Digital resource transaction link tracking method and device, equipment and storage medium

Abstract

The embodiment of the invention is suitable for the technical field of block chains, and provides a digital resource transaction link tracking method and device, equipment and a storage medium, and the method comprises the steps: constructing a risk address set based on a received initial address; determining a target node according to preset digital resource transaction graph data and the risk address set; determining a risk neighbor node of the target node according to the node type of the target node; adding the node address of the risk neighbor node to the risk address set; under the condition that the risk address set is a non-empty set, returning to the step of determining the target node according to the preset digital resource transaction graph data and the risk address set; and under the condition that the risk address set is an empty set, outputting a transaction link containing the risk neighbor node. According to the embodiment of the invention, the received initial address can be searched, and the transaction link containing the suspected illegal transaction address is output.

Description

Technical Field

[0001] The embodiments of the present application belong to the field of blockchain technology, and in particular, relate to a method, device, equipment and storage medium for tracking a digital resource transaction link. Background Art

[0002] With the rapid development of blockchain technology, digital resource trading has become an emerging and vibrant field. Blockchain technology is a distributed ledger technology that maintains a secure, transparent, and tamper-proof data record in a decentralized manner. This technology is widely used in many fields, such as finance, supply chain management, intellectual property protection, etc. Digital resource trading uses blockchain technology to realize the digitization, ownership confirmation, trading, and tracking of assets, thereby improving transaction efficiency and security. However, at the same time, the existence of illegal trading accounts has brought serious security threats to this field. These accounts often use the anonymity of blockchain to carry out illegal activities.

[0003] In the related art, illegal transaction accounts are searched through extensive scanning of transaction data of digital resources. This method can only scan nodes that meet a single feature and consumes a lot of time and computing resources.

[0004] How to quickly and effectively discover illegal trading accounts is very important for maintaining the security of digital resource transactions. Summary of the invention

[0005] In view of this, embodiments of the present application provide a digital resource transaction link tracking method, apparatus, device and storage medium to improve the search efficiency for suspected illegal transaction links in a digital resource transaction network.

[0006] A first aspect of an embodiment of the present application provides a digital resource transaction link tracking method, comprising:

[0007] Based on the received initial address, a risk address set is constructed;

[0008] Determine the address to be searched from the pre-built risk address set;

[0009] Determine the target node based on the preset digital resource transaction graph data and the risk address set;

[0010] Determining a risky neighbor node of the target node according to the node type of the target node;

[0011] Adding the node address of the risk neighbor node to the risk address set;

[0012] In the case where the risk address set is a non-empty set, returning to the step of determining the target node based on the preset digital resource transaction graph data and the risk address set;

[0013] When the risk address set is an empty set, a transaction link including the risk neighbor node is output.

[0014] In a possible implementation manner of the first aspect, before determining the target node and the target node type according to the preset digital resource transaction graph data and the risk address set, the method further includes:

[0015] Obtain transaction network data of digital resources;

[0016] determining a plurality of nodes according to the transaction data;

[0017] Determining node information, transaction information of the node, and transaction edge information between the nodes;

[0018] Digital resource transaction graph data is constructed based on the node information, transaction information and transaction edge information.

[0019] In a possible implementation manner of the first aspect, determining the risk neighbor node of the target node according to the node type of the target node includes:

[0020] Obtain neighbor nodes of the target node;

[0021] Determine the node type of the target node according to a preset multi-classification graph neural network model;

[0022] According to the node type, risky neighbor nodes are determined among neighbor nodes of the target node.

[0023] In a possible implementation manner of the first aspect, determining the node type of the target node according to a preset multi-classification graph neural network model includes:

[0024] Acquire node features of the target node; the node features include transaction information and transaction side information corresponding to the target node;

[0025] A multi-classification graph neural network model is used to classify the node features to obtain the node type of the target node.

[0026] In a possible implementation manner of the first aspect, determining a risky neighbor node among neighbor nodes of the target node according to the node type includes:

[0027] Determining a target graph edge link neural network model corresponding to the node type from among a plurality of preset graph edge link neural network models;

[0028] The target graph edge link neural network model is used to predict the neighbor nodes of the target node to determine the risky neighbor nodes.

[0029] In a possible implementation manner of the first aspect, adding the node address of the risk neighbor node to the risk address set includes:

[0030] Obtaining an access identifier of the risky neighbor node; the access identifier is visited or not visited;

[0031] The node address of the risk neighbor node identified as unvisited is added to the risk address set.

[0032] In a possible implementation manner of the first aspect, the method further includes:

[0033] Determine node object information of the risk neighbor node; the node object information includes forward tracing node information;

[0034] Determine that the node address of the target node is the forward node information of the risk neighbor node of the target node;

[0035] The output includes the transaction link of the risk neighbor node, including:

[0036] Taking the tail node of the link as the starting point, the transaction link is output according to the node object; the tail node of the link is the target node without any unvisited risk neighbor node.

[0037] A second aspect of an embodiment of the present application provides a digital resource transaction link tracking device, comprising:

[0038] A risk address set building module, used to build a risk address set based on the received initial address;

[0039] A target node determination module, used to determine the target node according to the preset digital resource transaction graph data and the risk address set;

[0040] A risk neighbor node determination module, used to determine the risk neighbor nodes of the target node according to the node type of the target node;

[0041] A risk address adding module, used for adding the node address of the risk neighbor node to the risk address set;

[0042] A loop module, configured to call the target node determination module when the risk address set is a non-empty set;

[0043] The link output module is used to output the transaction link containing the risk neighbor node when the risk address set is an empty set.

[0044] In a possible implementation manner of the second aspect, the apparatus further includes:

[0045] A transaction network data acquisition module, used to acquire transaction network data of digital resources;

[0046] A node determination module, used to determine a plurality of nodes according to the transaction data;

[0047] An information determination module, used to determine the node information and transaction information of the node, and the transaction edge information between the nodes;

[0048] A digital resource transaction graph data construction module is constructed, which is used to construct digital resource transaction graph data based on the node information, transaction information and transaction edge information.

[0049] In a possible implementation manner of the second aspect, the risk neighbor node determination module includes:

[0050] A neighbor node acquisition submodule is used to acquire neighbor nodes of the target node;

[0051] A node type determination submodule, used to determine the node type of the target node based on a preset multi-classification graph neural network model;

[0052] The risk neighbor node determination submodule is used to determine the risk neighbor node among the neighbor nodes of the target node according to the node type.

[0053] In a possible implementation manner of the second aspect, the node type determination submodule includes:

[0054] A node feature acquisition unit, configured to acquire node features of the target node; the node features include transaction information and transaction edge information corresponding to the target node;

[0055] The node type determination unit is used to classify the node features using a multi-classification graph neural network model to obtain the node type of the target node.

[0056] In a possible implementation manner of the second aspect, the risk neighbor node determination submodule includes:

[0057] A target graph edge link neural network model determination unit, used to determine a target graph edge link neural network model corresponding to the node type from a plurality of preset graph edge link neural network models;

[0058] The risk neighbor node determination unit is used to predict the neighbor nodes of the target node using the target graph edge link neural network model to determine the risk neighbor nodes.

[0059] In a possible implementation manner of the second aspect, the risky address adding module includes:

[0060] An access identification acquisition submodule is used to acquire the access identification of the risky neighbor node; the access identification is visited or not visited;

[0061] The node address adding submodule is used to add the node address of the risk neighbor node identified as unvisited to the risk address set.

[0062] In a possible implementation manner of the second aspect, the apparatus further includes:

[0063] A node object information determination module, used to determine the node object information of the risk neighbor node; the node object information includes the forward node information;

[0064] A forward node information adding module, used to determine the forward node information of the risk neighbor node of the target node whose node address is the target node;

[0065] The link output module is used to output the transaction link based on the node object with the link tail node as the starting point; the link tail node is a target node without any unvisited risk neighbor node.

[0066] A third aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the digital resource transaction link tracking method as described in the first aspect above is implemented.

[0067] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the digital resource transaction link tracking method as described in the first aspect above is implemented.

[0068] A fifth aspect of the embodiments of the present application provides a computer program product. When the computer program product is run on a computer, the computer executes the digital resource transaction link tracking method described in the first aspect.

[0069] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0070] In an embodiment of the present application, a risk address set is constructed based on the received initial address; a target node is determined according to preset digital resource transaction graph data and the risk address set; a risk neighbor node of the target node is determined according to the node type of the target node; the node address of the risk neighbor node is added to the risk address set; when the risk address set is a non-empty set, the step of determining the target node according to the preset digital resource transaction graph data and the risk address set is returned; when the risk address set is an empty set, a transaction link containing the risk neighbor node is output, thereby realizing a search for the received initial address, taking the node corresponding to the initial address in the digital resource transaction graph data as the starting point, searching for risk neighbor nodes suspected of having illegal transactions according to the node type, adding the addresses of the risk neighbor nodes to the risk address set, and then searching for risk neighbor nodes for the addresses in the risk address set, so as to mine more nodes suspected of having illegal transactions, and when it is determined that there are no more risk neighbor nodes, outputting a transaction link containing the risk neighbor node, so as to display a complete transaction link containing an address suspected of having illegal transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0072] Figure 1 It is a schematic diagram of a digital resource transaction link tracking method provided in an embodiment of the present application;

[0073] Figure 2A This is a schematic diagram of digital resource transaction network data provided by an embodiment of the present application;

[0074] Figure 2B It is a schematic diagram of digital resource transaction graph data provided by an embodiment of the present application;

[0075] Figure 2C It is another schematic diagram of digital resource transaction graph data provided by an embodiment of the present application;

[0076] Figure 2D This is a transaction link diagram provided by an embodiment of the present application;

[0077] Figure 3 It is a schematic diagram of a digital resource transaction link tracking device provided by an embodiment of the present application;

[0078] Figure 4It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0079] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0080] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0081] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0082] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0083] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0084] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0085] Blockchain is an application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm. Blockchain is essentially a decentralized distributed database that records transactions by creating a decentralized tamper-proof system. Specifically: Blockchain uses blocks as the basic unit to manage and store data. Blocks are composed of multiple parts of data structures, which are used to store different information. For example: blocks can be divided into block headers and block bodies. Block headers are used to store data such as temporary random numbers that can be modified, hash values ​​of previous blocks, timestamps, difficulty of creating blocks, and roots of transaction trees. Block bodies are used to store valid transactions. When blocks containing transaction data are linked in order, a blockchain is formed.

[0086] Digital resources are digital assets or rights based on blockchain technology. Digital resources can be traded (or exchanged) on a designated platform. The platform is built on blockchain technology to ensure the security and reliability of digital resource transactions. Different digital resources can be traded on different platforms. Users can trade digital resources through their accounts on the platform, and each account is represented by a unique address.

[0087] As an example, the trading platform for digital resources may be a decentralized exchange (DecentralizedExchange).

[0088] The technical solution of the present application is described below through specific embodiments.

[0089] Reference Figure 1 , shows a schematic diagram of a digital resource transaction link tracking method provided by an embodiment of the present application, which may specifically include the following steps:

[0090] Step 101, constructing a risk address set based on the received initial address;

[0091] The initial address can be obtained in a preset manner, and a risk address set including the initial address can be constructed, and suspected illegal transaction accounts can be searched for the risk address set.

[0092] As an example, the preset method may be to use the address received in the designated information input area as the initial address and to construct a risk address set including the initial address.

[0093] For example, the above-mentioned designated information output area is a web page or a client page. The user enters one or more character strings that meet the address format of the designated account in the information input area, and uses the character string as the initial address. The risk address set is constructed with the initial address as the seed address. It can be understood that the initial address is the address of a suspected illegal transaction account.

[0094] Step 102, determining a target node according to the preset digital resource transaction graph data and the risk address set;

[0095] Before step 102, digital resource transaction graph data is pre-constructed, and the digital resource transaction graph data includes a plurality of nodes, and one node corresponds to the address of one account.

[0096] At least one node corresponding to the risk address set in the digital resource transaction graph data is a target node, and a suspected illegal transaction node (i.e., suspected illegal transaction address) is searched based on the target node.

[0097] As an example, step 102 may include: determining the address to be searched in a pre-constructed risk address set; determining the target node corresponding to the address to be searched based on the preset digital resource transaction graph data. There may be one or more addresses in the risk address set, and the address to be searched can be determined from the risk address set. The embodiment of the present application does not limit the manner in which the address to be searched is determined in the risk address set. For example: in a random manner (randomly determining an address in the risk address set as the address to be searched), or in chronological order (determining the one in the risk address set that was added to the risk address set the earliest). After determining the address to be searched, the digital resource transaction graph data is searched to determine that the node corresponding to the address to be searched is the target node.

[0098] Step 103, determining risk neighbor nodes of the target node according to the node type of the target node;

[0099] The neighbor nodes of each node contained in the digital resource transaction graph data can be determined, so after the target node is determined, the neighbor nodes of the target node can be determined.

[0100] In the embodiment of the present application, several node types are pre-set. After the node type of the target node is determined, the risky neighbor node (the address suspected to be related to illegal transactions) is determined according to the node type, thereby avoiding large-scale neighbor node search operations and improving search efficiency.

[0101] As an example, the node type may include high-risk nodes, low-risk nodes, and no-risk nodes. Further, the high-risk nodes may be divided into multiple sub-types to match different types of illegal transactions.

[0102] Step 104, adding the node address of the risk neighbor node to the risk address set;

[0103] After determining the risk neighbor node, it is necessary to further determine whether the neighbor node of the risk neighbor node is also a risk neighbor node, so the node address corresponding to the risk neighbor node can be added to the risk address set to update the risk address set. For example: target node A includes neighbor node B, neighbor node C, neighbor node D, and neighbor node E, and after determining the node type of target node A, it is determined that neighbor node D and neighbor node E are risk neighbor nodes, then the node address of neighbor node D and the node address of neighbor node E are added to the risk address set.

[0104] In actual applications, the address of the same node only needs to be added to the risk address set once. There is no need to repeatedly add multiple addresses to the risk address set to avoid consuming unnecessary computing resources.

[0105] Step 105, when the risk address set is a non-empty set, return to step 102;

[0106] If the current risk set is a non-empty set, that is, there is at least one address in the current risk set, return to step 102 to search for risk neighbor nodes for the addresses in the risk set, so that a more complete transaction link can be constructed later.

[0107] Step 106: when the risk address set is an empty set, output the transaction link including the risk neighbor node.

[0108] When the risk address set is an empty set, that is, there is no address in the current risk set, it means that there are no more risk neighbor nodes, that is, the search for risk neighbor nodes is determined to be completed, and the transaction link containing the risk neighbor node is output, thereby outputting the transaction link related to the illegal transaction address. It can be understood that at least one risk neighbor node is a neighbor node of the node corresponding to the initial address, so the node corresponding to the initial address is also located on the transaction link. The embodiment of the present application realizes searching for a transaction link containing a suspected illegal transaction address with the initial address as the starting point.

[0109] In an embodiment of the present application, a risk address set is constructed based on the received initial address; a target node is determined according to the preset digital resource transaction graph data and the risk address set; a risk neighbor node of the target node is determined according to the node type of the target node; the node address of the risk neighbor node is added to the risk address set; when the risk address set is a non-empty set, the step of determining the target node according to the preset digital resource transaction graph data and the risk address set is returned; when the risk address set is an empty set, a transaction link containing the risk neighbor node is output, thereby realizing a search for the received initial address, taking the node corresponding to the initial address in the digital resource transaction graph data as the starting point, searching for risk neighbor nodes suspected of having illegal transactions according to the node type, adding the addresses of the risk neighbor nodes to the risk address set, and then searching for risk neighbor nodes for the addresses in the risk address set, so as to mine more nodes suspected of having illegal transactions, and when it is determined that there are no more risk neighbor nodes, outputting a transaction link containing the risk neighbor node, so that a complete transaction link containing an address suspected of having illegal transactions can be displayed.

[0110] In an optional embodiment of the present application, before determining the target node and the target node type based on the preset digital resource transaction graph data and the risk address set, the method also includes: obtaining transaction network data of the digital resource; determining multiple nodes based on the transaction data; determining the node information, transaction information, and transaction edge information between the nodes; and constructing the digital resource transaction graph data based on the node information, transaction information and transaction edge information.

[0111] The transaction network data of digital resources can be obtained through the digital resource transaction platform, and then the various nodes contained in the transaction network data can be determined, each node corresponds to a transaction address (that is, the address of the account), and the node information, transaction information, and transaction side information between nodes where transactions exist can be determined. Among them, the node information includes information for identifying the node; the transaction information includes the transaction characteristics corresponding to the node, and the transaction characteristics may include one or more of the number of transactions, the total transaction amount, the transaction mean, the distribution of transaction objects, and the transaction input and output ratio; the transaction side information includes the transaction side characteristics corresponding to the node, and the transaction side characteristics may include one or more of the addresses of the two transaction parties (nodes), the transaction subject (for example: the transaction currency), the transaction status, the transaction amount, the transaction hash, and the transaction time. Digital resource transaction graph data is generated through the node information, transaction information, and transaction side information of each node. In an optional embodiment of the present application, step 103 includes:

[0112] Sub-step 1031, obtaining neighbor nodes of the target node;

[0113] Each node in the digital resource transaction graph data is connected to its neighbor nodes through transaction edges. When two nodes correspond to the same transaction edge feature, that is, the two nodes have traded directly (1-hop transaction), the two nodes are neighbor nodes. After determining the target node, its neighbor nodes can be determined through the target node's transaction edge information.

[0114] Sub-step 1032, determining the node type of the target node according to a preset multi-classification graph neural network model;

[0115] According to the trained multi-classification graph neural network model, the node type of the target node is identified.

[0116] As an example, we can label several nodes of known node types, divide them into training sets and test sets, perform multiple iterative training and accuracy verification on the graph neural network model on the training set and test set respectively, to obtain a multi-classification graph neural network model that can accurately output the node type of the node.

[0117] In the specific implementation, the multi-classification graph neural network model can adopt graph neural network models based on neighbor feature sampling and aggregation, such as GCN (Graph Convolutional Network) and GraphSAGE (Graph Sample and Aggregated).

[0118] Sub-step 1033, determining risky neighbor nodes among neighbor nodes of the target node according to the node type.

[0119] Combined with the node type of the target node, the risk neighbor nodes are determined among the neighbor nodes of the target node, so as to distinguish the neighbor link relationship of different types of nodes and improve the accuracy and reliability of risk neighbor node identification.

[0120] In an optional embodiment of the present application, step 1032 includes:

[0121] Sub-step 10321, obtaining node characteristics of the target node; the node characteristics include transaction information and transaction side information corresponding to the target node;

[0122] As can be seen from the above, the digital resource transaction graph data contains the transaction information and transaction side information corresponding to the node, and the transaction information and transaction side information are used as the node characteristics of the node. After determining the target node, the node characteristics of the target node can be read through the digital resource transaction graph data.

[0123] Sub-step 10322, using a multi-classification graph neural network model to classify the node features to obtain the node type of the target node.

[0124] The node features of the target node are input into the multi-classification graph neural network model, and the multi-classification graph neural network model can output the node type of the target node.

[0125] In an optional embodiment of the present application, sub-step 1033 includes:

[0126] Sub-step 10331, determining a target graph edge link neural network model corresponding to the node type from a plurality of preset graph edge link neural network models;

[0127] For different node types, multiple graph edge link neural network models corresponding to the node types are pre-trained.

[0128] In practical applications, the graph edge link neural network model can adopt feature prediction classification models such as MLP (Multilayer Perceptron) and Transformer (a network model based on self-attention mechanism), and train the model according to the known node types between nodes to obtain graph edge link neural network models corresponding to different node types.

[0129] Sub-step 10332, using the target graph edge link neural network model to predict the neighbor nodes of the target node to determine the risky neighbor nodes.

[0130] The target graph edge link neural network model corresponding to the node type of the target node is used to predict the link relationship between the target node and the neighboring nodes, so as to identify whether the neighboring node is a risky neighboring node.

[0131] Specifically, the target graph edge link neural network model can output corresponding evaluation values ​​for neighbor nodes of the target node, and determine neighbor nodes with evaluation values ​​greater than a preset threshold as risky neighbor nodes.

[0132] In an optional embodiment of the present application, step 104 includes:

[0133] Step 1041, obtaining the access identifier of the risky neighbor node; the access identifier is visited or not visited;

[0134] The access identifier of the risk neighbor node can be read. If the access identifier is visited, it means that the risk neighbor node has been previously determined as a target node and its risk neighbor nodes have been searched.

[0135] Step 1042: Add the node address of the risk neighbor node with the access mark as unvisited to the risk address set.

[0136] If the access mark is not visited, it means that the risk neighbor node is not searched for its risk neighbor node with the risk neighbor node as the target node, then the node address of the risk neighbor node is added to the risk address set, so that the risk neighbor node can be searched for the node address later, so that the subsequent output transaction link is more complete. At the same time, for the risk neighbor node whose access mark is visited, its node address will not be added to the risk address set to avoid searching for risk neighbor nodes for the same node multiple times, resulting in a waste of computing resources.

[0137] In an optional embodiment of the present application, the method further includes:

[0138] Determine the node object information of the risk neighbor node; the node object information includes the forward node information; determine that the node address of the target node is the forward node information of the risk neighbor node of the target node;

[0139] The outputting of the transaction link including the risk neighbor node includes: taking the link tail node as the starting point, outputting the transaction link according to the node object; the link tail node is a target node without any unvisited risk neighbor node.

[0140] In an embodiment of the present application, after determining the risk neighbor node, node object information is constructed for the risk neighbor node, the node object information includes but is not limited to an access identifier and forward node information, and the node address of the current target node is determined as the forward node information of the risk neighbor node.

[0141] If the current target node does not have a risky neighbor node, it means that the current target node is the tail node of a transaction link. According to the currently stored node object, the transaction link to which it belongs can be output starting from the tail node of the link.

[0142] For example: when determining that node E is the target node, node F is determined to be an unvisited risk neighbor node, then the address of node E is the forward node information of node F; when determining that node F is the target node, node G is determined to be an unvisited risk neighbor node, then the address of node F is the forward node information of node G; when determining that node G is the target node, there is no unvisited risk neighbor node, then node G is determined to be the tail node of the link, node F is determined based on the forward node information of node G, and node E is determined through the forward node information of node F, then the output includes a transaction link containing node G-node F-node E.

[0143] The following is an example to further illustrate the embodiment of the present application:

[0144] Before searching for transaction links containing suspected illegal transaction addresses, obtain digital resource transaction network data (such as Figure 2AA digital resource transaction network data schematic diagram provided by an embodiment of the present application as shown in FIG. 1 ) is constructed as a digital resource transaction graph data with node and edge features (such as Figure 2B A digital resource transaction graph data schematic diagram provided in an embodiment of the present application is shown).

[0145] After constructing the digital resource transaction graph data, the multi-role state machine executes steps 201-204 to output the transaction link. According to the different types of node addresses, the state machine will switch its own role to adapt to different search methods. The node types can include high-risk nodes, low-risk nodes, and risk-free nodes. Furthermore, high-risk nodes can be divided into multiple subtypes, including: illegal transaction nodes, upstream nodes, and downstream nodes. (As an example, illegal transaction nodes are illegal money laundering group nodes, upstream funding source nodes, and downstream group nodes;).

[0146] Step 201, address input stage.

[0147] Wait for the user to enter the suspected illegal transaction node address. When the user enters the suspected illegal transaction address, build a potential fraud address set and switch to the address judgment stage. For example: the suspected illegal transaction node address entered by the user is TK6SJ*****************************Bo26 (in actual application, * can be letters or numbers).

[0148] Step 202, address determination stage.

[0149] The search address is located on the digital resource transaction graph data to obtain the node corresponding to the current address (such as Figure 2C Another digital resource transaction graph data schematic diagram provided by the present application embodiment shows a node in a dotted box) and its neighboring nodes and the transaction edges between the current node and the neighboring nodes (such as Figure 2CAnother digital resource transaction graph data schematic diagram provided by an embodiment of the present application (as shown by the dotted arrow), the transaction features of the target node and all transaction edge features within 1 hop are extracted and aggregated as the node features of the target node, and the target node is classified by a pre-trained multi-classification graph neural network method to obtain the node type, and the neighbor link judgment stage of different roles is switched according to the node type. For example: take out an address to be searched, and construct Cypher statements "MATCH(a:account{vid:'TK6SJ*****************************Bo26'})RETURN a" and "MATCH(account{vid:'TK6SJ*****************************Bo26'})-[t:transaction]->(account)RETURN t" respectively, and query the graph database to obtain node information and all transaction information.

[0150] Step 203: Neighbor link determination phase.

[0151] According to different node role classifications, different edge link prediction models are loaded to judge the suspected illegal transaction connectivity of the links between the target node and the neighbor nodes, and the neighbor nodes with a value greater than the threshold are extracted as risky neighbor nodes, and the unvisited nodes are pushed into the potential fraud address set; if the current potential fraud address set is empty, switch to the output stage, otherwise switch to the address judgment stage.

[0152] Specifically, a linked list structure plus a hash table search method can be used to facilitate link construction, wherein a node object is constructed for a node determined from the digital resource transaction graph data, and the node object can be regarded as the following structure:

[0153] Visited Prev Node data2

[0154] Among them, Node data2 stores the original results and node features found from the graph data, Visited is a unit Boolean value, which serves as a visit identifier, and Prev is used to store a string, which represents the previous hop of the node link (forward node information). The Prev label of the risk neighbor node with the visited label of False (i.e., not visited) selected from step 202 is set as the current target node address (for link construction), and the node address of the risk neighbor node is pushed into the potential fraud address set.

[0155] At the same time, a node search table is constructed, which can be viewed as the following structure:

[0156] Addr.N->Node object2

[0157] “->” indicates a key-value relationship, where the key is “Addr.N” representing the node address string, and the value is “Nodeobject2”. “Node object2” is used to store the node object information corresponding to the key, so that on the basis of the graph structure data, the relevant node information can be found directly through the address corresponding to the key.

[0158] Step 204, output stage.

[0159] Starting from the tail address node, the address string in its Prev field is taken out in turn, and the data object of the node is obtained in the node search table until the object with an empty Prev field (i.e., the head node of the transaction link suspected of having an illegal transaction) is obtained to output the transaction link (such as Figure 2D In this process, a link list is maintained to record the address and characteristics of each link and each hop node of the link, and finally output a link search report.

[0160] Reference Figure 3 , shows a schematic diagram of a digital resource transaction link tracking device provided by an embodiment of the present application, which may specifically include a risk address set construction module 301, a target node determination module 302, a risk neighbor node determination module 303, a risk address addition module 304, a circulation module 305, and a link output module 306, wherein:

[0161] A risk address set building module 301 is used to build a risk address set based on the received initial address;

[0162] A target node determination module 302 is used to determine the target node according to the preset digital resource transaction graph data and the risk address set;

[0163] A risk neighbor node determination module 303 is used to determine the risk neighbor nodes of the target node according to the node type of the target node;

[0164] A risk address adding module 304, configured to add the node address of the risk neighbor node to the risk address set;

[0165] A loop module 305, configured to call the target node determination module 302 when the risk address set is a non-empty set;

[0166] The link output module 306 is used to output the transaction link containing the risk neighbor node when the risk address set is an empty set.

[0167] In an optional embodiment of the present application, the device further includes:

[0168] A transaction network data acquisition module, used to acquire transaction network data of digital resources;

[0169] A node determination module, used to determine a plurality of nodes according to the transaction data;

[0170] An information determination module, used to determine the node information and transaction information of the node, and the transaction edge information between the nodes;

[0171] A digital resource transaction graph data construction module is constructed, which is used to construct digital resource transaction graph data based on the node information, transaction information and transaction edge information.

[0172] In an optional embodiment of the present application, the risk neighbor node determination module 303 includes:

[0173] A neighbor node acquisition submodule is used to acquire neighbor nodes of the target node;

[0174] A node type determination submodule, used to determine the node type of the target node based on a preset multi-classification graph neural network model;

[0175] The risk neighbor node determination submodule is used to determine the risk neighbor node among the neighbor nodes of the target node according to the node type.

[0176] In an optional embodiment of the present application, the node type determination submodule includes:

[0177] A node feature acquisition unit, configured to acquire node features of the target node; the node features include transaction information and transaction edge information corresponding to the target node;

[0178] The node type determination unit is used to classify the node features using a multi-classification graph neural network model to obtain the node type of the target node.

[0179] In an optional embodiment of the present application, the risk neighbor node determination submodule includes:

[0180] A target graph edge link neural network model determination unit, used to determine a target graph edge link neural network model corresponding to the node type from a plurality of preset graph edge link neural network models;

[0181] The risk neighbor node determination unit is used to predict the neighbor nodes of the target node using the target graph edge link neural network model to determine the risk neighbor nodes.

[0182] In an optional embodiment of the present application, the risk address adding module 304 includes:

[0183] An access identification acquisition submodule is used to acquire the access identification of the risky neighbor node; the access identification is visited or not visited;

[0184] The node address adding submodule is used to add the node address of the risk neighbor node identified as unvisited to the risk address set.

[0185] In an optional embodiment of the present application, the device further includes:

[0186] A node object information determination module, used to determine the node object information of the risk neighbor node; the node object information includes the forward node information;

[0187] A forward node information adding module, used to determine the forward node information of the risk neighbor node of the target node whose node address is the target node;

[0188] The link output module 306 is used to output the transaction link based on the node object with the link tail node as the starting point; the link tail node is a target node without any unvisited risk neighbor node.

[0189] An embodiment of the present application provides a digital resource transaction link tracking device, and by using the device, each step in the aforementioned method embodiments can be implemented.

[0190] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment part.

[0191] Reference Figure 4 , shows a schematic diagram of an electronic device provided by an embodiment of the present application. Figure 4 As shown, the electronic device 400 in the embodiment of the present application includes: a processor 410, a memory 420, and a computer program 421 stored in the memory 420 and executable on the processor 410. When the processor 410 executes the computer program 421, the steps in each embodiment of the digital resource transaction link tracking method are implemented, such as Figure 1 Alternatively, when the processor 410 executes the computer program 421, the functions of each module / unit in the above-mentioned device embodiments are realized, for example, Figure 3 Functions of modules 301 to 306 are shown.

[0192] Exemplarily, the computer program 421 may be divided into one or more modules / units, which are stored in the memory 420 and executed by the processor 410 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which may be used to describe the execution process of the computer program 421 in the electronic device 400. For example, the computer program 421 may be divided into a risk address set construction module, a target node determination module, a risk neighbor node determination module, a risk address addition module, a loop module, and a link output module, and the specific functions of each module are as follows:

[0193] A risk address set building module, used to build a risk address set based on the received initial address;

[0194] A target node determination module, used to determine the target node according to the preset digital resource transaction graph data and the risk address set;

[0195] A risk neighbor node determination module, used to determine the risk neighbor nodes of the target node according to the node type of the target node;

[0196] A risk address adding module, used for adding the node address of the risk neighbor node to the risk address set;

[0197] A loop module, configured to call the target node determination module when the risk address set is a non-empty set;

[0198] The link output module is used to output the transaction link containing the risk neighbor node when the risk address set is an empty set.

[0199] The electronic device 400 may be a computing device such as a mobile terminal, a desktop computer, a cloud server, etc. The electronic device 400 may include, but is not limited to, a processor 410 and a memory 420. Those skilled in the art will appreciate that Figure 4 It is only an example of the electronic device 400 and does not constitute a limitation of the electronic device 400. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 400 may also include input and output devices, network access devices, buses, etc.

[0200] The processor 410 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0201] The memory 420 may be an internal storage unit of the electronic device 400, such as a hard disk or memory of the electronic device 400. The memory 420 may also be an external storage device of the electronic device 400, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 400. Further, the memory 420 may also include both an internal storage unit of the electronic device 400 and an external storage device. The memory 420 is used to store the computer program 421 and other programs and data required by the electronic device 400. The memory 420 may also be used to temporarily store data that has been output or is to be output.

[0202] An embodiment of the present application further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the digital resource transaction link tracking method as described in the above-mentioned embodiments is implemented.

[0203] The embodiment of the present application also discloses a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the digital resource transaction link tracking method described in the above-mentioned embodiments.

[0204] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application is described in detail with reference to the above-mentioned embodiments, a person skilled in the art should understand that the technical solutions described in the above-mentioned embodiments can still be modified, or some of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A digital resource transaction link tracking method, characterized in that: include: Based on the received initial address, a risk address set is constructed; Determine the target node based on the preset digital resource transaction graph data and the risk address set; Determining a risky neighbor node of the target node according to the node type of the target node; Adding the node address of the risk neighbor node to the risk address set; In the case where the risk address set is a non-empty set, returning to the step of determining the target node based on the preset digital resource transaction graph data and the risk address set; When the risk address set is an empty set, a transaction link including the risk neighbor node is output.

2. The method according to claim 1, characterized in that Before determining the target node and the target node type according to the preset digital resource transaction graph data and the risk address set, the method further includes: Obtain transaction network data of digital resources; determining a plurality of nodes according to the transaction data; Determining node information, transaction information of the node, and transaction edge information between the nodes; Digital resource transaction graph data is constructed based on the node information, transaction information and transaction edge information.

3. The method according to claim 1 or 2, characterized in that: The step of determining the risk neighbor node of the target node according to the node type of the target node includes: Obtain neighbor nodes of the target node; Determine the node type of the target node according to a preset multi-classification graph neural network model; According to the node type, risky neighbor nodes are determined among neighbor nodes of the target node.

4. The method according to claim 3, characterized in that The determining the node type of the target node according to a preset multi-classification graph neural network model includes: Acquire node features of the target node; the node features include transaction information and transaction side information corresponding to the target node; A multi-classification graph neural network model is used to classify the node features to obtain the node type of the target node.

5. The method according to claim 4, characterized in that The step of determining risky neighbor nodes among neighbor nodes of the target node according to the node type includes: Determining a target graph edge link neural network model corresponding to the node type from among a plurality of preset graph edge link neural network models; The target graph edge link neural network model is used to predict the neighbor nodes of the target node to determine the risky neighbor nodes.

6. The method according to claim 1, characterized in that The adding the node address of the risk neighbor node to the risk address set includes: Obtaining an access identifier of the risky neighbor node; the access identifier is visited or not visited; The node address of the risk neighbor node identified as unvisited is added to the risk address set.

7. The method according to claim 6, characterized in that The method further comprises: Determine node object information of the risk neighbor node; the node object information includes forward tracing node information; Determine that the node address of the target node is the forward node information of the risk neighbor node of the target node; The output includes the transaction link of the risk neighbor node, including: Taking the tail node of the link as the starting point, the transaction link is output according to the node object; the tail node of the link is the target node without any unvisited risk neighbor node.

8. A digital resource transaction link tracking device, characterized in that: include: A risk address set building module, used to build a risk address set based on the received initial address; A target node determination module, used to determine the target node according to the preset digital resource transaction graph data and the risk address set; A risk neighbor node determination module, used to determine the risk neighbor nodes of the target node according to the node type of the target node; A risk address adding module, used for adding the node address of the risk neighbor node to the risk address set; A loop module, used for returning the step of determining the target node based on the preset digital resource transaction graph data and the risk address set when the risk address set is a non-empty set; The link output module is used to output the transaction link containing the risk neighbor node when the risk address set is an empty set.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the digital resource transaction link tracking method as described in any one of claims 1-7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the digital resource transaction link tracking method as described in any one of claims 1 to 7 is implemented.

Images