Target account detection method and device based on dynamic events and graph neural network

Abstract

The present invention discloses an account detection method, in particular to a target account detection method based on dynamic events and graph neural networks, comprising: inputting a time transaction graph into a feature extraction module for feature extraction to obtain node features corresponding to nodes and edge features corresponding to edges; inputting node features and edge features into a time graph neural network based on a Hawkes process for feature aggregation to obtain a node time representation of the node at the target moment; inputting the node time representation into a condition strength calculation module for processing to obtain condition strength, inputting the node time representation and edge features into an event trend prediction module for processing to obtain an event trend; and determining the detection result of the account corresponding to the node based on the condition strength and event trend. The present invention comprehensively models the dynamics and group behavior of Ethereum, and can obtain target account detection results with higher accuracy from the two aspects of time dimension and group behavior.

Description

Technical Field

[0001] The present invention relates to an account detection method, and specifically to a target account detection method and device based on dynamic events and graph neural networks. Background Art

[0002] Ethereum is an open-source, public blockchain platform with smart contract functionality. Through its dedicated cryptocurrency, Ether (ETH), it provides a decentralized Ethereum Virtual Machine (EVM) for processing peer-to-peer contracts. Blockchain technology offers a decentralized, anonymous, and global trading platform for digital assets, enabling free, fast, and private fund transfers. These characteristics of blockchain technology are being exploited to circumvent traditional financial regulations through multiple transfers, the use of coin mixers, decentralized exchanges (DEXs), and smart contracts.

[0003] There are three main stages of characteristic Ethereum activities. (1) The placement stage. In this stage, stolen assets are transferred to specific addresses for centralized storage through hacking, phishing, and fraud. (2) The layering stage. In this stage, the stolen funds are split into multiple small transactions, and Ether or ERC20 tokens are traded between different accounts to obfuscate the source of funds and increase the difficulty of tracking. (3) The integration stage. After layering, the illegal funds are pooled to service providers (such as DEX, decentralized finance (DeFi) platforms, etc.) for cashing out. This means that subsequent criminals can use them for any purpose. Therefore, it can be seen that Ethereum accounts play an important role in this type of activity and are the main channels for the placement, layering, and integration stages.

[0004] However, traditional detection methods struggle to adapt to its decentralized, anonymous, and highly complex characteristics. Currently, common methods include heuristic rule-based methods, which rely on manual feature extraction and traditional graph analysis algorithms, and graph representation learning-based methods, such as network embedding and graph neural networks. However, detection methods designed based on heuristic rules rely on predefined features and have difficulty discovering complex group behavior patterns; algorithms based on network embedding focus more on the characteristics of individual accounts and have difficulty capturing behavioral characteristics at the group level; and these methods typically treat the network as a static structure, ignoring the dynamic evolution of behavior. Due to the lack of processing of the time dimension, these methods are insufficient in capturing the temporal characteristics of behavior, resulting in high false positive and false negative rates. Summary of the Invention

[0005] The technical problem to be solved by the present invention is that the above-mentioned methods commonly used in the prior art usually regard the network as a static structure, ignoring the dynamic evolution characteristics of behavior. Moreover, due to the lack of processing of the time dimension, these methods are insufficient in capturing the temporal characteristics of behavior, resulting in high false alarm and missed alarm rates. In order to solve the above problems, the present invention provides a target account detection method and device based on dynamic events and graph neural networks.

[0006] The present invention includes:

[0007] In a first aspect, an embodiment of the present invention provides a target account detection method based on dynamic events and graph neural networks, comprising:

[0008] Inputting the time transaction graph into a feature extraction module for feature extraction to obtain node features corresponding to nodes and edge features corresponding to edges, wherein the time transaction graph includes the nodes, the edges, and timestamps. The nodes are used to represent accounts, the edges are used to represent transactions between the accounts, and the timestamps are used to represent the time of the transactions;

[0009] Inputting the node features and the edge features into a time graph neural network based on a Hawkes process to perform feature aggregation to obtain a node time representation of the node at the target time;

[0010] Inputting the node time representation into a condition strength calculation module for processing to obtain a condition strength, wherein the condition strength is used to characterize the probability of any two nodes forming a link at the target time;

[0011] Inputting the node time representation and the edge feature into an event trend prediction module for processing to obtain an event trend, wherein the event trend is used to represent a predicted value of the number of new events generated by the node at the target time;

[0012] A detection result of the account corresponding to the node is determined based on the condition strength and the event trend.

[0013] Optionally, inputting the node features and the edge features into a Hawkes process-based time graph neural network for feature aggregation to obtain a node time representation of the node at the target time includes:

[0014] Inputting the node features and the edge features into a multi-layer Hawkes process-based time graph neural network for feature aggregation to obtain a node time representation of the node at the target time;

[0015] Among them, The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of for:

[0016] ;

[0017] ;

[0018] ;

[0019] ;

[0020] The target time is the time , and For the The weight matrix of the Hawkes process-based temporal graph neural network described in the layer, Relative to time At the node A collection of historical events on , is the set of events in the time transaction graph, , is the number of events in the time transaction graph, node For nodes The historical neighbor nodes of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment The embedding vector of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of node For nodes The historical neighbor nodes of , is the activation function, Based on The kernel function, is an exponential function, is the decay rate constant.

[0021] Optionally, inputting the node time representation into a condition strength calculation module for processing to obtain the condition strength includes:

[0022] Using the fully connected layer as a main network, learning parameters of a target network from parameters of the main network based on a first node time representation corresponding to a first node and a second node time representation corresponding to a second node, where the first node and the second node are any two nodes in the time transaction graph;

[0023] The first node time representation and the second node time representation are input into the target network for processing to obtain a target condition strength, where the target condition strength is used to characterize the probability of the first node and the second node forming a link at the target time.

[0024] Optionally, the parameters of the target network are:

[0025] ;

[0026] Among them, the node is the first node, For the first node time representation, node is the second node, The second node time is represented by the time is the target time, are the parameters of the main network, Used to characterize a conversion model, where the conversion model is used to learn the parameters of the target network from the parameters of the main network.

[0027] Optionally, inputting the first node time representation and the second node time representation into the target network for processing to obtain target condition strength includes:

[0028] determining the square of the difference between the first node time representation and the second node time representation as input data;

[0029] The input data is input into the target network for processing to obtain the target condition strength.

[0030] Optionally, inputting the node time representation and the edge feature into an event trend prediction module for processing to obtain an event trend includes:

[0031] The node time representation and the edge feature corresponding to the node are input into an edge feature integration model based on a graph attention network for processing to obtain a target event trend, where the target event trend is used to characterize a predicted value of the number of new events generated by the node at the target time.

[0032] Optionally, the method further includes:

[0033] Get the training time transaction graph;

[0034] Inputting the training time transaction graph into the feature extraction module for feature extraction to obtain the training node features and training edge features;

[0035] An event-driven self-exciting encoder is iteratively trained based on the training node features and the training edge features. The event-driven self-exciting encoder includes the Hawkes process-based time graph neural network, the conditional strength calculation module and the event trend prediction module.

[0036] In a second aspect, an embodiment of the present invention provides a target account detection device based on dynamic events and graph neural networks, comprising:

[0037] a feature extraction module, configured to extract features from a time transaction graph to obtain node features corresponding to nodes and edge features corresponding to edges, wherein the time transaction graph includes the nodes, the edges, and timestamps, wherein the nodes represent accounts, the edges represent transactions between the accounts, and the timestamps represent the moments of the transactions;

[0038] A time graph neural network based on a Hawkes process is used to perform feature aggregation on the node features and the edge features to obtain a node time representation of the node at a target time;

[0039] a conditional strength calculation module, configured to process the node time representation to obtain a conditional strength, wherein the conditional strength is used to characterize the probability of any two nodes forming a link at the target time;

[0040] An event trend prediction module, configured to process the node time representation and the edge features to obtain an event trend, wherein the event trend is used to represent a predicted value of the number of new events generated by the node at the target time;

[0041] A determination module is used to determine a detection result of the account corresponding to the node based on the condition strength and the event trend.

[0042] In a third aspect, an embodiment of the present invention provides an electronic device comprising: a memory, a processor, and a program stored in the memory and executable on the processor; the processor is configured to read the program in the memory to implement the steps of the target account detection method based on dynamic events and graph neural networks as described in the first aspect.

[0043] In a fourth aspect, an embodiment of the present invention provides a readable storage medium for storing a program, which, when executed by a processor, implements the steps in the target account detection method based on dynamic events and graph neural networks as described in the first aspect.

[0044] The beneficial effects of the present invention are that, first, the structured characteristics of behavior are revealed through the time transaction graph, and through in-depth analysis of account transaction behavior, a series of edge features and node features that describe behavior from the perspective of time and transaction are extracted. Secondly, by combining the Hawkes process and the graph neural network, a time graph neural network based on the Hawkes process is obtained, which is used to model the time correlation and interaction pattern between the node and its neighbor nodes, obtain the node time representation of the node at the target moment, and capture the excitation effect between events. On the one hand, the embodiment of the present invention takes into account the time correlation between the account and its neighbors from the individual level, captures the excitation effect between events, and processes the node time representation through the conditional strength calculation module to obtain the conditional strength; on the other hand, the embodiment of the present invention takes into account the group level and captures the collaborative behavior pattern of the target account through the event trend prediction network integrated with edge features. Through the above method, it can not only reveal individual behavior, but also explore the collaborative relationship between accounts, effectively identify cross-account chains, and obtain more accurate account prediction results. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Attachment Figure 1 A flowchart of a target account detection method based on dynamic events and graph neural networks provided by an embodiment of the present invention;

[0046] Attachment Figure 2 A schematic diagram of the processing flow of the feature extraction module provided in an embodiment of the present invention;

[0047] Attachment Figure 3 A schematic diagram of the processing flow of an event-driven self-exciting encoder provided in an embodiment of the present invention;

[0048] Attachment Figure 4 A schematic diagram of the processing flow of target account prediction provided by an embodiment of the present invention;

[0049] Attachment Figure 5 A schematic diagram of a target account detection device based on dynamic events and graph neural networks provided by an embodiment of the present invention;

[0050] Attachment Figure 6 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In the embodiments of the present application, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In the embodiments of the present application, the term "multiple" refers to two or more, and other quantifiers are similar. The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first" and "second" are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more.

[0052] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0054] First, let’s analyze some of the terms used in this application:

[0055] Hawkes Process: Hawkes process is a random point process widely used in event modeling. Previous historical events have an impact on the occurrence of current events. The conditional intensity function of the Hawkes process can be expressed as:

[0056] ;

[0057] in, Indicates the base strength, which refers to the time The incidence of spontaneous events, It is a kernel function used to describe the impact of historical events on current events, and usually uses an exponential function to simulate the time decay effect. Indicates from the start time to the time The total number of events that occurred between Indicates from the start time to the time The total number of events that occurred between . Through the conditional intensity function of the Hawkes process, we can see that the occurrence of the current event not only depends on the event at the previous moment, but is also affected by the cumulative effect of historical events, and this effect gradually decays over time.

[0058] Based on this, the embodiments of the present application provide a target account detection method and device based on dynamic events and graph neural networks, aiming to comprehensively model the dynamics and group behavior of Ethereum, starting from both the time dimension and group behavior, to improve the accuracy of target account detection.

[0059] See Figure 1 , Figure 1 This is a flow chart of a target account detection method based on dynamic events and graph neural networks provided by an embodiment of the present invention. This method specifically includes the following steps:

[0060] Step 101: Input the time transaction graph into the feature extraction module for feature extraction to obtain node features corresponding to the nodes and edge features corresponding to the edges. The time transaction graph includes the nodes, the edges, and timestamps. The nodes are used to represent accounts, the edges are used to represent transactions between the accounts, and the timestamps are used to represent the moments of the transactions.

[0061] Step 102: Input the node features and the edge features into a time graph neural network based on the Hawkes process to perform feature aggregation to obtain a node time representation of the node at the target time.

[0062] Step 103: Input the node time representation into a condition strength calculation module for processing to obtain a condition strength, where the condition strength is used to characterize the probability of any two nodes forming a link at the target time.

[0063] Step 104 : Input the node time representation and the edge feature into an event trend prediction module for processing to obtain an event trend, where the event trend is used to represent a predicted value of the number of new events generated by the node at the target time.

[0064] Step 105: Determine a detection result of the account corresponding to the node based on the condition strength and the event trend.

[0065] The time transaction graph is represented as a directed multigraph, denoted as ,in, A set of nodes representing accounts; is the set of edges representing transactions; A timestamp set, i.e., the time when the transaction occurred; is the node feature matrix, is the dimension of node features, is the number of nodes; is the edge feature matrix, is the dimension of edge features, is the number of edges.

[0066] In the time transaction graph, each edge Considered as an event, representing a point in time Previous node With node Therefore, in some embodiments, the time transaction graph of Ethereum can be represented as a series of events arranged in chronological order:

[0067] ;

[0068] As a specific embodiment, the node label of the node Use collection For example, if the account corresponding to the node If the node is related to the transaction, its corresponding node label is marked as 1; otherwise, it is marked as 0; if the node label is unknown, it is marked as -1.

[0069] After converting the original transaction records of Ethereum into a time transaction graph, such as Figure 2 As shown, in step 101, node features and edge features are extracted based on the time transaction graph. These features are selected based on the observation of transaction behavior. Specifically, based on the observation of normal transaction graphs and active transaction graphs, it can be seen that the unique transaction pattern of an activity has the following two obvious characteristics:

[0070] 1. Transactions are presented in chronological order, forming a tree-like structure, with consistent capital flows, reflecting a hierarchical and transitive transaction model.

[0071] 2. The transaction frequency of a single target account is low, usually manifesting as a single in / out transaction. However, when multiple accounts form a tree-like transaction structure over a period of time, clear group-level behavior emerges.

[0072] Based on the above two obvious features and combined with the graph analysis method, the features of multiple target accounts are extracted. Specifically, in some embodiments, the node features corresponding to the nodes include:

[0073] In-degree, which represents the number of transactions received by the account corresponding to the node from the accounts corresponding to its neighboring nodes;

[0074] Out-degree, which indicates the number of transactions sent by the account corresponding to the node to the accounts corresponding to its neighboring nodes;

[0075] Degree, which is used to represent the total number of transactions between the account corresponding to the node and the accounts corresponding to the node's neighboring nodes;

[0076] a first amount, where the first amount is used to represent the total transaction amount received by the account corresponding to the node from the accounts corresponding to the neighboring nodes of the node;

[0077] a second amount, where the second amount represents the total amount of transactions sent from the account corresponding to the node to the accounts corresponding to the neighboring nodes of the node;

[0078] a third amount, where the third amount is used to represent the total transaction amount between the account corresponding to the node and the accounts corresponding to the neighboring nodes of the node;

[0079] The number of neighbor accounts, which indicates the number of accounts that have conducted transactions with the account corresponding to the node;

[0080] Average transaction interval, which is the average time interval between two transactions of the account corresponding to the node;

[0081] Account transaction activity, where the account transaction activity is used to represent the volatility (variance) of the account transaction activity corresponding to the node in different months.

[0082] Specifically, the average transaction interval is calculated as follows:

[0083] ;

[0084] in, For the The timestamp of the transaction, For the The timestamp of the transaction, is the total number of transactions.

[0085] Specifically, account transaction activity is calculated as follows:

[0086] ; ;

[0087] in, For the Monthly total transaction amount, It is the sum of all transaction amounts within the preset statistical interval. For the Monthly transaction percentage, Used to calculate the variance of each month's transaction proportion, thereby reflecting the volatility of account transaction behavior, where n is the total number of months in a preset statistical interval. For example, in some embodiments, when statistics are taken for data within a year, the value of n is 12.

[0088] In order to better utilize the transaction network structure, this embodiment also extracts edge features corresponding to the edges. Specifically, in some embodiments, the edge features corresponding to the edges include:

[0089] A value, which is used to represent the amount of the transaction corresponding to the edge;

[0090] Transaction service fee, which is used as a service fee for the transaction corresponding to the edge;

[0091] A timestamp, which is used to indicate the occurrence of the transaction corresponding to the edge.

[0092] It should be understood that in some embodiments, the original timestamp is a Unix timestamp, which needs to be converted into standard data types for date and time, including year, month, day, hour, minute, and second.

[0093] like Figure 2 As shown, in step 101, the feature extraction module extracts features from the nodes and edges in the time transaction graph to obtain the node features corresponding to each node and the edge features corresponding to each edge, thereby obtaining the node feature matrix and edge feature matrix Node feature matrix and edge feature matrix It will be used as the input of the subsequent event-driven free-running encoder.

[0094] It should be understood that this embodiment also provides an event-driven self-exciting encoder, which includes the Hawkes process-based time graph neural network, the conditional strength calculation module and the event trend prediction module.

[0095] These transactions executed by target accounts often exhibit organized, abnormal trading patterns, with the behavior of one node often triggering transactions on subsequent, related nodes. To capture these complex temporal dependencies, this example incorporates the Hawkes Process into Graph Neural Networks (GNNs), resulting in a Hawkes Process-based temporal graph neural network (GNN). This allows the GNN to capture the interactions and temporal dependencies between events.

[0096] like Figure 3 As shown in the figure, specifically, the event-driven self-excited encoder is aggregated through multiple layers of GNN based on Hawkes process, integrating self-information and historical neighbor information, quantifying the conditional intensity of events through Hawkes process, and predicting event trends at the node level, thereby capturing the individual and group characteristics of events.

[0097] Since the three stages of this type of behavior (placement, stratification, and integration) in which the target account participates conform to the self-excitation characteristics of the Hawkes process, that is, the occurrence of an event (transaction) affects the probability of future events, historical neighbor information is crucial for simulating the excitation process caused by historical events. Figure 3 As shown in the figure, the node features and edge features are first input into a multi-layer Hawkes process-based temporal graph neural network for feature aggregation.

[0098] Specifically, the following time transaction chart Any two nodes in and nodes ) as an example.

[0099] For any two nodes in the time transaction graph and , from the node Extract nodes from their historical neighbors At the moment Node time representation of the target time , from the node Extract nodes from their historical neighbors At the moment Node time representation It should be noted that since the Ethereum transaction link is directed, the current event is only affected by the node The historical influence of neighbors.

[0100] In order to capture this information transmission process, the node information is iteratively transmitted to the neighboring nodes through the message transmission mechanism, and the received neighbor information is aggregated to obtain the final node time representation. Optionally, in some embodiments, the step 102 includes:

[0101] Inputting the node features and the edge features into a multi-layer Hawkes process-based time graph neural network for feature aggregation to obtain a node time representation of the node at the target time;

[0102] Among them, The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of as follows:

[0103] ;

[0104] ;

[0105] ;

[0106] ;

[0107] The target time is the time , and For the The weight matrix of the layer, Relative to time At the node The set of historical events on , is the set of events in the time transaction graph, , is the number of events in the time transaction graph, node For nodes The historical neighbor nodes of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment The embedding vector of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of node For nodes The historical neighbor nodes of , is the activation function, Based on The kernel function, is an exponential function, is the decay rate constant.

[0108] Specifically, It is a A kernel function is used to capture the decay effect with respect to time. It is defined as an exponential function ,in Controlling the decay rate, is the activation function ReLU.

[0109] The Hawkes process can simulate the excitation effects between events and effectively capture the ongoing impact of historical events on current events. It is suitable for modeling dynamic systems with time dependence and historical memory. In this embodiment, a GNN network based on the Hawkes process is used for feature aggregation. By combining the self-excitation effect of the Hawkes process with the structural modeling of graph neural networks, it can reflect the impact of historical events on current behavior without predefined rules. It can adaptively learn the time series and graph structure features related to such account behavior in the transaction network, allowing for a deeper understanding and characterization of the dynamic evolution of such account behavior in the Ethereum network, improving the accuracy and flexibility of detection.

[0110] like Figure 3 As shown, after the GNN network based on the Hawkes process outputs the node time representation, in step 103, the node time representation is input into the condition strength calculation module for processing to obtain the condition strength. In step 104, the node time representation and edge features are input into the event trend prediction module for processing to obtain the event trend. It should be understood that the execution order of steps 103 and 104 is not limited here. In specific implementations, steps 103 and 104 can be executed sequentially or simultaneously.

[0111] The Hawkes process can effectively simulate the formation process of links in the Ethereum transaction graph. Therefore, in step 103, by calculating the event The conditional strength of the node can be quantified and nodes At the moment Whether to form a link:

[0112] ;

[0113] in, Indicates at time node and nodes The baseline probability of forming a link between Indicates historical neighbors In time The degree of excitement caused by the current event. Given a node and nodes At the moment Node time representation and , can be achieved by transferring the function To generate the conditional strength. A well-fitting transfer function , whose input is the square of the difference in node time representation.

[0114] Optionally, in some embodiments, a fully connected layer is used as a main network, and parameters of a target network are learned from parameters of the main network based on a first node time representation corresponding to a first node and a second node time representation corresponding to a second node, where the first node and the second node are any two nodes in the time transaction graph;

[0115] The first node time representation and the second node time representation are input into the target network for processing to obtain a target condition strength, where the target condition strength is used to characterize the probability of the first node and the second node forming a link at the target time.

[0116] It should be understood that in step 103, the distance between any two nodes at the target time (time ) forms a link, and the corresponding conditional strength can be calculated for each event. For example, the event The corresponding conditional strength is used to characterize the node and nodes At the moment The probability of forming a link. In the time transaction graph, the node and nodes At the moment The probability of forming a link represents the node Corresponding accounts and nodes The corresponding account at time The probability of a transaction occurring.

[0117] In this embodiment, a fully connected layer (FCL) is used as the transfer function In order to enable the model to accurately capture the uniqueness of such events at the individual level without being disturbed by other types of events, in some embodiments, the idea of ​​a hypernetwork is introduced, and the fully connected layer is used as the main network. By learning the parameters of the main network (i.e., the prior distribution of events), thereby generating the parameters of the target network corresponding to each event.

[0118] For example, the event Specific parameters of the corresponding target network :

[0119] ;

[0120] in, Representing an event The parameters of the corresponding target network are used to further parameterize the transfer function FCL specific to each event, thereby encoding the underlying information formed by the transaction link in order to capture the individual characteristics of each event. It is a transformation model that implements the parameters for generating specific events from the main network.

[0121] Optionally, in some embodiments, inputting the first node time representation and the second node time representation into the target network for processing to obtain target condition strength includes:

[0122] determining the square of the difference between the first node time representation and the second node time representation as input data;

[0123] The input data is input into the target network for processing to obtain the target condition strength.

[0124] Take the first node (node ) and the second node (node ) as an example, in this embodiment, the input is the first node time representation and the second node time representation The square of the difference between the two nodes is used because the differential form is more effective in predicting whether an event will occur between two nodes than other representations such as concatenation.

[0125] Specifically, the node ,node At the moment The events that constitute The corresponding conditional strength is:

[0126] ;

[0127] in, Used to represent the fully connected layer, To measure the node and nodes At the moment Whether a link is formed, For events The specific parameters of the corresponding target network.

[0128] Ethereum transactions are often formed through connections between multiple accounts, exhibiting group behavior patterns. This suggests that such behavior does not occur in isolation but is influenced by certain accounts, causing different target nodes to form new connections with other nodes at different times, resulting in different trends. Therefore, in this case, edge features play a significant role in classifying target nodes. Unlike capturing the individual characteristics of such events at the connection level, event trend prediction aims to capture the group characteristics of events at the node level.

[0129] like Figure 3 As shown, in step 104, the node is The event trend is quantified as the number of new events. Optionally, in some embodiments, step 104 includes:

[0130] The node time representation and the edge feature corresponding to the node are input into an edge feature integration model based on a graph attention network for processing to obtain a target event trend, where the target event trend is used to characterize a predicted value of the number of new events generated by the node at the target time.

[0131] Node For example, specifically, in this embodiment, an edge feature integration model based on a graph attention network is constructed to fit the number of new events generated by the node. Corresponding event trends for:

[0132] ;

[0133] In this embodiment, Used to represent the edge feature integration model based on the graph attention network, whose input is the node Node time representation and nodes Corresponding edge features , the output For nodes At the moment The predicted number of new events that will occur.

[0134] It should be understood that, in a specific implementation, step 104 can calculate the event trends corresponding to all nodes, which can be used to represent the predicted number of new events generated by the node at the target time. In a time transaction graph, the event trend corresponding to a node can represent the predicted number of transactions occurring in the account corresponding to the node at the target time.

[0135] In this application, the examples consider the temporal correlation between accounts and their neighbors at the individual level, capturing the stimulating effects between events. Furthermore, at the group level, an event trend prediction network integrating edge features is used to capture the collaborative behavior patterns of target accounts. This joint modeling not only reveals individual behaviors but also explores collaborative relationships between accounts, effectively identifying cross-account chains.

[0136] Optionally, in some embodiments, the method further comprises:

[0137] Get the training time transaction graph;

[0138] Inputting the training time transaction graph into the feature extraction module for feature extraction to obtain the training node features and training edge features;

[0139] An event-driven self-exciting encoder is iteratively trained based on the training node features and the training edge features. The event-driven self-exciting encoder includes the Hawkes process-based time graph neural network, the conditional strength calculation module and the event trend prediction module.

[0140] Specifically, during the training process, obtain the training time transaction graph and the corresponding training event set , through the feature extraction module to train the time transaction graph Perform feature extraction to obtain training node features and training edge features, and perform multiple rounds (epochs) of iterative training based on the training node features and training edge features. In each round of iterative training, A batch of events is used, and for each event in the batch Do the following:

[0141] Obtaining nodes via a Hawkes process-based temporal graph neural network Node time representation and nodes Node time representation ;

[0142] For events Generate the parameters of the corresponding target network ;

[0143] Calculation Events Corresponding conditional strength ;

[0144] Compute nodes Corresponding event trends ;

[0145] Calculate the loss value and update all model parameters based on the loss gradient.

[0146] In some embodiments, for any event that occurs , using the negative log-likelihood method to calculate the event Corresponding event loss :

[0147] ;

[0148] Among them, according to the distribution For negative samples Sampling is performed so that It won't happen. is a constant, For nodes The degree is used to represent the number of edges connecting the node. is the number of negative samples corresponding to each positive event, For events The corresponding condition strength.

[0149] In the Ethereum transaction network, extreme events may occur at certain moments (for example, large-scale abnormal transactions occur in a short period of time). In order to accurately reflect the dynamic evolution of node event trends, this embodiment combines and The advantage of the loss function is that it uses a smooth Loss to calculate node Corresponding node loss :

[0150] ;

[0151] in, For nodes At the moment The corresponding event trend, that is, at the moment The predicted number of new events generated, For nodes At the moment The actual number of new events generated.

[0152] Assume that the training event set is , where time The subsequent events are used for testing. This embodiment performs joint optimization on the model, and the loss function The definition is as follows:

[0153] ;

[0154] in, Representation conversion model The weight matrix, and is a regularization hyperparameter used to control the weight of each loss term.

[0155] like Figure 4 As shown, in the downstream target account detection task, link prediction and node classification are performed separately. The link prediction task uses a logistic regression function based on the individual and group characteristics of the target event to calculate the probability of edges and the absence of edges. The node classification task, on the other hand, relies on node representations obtained using a GNN based on the Hawkes process and manually extracted node features. The output of the last layer of the event-driven auto-excited encoder, i.e., the hidden layer of the neural network (output dimension 2), is passed through the softmax activation function to map the probability distribution of two categories: normal nodes and target nodes.

[0156] In step 105, after obtaining the event trend and conditional strength, link prediction is performed based on the event trend, and node classification is performed based on the conditional strength, resulting in node detection results. Specifically, the link prediction task is based on the output of the event trend prediction module (i.e., the predicted number of new events generated by node i at time t). This prediction task uses a logistic regression function to calculate the probabilities of edges and absences. The node classification task is based on the conditional strength output of the Hawkes process graph neural network, which is the hidden layer output of the model (output dimension is 2). The softmax activation function is then applied to the two categories (i.e., target node and normal node), resulting in the category of each account.

[0157] During training, the link prediction task and the node classification task each have different loss functions. After a weighted combination, they are jointly optimized to train the final model. It should be understood that in this embodiment, labeled data is used to calculate the loss, while unlabeled data is only used for model training. The event-driven auto-excited encoder provided in this embodiment simultaneously optimizes these two objectives through multi-task learning, enabling the models to share information, thereby improving the overall performance of both tasks.

[0158] In this embodiment, the training time complexity of the model is ,in is the number of epochs for training, is the number of training events, represents the number of historical neighbors in the temporal GNN aggregation process, is the number of GNN layers based on Hawkes process, is the number of negative samples per training event, which is usually a small constant. Therefore, the complexity can be considered to be linear with the number of events in the Ethereum network.

[0159] In this embodiment, a generalized parameterized model capable of processing new nodes can be obtained through training. , that is, an event-driven self-excited encoder, which can, at any given moment, and edge feature matrix , maps each node in the graph into a representation vector space. Specifically, the model The mapping function is defined as:

[0160] ;

[0161] in, is the expanded node set containing all current nodes and new nodes, represents the dimension of the vector, It is a time domain, used to represent the event of transaction.

[0162] In an embodiment of the present application, a time transaction graph is first obtained based on transaction records within a preset time period to reveal the structured characteristics of the target behavior, and a series of features describing the target behavior from the perspective of time and transaction are extracted through in-depth analysis of account transaction behavior. Secondly, a time graph neural network based on the Hawkes process is used to model the temporal correlation and interaction pattern between accounts and their neighbors to capture the excitation effect between events. Finally, link prediction is performed through conditional strength calculation to determine the probability of a transaction between any two accounts. The group collaborative relationship is analyzed through the event trend prediction module to capture the global event trend of the target account.

[0163] like Figure 5 As shown, an embodiment of the present invention further provides a target account detection device 500 based on dynamic events and graph neural networks, comprising:

[0164] A feature extraction module 501 is configured to extract features from a time transaction graph to obtain node features corresponding to nodes and edge features corresponding to edges. The time transaction graph includes the nodes, edges, and timestamps. The nodes represent accounts, the edges represent transactions between the accounts, and the timestamps represent the moments of the transactions.

[0165] A Hawkes process-based time graph neural network 502 is used to perform feature aggregation on the node features and the edge features to obtain a node time representation of the node at the target time;

[0166] A condition strength calculation module 503 is used to process the node time representation to obtain a condition strength, where the condition strength is used to represent the probability of any two nodes forming a link at the target time;

[0167] An event trend prediction module 504 is configured to process the node time representation and the edge features to obtain an event trend, wherein the event trend is used to represent a predicted value of the number of new events generated by the node at the target time;

[0168] The determination module 505 is configured to determine a detection result of the account corresponding to the node based on the condition strength and the event trend.

[0169] Optionally, the Hawkes process-based temporal graph neural network 502 includes:

[0170] A feature aggregation unit, configured to input the node features and the edge features into a multi-layer Hawkes process-based time graph neural network for feature aggregation, to obtain a node time representation of the node at a target time;

[0171] Among them, The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of for:

[0172] ;

[0173] ;

[0174] ;

[0175] ;

[0176] The target time is the time , and For the The weight matrix of the Hawkes process-based temporal graph neural network described in the layer, Relative to time At the node A collection of historical events on , is the set of events in the time transaction graph, , is the number of events in the time transaction graph, node For nodes The historical neighbor nodes of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment The embedding vector of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of node For nodes The historical neighbor nodes of , is the activation function, Based on The kernel function, is an exponential function, is the decay rate constant.

[0177] Optionally, the condition strength calculation module 503 includes:

[0178] a parameter learning unit, configured to use the fully connected layer as a main network, and learn parameters of a target network from parameters of the main network based on a first node time representation corresponding to a first node and a second node time representation corresponding to a second node, where the first node and the second node are any two nodes in the time transaction graph;

[0179] A processing unit is used to input the first node time representation and the second node time representation into the target network for processing to obtain a target condition strength, where the target condition strength is used to characterize the probability that the first node and the second node form a link at the target time.

[0180] Optionally, the parameters of the target network are:

[0181] ;

[0182] Among them, the node is the first node, For the first node time representation, node is the second node, The second node time is represented by the time is the target time, are the parameters of the main network, Used to characterize a conversion model, where the conversion model is used to learn the parameters of the target network from the parameters of the main network.

[0183] Optionally, the processing unit is specifically configured to:

[0184] determining the square of the difference between the first node time representation and the second node time representation as input data;

[0185] The input data is input into the target network for processing to obtain the target condition strength.

[0186] Optionally, the event trend prediction module 504 is specifically configured to:

[0187] The node time representation and the edge feature corresponding to the node are input into an edge feature integration model based on a graph attention network for processing to obtain a target event trend, where the target event trend is used to characterize a predicted value of the number of new events generated by the node at the target time.

[0188] Optionally, the target account detection device 500 based on dynamic events and graph neural network further includes:

[0189] Acquisition module, used to obtain the training time transaction graph;

[0190] An input module, configured to input the training time transaction graph into the feature extraction module for feature extraction to obtain the training node features and training edge features;

[0191] A training module is used to iteratively train an event-driven self-exciting encoder based on the training node features and the training edge features, wherein the event-driven self-exciting encoder includes the Hawkes process-based time graph neural network, the conditional strength calculation module and the event trend prediction module.

[0192] The target account detection device 500 based on dynamic events and graph neural networks provided in the embodiment of the present application can execute the above-mentioned method embodiment. Its implementation principle and technical effects are similar, and this embodiment will not be repeated here.

[0193] It should be noted that the division of units in the embodiments of the present application is schematic and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0194] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program code.

[0195] like Figure 6 As shown, an embodiment of the present application provides an electronic device 600, including: a memory 602, a processor 601, and a program stored on the memory 602 and executable on the processor 601; the processor 601 is used to read the program in the memory 602 to implement the steps in the target account detection method based on dynamic events and graph neural networks as described above.

[0196] An embodiment of the present application also provides a readable storage medium, on which a program is stored. When the program is executed by a processor, the various processes of the above-mentioned target account detection method embodiment based on dynamic events and graph neural networks are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here. Among them, the readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as compact disk (CD), digital video disc (DVD), Blu-ray Disc (BD), high-definition versatile disc (HVD), etc.), and semiconductor memory (such as read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read only memory (EEPROM), non-volatile memory (NAND FLASH), solid state drive (SSD)), etc.

[0197] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0198] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, disk, CD-ROM) and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of this application.

[0199] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. A target account detection method based on dynamic events and graph neural networks, characterized by: include: Inputting the time transaction graph into a feature extraction module for feature extraction to obtain node features corresponding to nodes and edge features corresponding to edges, wherein the time transaction graph includes the nodes, the edges, and timestamps. The nodes are used to represent accounts, the edges are used to represent transactions between the accounts, and the timestamps are used to represent the time of the transactions; Inputting the node features and the edge features into a time graph neural network based on a Hawkes process to perform feature aggregation to obtain a node time representation of the node at the target time; Inputting the node time representation into a condition strength calculation module for processing to obtain a condition strength, wherein the condition strength is used to characterize the probability of any two nodes forming a link at the target time; Inputting the node time representation and the edge feature into an event trend prediction module for processing to obtain an event trend, wherein the event trend is used to represent a predicted value of the number of new events generated by the node at the target time; Determining a detection result of the account corresponding to the node based on the condition strength and the event trend; The step of inputting the node features and the edge features into a time graph neural network based on a Hawkes process to perform feature aggregation to obtain a node time representation of the node at the target time includes: Inputting the node features and the edge features into a multi-layer Hawkes process-based time graph neural network for feature aggregation to obtain a node time representation of the node at the target time; Among them, The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of for: ； ； ； ； The target time is the time , and For the The weight matrix of the Hawkes process-based temporal graph neural network described in the layer, Relative to time At the node A collection of historical events on , is the set of events in the time transaction graph, , is the number of events in the time transaction graph, node For nodes The historical neighbor nodes of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment The embedding vector of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of node For nodes The historical neighbor nodes of , is the activation function, Based on The kernel function, is an exponential function, is the decay rate constant.

2. The method according to claim 1, wherein: The step of inputting the node time representation into a condition strength calculation module for processing to obtain the condition strength includes: Using the fully connected layer as a main network, learning parameters of a target network from parameters of the main network based on a first node time representation corresponding to a first node and a second node time representation corresponding to a second node, where the first node and the second node are any two nodes in the time transaction graph; The first node time representation and the second node time representation are input into the target network for processing to obtain a target condition strength, where the target condition strength is used to characterize the probability of the first node and the second node forming a link at the target time.

3. The method according to claim 2, wherein: The parameters of the target network are: ； Among them, the node is the first node, For the first node time representation, node is the second node, The second node time is represented by the time is the target time, are the parameters of the main network, Used to characterize a conversion model, where the conversion model is used to learn the parameters of the target network from the parameters of the main network.

4. The method according to claim 2, wherein: The step of inputting the first node time representation and the second node time representation into the target network for processing to obtain conditional strength includes: determining the square of the difference between the first node time representation and the second node time representation as input data; The input data is input into the target network for processing to obtain the conditional strength.

5. The method according to claim 1, wherein: The step of inputting the node time representation and the edge feature into an event trend prediction module for processing to obtain an event trend includes: The node time representation and the edge feature corresponding to the node are input into an edge feature integration model based on a graph attention network for processing to obtain a target event trend, where the target event trend is used to characterize a predicted value of the number of new events generated by the node at the target moment.

6. The method according to claim 1, wherein: The method further comprises: Get the training time transaction graph; Inputting the training time transaction graph into the feature extraction module for feature extraction to obtain the training node features and training edge features; An event-driven self-exciting encoder is iteratively trained based on the training node features and the training edge features. The event-driven self-exciting encoder includes the Hawkes process-based time graph neural network, the conditional strength calculation module and the event trend prediction module.

7. A target account detection device based on dynamic events and graph neural networks, characterized by: include: a feature extraction module, configured to extract features from a time transaction graph to obtain node features corresponding to nodes and edge features corresponding to edges, wherein the time transaction graph includes the nodes, the edges, and timestamps, wherein the nodes represent accounts, the edges represent transactions between the accounts, and the timestamps represent the moments of the transactions; A time graph neural network based on a Hawkes process is used to perform feature aggregation on the node features and the edge features to obtain a node time representation of the node at a target time; a conditional strength calculation module, configured to process the node time representation to obtain a conditional strength, wherein the conditional strength is used to characterize the probability of any two nodes forming a link at the target time; An event trend prediction module, configured to process the node time representation and the edge features to obtain an event trend, wherein the event trend is used to represent a predicted value of the number of new events generated by the node at the target time; a determination module, configured to determine a detection result of the account corresponding to the node based on the condition strength and the event trend; The Hawkes process-based temporal graph neural network includes: A feature aggregation unit, configured to input the node features and the edge features into a multi-layer Hawkes process-based time graph neural network for feature aggregation, to obtain a node time representation of the node at a target time; Among them, The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of for: ； ； ； ； The target time is the time , and For the The weight matrix of the Hawkes process-based temporal graph neural network described in the layer, Relative to time At the node A collection of historical events on , is the set of events in the time transaction graph, , is the number of events in the time transaction graph, node For nodes The historical neighbor nodes of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment The embedding vector of For the The nodes output by the Hawkes process-based temporal graph neural network in the layer At the moment Embedding vector of node For nodes The historical neighbor nodes of , is the activation function, Based on The kernel function, is an exponential function, is the decay rate constant.

8. An electronic device comprising: A memory, a processor, and a program stored in the memory and executable on the processor; wherein the processor is configured to read the program in the memory to implement the steps of the target account detection method based on dynamic events and graph neural networks as described in any one of claims 1 to 6.

9. A readable storage medium for storing a program, characterized in that: When the program is executed by a processor, the steps of the target account detection method based on dynamic events and graph neural networks are implemented as described in any one of claims 1 to 6.

Images