Intelligent case research and judgment platform and method

Abstract

The invention belongs to the technical field of data analysis, and discloses an intelligent case research and judgment platform and method. The intelligent case research and judgment platform comprises a case management module used for creating a case according to collection clues, setting a case type and then determining a scenarized case analysis model according to the case type; analyzing the case in combination with virtual currency transaction data stored on the block chain, and then storing an analysis result to a case database; the scenarized case analysis model library is used for storing a plurality of scenarized case analysis models associated with case types; each scene case analysis model comprises a plurality of analysis stage modules which are carried out in sequence, each analysis stage module comprises more than one analysis target, and each analysis target is associated with an analysis unit; and the analysis unit is used for analyzing the input data of the analysis stage module associated with the analysis unit. According to the invention, the scene case analysis model is constructed for different case-related scenes, so that case handling personnel can be assisted to analyze cases in different scenes.

Description

Technical Field

[0001] The present invention belongs to the technical field of data analysis, relates to the analysis of virtual currency legal cases, and relates to an intelligent case analysis platform and method applicable to virtual currency legal cases. Background Art

[0002] The rapid development of virtual currency crime cases has brought great difficulties and challenges to case analysis. In the face of emerging virtual currency crimes, traditional analysis methods that rely on tools are stretched. At present, the analysis of virtual currency crimes mainly relies on multi-dimensional virtual currency capital chain analysis tools such as address analysis, capital analysis, and cross-chain currency exchange analysis based on blockchain technology. However, each tool has a high degree of professionalism, which brings certain challenges to regulators or law enforcement officers who are not from blockchain technology to analyze virtual currency crimes.

[0003] At the same time, when analyzing virtual currency cases in different scenarios, case analysts often lack regularity in the case analysis process and the use of tools due to personal subjectivity and case handling experience, and the accuracy and effectiveness of the analysis conclusions obtained are difficult to guarantee.

[0004] The case-assisted judgment service system based on artificial intelligence can automatically extract, manage and analyze the key information of the case to improve the efficiency and effect of case analysis. Therefore, the development of an intelligent judgment platform for virtual currency cases is of great significance for assisting regulators or law enforcement personnel in analyzing virtual currency cases. Summary of the invention

[0005] The purpose of the present invention is to solve the above-mentioned problems existing in the prior art and to provide an intelligent case analysis platform that can conduct step-by-step case analysis in combination with different scenarios and stages, thereby improving the analysis efficiency and analysis effect of case analysis while realizing scenario-based case analysis.

[0006] The case intelligent analysis platform provided by the present invention includes:

[0007] The case management module is used to create cases based on collected clues, set case types, and then determine scenario-based case analysis models based on case types; then analyze the cases through the determined scenario-based case analysis models combined with the virtual currency transaction data stored on the blockchain, and then store the analysis results in the case database;

[0008] A scenario-based case analysis model library, used to store a number of scenario-based case analysis models associated with case types; each scenario-based case analysis model includes a number of analysis phase modules that are performed in sequence, each analysis phase module includes more than one analysis target, and each analysis target is associated with an analysis unit;

[0009] An analysis unit library, used to store a plurality of analysis units, wherein the analysis units are used to analyze input data of analysis phase modules associated therewith according to analysis objectives;

[0010] The case database is used to store analysis results associated with the case.

[0011] In one implementation, the case management module calls the corresponding scenario-based case analysis model in the scenario-based case analysis model library and performs analysis in combination with the virtual currency transaction data stored on the blockchain.

[0012] In one implementation, the case intelligent analysis platform also includes an analysis phase module library and an analysis target library; the analysis phase module library is used to store a number of analysis phase modules; the analysis target library is used to store one or more analysis targets associated with each analysis phase module; each analysis target is associated with an analysis unit. At this time, according to the case type, the case management module selects two or more analysis phase modules to be performed in sequence from the analysis phase module library according to the needs, and retrieves one or more analysis targets from the analysis target library to associate with the analysis phase modules, each analysis target is associated with an analysis unit, and generates a custom scenario-based case analysis model. The generated custom scenario-based case analysis model can also be stored in the scenario-based case analysis model library. In the scenario-based case analysis model library, the number of scenario-based case analysis models associated with any case type is more than one.

[0013] In one implementation, the case type is selected from virtual currency fraud cases, virtual currency pyramid scheme cases, virtual currency online gambling cases, virtual currency theft cases, or virtual currency money laundering cases.

[0014] In one implementation, the scenario-based case analysis model library includes virtual currency fraud analysis model, virtual currency pyramid scheme analysis model, virtual currency online gambling analysis model, virtual currency theft analysis model, and virtual currency money laundering analysis model, etc. Each scenario-based case analysis model includes two or more analysis phase modules that are performed in sequence, and the analysis phase modules are selected from the case clue collection and confirmation phase module, the case address preliminary analysis phase module, the case address analysis expansion phase module, the key address handling fee tracing phase module, the case address evidence collection target management phase module, or the evidence collection data association analysis phase module, etc.

[0015] In one implementation, the analysis phase module library includes a module for collecting and confirming clues involved in the case, a module for preliminary analyzing addresses involved in the case, a module for expanding the analysis of addresses involved in the case, a module for tracing the handling fees for key addresses, a module for managing the target phase for tracing evidence of addresses involved in the case, and a module for correlation analysis of tracing data.

[0016] In one implementation, the analysis target library includes analysis targets such as address confirmation, transaction hash value confirmation, address user analysis, address role analysis, transaction feature analysis, expansion of funds analysis of addresses involved in the case, determination of the amount of funds involved in the case, tracing the source of key address fees, generating clues for investigation related to the subject's funds, generating clues for investigation related to the source of fees, investigation data analysis, and investigation data association analysis.

[0017] In one implementation, the analysis objectives associated with the case clue collection and confirmation phase module include address confirmation and / or transaction hash value confirmation; the analysis objectives associated with the case address preliminary analysis phase module include address user analysis, address role analysis, and / or transaction feature analysis, the address user analysis analysis objective is to determine the address ownership (i.e., to whom the address belongs), the address role analysis analysis objective is to determine the role to which the address belongs (i.e., the role the address plays in the case), the transaction features include transaction time and / or transaction amount, and the transaction feature analysis objective is to find out the transaction pattern; the analysis objectives associated with the case address analysis expansion phase module include the case address funds analysis expansion, and / or determination of the case address funds volume, the case address funds analysis analysis objective is to determine the transaction pattern; The analysis target of the extended analysis is to restore the capital chain involved in the case and locate the key addresses involved in the case. The analysis target of determining the volume of funds involved in the case is to obtain the flow of key addresses. The analysis target associated with the key address fee tracing stage module includes key address fee tracing. The analysis target associated with the address verification target management stage module includes generating principal funds-related verification clues and / or generating fee source-related verification clues. The analysis target associated with the verification data association analysis stage module includes verification data analysis and / or verification data association analysis. The verification data analysis is to analyze the verification reply data to obtain the information of the persons involved in the case. The verification data association analysis is to analyze the verification reply data in combination with the virtual currency transaction data on the blockchain to achieve continuous tracking of funds.

[0018] In one implementation, the analysis unit library mainly includes a browser, a single-address analysis unit, a multi-address analysis unit, a call letter generation unit, a verification analysis unit, and a transaction institution penetration unit; it also includes an address mining unit, an address monitoring unit, etc.

[0019] The analysis units associated with the address confirmation analysis target, the transaction hash value confirmation analysis target, and the determination of the amount of funds involved in the case analysis target are all browsers; the analysis unit associated with the address user judgment analysis target is a single-address judgment unit; the analysis unit associated with the address role judgment analysis target, the transaction feature judgment analysis target, and the key address fee tracing analysis target is a multi-address judgment unit; the analysis unit associated with the extended analysis target of the address funds involved in the case is a single-address judgment sub-unit or a multi-address judgment unit; the analysis unit associated with the analysis target of generating subject funds-related evidence investigation clues and the analysis target of generating fee source-related evidence investigation clues is a generation letter unit; the analysis unit associated with the evidence investigation data analysis target is the evidence investigation analysis unit; the analysis unit associated with the evidence investigation data association analysis target is the transaction institution penetration unit.

[0020] The browser is used to search for virtual currency transaction data based on the input query address or / and transaction hash value, obtain the blockchain and transaction data associated with the query address, and then add the query address and the blockchain and transaction data associated with it to the analysis object. The blockchain associated with the query address can be multiple funding links of the same currency or / and funding links of different currencies.

[0021] The single address analysis unit is used to analyze a single address involved in the case and the blockchain and transaction data associated with it, and determine the ownership of the address involved in the case in combination with the case type. The single address analysis unit also analyzes the address involved in the case and the blockchain associated with it according to the specified direction of capital flow (such as capital inflow or capital outflow), fully tracks and traces the funds, restores the capital chain involved in the case, obtains the corresponding virtual currency address topology map, locates the adjustable transaction institution and multiple key addresses involved in the case, and the multiple key addresses involved in the case can be further added to the analysis object.

[0022] The multi-address judgment unit is used to judge the role of the address involved in the case by combining the transaction amount and transaction time characteristics in the transaction data of the address involved in the case with the single or multiple addresses involved in the case and the blockchain associated therewith. It can also find out the transaction rules by combining the transaction amount and transaction time characteristics of the address involved in the case; then further expand the clues of the address involved in the case from the transaction data of the blockchain based on the address involved in the case and the transaction rules, and add these addresses involved in the case to the analysis object. The multi-address judgment unit also analyzes the inflow and outflow of funds based on the single or multiple addresses involved in the case and the blockchain associated therewith, completely tracks and traces the funds, restores the funds involved in the case, obtains the corresponding virtual currency address topology map, locates the adjustable transaction institution and the key address involved in the case, and locates the multiple key addresses involved in the case, which can be further added to the analysis object. Further trace the handling fee of the key address involved in the case to determine the address boundary; take the handling fee payment address as the final analysis object, and take the counterparty of the handling fee payment address (that is, the address in the blockchain that has transactions with the handling fee payment address) as the address boundary.

[0023] The transfer letter generating unit is used to find the evidence transfer clues, generate the transfer letter, and send it to the corresponding transaction institution based on the analysis results obtained from each analysis target in the case-involved address analysis expansion phase and / or the analysis results obtained from the analysis target in the key address handling fee tracing phase.

[0024] The evidence collection and analysis unit is used to group the persons and behaviors involved in the case based on the evidence collection data fed back by the trading institutions, and can also further analyze the common behavioral characteristics among multiple persons involved in the case.

[0025] The transaction institution penetration unit is used to continuously track and analyze funds based on the verification data fed back by the transaction institution and combined with the virtual currency transaction data on the blockchain.

[0026] The address mining unit is used to mine the incomplete query address received by the browser and then complete the address.

[0027] The monitoring unit is used to monitor the virtual currency address determined as the deposit address by the multi-address analysis unit. When funds are transferred out of the address, it can be sent to the object associated with the case via email.

[0028] The above-mentioned case management module performs analysis based on the analysis objectives of each stage module of the scenario-based case analysis model, and the analysis results are saved in the case database in the form of a list or a graph. The generated list or graph is associated with the corresponding analysis objective.

[0029] The present invention also provides a case intelligent judgment method, which is performed using the above-mentioned case intelligent judgment platform according to the following steps:

[0030] The S1 case management module creates cases based on collected clues, sets case types, and then determines scenario-based case analysis models based on case types;

[0031] S2 determines whether the scenario-based case analysis model determined in step S1 exists in the scenario-based case analysis model library; if so, retrieves the corresponding scenario-based case analysis model and then proceeds to step S3; if not, proceeds to step S4;

[0032] S3 combines the virtual currency transaction data stored on the blockchain, completes the analysis objectives in each analysis phase module in sequence according to the sequence of several analysis phase modules set in the scenario-based case analysis model, and stores the analysis results in the case database;

[0033] S4 generates a custom scenario-based case analysis model and performs analysis; specifically, it includes the following steps:

[0034] S41 Case Management Module selects an analysis phase module from the analysis phase module library;

[0035] S42 retrieves one or more analysis targets associated with the analysis phase module from the analysis target library;

[0036] S43 combines the virtual currency transaction data stored on the blockchain, performs analysis through an analysis unit associated with the analysis target, and stores the analysis result in a case database;

[0037] The above steps S41-S43 are repeated until the case management module selects all required analysis phase modules from the analysis phase module library.

[0038] Compared with the existing technical solutions, the case intelligent analysis platform and method provided by the present invention have the following beneficial effects:

[0039] 1) The present invention constructs a scenario-based case analysis model for different case scenarios, thereby assisting case handlers in analyzing cases in different scenarios;

[0040] 2) The present invention divides the complex virtual currency case analysis into different stages. For case analysts, especially those who are new to virtual currency case analysis, they can complete virtual currency case analysis of different scenario types based on various scenario case analysis models in the scenario case analysis model library, which not only simplifies the process and lowers the threshold, but also improves the case analysis efficiency and analysis effect;

[0041] 3) The construction of the case intelligent analysis platform of the present invention makes the analysis of virtual currency cases more intelligent, efficient, and collaborative, and can promote the innovation and development of virtual currency case analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a schematic diagram of the intelligent case analysis platform;

[0043] Figure 2 This is the principle block diagram of the case intelligent analysis platform;

[0044] Figure 3 A schematic diagram of the composition of the analysis unit library;

[0045] Figure 4 This is a schematic diagram of the module composition of the clue collection and confirmation stage involved in the case;

[0046] Figure 5 This is a schematic diagram of the module composition in the preliminary analysis phase of the address involved in the case;

[0047] Figure 6 This is a schematic diagram of the module composition of the extended phase of address analysis involved in the case;

[0048] Figure 7 This is a schematic diagram of the module composition of the key address fee tracing stage;

[0049] Figure 8 This is a schematic diagram of the module composition of the target management phase of address evidence collection involved in the case;

[0050] Fig. 9 This is a schematic diagram of the module composition of the evidence data association analysis stage;

[0051] Fig.10 Confirm the results for clues obtained through the browser;

[0052] Fig.11 It is the clue expansion result obtained by the multi-address analysis unit during the transaction feature analysis process of the module of the preliminary analysis phase of the address involved in the case;

[0053] Fig.12 This is the virtual currency address topology map obtained by the multi-address analysis unit during the extended analysis of the funds analysis of the involved addresses in the extended phase module of the involved address analysis. DETAILED DESCRIPTION

[0054] The specific implementation modes of the present invention are described below to facilitate those skilled in the art to understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0055] Example 1

[0056] like Figure 1As shown, this embodiment provides a case intelligent analysis platform, which includes a case management module, a scenario-based case analysis model library, an analysis unit library and a case database.

[0057] 1. Case management module

[0058] like Figure 2 As shown, the case management module is used to create cases based on collected clues, set case types, and then determine a scenario-based case analysis model based on the case type; then, through the determined scenario-based case analysis model, combined with the virtual currency transaction data stored on the blockchain, the case is analyzed, and the analysis results are stored in the case database.

[0059] The case type is selected from virtual currency fraud cases, virtual currency pyramid scheme cases, virtual currency online gambling cases, virtual currency theft cases or virtual currency money laundering cases, etc. The scenario-based case analysis model is the corresponding virtual currency fraud analysis model, virtual currency pyramid scheme analysis model, virtual currency online gambling analysis model, virtual currency theft analysis model or virtual currency money laundering analysis model, etc.

[0060] 2. Analysis unit library

[0061] The analysis unit library is used to store several analysis units. Figure 3 As shown, the analysis unit library mainly includes a browser, a single-address analysis unit, a multi-address analysis unit, a call letter generation unit, a verification analysis unit, and a transaction institution penetration unit; it can also include an address mining unit, an address monitoring unit, etc.

[0062] The browser is used to search for virtual currency transaction data based on the input query address or / and transaction hash value, and obtain the blockchain and transaction data associated with the query address; then the query address and the blockchain and transaction data associated with it are added to the analysis object. The blockchain associated with the query address can be multiple funding links of the same currency or / and funding links of different currencies.

[0063] The single-address analysis unit is used to analyze a single address involved in the case and the blockchain and transaction data associated with it, and determine the ownership of the address involved in the case in combination with the case type. The single-address analysis unit also analyzes the address involved in the case and the blockchain associated with it according to the specified direction of capital flow (such as capital inflow or capital outflow), fully tracks and traces the funds, restores the capital link involved in the case, obtains the corresponding virtual currency address topology map, locates the adjustable certificate transaction institution and multiple key addresses involved in the case, and the multiple key addresses involved in the case can be further added to the analysis object. The specific implementation method of the single-address analysis unit can refer to the address analysis method given in the "A Virtual Currency Address Analysis Method and System" disclosed in patent application CN202311809030.2.

[0064] The multi-address judgment unit is used to judge the role of the address involved in the case by combining the transaction amount and transaction time characteristics in the transaction data of the address involved in the case with the single or multiple addresses involved in the case and the blockchain associated therewith. The address roles include deposit address, collection address, withdrawal address, stolen goods disposal address, and sedimentation address. It is also possible to find out the transaction rules by combining the transaction amount and transaction time characteristics of the address involved in the case; then, based on the address involved in the case and the transaction rules, further expand the clues of the address involved in the case from the transaction data of the blockchain, and add these addresses involved in the case to the analysis object. The multi-address judgment unit also analyzes the inflow and outflow of funds based on the single or multiple addresses involved in the case and the blockchain associated therewith, completely tracks and traces the funds, restores the funds chain involved in the case, obtains the corresponding virtual currency address topology map, locates the adjustable transaction institutions and key addresses involved in the case, and locates the multiple key addresses involved in the case, which can be further added to the analysis object. Further trace the handling fees of the key addresses involved in the case and determine the address boundaries; take the handling fee payment address as the final analysis object, and take the counterparty of the handling fee payment address (that is, the address in the blockchain that has transactions with the handling fee payment address) as the address boundary. The specific implementation of the multi-address analysis unit can refer to the address analysis method given in the "A virtual currency address analysis method and system" disclosed in patent application CN202311809030.2.

[0065] The unit for generating a letter of inquiry is used to find clues for inquiry based on the analysis results obtained from each analysis target in the expansion phase of the address analysis involved or / and the analysis results obtained from the analysis target in the key address handling fee tracing phase, generate a letter of inquiry, and send it to the corresponding trading institution. The specific implementation method for cleaning the dispatch return data fed back by the trading institution can refer to the method for cleaning the inquiry data given in the "A method for cleaning the inquiry of cryptocurrency" disclosed in the patent application CN202311703539.9.

[0066] The evidence collection and analysis unit is used to group the persons and behaviors involved in the case based on the evidence collection data fed back by the trading institutions, and can also further analyze the common behavioral characteristics among multiple persons involved in the case.

[0067] The transaction institution penetration unit is used to continuously track and analyze funds based on the verification data fed back by the transaction institution and combined with the virtual currency transaction data on the blockchain.

[0068] The address mining unit is used to mine the incomplete query address received by the browser, and then complete the address. The specific implementation method of completing the address can refer to the address completion method given in the "A Cryptocurrency Clue Mining Method" disclosed in the patent application CN202410814692.7.

[0069] The monitoring unit is used to monitor the virtual currency address determined as the deposit address by the multi-address analysis unit. When funds are transferred out of the address, it can be sent to the object associated with the case via email.

[0070] 3. Scenario-based case analysis model library

[0071] The scenario-based case analysis model library is used to store several scenario-based case analysis models associated with case types.

[0072] like Figure 2 As shown, the scenario-based case analysis model library includes virtual currency fraud analysis model, virtual currency pyramid scheme analysis model, virtual currency online gambling analysis model, virtual currency theft analysis model and virtual currency money laundering analysis model, etc.

[0073] Virtual currency fraud analysis model: Applicable to virtual currency fraud scenarios.

[0074] Virtual currency pyramid scheme analysis model: Applicable to virtual currency pyramid scheme scenarios, which generally have a hierarchical relationship, as well as virtual currency crime scenarios with different counter-points according to the hierarchy.

[0075] Virtual currency online gambling analysis model: Applicable to the scenario where traditional online gambling platforms use virtual currency as a settlement tool.

[0076] Virtual currency theft analysis model: Applicable to virtual currency theft scenarios. The most important thing is to confirm the actual flow of stolen assets on the link. On the link, many thieves tend to split large amounts of funds into small amounts and transfer them through multiple layers. Therefore, there may be a large number of addresses that are only used as channels. When writing off funds, virtual currency thieves are generally individuals and do not have many channels for writing off accounts. They are more inclined to consider using trading institutions or blockchain technology (cross-chain and coin mixers) to deal with stolen money.

[0077] Virtual currency money laundering analysis model: Applicable to scenarios where crimes are committed by taking advantage of the anonymity of virtual currency and combining it with money laundering platforms.

[0078] Therefore, for each scenario-based case analysis model, combined with the analysis process, the stages can be split to form several analysis stage modules that are carried out in sequence and the goals required for each stage. That is, each analysis stage module includes one or more analysis goals, and each analysis goal is associated with an analysis unit.

[0079] Each scenario-based case analysis model includes more than two analysis phase modules that are performed in sequence. The analysis phase modules are selected from the case-related clues collection and confirmation phase module, the case-related address preliminary analysis phase module, the case-related address analysis expansion phase module, the key address handling fee tracing phase module, the case-related address evidence collection target management phase module, or the evidence collection data association analysis phase module. Among them, the case-related clues collection and confirmation phase module is required; the key address handling fee tracing phase module is based on the analysis results of the case-related address analysis expansion phase module; the case-related address evidence collection target management phase module and the evidence collection data association analysis phase module need to be selected at the same time, and are based on the key address handling fee tracing phase module. The analysis results of each analysis phase module are saved separately.

[0080] (1) Module for collecting and confirming clues involved in the case

[0081] According to preliminary investigations, the collected clues mainly include two types: addresses involved in the case and transaction hash values.

[0082] Therefore, if Figure 4 As shown, the analysis objectives associated with the case-related clue collection and confirmation phase module include address confirmation and / or transaction hash value confirmation.

[0083] The analysis units associated with the address confirmation analysis target and the transaction hash value confirmation analysis target are all browsers.

[0084] The analysis process of address confirmation is as follows: input the address involved in the case as a clue into the browser, search the virtual currency transaction data related to the address through the browser, and then determine the blockchain in which the address participates in the transaction, and then add the address and blockchain to the analysis object after marking, and save it to the address list associated with the case. When multiple blockchains are searched in the browser search process, the blockchain with a transaction amount exceeding the set threshold can also be added to the analysis object based on the transaction amount of the address in each blockchain.

[0085] The analysis process of transaction hash values ​​is as follows: input the transaction hash value as a clue into the browser, search the virtual currency transaction data related to the transaction hash value through the browser, and then determine the blockchain to which the address involved belongs and the transaction source destination, transaction amount, transaction time and other information; then mark the transaction hash value, source destination and blockchain to which it belongs, add it to the analysis object, and save it to the address list associated with the case. The transaction source destination includes the address that sends funds and the address that receives funds.

[0086] (2) Module for preliminary analysis of addresses involved in the case

[0087] During the stage of collecting and confirming clues involved in the case, the correctness of the wallet address or transaction hash value involved and the chain to which it belongs are confirmed, and the relevant address or transaction hash is marked and added to the analysis object and automatically brought back to the task analysis stage.

[0088] like Figure 5 As shown, the analysis targets associated with the preliminary analysis phase module of the involved address include address user analysis, address role analysis, or / and transaction feature analysis. Transaction features include transaction time and transaction amount. In the preliminary analysis phase module of the involved address, based on the addresses (including wallet addresses, source and destination addresses, etc.) added to the analysis object in the clue collection and confirmation phase module, the single address analysis unit in the analysis unit library is used to analyze the address user, and the multi-address analysis unit is used to analyze the address role and the transaction time and transaction amount characteristics.

[0089] The goal of address user analysis is to determine the ownership of the address. The analysis process of address user analysis is: for a single address involved in the case and multiple same-currency funding links or / and different-currency funding links associated with the address, the single address analysis unit is combined with the case type analysis to determine the ownership of the address involved. For example, in an online gambling case, the blockchain involved in the case is confirmed through the module of the clue collection and confirmation phase. Then, the ownership of the address involved is confirmed by the single address analysis unit, which is controlled by the gambler, the online gambling platform or the third-party channel. When the address involved in the case is the fund transferor, it can be determined to be controlled by the gambler; when the address involved in the case is the fund transferor, it can be determined to be controlled by the online gambling platform; when the address involved in the case has multiple fund transfers in and out, it can be determined that the address involved is controlled by a third-party channel. The address ownership information can be added to the address list associated with the address involved in the case to enrich the address labeling and description information.

[0090] The goal of address role analysis is to determine the role to which the address belongs. The analysis process of address role analysis is: for a single or multiple addresses involved in the case and the blockchain associated with them, the multi-address analysis unit is combined with the transaction amount and transaction time characteristics in the transaction data of the address involved to determine the address role involved. Address roles include deposit addresses (i.e., addresses where funds flow in), fund transfer addresses (as fund transfer between deposit addresses and fund collection addresses), collection addresses (i.e., addresses where funds are finally transferred to), withdrawal addresses (i.e., fund withdrawal addresses), disposal addresses (third-party platforms where funds flow in), and deposit addresses (addresses where funds have not yet been transferred and realized), etc. The specific address role should be determined in combination with the current transaction data of the blockchain where the address involved in the case is located. For example, in online gambling cases, the blockchain involved in the case is confirmed through the module of the clue collection and confirmation stage. When the address involved in the case is the fund transfer address (i.e. the online gambling payment address), the address involved in the case corresponds to the deposit address; when the address involved in the case is the address for multiple fund transfers (i.e. the online gambling fund collection), the address involved in the case corresponds to the collection address; when the funds in the collection address are withdrawn, the online gambling withdrawal address corresponds to the withdrawal address.

[0091] The goal of transaction feature analysis is to find out the transaction rules. The analysis process of transaction feature analysis is: according to the transaction amount and transaction time characteristics of the address involved in the case, find out the transaction rules, such as transaction time, transaction cycle, whether the transaction amount is a multiple or the same, etc. Then, based on the address involved in the case and the transaction rules, further expand the address involved in the case from the transaction data of the blockchain. The expanded address involved in the case is the new clue of the address involved in the case, and these addresses involved in the case are added to the analysis objects, and the attribution and address role of the address involved in the case are supplemented.

[0092] (3) Module for the expansion phase of case-related address analysis

[0093] This stage mainly conducts fund expansion analysis on the addresses involved in the case after the information is improved in the preliminary analysis stage, so as to restore the online gambling fund chain and locate the key addresses involved in the case based on the fund chain. Label and set roles for the key addresses on the fund expansion analysis chain diagram, and add these key addresses to the analysis objects. After the corresponding target analysis is completed, it can be saved, and the analysis process can be saved to the corresponding analysis stage of the case model to facilitate subsequent secondary expansion analysis or task review. After restoring the fund chain involved in the case and locating the key addresses involved in the case through fund analysis expansion, it is also necessary to comprehensively judge the size of online gambling funds.

[0094] Therefore, if Figure 6 As shown, the analysis objectives associated with the module of the expansion phase of the address analysis involved in the case include the expansion of the funds analysis of the address involved in the case and / or the determination of the amount of funds involved in the case.

[0095] ① The extended analysis goal of the funds analysis at the addresses involved in the case is to restore the funds chain involved in the case and locate the key addresses involved in the case.

[0096] The analysis process of restoring the capital chain involved in the case is as follows: here, the deposit address or withdrawal address determined in the preliminary analysis of the address involved in the case is used as the starting point, based on the virtual currency transaction data on the blockchain involved in the address involved in the case, through a single address judgment unit or a multi-address judgment unit, the funds are fully tracked and traced, the source and destination of the funds are determined, the capital chain involved in the case is restored, the corresponding virtual currency address topology map is obtained, and it is saved in the case-related graphic library. For example, for online gambling cases, based on the capital chain involved in the case, it can be determined whether it meets the characteristics of online gambling funds, and the deposit, collection, and withdrawal links can be verified.

[0097] The analysis process of locating key addresses involved in the case: According to the corresponding virtual currency address topology map, the adjustable trading institutions and key addresses involved in the case are located. The multiple key addresses involved in the case can be further added to the analysis objects, and the attribution and address roles of the addresses involved in the case are supplemented and saved in the list of key addresses involved in the case associated with the case. For example, for online gambling cases, in addition to the deposit address, collection address and withdrawal address mentioned above, it also includes the sale address and sedimentation address; when multiple funds are transferred to a third-party platform, the third-party platform corresponds to the sale address, which is used for the online gambling platform to sell the stolen goods for profit; when multiple funds are remitted to an address involved in the case and have not yet been transferred, the address involved in the case corresponds to the sedimentation address; unlike the collection address, the funds in the sedimentation address have not yet been withdrawn or transferred to the third-party platform.

[0098] ② The goal of judging the amount of funds involved in the case is to obtain the flow of key addresses. The analysis process for judging the amount of funds involved is as follows: input the key addresses involved in the case obtained from the analysis of the funds involved in the case into the browser for search, find the virtual currency transactions associated with these key addresses involved, and conduct flow analysis to judge the amount of funds involved. The corresponding address transaction data can be exported from the browser into Excel format to facilitate data backup and online analysis. The amount of funds involved mainly includes the flow of deposit addresses (which can be counted on a daily, weekly, or monthly basis), the flow of withdrawal addresses (which can be counted on a daily, weekly, or monthly basis), the total flow of collection addresses, the total flow of sales addresses, and the balance of sedimentation addresses.

[0099] (4) Key address fee tracing stage module

[0100] This stage mainly analyzes the source of transaction fees for the key addresses involved in the case that were expanded and located in the previous stage of address analysis and expansion, which can further determine the correlation between addresses and distinguish address boundaries.

[0101] Therefore, if Figure 7 As shown, the analysis objectives associated with the key address fee tracing phase module include key address fee tracing.

[0102] The analysis process of tracing the source of key address fees is as follows: based on the virtual currency address topology of the key addresses involved in the case obtained by multi-address analysis, the fees of each key address involved in the case are traced, that is, the source address of the fees is queried. For example, in online gambling cases, the tracing of key address fees includes the tracing of online gambling deposit addresses, the tracing of online gambling collection addresses, the tracing of online gambling withdrawal addresses, the tracing of online gambling stolen goods addresses, and the tracing of online gambling sedimentation addresses.

[0103] During the fee source analysis process, the address relationship and boundaries can also be verified. It is necessary to pay attention to whether the fee source address of the address meets the characteristics of ordinary users (the counterparty is not a black address or the number of transactions is less than the set threshold). If the fee source address meets the characteristics of ordinary users, then see whether the fees are from the same source. If they are from the same source, then it is likely that they are controlled by the same group; different sources may have different controllers. It is necessary to further analyze the addresses that have transactions with each fee source address, and use these addresses as the boundaries to distinguish addresses. It is also possible to analyze whether there is a connection between different controllers.

[0104] After the corresponding target analysis is completed, it can be saved to the corresponding analysis stage of the case model to facilitate subsequent secondary expansion analysis or task review.

[0105] (5) Module for target management of case address verification

[0106] This stage mainly combines the expansion of the analysis of the addresses involved in the case and the tracing analysis of the fees for key addresses, and links valuable evidence clues from two directions: the flow of main funds at the key addresses involved in the case and the source of fees.

[0107] In the previous analysis phase, the results of the fund analysis of the addresses involved and the fee tracing analysis of the key addresses have been saved respectively. In this phase, it is necessary to further expand on the previously saved results and find clues for verification purposefully based on the overall situation (for example: the deposit address of the trading institution, the withdrawal transaction of the trading institution, the wallet that can be verified, etc.).

[0108] Therefore, if Figure 8 As shown, the analysis objectives associated with the target management phase module of the case address verification include generating clues for verification related to the subject's funds and / or generating clues for verification related to the source of handling fees.

[0109] The analysis process of generating the principal funds-related verification clues is as follows: by generating the verification letter unit, firstly, according to the funds chain involved in the case obtained by analyzing the funds of the address involved in the case, the verification clues associated with the designated funds (such as: the deposit address of the trading institution, the withdrawal transaction of the trading institution, the verification wallet, etc.) are determined, and then according to the address or transaction hash value contained in the verification clue, according to the verification request template of the trading institution, the verification clue is added to the verification request template to generate a verification letter, which is sent to the relevant trading institution. The trading institution will feedback verification data such as identity information and transaction data for the address or transaction hash value.

[0110] The analysis process of generating the fee source-related verification clues is as follows: by generating the verification letter unit, first determine the verification clues associated with the fee source address (such as fee payment transactions, verification wallets, etc.) based on the fee source address obtained by tracing the key address fee source, and then add the verification clues to the verification request template according to the verification request template of the trading institution based on the address or transaction hash value contained in the verification clues to generate a verification letter and send it to the relevant trading institution. The trading institution will feedback verification data such as identity information and transaction data for the address or transaction hash value.

[0111] (6) Evidence collection data correlation analysis phase module

[0112] This stage mainly analyzes the verification data returned by the trading institutions, and further breaks through the restrictions of the trading institutions, combining the verification data with the virtual currency transaction data on the blockchain to achieve continuous tracking and analysis of funds.

[0113] Therefore, if Fig. 9 As shown, the analysis objectives associated with the evidence retrieval data association analysis phase module include evidence retrieval data analysis and / or evidence retrieval data association analysis.

[0114] The evidence data analysis is to analyze the evidence reply data to obtain the information of the persons involved in the case. The specific analysis process is: first, the evidence data (which can be the evidence data of Huobi, Binance, and EUREX) is cleaned, and then the evidence analysis unit is used to collect portraits of the persons involved in the case and save them in the graphic library associated with the case. The behaviors of the persons involved in the case (including providing withdrawal addresses, deposit addresses, collection addresses, sedimentation addresses, and sales addresses) can also be collected in chronological order and saved in the list associated with the case; the common behavioral characteristics of multiple persons involved in the case can also be analyzed and saved in the list associated with the case.

[0115] The correlation analysis of verification data is to analyze the verification data in combination with the virtual currency transaction data on the blockchain to achieve continuous tracking of funds. The specific analysis process is: through the transaction institution penetration unit, the cleaned verification data (including address, transaction data, identity information (such as name, ID card), etc.) is combined with the virtual currency transaction data associated with the virtual currency address on the blockchain to achieve the integrated display of on-chain information and off-chain information, break through the black box restrictions of the transaction institution, and achieve continuous tracking and analysis of funds.

[0116] 4. Case database

[0117] The case database is used to store analysis results associated with the case. The target analysis results of the modules in each analysis phase are saved in the case database; in the case database, a data set is constructed based on the case, and the target analysis results of the modules in each analysis phase are saved separately, and the generated lists or graphs are associated with the corresponding analysis targets.

[0118] The working principle of the above-mentioned case intelligent analysis platform is as follows: the case management module first creates the case and sets the case type, and then determines the scenario-based case analysis model based on the case type; calls the corresponding scenario-based case analysis model in the scenario-based case analysis model library; combines the virtual currency transaction data stored on the blockchain, and analyzes the analysis targets in each analysis stage module in turn according to the order of the analysis stage modules set by the scenario-based case analysis model, and saves the analysis results in the case database.

[0119] Example 2

[0120] This embodiment provides a case intelligent analysis method based on the case intelligent analysis platform provided in Embodiment 1, which includes the following steps:

[0121] The S1 case management module creates cases based on collected clues, sets case types, and then determines the scenario-based case analysis model based on the case type.

[0122] For example, if the clues collected are the reporting information "online gambling address addressA and online gambling transaction hash txA", it can be determined that the case type is online gambling, and the scenario-based case analysis model is determined to be the virtual currency online gambling analysis model.

[0123] S2 calls up the corresponding scenario-based case analysis model.

[0124] The virtual currency online gambling analysis model is retrieved from the scenario-based case analysis model library. The virtual currency online gambling analysis model includes the case clue collection and confirmation phase module, the case address preliminary analysis phase module, the case address analysis expansion phase module, the key address handling fee tracing phase module, the case address evidence collection target management phase module and the evidence collection data correlation analysis phase module.

[0125] S3 combines the virtual currency transaction data stored on the blockchain, and completes the analysis objectives in each analysis stage module in sequence according to the order of several analysis stage modules set in the scenario-based case analysis model, and stores the analysis results in the case database.

[0126] S31 enters the case-related clue collection and confirmation phase module to confirm the address and transaction hash value.

[0127] For example, based on the collected clue virtual address address A, input address A as a clue into the browser, search for virtual currency transaction data related to address A through the browser, and then determine the blockchain and transaction data involved in address A, then mark address A and add it to the analysis object, and save it to the address list associated with the case (as shown in Table 1).

[0128] Enter the transaction hash value txA as a clue into the browser, search the virtual currency transaction data related to the transaction hash value txA through the browser, and then determine the blockchain to which address A belongs and the transaction source and destination, transaction amount, transaction time and other information; then mark the source and destination and add them to the analysis object, and save them to the address list associated with the case (as shown in Table 1). Since address B is also added to the analysis object, it is also necessary to search the blockchain to which address B belongs. The analysis results are as follows: Fig.10 shown.

[0129] Table 1 Analysis results of the clue collection and confirmation stage

[0130] Gathering clues Online gambling address: address A; Online gambling transaction hash: txA Wallet Address Address A belongs to the Tron blockchain Transaction Hash txA belongs to the Tron blockchain Transaction address Sender address: address B; Receiver address: addressA

[0131] S32 enters the preliminary analysis phase module of the addresses involved in the case to conduct address user analysis, address role analysis and transaction feature analysis.

[0132] The analysis process of address user judgment is as follows: the online gambling address A and the blockchain associated with this address are analyzed by the single address judgment unit in combination with online gambling cases. Since address A is the recipient of funds, it can be determined that address A is controlled by the online gambling platform. Similarly, the online gambling address B and the blockchain associated with this address are analyzed by the single address judgment unit in combination with online gambling cases. Since address B is the sender of funds, it can be determined that address B is controlled by the gambler.

[0133] The analysis process of address role judgment is as follows: the online gambling address A, address B and the blockchain associated with the address are analyzed through the multi-address judgment unit in combination with the online gambling case. Since address A is the recipient of funds and funds are transferred in, address A is the deposit address.

[0134] The analysis process of transaction feature analysis is as follows: Based on addressA as the receiving address, addressB as the sending address, as well as their transaction amount and transaction time, the addressesA and B involved in the case are expanded to obtain the following: Fig.11 The expanded clues result. The expanded addresses involved in the case are new clues of addresses involved in the case (address K, address I, address B, address H, address M), and these addresses involved in the case are added to the analysis objects; then the attribution and address roles of the addresses involved in the case are supplemented and marked through the single address judgment unit and the multi-address judgment unit, as shown in Table 2.

[0135] Table 2 Results of preliminary analysis of the addresses involved in the case

[0136] Address involved Address user Address involved Address Role addressB Gambler Control addressB Victims addressI Gambler Control addressI Victims addressK Gambler Control addressK Victims addressH Gambler Control addressH Victims addressA Online gambling platform control addressA Deposit Address addressC Online gambling platform control addressC Deposit Address addressD Online gambling platform control addressD Transit address addressE Online gambling platform control addressE Collection address addressG Online gambling platform control addressG Withdrawal Address addressF Online gambling platform control addressF Sold stolen goods address addressM Online gambling platform control addressM Sedimentation address

[0137] S33 enters the module of expansion phase of address analysis involved in the case to expand the analysis of funds at the address involved in the case and determine the amount of funds involved in the case.

[0138] The extended analysis process of the funds analysis of the addresses involved in the case is as follows: here, the address A (deposit address) determined in the preliminary analysis of the addresses involved in the case is taken as the starting point. Based on the virtual currency transaction data on the blockchain in which the addresses involved in the case participate, the funds are fully tracked and traced through the multi-address analysis unit to determine the source and destination of the funds, restore the funds chain involved in the case, and obtain the corresponding virtual currency address topology map, such as Fig.12 shown.

[0139] The analysis process of locating the key addresses involved in the case: According to the corresponding virtual currency address topology map, the adjustable trading institutions and key addresses involved in the case are located. The multiple key addresses involved in the case located can be further added to the analysis object, and the attribution and address roles of the addresses involved in the case are supplemented and marked, and saved in the list of key addresses involved in the case associated with the case. Since the address attribution and address role of the key addresses involved in the case have been marked in the clue expansion stage in this embodiment, it is only necessary to extract the key addresses involved in the case and related information and save them in the list of key addresses involved in the case (as shown in Table 3).

[0140] The analysis process for determining the amount of funds involved is as follows: input the key addresses involved in the case obtained from the analysis of the funds involved in the case into the browser for search, find the virtual currency transactions associated with these key addresses involved, and conduct flow analysis to determine the amount of funds involved. The corresponding address transaction data can be exported from the browser into Excel format to facilitate data backup and online analysis. The amount of funds involved mainly includes the flow of deposit addresses (which can be counted on a daily, weekly, or monthly basis), the flow of withdrawal addresses (which can be counted on a daily, weekly, or monthly basis), the total flow of collection addresses, the total flow of sales addresses, the balance of deposit addresses, etc. (as shown in Table 3).

[0141] Table 3 Analysis results of the extended phase of address analysis

[0142] Key addresses involved in the case Address Role Funding addressA Deposit Address 1000U addressC Deposit Address 3000U addressE Collection address 3500U addressG Withdrawal Address 3200U addressF Sold stolen goods address 300U addressM Sedimentation address 500U

[0143] S34 enters the key address fee tracing phase module to perform key address fee tracing.

[0144] The analysis process of tracing the source of key address fees is as follows: based on the virtual currency address topology of the key addresses involved in the case obtained by the multi-address analysis unit, the fees of each key address involved in the case are traced, and the results are shown in Table 4.

[0145] Table 4 Analysis results of key address handling fee tracing stage

[0146] Key addresses involved in the case trade Fee source address addressA Tx1 addressN addressC Tx2 addressN addressE Tx3 addressN addressG Tx4 addressN addressF Tx5 addressN addressM Tx6 addressN

[0147] It can be seen from Table 4 that the key addresses involved in the case, addressA, addressC, addressE, addressG, addressF, and addressM, have the same origin, so it can be determined that the online gambling case is controlled by addressN.

[0148] S35 enters the target management stage module of the case address verification to generate the main body fund related verification clues and the fee source related verification clues.

[0149] The analysis process of generating the principal funds-related verification clues is as follows: by generating the verification letter unit, firstly, according to the funds chain involved in the case obtained by analyzing the funds of the address involved in the case, determine the verification clues associated with the specified funds (such as the exchange user address addressG), and then according to the addressG contained in the verification clues, add the verification clues to the verification request template according to the verification request template of the trading institution to generate a verification letter, and send it to the relevant trading institution. The trading institution will feedback the verification data such as identity information (including name, ID card,) and transaction data (including transaction time, transaction amount, counterparty) for the address or transaction hash value.

[0150] The analysis process of generating the fee source-related verification clue is as follows: by generating the verification letter unit, first determine the verification clue associated with the fee address (such as addressN, etc.) based on the fee source address obtained by tracing the key address fee, and then add the verification clue to the verification request template according to the verification request template of the trading institution based on the (exchange tag) contained in the verification clue to generate a verification letter and send it to the relevant trading institution. The trading institution will feedback the verification data such as the identity information and transaction data of the address or transaction hash value.

[0151] S36 enters the evidence collection data association analysis phase module to perform evidence collection data analysis and evidence collection data association analysis.

[0152] The analysis process of evidence collection data analysis is as follows: first, the evidence collection data is cleaned, and then the real-name information and portraits of the persons involved in the case are collected through the evidence collection analysis unit and saved in the evidence collection data analysis list and graphic library associated with the case.

[0153] The behaviors of the persons involved in the case can also be collected in chronological order and saved in the case-related evidence collection data analysis list (as shown in Table 5); the common behavioral characteristics of multiple persons involved in the case can also be analyzed, such as being used as a common withdrawal address, a common deposit address, or having transactions with the same collection address.

[0154] Table 5 Results of data analysis

[0155] Persons involved Identity information Address involved Behavioral characteristics King 1 ID number 1 addressG Provide a withdrawal address Lee 2 ID number 2 addressN Provide handling fee address … … … …

[0156] The analysis process of the correlation analysis of the verification data is as follows: through the transaction institution penetration unit, the cleaned verification data is combined with the virtual currency transaction data on the blockchain, and the two are correlated according to addressG and addressN, breaking through the black box restrictions of the transaction institution and realizing continuous tracking and analysis of funds.

[0157] The analysis results (including lists and graphs) of the above steps S31-S36 are saved in the case database.

[0158] Example 3

[0159] This embodiment is a further improvement on the embodiment 1.

[0160] The case intelligent analysis platform provided in this embodiment includes a case management module, a scenario-based case analysis model library, an analysis unit library, a case database, an analysis stage module library and an analysis target library.

[0161] The above-mentioned case management module, scenario-based case analysis model library, analysis unit library, and case database are the same as those in Example 1, and the explanations are as described above.

[0162] The analysis phase module library includes the case clue collection and confirmation phase module, the case address preliminary analysis phase module, the case address analysis expansion phase module, the key address handling fee tracing phase module, the case address evidence collection target management phase module and the evidence collection data association analysis phase module, etc. The explanation of each phase module is as described in Example 1.

[0163] The analysis target library includes analysis targets such as address confirmation, transaction hash value confirmation, address user analysis, address role analysis, transaction feature analysis, fund analysis and expansion of the address involved, determination of the fund volume involved, key address handling fee tracing, generation of subject fund-related evidence investigation clues, generation of handling fee source-related evidence investigation clues, evidence investigation data analysis, and evidence investigation data association analysis. The explanation of each analysis target is as described in Example 1.

[0164] The working principle of the above-mentioned case intelligent analysis platform is as follows: the case management module first creates a case and sets the case type, and then determines the scenario-based case analysis model based on the case type; then determines whether there is a corresponding scenario-based case analysis model in the scenario-based case analysis model library; if so, call the corresponding scenario-based case analysis model in the scenario-based case analysis model library, and combine it with the virtual currency transaction data stored on the blockchain. According to the sequence of each analysis stage module set by the scenario-based case analysis model, analyze the analysis targets in each analysis stage module in turn, and save the analysis results in the case database; if not, select two or more analysis stage modules from the analysis stage module library, and retrieve one or more analysis targets from the analysis target library to associate with the analysis stage module. Each analysis target is associated with an analysis unit, and the target analysis is completed through the analysis unit to generate a custom scenario-based case analysis model.

[0165] Example 4

[0166] This embodiment provides a case intelligent analysis method based on the case intelligent analysis platform provided in Embodiment 3, which includes the following steps:

[0167] The S1 case management module creates cases based on collected clues, sets case types, and then determines scenario-based case analysis models based on case types;

[0168] S2 determines whether the scenario-based case analysis model determined in step S1 exists in the scenario-based case analysis model library; if so, retrieves the corresponding scenario-based case analysis model and then proceeds to step S3; if not, proceeds to step S4;

[0169] S3 combines the virtual currency transaction data stored on the blockchain, completes the analysis objectives in each analysis phase module in sequence according to the sequence of several analysis phase modules set in the scenario-based case analysis model, and stores the analysis results in the case database;

[0170] S4 generates a custom scenario-based case analysis model and performs analysis; specifically, it includes the following steps:

[0171] S41 Case Management Module selects an analysis phase module from the analysis phase module library;

[0172] S42 retrieves one or more analysis targets associated with the analysis phase module from the analysis target library;

[0173] S43 combines the virtual currency transaction data stored on the blockchain, performs analysis through an analysis unit associated with the analysis target, and stores the analysis result in a case database;

[0174] The above steps S41-S43 are repeated until the case management module selects all required analysis phase modules from the analysis phase module library.

[0175] The specific implementation process of the above steps S1-S3 is as described in Example 2.

[0176] The specific implementation process of the above steps S41-S43 is similar to the implementation process of the corresponding analysis phase module in steps S31-S36 in Example 2, and will not be explained in detail here.

[0177] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0178] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0179] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0180] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0181] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A case intelligent analysis platform, characterized in that: include: The case management module is used to create cases based on collected clues, set case types, and then determine scenario-based case analysis models based on case types; Then, the case is analyzed through the determined scenario-based case analysis model, combined with the virtual currency transaction data stored on the blockchain, and the analysis results are stored in the case database; A scenario-based case analysis model library, used to store a number of scenario-based case analysis models associated with case types; each scenario-based case analysis model includes a number of analysis phase modules that are performed in sequence, each analysis phase module includes more than one analysis target, and each analysis target is associated with an analysis unit; An analysis unit library, used to store a plurality of analysis units, wherein the analysis units are used to analyze input data of analysis phase modules associated therewith according to analysis objectives; The case database is used to store analysis results associated with the case.

2. The case intelligent analysis platform according to claim 1 is characterized in that: The case management module calls the corresponding scenario-based case analysis model in the scenario-based case analysis model library and performs analysis in combination with the virtual currency transaction data stored on the blockchain.

3. The case intelligent analysis platform according to claim 1 is characterized in that: It also includes an analysis phase module library and an analysis target library; the analysis phase module library is used to store a number of analysis phase modules; the analysis target library is used to store more than one analysis target associated with each analysis phase module; each analysis target is associated with an analysis unit; At this time, based on the case type, the case management module selects two or more analysis phase modules to be performed in sequence from the analysis phase module library, and retrieves one or more analysis targets from the analysis target library to associate with the analysis phase modules. Each analysis target is associated with an analysis unit to generate a customized scenario-based case analysis model.

4. The case intelligent analysis platform according to any one of claims 1 to 3, characterized in that: The case type is selected from virtual currency fraud cases, virtual currency pyramid scheme cases, virtual currency online gambling cases, virtual currency theft cases or virtual currency money laundering cases.

5. The case intelligent analysis platform according to claim 1 is characterized in that: The scenario-based case analysis model library includes virtual currency fraud analysis model, virtual currency pyramid scheme analysis model, virtual currency online gambling analysis model, virtual currency theft analysis model and virtual currency money laundering analysis model; each scenario-based case analysis model includes two or more analysis phase modules that are performed in sequence, and the analysis phase modules are selected from the case-related clues collection and confirmation phase module, the case-related address preliminary analysis phase module, the case-related address analysis expansion phase module, the key address handling fee tracing phase module, the case-related address evidence collection target management phase module or the evidence collection data correlation analysis phase module.

6. The case intelligent analysis platform according to claim 3 is characterized in that: The analysis phase module library includes a module for collecting and confirming clues involved in the case, a module for preliminary analysis of addresses involved in the case, a module for expanding analysis of addresses involved in the case, a module for tracing the source of fees for key addresses, a module for managing the target phase for address verification and evidence collection involved in the case, and a module for correlation analysis of verification data; the analysis target library includes address confirmation, transaction hash value confirmation, address user analysis, address role analysis, transaction feature analysis, expansion of funds analysis for addresses involved in the case, determination of the size of funds involved in the case, tracing the source of fees for key addresses, generating clues for verification and evidence collection associated with the subject funds, generating clues for verification and evidence collection associated with the source of fees, verification and evidence collection data analysis, and verification and evidence collection data correlation analysis.

7. The case intelligent analysis platform according to any one of claims 1 to 3, characterized in that: The analysis unit library includes a browser, a single-address analysis unit, a multi-address analysis unit, a call letter generation unit, a certificate analysis unit, and a transaction institution penetration unit; The browser is used to search for virtual currency transaction data based on the input query address and / or transaction hash value, and obtain the blockchain and transaction data associated with the address involved in the case; then add the address involved in the case and the blockchain and transaction data associated therewith to the analysis object; The single address analysis unit is used to analyze a single address involved in the case and the blockchain and transaction data associated with it, and determine the ownership of the address involved in the case in combination with the case type; The multi-address analysis unit is used to analyze the role of the address involved in the case by combining the transaction amount and transaction time characteristics in the transaction data of the address involved in the case with the single or multiple addresses involved in the case and the blockchain associated therewith. The unit for generating a transfer letter is used to find the clues for the transfer of evidence, generate a transfer letter, and send it to the corresponding transaction institution based on the analysis results obtained from each analysis target in the stage of analyzing and expanding the address involved in the case or / and the analysis results obtained from the analysis target in the stage of tracing the source of the handling fee of the key address; The evidence collection and analysis unit is used to collect the persons and behaviors involved in the case based on the evidence collection data fed back by the trading institutions; The transaction institution penetration unit is used to continuously track and analyze funds based on the verification data fed back by the transaction institution and combined with the virtual currency transaction data on the blockchain.

8. The case intelligent analysis platform according to claim 7 is characterized in that: The analysis unit library also includes an address mining unit and an address monitoring unit; the address mining unit is used to mine the incomplete query address received by the browser and then complete the address; the monitoring unit is used to monitor the virtual currency address determined as the sedimentation address by the multi-address analysis unit.

9. The case intelligent analysis platform according to claim 7 is characterized in that: The single-address analysis unit also performs analysis based on the address involved and the blockchain associated with it, according to the specified direction of fund flow, completely tracks and traces the funds, restores the fund chain involved in the case, obtains the corresponding virtual currency address topology map, locates the verifiable trading institutions and multiple key addresses involved in the case, and adds the located multiple key addresses involved in the case to the analysis object.

10. The case intelligent analysis platform according to claim 7 is characterized in that: The multi-address analysis unit can also find out the transaction rules based on the transaction amount and transaction time characteristics of the addresses involved in the case; then, based on the addresses involved in the case and the transaction rules, expand the clues of the addresses involved in the case from the transaction data of the blockchain, and add these addresses involved in the case to the analysis objects.

11. The case intelligent analysis platform according to claim 7 is characterized in that: The multi-address analysis unit also analyzes the inflow and outflow of funds based on a single or multiple addresses involved in the case and the associated blockchains, completely tracks and traces the funds, restores the funds chain involved in the case, obtains the corresponding virtual currency address topology map, locates the verifiable trading institutions and key addresses involved in the case, and further adds the located multiple key addresses involved in the case to the analysis objects.

12. A case intelligent analysis method, characterized in that: The case intelligent analysis platform according to any one of claims 1 to 11 is used to perform the following steps: The S1 case management module creates cases based on collected clues, sets case types, and then determines scenario-based case analysis models based on case types; S2 determines whether the scenario-based case analysis model determined in step S1 exists in the scenario-based case analysis model library; if so, retrieves the corresponding scenario-based case analysis model and then proceeds to step S3; if not, proceeds to step S4; S3 combines the virtual currency transaction data stored on the blockchain, completes the analysis objectives in each analysis phase module in sequence according to the sequence of several analysis phase modules set in the scenario-based case analysis model, and stores the analysis results in the case database; S4 generates a custom scenario-based case analysis model and performs analysis; The following steps are included: S41 Case Management Module selects an analysis phase module from the analysis phase module library; S42 retrieves one or more analysis targets associated with the analysis phase module from the analysis target library; S43 combines the virtual currency transaction data stored on the blockchain, performs analysis through an analysis unit associated with the analysis target, and stores the analysis result in a case database; The above steps S41-S43 are repeated until the case management module selects all required analysis phase modules from the analysis phase module library.

Images