Ethereum phishing account detection method, device and equipment

Abstract

The invention provides an Ethereum phishing account detection method, device and equipment. The method comprises the following steps: carrying out effective time sequence sampling on an Ethereum transaction network by utilizing dynamic random walk; representing the sampled data as a discrete dynamic weighted directed multiple graph; image signal processing is carried out on the discrete dynamic weighted directed multiple graphs, graph signals of all the time snapshots are determined, and the graph signals comprise different dimension features of all nodes in the time snapshots; the discrete dynamic weighted directed multi-graph and the graph signal of each time snapshot are input into a pre-trained detection network for phishing detection, the phishing score of each node is determined, and the phishing score represents the probability that the corresponding node is a phishing account; and determining a phishing account in the transaction network based on the phishing score of each node. According to the Ethereum network phishing account detection method provided by the invention, the phishing account can be effectively and accurately identified and determined.

Description

Technical Field

[0001] The present invention belongs to the technical fields of blockchain security and network security, and particularly relates to a method, device, and equipment for detecting phishing accounts in an Ethereum network. Background Art

[0002] With the rise of decentralized finance (DeFi) and smart contract applications, phishing attacks have become a serious security threat. Attackers conduct phishing through fake contracts and forged websites, taking advantage of users' cognitive gaps in blockchain technology to steal users' private information or funds. It has high concealment and destructiveness, causing serious financial losses to users and blockchain platforms. Traditional phishing detection research mainly focuses on identifying suspicious phishing websites, as well as detecting phishing emails and messages. In contrast, the transparency and traceability of blockchain make it possible to detect suspicious phishing addresses and trace stolen funds by analyzing transaction data and fund flows. These data contain rich information such as transaction amounts, transaction directions, and transaction addresses, which helps in in-depth analysis and identification of phishing activities. Early methods relied on manual feature extraction and traditional machine learning methods. Currently, methods based on graph representation learning are mainstream, such as network embedding, graph neural networks, etc. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a method, device, and equipment for detecting phishing accounts in an Ethereum network that can effectively and accurately identify and determine phishing accounts.

[0004] The content of the present invention includes providing a method for detecting phishing accounts in an Ethereum network, comprising: Effectively sampling the time series of the Ethereum transaction network using dynamic random walk; Representing the sampled data as a discrete dynamic weighted directed multi-graph, where the dynamic weighted directed multi-graph includes time snapshots corresponding to each time step, and the time snapshots form a weighted directed multi-graph, and the weighted directed multi-graph represents the trading volume between the nodes involved at the corresponding time step, and each node represents an account; Performing image signal processing on the discrete dynamic weighted directed multi-graph to determine the graph signal of each time snapshot, where the graph signal contains different dimensional features of each node in the time snapshot; Inputting the discrete dynamic weighted directed multi-graph and the graph signal of each time snapshot into a pre-trained detection network for phishing detection to determine the phishing score of each node, where the phishing score represents the probability that the corresponding node is a phishing account; Determining phishing accounts in the transaction network based on the phishing scores of each node.

[0005] In one embodiment, the sampling of the effective time series of the transaction network using the dynamic random walk of Ethereum includes: Normalize the transaction amounts and transaction times in the transaction network; Calculate the time deviation distribution of the normalized transaction network; Based on the exponential function, calculate the time interval weight between each historical transaction time and the current moment in the normalized transaction network. The shorter the time interval, the greater the weight value; Based on the time deviation distribution and time interval weight, determine the initial transaction time and initial edge of the random walk; Perform a random walk based on the initial transaction time and initial edge; Determine the neighbor nodes of the nodes in the current edge. Based on the transaction amounts and transaction frequencies involved between the nodes and the neighbor nodes, determine the next node for the walk from the neighbor nodes; Obtain the effective time series based on the nodes and edges that have been walked through.

[0006] In one embodiment, the method further includes: Set the number of walks for each node, the minimum length of each walk, the maximum length of each walk, and the context window count; Perform a random walk in the transaction network according to the number of walks for each node, the minimum length of each walk, the maximum length of each walk, and the context window count as the walk rules to obtain the effective time series.

[0007] In one embodiment, the determination of the graph signal of each time snapshot includes: Based on the information in the time snapshot, calculate the in-degree, out-degree, degree, incoming transaction amount, outgoing transaction amount, total transaction amount, number of first-order neighbor nodes, and reciprocal of the transaction frequency of each node in the time snapshot. The reciprocal of the transaction frequency is determined by dividing the time span between the first and last transactions of the node by its degree.

[0008] In one embodiment, the pre-trained detection network is trained through the following steps: Construct a diffusion convolutional evolutionary recurrent neural network as the initial network; Use the training time snapshots and the graph signals calculated based on the training time snapshots as training data, and train the initial network based on the stochastic gradient algorithm and the cross-entropy loss function to obtain the detection network. The training includes the calculation of convolutional filter parameters, the calculation of node embeddings, and the calculation of fishing scores.

[0009] In one embodiment, the calculation of convolutional filter parameters includes: Based on the diffusion convolutional layer in the initial network, diffusion convolution operations are performed on the graph signal and the filter using time snapshots to map the P-dimensional features of the graph signal into Q-dimensional output features; The gated recurrent unit is combined to process the input features at the current moment and the output features at the previous moment to obtain the reset gate and the update gate corresponding to the current moment, and the output features of the diffusion convolutional layer at the current moment are calculated and updated in combination with the reset gate and the update gate, and the output features form the node embeddings corresponding to the nodes; Using the gated recurrent unit, the parameters of the filter at the current moment are calculated and determined based on the filter parameters at the previous moment, the reset gate at the current moment, and the update gate.

[0010] In one embodiment, the calculation of the node embeddings includes: The gated recurrent unit is used to calculate and update the output features of the diffusion convolutional layer at the current moment with the output features of the diffusion convolutional layer at the current moment as the input and the output features of the diffusion convolutional layer at the previous moment as the hidden state of the trading network.

[0011] In one embodiment, the calculation of the phishing score includes: The Softmax activation function is used to calculate the updated output features to determine the phishing score of each node.

[0012] Another embodiment of the present invention also provides an Ethereum network phishing account detection device, including: A sampling module for sampling an effective time series of the Ethereum trading network using dynamic random walk; A representation module for representing the sampled data as a discrete dynamic weighted directed multi-graph, the dynamic weighted directed multi-graph including time snapshots corresponding to each time step, the time snapshots forming a weighted directed multi-graph, and the weighted directed multi-graph representing the trading volume between the involved nodes at the corresponding time step, and each node representing an account; A processing module for performing image signal processing on the discrete dynamic weighted directed multi-graph to determine the graph signal of each time snapshot, and the graph signal includes different dimensional features of each node in the time snapshot; A detection module for inputting the discrete dynamic weighted directed multi-graph and the graph signal of each time snapshot into a pre-trained detection network for phishing detection to determine the phishing score of each node, and the phishing score represents the probability that the corresponding node is a phishing account; A determination module for determining the phishing accounts in the trading network based on the phishing score of each node.

[0013] Another embodiment of the present invention also provides an electronic device, including: One or more processors; A memory configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the Ethereum phishing account detection method described in any one of the above.

[0014] The beneficial effects of the present invention include that compared with the existing solution of directly obtaining all transactions for processing, the solution of the present application can capture effective time transaction sequences, accurately retain the graph structure and features in the transaction network, improve data utilization rate, and reduce data processing volume. Moreover, the detection model constructed in the present application can respectively fully capture the structural and temporal dynamic features of the phishing network compared with the detection models in the existing solutions, and can adapt to the constantly changing transaction network in real time, automatically update parameters and node embeddings, enhance the self-adaptability of the model to network dynamics, achieve a comprehensive capture of the dynamic features of the phishing network, and finally accurately identify and determine phishing nodes. Compared with the existing solutions, the capture efficiency of phishing nodes is significantly improved.

[0015] Other features and advantages of the present application will be described in the following specification, and part of them will become obvious from the specification, or be understood by implementing the present application. The objectives and other advantages of the present application can be achieved and obtained through the structures specifically pointed out in the written specification, claims, and drawings.

[0016] The technical solutions of the present application will be further described in detail below through the accompanying drawings and embodiments. Description of the Drawings

[0017] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0018] Figure 1 It is a schematic flowchart of the Ethereum phishing account detection method in an embodiment of the present invention.

[0019] Figure 2 It is a schematic flowchart of the Ethereum phishing account detection method in another embodiment of the present invention.

[0020] Figure 3 It is a structural block diagram of the Ethereum phishing account detection device in an embodiment of the present invention. Detailed Description of the Embodiments

[0021] Next, specific embodiments of the present invention will be described in detail with reference to the accompanying drawings, but this is not intended to limit the present invention.

[0022] It should be understood that various modifications can be made to the embodiments disclosed herein. Therefore, the following description should not be regarded as limiting, but merely as an example of the embodiments. Those skilled in the art will think of other modifications within the scope of the present disclosure.

[0023] The accompanying drawings, which are included in and constitute a part of this specification, illustrate embodiments of the present disclosure and, together with the general description of the present disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the present disclosure.

[0024] These and other features of the present invention will become apparent from the following description of the preferred forms of the embodiments, given by way of non-limiting example with reference to the accompanying drawings.

[0025] It should also be understood that although the present invention has been described with reference to some specific examples, those skilled in the art can surely implement many other equivalent forms of the present invention, which have the features as described in the claims and thus are all within the protection scope defined thereby.

[0026] When combined with the accompanying drawings, the above and other aspects, features, and advantages of the present disclosure will become more apparent in view of the following detailed description.

[0027] Hereinafter, specific embodiments of the present disclosure will be described with reference to the accompanying drawings; however, it should be understood that the disclosed embodiments are merely examples of the present disclosure and can be implemented in various ways. Well-known and / or repetitive functions and structures are not described in detail to avoid unnecessary or redundant details from obscuring the present disclosure. Therefore, the specific structural and functional details disclosed herein are not intended to be limiting, but merely serve as a basis for the claims and a representative basis for teaching those skilled in the art to use the present disclosure in substantially any suitable detailed structure in a variety of ways.

[0028] This specification may use the phrases "in one embodiment", "in another embodiment", "in yet another embodiment", or "in other embodiments", each of which may refer to one or more of the same or different embodiments according to the present disclosure.

[0029] Next, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0030] The current detection of phishing nodes only relies on manual feature engineering, with limited feature selection and difficulty in representing complex patterns in transaction data. In research using graph representation learning, the Ethereum transaction network is usually regarded as a static graph, simplifying multiple edges into single edges, but the dynamic evolution of the Ethereum network is crucial for capturing phishing behavior characteristics. Although some methods consider time factors, they usually assume that the graph topology is static and fail to fully capture the dynamic changes of the graph. Additionally, many detection models based on Graph Neural Networks (GNNs) usually only focus on the first-order neighborhood of nodes, ignoring the deep relationships between multiple nodes. Especially in the case of coordinated attacks involving multiple phishing nodes, this method may not perform well.

[0031] To solve the above problems, as Figure 1 shown, an embodiment of the present invention provides a method for detecting phishing accounts in the Ethereum network, including: S1: Sampling the effective time series of the Ethereum transaction network using dynamic random walk; S2: Representing the sampled data as a discrete dynamic weighted directed multi-graph, where the dynamic weighted directed multi-graph includes time snapshots corresponding to each time step, and the time snapshots form a weighted directed multi-graph, and the weighted directed multi-graph represents the trading volume between the involved nodes at the corresponding time step, and each node represents an account; S3: Performing image signal processing on the discrete dynamic weighted directed multi-graph to determine the graph signal of each time snapshot, where the graph signal contains different-dimensional features of each node in the time snapshot; S4: Inputting the discrete dynamic weighted directed multi-graph and the graph signal of each time snapshot into a pre-trained detection network for phishing detection to determine the phishing score of each node, where the phishing score represents the probability that the corresponding node is a phishing account; S5: Determining the phishing accounts in the transaction network based on the phishing scores of each node.

[0032] Due to the complexity, periodicity, and dynamicity of the Ethereum transaction network, in this embodiment, the network is first sampled through dynamic random walk, and then the sampled time transaction sequence is represented as a dynamic weighted directed multi-graph containing multiple discrete time snapshots , where T represents the number of time steps. Each time snapshot forms a weighted directed multi-graph, including a node set V, an edge set and a weighted adjacency matrix , representing the trading volume between nodes at time step t. The label of the node is , where 1 represents the phishing node label and 0 represents the normal node label. Regarding these graphs as effective time series makes It can simultaneously preserve the local graph structure around node V and its temporal evolution behavior. That is, the valid time series is formed by valid transactions at different times, and each valid time series is equivalent to a subgraph of the transaction network graph G. Determine the graph signal of each time snapshot. Assume that represents the graph signal of the time snapshot where P is the feature dimension of each node. The detection model in this embodiment is a model targeted at Ethereum phishing detection, and the goal of Ethereum phishing detection is to learn a function that maps historical snapshots to the embedding representation of the corresponding graph of the entire transaction network. Specifically, given the graph and perform binary classification on the nodes in the future time snapshot, that is, determine the phishing nodes and normal nodes in the transaction network.

[0033] The method in this embodiment can fully consider the dynamic evolution characteristics of the Ethereum transaction network, effectively prevent misjudgment of the network topology and failure to identify the key trends of phishing networks, and can improve the judgment efficiency and accuracy by using the detection model. The detection model in this embodiment can effectively capture the deep relationships between multiple nodes in the phishing network. Since in Ethereum, new transaction nodes and connections are constantly emerging, in addition to phishing attacks that quickly deceive targets in the short term, there are also some attacks that gradually build trust over time and conceal their true intentions through long-term transaction relationships. Therefore, the detection model trained in this embodiment effectively overcomes the above problems, can analyze the transaction relationships that change over time, capture the complex structures and behavior patterns between nodes, adapt to the dynamic evolution of the network, and timely identify newly emerging phishing nodes.

[0034] Furthermore, from the above content, it can be seen that the method in this embodiment mainly involves data sampling, graph signal processing, and the formation of a detection model. This process involves three key components, including: (1) Ethereum Dynamic Walker (EthdynWalker) to capture valid time transaction sequences; (2) Graph signal calculation to determine transaction features for each node in the discrete dynamic graph; (3) Diffusion Convolutional Evolutionary Recurrent Neural Network (DCERNN) includes a diffusion convolutional layer to capture the local behavior patterns and structural information between multi-hop nodes, and at the same time uses a Recurrent Neural Network (RNN) to model temporal changes. Through the parameter evolution mechanism, the dynamic evolution of the diffusion convolution kernel is realized, and the temporal changes of node embeddings are captured through the RNN-based embedding evolution mechanism.

[0035] In one embodiment, the sampling of the valid time series of the transaction network using dynamic random walk includes: S6: Normalize the transaction amounts and transaction times in the transaction network; S7: Calculate the time deviation distribution of the normalized transaction network; S8: Calculate the time interval weights between each historical transaction time and the current moment in the normalized transaction network based on the exponential function. The shorter the time interval, the greater the weight value; S9: Determine the initial transaction time and the initial edge of the random walk based on the time deviation distribution and the time interval weights; S10: Conduct a random walk based on the initial transaction time and the initial edge; S11: Determine the neighbor nodes of the nodes in the current edge, and determine the next node for the walk from the neighbor nodes based on the transaction amounts and transaction frequencies involved between the nodes and the neighbor nodes; S12: Obtain the effective time series based on the nodes and edges traversed.

[0036] In this embodiment, the walker adopted traverses transactions in the order of timestamps. By extracting the effective time series, the structure and time information in the original network can be accurately captured. First, represent the transaction network as a graph , where represents the node set, represents the edge set between nodes, is a function that sorts the edges in ascending order according to the transaction timestamps, maps each edge to its corresponding transaction amount. Each edge has a unique timestamp and transaction amount . In the graph , a time walk from to is a vertex sequence , satisfying that for , , and for , . The represents the elements in the node set . Here, the subscripts and represent different elements .

[0037] Since most existing methods perform a fixed number of random walks on each node in the graph, they ignore the time factor. In order to explore the structural and temporal characteristics of the Ethereum phishing network, the method of this embodiment focuses on performing more time walks starting from the edges close to the current time point. This priority setting is intended to show that recent transactions are more important than earlier transactions. When performing random walks, the transaction amount and transaction time are first normalized and mapped to Then, the time deviation distribution of the normalized transaction network is determined, and an exponential function is used to calculate the weight of the time interval between each historical transaction time and the current moment, ensuring that the edges close to the current time have a larger weight. In this case, each edge is assigned a probability: described The value is based on the edge e The sequence number used to sort the timestamps. is the minimum time associated with edge e in the dynamic graph. is the set of edges. The above formula uses exponential distribution to calculate a probability value for the selection of the initial edge.

[0038] Based on time deviation distribution, time interval weight self-time deviation distribution Extract the initial time of the walk , and the initial time edge . From the initial edge After starting the time walk, the next step is to select the target node for the time random walk. The neighbor set of From the collection In the process, the next node is selected for dynamic walking. It should be noted that the same neighboring nodes Maybe in Because multiple transactions may occur between the same account pair. In order to better reflect the activity pattern between fishing nodes, for each pair of consecutive edges and , the number of walks needs to be It is limited to a smaller range to maintain the time correlation between adjacent nodes. In addition, it is necessary to ensure that the transaction amount is not biased, because large transactions may involve fraud and other illegal activities, while small transactions may be used to verify phishing websites or phishing fraud activities. Based on this, this embodiment adopts a weight distribution To select the next neighbor node to walk to, given any edge , select each neighbor node (Characterization t Time Node The neighbor set of is a node in the set, and the probability of where represents the mapping at the corresponding time. The formula characterizes the probability of selecting the next node from the neighbor set of node for dynamic random walk at time t.

[0039] Furthermore, as Figure 2 shown, the method further includes: S13: Set the number of walks for each node, the minimum length of each walk, the maximum length of each walk, and the context window count; S14: Perform random walks in the transaction network according to the number of walks for each node, the minimum length of each walk, the maximum length of each walk, and the context window count as the random walk rules to obtain the effective time series.

[0040] Due to considering the time factor, the random walk may traverse all edges that are valid in time. Let the number of walks for each node be R, the minimum length of each time walk be , and the maximum length be L. Considering the generated effective time walk which satisfies , then the context window count can be calculated according to the following formula: .

[0041] Ethereum transactions exhibit a periodic pattern affected by factors such as transaction activities and market conditions. Normal accounts maintain a relatively stable rhythm in sending and receiving transactions, while phishing accounts often experience an outbreak of transaction activities in a short period of time, and the number of received transactions is significantly higher than the number of sent transactions. After these activity peaks, as the activities weaken, a gradual transfer of a large number of fraudulent assets usually occurs. The method in this embodiment emphasizes the ability to capture the dynamic evolution characteristics of nodes and graph structures in the Ethereum transaction network. Due to the anonymity of the blockchain, nodes lack attribute features, so information obtained from the effective time transaction sequence must be used. For this purpose, this embodiment first calculates the graph signal to prepare for learning its dynamic characteristics. Determining the graph signal for each time snapshot includes: S15: Calculate the in-degree, out-degree, degree, incoming transaction amount, outgoing transaction amount, total transaction amount, number of first-order neighbor nodes, and reciprocal of the transaction frequency for each node in the time snapshot based on the information in the time snapshot. The reciprocal of the transaction frequency is determined by dividing the time span between the first and last transactions of the node by its degree.

[0042] Specifically, in-degree: the number of transactions received by the node. Phishing nodes usually have a relatively high in-degree, while normal nodes show a more uniform distribution.

[0043] Out-degree: the number of transactions sent by the node. Phishing nodes usually have a relatively low out-degree, while normal nodes show a more uniform distribution.

[0044] Degree: the sum of the in-degree and out-degree of the node.

[0045] Incoming transaction amount: the total amount received by the node, calculated as the sum of the weights of all incoming edges.

[0046] Outgoing transaction amount: the total amount sent by the node to other nodes, calculated as the sum of the weights of all outgoing edges.

[0047] Total transaction amount: the total amount of all transactions involving the node, including the incoming and outgoing amounts.

[0048] Number of neighbors: the number of first-order neighbors of the node.

[0049] Reciprocal of the transaction frequency: the time span between the first and last transactions of the node, divided by its degree.

[0050] By analyzing and modeling the basic node behavior characteristics, it is convenient for the detection model to effectively capture the node relationships and time patterns, thereby improving the accuracy of phishing node detection.

[0051] When constructing the detection model, the method further includes: S16: Construct a Diffusion Convolutional Evolutionary Recurrent Neural Network (DCERNN) as the initial network; S17: Use the training time snapshot and training node graph signal as training data, and train the initial network based on the stochastic gradient algorithm and cross-entropy loss function to obtain the detection network. The training includes the calculation of convolutional filter parameters, the calculation of node embeddings, and the calculation of phishing scores.

[0052] Among them, the calculation of convolutional filter parameters includes: S18: Based on the diffusion convolutional layer in the initial network, perform diffusion convolution operations on the graph signal and filter using the time snapshot to map the P-dimensional features of the graph signal to Q-dimensional output features; S19: Combine the gated recurrent unit to process the input features at the current moment and the output features at the previous moment, obtain the reset gate and update gate corresponding to the current moment, and calculate and update the output features of the diffusion convolutional layer at the current moment in combination with the reset gate and the update gate, and the output features form the node embedding corresponding to the node; S20: Use the gated recurrent unit to calculate and determine the parameters of the filter at the current moment based on the filter parameters at the previous moment, the reset gate at the current moment, and the update gate.

[0053] In the above embodiments, steps S18 and S19 include the calculation of the diffusion convolutional layer, and the calculation of the convolutional filter parameters is realized based on the diffusion convolutional layer. Step S20 is an iterative calculation process of the convolutional filter parameters.

[0054] For example, the (DCERNN) includes a diffusion convolutional layer, and the input of this layer is a time snapshot , and its graph signal is , where P is the feature dimension. The input of the initial layer is set to the transaction feature vector of each node. The output is a set of new node representations with a dimension of Q, which reflects the local structural attributes within the time snapshot .

[0055] The diffusion convolutional layer propagates and updates the interaction information between each node and its neighbors through multiple convolutional operations, and gradually captures information from more distant nodes. The graph signal and the filter The diffusion convolutional operation on is defined as: Among them, is the graph signal, that is, a feature matrix with a dimension of , is the number of nodes, is the feature dimension. represents selecting the numerical value of the -th column of all rows of this feature matrix, . The filter function represents transforming the graph signal , and the operator represents the diffusion convolutional operation. The above symbols together represent performing a diffusion convolutional operation on each column of the feature matrix. is the filter parameter, which can be regarded as a parameter matrix, represents the first column of this matrix, represents the second column of this matrix. Further, is the weighted adjacency matrix representing the transaction amount. is the out-degree diagonal matrix, is the in-degree diagonal matrix, where, represents the all - one vector. Thus, and represent the transition matrices of the diffusion process and its inverse process respectively. The operator represents diffusion convolution, where represents the feature dimension, is the finite number of diffusion steps of the filter parameters.

[0056] Assigns a trainable weight to each step. Through the convolution operation, the diffusion convolution layer can map the P - dimensional feature to the Q - dimensional output: .

[0057] where is the filter, is the parameter tensor, . The th input and the th output of the convolution filter parameter is , is the activation function. represents the graph signal after passing through the diffusion convolution layer, which is an intermediate result and the feature dimension is .

[0058] To use the diffusion convolution layer to learn the representation of the Ethereum transaction graph, this embodiment adopts the Gated Recurrent Unit (GRU), which is a simple and efficient variant of the graph convolutional neural network RNN for capturing temporal dependencies. In this model, matrix multiplication is replaced by diffusion convolution, specifically: .

[0059] and represent the input and output at time t respectively, and represent the reset gate and update gate at time t respectively. represents the diffusion convolution operation, , and are the parameters of the filter. tanh is the hyperbolic tangent activation function, is the bias vector of the reset gate, is the bias vector of the update gate, is the candidate hidden state 's bias vector, is the final hidden state. By combining dilated convolution with GRU, the recurrent neural network can be trained through time backpropagation, effectively capturing the temporal and network structure dependencies in the Ethereum phishing network.

[0060] The core idea of parameter evolution is to update the convolution filter parameters using current and historical data through a recursive architecture. The value at time t. For example, It is considered as the output of the Ethereum dynamic system, which evolves over time and serves as the input of the subsequent steps. In this embodiment, GRU is used to model the relationship between the input and output of the diffusion convolution layer. GRU is a recursive architecture, while DConv represents the graph signal. The diffusion convolution unit in the table. Time advances from left to right in the recursive architecture, and the layers are connected in a bottom-up manner. While performing graph convolution between layers, the parameters are also evolving. Filter parameters is the input and output of GRU. The output of DConv represents the hidden state of GRU, while the node embedding As input.

[0061] For example, the above process can be expressed as: .

[0062] The origin of the above formula, that is, the realization of the parameter evolution in the above formula is as follows: .

[0063] Among them, such as and Only used as a local variable. is the weight matrix of the reset gate, is the weight matrix of the update gate, is a candidate hidden state The weight matrix, , , is the hidden state of the previous moment The associated weight matrices are used to calculate the reset gate, update gate, and candidate hidden states, respectively. is a candidate hidden state The calculation of the node embedding includes: S21: Utilize the gated recurrent unit to calculate and update the output features of the diffusion convolution layer at the current moment with the output features of the diffusion convolution layer at the previous moment as input and the output features of the diffusion convolution layer at the previous moment as the hidden state of the transaction network.

[0064] The core idea of the embedded evolution in this embodiment is to use the current and historical information to update the node embedding at time t , thus enhancing the model's representation ability for the dynamic network features of Ethereum. This embodiment adopts a recursive architecture to consider the temporal evolution of nodes. Taking the from the parameter evolution subsection as the input of the GRU. is used as the hidden state of the Ethereum dynamic system. At time t, the hidden state is updated through the input to model and learn the temporal features of the nodes. For example, it can be defined as: is the hidden state output by the diffusion convolution layer at time t. is based on and the hidden state at the previous moment, which is updated through the GRU to obtain the hidden state at the current moment. will be used as the node embedding of the node at the current moment.

[0065] The evolution process of the above formula is as follows: is the weight matrix of the reset gate, is the weight matrix of the update gate, is the weight matrix of the candidate hidden state , , , is the weight matrix related to the hidden state at the previous moment, which are respectively used to calculate the reset gate, the update gate and the candidate hidden state. is the bias vector of the candidate hidden state .

[0066] The embedded evolution can improve the representation of node behavior, thereby improving the accuracy and efficiency of phishing node detection.

[0067] The calculation of the phishing score includes: S22: Using the Softmax activation function to calculate the updated output features to determine the phishing score of each node.

[0068] In this embodiment, after obtaining the node embedding, our goal is to assign a phishing score to each node in the dynamic graph using an end-to-end method. The phishing score of each node embedding is calculated using the Softmax activation function and is defined as: where represents the phishing score, represents the category Node embeddings. The category includes two categories, phishing accounts and normal accounts.

[0069] The training in this embodiment is iterative and end-to-end. Specifically, the Adam algorithm with stochastic gradient and the cross-entropy loss function are used to train the model. For normal nodes, the label is 0; for phishing nodes, the label is 1. At the training time snapshot contains nodes. Therefore, combined with the cross-entropy loss function, the loss function in this embodiment can be defined as: .

[0070] c represents the account category, N represents the total number of nodes, represents the th node, represents the label value of the node, represents the phishing score of the node.

[0071] Based on the above embodiments, it can be seen that the present application can be used to capture effective time transaction sequences through the designed Ethereum dynamic walker. Secondly, the proposed Diffusion Convolutional Evolutionary Recurrent Neural Network (DCERNN) can capture multi-hop propagation information between nodes through diffusion convolution for spatial dependence modeling; moreover, it can capture the long-term dependence relationship of nodes through the recurrent neural network for time dependence modeling. At the same time, the solution of the present application also introduces two evolutionary mechanisms, namely the parameter evolution mechanism and the embedding evolution mechanism, which are used to update the network parameters and the time changes of node embeddings respectively. Through the above configuration, the solution of the present application has the following advantages: The Ethereum dynamic walker can capture effective time transaction sequences and accurately retain the graph structure and features in the transaction network; The evolutionary recurrent neural network based on diffusion convolution combines the graph neural network and the sequence modeling method to capture the structural and time dynamic features of the phishing network from both the spatial and temporal levels; The evolutionary mechanism of DCERNN enables the model to adapt to the continuously changing transaction network in real time, automatically update the parameters and node embeddings, enhances the self-adaptability of the model to network dynamics, and realizes the comprehensive capture of the dynamic features of the phishing network.

[0072] As Figure 3 shown, another embodiment of the present invention also provides an Ethereum phishing account detection device 100, including: A sampling module for sampling effective time series of the Ethereum transaction network using dynamic random walk; A representation module, configured to represent sampled data as a discrete dynamic weighted directed multigraph, where the dynamic weighted directed multigraph includes time snapshots corresponding to each time step, and the time snapshots form a weighted directed multigraph that represents the trading volume between nodes involved at the corresponding time step, and each node represents an account; A processing module, configured to perform image signal processing on the discrete dynamic weighted directed multigraph to determine the graph signal of each time snapshot, where the graph signal includes different dimensional features of each node in the time snapshot; A detection module, configured to input the discrete dynamic weighted directed multigraph and the graph signal of each time snapshot into a pre-trained detection network for phishing detection to determine the phishing score of each node, where the phishing score represents the probability that the corresponding node is a phishing account; A determination module, configured to determine phishing accounts in the trading network based on the phishing scores of each node.

[0073] In one embodiment, the sampling of the effective time series of the trading network by using dynamic random walk includes: Normalizing the trading amount and trading time in the trading network; Calculating the time deviation distribution of the normalized trading network; Calculating the time interval weight between each historical trading time and the current moment in the normalized trading network based on an exponential function, where the shorter the time interval, the larger the weight value; Determining the initial trading time and initial edges of the random walk based on the time deviation distribution and time interval weight; Performing random walk based on the initial trading time and initial edges; Determining the neighbor nodes of the nodes in the currently located edge, and determining the next node for the walk from the neighbor nodes based on the trading amount and trading frequency involved between the node and the neighbor nodes; Obtaining the effective time series based on the nodes and edges that have been walked through.

[0074] In one embodiment, the apparatus further includes: A setting module, configured to set the number of walks for each node, the minimum length of each walk, the maximum length of each walk, and the context window count; A random walk module, configured to perform random walk in the trading network according to the number of walks for each node, the minimum length of each walk, the maximum length of each walk, and the context window count as the walk rules to obtain the effective time series.

[0075] In one embodiment, the determining the graph signal of each time snapshot includes: Calculate the in - degree, out - degree, degree, incoming transaction amount, outgoing transaction amount, total transaction amount, number of first - order neighbor nodes, and reciprocal of the transaction frequency for each node in the time snapshot based on the information in the time snapshot. The reciprocal of the transaction frequency is determined by dividing the time span between the first and last transactions of the node by its degree.

[0076] In one embodiment, the pre - trained detection model is obtained based on the following method: Used to construct a diffusion convolutional evolutionary recurrent neural network as the initial network; Used to take the training time snapshot and training node graph signal as training data, and train the initial network based on the stochastic gradient algorithm and cross - entropy loss function to obtain the detection network. The training includes the calculation and evolution of convolutional filter parameters, the calculation and evolution of node embeddings, and the calculation of fishing scores.

[0077] In one embodiment, the calculation of convolutional filter parameters includes: Based on the diffusion convolutional layer in the initial network, perform a diffusion convolution operation on the graph signal and filter using the time snapshot to map the P - dimensional features of the graph signal to Q - dimensional output features; Combine a gated recurrent unit to process the input features at the current moment and the output features at the previous moment to obtain the reset gate and update gate corresponding to the current moment, and combine the reset gate and update gate to calculate and update the output features of the diffusion convolutional layer at the current moment. The output features form the node embeddings corresponding to the nodes; Use the gated recurrent unit to calculate and determine the parameters of the filter at the current moment based on the filter parameters at the previous moment, the reset gate at the current moment, and the update gate.

[0078] In one embodiment, the calculation of the node embeddings includes: Use the gated recurrent unit to calculate and update the output features of the diffusion convolutional layer at the current moment with the output features of the diffusion convolutional layer at the current moment as the input and the output features of the diffusion convolutional layer at the previous moment as the hidden state of the transaction network.

[0079] In one embodiment, the calculation of the fishing score includes: Use the Softmax activation function to calculate the updated output features to determine the fishing score for each node.

[0080] Another embodiment of the present invention also provides an electronic device, including: One or more processors; A memory configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum phishing account detection method as described in any one of the above.

[0081] Furthermore, an embodiment of the present invention also provides a storage medium, on which a computer program is stored, and when the program is executed by a processor, it implements the Ethereum phishing account detection method as described above. It should be understood that each solution in this embodiment has the corresponding technical effects in the above method embodiment, and will not be elaborated here.

[0082] Furthermore, an embodiment of the present invention also provides a computer program product, the computer program product is tangibly stored on a computer-readable medium and includes computer-readable instructions, and the computer-executable instructions, when executed, cause at least one processor to execute the Ethereum phishing account detection method as described in the above embodiments.

[0083] It should be noted that the computer storage medium of the present invention can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access storage medium (RAM), a read-only storage medium (ROM), an erasable programmable read-only storage medium (EPROM or flash memory), an optical fiber, a portable compact disk read-only storage medium (CD-ROM), an optical storage medium, a magnetic storage medium, or any suitable combination of the above. In the present invention, a computer-readable storage medium can be any tangible medium that contains or stores a program, and this program can be used by or in combination with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, in which the computer-readable program code is carried. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, and this computer-readable medium can send, propagate, or transmit a program configured to be used by or in combination with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted by any suitable medium, including but not limited to: wireless, antenna, optical cable, RF, etc., or any suitable combination of the above.

[0084] In addition, those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0085] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a system for implementing the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0086] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including an instruction system that implements the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0087] Those of ordinary skill in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of protection of this application is limited to these examples; under the idea of this application, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations in different aspects of one or more embodiments of the present application as described above, and they are not provided in detail for the sake of brevity.

Claims

1. A method for detecting phishing accounts in the Ethereum network, characterized in that, Including: Sampling an effective time series of the Ethereum transaction network using dynamic random walk; Representing the sampled data as a discrete dynamic weighted directed multi-graph, the dynamic weighted directed multi-graph including a time snapshot corresponding to each time step, the time snapshots forming a weighted directed multi-graph, the weighted directed multi-graph representing the trading volume between the nodes involved at the corresponding time step, and each node representing an account; Performing image signal processing on the discrete dynamic weighted directed multi-graph to determine the graph signal of each time snapshot, the graph signal containing different dimensional features of each node in the time snapshot; Inputting the discrete dynamic weighted directed multi-graph and the graph signals of each time snapshot into a pre-trained detection network for phishing detection to determine the phishing score of each node, the phishing score representing the probability that the corresponding node is a phishing account; Determining phishing accounts in the transaction network based on the phishing scores of each node.

2. The Ethereum phishing account detection method according to claim 1, wherein The sampling of an effective time series of the Ethereum transaction network using dynamic random walk includes: Normalizing the transaction amount and transaction time in the transaction network; Calculating the time deviation distribution of the normalized transaction network; Calculating the time interval weight between each historical transaction time and the current moment in the normalized transaction network based on an exponential function, the shorter the time interval, the larger the weight value; Determining the initial transaction time and initial edge of the random walk based on the time deviation distribution and time interval weight; Performing random walk based on the initial transaction time and initial edge; Determining the neighbor nodes of the currently located node, and determining the next node to walk from the neighbor nodes based on the transaction amount and transaction frequency involved between the node and the neighbor nodes; Obtaining the effective time series based on the nodes and edges that have been walked through.

3. The Ethereum phishing account detection method according to claim 2, wherein, The method further includes: Setting the number of walks of each node, the minimum length of each walk, the maximum length of each walk, and the context window count; Performing random walk in the transaction network according to the number of walks of each node, the minimum length of each walk, the maximum length of each walk, and the context window count as the walk rules to obtain the effective time series.

4. The Ethereum phishing account detection method according to claim 1, wherein The determining of the graph signal of each time snapshot includes: Calculating the in-degree, out-degree, degree, incoming transaction amount, outgoing transaction amount, total transaction amount, number of first-order neighbor nodes, and reciprocal of the transaction frequency of each node in the time snapshot based on the information in the time snapshot, the reciprocal of the transaction frequency being determined by dividing the time span between the first and last transactions of the node by its degree.

5. The Ethereum phishing account detection method according to claim 1, wherein The pre-trained detection network is obtained through the following steps: Constructing a diffusion convolutional evolutionary recurrent neural network as the initial network; Using the training time snapshots and the graph signals calculated based on the training time snapshots as training data, and training the initial network based on the stochastic gradient algorithm and the cross-entropy loss function to obtain the detection network, the training including the calculation of convolutional filter parameters, the calculation of node embeddings, and the calculation of phishing scores.

6. The Ethereum phishing account detection method according to claim 5, characterized in that, The calculation of convolutional filter parameters includes: The diffusion convolution layer in the initial network uses time snapshots to perform diffusion convolution operations on graph signals and filters, so as to map the P-dimensional features of the graph signal into Q-dimensional output features; Combined with a gated recurrent unit to process the input features at the current moment and the output features at the previous moment, obtain the reset gate and update gate corresponding to the current moment, and combine the reset gate and update gate to calculate and update the output features of the diffusion convolution layer at the current moment, and the output features form the node embeddings of the corresponding nodes; Using the gated recurrent unit, based on the filter parameters at the previous moment, the reset gate and update gate at the current moment, calculate and determine the filter parameters at the current moment.

7. The Ethereum phishing account detection method according to claim 6, wherein The calculation of the node embeddings includes: Using the gated recurrent unit, taking the output features of the diffusion convolution layer at the current moment as the input and the output features of the diffusion convolution layer at the previous moment as the hidden state of the trading network, calculate and update the output features of the diffusion convolution layer obtained at the current moment.

8. The Ethereum phishing account detection method according to claim 7, wherein The calculation of the phishing score includes: Using the Softmax activation function to calculate the updated output features to determine the phishing score of each node. The phishing score represents the probability that the corresponding node is a phishing account.

9. An Ethereum phishing account detection device, characterized in that, Includes: A sampling module for sampling the effective time series of the Ethereum trading network using dynamic random walk; A representation module for representing the sampled data as a discrete dynamic weighted directed multi-graph. The dynamic weighted directed multi-graph includes time snapshots corresponding to each time step. The time snapshots form a weighted directed multi-graph, and the weighted directed multi-graph represents the trading volume between the involved nodes at the corresponding time step. Each node represents an account; A processing module for performing image signal processing on the discrete dynamic weighted directed multi-graph to determine the graph signal of each time snapshot. The graph signal contains different dimensional features of each node in the time snapshot; A detection module for inputting the discrete dynamic weighted directed multi-graph and the graph signal of each time snapshot into a pre-trained detection network for phishing detection to determine the phishing score of each node. The phishing score represents the probability that the corresponding node is a phishing account; A determination module for determining the phishing accounts in the trading network based on the phishing scores of each node.

10. An electronic device, characterized in that, Includes: One or more processors; A memory configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum network phishing account detection method according to any one of claims 1-8.

Images