Ethiopian user behavior analysis method based on heterogeneous condition codec architecture

Abstract

This invention discloses an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture, belonging to the field of artificial intelligence and blockchain behavior analysis technology. This invention models the Ethereum interaction network as a directed heterogeneous graph that distinguishes between user types and interaction types, defining six meta-interaction types for one-hot encoding; it aggregates neighboring source user features from the target user's perspective to generate neighborhood features, combining target features and meta-interaction features as input to the encoder to output intermediate hidden states; it reconstructs generated features through a feature decoder, and uses attention to aggregate different interaction features to obtain enhanced features for the target user; it concatenates the original features and inputs them into a heterogeneous graph neural network to detect malicious behavior; simultaneously, it symmetrically generates neighborhood features and hidden states from the source user's perspective, and reconstructs the adjacency matrix through a structure decoder to construct an auxiliary learning objective. This invention achieves refined interaction semantic modeling, adaptive learning of multiple interaction patterns, strengthens topological relationship representation, and improves detection accuracy.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and blockchain behavior analysis technology, and in particular relates to an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture. Background Technology

[0002] With the rapid development of blockchain technology, it has been widely applied in various fields. Ethereum, with its revolutionary smart contract technology, has risen rapidly, and its user base has continued to grow. However, this growth has also brought about a number of problems. The functionality of smart contracts originates from code logic, and to meet the ever-changing user needs, contract functions are becoming increasingly rich and complex, further increasing the difficulty of user behavior analysis. Against this backdrop, how to effectively mine Ethereum user behavior patterns for efficient illegal behavior detection and maintain Ethereum security has become a current research hotspot.

[0003] Ethereum networks are highly complex due to the diverse user types and intricate interactions among them. Furthermore, the high activity levels of users result in massive amounts of interaction data, making it difficult to extract valuable information for user behavior capture. Existing methods incorporate graph neural network algorithms to model Ethereum interactions as homogeneous or heterogeneous graphs, combining this with downstream graph neural network algorithms to learn user behavior patterns and detect illegal behavior. However, homogeneous graph-based modeling ignores type information, leading to incomplete modeling and inability to learn user behavior representations. Existing heterogeneous graph methods, which distinguish between user and edge types, can more comprehensively model user behavior, but also significantly increase graph complexity. Moreover, these methods often use meta-path definitions to define fixed user behavior patterns to enhance detection, resulting in a lack of model generality. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention proposes an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture, thereby resolving the issues present in the existing technologies.

[0005] Firstly, to achieve the above objectives, this invention provides an Ethereum user behavior analysis method based on a heterogeneous conditional encoding / decoding architecture, comprising the following steps:

[0006] The Ethereum interaction network is modeled as a directed heterogeneous graph pointing from source users to target users, distinguishing between user types and interaction types;

[0007] The triple consisting of the source user, the target user, and the interaction behavior is defined as the meta-interaction type, and the meta-interaction type is one-hot encoded to generate meta-interaction type features.

[0008] From the perspective of the target user, the features of neighboring source users are aggregated based on different meta-interaction types to generate the neighborhood features of the target user;

[0009] Input the target user features into the encoder, use the neighborhood features and meta-interaction type features as conditions, and output the intermediate hidden state of the target user.

[0010] The intermediate hidden states are input into the feature decoder to reconstruct the generated features of the target user under meta-interaction behavior;

[0011] By aggregating generated features under different meta-interaction behaviors through an attention mechanism, we can obtain enhanced features for the target user.

[0012] The enhanced features are spliced ​​together with the original features, and the original adjacency matrix is ​​input into a heterogeneous graph neural network to detect malicious behavior;

[0013] From the perspective of the source user, aggregate the features of the target user from the neighboring user to generate the source user's neighborhood features;

[0014] Input the source user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the intermediate hidden state of the source user.

[0015] The hidden state input structure decoder between the target user and the source user under the same meta-interaction is used to reconstruct the adjacency matrix and construct the auxiliary learning target.

[0016] Optionally, the user types include external users and contract users;

[0017] The interaction types include invocation and transaction; the meta-interaction types are defined as six triples:

[0018] Contract users can point to other contract users via calls, contracts can point to other contract users via transactions, contracts can point to external users via transactions, external users can point to other contract users via calls, external users can point to other contract users via transactions, and external users can point to external users via transactions.

[0019] Optionally, the process of generating target user neighborhood features includes:

[0020] Extract the characteristics of neighboring source users of the target user under specific meta-interaction types;

[0021] The neighborhood features of the target user under this meta-interaction type are obtained by averaging and aggregating the features of the neighboring source users.

[0022] The process of generating source user neighborhood features includes:

[0023] Extract the characteristics of the target users' neighbors under specific meta-interaction types from the source user;

[0024] The neighborhood features of the target users are averaged and aggregated to obtain the neighborhood features of the source user under this meta-interaction type.

[0025] Optionally, the encoder is a two-layer multilayer perceptron;

[0026] Input a concatenated vector of target user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the target user.

[0027] Input a concatenated vector of source user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden states of the source user.

[0028] The encoder parameters are shared between the target user and the source user.

[0029] Optionally, the process of reconstructing the target user's generated features includes:

[0030] The target user's intermediate hidden state, neighborhood features, and meta-interaction type features are input into a feature decoder composed of two multi-layer perceptrons to reconstruct and generate features.

[0031] The attention mechanism aggregation process includes:

[0032] The importance weights of each meta-interaction type are calculated using the meta-interaction level attention vector.

[0033] By fusing generated features from different meta-interaction types according to weights, we obtain enhanced features for the target user.

[0034] Optionally, the process of reconstructing the adjacency matrix includes:

[0035] Input the intermediate hidden states of the target user and the intermediate hidden states of the source user into the structure decoder under the same meta-interaction type;

[0036] The reconstructed adjacency matrix for this meta-interaction type is generated by matrix multiplication;

[0037] The auxiliary learning objective is constructed by calculating the mean square error between the reconstructed adjacency matrix and the original adjacency matrix.

[0038] Secondly, the present invention also provides an Ethereum user behavior analysis system based on a heterogeneous conditional encoding / decoding architecture, for implementing an Ethereum user behavior analysis method based on a heterogeneous conditional encoding / decoding architecture, the system comprising:

[0039] The network modeling module is used to model the Ethereum interaction network as a directed heterogeneous graph pointing from source users to target users, distinguish between user types and interaction types, and define the triple consisting of source user, target user, and interaction behavior as meta-interaction type.

[0040] The feature encoding module is used to perform one-hot encoding on the meta-interaction type to generate meta-interaction type features;

[0041] The neighborhood aggregation module is used to aggregate neighbor source user features from the perspective of the target user based on different meta-interaction types to generate target user neighborhood features, and to aggregate neighbor target user features from the perspective of the source user to generate source user neighborhood features.

[0042] The conditional encoding module is used to input the target user features into the encoder and output the intermediate hidden state of the target user as a condition based on the neighborhood features and the meta-interaction type features, and to input the source user features into the encoder and output the intermediate hidden state of the source user as a condition based on the neighborhood features and the meta-interaction type features.

[0043] The feature decoding module is used to reconstruct the generated features of the target user under meta-interaction behavior from the intermediate hidden state input feature decoder;

[0044] The attention aggregation module is used to aggregate generated features from different meta-interaction behaviors through an attention mechanism to obtain target user enhanced features.

[0045] The behavior detection module is used to concatenate enhanced features with original features and combine them with the original adjacency matrix to input a heterogeneous graph neural network to detect malicious behavior.

[0046] The structure decoding module is used to reconstruct the adjacency matrix and construct auxiliary learning targets by inputting the hidden states of the target user and the source user under the same meta-interaction into the structure decoder.

[0047] Optionally, the modeling module includes:

[0048] User type definition unit, used to distinguish between external users and contract users;

[0049] Interaction type definition unit, used to distinguish between invocation and transaction;

[0050] The meta-interaction building block is used to construct six types of meta-interactions: contract user pointing to contract user via call, contract user pointing to contract user via transaction, contract user pointing to external user via transaction, external user pointing to contract user via call, external user pointing to contract user via transaction, and external user pointing to external user via transaction.

[0051] Thirdly, the present invention also provides a computer terminal device, comprising:

[0052] One or more processors;

[0053] A memory, coupled to the processor, for storing one or more programs;

[0054] When the one or more programs are executed by the one or more processors, the one or more processors implement an Ethereum user behavior analysis method based on a heterogeneous conditional codec architecture.

[0055] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture.

[0056] Compared with the prior art, the present invention has the following advantages and technical effects:

[0057] This invention provides an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture. This invention refines the semantics of user interactions through meta-interaction types, avoiding the limitations of preset meta-paths; it adaptively learns multiple interaction patterns based on the heterogeneous conditional encoding and decoding architecture, and strengthens the topological relationship representation by combining dual-view hidden state learning and graph structure reconstruction tasks; and it improves the accuracy of malicious behavior detection by fusing multiple interaction features through an attention mechanism to generate enhanced representations. Attached Figure Description

[0058] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0059] Figure 1 This is a flowchart of the malicious behavior detection architecture method according to an embodiment of the present invention;

[0060] Figure 2 This is a task framework diagram of the malicious behavior detection method according to an embodiment of the present invention;

[0061] Figure 3 This is a diagram of the user-enhanced feature-assisted learning framework according to an embodiment of the present invention;

[0062] Figure 4 This is a framework diagram of a malicious behavior detection system according to an embodiment of the present invention. Detailed Implementation

[0063] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0064] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0065] Example 1

[0066] like Figure 1 As shown, this embodiment provides an Ethereum user behavior analysis method based on a heterogeneous conditional encoding / decoding architecture, including:

[0067] The Ethereum interaction network is modeled as a directed heterogeneous graph pointing from source users to target users, distinguishing between user types and interaction types;

[0068] The triple consisting of the source user, the target user, and the interaction behavior is defined as the meta-interaction type, and the meta-interaction type is one-hot encoded to generate meta-interaction type features.

[0069] From the perspective of the target user, the features of neighboring source users are aggregated based on different meta-interaction types to generate the neighborhood features of the target user;

[0070] Input the target user features into the encoder, use the neighborhood features and meta-interaction type features as conditions, and output the intermediate hidden state of the target user.

[0071] The intermediate hidden states are input into the feature decoder to reconstruct the generated features of the target user under meta-interaction behavior;

[0072] By aggregating generated features under different meta-interaction behaviors through an attention mechanism, we can obtain enhanced features for the target user.

[0073] The enhanced features are spliced ​​together with the original features, and the original adjacency matrix is ​​input into a heterogeneous graph neural network to detect malicious behavior;

[0074] From the perspective of the source user, aggregate the features of the target user from the neighboring user to generate the source user's neighborhood features;

[0075] Input the source user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the intermediate hidden state of the source user.

[0076] The hidden state input structure decoder between the target user and the source user under the same meta-interaction is used to reconstruct the adjacency matrix and construct the auxiliary learning target.

[0077] Specifically, S1: For the complex interaction behaviors between multiple types of users on the Ethereum platform, distinguish between users and interaction types, and model the Ethereum interaction network as a directed heterogeneous graph from source users to target users;

[0078] S2: The triple consisting of the source user, the target user, and the corresponding interaction behavior is regarded as the meta-interaction type. The meta-interaction type is encoded using the One-hot encoding method to obtain specific meta-interaction type features.

[0079] S3: Learning from the perspective of the target user, considering the various meta-interactions around the target user, aggregating source users based on different meta-interaction types, and obtaining the neighborhood features of the target user under different meta-interaction behaviors;

[0080] S4: Take the target user features as input, and take its neighborhood features and corresponding meta-interaction type features as conditions, and input them together into the encoder of the heterogeneous CVAE model to obtain the intermediate hidden state of the target user.

[0081] S5: Input the intermediate hidden state of the target user into the feature decoder to reconstruct the generated features of the target user under different meta-interaction behaviors, and use the attention mechanism to aggregate the generated features under different meta-interaction behaviors to obtain the final enhanced features of the target user.

[0082] S6: Concatenate the enhanced features with the original features, combine them with the original adjacency matrix, and input them into the downstream heterogeneous graph neural network module to learn user behavior and detect malicious behavior;

[0083] S7: In order for the encoder to uncover deeper topological information, an auxiliary learning module is designed to learn from the perspective of the source user. First, the target users around the source user under different meta-interaction behaviors are aggregated as the neighborhood features of the source user under different meta-interaction behaviors.

[0084] S8: Same as S4, combining the neighborhood features and meta-interaction type features of the source user, and inputting them together with the source user features into the parameter-shared encoder to obtain the intermediate hidden state of the source user;

[0085] S9: Combine the intermediate hidden states of the target user and the source user under the same meta-interaction relationship, input them into the structure decoder, reconstruct the reconstructed adjacency matrix under the meta-interaction relationship, and construct the auxiliary learning target.

[0086] As one implementation method in this embodiment, the user types include external users and contract users;

[0087] The interaction types include invocation and transaction; the meta-interaction types are defined as six triples:

[0088] Contract users can point to other contract users via calls, contracts can point to other contract users via transactions, contracts can point to external users via transactions, external users can point to other contract users via calls, external users can point to other contract users via transactions, and external users can point to external users via transactions.

[0089] Specifically, step S1 includes: On the Ethereum platform, users are divided into two main categories: External Users (EOA) and Contract Users (CA), while interaction behaviors are mainly divided into two types: calls and transactions. Through different users and different interaction behaviors, the Ethereum interaction network is modeled as a directed heterogeneous graph pointing from source users to target users, where the target user is defined as... The source user is defined as Specifically, based on actual Ethereum interactions, six triplet structures combining user type, target user type, and interaction type are formed, which are called meta-interactions and denoted as... .

[0090] For more details, please refer to the appendix. Figure 2 The above, Figure 2 To Figure 1 The flowchart shown provides a detailed description of how to generate enhanced features for target users in a heterogeneous codec architecture and use them for malicious behavior detection. The specific process is as follows:

[0091] S1: Based on the actual interaction situation in Ethereum, six combinations are obtained by distinguishing between the types of head and tail users and intermediate interactions, which are called meta-interaction relationships. They are:

[0092]

[0093] The symbols enclosed in parentheses represent the various meta-interaction types. Meta-interaction types are constructed based on different meta-interaction types. ,in Indicates the user type.

[0094] Specifically, in step S2, for different meta-interaction behaviors, one-hot encoding is used to encode the corresponding meta-interaction behaviors to obtain the features corresponding to each meta-interaction type, denoted as... .

[0095] More specifically, S2: For different meta-interaction behaviors, one-hot encoding is used to encode the corresponding meta-interaction behaviors, resulting in feature vectors for the meta-interaction types. The specific encoding format is as follows:

[0096]

[0097] As one implementation method in this embodiment, the process of generating target user neighborhood features includes:

[0098] Extract the characteristics of neighboring source users of the target user under specific meta-interaction types;

[0099] The neighborhood features of the target user under this meta-interaction type are obtained by averaging and aggregating the features of the neighboring source users.

[0100] The process of generating source user neighborhood features includes:

[0101] Extract the characteristics of the target users' neighbors under specific meta-interaction types from the source user;

[0102] The neighborhood features of the target users are averaged and aggregated to obtain the neighborhood features of the source user under this meta-interaction type.

[0103] Specifically, step S3 extracts the neighboring source users around the target user under a specific interaction type, aggregates the features of its neighboring source users and performs average processing to obtain the neighborhood feature representation of the target user under that meta-interaction behavior.

[0104] More specifically, S3: From the perspective of the target user, aggregate target users. exist Source User Characteristics under Meta-Interaction Type To obtain target users Domain characteristics under meta-interaction The formula is expressed as follows:

[0105]

[0106] in, Indicates target user Meta-interaction The total number of neighboring users.

[0107] As one implementation method in this embodiment, the encoder is a two-layer multilayer perceptron;

[0108] Input a concatenated vector of target user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the target user.

[0109] Input a concatenated vector of source user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden states of the source user.

[0110] The encoder parameters are shared between the target user and the source user.

[0111] Specifically, in step S4, the target user features are used as encoder input, and the domain features and corresponding meta-interaction types are used as conditions to input into the CVAE encoder to obtain the intermediate hidden state of the target user under the meta-interaction type.

[0112] More specifically, S4.1: Target user characteristics As input, its domain features and corresponding meta-interaction type features As a condition, input to the CVAE encoder In this model, the encoder is trained using a two-layer multilayer perceptron, as shown in the following formula:

[0113]

[0114] in, , These represent the parameter matrices of the first and second layers of the multilayer perceptron, respectively. After encoding, the intermediate hidden states of the target user are obtained. .

[0115] S4.2: Calculate the KL divergence of the intermediate hidden states of the target user to optimize encoder performance. The specific formula is as follows:

[0116]

[0117] in, Indicates the number of meta-interaction types. Relative entropy measures the similarity between two distributions.

[0118] As one implementation method in this embodiment, the process of reconstructing the target user-generated features includes:

[0119] The target user's intermediate hidden state, neighborhood features, and meta-interaction type features are input into a feature decoder composed of two multi-layer perceptrons to reconstruct and generate features.

[0120] The attention mechanism aggregation process includes:

[0121] The importance weights of each meta-interaction type are calculated using the meta-interaction level attention vector.

[0122] By fusing generated features from different meta-interaction types according to weights, we obtain enhanced features for the target user.

[0123] Specifically, step S5 includes:

[0124] S5.1: Combine the intermediate hidden states and conditional vectors and input them into the feature decoder to reconstruct the generated features of the target user under different meta-interaction behaviors;

[0125] S5.2: Learn the importance index of users under each meta-interaction type through attention at the meta-interaction level, and aggregate user-generated features under different meta-interaction types based on the index to obtain the enhanced features of the final target user.

[0126] More specifically, S5.1: Combining condition vectors and The intermediate hidden state between the generated target user and the target user Common Input Feature Decoder In this model, the feature decoder uses a two-layer multilayer perceptron for feature mapping, as shown in the following formula:

[0127]

[0128] The generated features of the target user under different meta-interaction behaviors are reconstructed using a feature decoder. .in, , These represent the parameter matrices of the first and second layer multilayer perceptrons, respectively.

[0129] S5.2: Based on Generative Features and input features The feature reconstruction loss function is calculated as follows:

[0130]

[0131] in, This represents the total number of neighbors of the target user. Indicates the meta-interaction type between the target user and the source user. Generated using reparameterization techniques.

[0132] S5.3: The generated target user features are aggregated through a meta-interaction-level attention mechanism to obtain enhanced target user features. First, a meta-interaction-level attention vector is introduced. ,use The function calculates Importance scores of generated features under meta-interaction behavior The specific calculation process is as follows:

[0133]

[0134] in, It is a weight matrix. It is a bias vector. After obtaining the importance of each meta-interaction, the generated features under each meta-interaction are fused. This yields the final enhanced features for the target user:

[0135]

[0136] in, The number of meta-interaction behavior types, For target users The final enhanced feature.

[0137] Specifically, in step S6, the enhanced features and original features of the target user are concatenated to obtain its enhanced user representation. Then, the original adjacency matrix is ​​combined for graph message passing and updating. The final user representation is obtained by fusing structural information and input into the downstream classifier to achieve malicious behavior detection.

[0138] More specifically, S6.1: Target users Enhanced features and original features By splicing, an enhanced user representation can be obtained. Combining the original adjacency matrices of the target user and the source user Both are input into the downstream HGNN for malicious behavior detection.

[0139]

[0140] in, For target users The end user stated that the data is input into the downstream classifier to achieve the task of detecting malicious behavior.

[0141] S6.2: Calculate the loss function for malicious behavior detection, using cross-entropy as the objective function and a multilayer perceptron as the classifier. The formula is as follows:

[0142]

[0143] in, This indicates the number of users who need to be tested.

[0144] Specifically, step S7, from the perspective of the source user, averages and aggregates the neighbor target user features of the source user under a specific meta-interaction to obtain the neighborhood features of the source user under that meta-interaction type.

[0145] For more details, please refer to the appendix. Figure 3 The above, Figure 3 To Figure 1 The flowchart shown illustrates the auxiliary learning task for graph reconstruction in heterogeneous codec architectures, and provides a detailed description of the process used to guide encoder optimization. The specific steps are as follows:

[0146] S7: From the perspective of the source user, under the same type of meta-interaction, by shifting the focus to the source user's domain information, the meta-interaction triplet structure is transformed into the following form. Aggregator source users exist Target user characteristics under meta-interaction type , obtain source user Neighborhood features The formula is expressed as follows:

[0147]

[0148] in, Indicates the source user In meta-interaction type The neighboring users below.

[0149] Specifically, step S8 involves encoding the source user features by combining the source user's neighborhood features and the corresponding meta-interaction type to obtain the source user's intermediate hidden state. In other words, similar operations to steps S3 and S4 are repeated, inputting the user representation and corresponding conditions into the encoder to obtain the source user's intermediate hidden state under a specific meta-interaction type.

[0150] More specifically, S8.1: Source user characteristics As input, its domain features Features of Meta-interaction Types As a conditional input into the encoder In this architecture, the encoder uses the same S4 ​​implementation to share parameters, and the learning process of the encoder is optimized through auxiliary tasks. A two-layer multilayer perceptron is used to implement the encoding process, and the specific calculation process is as follows:

[0151]

[0152] in, , These represent the parameter matrices of the first and second layer multilayer perceptrons, respectively.

[0153] S8.2: Calculate the KL divergence of the intermediate hidden states of the source users to optimize encoder performance. The specific formula is as follows:

[0154]

[0155] in, Indicates the number of meta-interaction types.

[0156] As one implementation method in this embodiment, the process of reconstructing the adjacency matrix includes:

[0157] Input the intermediate hidden states of the target user and the intermediate hidden states of the source user into the structure decoder under the same meta-interaction type;

[0158] The reconstructed adjacency matrix for this meta-interaction type is generated by matrix multiplication;

[0159] The auxiliary learning objective is constructed by calculating the mean square error between the reconstructed adjacency matrix and the original adjacency matrix.

[0160] Specifically, step S9 describes the process of reconstructing the adjacency matrix of the target user and the source user under a specific meta-interaction type using a structure decoder. Specifically, the intermediate hidden states of the target user and the source user are input into the structure decoder to obtain the reconstructed adjacency matrix. This reconstructed adjacency matrix, along with the original adjacency matrix, is used to construct an auxiliary task to optimize the user representation learning process.

[0161] More specifically, S9.1: will be The intermediate hidden states of all target users under meta-interaction behavior The intermediate hidden state between the source user and the source user Input to the structure decoder In this process, the reconstructed adjacency matrix is ​​obtained. The specific calculation process is as follows:

[0162]

[0163] in, and for The total number of target users and source users under the meta-interaction behavior.

[0164] S9.2: Calculate the loss function for reconstructing the adjacency matrix, which is used to assist the learning task. The formula is as follows:

[0165]

[0166] in, This represents the total number of types of meta-interaction behaviors.

[0167] S9.3: Calculate the total loss of this model:

[0168]

[0169] in, , , These are the KL divergence. Feature loss and reconstruction loss Weights under the total loss L.

[0170] Based on this, this invention provides an Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture. This invention refines the semantics of user interactions through meta-interaction types, avoiding the limitations of preset meta-paths; it adaptively learns multiple interaction modes based on the heterogeneous conditional encoding and decoding architecture, and strengthens the topological relationship representation by combining dual-view hidden state learning and graph structure reconstruction tasks; it improves the accuracy of malicious behavior detection by fusing multiple interaction features through an attention mechanism to generate enhanced representations.

[0171] Example 2

[0172] Based on the same general inventive concept, this invention also provides an Ethereum user behavior analysis system based on a heterogeneous conditional encoding and decoding architecture. (See attached document.) Figure 4The Ethereum user behavior analysis system based on a heterogeneous conditional codec architecture provided by the present invention is described below. The Ethereum user behavior analysis system based on a heterogeneous conditional codec architecture described below can be referred to in correspondence with the Ethereum user behavior analysis method based on a heterogeneous conditional codec architecture described above. The system includes:

[0173] The network modeling module is used to distinguish the type information in the collected interactive data and model it as a heterogeneous network.

[0174] The user domain information acquisition and encoding module is used to obtain the neighbor aggregation information of the target user and the source user in the network under a specific interaction type, and to distinguish between input and condition information and pass them into the encoder to learn the user local domain representation;

[0175] The feature decoder module is used to generate enhanced features of the target user, which describe the user's local interactive behavior characteristics;

[0176] The structure decoder module is used to reconstruct the target user's hidden state and the source user's hidden state into a graph, generating a reconstruction graph under different meta-interactions to assist the encoder in learning and optimization.

[0177] The attention aggregation module is used to aggregate user representations obtained from multiple interaction types to obtain a final user representation that can describe complex interaction behaviors.

[0178] The malicious behavior detection module is used to input the end-user augmented representation into the classifier, enhance malicious behavior detection by utilizing the graph structure reconstruction task, and design the main task optimization function and the graph reconstruction optimization function to optimize model training.

[0179] Taking the Ethereum interaction network as an example, the Ethereum interaction network is modeled as a heterogeneous graph containing six meta-interaction behaviors. Neighborhood information of the source user and the target user is obtained and input into the encoder to learn the user's intermediate hidden states. Then, feature decoding and structure decoding are performed according to different task requirements to construct different optimization objectives. Next, attention is used to aggregate the output results of multiple meta-interactions to obtain the final enhanced user representation. Finally, the representation is input into the downstream neural network model for training and the final classification result is obtained. Based on the above steps, a user representation that considers the semantic information of multiple interaction behaviors is obtained, thereby improving the performance of malicious behavior detection.

[0180] It should be understood that the Ethereum user behavior analysis system based on a heterogeneous conditional codec architecture provided in this embodiment of the invention possesses all the advantages of the Ethereum user behavior analysis method based on a heterogeneous conditional codec architecture provided in the above embodiments.

[0181] Example 3

[0182] In this embodiment, a computer terminal device is provided, including:

[0183] One or more processors;

[0184] A memory, coupled to the processor, for storing one or more programs;

[0185] When the one or more programs are executed by the one or more processors, the one or more processors implement the methods in the above embodiments.

[0186] In this embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the methods described in the above embodiments.

[0187] In this embodiment, an electronic device is also provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to perform the methods described in the above embodiments.

[0188] The aforementioned program can run on a processor or be stored in memory (or a computer-readable medium). Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0189] These computer programs may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes can be implemented using different modules, and different steps can be implemented using different modules.

[0190] This embodiment provides such a device or system. The system, referred to as an Ethereum user behavior analysis system based on a heterogeneous conditional codec architecture, includes:

[0191] The network modeling module is used to model the Ethereum interaction network as a directed heterogeneous graph pointing from source users to target users, distinguish between user types and interaction types, and define the triple consisting of source user, target user, and interaction behavior as meta-interaction type.

[0192] The feature encoding module is used to perform one-hot encoding on the meta-interaction type to generate meta-interaction type features;

[0193] The neighborhood aggregation module is used to aggregate neighbor source user features from the perspective of the target user based on different meta-interaction types to generate target user neighborhood features, and to aggregate neighbor target user features from the perspective of the source user to generate source user neighborhood features.

[0194] The conditional encoding module is used to input the target user features into the encoder and output the intermediate hidden state of the target user as a condition based on the neighborhood features and the meta-interaction type features, and to input the source user features into the encoder and output the intermediate hidden state of the source user as a condition based on the neighborhood features and the meta-interaction type features.

[0195] The feature decoding module is used to reconstruct the generated features of the target user under meta-interaction behavior from the intermediate hidden state input feature decoder;

[0196] The attention aggregation module is used to aggregate generated features from different meta-interaction behaviors through an attention mechanism to obtain target user enhanced features.

[0197] The behavior detection module is used to concatenate enhanced features with original features and combine them with the original adjacency matrix to input a heterogeneous graph neural network to detect malicious behavior.

[0198] The structure decoding module is used to reconstruct the adjacency matrix and construct auxiliary learning targets by inputting the hidden states of the target user and the source user under the same meta-interaction into the structure decoder.

[0199] As one implementation method in this embodiment, the network modeling module includes:

[0200] User type definition unit, used to distinguish between external users and contract users;

[0201] Interaction type definition unit, used to distinguish between invocation and transaction;

[0202] The meta-interaction building block is used to construct six types of meta-interactions: contract user pointing to contract user via call, contract user pointing to contract user via transaction, contract user pointing to external user via transaction, external user pointing to contract user via call, external user pointing to contract user via transaction, and external user pointing to external user via transaction.

[0203] As one implementation method in this embodiment, the neighborhood aggregation module includes:

[0204] The target neighborhood generation unit is used to extract the features of the target user's neighboring source users under a specific meta-interaction type, and perform average aggregation to generate the target user's neighborhood features.

[0205] The source neighborhood generation unit is used to extract the features of the target users' neighbors under a specific meta-interaction type and perform average aggregation to generate the source user's neighborhood features.

[0206] As one implementation method in this embodiment, the conditional coding module includes:

[0207] A multilayer sensing coding unit is composed of two multilayer sensing mechanisms;

[0208] The target latent state generation unit inputs the target user features, neighborhood features and meta-interaction type features into the multilayer perceptual coding unit and outputs the intermediate latent state of the target user.

[0209] The source latent state generation unit inputs source user features, neighborhood features and meta-interaction type features into the multilayer perceptual coding unit and outputs the source user intermediate latent state.

[0210] The target hidden state generator and the source hidden state generator share parameters.

[0211] As one implementation method in this embodiment, the feature decoding module includes:

[0212] The feature reconstruction unit, composed of two multi-layer perception mechanisms, is used to reconstruct the target user's intermediate latent state, neighborhood features, and meta-interaction type features into generated features.

[0213] The attention aggregation module includes:

[0214] The weight calculation unit calculates the importance weight of each meta-interaction type through the meta-interaction level attention vector;

[0215] The feature fusion unit fuses generated features from different meta-interaction types according to weights to generate enhanced features for the target user.

[0216] As one implementation method in this embodiment, the structure decoding module includes:

[0217] The matrix reconstruction unit is used to generate a reconstructed adjacency matrix by multiplying the intermediate hidden states of the target user and the source user under the same meta-interaction type.

[0218] The auxiliary learning unit constructs an auxiliary learning objective by calculating the mean square error between the reconstructed adjacency matrix and the original adjacency matrix.

[0219] The system or apparatus is used to implement the functions of the methods in the above embodiments. Each module in the system or apparatus corresponds to each step in the method, as has been described in the method and will not be repeated here.

[0220] The above implementation method solves the problem of Ethereum user behavior analysis based on heterogeneous conditional encoding and decoding architecture in related technologies, thereby ensuring that the problems existing in the prior art are resolved.

[0221] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for analyzing Ethereum user behavior based on a heterogeneous conditional encoding / decoding architecture, characterized in that, Includes the following steps: S1. Model the Ethereum interaction network as a directed heterogeneous graph pointing from source users to target users, and distinguish between user types and interaction types; S2. Define the triple consisting of source user, target user and interaction behavior as meta-interaction type, and perform one-hot encoding on meta-interaction type to generate meta-interaction type feature. S3. From the perspective of the target user, aggregate the features of neighboring source users based on different meta-interaction types to generate the neighborhood features of the target user; S4. Input the target user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to input them into the encoder of the heterogeneous CVAE model, and output the intermediate hidden state of the target user. S5. Input the intermediate hidden state into the feature decoder to reconstruct the generated features of the target user under the meta-interaction behavior; By aggregating generated features under different meta-interaction behaviors through an attention mechanism, we can obtain enhanced features for the target user. S6. Combine enhanced features with original features and input the original adjacency matrix into a heterogeneous graph neural network to detect malicious behavior; S7. From the perspective of the source user, aggregate the features of the target user from the neighbor to generate the features of the source user neighborhood; S8. Input the source user features into the encoder, and use the neighborhood features and meta-interaction type features as conditions to output the intermediate hidden state of the source user. S9. Input the hidden state of the target user and the source user under the same meta-interaction into the decoder, reconstruct the adjacency matrix and construct the auxiliary learning target; S5 includes: S5.1: Combining condition vectors and The intermediate hidden state between the generated target user and the target user Common Input Feature Decoder In this model, the feature decoder uses a two-layer multilayer perceptron for feature mapping, as shown in the following formula: The generated features of the target user under different meta-interaction behaviors are reconstructed using a feature decoder. ,in, , These represent the parameter matrices of the first and second layer multilayer perceptrons, respectively. S5.2: Based on Generative Features and input features Calculate the feature reconstruction loss function ; S5.3: By aggregating the generated target user features under various meta-interaction behaviors through a meta-interaction-level attention mechanism, the enhanced features of the target user are obtained; firstly, a meta-interaction-level attention vector is introduced. ,use The function calculates Importance scores of generated features under meta-interaction behavior The calculation process is as follows: in, It is a weight matrix. It is a bias vector. After obtaining the importance of each meta-interaction, the generated features under each meta-interaction are fused. This yields the final enhanced features for the target user: in, The number of meta-interaction behavior types, For target users The final enhancement feature; S9 includes: S9.1: will be The intermediate hidden states of all target users under meta-interaction behavior The intermediate hidden state between the source user and the source user Input to the structure decoder In this process, the reconstructed adjacency matrix is ​​obtained. The calculation process is as follows: in, and for Total number of target users and source users under meta-interaction behavior; S9.2: Calculate the loss function for reconstructing the adjacency matrix, which is used to assist the learning task. The formula is as follows: in, The total number of types of meta-interaction behaviors; S9.3: Calculate the total loss of this model: in, , , These are the KL divergence. Feature loss and reconstruction loss Weights under the total loss L.

2. The method according to claim 1, characterized in that, The user types include external users and contract users; The interaction types include invocation and transaction; the meta-interaction types are defined as six triples: Contract users can point to other contract users via calls, contracts can point to other contract users via transactions, contracts can point to external users via transactions, external users can point to other contract users via calls, external users can point to other contract users via transactions, and external users can point to external users via transactions.

3. The method according to claim 1, characterized in that, The process of generating target user neighborhood features includes: Extract the characteristics of neighboring source users of the target user under specific meta-interaction types; The neighborhood features of the target user under this meta-interaction type are obtained by averaging and aggregating the features of the neighboring source users. The process of generating source user neighborhood features includes: Extract the characteristics of the target users' neighbors under specific meta-interaction types from the source user; The neighborhood features of the target users are averaged and aggregated to obtain the neighborhood features of the source user under this meta-interaction type.

4. The method according to claim 1, characterized in that, The encoder is a two-layer, multi-layer sensor; Input a concatenated vector of target user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden state of the target user. Input a concatenated vector of source user features, neighborhood features, and meta-interaction type features, and output the intermediate hidden states of the source user. The encoder parameters are shared between the target user and the source user.

5. An Ethereum user behavior analysis system based on a heterogeneous conditional encoding / decoding architecture, characterized in that, The system for implementing the method according to any one of claims 1-4 comprises: The network modeling module is used to model the Ethereum interaction network as a directed heterogeneous graph pointing from source users to target users, distinguish between user types and interaction types, and define the triple consisting of source user, target user, and interaction behavior as meta-interaction type. The feature encoding module is used to perform one-hot encoding on the meta-interaction type to generate meta-interaction type features; The neighborhood aggregation module is used to aggregate neighbor source user features from the perspective of the target user based on different meta-interaction types to generate target user neighborhood features, and to aggregate neighbor target user features from the perspective of the source user to generate source user neighborhood features. The conditional encoding module is used to input the target user features into the encoder and output the intermediate hidden state of the target user as a condition based on the neighborhood features and the meta-interaction type features, and to input the source user features into the encoder and output the intermediate hidden state of the source user as a condition based on the neighborhood features and the meta-interaction type features. The feature decoding module is used to reconstruct the generated features of the target user under meta-interaction behavior from the intermediate hidden state input feature decoder; The attention aggregation module is used to aggregate generated features from different meta-interaction behaviors through an attention mechanism to obtain target user enhanced features. The behavior detection module is used to concatenate enhanced features with original features and combine them with the original adjacency matrix to input a heterogeneous graph neural network to detect malicious behavior. The structure decoding module is used to reconstruct the adjacency matrix and construct auxiliary learning targets by inputting the hidden states of the target user and the source user under the same meta-interaction into the structure decoder.

6. The system according to claim 5, characterized in that, The network modeling module includes: User type definition unit, used to distinguish between external users and contract users; Interaction type definition unit, used to distinguish between invocation and transaction; The meta-interaction building block is used to construct six types of meta-interactions: contract user pointing to contract user via call, contract user pointing to contract user via transaction, contract user pointing to external user via transaction, external user pointing to contract user via call, external user pointing to contract user via transaction, and external user pointing to external user via transaction.

7. A computer terminal device, characterized in that, include: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture as described in any one of claims 1-4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the Ethereum user behavior analysis method based on a heterogeneous conditional encoding and decoding architecture as described in any one of claims 1-4.

Images