Digital currency transaction abnormal behavior detection method of AI Agent

Abstract

The invention discloses a digital currency transaction abnormal behavior detection method of an AI Agent, and relates to the related field of digital currency transactions, and the method comprises the steps: collecting transaction data, order book data and block chain transfer records of a digital currency market in a preset time zone; constructing an inter-account transaction graph, and identifying a transaction cluster; identifying a withdrawal behavior, executing transaction commodity type clustering, and generating a withdrawal transaction commodity cluster; performing block chain path analysis to obtain a transfer path; constructing a multi-level transaction behavior flow relationship; the method comprises the following steps: determining transaction commodities, constructing keywords, collecting associated information of external factors of a market, evaluating the influence on market emotions, carrying out true and false flow judgment and early warning on a multi-level transaction behavior flow relationship, and generating an abnormal early warning decision. The technical problems that invisible abnormal behaviors are difficult to accurately recognize and the detection accuracy is insufficient in existing abnormal behavior detection are solved, and the technical effects of effectively recognizing the invisible abnormal behaviors and improving the detection accuracy are achieved.

Description

Technical Field

[0001] The present application relates to the field of digital currency transactions, and in particular to a method for detecting abnormal behavior in digital currency transactions using an AI Agent. Background Art

[0002] Abnormal trading behaviors in the digital currency market, especially invisible abnormal behaviors, are not only related to market fairness and transparency, but may also cause serious damage to the interests of investors and undermine the healthy and stable development of the market. Therefore, accurate and efficient detection of these invisible abnormal behaviors is crucial to maintaining market order. At present, the main method to solve this problem is to identify potential abnormal trading behaviors by analyzing the transaction data, order book data and blockchain transfer records of the digital currency market. However, most of these methods only stay at the analysis of a single data dimension and fail to fully integrate multi-dimensional information, resulting in limitations in identifying complex and hidden transaction patterns. In particular, invisible abnormal behaviors are often difficult to be accurately identified by existing methods due to their strong concealment and complex patterns.

[0003] Among the current related technologies, the detection of abnormal behavior in digital currency transactions has technical problems such as difficulty in accurately identifying invisible abnormal behavior and insufficient detection accuracy. Summary of the invention

[0004] This application provides an AI Agent digital currency transaction abnormal behavior detection method, which collects transaction data, order book data and blockchain transfer records within a preset time zone, builds an inter-account transaction graph based on transaction data, identifies transaction clusters, analyzes order book data, identifies order cancellation behavior, clusters transaction products to form order cancellation transaction product clusters, performs path analysis based on blockchain transfer records, obtains capital flow paths, integrates transaction clusters, order cancellation transaction product clusters and transfer paths, builds multi-level transaction behavior flow relationships, analyzes transaction data to determine transaction products, collects market external factor information, evaluates its impact on market sentiment, distinguishes real flow from false flow, judges multi-level transaction behavior flow relationships, and generates abnormal warning decisions and other technical means, thereby achieving the technical effect of effectively identifying invisible abnormal behaviors and improving detection accuracy.

[0005] The present application provides an AI Agent digital currency transaction abnormal behavior detection method, including: collecting transaction data, order book data and blockchain transfer records of the digital currency market in a preset time zone; constructing an inter-account transaction graph based on the transaction data and identifying transaction clusters; identifying order cancellation behavior based on the order book data, and performing transaction commodity type clustering to generate an order cancellation transaction commodity cluster; performing blockchain path analysis based on the blockchain transfer record to obtain the transfer path; constructing a multi-level transaction behavior flow relationship based on the transaction cluster, the order cancellation transaction commodity cluster and the transfer path; determining the transaction commodity based on the transaction data analysis, constructing keywords to collect market external factor correlation information, evaluating the impact of external factors on market sentiment, distinguishing and warning the real flow and false flow of the multi-level transaction behavior flow relationship, and generating an Agent abnormal warning decision.

[0006] In a possible implementation, an inter-account transaction graph is constructed based on the transaction data, transaction clusters are identified, and the following processing is performed: parsing the transaction data, determining account nodes and relationship weights between the account nodes, and constructing the inter-account transaction graph; clustering transaction groups using the inter-account transaction graph to generate the transaction clusters, wherein the transaction group clustering is performed based on any one account in the transaction group.

[0007] In a possible implementation, the inter-account transaction graph is constructed and the following processing is performed: the transaction data is parsed, the account address and the exchange account are determined, and the account node is generated; based on the account node, the actual transaction behavior between the accounts is analyzed, including the transaction amount, number of transactions, time interval, capital flow direction and order matching relationship; based on the actual transaction behavior, the transaction amount, number of transactions, transaction ratio and transaction time interval are counted, and the relationship weight between the account nodes is configured, wherein the relationship weight is proportional to the transaction amount, number of transactions and transaction ratio, and inversely proportional to the transaction time interval.

[0008] In a possible implementation, order cancellation behavior is identified based on the order book data, and transaction commodity type clustering is performed to generate an order cancellation transaction commodity cluster, and the following processing is performed: order cancellation behavior is identified based on the order book data, and an order cancellation behavior set is determined; the order transaction commodity type, order cancellation account ID, and order survival time corresponding to the order cancellation behavior set are extracted from the order book data; clustering is performed based on the order transaction commodity type, and then the order cancellation frequency and the distribution characteristics of the order cancellation account are analyzed according to the order cancellation account ID and the order survival time, the analysis results are marked to the clustering results, and the order cancellation transaction commodity cluster is generated.

[0009] In a possible implementation, based on the analysis of the transaction data, the transaction commodity is determined, keywords are constructed to collect market external factor correlation information, the impact of external factors on market sentiment is evaluated, the real flow and false flow are distinguished and warned for the multi-level transaction behavior flow relationship, and an Agent abnormal warning decision is generated, and the following processing is performed: based on the type of transaction commodity, historical market dynamics data is analyzed, keywords related to market dynamics are constructed, and a mapping relationship between market sentiment and market behavior is constructed; after evaluating market sentiment based on the keyword collection of market external factor correlation information, the mapping relationship is called for analysis to generate a market behavior mapping result; the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship is analyzed, real flow and false flow are distinguished and warned, and the Agent abnormal warning decision is generated.

[0010] In a possible implementation, the following processing is performed: the keywords are determined based on the project name, token symbol, industry terminology and market dynamics corresponding to the type of the transaction commodity.

[0011] In a possible implementation, a mapping relationship between market sentiment and market behavior is constructed, and the following processing is performed: based on the historical market dynamics data, the causal relationship of market sentiment on price fluctuations is analyzed; based on the historical market dynamics data, the impact relationship of market sentiment on the market's active time is analyzed; based on the historical market dynamics data, the impact relationship of market sentiment on the market's trading activity is analyzed; and the mapping relationship is formed by the causal relationship, the active time impact relationship, and the trading activity impact relationship.

[0012] In a possible implementation, the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship is analyzed, the real flow and false flow are distinguished and warned, the Agent abnormal warning decision is generated, and the following processing is performed: a matching degree analysis model is constructed, and the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship is calculated; when the matching degree is less than a preset matching degree threshold, a false flow warning is issued, and the hidden transaction abnormal behavior type is analyzed based on the multi-level transaction behavior flow relationship to generate the Agent abnormal warning decision.

[0013] In a possible implementation, a matching analysis model is constructed to calculate the matching degree between the market behavior mapping results and the multi-level transaction behavior flow relationship, and the following processing is performed: based on the multi-level transaction behavior flow relationship, the market's price fluctuations, active time and transaction activity are evaluated to generate a market behavior evaluation result; the matching degree between the market behavior evaluation result and the market behavior mapping result is analyzed to generate the matching degree.

[0014] In a possible implementation, the analysis of hidden transaction abnormal behavior types is performed based on the multi-level transaction behavior flow relationship, the Agent abnormal warning decision is generated, and the following processing is performed: a preset set of hidden transaction abnormal behavior types is determined, and a corresponding transaction behavior portrait set is constructed; the multi-level transaction behavior flow relationship is analyzed with the transaction behavior portrait set to complete the analysis of hidden transaction abnormal behavior types.

[0015] The method for detecting abnormal behavior of digital currency transactions by the AI ​​Agent proposed in this application first collects the transaction data, order book data and blockchain transfer records of the digital currency market in a preset time zone, then constructs an inter-account transaction graph based on the transaction data, identifies transaction clusters, and then identifies order cancellation behavior based on the order book data, and performs transaction commodity type clustering to generate order cancellation transaction commodity clusters, and then performs blockchain path analysis based on the blockchain transfer records to obtain the transfer path, and then constructs a multi-level transaction behavior flow relationship with the transaction cluster, the order cancellation transaction commodity cluster and the transfer path, and finally determines the transaction commodity based on the transaction data analysis, constructs keyword collection market external factor correlation information, evaluates the impact of external factors on market sentiment, and distinguishes and warns the real flow and false flow of the multi-level transaction behavior flow relationship, and generates Agent abnormal warning decisions. The technical effect of effectively identifying invisible abnormal behavior and improving the accuracy of detection is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the accompanying drawings of the embodiment of the present invention will be briefly introduced below. A flow chart is used in the present application to illustrate the operations performed by the method according to the embodiment of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0017] Figure 1 A flowchart of a method for detecting abnormal behavior in digital currency transactions using an AI agent provided in an embodiment of the present application.

[0018] Figure 2 A schematic diagram of the process of generating a cluster of commodity clusters for canceled transactions in the method for detecting abnormal behavior in digital currency transactions of the AI ​​Agent provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0020] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0021] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. The terms "including" and "having" and any variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0022] The present application embodiment provides an AI Agent digital currency transaction abnormal behavior detection method, such as Figure 1 As shown, the method includes: Step S100, collecting transaction data, order book data and blockchain transfer records of the digital currency market in a preset time zone.

[0023] Specifically, the transaction records in the preset time zone are obtained from the digital currency trading platform through API interface or crawler technology, including transaction time, transaction pair (such as BTC / USD), transaction price, transaction volume, buyer account and seller account, etc. Among them, the preset time zone refers to the time range set by the user, which is used to limit the time window for data collection. Transaction data refers to the actual transaction records in the digital currency market.

[0024] Also use API interface or crawler technology to obtain order book data from the trading platform. The order book data contains detailed information of all pending orders (buy orders and sell orders) in the market, such as order price, order quantity, order status (whether it is executed, whether the order is cancelled, etc.), order time, etc.

[0025] Obtain transfer records within the preset time zone through the blockchain node interface or blockchain browser, that is, all transfer transaction records occurring on the blockchain network, including transfer time, transfer-out account, transfer-in account, transfer amount, transaction hash and other information.

[0026] Step S200, constructing an inter-account transaction graph based on the transaction data and identifying transaction clusters.

[0027] Specifically, each transaction record is regarded as an edge in the graph, and the buyer's account and the seller's account are the vertices of the graph. A directed graph, namely the inter-account transaction graph, is constructed to represent the transaction relationship between accounts. The weight of the edge can be set according to the transaction volume or transaction amount. The transaction graph is clustered using graph clustering algorithms (including Louvain algorithm, Label Propagation algorithm, etc.) to identify account clusters with similar transaction behaviors.

[0028] In a possible implementation, an inter-account transaction graph is constructed based on the transaction data to identify transaction clusters. Step S200 further includes step S210, parsing the transaction data, determining account nodes, and the relationship weights between the account nodes, and constructing the inter-account transaction graph. Specifically, key information of each transaction record is extracted from the collected transaction data, including transaction time, transaction accounts of both parties (buyer and seller), transaction commodities, transaction price, transaction volume, etc. The buyer account and seller account in the transaction record are used as nodes (vertices) in the graph. If an account appears in multiple transaction records, it will be regarded as an independent node, but its role (buyer or seller) in different transactions may be different. In order to represent the transaction intensity or frequency between accounts, a weight can be assigned to each edge (line connecting two nodes) in the graph according to the transaction volume, transaction amount, transaction frequency, or a combination of these indicators. For example, the total transaction volume between two accounts can be used as the weight of the edge between them. A graph data structure (such as an adjacency matrix or an adjacency list) is used to represent the transaction relationship between accounts. Each account node is connected to other account nodes through weighted edges to form a directed weighted graph.

[0029] Step S220, clustering the transaction groups with the inter-account transaction graph to generate the transaction clusters, wherein the transaction group clustering is based on any account in the transaction group. Specifically, the inter-account transaction graph is used as input, and the Louvain algorithm, the Label Propagation algorithm, or the spectral clustering algorithm is used to perform group clustering to identify account groups with similar transaction behaviors, i.e., transaction clusters. The clustering condition is clustering based on any account in the transaction group, i.e., if there is a common transaction account in two transaction groups, they will be regarded as part of the same transaction cluster and merged. After the clustering algorithm is completed, a set of transaction clusters is output, each cluster containing a group of accounts with similar transaction behaviors. This implementation method can identify account groups with similar transaction behaviors in the digital currency market by constructing an inter-account transaction graph and performing transaction group clustering. These groups may represent specific trading strategies, market participant types, or potential market manipulation behaviors. By further analyzing the characteristics and behavior patterns of these transaction clusters, it can help AI Agent identify abnormal transaction behaviors and improve the efficiency and accuracy of market supervision.

[0030] In a possible implementation, the inter-account transaction graph is constructed, and step S210 further includes step S211, parsing the transaction data, determining the account address and the exchange account, and generating the account node. Specifically, a data processing tool (such as Python's pandas library) is used to read the transaction data file. By parsing the "account address of both parties to the transaction" field in the transaction record, the account addresses of all parties involved in the transaction are extracted. At the same time, the exchange accounts are identified and distinguished through the characteristics of the account address or the known exchange address list. Finally, an account node is created for each unique account address, and these nodes are used to construct the inter-account transaction graph.

[0031] Step S212, based on the account nodes, analyze the actual transaction behavior between accounts, including transaction amount, number of times, time interval, fund flow direction and order matching relationship. Specifically, for each transaction record, extract information such as transaction amount, number of transactions, transaction time interval, fund flow direction (i.e., funds flow from which account to which account) and order matching relationship (such as the matching of buy orders and sell orders). This information is used to calculate relationship weights and identify transaction patterns.

[0032] Step S213, based on the actual transaction behavior, the transaction amount, transaction number, transaction ratio and transaction time interval are counted, and the relationship weight between the account nodes is configured, wherein the relationship weight is proportional to the transaction amount, transaction number and transaction ratio, and inversely proportional to the transaction time interval. Specifically, for each pair of transaction accounts (i.e., an edge in the figure), the transaction amount and transaction number between them are counted. The transaction ratio refers to the proportion of the transaction amount between the pair of accounts to their respective total transaction amounts. The transaction time interval refers to the time difference between the continuous transactions between the pair of accounts. Then, according to these statistical information, a relationship weight is configured for each account pair. The weight calculation formula can be designed as a linear combination of the transaction amount, transaction number and transaction ratio (proportional relationship), and divided by the transaction time interval (inverse relationship). In this way, account pairs with frequent transactions, large amounts and short time intervals will be given higher weights, indicating that the relationship between them is stronger. This implementation method more accurately reflects the degree of association and transaction activity between accounts by carefully analyzing the actual transaction behaviors between accounts and configuring weights based on these behaviors, which is conducive to improving the accuracy and effectiveness of abnormal transaction behavior identification.

[0033] Step S300, identifying order cancellation behavior based on the order book data, and performing transaction commodity type clustering to generate a cluster of order cancellation transaction commodities.

[0034] Specifically, compare the pending order data in the order book with the final transaction data to find out the cancelled orders. Use clustering algorithms to cluster the order cancellation data according to the attributes of the trading products (such as digital currency type, trading pair, etc.) to generate a cluster of cancelled trading products. Among them, order cancellation behavior refers to the behavior of traders actively canceling the order after placing it. The order cancellation may be due to various reasons, such as changing trading strategies, avoiding losses, etc.

[0035] like Figure 2 As shown, in a possible implementation, order cancellation behavior is identified based on the order book data, and transaction commodity type clustering is performed to generate a cluster of order cancellation transaction commodities. Step S300 further includes step S310, identifying order cancellation behavior based on the order book data and determining an order cancellation behavior set. Specifically, a data processing tool (such as Python's pandas library) is used to read the order book data file. The order records are traversed to check the status field of each order. If the status is "cancelled", the order is marked as an order cancellation behavior, and its related information (including order ID, order cancellation time, order account ID, etc.) is extracted and stored in the order cancellation behavior set.

[0036] Step S320, extract the order transaction commodity type, cancellation account ID and order survival time corresponding to the cancellation behavior set from the order book data. Specifically, for each cancellation behavior determined in step S310, the transaction commodity type (i.e., digital currency type), order account ID (i.e., cancellation account ID) and the time from order placement to order cancellation (i.e., order survival time) of the order are extracted from the order book data. This information is used for cluster analysis and feature analysis.

[0037] Step S330, clustering is performed based on the order transaction commodity type, and then the order cancellation frequency and the distribution characteristics of the order cancellation account are analyzed according to the order cancellation account ID and the order survival time, and the analysis results are marked to the clustering results to generate the order cancellation transaction commodity cluster. Specifically, a clustering algorithm (such as K-means clustering) is used to cluster the extracted order transaction commodity types. The transaction commodity type can be a type of digital currency or a trading pair. Similar commodity types are classified into one category to form several order cancellation transaction commodity clusters, and each cluster represents a group of transaction commodities with similar order cancellation behaviors. Then, for each order cancellation transaction commodity cluster, the order cancellation frequency and the distribution characteristics of the order cancellation account are further analyzed. The order cancellation frequency refers to the number of order cancellations of each order cancellation account in the cluster. A high-frequency order cancellation account may indicate that the account is carrying out a certain specific trading strategy (such as high-frequency trading or market manipulation). The distribution characteristics analysis of the order cancellation account focuses on which accounts frequently cancel orders and the correlation between these accounts. For example, some accounts may frequently cancel orders in the same time period, which may imply coordinated operations or market manipulation behaviors. These characteristics are displayed by calculating statistics (such as mean, standard deviation, frequency distribution, etc.) and drawing charts (such as scatter plots, histograms, etc.). Finally, the analysis results of the distribution characteristics of the order cancellation frequency and the order cancellation account are marked in the corresponding clustering results to generate the order cancellation transaction commodity clusters. These clusters not only contain commodity type information, but also contain the order cancellation behavior characteristics related to the commodity type, which provides an important basis for the subsequent multi-level transaction behavior flow relationship construction and abnormal warning.

[0038] Step S400: performing blockchain path analysis based on the blockchain transfer record to obtain the transfer path.

[0039] Specifically, all transfer records within the preset time zone are obtained through the interface of the blockchain node or the blockchain browser. Each transfer record contains information such as the transfer time, the transfer-out account, the transfer-in account, the transfer amount, and the transaction hash. These transfer records are the basic data for blockchain path analysis. Starting from the transfer-out account, the flow path of funds is traced until it reaches the transfer-in account or the fund pool. The complete path of each transfer is recorded, including the intermediate accounts (if any) and the transfer amount of each path. By tracing the flow path of funds, complex fund flow patterns can be identified, such as the frequent transfer of funds between multiple accounts, the formation of fund pools, etc. By analyzing the complexity of the transfer path and the frequency of fund flow, possible abnormal fund flows can be identified. For example, some accounts may frequently receive or transfer large amounts of funds in a short period of time, which may indicate certain illegal activities. Potential "transit accounts" can also be identified by analyzing the intermediate accounts in the transfer path, which may be used to hide the true source or destination of funds. The analyzed fund flow path and abnormal fund flow pattern are recorded as input for the construction of multi-level transaction behavior flow relationships.

[0040] Step S500, constructing a multi-level transaction behavior flow relationship with the transaction cluster, the order cancellation transaction commodity cluster and the transfer path.

[0041] Specifically, transaction clusters, order cancellation transaction commodity clusters, and transfer paths are used as information at different levels, and multi-level and multi-dimensional transaction behavior flow relationships are constructed through association analysis (such as network analysis, graph database query, etc.). For example, accounts in transaction clusters can be associated with accounts in order cancellation transaction commodity clusters to identify which accounts frequently cancel orders on specific commodity types. At the same time, these accounts can be associated with accounts in transfer paths to identify abnormal patterns of capital flow. Through this multi-level analysis, a complex transaction behavior relationship network can be constructed to help identify potential abnormal transaction behaviors. The final generated multi-level transaction behavior flow relationship is a complex network structure that includes the association relationship between transaction clusters, order cancellation transaction commodity clusters, and transfer paths. This network can be used for abnormal behavior detection and early warning.

[0042] Step S600, based on the analysis of the transaction data, determine the transaction commodities, construct keywords to collect the correlation information of external factors in the market, evaluate the impact of external factors on market sentiment, distinguish and warn the real flow and false flow of the multi-level transaction behavior flow relationship, and generate Agent abnormal warning decision.

[0043] Specifically, information about trading commodities is extracted from trading data. Natural language processing (NLP) technology is used to extract keywords and information related to trading commodities from sources such as market news, social media, and announcements. Sentiment analysis algorithms (such as sentiment classifiers based on machine learning) are used to analyze the sentiment tendency of the extracted market external factors information and evaluate its impact on market sentiment. Combining the multi-level transaction behavior flow relationship and the impact of external factors on market sentiment, machine learning models (such as classifiers or clustering algorithms) are used to distinguish the authenticity and falsity of transaction behaviors. Based on the discrimination results, abnormal transaction behaviors are warned, and corresponding Agent abnormal warning decisions are generated to guide AI Agents to warn and handle abnormal behaviors. Among them, real flow refers to the flow of transaction behaviors generated based on real transaction intentions and market demand. False flow refers to the flow of transaction behaviors that may be caused by abnormal behaviors such as market manipulation and false transactions. The embodiment of the present application collects transaction data, order book data and blockchain transfer records within a preset time zone, constructs an inter-account transaction graph based on the transaction data, identifies transaction clusters, analyzes order book data, identifies order cancellation behavior, clusters transaction commodities, forms order cancellation transaction commodity clusters, performs path analysis based on blockchain transfer records, obtains capital flow paths, integrates transaction clusters, order cancellation transaction commodity clusters and transfer paths, constructs multi-level transaction behavior flow relationships, parses transaction data to determine transaction commodities, collects information on external market factors, evaluates their impact on market sentiment, distinguishes between real flows and false flows, discriminates multi-level transaction behavior flow relationships, and generates abnormal warning decisions and other technical means, thereby achieving the technical effect of effectively identifying invisible abnormal behaviors and improving the accuracy of detection.

[0044] In a possible implementation, based on the analysis of the transaction data, the transaction commodity is determined, keywords are constructed to collect the relevant information of external factors in the market, the impact of external factors on market sentiment is evaluated, the real flow and false flow of the multi-level transaction behavior flow relationship are distinguished and warned, and the Agent abnormal warning decision is generated. Step S600 further includes step S610, based on the type of transaction commodity, historical market dynamic data analysis is performed, keywords related to market dynamics are constructed, and a mapping relationship between market sentiment and market behavior is constructed. Specifically, a data processing tool (such as Python's pandas library) is used to read the historical transaction data of the digital currency market, including transaction price, transaction volume, transaction time, etc. According to the type of transaction commodity, combined with market common sense and professional knowledge, a keyword list related to these commodity types is constructed, and the keyword is a specific word or phrase related to market dynamics, which is used to capture information about external factors in the market, and may include commodity names, trading platform names, related news events, etc. The characteristics of market behavior under different market sentiments are analyzed using historical transaction data and market dynamics data. Through data analysis techniques (such as machine learning, statistical modeling, etc.), we can establish a mapping relationship between market sentiment indicators (such as news activity, social media discussion heat, etc.) and market behavior indicators (such as trading volume, trading price, trading frequency, etc.). This mapping relationship can help us understand how market sentiment affects market behavior and provide a basis for distinguishing between real and false flows.

[0045] Step S620, after collecting the market external factor related information based on the keywords to evaluate the market sentiment, call the mapping relationship for analysis to generate a market behavior mapping result. Specifically, natural language processing (NLP) technology (such as text mining, sentiment analysis) is used to collect external factor information related to market dynamics from news, social media (such as Twitter, Reddit), forums and blogs (such as Bitcointalk, Medium), academic and government work reports and other channels. Based on the collected external factor information, sentiment analysis algorithms (such as VADER, TextBlob) are used to evaluate market sentiment. The market sentiment index obtained by the evaluation is input into the mapping relationship between market sentiment and market behavior constructed previously. Through the mapping relationship, the market behavior characteristics that may appear under the current market sentiment are predicted or estimated. These predicted or estimated market behavior characteristics constitute the market behavior mapping results.

[0046] Step S630, analyze the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, distinguish and warn the real flow and false flow, and generate the Agent abnormal warning decision. Specifically, the market behavior mapping result is compared and analyzed with the multi-level transaction behavior flow relationship, and the matching degree between the two is evaluated by calculating the correlation coefficient, distance measurement and other methods. According to the matching degree analysis result, combined with the preset threshold or rule, it is judged whether the transaction behavior flow is real flow or false flow. If the market behavior mapping result is highly consistent with the actual transaction behavior, it is judged as real flow. If there is a significant difference or inconsistency between the market behavior mapping result and the actual transaction behavior, it is judged as false flow, which may imply market manipulation, fraud or other abnormal transaction behavior. For the transaction behavior judged as false flow, the Agent abnormal warning decision is generated, including issuing an alarm, recording abnormal behavior, taking risk control measures, etc. Market sentiment is an important indicator reflecting investors' views and emotional tendencies on the digital currency market, and the multi-level transaction behavior flow relationship provides a comprehensive perspective on transaction behavior. By combining the two for analysis, abnormal trading behaviors (such as market manipulation, false trading, etc.) can be identified more accurately, so that timely measures can be taken to protect investor interests and maintain market order.

[0047] In a possible implementation, step S610 further includes step S611, wherein the keywords are determined based on the project name, token symbol, industry terminology, and market dynamics corresponding to the type of the transaction commodity. Specifically, a data processing tool (such as Python's pandas library) is used to read the transaction data, extract the transaction commodity type information, directly extract the project name and token symbol from the transaction commodity type as keywords, and store these keywords in a list. Among them, the project name is the name of the project or protocol behind the digital currency. The token symbol is the abbreviation or logo of the digital currency. According to the professional knowledge in the field of digital currency, industry terms related to the transaction commodity type are listed as keywords. Industry terms are words or phrases unique to the field of digital currency, such as DeFi (decentralized finance), NFT (non-fungible token), Layer 2 (second layer expansion solution), etc. Similarly, these keywords are stored in a list. Use a web crawler or API interface to obtain news and data related to the digital currency market from channels such as financial media, policy announcements, social media, forums and blogs, academic and government work reports. Perform text analysis and sentiment analysis on the acquired information to extract market dynamic keywords directly related to the transaction commodity type. These keywords include the names of specific events, descriptions of relevant policies, statements about market trends, etc. Integrate the project name, token symbol, industry terminology, and market dynamic keywords together to form a complete keyword group. Store the generated keyword group in the database for use in market sentiment assessment and analysis. Update the keyword group regularly to reflect the latest developments and trends in the digital currency market. This implementation method provides accurate keyword input for market sentiment assessment by integrating keywords from multiple aspects such as project name, token symbol, industry terminology, and market dynamics, which helps to timely detect abnormal trading behavior and warn of market risks.

[0048] In a possible implementation, a mapping relationship between market sentiment and market behavior is constructed, and step S610 further includes step S612, analyzing the causal relationship between market sentiment and price fluctuations based on the historical market dynamics data. Specifically, historical market dynamics data, including transaction prices, transaction volumes, news headlines, social media posts, etc., are collected from multiple channels such as digital currency trading platforms, news websites, and social media. Natural language processing (NLP) technology, such as sentiment dictionary matching, machine learning models (such as SVM, LSTM), etc., are used to perform sentiment analysis on news and social media content to obtain market sentiment indicators (such as positive sentiment index, negative sentiment index). Time series analysis methods (such as ARIMA, GARCH models) or regression models in machine learning (such as linear regression, random forest regression) are used to analyze the time lag effect and causal relationship between market sentiment indicators and price fluctuations. Statistical methods such as Granger causality test are used to determine whether market sentiment is the cause of price fluctuations.

[0049] Step S613, based on the historical market dynamics data, analyze the impact of market sentiment on the market's active time. Specifically, based on the transaction data, define the market's active time, such as peak trading volume, price fluctuations, etc. Analyze the correlation between market sentiment indicators and active time using statistical methods (such as correlation analysis, regression analysis) or machine learning models (such as decision trees, neural networks). Display the changing trend and correlation pattern between market sentiment and active time by drawing time series graphs, scatter plots, etc.

[0050] Step S614, based on the historical market dynamics data, analyze the impact of market sentiment on the market's trading activity. Specifically, based on the trading data, define trading activity indicators, such as trading volume, trading frequency, trading amount, etc. Use an analysis method similar to step S613 to analyze the correlation between market sentiment indicators and trading activity. Based on the analysis results, construct a prediction model between market sentiment and trading activity to predict the impact of future market sentiment on trading activity.

[0051] Step S615, forming the mapping relationship with the causal relationship, the active time influence relationship and the transaction activity influence relationship. Specifically, the analysis results of steps S612, S613 and S614 are integrated to form a comprehensive mapping relationship between market sentiment and market behavior. Based on the integrated analysis results, a mapping relationship model between market sentiment and market behavior is constructed, which can reflect the impact of market sentiment on price fluctuations, active time and transaction activity. This implementation method reveals the inherent connection and law between market sentiment and market behavior by analyzing the impact of market sentiment on price fluctuations, active time and transaction activity, which helps AI Agent to more accurately identify changes in market sentiment and its impact on trading behavior in the detection of abnormal behavior in digital currency transactions, so as to issue abnormal warning decisions in time.

[0052] In a possible implementation, the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship is analyzed, the real flow and false flow are distinguished and warned, and the Agent abnormal warning decision is generated. Step S630 further includes step S631, constructing a matching degree analysis model, and calculating the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship. Specifically, the market behavior mapping result and the multi-level transaction behavior flow relationship are formatted to ensure that the data format is consistent and easy to analyze. Key features are extracted from the market behavior mapping result and the multi-level transaction behavior flow relationship. For example, the market behavior mapping result includes indicators such as market sentiment index and expected transaction volume change; the multi-level transaction behavior flow relationship includes indicators such as the activity of the transaction cluster, the frequency of order withdrawal, and the complexity of the transfer path. Based on the extracted features, a matching degree analysis model is constructed. The model uses a support vector machine SVM to learn the association pattern between the market behavior mapping result and the multi-level transaction behavior flow relationship by training historical data. Using the constructed matching degree analysis model, the matching degree of the market behavior mapping result and the multi-level transaction behavior flow relationship is calculated. The match degree is a value between 0 and 1, indicating the similarity or consistency between the two.

[0053] Step S632, when the matching degree is less than the preset matching degree threshold, a false flow warning is performed, and the type of hidden transaction abnormal behavior is analyzed based on the multi-level transaction behavior flow relationship, and the Agent abnormal warning decision is generated. Specifically, a matching degree threshold is set according to historical data and business needs. When the matching degree of the market behavior mapping result and the multi-level transaction behavior flow relationship is lower than the threshold, it is considered that the possibility of false flow is high. When the matching degree is lower than the threshold, the warning mechanism is triggered. The warning includes sending alarm information, recording logs, marking abnormal transactions and other behaviors. Based on the multi-level transaction behavior flow relationship, the transaction behavior of the warning is further analyzed, including identifying abnormal transaction patterns in the transaction cluster, high-frequency order withdrawal accounts in the order withdrawal behavior, abnormal fund flow in the transfer path, etc. By analyzing these abnormal behaviors, the type of hidden transaction abnormal behavior is determined, such as market manipulation, insider trading, etc. Based on the analysis results of the hidden transaction abnormal behavior, the Agent abnormal warning decision is generated. The decision includes information such as the type of abnormal behavior, the account involved, the transaction commodity, the time range, and the recommended response measures, such as freezing the account and strengthening supervision. This implementation method conducts in-depth analysis based on the flow relationship of multi-level transaction behaviors, further reveals the types and characteristics of abnormal behaviors, provides a strong basis for subsequent supervision and response measures, helps to improve the transparency and security of the digital currency market, and protects the legitimate rights and interests of investors.

[0054] In a possible implementation, a matching degree analysis model is constructed to calculate the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, and step S631 further includes step S6311, based on the multi-level transaction behavior flow relationship, the market price fluctuation, active time and transaction activity are evaluated to generate a market behavior evaluation result. Specifically, price fluctuation evaluation refers to quantitative analysis and evaluation of market price changes, and key data such as transaction amount, transaction frequency, and transaction price of transaction clusters are extracted from the multi-level transaction behavior flow relationship. Time series analysis technology or statistical methods (such as moving average, standard deviation, etc.) are used to evaluate the trend and amplitude of price fluctuations. A price fluctuation threshold is set, and when the price fluctuation exceeds the threshold, it is marked as abnormal fluctuation.

[0055] Active time assessment refers to the quantitative analysis and assessment of the market's activity in different time periods, counting the number of transactions and transaction amounts of transaction clusters in different time periods to identify the market's active time periods. Based on the statistical results, activity indicators (such as hourly transaction amount, number of transactions per minute, etc.) are constructed to quantify the market's activity. Time series analysis techniques or visualization tools (such as line charts, heat maps, etc.) are used to show the changing trend of activity over time.

[0056] Trading activity assessment refers to the quantitative analysis and assessment of the overall trading activity of the market, analyzing the trading patterns in the trading cluster (such as high-frequency trading, large-value trading, etc.) and the characteristics of trading accounts (such as account activity, account correlation, etc.). Based on the results of trading behavior analysis, the trading activity index is calculated to quantify the overall trading activity of the market. The calculated trading activity index is compared with historical data or the industry average to evaluate the trading activity level of the market.

[0057] Step S6312, analyze the degree of match between the market behavior evaluation result and the market behavior mapping result, and generate the matching degree. Specifically, ensure that the market behavior evaluation result and the market behavior mapping result are consistent in the time dimension, and select corresponding indicators for alignment and comparison according to the specific contents of the market behavior evaluation result and the market behavior mapping result. Use distance measurement methods (such as Euclidean distance, Manhattan distance, etc.) to calculate the similarity between the market behavior evaluation result and the market behavior mapping result. Or calculate the correlation coefficient between the two (such as Pearson correlation coefficient, Spearman rank correlation coefficient, etc.) to evaluate the linear relationship or monotonic relationship between the two. Set a matching degree threshold according to business needs and historical data. When the similarity or correlation coefficient is higher than the threshold, it is considered that the two have a high matching degree; otherwise, the matching degree is low. The calculated matching degree is used as the output result for the discrimination and early warning of real flow and false flow. This implementation method quantitatively analyzes the degree of match between market behavior assessment results and market behavior mapping results. Market behavior assessment results reflect market dynamics and trading activity based on multi-level trading behavior flow relationships, while market behavior mapping results reflect market sentiment and its corresponding market behavior forecasts based on market external factors (such as news, social media, etc.). By comparing the degree of match between the two, it is possible to determine whether market behavior is interfered with or affected by external factors, thereby identifying real flows and false flows.

[0058] In a possible implementation, based on the multi-level transaction behavior flow relationship, the analysis of the hidden transaction abnormal behavior type is performed to generate the Agent abnormal warning decision. Step S632 further includes step S6321, determining a preset hidden transaction abnormal behavior type set and constructing a corresponding transaction behavior portrait set. Specifically, combined with the expert experience and knowledge in the field of digital currency transactions, a series of common hidden transaction abnormal behavior types are defined, that is, those transaction behaviors that are not easily observed or detected directly and violate transaction rules or laws and regulations, such as market manipulation, insider trading, etc. Abnormal behavior cases in historical transaction data are analyzed, and their behavioral characteristics are extracted as a reference for hidden transaction abnormal behavior types. For each hidden transaction abnormal behavior type, its key behavioral characteristics are extracted, such as transaction frequency, transaction amount, transaction time, account correlation, capital flow, etc. Based on the extracted behavioral characteristics, a transaction behavior portrait template is designed, including feature dimensions, feature value range, weight, etc. The portrait template of each hidden transaction abnormal behavior type is integrated into the portrait library to form a complete transaction behavior portrait set.

[0059] Step S6322, using the transaction behavior portrait set to analyze the multi-level transaction behavior flow relationship, and complete the analysis of the hidden transaction abnormal behavior type. Specifically, the data in the multi-level transaction behavior flow relationship is cleaned to remove noise and outliers. The transaction data is standardized to ensure the comparability between different features. The transaction behavior in the multi-level transaction behavior flow relationship is feature matched with the portrait template in the transaction behavior portrait set, and the similarity or distance is calculated. According to the preset similarity threshold or distance threshold, it is determined whether the transaction behavior belongs to a certain type of hidden transaction abnormal behavior. Cluster analysis is performed on the matched transaction behaviors to identify transaction groups with similar behavior characteristics. Based on the clustering results and the transaction behavior portrait set, the specific type of hidden transaction abnormal behavior is determined. Risk assessment is performed on the determined hidden transaction abnormal behavior type to determine its potential harm level. According to the risk assessment results, an Agent abnormal warning decision is generated, including warning level, warning information, countermeasures, etc. Hidden transaction abnormal behavior is often difficult to observe and detect directly, but by extracting its behavior characteristics and constructing transaction behavior portraits, effective identification and analysis of such behavior can be achieved. This implementation method can accurately determine the specific types of hidden abnormal trading behaviors by matching and analyzing the trading behaviors in the multi-level trading behavior flow relationships with the trading behavior portrait sets, and then generate early warning decisions to provide regulators, trading platforms or investors with timely risk warnings and response measures.

[0060] The above specific implementation manner does not constitute a limitation to the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiment and can still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. The AI ​​Agent’s method for detecting abnormal behavior in digital currency transactions is characterized by: include: Collect transaction data, order book data and blockchain transfer records of digital currency markets within a preset time zone; Building an inter-account transaction graph based on the transaction data and identifying transaction clusters; Identify order cancellation behavior based on the order book data, perform transaction commodity type clustering, and generate a cluster of order cancellation transaction commodities; Perform blockchain path analysis based on the blockchain transfer record to obtain the transfer path; Constructing a multi-level transaction behavior flow relationship based on the transaction cluster, the order cancellation transaction commodity cluster and the transfer path; Based on the analysis of the transaction data, the transaction commodities are determined, keywords are constructed to collect the correlation information of external factors in the market, the impact of external factors on market sentiment is evaluated, the real flow and false flow of the multi-level transaction behavior flow relationship are distinguished and warned, and the Agent abnormal warning decision is generated.

2. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 1, characterized in that: Building an inter-account transaction graph based on the transaction data and identifying transaction clusters includes: Parsing the transaction data, determining account nodes and relationship weights between the account nodes, and constructing the inter-account transaction graph; The transaction groups are clustered based on the inter-account transaction graph to generate the transaction cluster, wherein the transaction groups are clustered based on any one account in the transaction group.

3. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 2, characterized in that: Constructing the inter-account transaction graph includes: Parsing the transaction data, determining the account address and the exchange account, and generating the account node; Based on the account nodes, analyze the actual transaction behavior between accounts, including transaction amount, number of times, time interval, capital flow direction and order matching relationship; Based on the actual transaction behavior, the transaction amount, transaction number, transaction ratio and transaction time interval are counted, and the relationship weight between the account nodes is configured, wherein the relationship weight is proportional to the transaction amount, transaction number and transaction ratio, and inversely proportional to the transaction time interval.

4. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 1, characterized in that: Identifying order cancellation behavior based on the order book data, and performing transaction commodity type clustering to generate an order cancellation transaction commodity cluster, including: Identifying order cancellation behavior based on the order book data and determining an order cancellation behavior set; Extracting the order transaction commodity type, order cancellation account ID and order survival time corresponding to the order cancellation behavior set from the order book data; Clustering is performed based on the order transaction commodity type, and then the order cancellation frequency and the distribution characteristics of the order cancellation account are analyzed according to the order cancellation account ID and the order survival time, and the analysis result is marked to the clustering result to generate the order cancellation transaction commodity cluster.

5. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 1, characterized in that: Based on the analysis of the transaction data, the transaction commodities are determined, keywords are constructed to collect the correlation information of external factors in the market, the impact of external factors on market sentiment is evaluated, the real flow and false flow of the multi-level transaction behavior flow relationship are distinguished and warned, and the Agent abnormal warning decision is generated, including: Analyze historical market dynamics data based on the types of trading commodities, construct keywords related to market dynamics, and build a mapping relationship between market sentiment and market behavior; After collecting the market external factor correlation information based on the keywords to evaluate the market sentiment, calling the mapping relationship to analyze and generate the market behavior mapping result; The matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship is analyzed to distinguish and warn the real flow and false flow, and generate the Agent abnormal warning decision.

6. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 5, characterized in that: The keywords are determined based on the project name, token symbol, industry terminology and market dynamics corresponding to the type of the trading commodity.

7. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 5, characterized in that: Construct a mapping relationship between market sentiment and market behavior, including: Analyze the causal relationship between market sentiment and price fluctuations based on the historical market dynamics data; Analyze the impact of market sentiment on the market's active time based on the historical market dynamics data; Analyze the impact of market sentiment on market trading activity based on the historical market dynamics data; The mapping relationship is constructed based on the causal relationship, the active time influence relationship and the transaction activity influence relationship.

8. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 5, characterized in that: Analyze the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, distinguish and warn the real flow and false flow, and generate the Agent abnormal warning decision, including: Constructing a matching degree analysis model to calculate the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship; When the matching degree is less than a preset matching degree threshold, a false flow warning is issued, and based on the multi-level transaction behavior flow relationship, an analysis of the hidden transaction abnormal behavior type is performed to generate the Agent abnormal warning decision.

9. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 8, characterized in that: Constructing a matching degree analysis model to calculate the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, including: Based on the multi-level transaction behavior flow relationship, the market price fluctuation, active time and transaction activity are evaluated to generate market behavior evaluation results; The matching degree between the market behavior evaluation result and the market behavior mapping result is analyzed to generate the matching degree.

10. The method for detecting abnormal behavior of digital currency transactions by an AI Agent as claimed in claim 8, characterized in that: Based on the multi-level transaction behavior flow relationship, the hidden transaction abnormal behavior type is analyzed to generate the Agent abnormal warning decision, including: Determine the preset hidden transaction abnormal behavior type set and construct the corresponding transaction behavior portrait set; The transaction behavior portrait set is used to analyze the flow relationship of the multi-level transaction behaviors to complete the analysis of the types of hidden transaction abnormal behaviors.

Images