A digital resource transaction link tracking method, device, equipment and storage medium

Abstract

The embodiment of the present application is applicable to the field of blockchain technology and provides a digital resource transaction link tracking method, device, equipment and storage medium. The method includes: constructing a risk address set based on the received initial address; determining the target node based on the preset digital resource transaction graph data and the risk address set; determining the risk neighbor node of the target node based on the node type of the target node; adding the node address of the risk neighbor node to the risk address set; if the risk address set is a non-empty set, returning to the step of determining the target node based on the preset digital resource transaction graph data and the risk address set; if the risk address set is an empty set, outputting the transaction link containing the risk neighbor node. The embodiment of the present application can realize searching for the received initial address and outputting the transaction link containing the suspected illegal transaction address.

Description

Technical Field

[0001] The embodiments of the present application belong to the field of blockchain technology, and in particular relate to a method, apparatus, device, and storage medium for tracking a digital resource transaction link. Background Art

[0002] With the rapid development of blockchain technology, digital resource trading has become an emerging and vibrant field. Blockchain technology is a distributed ledger that maintains a secure, transparent, and tamper-proof data record in a decentralized manner. This technology is widely used in various fields, such as finance, supply chain management, and intellectual property protection. Digital resource trading utilizes blockchain technology to digitize, confirm ownership, trade, and track assets, thereby improving transaction efficiency and security. However, the existence of illegal trading accounts poses a serious security threat to this sector. These accounts often exploit the anonymity of blockchain to conduct illegal activities.

[0003] In the related art, illegal transaction accounts are searched through extensive scanning of transaction data of digital resources. This method can only scan nodes that meet a single feature and consumes a lot of time and computing resources.

[0004] How to quickly and effectively detect illegal trading accounts is very important for maintaining the security of digital resource transactions. Summary of the Invention

[0005] In view of this, embodiments of the present application provide a digital resource transaction link tracking method, apparatus, device, and storage medium to improve the efficiency of searching for suspected illegal transaction links in a digital resource transaction network.

[0006] A first aspect of an embodiment of the present application provides a method for tracking a digital resource transaction link, comprising:

[0007] Based on the received initial address, a risk address set is constructed;

[0008] Determine the address to be searched from the pre-built risk address set;

[0009] Determine the target node based on the preset digital resource transaction graph data and the risk address set;

[0010] Determining risky neighbor nodes of the target node according to the node type of the target node;

[0011] Adding the node address of the risk neighbor node to the risk address set;

[0012] When the risk address set is a non-empty set, returning to the step of determining the target node based on the preset digital resource transaction graph data and the risk address set;

[0013] When the risk address set is an empty set, the transaction link containing the risk neighbor node is output.

[0014] In a possible implementation of the first aspect, before determining the target node and the target node type based on the preset digital resource transaction graph data and the risk address set, the method further includes:

[0015] Obtain transaction network data of digital resources;

[0016] determining a plurality of nodes based on the transaction data;

[0017] Determining node information, transaction information of the node, and transaction edge information between the nodes;

[0018] Digital resource transaction graph data is constructed based on the node information, transaction information, and transaction edge information.

[0019] In a possible implementation manner of the first aspect, determining the risky neighbor node of the target node based on the node type of the target node includes:

[0020] Obtaining neighbor nodes of the target node;

[0021] Determine the node type of the target node based on a preset multi-classification graph neural network model;

[0022] According to the node type, risky neighbor nodes are determined among neighbor nodes of the target node.

[0023] In a possible implementation of the first aspect, determining the node type of the target node based on a preset multi-classification graph neural network model includes:

[0024] Obtaining node features of the target node; the node features include transaction information and transaction side information corresponding to the target node;

[0025] A multi-classification graph neural network model is used to classify the node features to obtain the node type of the target node.

[0026] In a possible implementation manner of the first aspect, determining, based on the node type, a risky neighbor node among neighbor nodes of the target node includes:

[0027] Determining a target graph edge link neural network model corresponding to the node type from a plurality of preset graph edge link neural network models;

[0028] The target graph edge link neural network model is used to predict the neighbor nodes of the target node to determine the risky neighbor nodes.

[0029] In a possible implementation manner of the first aspect, adding the node address of the risky neighbor node to the risky address set includes:

[0030] Obtaining an access identifier of the risky neighbor node; the access identifier is visited or not visited;

[0031] The node address of the risk neighbor node identified as unvisited is added to the risk address set.

[0032] In a possible implementation of the first aspect, the method further includes:

[0033] Determine node object information of the risk neighbor node; the node object information includes forwarding node information;

[0034] Determine that the node address of the target node is the forward node information of the risk neighbor node of the target node;

[0035] The output of the transaction link including the risk neighbor node includes:

[0036] Taking the tail node of the link as the starting point, the transaction link is output according to the node object; the tail node of the link is the target node that does not have any unvisited risk neighbor nodes.

[0037] A second aspect of an embodiment of the present application provides a digital resource transaction link tracking device, comprising:

[0038] A risky address set construction module, used to construct a risky address set based on the received initial address;

[0039] A target node determination module, configured to determine a target node based on preset digital resource transaction graph data and the risk address set;

[0040] A risk neighbor node determination module, configured to determine the risk neighbor nodes of the target node according to the node type of the target node;

[0041] A risk address adding module, configured to add the node address of the risk neighbor node to the risk address set;

[0042] a loop module, configured to call the target node determination module when the risk address set is a non-empty set;

[0043] The link output module is used to output the transaction link containing the risk neighbor node when the risk address set is an empty set.

[0044] In a possible implementation of the second aspect, the apparatus further includes:

[0045] A transaction network data acquisition module, used to acquire transaction network data of digital resources;

[0046] A node determination module, configured to determine a plurality of nodes based on the transaction data;

[0047] An information determination module, configured to determine node information and transaction information of the node, and transaction edge information between the nodes;

[0048] Construct a digital resource transaction graph data construction module, which is used to construct digital resource transaction graph data based on the node information, transaction information and transaction edge information.

[0049] In a possible implementation of the second aspect, the risky neighbor node determining module includes:

[0050] A neighbor node acquisition submodule is used to acquire neighbor nodes of the target node;

[0051] A node type determination submodule is used to determine the node type of the target node based on a preset multi-classification graph neural network model;

[0052] The risk neighbor node determination submodule is configured to determine risk neighbor nodes among neighbor nodes of the target node according to the node type.

[0053] In a possible implementation of the second aspect, the node type determination submodule includes:

[0054] A node feature acquisition unit, configured to acquire node features of the target node; the node features include transaction information and transaction side information corresponding to the target node;

[0055] The node type determination unit is used to classify the node features using a multi-classification graph neural network model to obtain the node type of the target node.

[0056] In a possible implementation of the second aspect, the risky neighbor node determination submodule includes:

[0057] a target graph edge link neural network model determining unit, configured to determine a target graph edge link neural network model corresponding to the node type from among a plurality of preset graph edge link neural network models;

[0058] The risk neighbor node determination unit is used to predict the neighbor nodes of the target node using the target graph edge link neural network model to determine the risk neighbor nodes.

[0059] In a possible implementation of the second aspect, the risky address adding module includes:

[0060] An access identifier acquisition submodule is used to acquire the access identifier of the risky neighbor node; the access identifier can be visited or not visited;

[0061] The node address adding submodule is used to add the node address of the risk neighbor node identified as unvisited to the risk address set.

[0062] In a possible implementation of the second aspect, the apparatus further includes:

[0063] A node object information determination module, configured to determine node object information of a risky neighbor node; the node object information includes forwarding node information;

[0064] A forward node information adding module, configured to determine that the node address of the target node is forward node information of a risk neighbor node of the target node;

[0065] The link output module is used to output the transaction link based on the node object with the link tail node as the starting point; the link tail node is a target node that does not have any unvisited risk neighbor nodes.

[0066] A third aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the digital resource transaction link tracking method as described in the first aspect above is implemented.

[0067] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the digital resource transaction link tracking method as described in the first aspect above is implemented.

[0068] A fifth aspect of an embodiment of the present application provides a computer program product, which, when executed on a computer, enables the computer to execute the digital resource transaction link tracking method described in the first aspect.

[0069] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0070] In an embodiment of the present application, a risk address set is constructed based on the received initial address; a target node is determined according to preset digital resource transaction graph data and the risk address set; a risk neighbor node of the target node is determined according to the node type of the target node; the node address of the risk neighbor node is added to the risk address set; when the risk address set is a non-empty set, the step of determining the target node according to the preset digital resource transaction graph data and the risk address set is returned; when the risk address set is an empty set, a transaction link containing the risk neighbor node is output, thereby realizing a search for the received initial address, starting from the node corresponding to the initial address in the digital resource transaction graph data, searching for risk neighbor nodes suspected of having illegal transactions according to the node type, adding the addresses of the risk neighbor nodes to the risk address set, and then searching for risk neighbor nodes for the addresses in the risk address set to mine more nodes suspected of having illegal transactions, and when it is determined that there are no more risk neighbor nodes, outputting a transaction link containing the risk neighbor node, thereby displaying a complete transaction link containing a suspected illegal transaction address. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] To more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0072] Figure 1 This is a schematic diagram of a digital resource transaction link tracking method provided by an embodiment of the present application;

[0073] Figure 2A This is a diagram of digital resource transaction network data provided by an embodiment of the present application;

[0074] Figure 2B This is a schematic diagram of digital resource transaction graph data provided by an embodiment of the present application;

[0075] Figure 2C This is another digital resource transaction graph data diagram provided by an embodiment of the present application;

[0076] Figure 2D This is a transaction link diagram provided by an embodiment of the present application;

[0077] Figure 3 This is a schematic diagram of a digital resource transaction link tracking device provided by an embodiment of the present application;

[0078] Figure 4This is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0079] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0080] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0081] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0082] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0083] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0084] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0085] Blockchain is an application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Blockchain is essentially a decentralized, distributed database that records transactions by creating a decentralized, tamper-proof system. Specifically, data on a blockchain is managed and stored using blocks as the basic unit. Blocks consist of multiple data structures that store different types of information. For example, a block can be divided into a header and a body. The header stores data such as a modifiable temporary random number, the hash value of the previous block, a timestamp, the difficulty of creating the block, and the root of the transaction tree. The body stores valid transactions. When blocks containing transaction data are linked in an orderly manner, a blockchain is formed.

[0086] Digital resources are digitized assets or rights based on blockchain technology. Digital resources can be traded (or exchanged) on designated platforms. These platforms, built on blockchain technology, ensure the security and reliability of digital resource transactions. Different digital resources can be traded on different platforms. Users can trade digital resources using accounts on the platform, each represented by a unique address.

[0087] As an example, the trading platform for digital resources may be a decentralized exchange (DecentralizedExchange).

[0088] The technical solution of this application is described below through specific embodiments.

[0089] Reference Figure 1 , which shows a schematic diagram of a digital resource transaction link tracking method provided by an embodiment of the present application, which may specifically include the following steps:

[0090] Step 101: construct a risk address set based on the received initial address;

[0091] The initial address can be obtained in a preset way, and a risk address set including the initial address can be constructed, and suspected illegal transaction accounts can be searched for the risk address set.

[0092] As an example, the preset method may be to use the address received in the designated information input area as the initial address and to construct a risk address set including the initial address.

[0093] For example, the designated information output area is a webpage or client page. The user enters one or more strings that match the address format of a specified account in the information input area, and uses these strings as initial addresses. A risky address set is constructed using these initial addresses as seed addresses. It is understood that these initial addresses are addresses of suspected illegal trading accounts.

[0094] Step 102: determining a target node based on the preset digital resource transaction graph data and the risk address set;

[0095] Before step 102 , digital resource transaction graph data is pre-constructed. The digital resource transaction graph data includes multiple nodes, and one node corresponds to the address of one account.

[0096] At least one node corresponding to the risk address set in the digital resource transaction graph data is a target node, and a suspected illegal transaction node (i.e., suspected illegal transaction address) is searched based on the target node.

[0097] As an example, step 102 may include: determining the address to be searched in a pre-constructed risk address set; and determining the target node corresponding to the address to be searched based on the preset digital resource transaction graph data. There may be one or more addresses in the risk address set, and the address to be searched can be determined from the risk address set. The embodiment of the present application does not limit the manner in which the address to be searched is determined in the risk address set. For example: in a random manner (randomly determining an address in the risk address set as the address to be searched), or in a chronological order (determining the one in the risk address set that was added to the risk address set the earliest). After determining the address to be searched, the digital resource transaction graph data is searched to determine the node corresponding to the address to be searched as the target node.

[0098] Step 103: determining risky neighbor nodes of the target node based on the node type of the target node;

[0099] The neighbor nodes of each node contained in the digital resource transaction graph data can be determined. Therefore, after the target node is determined, the neighbor nodes of the target node can be determined.

[0100] In the embodiment of the present application, several node types are pre-set. After determining the node type of the target node, the risky neighbor node (suspected illegal transaction-related address) is determined according to the node type, thereby avoiding large-scale neighbor node search operations and improving search efficiency.

[0101] As an example, node types may include high-risk nodes, low-risk nodes, and no-risk nodes. Furthermore, high-risk nodes may be divided into multiple subtypes to match different types of illegal transactions.

[0102] Step 104: adding the node address of the risky neighbor node to the risky address set;

[0103] After identifying risky neighbor nodes, it is necessary to further determine whether the neighbor nodes of the risky neighbor nodes are also risky neighbor nodes. Therefore, the node addresses corresponding to the risky neighbor nodes can be added to the risk address set to update the risk address set. For example, if target node A includes neighbor nodes B, C, D, and E, and after determining the node type of target node A, neighbor nodes D and E are determined to be risky neighbor nodes, the node addresses of neighbor nodes D and E are added to the risk address set.

[0104] In actual applications, the address of the same node only needs to be added to the risk address set once. There is no need to repeatedly add multiple addresses to the risk address set to avoid consuming unnecessary computing resources.

[0105] Step 105: If the risk address set is a non-empty set, return to step 102;

[0106] If the current risk set is a non-empty set, that is, there is at least one address in the current risk set, then return to step 102 to search for risk neighbor nodes for the addresses in the risk set, so that a more complete transaction chain can be constructed later.

[0107] Step 106: When the risk address set is an empty set, output the transaction link containing the risk neighbor node.

[0108] When the risk address set is empty, meaning no address exists in the current risk set, indicating that no further risk neighbor nodes exist, the search for risk neighbor nodes is complete. The transaction chain containing the risk neighbor nodes is then output, thereby outputting the transaction chain associated with the illegal transaction address. It is understood that at least one risk neighbor node is a neighbor node of the node corresponding to the initial address, and therefore the node corresponding to the initial address is also located on the transaction chain. This embodiment of the present application implements a search for a transaction chain containing a suspected illegal transaction address, starting with the initial address.

[0109] In an embodiment of the present application, a risk address set is constructed based on the received initial address; a target node is determined according to the preset digital resource transaction graph data and the risk address set; a risk neighbor node of the target node is determined according to the node type of the target node; the node address of the risk neighbor node is added to the risk address set; when the risk address set is a non-empty set, the step of determining the target node according to the preset digital resource transaction graph data and the risk address set is returned; when the risk address set is an empty set, a transaction link containing the risk neighbor node is output, thereby realizing a search for the received initial address, starting from the node corresponding to the initial address in the digital resource transaction graph data, searching for risk neighbor nodes suspected of having illegal transactions according to the node type, adding the addresses of the risk neighbor nodes to the risk address set, and then searching for risk neighbor nodes for the addresses in the risk address set to mine more nodes suspected of having illegal transactions, and when it is determined that there are no more risk neighbor nodes, outputting the transaction link containing the risk neighbor node, so that a complete transaction link containing a suspected illegal transaction address can be displayed.

[0110] In an optional embodiment of the present application, before determining the target node and the target node type based on the preset digital resource transaction graph data and the risk address set, the method also includes: obtaining transaction network data of the digital resource; determining multiple nodes based on the transaction data; determining the node information, transaction information, and transaction edge information between the nodes; and constructing the digital resource transaction graph data based on the node information, transaction information, and transaction edge information.

[0111] The transaction network data of digital resources can be obtained through the digital resource transaction platform, and then the various nodes contained in the transaction network data can be determined. Each node corresponds to a transaction address (that is, the address of the account), and the node information, transaction information, and transaction side information between the nodes where the transaction occurs can be determined. Among them, the node information includes information for identifying the node; the transaction information includes transaction characteristics corresponding to the node, and the transaction characteristics may include one or more of the number of transactions, the total transaction amount, the transaction mean, the distribution of transaction objects, and the transaction input and output ratio; the transaction side information includes the transaction side characteristics corresponding to the node, and the transaction side characteristics may include one or more of the addresses of the two transaction parties (nodes), the transaction subject (for example: transaction currency), the transaction status, the transaction amount, the transaction hash, and the transaction time. Digital resource transaction graph data is generated through the node information, transaction information, and transaction side information of each node. In an optional embodiment of the present application, step 103 includes:

[0112] Sub-step 1031, obtaining neighbor nodes of the target node;

[0113] Each node in the digital resource transaction graph is connected to its neighbor nodes through transaction edges. When two nodes correspond to the same transaction edge characteristics, that is, when the two nodes have directly traded with each other (one-hop transaction), the two nodes are neighbors. After determining the target node, its neighbor nodes can be determined based on the target node's transaction edge information.

[0114] Sub-step 1032, determining the node type of the target node according to a preset multi-classification graph neural network model;

[0115] Identify the node type of the target node based on the trained multi-classification graph neural network model.

[0116] As an example, we can label several nodes of known node types, divide them into training sets and test sets, and perform multiple iterative training and accuracy verification on the graph neural network model on the training set and test set respectively to obtain a multi-classification graph neural network model. The multi-classification graph neural network model can accurately output the node type of the node.

[0117] In the specific implementation, the multi-classification graph neural network model can adopt graph neural network models based on neighbor feature sampling and aggregation, such as GCN (Graph Convolutional Network) and GraphSAGE (Graph Sample and Aggregated).

[0118] Sub-step 1033 : determining risky neighbor nodes among neighbor nodes of the target node according to the node type.

[0119] Combined with the node type of the target node, the risky neighbor nodes are determined among the neighbor nodes of the target node, thereby realizing the identification of neighbor link relationships of different types of nodes and improving the accuracy and reliability of risky neighbor node identification.

[0120] In an optional embodiment of the present application, step 1032 includes:

[0121] Sub-step 10321: obtaining node characteristics of the target node; the node characteristics include transaction information and transaction side information corresponding to the target node;

[0122] As can be seen above, the digital resource transaction graph data contains the transaction information and transaction side information corresponding to the node, which are used as the node characteristics. After determining the target node, the node characteristics of the target node can be read through the digital resource transaction graph data.

[0123] Sub-step 10322: Use a multi-classification graph neural network model to classify the node features to obtain the node type of the target node.

[0124] The node features of the target node are input into the multi-classification graph neural network model, and the multi-classification graph neural network model can output the node type of the target node.

[0125] In an optional embodiment of the present application, sub-step 1033 includes:

[0126] Sub-step 10331, determining a target graph edge link neural network model corresponding to the node type from a plurality of preset graph edge link neural network models;

[0127] For different node types, multiple graph edge link neural network models corresponding to the node types are pre-trained.

[0128] In practical applications, the graph edge link neural network model can adopt feature prediction and classification models such as MLP (Multilayer Perceptron) and Transformer (a network model based on the self-attention mechanism), and train the model according to the known node types between nodes to obtain graph edge link neural network models corresponding to different node types.

[0129] Sub-step 10332: Use the target graph edge link neural network model to predict the neighbor nodes of the target node to determine the risky neighbor nodes.

[0130] The target graph edge link neural network model corresponding to the node type of the target node is used to predict the link relationship between the target node and the neighbor nodes, thereby identifying whether the neighbor node is a risky neighbor node.

[0131] Specifically, the target graph edge link neural network model can output corresponding evaluation values ​​for the neighbor nodes of the target node, and determine the neighbor nodes with evaluation values ​​greater than a preset threshold as risky neighbor nodes.

[0132] In an optional embodiment of the present application, step 104 includes:

[0133] Step 1041: Obtain the access identifier of the risky neighbor node; the access identifier can be visited or not visited;

[0134] The access identifier of the risky neighbor node can be read. If the access identifier is visited, it means that the risky neighbor node has been previously determined as a target node and its risky neighbor nodes have been searched.

[0135] Step 1042: Add the node address of the risk neighbor node identified as unvisited to the risk address set.

[0136] If the access mark is "not visited", it means that the risk neighbor node has not been searched for its risk neighbor node with the risk neighbor node as the target node. The node address of the risk neighbor node is added to the risk address set so that the risk neighbor node can be searched for the node address in the future, so that the subsequent output transaction chain is more complete. At the same time, for the risk neighbor node whose access mark is "visited", its node address is not added to the risk address set to avoid searching for risk neighbor nodes for the same node multiple times, which causes a waste of computing resources.

[0137] In an optional embodiment of the present application, the method further includes:

[0138] Determine the node object information of the risk neighbor node; the node object information includes the forward node information; determine that the node address of the target node is the forward node information of the risk neighbor node of the target node;

[0139] Outputting the transaction link including the risk neighbor node includes: starting from the tail node of the link and outputting the transaction link according to the node object; the tail node of the link is a target node without any unvisited risk neighbor node.

[0140] In an embodiment of the present application, after determining the risk neighbor node, node object information is constructed for the risk neighbor node, and the node object information includes but is not limited to an access identifier and forward node information, and the node address of the current target node is determined as the forward node information of the risk neighbor node.

[0141] If the current target node does not have a risky neighbor node, it means that the current target node is the tail node of a transaction link. Based on the currently stored node object, the transaction link in which it is located can be output starting from the tail node of the link.

[0142] For example: when determining node E as the target node, node F is determined to be an unvisited risk neighbor node, then the address of node E is the forward node information of node F; when determining node F as the target node, node G is determined to be an unvisited risk neighbor node, then the address of node F is the forward node information of node G; when determining node G as the target node, there is no unvisited risk neighbor node, then node G is determined to be the tail node of the link, node F is determined based on the forward node information of node G, and node E is determined through the forward node information of node F, then the transaction link containing node G-node F-node E is output.

[0143] The following is an example to further illustrate the embodiment of the present application:

[0144] Before searching for transaction links containing suspected illegal transaction addresses, obtain digital resource transaction network data (such as Figure 2AA digital resource transaction network data diagram provided by the embodiment of the present application is shown in FIG), and is constructed as a digital resource transaction graph data with node and edge features (such as Figure 2B A digital resource transaction graph data diagram provided in an embodiment of the present application is shown).

[0145] After constructing the digital resource transaction graph data, steps 201-204 are executed through a multi-role state machine to output the transaction link. Depending on the node address type, the state machine switches its role to accommodate different search methods. Node types can include high-risk nodes, low-risk nodes, and risk-free nodes. Furthermore, high-risk nodes can be divided into multiple subtypes, including illegal transaction nodes, upstream nodes, and downstream nodes. (As an example, illegal transaction nodes include illegal money laundering group nodes, upstream funding source nodes, and downstream group nodes.)

[0146] Step 201: address input stage.

[0147] Wait for the user to enter the suspected illegal transaction node address. When the user enters the suspected illegal transaction address, a potential fraud address set is constructed and the address judgment phase is switched. For example, the suspected illegal transaction node address entered by the user is TK6SJ*****************************Bo26 (in actual application, * can be letters or numbers).

[0148] Step 202: address determination stage.

[0149] The search address is located on the digital resource transaction graph data, and the node corresponding to the current address is obtained (such as Figure 2C In another digital resource transaction graph data schematic provided by an embodiment of the present application, the node shown in the dotted box and its neighboring nodes and the transaction edges between the current node and the neighboring nodes (such as Figure 2CAnother digital resource transaction graph data diagram provided by an embodiment of the present application (as shown by the dotted arrow), the transaction features of the target node and all transaction edge features within 1 hop are extracted and aggregated as the node features of the target node, and the target node is classified by a pre-trained multi-classification graph neural network method to obtain the node type, and the neighbor link judgment stage of different roles is switched according to the different node types. For example: take out an address to be searched, and construct the Cypher statements "MATCH(a:account{vid:'TK6SJ*****************************Bo26'})RETURN a" and "MATCH(account{vid:'TK6SJ*****************************Bo26'})-[t:transaction]->(account)RETURN t" respectively, and query the graph database to obtain the node information and all transaction information.

[0150] Step 203: Neighbor link determination phase.

[0151] According to different node role classifications, different edge link prediction models are loaded to judge the suspected illegal transaction connectivity of the links between the target node and the neighboring nodes, and the neighboring nodes with a value greater than the threshold are extracted as risky neighboring nodes, and the unvisited nodes are pushed into the potential fraud address set; if the current potential fraud address set is empty, it switches to the output stage, otherwise it switches to the address judgment stage.

[0152] Specifically, a linked list structure plus a hash table search method can be used to facilitate link construction, wherein a node object is constructed for a node determined from the digital resource transaction graph data. The node object can be viewed as the following structure:

[0153] Visited Prev Node data2

[0154] Node data2 stores the original results and node features found in the graph data. Visited is a single Boolean value that serves as a visit identifier. Prev is used to store a string representing the previous hop of the node link (previous node information). The Prev label of the risky neighbor node filtered out in step 202 and with a visited label of False (i.e., not visited) is set as the current target node address (for link construction), and the node address of the risky neighbor node is pushed into the set of potential fraudulent addresses.

[0155] At the same time, a node search table is constructed, which can be viewed as the following structure:

[0156] Addr.N->Node object2

[0157] “->” represents a key-value relationship, where the key is “Addr.N” representing the node address string, and the value is “Nodeobject2”. “Node object2” is used to store the node object information corresponding to the key, so that based on the graph structure data, the relevant node information can be directly found through the address corresponding to the key.

[0158] Step 204, output stage.

[0159] Starting from the tail address node, the address string in its Prev field is taken out in turn, and the data object of the node is obtained in the node search table until the object with an empty Prev field is obtained (that is, the first node of the transaction link suspected of having an illegal transaction) to output the transaction link (such as Figure 2D In this process, a link list is maintained, recording the address and characteristics of each link and each hop node in the link, and finally outputting a link search report.

[0160] Reference Figure 3 , shows a schematic diagram of a digital resource transaction link tracking device provided by an embodiment of the present application, which may specifically include a risk address set construction module 301, a target node determination module 302, a risk neighbor node determination module 303, a risk address addition module 304, a circulation module 305, and a link output module 306, wherein:

[0161] A risky address set building module 301 is used to build a risky address set based on the received initial address;

[0162] A target node determination module 302 is configured to determine a target node based on preset digital resource transaction graph data and the risk address set;

[0163] A risk neighbor node determination module 303 is configured to determine risk neighbor nodes of the target node based on the node type of the target node;

[0164] A risk address adding module 304 is configured to add the node address of the risk neighbor node to the risk address set;

[0165] A loop module 305 is configured to call the target node determination module 302 when the risk address set is a non-empty set;

[0166] The link output module 306 is configured to output a transaction link including the risk neighbor node when the risk address set is an empty set.

[0167] In an optional embodiment of the present application, the device further includes:

[0168] A transaction network data acquisition module, used to acquire transaction network data of digital resources;

[0169] A node determination module, configured to determine a plurality of nodes based on the transaction data;

[0170] An information determination module, configured to determine node information and transaction information of the node, and transaction edge information between the nodes;

[0171] Construct a digital resource transaction graph data construction module, which is used to construct digital resource transaction graph data based on the node information, transaction information and transaction edge information.

[0172] In an optional embodiment of the present application, the risky neighbor node determination module 303 includes:

[0173] A neighbor node acquisition submodule is used to acquire neighbor nodes of the target node;

[0174] A node type determination submodule is used to determine the node type of the target node based on a preset multi-classification graph neural network model;

[0175] The risk neighbor node determination submodule is configured to determine risk neighbor nodes among neighbor nodes of the target node according to the node type.

[0176] In an optional embodiment of the present application, the node type determination submodule includes:

[0177] A node feature acquisition unit, configured to acquire node features of the target node; the node features include transaction information and transaction side information corresponding to the target node;

[0178] The node type determination unit is used to classify the node features using a multi-classification graph neural network model to obtain the node type of the target node.

[0179] In an optional embodiment of the present application, the risky neighbor node determination submodule includes:

[0180] a target graph edge link neural network model determining unit, configured to determine a target graph edge link neural network model corresponding to the node type from among a plurality of preset graph edge link neural network models;

[0181] The risk neighbor node determination unit is used to predict the neighbor nodes of the target node using the target graph edge link neural network model to determine the risk neighbor nodes.

[0182] In an optional embodiment of the present application, the risk address adding module 304 includes:

[0183] An access identifier acquisition submodule is used to acquire the access identifier of the risky neighbor node; the access identifier can be visited or not visited;

[0184] The node address adding submodule is used to add the node address of the risk neighbor node identified as unvisited to the risk address set.

[0185] In an optional embodiment of the present application, the device further includes:

[0186] A node object information determination module, configured to determine node object information of a risky neighbor node; the node object information includes forwarding node information;

[0187] A forward node information adding module, configured to determine that the node address of the target node is forward node information of a risk neighbor node of the target node;

[0188] The link output module 306 is configured to output a transaction link based on the node object with the link tail node as the starting point; the link tail node is a target node that does not have any unvisited risk neighbor nodes.

[0189] An embodiment of the present application provides a digital resource transaction link tracking device, and the application of this device can implement each step in the aforementioned method embodiments.

[0190] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment part.

[0191] Reference Figure 4 , shows a schematic diagram of an electronic device provided by an embodiment of the present application. Figure 4 As shown, the electronic device 400 in the embodiment of the present application includes: a processor 410, a memory 420, and a computer program 421 stored in the memory 420 and executable on the processor 410. When the processor 410 executes the computer program 421, the steps in each embodiment of the digital resource transaction link tracking method described above are implemented, such as Figure 1 Alternatively, when the processor 410 executes the computer program 421, the functions of the modules / units in the above-mentioned device embodiments are realized, for example, Figure 3 Functions of modules 301 to 306 are shown.

[0192] Exemplarily, the computer program 421 can be divided into one or more modules / units, which are stored in the memory 420 and executed by the processor 410 to complete the present application. The one or more modules / units can be a series of computer program instruction segments that can perform specific functions, and the instruction segments can be used to describe the execution process of the computer program 421 in the electronic device 400. For example, the computer program 421 can be divided into a risk address set construction module, a target node determination module, a risk neighbor node determination module, a risk address addition module, a loop module, and a link output module. The specific functions of each module are as follows:

[0193] A risky address set construction module, used to construct a risky address set based on the received initial address;

[0194] A target node determination module, configured to determine a target node based on preset digital resource transaction graph data and the risk address set;

[0195] A risk neighbor node determination module, configured to determine the risk neighbor nodes of the target node according to the node type of the target node;

[0196] A risk address adding module, configured to add the node address of the risk neighbor node to the risk address set;

[0197] a loop module, configured to call the target node determination module when the risk address set is a non-empty set;

[0198] The link output module is used to output the transaction link containing the risk neighbor node when the risk address set is an empty set.

[0199] The electronic device 400 may be a computing device such as a mobile terminal, a desktop computer, a cloud server, etc. The electronic device 400 may include, but is not limited to, a processor 410 and a memory 420. It will be understood by those skilled in the art that Figure 4 It is only an example of the electronic device 400 and does not constitute a limitation of the electronic device 400. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 400 may also include input and output devices, network access devices, buses, etc.

[0200] The processor 410 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0201] The memory 420 may be an internal storage unit of the electronic device 400, such as a hard disk or memory of the electronic device 400. The memory 420 may also be an external storage device of the electronic device 400, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 400. Furthermore, the memory 420 may include both an internal storage unit of the electronic device 400 and an external storage device. The memory 420 is used to store the computer program 421 and other programs and data required by the electronic device 400. The memory 420 may also be used to temporarily store data that has been output or is about to be output.

[0202] An embodiment of the present application further discloses a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the digital resource transaction link tracking method described in the aforementioned embodiments is implemented.

[0203] An embodiment of the present application further discloses a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the digital resource transaction link tracking method described in each of the aforementioned embodiments.

[0204] The above embodiments are intended only to illustrate the technical solutions of the present application and are not intended to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they may still modify the technical solutions described in the above embodiments or replace some of the technical features therein with equivalents; and such modifications or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present application and should be included within the scope of protection of the present application.

Claims

1. A digital resource transaction link tracking method, characterized in that: include: Based on the received initial address, a risk address set is constructed; Determine the target node based on the preset digital resource transaction graph data and the risk address set; Determining risky neighbor nodes of the target node according to the node type of the target node; Adding the node address of the risk neighbor node to the risk address set; When the risk address set is a non-empty set, returning to the step of determining the target node based on the preset digital resource transaction graph data and the risk address set; When the risk address set is an empty set, the transaction link containing the risk neighbor node is output.

2. The method according to claim 1, characterized in that Before determining the target node and the target node type based on the preset digital resource transaction graph data and the risk address set, the method further includes: Obtain transaction network data of digital resources; determining a plurality of nodes based on the transaction data; Determining node information, transaction information of the node, and transaction edge information between the nodes; Digital resource transaction graph data is constructed based on the node information, transaction information, and transaction edge information.

3. The method according to claim 1 or 2, characterized in that The determining of the risky neighbor nodes of the target node according to the node type of the target node includes: Obtaining neighbor nodes of the target node; Determine the node type of the target node based on a preset multi-classification graph neural network model; According to the node type, risky neighbor nodes are determined among neighbor nodes of the target node.

4. The method according to claim 3, characterized in that The determining the node type of the target node based on a preset multi-classification graph neural network model includes: Obtaining node features of the target node; the node features include transaction information and transaction side information corresponding to the target node; A multi-classification graph neural network model is used to classify the node features to obtain the node type of the target node.

5. The method according to claim 4, characterized in that The determining, based on the node type, risky neighbor nodes among neighbor nodes of the target node includes: Determining a target graph edge link neural network model corresponding to the node type from a plurality of preset graph edge link neural network models; The target graph edge link neural network model is used to predict the neighbor nodes of the target node to determine the risky neighbor nodes.

6. The method according to claim 1, characterized in that The adding the node address of the risk neighbor node to the risk address set includes: Obtaining an access identifier of the risky neighbor node; the access identifier is visited or not visited; The node address of the risk neighbor node identified as unvisited is added to the risk address set.

7. The method according to claim 6, characterized in that The method further comprises: Determine node object information of the risk neighbor node; the node object information includes forwarding node information; Determine that the node address of the target node is the forward node information of the risk neighbor node of the target node; The output of the transaction link including the risk neighbor node includes: Taking the tail node of the link as the starting point, the transaction link is output according to the node object; the tail node of the link is the target node that does not have any unvisited risk neighbor nodes.

8. A digital resource transaction link tracking device, characterized in that: include: A risky address set construction module, used to construct a risky address set based on the received initial address; A target node determination module, configured to determine a target node based on preset digital resource transaction graph data and the risk address set; A risk neighbor node determination module, configured to determine the risk neighbor nodes of the target node according to the node type of the target node; A risk address adding module, configured to add the node address of the risk neighbor node to the risk address set; A loop module, configured to return to the step of determining a target node based on the preset digital resource transaction graph data and the risk address set when the risk address set is a non-empty set; The link output module is used to output the transaction link containing the risk neighbor node when the risk address set is an empty set.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the digital resource transaction link tracking method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the digital resource transaction link tracking method according to any one of claims 1 to 7 is implemented.

Images