensional contrastive learning according to claim 1 is characterized in that: The transaction record of the transaction account includes: transaction time, sender, receiver and transaction amount information.

3. The Ethereum phishing account detection method based on multi-dimensional contrastive learning according to claim 1 is characterized in that: The time-based data enhancement based on the transaction cycle characteristics of the Ethereum phishing account includes: The transaction records of each crawled account are equally divided into 10 time periods. Based on the collected transaction accounts, the proportion of account transactions in each time period is obtained. By calculating the ratio difference between the sample to be enhanced and the statistic, it is determined whether the sample is incomplete and whether data enhancement is needed in each time period. The adversarial generative model is used to generate simulated transaction data in these time periods. If a transaction data needs to be added in the second time period, the statistical data of the second time period is input into the adversarial generative model to construct new data.

4. The Ethereum phishing account detection method based on multi-dimensional contrastive learning according to claim 1 is characterized in that: The feature extraction of transaction accounts from three dimensions of space, time series and transaction attributes is specifically as follows: Extract features from trading accounts from the spatial dimension: convert the acquired phishing transaction records into a directed transaction graph according to the transaction direction, weight the edges of the network according to the transaction amount, number of transactions and transaction frequency, and input the weighted graph into the anti-generation model to obtain its feature embedding vector; Extract features of trading accounts from the time series dimension: Divide the account's transaction records into 10 time periods, input the transaction data of each time period into the bidirectional LSTM model, and obtain the time series features of the account's entire transaction life cycle; Feature extraction of trading accounts from the transaction attribute dimension: statistics of the trading accounts' in-degree, out-degree, in-degree-out-degree ratio, in-value, out-value, in-value-out-value ratio, average in-value, average out-value, minimum in-value, minimum out-value, maximum in-value, and maximum out-value.

5. The Ethereum phishing account detection method based on multi-dimensional contrastive learning according to claim 4 is characterized in that: The Ethereum transaction graph is constructed as follows: the graph is constructed according to the natural graph structure of the transaction network, the nodes in the graph represent transaction accounts, the edges represent transaction relationships, and the edges are weighted according to the transaction characteristics between the nodes.

6. The Ethereum phishing account detection method based on multi-dimensional contrastive learning according to claim 5 is characterized in that: The comparative learning of the weighted sample group based on the Siamese triplet model includes: Construct positive and negative sample groups based on the transaction characteristics of the account, and calculate the distance between different samples; A threshold is set to distinguish similar samples from different samples, and enhanced features of three dimensional features are obtained through comparative learning: in, Represents anchor point samples With positive samples The distance between Represents anchor point samples With negative samples The distance between is the set interval.

7. The Ethereum phishing account detection method based on multi-dimensional contrastive learning according to claim 6 is characterized in that: The multi-head attention mechanism is used for feature fusion, including: in, denote the query vector, key vector and value vector respectively, is a learnable weight matrix used to perform a linear transformation on the concatenated output. The calculation formula for each head is as follows: in, , They are The query, key, and value transformation matrices of the head. Attention is the attention calculation function, using scaled dot product attention. The specific calculation formula is as follows: in, is the dimension of the key vector, used to scale the dot product result, The function is used to normalize the dot product result to obtain the attention weight.

8. The Ethereum phishing account detection method based on multi-dimensional contrastive learning according to claim 7 is characterized in that: The detection of the fused feature embedding is specifically as follows: A deep neural network is constructed to detect the fused feature embedding obtained by the multi-head attention mechanism and classify the detected samples as normal or malicious.

9. A detection system based on the Ethereum phishing account detection method based on multi-dimensional contrastive learning as claimed in claim 1, characterized in that: include: The data acquisition module is used to obtain the transaction addresses of normal accounts and phishing accounts based on the open source labeled data set in GitHub, and crawl the transaction records of transaction accounts in the Ethereum browser Ethereum; The data processing module is used to: set a transaction quantity threshold according to the transaction records of the transaction account, and perform a time-vertical data enhancement algorithm based on the transaction cycle characteristics of the Ethereum phishing account for the transaction account data whose transaction quantity is less than the threshold; extract features of the transaction account from three dimensions: space, time sequence, and transaction attributes; construct an Ethereum transaction graph based on the characteristics of the transaction account, and perform comparative learning of the weighted sample group based on the Siamese triplet model to obtain enhanced features in three dimensions: space, time sequence, and transaction attributes; The feature detection module is used to: use the multi-head attention mechanism to fuse features and detect the fused feature embeddings.

Images