Address identity identification method and system based on two-layer transaction network

Abstract

This invention discloses a method and system for identifying address identity based on a two-tier transaction network, belonging to the field of blockchain data analysis technology. The method comprises collecting transaction data and processing it to obtain a transaction record set; identifying suspicious addresses in the transaction record set and tracing the transaction flow paths between the suspicious addresses; and analyzing the transaction flow paths to determine the likelihood that two suspicious addresses belong to the same user or organization. Compared to existing technologies that rely on complex algorithms for identification, this method and system for identifying address identity based on a two-tier transaction network reduces computational complexity and is suitable for large-scale transaction data processing.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain data analysis, and specifically relates to a method and system for identifying address identity based on a two-layer transaction network. Background Art

[0002] Blockchain technology, with its highly transparent, decentralized, tamper-proof, and anonymous nature, has created a new way for online information exchange in the internet age that doesn't rely on trusted third-party institutions. Numerous public blockchains have been launched, with Tron being a mainstream one.

[0003] Tether, abbreviated as USDT, is a token issued by Tether and backed by the stablecoin USD (USD). USDT's parity with the same amount of US dollars makes it a valuable store of value in the volatile cryptocurrency market. Among the major public blockchains, the stablecoin Tether has the highest liquidity. Currently, there are three versions of USDT on the market, based on different blockchain networks: Omni-USDT, ERC20-USDT based on the Ethereum mainchain, and USDT-TRC20 based on the TRON mainchain. While these three USDT versions have the same price and are used identically on exchanges, they maintain separate and incompatible on-chain formats. Specifically, addresses differ: Omni-USDT addresses begin with 1, ERC20-USDT addresses begin with 0x, and USDT-TRC20 addresses begin with a prefix of T. USDT-TRC20 is a USD-pegged stablecoin issued by Tether on the TRON network and can be issued, transferred, and traded on Tron. The Tron public chain uses a cryptocurrency called Tronix (TRX).

[0004] Currently, tracking transaction behavior and user identities by deploying detection nodes or designing new blockchain-based proof methods is often difficult to implement effectively due to timeliness issues and the difficulty in comprehensively collecting key information transmitted at the cryptocurrency network layer. Therefore, it is necessary to develop a new address identity verification method and system based on a two-layer transaction network to solve the current problem of difficulty in verifying the owner identity and association behind different addresses. Summary of the Invention

[0005] The purpose of the present invention is to provide a method and system for address identity identification based on a two-layer transaction network to solve the above-mentioned problems.

[0006] To achieve the above-mentioned purpose, the present invention provides the following technical solution: a method for identifying address identity based on a two-layer transaction network, comprising:

[0007] Collect transaction data and process it to obtain a transaction record set;

[0008] Identifying suspicious addresses in the transaction record set and tracing transaction flow paths between the suspicious addresses;

[0009] The transaction flow path is analyzed to determine the possibility that the two suspicious addresses belong to the same user or organization.

[0010] Preferably, the step of identifying suspicious addresses in the transaction record set and tracing transaction flow paths between the suspicious addresses includes:

[0011] Use transaction time sequence constraints to screen effective transaction paths;

[0012] Calculate the maximum capital flow on all valid transaction paths;

[0013] Calculate the effective transfer amount from the source node on the valid transaction path, i.e. the sender address at the starting point of the transaction path, to the sink node, i.e. the receiver address at the end point of the transaction path.

[0014] Preferably, the method of screening valid transaction paths by using transaction time sequence constraints includes: for each path from source node i to sink node j, checking the time sequence constraint of the path, which is expressed as follows:

[0015]

[0016] Among them, t represents the time when the transfer transaction corresponding to the edge connecting the two nodes occurs, k1, k2, ..., k n-1 , k n represents the intermediate nodes on a transaction path from source node i to sink node j, n represents the number of nodes passed through from source node i to sink node j, Indicates the transaction timestamp of a direct transaction from node k1 to node k2;

[0017] If a transaction path satisfies the time order constraint, it is considered a valid transaction path and is retained. The process of filtering valid transaction paths in the transaction flow continues. For example, there are three paths from source node i to sink node j: i-k1-k2-j, and ik′1-k′2-j and ik″1-k″2-j. Valid paths are filtered from smallest to largest time constraints. This is because i's transfer to k1 must occur before k2's transfer to j, otherwise the path is invalid.

[0018] Preferably, the calculating of the maximum capital flow on all valid transaction paths includes: for each valid transaction path, calculating the maximum capital flow on the path:

[0019]

[0020] Among them, f pIndicates the effective transaction amount of a valid transaction path p; represents the direct transaction amount from node k1 to node k2, and n represents the number of nodes passed through from source node i to sink node j.

[0021] Preferably, the calculating of the effective transfer amount from the source node to the sink node includes:

[0022]

[0023] Among them, v ij represents the effective transfer amount from source node i to sink node j, P ij represents the set of all possible valid transaction paths from source node i to sink node j, f p It represents the effective transaction amount of a certain effective transaction path, and p represents a certain effective transaction path found.

[0024] Preferably, analyzing the transaction flow to determine the possibility that two suspicious addresses belong to the same user or organization includes:

[0025] Measure the frequency of mutual conversions between two suspicious addresses;

[0026] The identity index is used to determine whether two suspicious addresses belong to the same user or group.

[0027] Preferably, the measuring of the frequency of mutual conversion between two suspicious addresses includes:

[0028] The formula for calculating the harmonic mean H is as follows:

[0029]

[0030] in, represents the number of transactions from source node i to sink node j in the x-layer network, represents the number of transactions from sink node j to source node i in the x-layer network.

[0031] Preferably, the transaction capital flow intensity M is calculated to measure the total amount of mutual transfers between source node i and sink node j. The formula is as follows:

[0032] represents the effective transaction amount from source node i to sink node j in the x-layer network, represents the effective transaction amount from sink node j to source node i in the x-layer network, Indicates the maximum transaction amount between a pair of addresses in the network, used for normalization;

[0033] Use weight parameters to adjust the mutual conversion index of two factors The impact of mutual conversion index The formula is as follows:

[0034]

[0035] Where α and β represent weight parameters, H represents the harmonic mean, and M represents the intensity of trading capital flow.

[0036] Preferably, determining whether two suspicious addresses belong to the same user or group by using an identity index includes:

[0037] The identity index S of address i and address j ij The formula is as follows:

[0038]

[0039] in, Indicates the mutual transfer index of transactions between addresses i and j in the A-layer network, represents the number of transactions from source node i to sink node j in the B-layer network, Represents the number of transactions from sink node j to source node i in the B-layer network.

[0040] The present invention further provides an address identity verification system based on a two-layer transaction network, comprising:

[0041] Transaction data collection module, used to collect transaction data;

[0042] A processing module, used to process transaction data to obtain a transaction record set;

[0043] A transaction flow path identification module, configured to identify suspicious addresses in the transaction record set and track transaction flow paths between the suspicious addresses;

[0044] The hidden funds determination module is used to analyze the transaction flow path of the transaction record collection to determine the hidden funds;

[0045] The possibility analysis module is used to analyze the transaction flow path to determine the possibility that two suspicious addresses belong to the same user or organization. The technical effects and advantages of the present invention are as follows: the address identity identification method and system based on the two-layer transaction network, by analyzing the public transaction records, extracts transaction characteristics and rules, and then judges the correlation between addresses on different chains, and mines the hidden address clusters under the same user or organizational structure; the transaction records publicly available on the blockchain website can be directly used to conveniently obtain the transaction data set of the on-chain address. The data source is transparent and easy to access, making the transaction data set easy to obtain; and based on actual regulatory needs, by analyzing historical case data, a feasible address identity determination rule is summarized and summarized, and the identity between addresses is modeled using mathematical formulas, thereby providing an efficient and reliable hidden address identification method to solve the problem that the existing technology has not fully utilized the transaction relationship between addresses to determine the identity of the address; compared with the existing technology that relies on complex algorithms for identification, it reduces the computational complexity and is suitable for large-scale transaction data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Schematic diagram of the process of the present invention;

[0047] Figure 2 A transaction relationship attribute map for the method of the present invention;

[0048] Figure 3 The effective transaction path of the method of the present invention refers to an example diagram of a transaction path that meets the transaction time sequence constraint. DETAILED DESCRIPTION

[0049] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0050] The present invention provides Figure 1 A method for identifying address identity based on a two-layer transaction network is shown in [1]. It mines hidden on-chain addresses and different addresses belonging to the same user or group to solve the problem of difficulty in identifying the owner identity and association behind different existing addresses.

[0051] This embodiment constructs a method for address identity verification based on a two-layer transaction network on the TRON chain, including the following steps:

[0052] Transaction data collection: Synchronize transaction information on the blockchain, extract incoming and outgoing transaction data (including USDT-TRC20 and TRX transactions) based on input addresses, such as suspicious accounts, and use the counterparty address as a new input address. Recursively retrieve and download transaction data until the counterparty is a large exchange account or platform address, forming the original transaction data set;

[0053] Transaction data cleaning: Clean the original transaction data set to remove duplicate and invalid records, such as non-USDT, non-TRX transactions, or records with transaction amounts less than 0.01, to obtain two transaction record sets: USDT-TRC20 and TRX.

[0054] Constructing a two-layer network: Based on the USDT-TRC20 and TRX transaction record sets, a labeled property graph (LPG) is constructed. Specifically, a weighted directed graph is used to represent the transfer-in and transfer-out relationships between USDT-TRC20 and TRX transaction addresses, respectively, thereby constructing a two-layer network (multi-relationship network) based on USDT-TRC20 and TRX transaction records. The upper-layer network represents the USDT-TRC20 transfer-in and transfer-out relationships through nodes and weighted directed edges, while the lower-layer network represents the TRX transfer-in and transfer-out relationships through nodes and weighted directed edges. Since the upper and lower-layer networks have the same address sets, the inter-layer coupling relationship can be established by whether the addresses are the same, forming a complete two-layer network structure. It's important to note that some addresses only have a single USDT-TRC20 transaction relationship, some only have a single TRX transaction relationship, and some have both USDT-TRC20 and TRX transactions. This two-layer network intuitively reflects the correlation between different transaction types (USDT-TRC20 and TRX) between addresses. In this two-layer transaction network, each layer represents a different transaction currency, with nodes representing addresses and directed edges between nodes representing transfer transactions between addresses. Edge attributes record transaction time and amount.

[0055] Transaction flow analysis: Valid transaction paths within the USDT-TRC20 transaction layer are screened based on chronological constraints. The maximum flow of funds from the source node (suspicious account) to the sink node (destination account) is calculated to identify the primary paths and key nodes of fund flow. Furthermore, the total transaction amount, number of inbound and outbound transactions, frequency of round-trip transactions between two suspicious addresses, mutual transfer (round-trip) metrics, and identity metrics of a specific address within the USDT-TRC20 and TRX transaction layers are analyzed to identify address pairs with common social relationships.

[0056] Transaction data visualization: Visualize the transaction topology of address pairs belonging to common social relationships.

[0057] The specific operations of transaction data collection are as follows: based on the first input address, i.e. the suspicious address, the incoming and outgoing transaction data of the input address are extracted through the synchronized on-chain transaction information, the counterparty is redefined as the input address, and the counterparty's transaction data is continued to be retrieved and downloaded as the original transaction data until the counterparty is a large account of the exchange or a platform address.

[0058] Invalid records refer to records that are not USDT, not TRX, or have a transaction amount less than 0.01. The final table contains transaction hash, block height, date and time, sender, receiver, token, and transaction amount data.

[0059] A valid transaction path refers to a transaction path that satisfies transaction time order constraints. The maximum capital flow of a transaction path refers to the maximum possible capital flow between nodes while satisfying the capacity constraints of all edges and flow conservation conditions. The total transaction amount refers to the total amount of incoming and outgoing transactions from a specific transaction address. The total amount of incoming and outgoing transactions refers to the total amount of incoming and outgoing transactions between all addresses in a certain layer of the transaction network, which is the sum of the above total transaction amounts. The round-trip transaction frequency refers to the total number of transactions between a pair of addresses in a certain layer of the transaction network. The mutual transfer indicator is used to measure the likelihood that two suspicious addresses are connected.

[0060] The identity index is used to measure the likelihood that two suspicious addresses belong to the same user or group.

[0061] Common social relationships that can be analyzed include, but are not limited to: one address specifically used to receive withdrawals from the exchange and transfer them to another address used for outbound transfers.

[0062] The address identity identification method based on a two-layer transaction network refers to the construction of a two-layer transaction network of USDT-TRC20 and TRX based on on-chain address transaction data. By analyzing the transaction relationships between addresses on the same layer and between layers, the correlation between addresses is mined, and it is determined whether multiple different addresses are owned by the same person or the same organization. This provides algorithmic support for finding other addresses hidden by the owner or team of a designated suspicious account.

[0063] If there are frequent mutual transfers between two virtual addresses on the two-layer network, then these two suspicious addresses are likely to belong to the same user or the actual controllers behind them are highly correlated.

[0064] The above method solves the problem of difficulty in identifying the owner identity and association behind different addresses, and proposes a method for calculating the maximum flow of funds transferred from the initial node to the sink node on the transaction path based on the improved network maximum flow algorithm. Specifically:

[0065] Improve identification accuracy: By analyzing the number of mutual transfers, it is possible to more accurately determine whether two addresses belong to the same user or group. Analyzing the number of transactions on the two-layer network and referring to multiple sets of data at the same time can improve the accuracy of address identity identification. Low computational complexity: This application does not need to collect and analyze massive transaction data. Instead, it starts from a single address and mines related transaction information along the transaction chain until the exchange address or platform address is identified. Since it only focuses on counterparty information directly or indirectly related to the initial input address, and gradually expands the search scope through recursion, the number of calculation addresses involved is limited, the data processing scale is controllable, and the computational complexity is significantly reduced.

[0066] Efficiently mine hidden funds: Based on the improved network maximum flow algorithm, a maximum flow algorithm is proposed to track the hidden transaction flow paths between multiple addresses and mine the maximum flow of funds hidden by the sink nodes in the transaction chain.

[0067] This application solves the problems existing in the prior art in the transfer transaction amounts between virtual addresses and the identification of the owners of different addresses through a simple and effective method, improves the accuracy of identification, reduces the computational complexity, and provides a more effective technical means for the supervision of virtual addresses.

[0068] The USDT transaction address identity verification method based on the TRC20 protocol includes four steps: transaction data collection and cleaning, building a two-layer network, analyzing transaction flows, and visualizing transaction data. The steps are as follows:

[0069] Step 1: Transaction data collection and cleaning:

[0070] Step 11. Obtain transaction records of the initial address: Starting from the designated suspicious address, download all transaction records of the address through the blockchain browser;

[0071] Step 12: Retrieve the counterparty address: Retrieve and download the transaction records of each counterparty address of the suspicious address one by one;

[0072] Step 13. Recursively expand the search scope: Repeat the above steps, starting with the newly discovered counterparty address, and continue searching and downloading its transaction records until the counterparty is a known exchange address or platform address;

[0073] Step 14: Data aggregation and cleaning: Aggregate all downloaded transaction records and remove duplicate and invalid records through data cleaning to form a complete and valid USDT-TRC20 transaction record set and TRX transaction record set.

[0074] Among them, the blockchain browser refers to the blockchain browser represented by OKLink.

[0075] The complete and valid transaction data set includes the addresses of both parties to the transaction, i.e., the transferor and the transferee, transaction hash, block height, date and time, token, and transaction amount.

[0076] Invalid records include those that are not USDT, not TRX, and have transaction amounts less than 0.01.

[0077] Step 2: Build a two-layer network:

[0078] Step 21: Use the transaction data in the USDT-TRC20 and TRX transaction record sets to construct a two-layer transaction network topology diagram;

[0079] The transaction network consisting of USDT-TRC20 and TRX transactions is abstracted into a two-layer network, where the trader's address is regarded as a node, and the USDT-TRC20 or TRX transaction between two suspicious addresses is regarded as a directed edge;

[0080] It should be noted that since there may be multiple transactions between any two suspicious addresses in the established two-layer network, there may be multiple unidirectional or bidirectional edges between the two nodes. These edges can be represented by creating a labeled attribute graph using Cypher statements. The labeled attribute graph has the following characteristics:

[0081] (1) The tag attribute graph consists of nodes and directed edges, where nodes correspond to on-chain addresses and directed edges correspond to transaction relationships between addresses, such as Figure 2 As shown in the figure; Layer A represents the USDT-TRC20 trading network (the currency used for transactions between addresses is USDT-TRC20), and Layer B represents the TRX trading network (the currency used for transactions between addresses is TRX). Nodes in each layer of the network represent addresses. The addresses of Layer A and Layer B are the same, and the upper and lower layers correspond one to one. The edges with arrows represent the transfer relationship between the two addresses. The edges contain attribute information, namely the transfer time and transaction amount. For example, for Address 1 at 2025 / 2 / 2016:35: 55 transferred 50 USDT to address 5. In addition, address 1 transferred 100 TRX to address 5 at 11:45:32 on 2025 / 2 / 23. This represents an edge from node 1 to node 5 in the A-layer transaction network, and an edge from node 1 to node 5 in the B-layer network. However, the attributes of these two edges (transaction time and amount) are different, and the currencies used to represent the transactions on different layers are also different (USDT-TRC20 in the A-layer and TRX in the B-layer).

[0082] (2) Nodes have attributes described by key-value pairs.

[0083] For example, create(n1:address

[0084] {addr:'TCAJfgnAJLbYjFkqDbonkCVyJz8skg61ND'}) creates a node with the label "address" and the attribute "addr". In this node attribute, the key-value pair is "addr:TCAJfgnAJLbYjFkqDbonkCVyJz8skg61ND", where "TCAJfgnAJLbYjFkqDbonkCVyJz8skg61ND" is the actual on-chain address.

[0085] (3) A connection can have one or more attributes and always has a start node and an end node.

[0086] For example, create

[0087] (n1:address{addr:'TCAJfgnAJLbYjFkqDbonkCVyJz8skg61ND4'})-[r:usdt_trans_to{time:['2023-09-22 13:32:48'],amount:['5USDT']}]->(n2:address{addr:'TVjXoTnE7HFbZ23GHJjYhZpcqJLSHdMp8XL'}) creates a relationship between two nodes with the label "usdt_trans_to" and the attributes "time" and "amount".

[0088] Step 22: Abstract the two-layer network into a directed graph G = (V, E);

[0089] The top layer (layerA) represents the USDT-TRC20 transaction network diagram, and the bottom layer (layerB) represents the TRX transaction network diagram. The thick solid lines in the top layer represent USDT-TRC20 transaction relationships between addresses, while the dotted lines in the bottom layer represent TRX transaction relationships between addresses. The dotted line between the two layers represents the same address in the upper and lower layers, demonstrating the coupling relationship between the USDT-TRC20 network and the TRX network.

[0090] It should be noted that V in the directed graph G=(V, E) is a set of addresses, that is, a set of nodes in the network topology graph.

[0091] E x , x∈{A, B} is the edge set in layer x. For example, E A , represents the edge set of USDT-TRC20 transactions in layer A, E B Represents the edge set of TRX transactions in layer B.

[0092] Denote the node set in layer A as V A, where |V A | is the number of on-chain addresses involved in USDT-TRC20 transactions in Layer A.

[0093] Denote the node set in layer B as V B , where |V B |Indicates the number of on-chain addresses involved in B-layer TRX transactions.

[0094] V=V A ∪V B is the union of the node sets of layer A and layer B, and |V| is the number of nodes in the union.

[0095] and They represent the adjacency matrices of the A-layer graph and the B-layer graph in the two-layer network graph, Represents the number of directed edges from node i to node j in the x-layer graph.

[0096] Step 3: Analyze transaction flow;

[0097] Step 31: To identify suspicious addresses and track the main transaction flow paths between suspicious addresses, analyze the USDT-TRC20 transaction flow and find hidden funds: for example, k1-k2 (k1 to k2, 200 yuan) - k3 (k2 to k3, 50 yuan) - k4 (k3 to k4, 150 yuan). The actual amount transferred from k1 to k4 should be constrained by the transaction time sequence. The amount after screening the valid transaction path is 50 yuan.

[0098] Utilize the transaction time sequence constraint to screen the effective transaction path; since each transaction in the transaction flow has a sequence, for each path from source node i to sink node j, Figure 3 As shown in the figure, TCY3zyEa..., THt34jtu..., TGzgwdHw..., TYxMrB8q..., TMprkhAw..., TAWja7Kq... represent the transaction addresses represented by each node. USDT (TRC-20 standard) on the TRON chain uses the TRON address format with a length of 34 characters. The first 8 are shown in the figure. The transaction time from address i (TCY3zyEa...) to address k1 (THt34jtu...) is 2025 / 3 / 22 11:45:32, the transaction time from address k1 (THt34jtu...) to address k2 (TGzgwdHw...) is 2025 / 3 / 22 13:23:55, it can be seen that address k1 received the transfer from address i, and then address k1 transferred to address k2 After address k2 receives the transfer, it continues to transfer to the downstream receiving address until the final address j (TAWja7Kq...). By judging that the transfers between addresses on the transaction path all meet the time sequence constraint, Indicates that the path is a valid transaction path; checks the time sequence constraints of the path;

[0099]

[0100] Among them, t represents the timestamp of the transfer transaction corresponding to the edge connecting the two nodes, k1, k2, ..., k n-1 , k n is an intermediate node on a transaction path from source node i to sink node j, represents the transaction time of a direct transaction from node k1 to node k2; n represents the number of nodes passed between source node i and sink node j;

[0101] If the transaction path meets the time sequence constraint, it means that the path is a valid transaction path. The path is retained and the valid transaction paths in the transaction flow are further screened.

[0102] Step 32: For each valid transaction path, calculate the maximum capital flow on the path:

[0103]

[0104] Among them, f p Indicates the effective transaction amount of a valid transaction path p; represents the direct transaction amount from node k1 to node k2, and n represents the number of nodes passed through from source node i to sink node j.

[0105] Step 33: Calculate the effective transfer amount from source node i to sink node j:

[0106]

[0107] Among them, v ij represents the effective transfer amount from source node i to sink node j, P ij represents the set of all possible valid transaction paths from source node i to sink node j, f p It represents the effective transaction amount of a certain effective transaction path, and p represents a certain effective transaction path found.

[0108] Step 4: To quantitatively measure the likelihood that two suspicious addresses belong to the same user or organization, we propose a mutual conversion index and an identity index:

[0109] Step 41: Use the improved harmonic mean H to measure the frequency of transactions between address i and address j. The harmonic mean is sensitive to extreme values ​​and is more affected by the minimum value than the maximum value. This means that when the number of transactions from address i to address j is significantly different from the number of transactions from address j to address i, the calculated harmonic mean is close to the smaller value between the two, such as q ij Equal to 90, q ji =10, then the harmonic mean H is equal to 9, which is close to the smaller 10. The improved harmonic mean H calculation formula is:

[0110]

[0111] in, represents the number of transactions from source node i to sink node j in the x-layer network, represents the number of transactions from sink node j to source node i in the x-layer network;

[0112] At the same time, to further consider the impact of transaction amounts, the transaction capital flow intensity index M was introduced by improving the network maximum flow algorithm. This index is used to measure the total amount of mutual transfers between addresses i and j. The calculation formula for transaction capital flow intensity M is as follows:

[0113]

[0114] represents the effective transaction amount from source node i to sink node j in the x-layer network, represents the effective transaction amount from sink node j to source node i in the x-layer network, Indicates the maximum transaction amount between a pair of addresses in the network, used for normalization.

[0115] Considering that the mutual transfer frequency and transaction capital flow intensity have a linear relationship in measuring the correlation between two suspicious addresses, the harmonic mean H and transaction capital flow intensity M are linearly combined to evaluate the correlation between two suspicious addresses; The impact of the two factors on the mutual conversion index varies, so a weight parameter is introduced to adjust the impact of the two factors on the mutual conversion index to achieve a more scientific and accurate quantitative evaluation. In actual application, considering the differences in transaction scale, the weight parameters need to be adjusted according to the specific transaction scale. The initial values ​​of α and β are set to 1 and 10 respectively; for better quantitative analysis results, the parameters are different for different data sets;

[0116] It can be concluded that the mutual conversion index between node i and node j in the x-layer network is for:

[0117]

[0118] in, The number of transactions from source node i to sink node j in the x-layer network;

[0119] The number of transactions from sink node j to source node i in the x-layer network; H represents the harmonic mean, and M represents the transaction capital flow intensity;

[0120] α, β: weight parameters;

[0121] v ij : The effective transaction amount from source node i to sink node j in the x-layer network;

[0122] The effective transaction amount from sink node j to source node i in the x-layer network;

[0123] The maximum transaction amount between a pair of addresses in the network, used for normalization;

[0124] Conversion indicators The improved harmonic mean term H is used to measure the balance of transactions between the two parties; the dynamic weight term (α, β) is used to adjust the impact of the improved harmonic mean H and the transaction capital flow intensity M on the mutual conversion index; the threshold condition is used to Avoid occasional (1st, 2nd transfer) transaction interference.

[0125] Conversion indicators The larger the value, the greater the possibility that there is a connection between the two addresses.

[0126] Step 42: Mutual conversion indicators It can only preliminarily indicate that there is a potential association between the two addresses. In order to further determine whether the two addresses belong to the same user or group, the identity index is introduced as the core judgment basis. This index comprehensively considers two types of transaction behaviors, USDT-TRC20 and TRX. When there are not only USDT-TRC20 transfer records between two suspicious addresses, but also the characteristics of mutual payment of TRX (as transaction fees or independent transfers), it indicates that the address pair has formed a coupling relationship at the two levels of the token trading network and the underlying public chain trading network. The superposition effect of the cross-layer transaction model will significantly increase the identity index value, and ultimately determine that the probability of the address pair belonging to the same user or group is greatly increased. The logarithmic function is used to transform the number of TRX transactions. Its technical principles and parameter selection are based on the following:

[0127] The logarithmic function has a nonlinear mapping characteristic: TRX transaction behavior exhibits a law of diminishing marginal utility in characterizing address association. Specifically, when a TRX transaction occurs for the first time between two addresses, its contribution to proving address association is the greatest; as the number of transactions increases, the evidentiary value of a single new transaction decreases. The logarithmic function (a convex function) can effectively depict this diminishing law, and its mathematical properties conform to the nonlinear relationship between transaction count and association strength in actual business scenarios.

[0128] Technical adaptation of the base parameter: A logarithmic function with a base of 2 (log2) was selected to enhance feature differentiation in low-frequency trading scenarios. When the number of TRX transactions is in a low range (e.g., 1-5 times), the log2 function has a steeper initial growth slope than the natural logarithm or logarithmic functions with a larger base, significantly increasing the judgment weight of initial trading behavior, thereby improving the detection sensitivity of occasional correlated behavior.

[0129] Compensation mechanism for constant terms: The constant term +2 is introduced into the log2(N+2) function. Its technical effects are reflected in two aspects: First, when no TRX transactions occur between two addresses (i.e., N=0), the function value degenerates to log22=1, so that the identity index is automatically restored to the original conversion index, ensuring the robustness of the algorithm in the absence of TRX transaction data; second, the numerical stability of the function in the neighborhood of N=0 is optimized through parameter shifting, avoiding operational anomalies caused by zero-value input.

[0130] The identity between address pairs is measured by multiplying the USDT-TRC20 layer conversion index by the logarithm of the number of TRX transactions. The identity index S between address i and address j is ij The formula is as follows:

[0131] The USDT-TRC20 transfer indicator between layer A addresses i and j; the possible value of x is A or B;

[0132] The higher the value, the higher the probability that address i is associated with j. ij The higher the value, the more likely it is that addresses i and j not only have USDT-TRC20 transactions but also transfer TRX to each other, indicating a higher probability that a pair of addresses belong to the same user or group.

[0133] Step 5: Transaction data visualization:

[0134] The py2neo package in Python is used to import transaction data in batches into the Neo4j graph database, which is used to store the complex transaction network topology between addresses.

[0135] The transaction paths between addresses are output using Cypher statements. Cypher is a declarative graph database query language.

[0136] This application realizes the intuitive visualization of transaction relationships between addresses. By constructing a marked attribute graph and using a directed graph to clearly represent the coupling relationship between the USDT-TRC20 and TRX transaction networks, the transaction flow and association relationship between addresses can be clearly seen, significantly improving the analysis efficiency and explainability of the transaction network.

[0137] The present invention also provides an address identity determination system for implementing the above method, comprising:

[0138] Transaction data collection module: Synchronizes transaction information on the blockchain, extracts its inbound and outbound transaction data (including USDT-TRC20 and TRX transactions) based on the input address (such as suspicious accounts), and uses the counterparty address as the new input address to recursively retrieve and download transaction data until the counterparty is a large exchange account or platform address, forming the original transaction data set.

[0139] Transaction data cleaning module: Cleans the original transaction data set, removes duplicate records and invalid records, such as non-USDT, non-TRX transactions, or records with transaction amounts less than 0.01, and obtains two transaction record sets, USDT-TRC20 and TRX.

[0140] Two-layer network construction module: Build a labeled attribute graph based on USDT-TRC20 and TRX on-chain address transaction data. Use a directed graph to represent the transfer-in and transfer-out relationships between addresses, building a multi-relationship network graph where nodes represent addresses and directed edges represent transfer-in and transfer-out relationships.

[0141] Transaction Flow Analysis: This module filters valid transaction paths within the USDT-TRC20 transaction layer based on chronological constraints, calculates the maximum flow of funds from the source node (suspicious account) to the sink node (destination account), and identifies the primary paths and key nodes of fund flow. Furthermore, it analyzes the round-trip transaction frequency, mutual conversion metrics, and identity metrics between two suspicious addresses within the USDT-TRC20 and TRX transaction layers to identify address pairs with common social relationships.

[0142] Transaction data visualization module: visualizes the transaction topology of address pairs belonging to common social relationships.

[0143] The address identity verification method based on a two-layer transaction network is based on the USDT-TRC20 on-chain transaction network and includes five major modules: transaction data collection, transaction information cleaning, two-layer network construction, transaction flow analysis, and transaction data visualization. The system requires a USDT address at the entry point, which is defined as the input address. The system extracts the incoming and outgoing transactions of the input address through synchronized on-chain transaction information, and sets the counterparty's address as the new input address. The system continuously retrieves and downloads the counterparty's transaction data as raw transaction data until the counterparty is a large exchange account or platform address. The downloaded data is then integrated and screened to remove duplicate and invalid records. Based on the cleaned and aggregated transaction data set, a topological map describing the USDT-TRC20 and TRX two-layer transaction networks is constructed. Conventional indicators and the new indicators proposed in this invention are used to analyze the transaction data, identify possible social relationships, and ultimately achieve transaction data visualization.

[0144] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for address identity verification based on a two-layer transaction network, characterized by: include: Collect transaction data and process the transaction data to obtain a transaction record set; Build a two-layer network based on the transaction record set; Identifying suspicious addresses in the transaction record set and tracing transaction flow paths between the suspicious addresses; Analyzing the transaction flow path to determine the likelihood that the two suspicious addresses belong to the same user or organization; The construction of a two-layer network based on the transaction record set includes: A two-layer transaction network topology is constructed using transaction data from the USDT-TRC20 and TRX transaction record sets. The transaction network composed of USDT-TRC20 and TRX transactions is abstracted into a two-layer transaction network, where the trader's address is a node and the USDT-TRC20 or TRX transaction between two suspicious addresses is considered a directed edge. Abstract the two-layer transaction network into a directed graph ; Represents a collection of addresses, represents an edge set; The possibility of determining that two suspicious addresses belong to the same user or organization by analyzing the transaction flow path includes: Use identity indicators to determine whether two suspicious addresses belong to the same user or organization; Determining whether two suspicious addresses belong to the same user or organization by using the identity indicator includes: Source Node Sink Node Identity index The formula is as follows: ;in, express B From the source node in the layer network To the sink node The number of transactions, express B Sink node in the layer network To the source node The number of transactions, express Layer 2 network address and The mutual conversion indicator between transactions.

2. The method for identifying address identity based on a two-tier transaction network according to claim 1, characterized in that: The identifying of suspicious addresses in the transaction record set and tracing the transaction flow paths between the suspicious addresses includes: Use transaction time sequence constraints to screen effective transaction paths; Calculate the maximum capital flow on all valid transaction paths; Calculate the effective transfer amount from the source node to the sink node on the valid transaction path.

3. The method for identifying address identity based on a two-tier transaction network according to claim 2, characterized in that: The method of using transaction time sequence constraints to screen valid transaction paths includes: checking each transaction path from the source node To the sink node The time sequence constraint of the transaction flow path is expressed as follows: ； in, Indicates the transfer transaction timestamp corresponding to the edge connecting two nodes, Represents the source node To the sink node An intermediate node on a transaction flow path, Indicates that the source node To the sink node The number of nodes passed, Indicates a slave node To Node The transaction time of direct transactions; If the transaction flow path satisfies the time sequence constraint, the path is a valid transaction path, and the valid transaction path between the source node and the sink node is further screened.

4. The method for identifying address identity based on a two-tier transaction network according to claim 2, characterized in that: Calculating the maximum capital flow on all valid transaction paths includes: calculating the maximum capital flow on each valid transaction path: ； in, Indicates a valid transaction path The effective transaction amount; Represents a slave node To Node Direct transaction amount, Represents the source node To the sink node The number of nodes passed through.

5. The method for identifying address identity based on a two-tier transaction network according to claim 2, characterized in that: Calculating the effective transfer amount from the source node to the sink node on the effective transaction path includes: ； in, Indicates that the source node To the sink node The effective transfer amount, Indicates that the source node To the sink node The set of all possible valid transaction paths, Indicates a valid transaction path The effective transaction amount, Indicates a valid transaction path found.

6. The method for identifying address identity based on a two-tier transaction network according to claim 1, characterized in that: The analyzing the transaction flow path to determine the possibility that the two suspicious addresses belong to the same user or organization also includes: Measures the frequency of mutual transitions between two suspicious addresses.

7. The method for identifying address identity based on a two-tier transaction network according to claim 6, characterized in that: The measurement of the frequency of mutual conversion between two suspicious addresses includes: Calculating the harmonic mean , the formula is as follows: ； in, express From the source node in the layer network To the sink node The number of transactions, express Sink node in the layer network To the source node Number of transactions; Calculating transaction capital flow intensity , the formula is as follows: ； in, express From the source node in the layer network To the sink node The effective transaction amount, express Sink node in the layer network To the source node The effective transaction amount, Indicates the maximum transaction amount between a pair of suspicious addresses in the network; Use weight parameters to adjust the mutual conversion index of two factors The impact of mutual conversion index The formula is as follows: ； in, Represent the weight parameters, represents the harmonic mean, Indicates the strength of transaction capital flow, The value is or .

8. A system for implementing the address identity verification method based on a two-tier transaction network as claimed in claim 1, characterized in that: The system comprises: Transaction data collection module, used to collect transaction data; A processing module, used to process transaction data to obtain a transaction record set; A transaction flow path identification module, configured to identify suspicious addresses in the transaction record set and track the fund flow paths between the suspicious addresses; A hidden funds determination module, configured to analyze the transaction flow path in the transaction record collection to determine the hidden funds; The possibility analysis module is used to analyze the transaction flow path to determine the possibility that two suspicious addresses belong to the same user or organization.

9. The system according to claim 8, characterized in that: The system further comprises: A module for performing the steps of any one of claims 2 to 7.

Images