Blockchain phishing account detection method and device based on dynamic weighted transaction subgraph

Abstract

The present invention discloses a blockchain phishing account detection method and device based on a dynamic weighted transaction subgraph, relating to the technical field of blockchain security monitoring. The method comprises: constructing a dynamic weighted transaction subgraph network based on transaction information; obtaining a blockchain phishing account detection model, comprising a first-level graph neural network, a first-level differentiable graph pooling layer, a second-level graph neural network, a second-level differentiable graph pooling layer, a third-level graph neural network, and a classifier module; inputting the dynamic weighted transaction subgraph network into the first-level graph neural network, inputting the obtained first distribution matrix into the first-level differentiable graph pooling layer, inputting the obtained first compressed features into the second-level graph neural network, inputting the obtained second distribution matrix into the second-level differentiable graph pooling layer, inputting the obtained second compressed features into the third-level graph neural network, and inputting the obtained graph global features into the classifier module to obtain a prediction result for phishing accounts. The present invention can improve the accuracy of blockchain phishing account detection.

Description

Technical Field

[0001] The present invention relates to the field of blockchain security monitoring technology, and in particular to a blockchain phishing account detection method and device based on a dynamic weighted transaction subgraph. Background Art

[0002] While blockchain technology, characterized by decentralization and immutability, enhances transaction transparency, its openness and anonymity also make it a hotbed for phishing attacks. Traditional detection methods rely on rule-based matching or shallow machine learning models, making them inadequate for attackers exploiting complex transaction networks to carry out covert fraudulent activities. In recent years, graph neural networks, owing to their powerful ability to model graph-structured data, have been increasingly applied to blockchain security. For example, they construct transaction subgraph networks to capture interaction patterns between transactions and utilize graph convolutional networks and attention mechanisms to enhance phishing attack detection. However, current methods for constructing these subgraph networks use a relatively static approach to calculating edge weights, considering only the number of transactions and ignoring the volatility and time-intensive nature of these transactions. This results in a limited flexibility of these subgraph networks, leading to low accuracy in identifying blockchain phishing accounts. Summary of the Invention

[0003] To address the technical problem in existing technologies where transaction subgraph edge weights are based solely on static aggregation of transaction amounts, resulting in low accuracy in identifying blockchain phishing accounts, the present invention provides a method and device for detecting blockchain phishing accounts based on a dynamic weighted transaction subgraph. The technical solution is as follows:

[0004] In one aspect, a method for detecting blockchain phishing accounts based on a dynamic weighted transaction subgraph is provided. The method is implemented by a blockchain phishing account detection device based on a dynamic weighted transaction subgraph, and the method includes:

[0005] S1. Build a dynamic weighted transaction subgraph network based on the original transaction information;

[0006] S2. Obtain a blockchain phishing account detection model, wherein the blockchain phishing account detection model includes a first-level graph neural network, a first-level differentiable graph pooling layer, a second-level graph neural network, a second-level differentiable graph pooling layer, a third-level graph neural network, and a classifier module;

[0007] S3. Input the dynamic weight transaction subgraph network into the first-level graph neural network to obtain a first allocation matrix;

[0008] S4. Input the first allocation matrix into the first-level differentiable graph pooling layer to obtain a first compressed feature;

[0009] S5. Input the first compressed feature into the second-level graph neural network to obtain a second allocation matrix;

[0010] S6. Input the second allocation matrix into the second-level differentiable graph pooling layer to obtain a second compressed feature;

[0011] S7. Input the second compressed features into the third-level graph neural network to obtain the global features of the graph;

[0012] S8. Input the global features of the graph into the classifier module to obtain the prediction results of the blockchain phishing account.

[0013] On the other hand, a blockchain phishing account detection device based on a dynamic weighted transaction subgraph is provided. The device is applied to a blockchain phishing account detection method based on a dynamic weighted transaction subgraph. The device includes:

[0014] The construction unit is used to build a dynamic weighted transaction subgraph network based on the original transaction information;

[0015] An acquisition unit is configured to acquire a blockchain phishing account detection model, wherein the blockchain phishing account detection model includes a first-level graph neural network, a first-level differentiable graph pooling layer, a second-level graph neural network, a second-level differentiable graph pooling layer, a third-level graph neural network, and a classifier module;

[0016] A first processing unit is configured to input the dynamic weight transaction subgraph network into a first-level graph neural network to obtain a first allocation matrix;

[0017] A second processing unit is configured to input the first allocation matrix into a first-level differentiable graph pooling layer to obtain a first compressed feature;

[0018] A third processing unit is configured to input the first compressed features into the second-level graph neural network to obtain a second allocation matrix;

[0019] a fourth processing unit, configured to input the second allocation matrix into a second-level differentiable graph pooling layer to obtain a second compressed feature;

[0020] A fifth processing unit is configured to input the second compressed features into the third-level graph neural network to obtain a global graph feature;

[0021] The classification unit is used to input the global features of the graph into the classifier module to obtain the prediction results of blockchain phishing accounts.

[0022] On the other hand, a blockchain phishing account detection device based on a dynamic weighted transaction subgraph is provided, and the blockchain phishing account detection device based on a dynamic weighted transaction subgraph includes: a processor; a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the above-mentioned blockchain phishing account detection methods based on a dynamic weighted transaction subgraph is implemented.

[0023] On the other hand, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, and the at least one instruction is loaded and executed by a processor to implement any one of the above-mentioned blockchain phishing account detection methods based on dynamic weight transaction subgraphs.

[0024] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0025] In this embodiment of the present invention, a dynamic weighted transaction subgraph network considers transaction frequency and enhances awareness of phishing behavior through time decay and amount weighting. As weights, directions, and time attributes are retained layer by layer, network information density and modeling accuracy are improved, while sparsity is simultaneously enhanced. A hierarchical feature extraction architecture is constructed based on DenseSAGEConv. A third-order graph convolutional layer is used to achieve node-level feature abstraction. A cross-layer feature splicing strategy is employed to fuse local and global information, and batch normalization and ReLU activation are combined to enhance model stability. Secondly, a differentiable graph pooling technique is introduced. A dual-branch GNN dynamically generates node allocation matrices and embedded features, achieving hierarchical compression of the graph structure. The model constrains the pooling process through link prediction loss and entropy regularization, ensuring the interpretability of topological relationships and node clustering. By combining the dynamic weighted transaction subgraph network with a blockchain phishing account detection model, the ability to detect blockchain phishing accounts can be comprehensively improved, enhancing the efficiency and accuracy of detection, and further ensuring the security of user accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 This is a flow chart of a blockchain phishing account detection method based on a dynamic weighted transaction subgraph provided by an embodiment of the present invention;

[0028] Figure 2-1 This is a schematic diagram of a process for constructing a transaction subgraph network from a transaction network provided by an embodiment of the present invention;

[0029] Figure 2-2 This is a schematic diagram of a process for constructing a directed transaction subgraph network from a transaction network provided by an embodiment of the present invention;

[0030] Figure 2-3 This is a schematic diagram of a process for constructing a time-series transaction subgraph network from a transaction network, provided by an embodiment of the present invention;

[0031] Figure 2-4 This is a schematic diagram of a mapping strategy for a time-series transaction subgraph network provided by an embodiment of the present invention;

[0032] Figure 2-5 This is a structural diagram of a blockchain phishing account detection model provided by an embodiment of the present invention;

[0033] Figure 2-6 This is a schematic diagram of the structure of a graph neural network provided by an embodiment of the present invention;

[0034] Figure 3 This is a block diagram of a blockchain phishing account detection device based on a dynamic weighted transaction subgraph provided by an embodiment of the present invention;

[0035] Figure 4 This is a structural diagram of a blockchain phishing account detection device based on a dynamic weighted transaction subgraph provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0037] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as an "exemplary" in the present invention should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of the word "exemplary" is intended to present concepts in a concrete manner. Furthermore, in the embodiments of the present invention, "and / or" can mean both or either of the two.

[0038] In the embodiments of the present invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, when the distinction is not emphasized, the meanings they convey are the same. The terms "of," "corresponding," and "corresponding" may sometimes be used interchangeably. It should be noted that, when the distinction is not emphasized, the meanings they convey are the same.

[0039] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0040] In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0041] The embodiment of the present invention provides a blockchain phishing account detection method based on a dynamic weighted transaction subgraph. The method can be implemented by a blockchain phishing account detection device based on a dynamic weighted transaction subgraph. The blockchain phishing account detection device based on a dynamic weighted transaction subgraph can be a terminal or a server. Figure 1 The flowchart of the blockchain phishing account detection method based on the dynamic weighted transaction subgraph is shown. The processing flow of the method may include the following steps:

[0042] S1. Based on the original transaction information, a dynamic weighted transaction subgraph network is constructed.

[0043] Optionally, S1 constructs a dynamic weighted transaction subgraph network based on the original transaction information, which may include the following S11-S13:

[0044] S11. Obtain original transaction information, including transaction accounts, transactions between transaction accounts, transaction direction, transaction timestamp, and transaction amount.

[0045] S12. Construct a graph structure of a dynamic weighted transaction subgraph network based on transaction accounts, transactions between transaction accounts, transaction directions, and transaction timestamps. The graph structure of the dynamic weighted transaction subgraph network is the same as the graph structure of the time-series transaction subgraph network. The nodes of the graph structure of the dynamic weighted transaction subgraph network represent transactions, and the edges represent transaction relationships that satisfy the time sequence.

[0046] In one possible implementation, let’s first introduce the graph network:

[0047] Subgraph networks represent local substructures within a graph. Unlike traditional full-graph representations, subgraph networks more concisely represent the relationships between nodes, better capturing the characteristics between nodes and improving model performance when processing complex data. In particular, subgraph networks can help detect anomalous patterns and identify threats in blockchain transactions.

[0048] The subgraph network first constructs a local subgraph based on the nodes and their connections in the graph. These subgraphs not only include information about the current node, but also information about interactions with its neighboring nodes, forming a local graph structure containing multiple layers of information.

[0049] The propagation mechanism of graph neural networks generates feature embeddings for each node in the subgraph network. Node embeddings are not only based on the node's own features, but also update the node's features by propagating information from adjacent nodes, allowing each node to reflect its context within the entire graph.

[0050] Aggregating subgraph features can effectively express the global properties of the local structure. Aggregation operations typically use techniques such as graph convolution and pooling, enabling the model to extract richer graph structure information.

[0051] Subgraph networks can be used for model training, helping researchers understand complex graph structures and discover potential patterns and regularities.

[0052] The dynamic weighted transaction subgraph network used in the embodiment of the present invention adopts the graph structure of the sequential transaction subgraph network. The construction of the graph structure of the sequential transaction subgraph network is improved on the basis of the directed transaction subgraph network, and the directed transaction subgraph network is improved on the basis of the transaction subgraph network. Therefore, the following introduces these three subgraph networks and their construction methods in order:

[0053] (1) Transaction subgraph network:

[0054] The transaction subgraph network is a mapping from G to T = (V', E'), where V' = {ei∈E} represents the node set of the transaction subgraph network, ei represents the account node, E' = {(ei, ej, w')} is the undirected edge set, w represents the weight, and when ei and ej share the same account address in G, they will be connected.

[0055] The transaction subgraph network is a variant of the subgraph network targeted at the transaction ecosystem context. Compared to the subgraph network, the transaction subgraph network adds a weight mapping w' = f(w), which can retain transaction amount information in the transaction network for subsequent phishing attack identification tasks.

[0056] Figure 2-1 The process of constructing a transaction subgraph network is demonstrated: Given an original transaction network consisting of a central account address and its adjacent account addresses, the directed attributes are first removed while retaining the weight attributes, resulting in an undirected transaction network with weighted values. This transaction network is then mapped into the transaction subgraph network structure space based on the definition of the transaction network subgraph. The edges of the undirected transaction network are mapped to the nodes of the transaction subgraph network. Since the edges of the undirected transaction networks w1, w2, w3, w4, and w5 share a central node, new edges are constructed between the transaction subgraph network nodes e1, e2, e3, e4, and e5. A mapping mechanism is also used between adjacent account addresses to map e6 and e7 to the transaction subgraph network, and new edges are constructed between them and e1 and e5, and e2 and e3, respectively.

[0057] (2) Directed transaction subgraph network:

[0058] The transaction subgraph network fails to retain transaction direction information, which is crucial for identifying phishing attacks. Furthermore, the transaction subgraph network is denser and more complex than the original transaction network, potentially evolving into a complete graph. Based on these issues, the transaction subgraph network was optimized to a directed transaction subgraph network. A directed transaction subgraph network considers both transaction direction and amount, helping to extract potential transaction patterns for the target address.

[0059] The directed transaction subgraph network is from G to The mapping of Represents the node set of the directed transaction subgraph network, di represents the transaction, that is, the node of the directed transaction subgraph network, is a directed edge set, , a directed edge is formed between di and dj when they meet the following conditions:

[0060] (1) di and dj share the same account address in G;

[0061] (2) The ending node of di is the starting node of dj, and they can form a same-direction path of length two.

[0062] By comparing the transaction subgraph network and the directed transaction subgraph network, we can find that the edges of the transaction subgraph network only represent a certain connection between transactions, while the edges in the directed transaction subgraph network clearly indicate the flow direction of transactions, enabling the directed transaction subgraph network to capture the directional relationship of capital flow. At the same time, the directed transaction subgraph network is smaller in scale and has more refined information storage.

[0063] Figure 2-2 The paper demonstrates the process of constructing a directed transaction subgraph network: given an original transaction network, the directed and weighted properties are first retained to obtain a weighted directed transaction network. A direction mapping strategy is then designed, and based on the definition of the directed transaction network subgraph, this directed transaction network is mapped into the directed transaction subgraph network structure space.

[0064] The edges of the directed transaction network are mapped to nodes d1, d2, d3, d4, d5, d6, and d7 in the directed transaction subgraph network. The two red directed dashed lines indicate that transactions d1, d2 and d3, d5 can be considered as two consecutive transactions, respectively. That is, edges d1, d2 and edges d3, d5 can each form a co-directional path of length two. New edges are constructed in the directed transaction subgraph network based on the three directional mapping strategies. Because strategy (b) of the directional mapping strategies does not meet the requirements for edge construction, the directed transaction subgraph network can effectively limit the network size, resulting in a relatively sparse graph.

[0065] (3) Time-series transaction subgraph network:

[0066] Transaction data is dynamic and increasingly complex over time, posing challenges for analyzing transaction behavior using graph mining algorithms. Furthermore, phishing attacks are often highly time-sensitive. To address these challenges, the directed transaction subgraph network needs to be optimized into a sequential transaction subgraph network. This sequential transaction subgraph network considers transaction direction, transaction amount, and transaction time, helping to extract potential transaction patterns of target addresses.

[0067] The time-series transaction subgraph network is a mapping from G to TT = (Vx, Ex), where Vx = {ti∈E} represents the node set of the time-series transaction subgraph network, ti ​​is a node of the time-series transaction subgraph network, representing a transaction, Ex = {(ti, tj,wx)} is a directed edge set, wx = f(w), and a directed edge is formed between ti and tj when they meet the following conditions:

[0068] (1) ti and tj share the same account address in G;

[0069] (2) The destination node of ti is the source node of tj, and they can form a same-direction path of length two;

[0070] (3) li < lj, so that (ti, tj) represents the order of transactions, li is the time when transaction ti occurs, and lj is the time when transaction tj occurs.

[0071] By comparing the directed transaction subgraph network and the time-series transaction subgraph network, it can be found that the time-series transaction subgraph network changes the mapping strategy and can accurately capture the structural information of the time-series transaction flow, while further limiting the scale of the network and making information storage more refined.

[0072] Figure 2-3 This paper demonstrates the process of constructing a time-sequential directed transaction subgraph network: given a constructed directed transaction subgraph network, edges that do not conform to chronological order are filtered out to obtain a time-sequential transaction subgraph network. The timestamps on the edges determine the order in which transactions are generated. Here, we assume that t1 < t2 < t3 < t4 < t5 < t6 < t7. For ti and tj to be connected, i < j must be satisfied. In this case, the edges (t3, t2), (t6, t1), and (t7, t3) do not meet the formation condition and are therefore deleted, resulting in a sparser graph.

[0073] Figure 2-4 The mapping strategy of the sequential transaction subgraph network is shown. A transaction chain of length 2 can only be constructed when the three conditions for constructing the sequential transaction subgraph edge are met. Figure 2-4 The transaction chain in (a) can be successfully mapped to the time-series transaction subgraph network. Figure 2-4The transaction chain in (b) does not meet the second condition for constructing the edge of the sequential transaction subgraph. Figure 2-4 The transaction chain in (c) does not meet the third condition for constructing the edge of the sequential transaction subgraph. Figure 2-4 The transaction chain in (d) does not meet the second condition for constructing the edges of the sequential transaction subgraph.

[0074] S13. Determine the edge weights of the dynamic weighted transaction subgraph network based on the transaction timestamp, the transaction amount, the preset transaction amount weight coefficient, and the preset time decay coefficient.

[0075] In one feasible implementation, phishing attacks often feature frequent small transactions and occasional large transactions. The time-series transaction subgraph network accurately captures the sequential nature of transaction flows through timing constraints, but its edge weights are based solely on static aggregations of transaction amounts, making it difficult to distinguish potential risk patterns in complex transaction scenarios. To address this issue, the time-series transaction subgraph network is optimized into a dynamic weighted transaction subgraph network. While retaining the timing constraints and graph structure of the time-series transaction subgraph network, the dynamic weighted transaction subgraph network incorporates a dynamic weight calculation mechanism that integrates transaction amounts, time decay, and pattern characteristics to enhance sensitivity to anomalous transaction patterns.

[0076] Typical characteristics of phishing attacks include:

[0077] (1) Sudden amount of funds transfer: There may be small test transactions in the early stage of the attack, followed by sudden large-scale fund transfers after the attack succeeds.

[0078] (2) Time-intensiveness: The transaction frequency during the attack phase is significantly higher than that of normal accounts, and the transaction intervals are shorter.

[0079] Therefore, the edge weights of the dynamic weight transaction subgraph network must satisfy:

[0080] (1) Time decay: Recent transactions are more timely, and the influence of historical transactions decays over time.

[0081] (2) Amount sensitivity: amplify the weight difference of abnormal amounts (especially sudden large transactions).

[0082] Based on the above conditions, the embodiment of the present invention invents a feasible method for calculating dynamic weights in an implementation manner. Optionally, the edge weight calculation method of S13 may include the following S131-S133:

[0083] S131. Calculate time decay based on the transaction timestamp and the following formula (1):

[0084] (1)

[0085] Where decay represents the time decay coefficient, t1 and t2 represent the transaction timestamps of different transactions respectively;

[0086] Time decay is related to the time interval; the longer the time interval, the stronger the decay.

[0087] S132. Calculate the amount weight based on the transaction amount, the preset transaction amount weight coefficient, and the following formula (2):

[0088] (2)

[0089] in, Indicates the amount weight, and Represents the transaction amount of different transactions, Indicates the preset transaction amount weight coefficient. Amount weight can increase the sensitivity to large transactions.

[0090] S133. Calculate the edge weights of the dynamic weighted transaction subgraph network based on the transaction amount, time decay, amount weight, and the following formula (3):

[0091] (3)

[0092] Taking the logarithm of the mean transaction amount can prevent a single extreme value from dominating the weight; the exponential decay function ensures that recent transactions have a higher weight; and the power function is used to amplify the marginal effect of the amount. The added time decay and power operation are both O(1) operations, and the overall complexity remains O(|E| 2 / |V|).

[0093] Comparing the time-series transaction subgraph network and the dynamic weight transaction subgraph network, we can find that the dynamic weight transaction subgraph network, through its two-stage weight optimization mechanism (time decay and amount weight enhancement), demonstrates advantages in reflecting the characteristics of phishing attacks:

[0094] (1) Refined capture of frequent small transactions:

[0095] Phishing attacks often begin with frequent, small test transactions to verify the activity of the target account. The time-series transaction subgraph network uses static logarithmic weights, which causes the weights of these transactions to be concentrated in a narrow range, making it difficult to distinguish small transfers by legitimate users. The dynamic weight transaction subgraph network uses a time decay factor to enhance the weight decay effect of dense transactions.

[0096] (2) Differentiated amplification of sudden large-value transactions:

[0097] After a successful phishing attack, attackers often quickly transfer large sums of money. The linear weight calculation of the time-series transaction subgraph network results in a high degree of overlap between the weights of these transactions and normal large-value transactions. The dynamic weight transaction subgraph network uses amount-based weights to enforce the weight differences between large-value transactions.

[0098] In summary, the dynamic weighted transaction subgraph network considers transaction frequency and increases awareness of phishing attempts through time decay and amount weighting. Comparison shows that as weight, direction, and time attributes are retained layer by layer, network information density and modeling accuracy improve, while sparsity also increases.

[0099] S2. Obtain a blockchain phishing account detection model. The blockchain phishing account detection model includes a first-level graph neural network, a first-level differentiable graph pooling layer, a second-level graph neural network, a second-level differentiable graph pooling layer, a third-level graph neural network, and a classifier module.

[0100] Among them, the structures of the first-level graph neural network, the second-level graph neural network, and the third-level graph neural network are the same, but the network parameters are different.

[0101] The first-level differentiable graph pooling layer and the second-level differentiable graph pooling layer have the same structure but different network parameters.

[0102] In a feasible implementation, the embodiment of the present invention combines the graph neural network (GNN) and the differentiable graph pooling (DiffPool) method to design a blockchain phishing account detection model for blockchain threat perception. GNN is a type of deep learning model specifically used to process graph structure data. Graph data consists of nodes and edges. GNN can effectively extract information from the graph structure by learning features of the nodes and edges in the graph. Diffpool can generate a hierarchical representation of the graph through a differentiable graph pooling strategy and can be used in conjunction with GNN, thereby solving the problem that the traditional GNN method has a flat structure and cannot learn the hierarchical representation of the graph. The model structure is as follows Figure 2-5 The pooling and embedding layer configurations are shown in Table 1-1, and the fully connected layer configurations are shown in Table 1-2.

[0103] Table 1-1 Pooling and embedding layer configuration table

[0104]

[0105] Table 1-2 Fully connected layer configuration table

[0106]

[0107] S3. Input the dynamic weight transaction subgraph network into the first-level graph neural network to obtain the first allocation matrix.

[0108] Optionally, the structures of the first-level graph neural network, the second-level graph neural network, and the third-level graph neural network all include a first convolutional layer, a second convolutional layer, and a third convolutional layer. Taking the first convolutional layer as an example, the operation execution process of the graph neural network is described in detail. The first convolutional layer is responsible for preliminary feature extraction and pooling preparation of the original input graph. It contains two parallel branches: the pooling branch generates a node allocation matrix to define how to cluster the original nodes into super nodes, and the feature branch extracts the local structural features of the original graph. The dynamic weight transaction subgraph network is used as input, and its feature dimensions include in-degree weight and out-degree weight, as well as the adjacency matrix of the corresponding transaction subgraph network. Its structure is as follows: Figure 2-6 As shown, the convolutional layer is DenseSAGEConv, which is suitable for dense graphs and can learn node representations based on the features of the node's neighbors and graph structure. The output of each convolutional layer passes through the ReLU activation function to introduce nonlinearity. Batch normalization is introduced at the output of each convolutional layer to standardize the intermediate feature distribution, significantly alleviating abnormal gradient fluctuations during training, thereby accelerating model convergence and improving overall training stability. The specific operations of S3 include S31-S34:

[0109] S31. Input the dynamic weight transaction subgraph network into the first convolutional layer, perform feature transformation through the DenseSAGEConv graph convolution operation to obtain the first initial convolution feature, process the first initial convolution feature through the ReLU activation function, and obtain the first convolution feature by optimizing the first initial convolution feature through batch normalization.

[0110] In one feasible implementation, the first convolutional layer extracts underlying transaction pattern features from the raw input and output degree weights. x0 undergoes feature transformation via the DenseSAGEConv graph convolution operation, with the output dimension mapped to hidden_channels. This layer is followed by a ReLU activation function to introduce nonlinear expression capabilities, and batch normalization is used to optimize gradient propagation stability. The output dimension of the first convolutional layer is hidden_channels.

[0111] S32. Input the first convolutional feature into the second convolutional layer to obtain a first initial high-order feature, process the first initial high-order feature through a ReLU activation function, and obtain a first high-order feature by optimizing the first initial high-order feature through batch normalization.

[0112] In one feasible implementation, the output dimension of the second convolutional layer is hidden_channels.

[0113] S33. Input the first high-order feature into the third convolutional layer to obtain a second initial high-order feature, process the second initial high-order feature through a ReLU activation function, and obtain a second high-order feature by optimizing the second initial high-order feature through batch normalization.

[0114] In one possible implementation, the second and third convolutional layers gradually abstract high-level features to identify complex patterns. Subsequent convolutional layers inherit the output of the previous layer as input, maintaining a uniform hidden dimension, hidden_channels. Each layer sequentially performs graph convolution, ReLU activation, and batch normalization. The output dimension of the third convolutional layer is out_channels.

[0115] The mathematical expression of convolution is as shown in formula (4), where x k is the output feature tensor, x k-1 is the input feature tensor, A is the adjacency matrix, and BN represents batch normalization.

[0116] (4)

[0117] S34. Concatenate the first convolution feature, the first high-order feature, and the second high-order feature along the channel dimension to obtain a fused feature, that is, obtain a first allocation matrix.

[0118] In one feasible implementation, the local transaction features (i.e., the first convolutional features, which can be represented by x1), the middle-level interaction patterns (i.e., the first high-order features, which can be represented by x2), and the global capital flow topology (i.e., the second high-order features, which can be represented by x3) are integrated to enhance the characterization of blockchain phishing account behavior. That is, the output x3 of the third convolutional layer is concatenated with the middle-level features x1 and x2 along the channel dimension to generate the fused feature x fused , whose dimension is hidden_channels×2+out_channels.

[0119] Optionally, a fully connected layer can be added after the third convolutional layer. After feature fusion, the fused features are input into the fully connected layer and mapped into a two-dimensional probability distribution (non-blockchain phishing account probability, blockchain phishing account probability) through the fully connected operation, which directly serves the account risk assessment.

[0120] The above-mentioned graph convolutional network takes into account both feature abstraction and information retention. Through the collaboration of standardization operations and nonlinear activation, it effectively alleviates the gradient vanishing problem in graph data. At the same time, the multi-scale fusion strategy improves the model's robustness in modeling complex transaction patterns.

[0121] S4. Input the first allocation matrix into the first-level differentiable graph pooling layer to obtain a first compressed feature.

[0122] In a feasible implementation, the graph structure is compressed for the first time based on the allocation matrix generated by the first-level graph neural network, reducing the number of nodes to about 25% of the original graph, while retaining key topological structure information and ensuring that the pooled graph maintains semantic consistency with the original graph through a specific loss function.

[0123] Optionally, the first-level differentiable graph pooling layer includes a node embedding generator, a distribution matrix learner, and a hierarchical pooling layer.

[0124] In a feasible implementation, in a blockchain transaction network, threat behaviors such as phishing attacks often present multi-level topological features: abnormal account behaviors at the micro level (such as high-frequency small transfers) are intertwined with cross-account fund flows at the macro level. Traditional graph neural networks can effectively capture node-level features through neighborhood information aggregation, but their flat information transmission structure makes it difficult to model complex hierarchical transaction patterns. The embodiment of the present invention adopts a differentiable graph pooling (DiffPool) mechanism to construct a hierarchical transaction representation system through dynamic coarsening and semantic abstraction, breaking through the limitations of traditional methods. DiffPool transforms the original graph structure G through parameterized hierarchical pooling operations. (l) = (A (l) , X (l) ) is gradually mapped into a series of coarse-grained graphs G (l+1) , G (l+2) , …, where A is the adjacency matrix and X is the node feature matrix. Its core innovation lies in transforming the discrete graph pooling process into a differentiable matrix operation. The specific operations of S4 can be combined with S41-S43:

[0125] S41. Embed the first allocation matrix input nodes into the generator, and extract high-order node representations through multi-layer graph convolution.

[0126] In a feasible implementation, the input is the graph structure G output by the previous layer (l) = (A (l) , X (l) ), where A (l) and X (l) It is the result of the previous layer of GNN after information aggregation and pooling operation. The output is Z (l) = GNNembed(A (l) , X (l) ), this module extracts high-order node representation Z through multi-layer graph convolution (l) ∈R nl ×d, where nl is the number of nodes in the current layer and d is the embedding dimension. This high-level semantic abstraction of the topological and feature information passed by the previous layer reflects the dynamic behavior pattern of the transaction node.

[0127] S42. Input the first assignment matrix into the assignment matrix learner, and generate a soft assignment matrix from nodes to supernodes through an independent GNN module.

[0128] In a feasible implementation, the input also depends on the graph structure G output by the previous layer (l) = (A (l) , X (l) ). The output is S (l) = softmax(GNNpool(A (l) , X (l) )), and generate a soft assignment matrix S from nodes to supernodes through an independent GNN module (l) ∈R nl×nl’ , where nl’ (nl’ < nl) is the number of nodes in the next layer. Through softmax normalization, S (l) maps the local transaction features learned by the previous layer of the graph neural network into a probability distribution from nodes to supernodes, thus defining the clustering boundary of suspicious account clusters. This process directly inherits the encoding ability of the previous layer for the complexity of the transaction network.

[0129] S43. Input the high-order node representation and the soft assignment matrix into the hierarchical pooling layer, retain the key transaction paths, aggregate the nodes with high-frequency interactions into supernodes, and abstract the node features to obtain the first compressed feature.

[0130] In a feasible implementation, the granularity adjacency matrix A (l+1) is obtained by multiplying three matrices S (l)T , A (l) , and S (l) . This can retain the key transaction paths, aggregate the nodes with high-frequency interactions into supernodes, and effectively identify abnormal patterns such as fund pooling and chain diffusion. Abstract the node feature X (l+1) = S (l)T Z (l) weightedly fuses the original node semantics, enabling the model to perceive local transaction details and global fund flow rules across different levels. This process is dynamically optimized through end-to-end training, making the assignment matrices of adjacent levels satisfy both the topological sparsity constraint (minimizing the link prediction loss) and the clustering confidence improvement (entropy regularization term constraint).

[0131] DiffPool ensures the effectiveness of hierarchical representation through the following mechanisms:

[0132] (1) Hierarchical parameter sharing: Different pooling layers share GNN parameters to avoid over-parameterization problems caused by an increase in the number of layers. 8]

[0133] (2) Regularization constraints: Introduce link prediction loss and entropy regularization terms to respectively constrain the sparsity of the assignment matrix and the clustering confidence.

[0134] (3) Multi-scale feature fusion: Use skip connections to aggregate the pooling results of each layer to enhance the model's ability to jointly perceive local and global features.

[0135] S5. Input the first compressed features into the second-level graph neural network to obtain a second allocation matrix.

[0136] In one feasible implementation, the method works on the coarsened graph after the first pooling, where the pooling branch further generates a more compact assignment matrix, and the feature branch learns higher-order graph features and interaction patterns between subgraphs.

[0137] S6. Input the second allocation matrix into the second-level differentiable graph pooling layer to obtain a second compressed feature.

[0138] In one feasible implementation, a second graph compression is performed to further reduce the number of nodes to approximately 6.25% of the original graph, generating a highly abstract global graph representation that captures the overall properties and macro-semantic features of the graph.

[0139] S7. Input the second compressed features into the third-level graph neural network to obtain the global features of the graph.

[0140] In one feasible implementation, pure feature extraction and transformation are performed on the final compressed hypergraph, and a fixed-size 64-dimensional graph-level global representation is generated through mean pooling.

[0141] S8. Input the global features of the graph into the classifier module to obtain the prediction results of the blockchain phishing account.

[0142] In one feasible implementation, high-dimensional semantic compression is performed on global graph features to filter out redundant information and enhance discriminative patterns, outputting a universal embedding vector that is both generalizable and interpretable; this embedding vector is then projected into the target classification space and a predicted label is generated through probabilistic normalization.

[0143] In summary, the three-level graph neural network structure can achieve the optimal balance between hierarchical feature abstraction and computational efficiency: the first level focuses on local feature extraction and preliminary pooling of the original graph, the second level models the sub-graph interaction pattern, and the third level integrates global semantics. Progressive pooling can both retain key topological information and avoid semantic distortion caused by excessive compression; compared with the two-level structure, the three-level design enhances the modeling ability of nested hierarchical graphs, while more than three levels are prone to cause training instability and excessive feature abstraction.

[0144] In an embodiment of the present invention, a dynamic weighted transaction subgraph network takes into account transaction frequency and increases the perception of phishing behavior through time decay and amount weights. A hierarchical feature extraction architecture is constructed based on DenseSAGEConv, node-level feature abstraction is achieved through a third-order graph convolution layer, a cross-layer feature splicing strategy is adopted to fuse local and global information, and batch normalization and ReLU activation are combined to enhance model stability. Secondly, a differentiable graph pooling technology is introduced to dynamically generate node allocation matrices and embedded features through a dual-branch GNN to achieve hierarchical compression of the graph structure. The model constrains the pooling process through link prediction loss and entropy regularization to ensure the interpretability of topological relationships and node clustering. By combining the dynamic weighted transaction subgraph network with the blockchain phishing account detection model, the perception ability of blockchain phishing accounts can be comprehensively improved, the detection efficiency and accuracy of blockchain phishing accounts can be improved, and the safety of users can be further ensured.

[0145] Figure 3 This is a block diagram of a blockchain phishing account detection device based on a dynamic weighted transaction subgraph provided by an embodiment of the present invention. The device is used in a blockchain phishing account detection method based on a dynamic weighted transaction subgraph. Figure 3 The device includes a construction unit 310, an acquisition unit 320, a first processing unit 330, a second processing unit 340, a third processing unit 350, a fourth processing unit 360, a fifth processing unit 370 and a classification unit 380.

[0146] A construction unit 310 is configured to construct a dynamic weighted transaction subgraph network based on the original transaction information;

[0147] An acquisition unit 320 is configured to acquire a blockchain phishing account detection model, wherein the blockchain phishing account detection model includes a first-level graph neural network, a first-level differentiable graph pooling layer, a second-level graph neural network, a second-level differentiable graph pooling layer, a third-level graph neural network, and a classifier module.

[0148] A first processing unit 330 is configured to input the dynamic weight transaction subgraph network into a first-level graph neural network to obtain a first allocation matrix;

[0149] The second processing unit 340 is configured to input the first allocation matrix into the first-level differentiable graph pooling layer to obtain a first compressed feature;

[0150] A third processing unit 350 is configured to input the first compressed features into the second-level graph neural network to obtain a second allocation matrix;

[0151] The fourth processing unit 360 is configured to input the second allocation matrix into the second-level differentiable graph pooling layer to obtain a second compressed feature;

[0152] A fifth processing unit 370 is configured to input the second compressed features into the third-level graph neural network to obtain a global graph feature;

[0153] The classification unit 380 is used to input the global features of the graph into the classifier module to obtain the prediction results of the blockchain phishing account.

[0154] Figure 4 This is a structural diagram of a blockchain phishing account detection device based on a dynamic weighted transaction subgraph provided by an embodiment of the present invention. Figure 4 As shown, the blockchain phishing account detection device based on the dynamic weight transaction subgraph may include the above Figure 3 The blockchain phishing account detection device based on the dynamic weight transaction subgraph shown. Optionally, the blockchain phishing account detection device 410 based on the dynamic weight transaction subgraph may include a first processor 2001.

[0155] Optionally, the blockchain phishing account detection device 410 based on the dynamic weight transaction subgraph may further include a memory 2002 and a transceiver 2003 .

[0156] The first processor 2001, the memory 2002 and the transceiver 2003 may be connected via a communication bus.

[0157] The following combination Figure 4 The components of the blockchain phishing account detection device 410 based on the dynamic weighted transaction subgraph are described in detail:

[0158] The first processor 2001 is the control center of the blockchain phishing account detection device 410 based on the dynamic weighted transaction subgraph, and can be a single processor or a collective term for multiple processing elements. For example, the first processor 2001 can be one or more central processing units (CPUs), or application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more microprocessors (digital signal processors, DSPs) or one or more field programmable gate arrays (FPGAs).

[0159] Optionally, the first processor 2001 can perform various functions of the blockchain phishing account detection device 410 based on the dynamic weight transaction subgraph by running or executing a software program stored in the memory 2002 and calling data stored in the memory 2002.

[0160] In a specific implementation, as an embodiment, the first processor 2001 may include one or more CPUs, such as Figure 4 CPU0 and CPU1 are shown in FIG.

[0161] In a specific implementation, as an embodiment, the blockchain phishing account detection device 410 based on the dynamic weight transaction subgraph may also include multiple processors, such as Figure 4 1 and 2. The first processor 2001 and the second processor 2004 are shown in FIG. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). A processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0162] The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled by the first processor 2001 for execution. The specific implementation method can refer to the above method embodiment and will not be repeated here.

[0163] Alternatively, the memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but not limited thereto. The memory 2002 may be integrated with the first processor 2001 or exist independently and access the first processor 2001 through the interface circuit ( Figure 4 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0164] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0165] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 4The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0166] Optionally, the transceiver 2003 may be integrated with the first processor 2001 or may exist independently and be connected to the blockchain phishing account detection device 410 based on the dynamic weight transaction subgraph through an interface circuit ( Figure 4 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0167] It should be noted that Figure 4 The structure of the blockchain phishing account detection device 410 based on the dynamic weight transaction subgraph shown in the figure does not constitute a limitation on the router. The actual knowledge structure identification device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0168] In addition, the technical effects of the blockchain phishing account detection device 410 based on dynamic weight transaction subgraph can refer to the technical effects of the blockchain phishing account detection method based on dynamic weight transaction subgraph described in the above method embodiment, and will not be repeated here.

[0169] It should be understood that the first processor 2001 in the embodiment of the present invention may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc.

[0170] It should also be understood that the memory in the embodiments of the present invention may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0171] The above embodiments can be implemented in whole or in part via software, hardware (e.g., circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions or computer programs. When loaded or executed on a computer, the processes or functions described in accordance with the embodiments of the present invention are fully or partially performed. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired means (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server or data center that contains a collection of one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. The semiconductor media can be a solid-state drive.

[0172] It should be understood that the term "and / or" as used herein simply describes a relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A alone, A and B together, or B alone. A and B can be singular or plural. Furthermore, the character " / " as used herein generally indicates an "or" relationship between the associated objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0173] In this disclosure, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, "at least one of a, b, or c" can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0174] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0175] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0176] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0177] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of the device or unit, which can be electrical, mechanical or other forms.

[0178] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0179] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0180] If the functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or the portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include various media that can store program code, such as USB flash drives, mobile hard drives, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical disks.

[0181] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A blockchain phishing account detection method based on a dynamic weighted transaction subgraph, characterized in that: The method comprises: S1. Build a dynamic weighted transaction subgraph network based on the original transaction information; S2. Obtain a blockchain phishing account detection model, wherein the blockchain phishing account detection model includes a first-level graph neural network, a first-level differentiable graph pooling layer, a second-level graph neural network, a second-level differentiable graph pooling layer, a third-level graph neural network, and a classifier module; S3. Input the dynamic weight transaction subgraph network into the first-level graph neural network to obtain a first allocation matrix; S4. Input the first allocation matrix into the first-level differentiable graph pooling layer to obtain a first compressed feature; S5. Input the first compressed feature into the second-level graph neural network to obtain a second allocation matrix; S6. Input the second allocation matrix into the second-level differentiable graph pooling layer to obtain a second compressed feature; S7. Input the second compressed features into the third-level graph neural network to obtain the global features of the graph; S8. Input the global features of the graph into the classifier module to obtain the prediction results of the blockchain phishing account; The S1 constructs a dynamic weighted transaction subgraph network based on the original transaction information, including: S11. Obtaining original transaction information, including transaction accounts, transactions between transaction accounts, transaction direction, transaction timestamp, and transaction amount; S12. Construct a graph structure of a dynamic weighted transaction subgraph network based on the transaction accounts, transactions between the transaction accounts, transaction directions, and transaction timestamps. The graph structure of the dynamic weighted transaction subgraph network is the same as the graph structure of the time-series transaction subgraph network. Nodes in the graph structure of the dynamic weighted transaction subgraph network represent transactions, and edges represent transaction relationships that satisfy the time sequence. S13. Determine the edge weights of the dynamic weighted transaction subgraph network based on the transaction timestamp, transaction amount, a preset transaction amount weight coefficient, and a preset time decay coefficient; The step S13 determines the edge weights of the dynamic weighted transaction subgraph network according to the transaction timestamp, the transaction amount, the preset transaction amount weight coefficient, and the preset time decay coefficient, including: S131. Calculate time decay based on the transaction timestamp and the following formula (1): （1） in, decay represents the time decay coefficient, t 1 and t 2 represents the transaction timestamps of different transactions; S132. Calculate the amount weight based on the transaction amount, the preset transaction amount weight coefficient, and the following formula (2): （2） in, Indicates the amount weight, and Represents the transaction amount of different transactions, Indicates the preset transaction amount weight coefficient; S133. Calculate the edge weights of the dynamic weighted transaction subgraph network based on the transaction amount, time decay, amount weight, and the following formula (3): （3）。 2. The blockchain phishing account detection method based on dynamic weighted transaction subgraph according to claim 1 is characterized in that: The structures of the first-level graph neural network, the second-level graph neural network, and the third-level graph neural network are the same, but the network parameters are different; The structures of the first-level graph neural network, the second-level graph neural network, and the third-level graph neural network each include a first convolutional layer, a second convolutional layer, and a third convolutional layer; The step S3 inputs the dynamic weight transaction subgraph network into the first-level graph neural network to obtain a first allocation matrix, including: S31. Input the dynamic weight transaction subgraph network into the first convolutional layer, perform feature transformation through the DenseSAGEConv graph convolution operation to obtain a first initial convolution feature, process the first initial convolution feature through the ReLU activation function, and optimize the first initial convolution feature through batch normalization to obtain a first convolution feature; S32, inputting the first convolutional feature into the second convolutional layer to obtain a first initial high-order feature, processing the first initial high-order feature through a ReLU activation function, and optimizing the first initial high-order feature through batch normalization to obtain a first high-order feature; S33, inputting the first high-order feature into the third convolutional layer to obtain a second initial high-order feature, processing the second initial high-order feature through a ReLU activation function, and optimizing the second initial high-order feature through batch normalization to obtain a second high-order feature; S34. Concatenate the first convolution feature, the first high-order feature, and the second high-order feature along the channel dimension to obtain a fused feature, that is, obtain a first allocation matrix.

3. The blockchain phishing account detection method based on dynamic weighted transaction subgraph according to claim 1 is characterized in that: The first-level differentiable graph pooling layer and the second-level differentiable graph pooling layer have the same structure but different network parameters; The first-level differentiable graph pooling layer includes a node embedding generator, a distribution matrix learner, and a hierarchical pooling layer; The step S4 inputs the first allocation matrix into the first-level differentiable graph pooling layer to obtain a first compression feature, including: S41, embedding the first allocation matrix input node into the generator, and extracting high-order node representation through multi-layer graph convolution; S42, input the first allocation matrix into the allocation matrix learner, and generate a soft allocation matrix from node to super node through an independent GNN module; S43. Input the high-order node representation and the soft allocation matrix into the hierarchical pooling layer, retain the key transaction path, aggregate the nodes with high-frequency interactions into super nodes, abstract the node features, and obtain the first compressed features.

4. A blockchain phishing account detection device based on a dynamic weighted transaction subgraph, wherein the blockchain phishing account detection device based on a dynamic weighted transaction subgraph is used to implement the blockchain phishing account detection method based on a dynamic weighted transaction subgraph as described in any one of claims 1 to 3, characterized in that: The device comprises: The construction unit is used to build a dynamic weighted transaction subgraph network based on the original transaction information; An acquisition unit is configured to acquire a blockchain phishing account detection model, wherein the blockchain phishing account detection model includes a first-level graph neural network, a first-level differentiable graph pooling layer, a second-level graph neural network, a second-level differentiable graph pooling layer, a third-level graph neural network, and a classifier module; A first processing unit is configured to input the dynamic weight transaction subgraph network into a first-level graph neural network to obtain a first allocation matrix; A second processing unit is configured to input the first allocation matrix into a first-level differentiable graph pooling layer to obtain a first compressed feature; A third processing unit is configured to input the first compressed features into the second-level graph neural network to obtain a second allocation matrix; a fourth processing unit, configured to input the second allocation matrix into a second-level differentiable graph pooling layer to obtain a second compressed feature; A fifth processing unit is configured to input the second compressed features into the third-level graph neural network to obtain a global graph feature; The classification unit is used to input the global features of the graph into the classifier module to obtain the prediction results of blockchain phishing accounts.

5. The blockchain phishing account detection device based on dynamic weighted transaction subgraph according to claim 4 is characterized in that: The building block is used to: S11. Obtaining original transaction information, including transaction accounts, transactions between transaction accounts, transaction direction, transaction timestamp, and transaction amount; S12. Construct a graph structure of a dynamic weighted transaction subgraph network based on the transaction accounts, transactions between the transaction accounts, transaction directions, and transaction timestamps. The graph structure of the dynamic weighted transaction subgraph network is the same as the graph structure of the time-series transaction subgraph network. Nodes in the graph structure of the dynamic weighted transaction subgraph network represent transactions, and edges represent transaction relationships that satisfy the time sequence. S13. Determine the edge weights of the dynamic weighted transaction subgraph network based on the transaction timestamp, the transaction amount, the preset transaction amount weight coefficient, and the preset time decay coefficient.

6. The blockchain phishing account detection device based on dynamic weighted transaction subgraph according to claim 5 is characterized in that: The building block is used to: S131. Calculate time decay based on the transaction timestamp and the following formula (1): （1） in, Indicates the amount weight, and Represents the transaction amount of different transactions, Indicates the preset transaction amount weight coefficient; S133. Calculate the edge weights of the dynamic weighted transaction subgraph network based on the transaction amount, time decay, amount weight, and the following formula (3): （3）。 7. A blockchain phishing account detection device based on a dynamic weighted transaction subgraph, characterized in that: The blockchain phishing account detection device based on the dynamic weighted transaction subgraph includes: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, which can be called by a processor to execute the method according to any one of claims 1 to 3.

Images