Detection Method for Abnormal Behavior of Digital Currency Transactions by AI Agent

Abstract

The present invention discloses a method for detecting abnormal behavior in digital currency transactions of an AI Agent, which relates to the field of digital currency transactions. The method includes: collecting transaction data, order book data, and blockchain transfer records in the digital currency market within a preset time zone; constructing an inter-account transaction graph to identify transaction clusters; identifying order cancellation behaviors, performing clustering of transaction commodity types, and generating an order cancellation transaction commodity cluster; conducting blockchain path analysis to obtain transfer paths; constructing a multi-level transaction behavior flow relationship; determining transaction commodities, constructing keywords to collect associated information on external market factors, evaluating the impact on market sentiment, discriminating and warning of real and false flows in the multi-level transaction behavior flow relationship, and generating an abnormal warning decision. It solves the technical problem that existing abnormal behavior detection has difficulty in accurately identifying hidden abnormal behaviors and has insufficient detection accuracy, and achieves the technical effect of effectively identifying hidden abnormal behaviors and improving detection accuracy.

Description

Technical Field

[0001] This application relates to the field of digital currency transactions, and in particular to a method for detecting abnormal digital currency trading behaviors of AI Agent. Background Art

[0002] Abnormal trading behaviors in the digital currency market, especially invisible abnormal behaviors, not only affect market fairness and transparency, but may also cause serious damage to the interests of investors and disrupt the healthy and stable development of the market. Therefore, accurately and efficiently detecting these invisible abnormal behaviors is crucial for maintaining market order. Currently, the main methods to solve this problem are to analyze transaction data, order book data, and blockchain transfer records in the digital currency market to identify potential abnormal trading behaviors. However, most of these methods only stay at the analysis of a single data dimension and fail to fully integrate multi-dimensional information, resulting in limitations in identifying complex and hidden trading patterns. Especially for invisible abnormal behaviors, due to their strong concealment and complex patterns, they are often difficult to be accurately identified by existing methods.

[0003] In the current related technologies, there are technical problems in detecting abnormal digital currency trading behaviors, such as difficulty in accurately identifying invisible abnormal behaviors and insufficient detection accuracy. Summary of the Invention

[0004] This application provides a method for detecting abnormal digital currency trading behaviors of AI Agent. By collecting transaction data, order book data, and blockchain transfer records within a preset time zone, based on the transaction data, constructing an inter-account transaction graph and identifying transaction clusters, analyzing the order book data to identify cancellation behaviors, clustering the traded goods to form a cancellation transaction goods cluster, performing path analysis according to the blockchain transfer records to obtain the fund flow path, integrating the transaction clusters, cancellation transaction goods cluster, and transfer path, constructing a multi-level trading behavior flow relationship, analyzing the transaction data to determine the traded goods, collecting external market factor information, evaluating its impact on market sentiment, distinguishing real flow from false flow, discriminating the multi-level trading behavior flow relationship, and generating abnormal warning decisions and other technical means, it achieves the technical effect of effectively identifying invisible abnormal behaviors and improving the detection accuracy.

[0005] The present application provides a method for detecting abnormal behavior in digital currency transactions of an AI Agent, including: collecting transaction data, order book data, and blockchain transfer records in the digital currency market within a preset time zone; constructing an inter-account transaction graph based on the transaction data to identify transaction clusters; identifying order cancellation behaviors based on the order book data, and performing clustering of transaction commodity types to generate an order cancellation transaction commodity cluster; performing blockchain path analysis based on the blockchain transfer records to obtain transfer paths; constructing a multi-level transaction behavior flow relationship with the transaction clusters, the order cancellation transaction commodity cluster, and the transfer paths; parsing the transaction data to determine transaction commodities, constructing keyword collection of market external factor correlation information, evaluating the impact of external factors on market sentiment, discriminating and warning real and false flows of the multi-level transaction behavior flow relationship, and generating an Agent abnormal warning decision.

[0006] In a possible implementation manner, when constructing an inter-account transaction graph based on the transaction data to identify transaction clusters, the following processing is performed: parsing the transaction data to determine account nodes and the relationship weights between the account nodes, and constructing the inter-account transaction graph; performing transaction group clustering with the inter-account transaction graph to generate the transaction clusters, where the transaction group clustering is performed based on any one account in the transaction group.

[0007] In a possible implementation manner, when constructing the inter-account transaction graph, the following processing is performed: parsing the transaction data to determine account addresses and exchange accounts, and generating the account nodes; based on the account nodes, analyzing the actual transaction behaviors between accounts, including transaction amounts, numbers of times, time intervals, fund flows, and order matching relationships; based on the actual transaction behaviors, counting transaction amounts, numbers of transactions, transaction ratios, and transaction time intervals, and configuring the relationship weights between account nodes, where the relationship weights are directly proportional to transaction amounts, numbers of transactions, and transaction ratios, and inversely proportional to transaction time intervals.

[0008] In a possible implementation manner, when identifying order cancellation behaviors based on the order book data and performing clustering of transaction commodity types to generate an order cancellation transaction commodity cluster, the following processing is performed: identifying order cancellation behaviors based on the order book data to determine an order cancellation behavior set; extracting the order transaction commodity types, order cancellation account IDs, and order survival times corresponding to the order cancellation behavior set from the order book data; performing clustering based on the order transaction commodity types, and then analyzing the distribution characteristics of order cancellation frequencies and order cancellation accounts according to the order cancellation account IDs and the order survival times, and marking the analysis results to the clustering results to generate the order cancellation transaction commodity cluster.

[0009] In a possible implementation, based on the parsing of the transaction data to determine the transaction goods, construct the keyword collection of market external factor association information, evaluate the impact of external factors on market sentiment, discriminate and warn of real and false flows in the multi-level transaction behavior flow relationship, generate an Agent anomaly warning decision, and perform the following processing: Analyze the historical market dynamic data based on the type of transaction goods, construct keywords related to market dynamics, and construct the mapping relationship between market sentiment and market behavior; After evaluating the market sentiment by collecting the market external factor association information based on the keywords, call the mapping relationship for analysis to generate the market behavior mapping result; Analyze the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, conduct discrimination and warning of real and false flows, and generate the Agent anomaly warning decision.

[0010] In a possible implementation, perform the following processing: The keywords are determined based on the project name, token symbol, industry terms, and market dynamics corresponding to the type of transaction goods.

[0011] In a possible implementation, construct the mapping relationship between market sentiment and market behavior, and perform the following processing: Analyze the causal relationship between market sentiment and price fluctuations based on the historical market dynamic data; Analyze the influence relationship between market sentiment and the active time of the market based on the historical market dynamic data; Analyze the influence relationship between market sentiment and the trading activity of the market based on the historical market dynamic data; Form the mapping relationship with the causal relationship, the active time influence relationship, and the trading activity influence relationship.

[0012] In a possible implementation, analyze the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, conduct discrimination and warning of real and false flows, and generate the Agent anomaly warning decision, and perform the following processing: Construct a matching degree analysis model to calculate the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship; When the matching degree is less than the preset matching degree threshold, issue a false flow warning, and analyze the type of hidden transaction abnormal behavior based on the multi-level transaction behavior flow relationship to generate the Agent anomaly warning decision.

[0013] In a possible implementation, construct a matching degree analysis model to calculate the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, and perform the following processing: Evaluate the price fluctuations, active time, and trading activity of the market based on the multi-level transaction behavior flow relationship to generate the market behavior evaluation result; Analyze the matching degree between the market behavior evaluation result and the market behavior mapping result to generate the matching degree.

[0014] In a possible implementation manner, based on the multi-level transaction behavior flow relationship, analyze the types of implicit transaction abnormal behaviors, generate the Agent abnormal warning decision, and perform the following processing: determine a preset set of implicit transaction abnormal behavior types, and construct a corresponding set of transaction behavior portraits; use the set of transaction behavior portraits to analyze the multi-level transaction behavior flow relationship to complete the analysis of the types of implicit transaction abnormal behaviors.

[0015] The method for detecting abnormal digital currency trading behaviors of an AI Agent proposed in this application first collects trading data, order book data, and blockchain transfer records in the digital currency market within a preset time zone, then constructs an inter-account trading graph based on the trading data to identify trading clusters, then identifies order cancellation behaviors based on the order book data, and performs clustering of trading commodity types to generate an order cancellation trading commodity cluster. Then, based on the blockchain transfer records, perform blockchain path analysis to obtain transfer paths. Furthermore, construct a multi-level transaction behavior flow relationship with the trading clusters, the order cancellation trading commodity cluster, and the transfer paths. Finally, based on the analysis of the trading data, determine the trading commodities, construct keywords to collect associated information on external factors in the market, evaluate the impact of external factors on market sentiment, discriminate and warn of real and false flows in the multi-level transaction behavior flow relationship, and generate an Agent abnormal warning decision. It achieves the technical effect of effectively identifying hidden abnormal behaviors and improving the accuracy of detection. Description of the Drawings

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly introduced below. Flowcharts are used in this application to illustrate the operations performed by the methods according to the embodiments of this application. It should be understood that the operations in the front or below do not necessarily need to be executed precisely in sequence. On the contrary, according to the need, they can be executed in reverse order or simultaneously. At the same time, other operations can also be added to these processes, or one or several operations can be removed from these processes.

[0017] Figure 1 It is a schematic flowchart of the method for detecting abnormal digital currency trading behaviors of an AI Agent provided by an embodiment of this application.

[0018] Figure 2 It is a schematic flowchart of generating an order cancellation trading commodity cluster in the method for detecting abnormal digital currency trading behaviors of an AI Agent provided by an embodiment of this application. Detailed Embodiments

[0019] The above description is only an overview of the technical solution of this application. In order to be able to understand the technical means of this application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of this application more obvious and understandable, the specific embodiments of this application are specifically given below.

[0020] In order to make the purpose, technical solution and advantages of this application clearer, the following will further describe this application in detail with reference to the accompanying drawings. The described embodiments should not be regarded as a limitation of this application. All other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

[0021] In the following description, "some embodiments" are involved, which describe a subset of all possible embodiments. However, it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. The terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or are inherent to these processes, methods, products or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application.

[0022] The embodiments of this application provide a method for detecting abnormal behavior of digital currency transactions of an AI Agent, as Figure 1 shown, the method includes:

[0023] Step S100, collect transaction data, order book data and blockchain transfer records of the digital currency market in a preset time zone.

[0024] Specifically, obtain transaction records in a preset time zone from a digital currency trading platform through an API interface or web crawler technology, including information such as transaction time, trading pair (such as BTC / USD), trading price, trading volume, buyer's account and seller's account. Among them, the preset time zone refers to the time range set by the user, which is used to limit the time window for data collection. Transaction data refers to the actual transaction records in the digital currency market.

[0025] Also use an API interface or web crawler technology to obtain order book data from the trading platform. The order book data contains detailed information about all orders (buy orders and sell orders) in the market, such as order price, order volume, order status (whether it is filled, whether it is cancelled, etc.), order placement time, etc.

[0026] Obtain transfer records within a preset time zone through the interface of blockchain nodes or a blockchain browser, that is, all transfer transaction records occurring on the blockchain network, including information such as transfer time, transfer-out account, transfer-in account, transfer amount, and transaction hash.

[0027] Step S200: Based on the transaction data, construct an inter-account transaction graph and identify transaction clusters.

[0028] Specifically, regard each transaction record as an edge in the graph, with the buyer's account and the seller's account as the vertices of the graph, and construct a directed graph, that is, an inter-account transaction graph, to represent the transaction relationship between accounts. The weight of the edge can be set according to the trading volume or transaction amount. Use graph clustering algorithms (including the Louvain algorithm, Label Propagation algorithm, etc.) to perform clustering analysis on the transaction graph to identify account clusters with similar trading behaviors.

[0029] In a possible implementation, based on the transaction data, construct an inter-account transaction graph and identify transaction clusters. Step S200 further includes step S210: Parse the transaction data, determine account nodes, and the relationship weights between the account nodes, and construct the inter-account transaction graph. Specifically, extract the key information of each transaction record from the collected transaction data, including transaction time, trading parties' accounts (buyer and seller), traded goods, transaction price, trading volume, etc. Take the buyer's account and the seller's account in the transaction record as nodes (vertices) in the graph. If an account appears in multiple transaction records, it will be regarded as an independent node, but its role (buyer or seller) in different transactions may be different. To represent the trading intensity or frequency between accounts, a weight can be assigned to each edge (the line connecting two nodes) in the graph according to the trading volume, transaction amount, trading frequency, or a combination of these metrics. For example, the total trading volume between two accounts can be used as the weight of the edge between them. Use a graph data structure (such as an adjacency matrix or adjacency list) to represent the transaction relationship between accounts. Each account node is connected to other account nodes through weighted edges to form a directed weighted graph.

[0030] Step S220: Cluster the trading groups using the inter-account transaction graph to generate the trading clusters, where the trading group clustering is performed based on any one account in the trading group. Specifically, take the inter-account transaction graph as the input, and use the Louvain algorithm, Label Propagation algorithm, or spectral clustering algorithm to perform group clustering to identify groups of accounts with similar trading behaviors, that is, trading clusters. The clustering condition is to cluster based on any one account in the trading group, that is, if two trading groups have a common trading account, they will be regarded as part of the same trading cluster and merged. After the clustering algorithm is completed, a set of trading clusters is output, and each cluster contains a group of accounts with similar trading behaviors. This implementation method can identify groups of accounts with similar trading behaviors in the digital currency market by constructing the inter-account transaction graph and performing trading group clustering. These groups may represent specific trading strategies, types of market participants, or potential market manipulation behaviors. By further analyzing the characteristics and behavior patterns of these trading clusters, it can help the AI Agent identify abnormal trading behaviors and improve the efficiency and accuracy of market supervision.

[0031] In a possible implementation, when constructing the inter-account transaction graph, step S210 further includes step S211: Parse the transaction data to determine the account addresses and exchange accounts, and generate the account nodes. Specifically, use a data processing tool (such as the pandas library in Python) to read the transaction data file. Extract all the account addresses participating in the transactions by parsing the "account addresses of both parties in the transaction" field in the transaction records. At the same time, identify and distinguish which are exchange accounts based on the characteristics of the account addresses or a list of known exchange addresses. Finally, create an account node for each unique account address, and these nodes are used to construct the inter-account transaction graph.

[0032] Step S212: Analyze the actual trading behaviors between accounts based on the account nodes, including transaction amount, number of transactions, time interval, fund flow direction, and order matching relationship. Specifically, for each transaction record, extract information such as transaction amount, number of transactions, transaction time interval, fund flow direction (i.e., from which account the funds flow to which account), and order matching relationship (such as the matching of buy orders and sell orders). This information is used to calculate the relationship weights and identify trading patterns.

[0033] Step S213: Based on the actual transaction behavior, count the transaction amount, transaction frequency, transaction ratio, and transaction time interval, and configure the relationship weights between account nodes. Herein, the relationship weight is directly proportional to the transaction amount, transaction frequency, and transaction ratio, and inversely proportional to the transaction time interval. Specifically, for each pair of trading accounts (i.e., an edge in the graph), count the transaction amount and transaction frequency between them. The transaction ratio refers to the proportion of the transaction amount between this pair of accounts to their respective total transaction amounts. The transaction time interval refers to the time difference between consecutive transactions between this pair of accounts. Then, based on these statistical information, configure a relationship weight for each account pair. The calculation formula of the weight can be designed as a linear combination (directly proportional relationship) of the transaction amount, transaction frequency, and transaction ratio, and divided by the transaction time interval (inversely proportional relationship). In this way, account pairs with frequent transactions, large amounts, and short time intervals will be assigned higher weights, indicating a stronger relationship between them. This implementation method more accurately reflects the degree of association and transaction activity between accounts by carefully analyzing the actual transaction behavior between accounts and configuring weights based on these behaviors, which is beneficial to improving the accuracy and effectiveness of abnormal transaction behavior identification.

[0034] Step S300: Identify the order cancellation behavior based on the order book data, and perform clustering of trading commodity types to generate an order cancellation trading commodity cluster.

[0035] Specifically, compare the order data in the order book with the final transaction data to find out the orders that have been cancelled. Use a clustering algorithm to perform clustering analysis on the order cancellation data according to the attributes of the trading commodities (such as digital currency type, trading pair, etc.) to generate an order cancellation trading commodity cluster. Herein, the order cancellation behavior refers to the behavior that a trader cancels an order after placing it. The order cancellation may be due to various reasons, such as changing the trading strategy, avoiding losses, etc.

[0036] As Figure 2 shown, in a possible implementation, based on the order book data to identify the order cancellation behavior and perform clustering of trading commodity types to generate an order cancellation trading commodity cluster, step S300 further includes step S310: identify the order cancellation behavior based on the order book data and determine the order cancellation behavior set. Specifically, use a data processing tool (such as the pandas library in Python) to read the order book data file. Traverse the order records and check the status field of each order. If the status is "cancelled", mark this order as an order cancellation behavior, and extract its relevant information (including order ID, order cancellation time, placing account ID, etc.) and store it in the order cancellation behavior set.

[0037] Step S320: Extract the order trading commodity type, cancellation account ID, and order survival time corresponding to the order cancellation behavior set from the order book data. Specifically, for each order cancellation behavior determined in step S310, extract the trading commodity type (i.e., the type of digital currency) of the order, the placing account ID (i.e., the cancellation account ID), and the time elapsed from the order being placed to being cancelled (i.e., the order survival time) from the order book data. These information are used for clustering analysis and feature analysis.

[0038] Step S330: Perform clustering based on the order trading commodity type, and then analyze the distribution characteristics of the order cancellation frequency and cancellation accounts according to the cancellation account ID and the order survival time, and mark the analysis results to the clustering results to generate the cancelled trading commodity clusters. Specifically, use a clustering algorithm (such as K-means clustering) to cluster the extracted order trading commodity types. The trading commodity type can be the type of digital currency or the trading pair. Group similar commodity types into one category to form several cancelled trading commodity clusters. Each cluster represents a group of trading commodities with similar order cancellation behaviors. Then, for each cancelled trading commodity cluster, further analyze the distribution characteristics of the order cancellation frequency and cancellation accounts. The order cancellation frequency refers to the number of cancellations of each cancellation account within the cluster. High-frequency cancellation accounts may indicate that the account is implementing a certain specific trading strategy (such as high-frequency trading or market manipulation). The analysis of the distribution characteristics of cancellation accounts focuses on which accounts cancel orders frequently and the correlation between these accounts. For example, certain accounts may cancel orders frequently within the same time period, which may imply coordinated operations or market manipulation behaviors. These characteristics are presented by calculating statistical measures (such as mean, standard deviation, frequency distribution, etc.) and plotting charts (such as scatter plots, histograms, etc.). Finally, mark the analysis results of the order cancellation frequency and the distribution characteristics of cancellation accounts to the corresponding clustering results to generate the cancelled trading commodity clusters. These clusters not only contain commodity type information but also contain order cancellation behavior characteristics related to this commodity type, providing an important basis for the subsequent construction of multi-level trading behavior flow relationships and anomaly warnings.

[0039] Step S400: Perform blockchain path analysis based on the blockchain transfer records to obtain the transfer paths.

[0040] Specifically, all transfer records within a preset time zone are obtained through the interfaces of blockchain nodes or blockchain browsers. Each transfer record contains information such as transfer time, transferor account, transferee account, transfer amount, and transaction hash. These transfer records are the basic data for blockchain path analysis. Starting from the transferor account, trace the flow path of funds until reaching the transferee account or the fund pool. Record the complete path of each transfer, including intermediate accounts (if any) and the transfer amount for each segment of the path. By tracing the flow path of funds, complex fund flow patterns can be identified, such as frequent transfers of funds between multiple accounts and the formation of fund pools. By analyzing the complexity of the transfer path and the frequency of fund flow, potential abnormal fund flows can be identified. For example, certain accounts may receive or transfer large amounts of funds frequently within a short period, which may imply certain illegal activities. Additionally, potential "intermediate accounts" can be identified by analyzing the intermediate accounts in the transfer path, and these accounts may be used to hide the true source or destination of funds. Record the analyzed fund flow paths and abnormal fund flow patterns as the input for constructing the multi-level transaction behavior flow relationship.

[0041] Step S500: Construct a multi-level transaction behavior flow relationship using the transaction cluster, the order cancellation transaction commodity cluster, and the transfer path.

[0042] Specifically, take the transaction cluster, the order cancellation transaction commodity cluster, and the transfer path as information at different levels, and construct a multi-level and multi-dimensional transaction behavior flow relationship through association analysis (such as network analysis, graph database query, etc.). For example, the accounts in the transaction cluster can be associated with the accounts in the order cancellation transaction commodity cluster to identify which accounts frequently cancel orders for specific commodity types. At the same time, these accounts can be associated with the accounts in the transfer path to identify abnormal patterns of fund flow. Through this multi-level analysis, a complex transaction behavior relationship network can be constructed to help identify potential abnormal transaction behaviors. The finally generated multi-level transaction behavior flow relationship is a complex network structure that includes the association relationships between the transaction cluster, the order cancellation transaction commodity cluster, and the transfer path. This network can be used for abnormal behavior detection and early warning.

[0043] Step S600: Based on the analysis of the transaction data, determine the transaction commodities, construct keyword collection market external factor association information, evaluate the impact of external factors on market sentiment, discriminate and give early warnings for real and pseudo flows of the multi-level transaction behavior flow relationship, and generate an Agent abnormal early warning decision.

[0044] Specifically, trading commodity information is extracted from transaction data. Using natural language processing (NLP) techniques, keywords and information related to the trading commodity are extracted from sources such as market news, social media, and announcements. An emotion analysis algorithm (such as a machine learning-based emotion classifier) is used to analyze the emotional tendency of the extracted market external factor information and evaluate its impact on market sentiment. Combining the multi-level trading behavior flow relationship and the impact of external factors on market sentiment, a machine learning model (such as a classifier or clustering algorithm) is used to distinguish the authenticity and falsity of trading behaviors. According to the discrimination results, early warnings are issued for abnormal trading behaviors, and corresponding Agent abnormal warning decisions are generated to guide the AI Agent to conduct early warning and handling of abnormal behaviors. Among them, real flow refers to the trading behavior flow generated based on real trading intentions and market demands. False flow refers to the trading behavior flow that may be caused by abnormal behaviors such as market manipulation and false trading. In the embodiments of the present application, transaction data, order book data, and blockchain transfer records within a preset time zone are collected. Based on the transaction data, an inter-account transaction graph is constructed, and transaction clusters are identified. The order book data is analyzed to identify order cancellation behaviors, and the trading commodities are clustered to form an order cancellation trading commodity cluster. According to the blockchain transfer records, path analysis is performed to obtain the fund transfer path. The transaction cluster, the order cancellation trading commodity cluster, and the transfer path are integrated to construct a multi-level trading behavior flow relationship, the transaction data is parsed to determine the trading commodity, the market external factor information is collected, its impact on market sentiment is evaluated, the real flow and false flow are distinguished, the multi-level trading behavior flow relationship is discriminated, and abnormal warning decisions are generated and other technical means are used to achieve the technical effect of effectively identifying hidden abnormal behaviors and improving the accuracy of detection.

[0045] In a possible implementation, based on the analysis of the transaction data to determine the traded goods, construct the associated information of the keyword collection market external factors, evaluate the impact of external factors on market sentiment, distinguish and give early warnings for the real flow and false flow of the multi-level transaction behavior flow relationship, and generate an Agent abnormal early warning decision. Step S600 further includes step S610, which analyzes the historical market dynamic data based on the type of traded goods, constructs keywords related to market dynamics, and constructs the mapping relationship between market sentiment and market behavior. Specifically, use a data processing tool (such as the pandas library in Python) to read the historical transaction data of the digital currency market, including transaction price, trading volume, transaction time, etc. According to the type of traded goods, combined with market common sense and professional knowledge, construct a keyword list related to these commodity types. The keywords are specific words or phrases related to market dynamics, used to capture information on market external factors, and can include commodity names, trading platform names, relevant news events, etc. Use the historical transaction data and market dynamic data to analyze the characteristics of market behavior under different market sentiments. Through data analysis techniques (such as machine learning, statistical modeling, etc.), establish the mapping relationship between market sentiment indicators (such as news activity, social media discussion heat, etc.) and market behavior indicators (such as trading volume, transaction price, trading frequency, etc.). This mapping relationship can help understand how market sentiment affects market behavior and provide a basis for distinguishing real flow and false flow.

[0046] In step S620, after evaluating the market sentiment based on the associated information of the keyword collection market external factors, call the mapping relationship for analysis to generate the market behavior mapping result. Specifically, use natural language processing (NLP) techniques (such as text mining, sentiment analysis) to collect external factor information related to market dynamics from channels such as news, social media (such as Twitter, Reddit), forums and blogs (such as Bitcointalk, Medium), academic and government work reports. According to the collected external factor information, use sentiment analysis algorithms (such as VADER, TextBlob) to evaluate the market sentiment. Input the evaluated market sentiment indicators into the previously constructed mapping relationship between market sentiment and market behavior. Through the mapping relationship, predict or estimate the characteristics of market behavior that may occur under the current market sentiment. These predicted or estimated market behavior characteristics constitute the market behavior mapping result.

[0047] Step S630: Analyze the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, conduct discrimination and early warning of real flow and pseudo flow, and generate the Agent abnormal early warning decision. Specifically, compare and analyze the market behavior mapping result with the multi-level transaction behavior flow relationship, and evaluate the matching degree between the two by calculating methods such as correlation coefficient and distance measurement. According to the matching degree analysis result, combined with the preset threshold or rule, judge whether the transaction behavior flow is real flow or pseudo flow. If the market behavior mapping result is highly consistent with the actual transaction behavior, it is judged as real flow. If there are significant differences or inconsistencies between the market behavior mapping result and the actual transaction behavior, it is judged as pseudo flow, which may imply market manipulation, fraud or other abnormal transaction behaviors. For the transaction behaviors judged as pseudo flow, generate the Agent abnormal early warning decision, including issuing an alarm, recording abnormal behaviors, taking risk control measures, etc. Market sentiment is an important indicator reflecting investors' views and sentiment tendencies on the digital currency market, while the multi-level transaction behavior flow relationship provides a comprehensive perspective on transaction behaviors. By combining the two for analysis, abnormal transaction behaviors (such as market manipulation, false transactions, etc.) can be identified more accurately, so as to take timely measures to protect investors' interests and maintain market order.

[0048] In a possible implementation, step S610 further includes step S611, where the keywords are determined based on the item name, token symbol, industry terms, and market dynamics corresponding to the type of the traded commodity. Specifically, a data processing tool (such as the pandas library in Python) is used to read the transaction data, extract the information on the type of the traded commodity, directly extract the item name and token symbol from the type of the traded commodity as keywords, and store these keywords in a list. Among them, the item name is the name of the project or protocol behind the digital currency. The token symbol is the abbreviation or identifier of the digital currency. According to the professional knowledge in the digital currency field, the industry terms related to the type of the traded commodity are listed as keywords. Industry terms are the unique words or phrases in the digital currency field, such as DeFi (Decentralized Finance), NFT (Non-Fungible Token), Layer 2 (second-layer scaling solution), etc. Similarly, these keywords are stored in a list. A web crawler or API interface is used to obtain news and data related to the digital currency market from channels such as financial media, policy announcements, social media, forums and blogs, academic and government work reports, etc. Text analysis and sentiment analysis are performed on the obtained information to extract the market dynamics keywords directly related to the type of the traded commodity. These keywords include the names of specific events, descriptions of relevant policies, expressions of market trends, etc. The item name, token symbol, industry terms, and market dynamics keywords are integrated together to form a complete keyword group. The generated keyword group is stored in the database for market sentiment assessment and analysis. The keyword group is updated regularly to reflect the latest dynamics and trends in the digital currency market. This implementation provides accurate keyword input for market sentiment assessment by integrating keywords from multiple aspects such as item name, token symbol, industry terms, and market dynamics, which helps to timely detect abnormal trading behaviors and warn of market risks.

[0049] In a possible implementation, a mapping relationship between market sentiment and market behavior is constructed. Step S610 further includes step S612 of analyzing the causal relationship between market sentiment and price fluctuations based on the historical market dynamic data. Specifically, historical market dynamic data, including transaction prices, trading volumes, news titles, social media posts, etc., is collected from multiple channels such as digital currency trading platforms, news websites, and social media. Natural language processing (NLP) techniques, such as sentiment dictionary matching and machine learning models (such as SVM, LSTM), are used to perform sentiment analysis on news and social media content to obtain market sentiment indicators (such as positive sentiment index, negative sentiment index). Time series analysis methods (such as ARIMA, GARCH models) or regression models in machine learning (such as linear regression, random forest regression) are used to analyze the time lag effect and causal relationship between market sentiment indicators and price fluctuations. Statistical methods such as the Granger causality test are used to determine whether market sentiment is the cause of price fluctuations.

[0050] Step S613, analyzing the influence relationship between market sentiment and the active time of the market based on the historical market dynamic data. Specifically, according to the trading data, the active time of the market is defined, such as the peak trading volume period, the period with frequent price fluctuations, etc. Statistical methods (such as correlation analysis, regression analysis) or machine learning models (such as decision trees, neural networks) are used to analyze the correlation relationship between market sentiment indicators and the active time. By plotting time series graphs, scatter plots, etc., the change trends and correlation patterns between market sentiment and the active time are displayed.

[0051] Step S614, analyzing the influence relationship between market sentiment and the trading activity of the market based on the historical market dynamic data. Specifically, according to the trading data, trading activity indicators are defined, such as trading volume, trading frequency, trading amount, etc. Similar analysis methods to those in step S613 are used to analyze the correlation relationship between market sentiment indicators and trading activity. Based on the analysis results, a prediction model between market sentiment and trading activity is constructed to predict the impact of future market sentiment on trading activity.

[0052] Step S615: Establish the mapping relationship based on the causal relationship, the active time impact relationship, and the trading activity impact relationship. Specifically, integrate the analysis results of steps S612, S613, and S614 to form a comprehensive mapping relationship between market sentiment and market behavior. Based on the integrated analysis results, construct a mapping relationship model between market sentiment and market behavior, which can reflect the impact of market sentiment on price fluctuations, active time, and trading activity. This implementation method reveals the internal connection and law between market sentiment and market behavior by analyzing the impact relationship of market sentiment on price fluctuations, active time, and trading activity, which helps the AI Agent to more accurately identify the changes in market sentiment and its impact on trading behavior in the detection of abnormal behavior in digital currency trading, so as to issue an abnormal warning decision in a timely manner.

[0053] In a possible implementation method, analyze the matching degree between the market behavior mapping result and the multi-level trading behavior flow relationship, conduct discrimination and early warning of real flow and false flow, and generate the Agent abnormal warning decision. Step S630 further includes step S631: construct a matching degree analysis model to calculate the matching degree between the market behavior mapping result and the multi-level trading behavior flow relationship. Specifically, format the market behavior mapping result and the multi-level trading behavior flow relationship to ensure consistent data formats for easy analysis. Extract key features from the market behavior mapping result and the multi-level trading behavior flow relationship. For example, the market behavior mapping result includes indicators such as the market sentiment index and the expected change in trading volume; the multi-level trading behavior flow relationship includes indicators such as the activity of trading clusters, the frequency of order cancellations, and the complexity of transfer paths. Based on the extracted features, construct a matching degree analysis model. This model uses the support vector machine (SVM) and learns the association pattern between the market behavior mapping result and the multi-level trading behavior flow relationship by training historical data. Use the constructed matching degree analysis model to calculate the matching degree between the market behavior mapping result and the multi-level trading behavior flow relationship. The matching degree is a value between 0 and 1, indicating the similarity or consistency between the two.

[0054] Step S632: When the matching degree is less than the preset matching degree threshold, a false flow warning is issued, and an analysis of the types of hidden trading abnormal behaviors is performed based on the multi-level trading behavior flow relationship to generate the Agent abnormal warning decision. Specifically, a matching degree threshold is set according to historical data and business requirements. When the matching degree between the market behavior mapping result and the multi-level trading behavior flow relationship is lower than this threshold, it is considered that the possibility of false flow is relatively high. When the matching degree is lower than the threshold, the warning mechanism is triggered. The warning includes behaviors such as sending alarm information, recording logs, and marking abnormal transactions. Based on the multi-level trading behavior flow relationship, a further analysis of the warned trading behaviors is carried out, including identifying abnormal trading patterns in trading clusters, high-frequency order cancellation accounts in order cancellation behaviors, and abnormal fund flows in transfer paths. By analyzing these abnormal behaviors, the types of hidden trading abnormal behaviors are determined, such as market manipulation, insider trading, etc. Based on the analysis results of the hidden trading abnormal behaviors, the Agent abnormal warning decision is generated. This decision includes information such as the type of abnormal behavior, the accounts involved, the traded commodities, the time range, etc., as well as recommended countermeasures, such as freezing accounts, strengthening supervision, etc. This implementation method conducts in-depth analysis based on the multi-level trading behavior flow relationship, further revealing the types and characteristics of abnormal behaviors, providing a strong basis for subsequent supervision and countermeasures, helping to improve the transparency and security of the digital currency market, and protecting the legitimate rights and interests of investors.

[0055] In a possible implementation, a matching degree analysis model is constructed to calculate the matching degree between the market behavior mapping result and the multi-level trading behavior flow relationship. Step S631 further includes step S6311: Based on the multi-level trading behavior flow relationship, an evaluation of the market's price volatility, active time, and trading activity is performed to generate a market behavior evaluation result. Specifically, the price volatility evaluation refers to the quantitative analysis and evaluation of market price changes, extracting key data such as transaction amounts, transaction frequencies, and transaction prices of trading clusters from the multi-level trading behavior flow relationship. Time series analysis techniques or statistical methods (such as moving averages, standard deviations, etc.) are used to evaluate the trend and amplitude of price volatility. A price volatility threshold is set, and when the price volatility exceeds this threshold, it is marked as abnormal volatility.

[0056] The active time evaluation refers to the quantitative analysis and evaluation of the market's active degree in different time periods, counting the transaction quantities and transaction amounts of trading clusters in different time periods to identify the active time periods of the market. Based on the statistical results, activity indicators (such as transaction amount per hour, number of transactions per minute, etc.) are constructed to quantify the active degree of the market. Time series analysis techniques or visualization tools (such as line charts, heat maps, etc.) are used to display the change trend of activity over time.

[0057] Transaction activity assessment refers to the quantitative analysis and evaluation of the overall trading activity in the market, analyzing trading patterns in the trading cluster (such as high-frequency trading, large-volume trading, etc.) and characteristics of trading accounts (such as account activity, correlation between accounts, etc.). Based on the results of trading behavior analysis, a transaction activity index is calculated to quantify the overall trading activity in the market. The calculated transaction activity index is compared with historical data or industry average levels to evaluate the trading activity level of the market.

[0058] In step S6312, analyze the matching degree between the market behavior assessment result and the market behavior mapping result to generate the matching degree. Specifically, ensure that the market behavior assessment result and the market behavior mapping result are consistent in the time dimension. According to the specific contents of the market behavior assessment result and the market behavior mapping result, select corresponding indicators for alignment and comparison. Use distance measurement methods (such as Euclidean distance, Manhattan distance, etc.) to calculate the similarity between the market behavior assessment result and the market behavior mapping result. Or calculate the correlation coefficient between the two (such as Pearson correlation coefficient, Spearman rank correlation coefficient, etc.) to evaluate the linear relationship or monotonic relationship between the two. Set a matching degree threshold according to business requirements and historical data. When the similarity or correlation coefficient is higher than this threshold, it is considered that the matching degree between the two is higher; otherwise, the matching degree is lower. Take the calculated matching degree as the output result for the discrimination and early warning of real flow and false flow. This implementation method conducts a quantitative analysis of the matching degree between the market behavior assessment result and the market behavior mapping result. The market behavior assessment result reflects the market dynamics and trading activity based on the multi-level trading behavior flow relationship, while the market behavior mapping result reflects the market sentiment and its corresponding market behavior prediction evaluated based on external market factors (such as news, social media, etc.). By comparing the matching degree between the two, it can be judged whether the market behavior is interfered or affected by external factors, so as to identify real flow and false flow.

[0059] In a possible implementation manner, based on the multi-level transaction behavior flow relationship, the analysis of the types of implicit transaction abnormal behaviors is performed to generate the Agent abnormal warning decision. Step S632 further includes step S6321 of determining a preset set of types of implicit transaction abnormal behaviors and constructing a corresponding set of transaction behavior portraits. Specifically, combining the expert experience and knowledge in the field of digital currency transactions, a series of common types of implicit transaction abnormal behaviors are defined, that is, those transaction behaviors that are not easily directly observed or detected and violate transaction rules or laws and regulations, such as market manipulation, insider trading, etc. Analyze the abnormal behavior cases in the historical transaction data, extract their behavior characteristics as a reference for the types of implicit transaction abnormal behaviors. For each type of implicit transaction abnormal behavior, extract its key behavior characteristics, such as transaction frequency, transaction amount, transaction time, account association degree, fund flow direction, etc. Based on the extracted behavior characteristics, design a transaction behavior portrait template, including feature dimensions, feature value ranges, weights, etc. Integrate the portrait templates of each type of implicit transaction abnormal behavior into the portrait library to form a complete set of transaction behavior portraits.

[0060] Step S6322, analyze the multi-level transaction behavior flow relationship with the set of transaction behavior portraits to complete the analysis of the types of implicit transaction abnormal behaviors. Specifically, clean the data in the multi-level transaction behavior flow relationship to remove noise and outliers. Standardize the transaction data to ensure the comparability between different features. Match the transaction behaviors in the multi-level transaction behavior flow relationship with the portrait templates in the set of transaction behavior portraits to calculate the similarity or distance. According to the preset similarity threshold or distance threshold, determine whether the transaction behavior belongs to a certain type of implicit transaction abnormal behavior. Perform clustering analysis on the successfully matched transaction behaviors to identify transaction groups with similar behavior characteristics. Based on the clustering results and the set of transaction behavior portraits, determine the specific type of the implicit transaction abnormal behavior. Conduct a risk assessment on the determined type of implicit transaction abnormal behavior to determine its potential harm level. According to the risk assessment results, generate the Agent abnormal warning decision, including warning level, warning information, countermeasures, etc. Implicit transaction abnormal behaviors are often difficult to directly observe and detect, but by extracting their behavior characteristics and constructing transaction behavior portraits, the effective identification and analysis of such behaviors can be achieved. This implementation method can accurately determine the specific type of implicit transaction abnormal behavior by matching and analyzing the transaction behaviors in the multi-level transaction behavior flow relationship with the set of transaction behavior portraits, and then generate a warning decision, providing timely risk warnings and countermeasures for regulatory agencies, trading platforms or investors.

[0061] The above specific embodiments do not constitute a limitation on the protection scope of this application. Those skilled in the art should understand that various modifications, combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principle of this application shall be included within the protection scope of this application. In some cases, the actions or steps recited in this application can be executed in a different order from that in the embodiments and still achieve the desired results. Additionally, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A method for detecting abnormal behavior in digital currency transactions of an AI Agent, characterized in that, Including: Collecting trading data, order book data, and blockchain transfer records in the digital currency market within a preset time zone; Constructing an inter-account transaction graph based on the trading data and identifying transaction clusters; Identifying order cancellation behaviors based on the order book data, and performing clustering of trading commodity types to generate an order cancellation trading commodity cluster; Performing blockchain path analysis based on the blockchain transfer records to obtain transfer paths; Constructing a multi-level trading behavior flow relationship with the transaction clusters, the order cancellation trading commodity cluster, and the transfer paths; Based on the trading data, parsing to determine trading commodities, constructing keywords to collect associated information on external market factors, evaluating the impact of external factors on market sentiment, discriminating and warning of real and false flows in the multi-level trading behavior flow relationship, and generating an Agent anomaly warning decision; Among them, identifying order cancellation behaviors based on the order book data, and performing clustering of trading commodity types to generate an order cancellation trading commodity cluster, including: Identifying order cancellation behaviors based on the order book data to determine an order cancellation behavior set; Extracting from the order book data the order trading commodity types, order cancellation account IDs, and order survival times corresponding to the order cancellation behavior set; Performing clustering based on the order trading commodity types, and then analyzing the distribution characteristics of order cancellation frequencies and order cancellation accounts according to the order cancellation account IDs and the order survival times, and marking the analysis results to the clustering results to generate the order cancellation trading commodity cluster; Among them, based on the trading data, parsing to determine trading commodities, constructing keywords to collect associated information on external market factors, evaluating the impact of external factors on market sentiment, discriminating and warning of real and false flows in the multi-level trading behavior flow relationship, and generating an Agent anomaly warning decision, including: Performing historical market dynamic data analysis based on the types of trading commodities, constructing keywords related to market dynamics, and constructing a mapping relationship between market sentiment and market behavior; After evaluating market sentiment by collecting associated information on external market factors based on the keywords, calling the mapping relationship for analysis to generate a market behavior mapping result; Analyzing the matching degree between the market behavior mapping result and the multi-level trading behavior flow relationship, discriminating and warning of real and false flows, and generating the Agent anomaly warning decision; Among them, generating the Agent anomaly warning decision specifically includes: Constructing a matching degree analysis model to calculate the matching degree between the market behavior mapping result and the multi-level trading behavior flow relationship; When the matching degree is less than a preset matching degree threshold, giving a false flow warning, and analyzing the types of implicit trading abnormal behaviors based on the multi-level trading behavior flow relationship to generate the Agent anomaly warning decision.

2. The method for detecting abnormal behavior of digital currency transactions of the AI Agent according to claim 1, wherein Constructing an inter-account transaction graph based on the trading data and identifying transaction clusters, including: Parsing the trading data to determine account nodes and the relationship weights between the account nodes, and constructing the inter-account transaction graph; Performing transaction group clustering on the inter-account transaction graph to generate the transaction clusters, where the transaction group clustering is performed based on any one account in the transaction group.

3. The method for detecting abnormal behavior of digital currency transactions of the AI Agent according to claim 2, wherein, Construct the inter-account transaction graph, including: Parse the transaction data, determine the account addresses and exchange accounts, and generate the account nodes; Based on the account nodes, analyze the actual transaction behaviors among the accounts, including transaction amounts, frequencies, time intervals, fund flows, and order matching relationships; Based on the actual transaction behaviors, count the transaction amounts, transaction frequencies, transaction ratios, and transaction time intervals, and configure the relationship weights between the account nodes, where the relationship weights are directly proportional to the transaction amounts, transaction frequencies, and transaction ratios, and inversely proportional to the transaction time intervals.

4. The method for detecting abnormal behavior of digital currency transactions of the AI Agent according to claim 1, wherein, The keywords are determined based on the project names, token symbols, industry terms, and market dynamics corresponding to the types of the traded goods.

5. The method for detecting abnormal behavior of digital currency transactions of the AI Agent according to claim 1, characterized in that, Construct the mapping relationship between market sentiment and market behavior, including: Analyze the causal relationship between market sentiment and price fluctuations based on the historical market dynamics data; Analyze the influence relationship between market sentiment and the active time of the market based on the historical market dynamics data; Analyze the influence relationship between market sentiment and the trading activity of the market based on the historical market dynamics data; Form the mapping relationship with the causal relationship, the active time influence relationship, and the trading activity influence relationship.

6. The method for detecting abnormal behavior of digital currency transactions of the AI Agent according to claim 1, characterized in that, Construct a matching degree analysis model to calculate the matching degree between the market behavior mapping result and the multi-level transaction behavior flow relationship, including: Evaluate the price fluctuations, active time, and trading activity of the market based on the multi-level transaction behavior flow relationship, and generate a market behavior evaluation result; Analyze the matching degree between the market behavior evaluation result and the market behavior mapping result to generate the matching degree.

7. The method for detecting abnormal behavior of digital currency transactions of the AI Agent according to claim 1, wherein Analyze the types of hidden transaction abnormal behaviors based on the multi-level transaction behavior flow relationship to generate the Agent abnormal warning decision, including: Determine a preset set of hidden transaction abnormal behavior types and construct a corresponding set of transaction behavior portraits; Analyze the multi-level transaction behavior flow relationship with the set of transaction behavior portraits to complete the analysis of the types of hidden transaction abnormal behaviors.

Images