Method and system for monitoring malicious transactions on Ethereum

Abstract

The invention discloses a method and system for monitoring malicious transactions on Ethereum, and the method comprises the following operation steps: collecting a large amount of transaction data from an Ethereum network, including normal transactions and malicious transactions; carrying out preliminary preprocessing on the collected transaction data, listing various data, and making a corresponding data table; a transaction graph is constructed according to transaction data, each node represents an account, each edge represents a transaction, in the transaction graph, each node has some characteristics, and a corresponding label is marked for each malicious transaction so as to facilitate subsequent model training. According to the method and the system for monitoring the malicious transactions on the Ethereum, automatic detection of the malicious transactions is realized through a deep learning technology, the defect of manual rule making is avoided, meanwhile, various types of malicious transactions can be adaptively identified, and various evasion means adopted by attackers can be effectively identified.

Description

Technical Field

[0001] The present invention relates to the technical field of Ethereum transaction supervision, and in particular to a method and system for monitoring malicious transactions on Ethereum. Background Art

[0002] Ethereum is a cryptocurrency platform based on blockchain technology. In Ethereum, users can create smart contracts through which various transactions can be carried out. Smart contracts are one of the core features of Ethereum, which can realize automated transactions and contract execution on the Ethereum blockchain. Smart contracts can be used to implement various business logics, such as transactions, data storage, and user authentication. However, due to the programmability of smart contracts, some vulnerabilities or errors may cause unexpected behaviors in contract execution, which may lead to security issues such as financial losses or data leaks.

[0003] Malicious contracts are a special type of smart contract whose purpose is to deceive users and profit from them. Malicious contracts usually perform unexpected actions by exploiting vulnerabilities or other security issues in the contract code, such as stealing user assets or forging transactions. Another common attack is the reentrancy attack, which enables attackers to bypass the security checks of the contract and gain improper benefits by repeatedly executing certain functions in the contract.

[0004] There are some problems with rule-based detection methods in monitoring malicious transactions. First, the types and patterns of malicious transactions change over time and with the advancement of attackers' technology, so detection rules need to be constantly updated to adapt to new malicious transaction types. Second, attackers can bypass detection by circumventing detection rules, thereby successfully conducting malicious transactions. This challenges the reliability and accuracy of rule-based detection methods.

[0005] Therefore, in order to effectively monitor malicious transactions in Ethereum, more advanced and flexible methods are needed. Deep learning-based methods can adaptively learn various types of malicious transactions and have good generalization capabilities. Compared with rule-based detection methods, deep learning-based methods can detect malicious transactions more accurately and do not require manual rule making, which has better practicality.

[0006] The rule-based detection method is one of the most commonly used malicious transaction detection methods. This method mainly detects malicious transactions through pre-set rules. For example, it detects that an account has made too many transactions in a short period of time, transferred funds to unknown accounts, and repeatedly executed the same contract. These rules are formulated based on professional knowledge and experience, and need to be constantly updated to adapt to new malicious transaction types.

[0007] Another commonly used method is feature-based detection, which first extracts some features of transaction data and then uses machine learning algorithms to detect malicious transactions. For example, by calculating the transaction frequency, transaction amount, balance change and other features of an account, these features are then input into the machine learning algorithm for training to identify malicious transactions.

[0008] However, both methods have some shortcomings. The rule-based method is easily circumvented by attackers, and the rules need to be constantly updated to adapt to new malicious transaction types. Although the feature-based method can identify certain specific types of malicious transactions, it is difficult to adapt to the ever-changing malicious transaction types. Therefore, the deep learning-based method has gradually become the mainstream method for malicious transaction detection. This method can adaptively learn various types of malicious transactions and has good generalization ability. At the same time, this method does not require manual rule formulation or feature extraction, which greatly reduces labor costs. Summary of the invention

[0009] Technical problem solved: In view of the shortcomings of the prior art, the present invention provides a method and system for monitoring malicious transactions on Ethereum, which realizes automatic detection of malicious transactions through deep learning technology, avoids the shortcomings of manually formulated rules, and can adaptively identify various types of malicious transactions, effectively identify various evasion measures taken by attackers, and effectively solve the problems in the background technology.

[0010] Technical solution: To achieve the above purpose, the technical solution adopted by the present invention is: a method for monitoring malicious transactions on Ethereum, comprising the following steps:

[0011] S1: Dataset collection: Collect a large amount of transaction data from the Ethereum network, including normal transactions and malicious transactions;

[0012] S2: Data preprocessing: preliminarily preprocess the collected transaction data, list various data, and make corresponding data tables;

[0013] S3: Transaction graph construction: A transaction graph is constructed based on the transaction data, where each node represents an account and each edge represents a transaction. In this transaction graph, each node has some features, including account balance and transaction times. For each malicious transaction, a corresponding label is also marked to facilitate subsequent model training.

[0014] S4: Graph neural network model design: A malicious transaction detection model based on a graph neural network is used. The transaction graph is used as input. The model contains multiple graph convolutional layers and fully connected layers. It can automatically detect malicious transactions by learning the transaction patterns between nodes.

[0015] S5: Model training and optimization: Use the constructed dataset to train the graph neural network model and optimize the model. Specifically, use the back-propagation algorithm to calculate the loss function of the model, and use the optimizer to update the model parameters. By continuously adjusting the model parameters, the accuracy and generalization ability of the model can be improved.

[0016] S6: Malicious transaction detection: In actual applications, the transaction graph is input into the trained model, and the malicious transaction label is judged to determine whether it is a malicious transaction. If it is judged to be a malicious transaction, corresponding defense measures can be taken.

[0017] As a preferred technical solution of the present application, a transaction graph dataset is constructed in the steps S1-S3 to ensure the quality and richness of the data.

[0018] As a preferred technical solution of the present application, a graph neural network model is designed in the step S4 to identify patterns of malicious transactions.

[0019] As a preferred technical solution of the present application, the model is fully trained and optimized in steps S5-S6 to improve the accuracy and generalization ability of the model.

[0020] A system for monitoring malicious transactions on Ethereum, comprising a transaction data collection system, a data preprocessing system, a transaction graph construction system, a training set and test set division system, a graph neural network model establishment system, a model training and parameter optimization system and a malicious transaction detection system, wherein the transaction data collection system is connected to the data preprocessing system, the data preprocessing system is connected to the transaction graph construction system, the transaction graph construction system is connected to the training set and test set division system, the training set and test set division system is connected to the graph neural network model establishment system, the graph neural network model establishment system is connected to the model training and parameter optimization system, and the model training and parameter optimization system is connected to the malicious transaction detection system.

[0021] As a preferred technical solution of the present application, the transaction data collection system includes a transaction amount collection module, a transaction time collection module, a transaction address collection module, a transaction object collection module, a transaction account collection module and a transaction number collection module.

[0022] As a preferred technical solution of the present application, the data preprocessing system includes a data collection module, a data classification module, a data arrangement module, a data tabulation module, a data encryption module and a data output module.

[0023] As a preferred technical solution of the present application, the graph neural network model establishment system includes a graph neural network module, a malicious transaction detection module, a graph convolution layer module, a fully connected layer module and a node learning module.

[0024] As a preferred technical solution of the present application, the model training and parameter optimization system includes a data set module, a graph neural network module, a model training module, a model optimization module and a model update module.

[0025] As a preferred technical solution of the present application, the malicious transaction detection system includes a transaction input module, a model detection module, a label judgment module, a malicious transaction alarm module and an automatic defense blocking module.

[0026] Beneficial effects: Compared with the prior art, the present invention provides a method and system for monitoring malicious transactions on Ethereum, which has the following beneficial effects: the method and system for monitoring malicious transactions on Ethereum realize automatic detection of malicious transactions through deep learning technology, avoiding the shortcomings of manually formulating rules, and at the same time, can adaptively identify various types of malicious transactions, and can effectively identify various evasion measures taken by attackers;

[0027] The present invention can better identify various types of malicious transactions with high accuracy, and can adaptively identify new types of malicious transactions. Compared with the traditional rule-based detection method, the present invention can detect malicious transactions more accurately, and does not require manual rule making, and has good practicality. The system for monitoring malicious transactions on Ethereum is easy to operate, and the effect of use is better than that of traditional methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 The present invention is a schematic diagram of the overall process of a method and system for monitoring malicious transactions on Ethereum.

[0029] Figure 2 The present invention provides a method and system for monitoring malicious transactions on Ethereum. DETAILED DESCRIPTION

[0030] The technical scheme of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments, but it will be understood by those skilled in the art that the following described embodiments are part of embodiments of the present invention, rather than all embodiments, and are only used to illustrate the present invention, and should not be considered as limiting the scope of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative work are within the scope of protection of the present invention. If specific conditions are not specified in the embodiments, they are carried out according to normal conditions or conditions recommended by the manufacturer. If the manufacturer is not specified in the reagents or instruments used, they are all conventional products that can be purchased commercially.

[0031] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0032] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0033] like Figure 1 , 2 As shown, a method for monitoring malicious transactions on Ethereum includes the following steps:

[0034] S1: Dataset collection: Collect a large amount of transaction data from the Ethereum network, including normal transactions and malicious transactions;

[0035] S2: Data preprocessing: preliminarily preprocess the collected transaction data, list various data, and make corresponding data tables;

[0036] S3: Transaction graph construction: A transaction graph is constructed based on the transaction data, where each node represents an account and each edge represents a transaction. In this transaction graph, each node has some features, including account balance and transaction times. For each malicious transaction, a corresponding label is also marked for subsequent model training;

[0037] S4: Graph neural network model design: A malicious transaction detection model based on a graph neural network is used. The transaction graph is used as input. The model contains multiple graph convolutional layers and fully connected layers. It can automatically detect malicious transactions by learning the transaction patterns between nodes.

[0038] S5: Model training and optimization: Use the constructed dataset to train the graph neural network model and optimize the model. Specifically, use the back-propagation algorithm to calculate the loss function of the model, and use the optimizer to update the model parameters. By continuously adjusting the model parameters, the accuracy and generalization ability of the model can be improved.

[0039] S6: Malicious transaction detection: In actual applications, the transaction graph is input into the trained model, and the malicious transaction label is judged to determine whether it is a malicious transaction. If it is judged to be a malicious transaction, corresponding defense measures can be taken.

[0040] Automatic detection of malicious transactions can be achieved through deep learning technology, avoiding the shortcomings of manually formulated rules. At the same time, it can adaptively identify various types of malicious transactions and effectively identify various evasion measures taken by attackers.

[0041] Furthermore, a transaction graph dataset is constructed in steps S1-S3 to ensure the quality and richness of the data.

[0042] Furthermore, in step S4, a graph neural network model is designed to identify patterns of malicious transactions.

[0043] Furthermore, in steps S5-S6, the model is fully trained and optimized to improve the accuracy and generalization ability of the model.

[0044] A system for monitoring malicious transactions on Ethereum, including a transaction data collection system, a data preprocessing system, a transaction graph construction system, a training set and test set division system, a graph neural network model building system, a model training and parameter optimization system and a malicious transaction detection system. The transaction data collection system is connected to the data preprocessing system, the data preprocessing system is connected to the transaction graph construction system, the transaction graph construction system is connected to the training set and test set division system, the training set and test set division system is connected to the graph neural network model building system, the graph neural network model building system is connected to the model training and parameter optimization system, and the model training and parameter optimization system is connected to the malicious transaction detection system.

[0045] Furthermore, the transaction data collection system includes a transaction amount collection module, a transaction time collection module, a transaction address collection module, a transaction object collection module, a transaction account collection module and a transaction number collection module.

[0046] Furthermore, the data preprocessing system includes a data collection module, a data classification module, a data arrangement module, a data tabulation module, a data encryption module and a data output module.

[0047] Furthermore, the graph neural network model building system includes a graph neural network module, a malicious transaction detection module, a graph convolution layer module, a fully connected layer module and a node learning module.

[0048] Furthermore, the model training and parameter optimization system includes a data set module, a graph neural network module, a model training module, a model optimization module and a model update module.

[0049] Furthermore, the malicious transaction detection system includes a transaction input module, a model detection module, a label judgment module, a malicious transaction alarm module and an automatic defense blocking module.

[0050] Working principle: A method for monitoring malicious transactions on Ethereum is based on deep learning technology and adopts a malicious transaction detection model based on graph neural network. The specific implementation process is as follows:

[0051] Dataset construction: First, a large amount of transaction data is collected from the Ethereum network, including normal transactions and malicious transactions. Then, a transaction graph is constructed based on these transaction data, where each node represents an account and each edge represents a transaction. In this transaction graph, each node has some features, such as account balance, number of transactions, etc. For each malicious transaction, the corresponding label is also marked for subsequent model training.

[0052] Graph neural network model design: This application uses a malicious transaction detection model based on a graph neural network, taking the transaction graph as input. The model contains multiple graph convolutional layers and fully connected layers, and realizes automatic detection of malicious transactions by learning the transaction patterns between nodes.

[0053] Model training and optimization: Use the constructed dataset to train the graph neural network model and optimize the model. Specifically, the back-propagation algorithm is used to calculate the model's loss function, and the optimizer is used to update the model parameters. By continuously adjusting the model parameters, the accuracy and generalization ability of the model can be improved.

[0054] Malicious transaction detection: In actual applications, the transaction graph is input into the trained model, and the malicious transaction label is judged to determine whether it is a malicious transaction. If it is judged to be a malicious transaction, corresponding defense measures can be taken.

[0055] The first is to build a suitable transaction graph dataset to ensure the quality and richness of the data; the second is to design a suitable graph neural network model to identify the patterns of malicious transactions; the third is to fully train and optimize the model to improve its accuracy and generalization ability.

[0056] It should be noted that, in this article, relational terms such as first and second (number one, number two), etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0057] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements all fall within the scope of the present invention to be protected.

Claims

1. A method for monitoring malicious transactions on Ethereum, characterized in that: The steps include: S1: Dataset collection: Collect a large amount of transaction data from the Ethereum network, including normal transactions and malicious transactions; S2: Data preprocessing: preliminarily preprocess the collected transaction data, list various data, and make corresponding data tables; S3: Transaction graph construction: A transaction graph is constructed based on the transaction data, where each node represents an account and each edge represents a transaction. In this transaction graph, each node has some features, including account balance and transaction times. For each malicious transaction, a corresponding label is also marked for subsequent model training; S4: Graph neural network model design: A malicious transaction detection model based on a graph neural network is used. The transaction graph is used as input. The model contains multiple graph convolutional layers and fully connected layers. It can automatically detect malicious transactions by learning the transaction patterns between nodes. S5: Model training and optimization: Use the constructed dataset to train the graph neural network model and optimize the model. Specifically, use the back-propagation algorithm to calculate the loss function of the model, and use the optimizer to update the model parameters. By continuously adjusting the model parameters, the accuracy and generalization ability of the model can be improved. S6: Malicious transaction detection: In actual applications, the transaction graph is input into the trained model, and the malicious transaction label is judged to determine whether it is a malicious transaction. If it is judged to be a malicious transaction, corresponding defense measures can be taken.

2. A method for monitoring malicious transactions on Ethereum according to claim 1, characterized in that: In the steps S1-S3, a transaction graph dataset is constructed to ensure the quality and richness of the data.

3. A method for monitoring malicious transactions on Ethereum according to claim 1, characterized in that: In the S4 step, a graph neural network model is designed to identify patterns of malicious transactions.

4. A method for monitoring malicious transactions on Ethereum according to claim 1, characterized in that: In the steps S5-S6, the model is fully trained and optimized to improve the accuracy and generalization ability of the model.

5. A system for monitoring malicious transactions on Ethereum, comprising a transaction data collection system, a data preprocessing system, a transaction graph construction system, a training set and test set division system, a graph neural network model establishment system, a model training and parameter optimization system and a malicious transaction detection system, characterized in that: The transaction data collection system is connected to the data preprocessing system, the data preprocessing system is connected to the transaction graph construction system, the transaction graph construction system is connected to the training set and test set partitioning system, the training set and test set partitioning system is connected to the graph neural network model establishment system, the graph neural network model establishment system is connected to the model training and parameter optimization system, and the model training and parameter optimization system is connected to the malicious transaction detection system.

6. A method and system for monitoring malicious transactions on Ethereum according to claim 5, characterized in that: The transaction data collection system includes a transaction amount collection module, a transaction time collection module, a transaction address collection module, a transaction object collection module, a transaction account collection module and a transaction number collection module.

7. A method and system for monitoring malicious transactions on Ethereum according to claim 5, characterized in that: The data preprocessing system includes a data collection module, a data classification module, a data arrangement module, a data tabulation module, a data encryption module and a data output module.

8. A method and system for monitoring malicious transactions on Ethereum according to claim 5, characterized in that: The graph neural network model establishment system includes a graph neural network module, a malicious transaction detection module, a graph convolution layer module, a fully connected layer module and a node learning module.

9. A method and system for monitoring malicious transactions on Ethereum according to claim 5, characterized in that: The model training and parameter optimization system includes a data set module, a graph neural network module, a model training module, a model optimization module and a model update module.

10. A method and system for monitoring malicious transactions on Ethereum according to claim 5, characterized in that: The malicious transaction detection system includes a transaction input module, a model detection module, a label judgment module, a malicious transaction alarm module and an automatic defense blocking module.

Images