Block chain abnormal transaction behavior identification method

Abstract

The invention discloses a block chain abnormal transaction behavior identification method, relates to the technical field of block chains, and solves the problem of low detection efficiency in the prior art. The method comprises the following steps: constructing first, second and third transaction network diagrams; according to a biased migration strategy, calculating to obtain an embedded vector of each node in the second transaction network diagram; performing unsupervised clustering on the first transaction network diagram according to the embedded vector; calculating a multi-dimensional suspicious index of each node in the third transaction network graph, obtaining a comprehensive suspicious value through aggregation calculation, generating a series of sub-graphs and the total suspiciousness of each sub-graph, and determining the sub-graph corresponding to the maximum total suspiciousness as a dense suspicious sub-graph; performing maximum flow detection in the dense suspicious subgraph to obtain an abnormal transaction source account set; according to the abnormal transaction source account set and the behavior abnormal account set, the risk level of the account in each cluster is judged; risk assessment and identification of large-scale Ethereum accounts are realized, and the Ethereum supervision capability is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a method for identifying abnormal transaction behavior in a blockchain. Background Art

[0002] Since the concept of Bitcoin was first proposed in 2008, blockchain technology has rapidly emerged, attracting widespread attention from academia and industry worldwide and driving the rapid development of distributed ledger technology. As the first blockchain platform to support smart contracts, Ethereum, with its flexible contract execution capabilities and decentralized nature, has become the world's second-largest blockchain network after Bitcoin. However, with its rapid development and widespread adoption, Ethereum has also become a hotbed for anomalous data. Initial coin offerings (ICOs) are a common fundraising method in the blockchain industry, raising funds by issuing digital tokens to investors. However, in recent years, the ICO market has been plagued by widespread turmoil and fraud. Statistics show that over 10% of Ethereum ICOs have been affected by fraudulent activities such as abnormal online transactions and Ponzi schemes, resulting in significant financial losses for investors. This phenomenon highlights the severity of financial security issues within the blockchain ecosystem. Of particular concern is that after committing these crimes, fraudulent users often use complex anomalous trading methods to legitimize the proceeds, concealing the source of funds and evading regulatory scrutiny.

[0003] Ethereum is an open-source blockchain-based platform with smart contract functionality. The concept of Ethereum was first proposed in late 2013, and development officially began in early 2014. With the rapid development of blockchain technology and smart contract applications, fraudulent activities under the guise of digital currency transactions and technological innovation have increased. Vasek and Moore were the first to systematically study financial security issues in the Bitcoin space, categorizing them into four categories: 1) abnormal network transactions; 2) Ponzi schemes; 3) mining scams; and 4) fraudulent wallets. Compared to Bitcoin, the Ethereum platform is also susceptible to the following financial fraud activities: 1) smart contract vulnerabilities; 2) ICO security issues; and 3) online fraud. For example, Atzei et al. systematically explored the security of Ethereum smart contracts by analyzing major attack methods and potential threats. Combined with a comprehensive investigation of online fraud by Bartolett et al. and a report released by Chainalysis, a virtual currency research and risk management company, as of the first half of 2024, 30,287 victims had lost a total of $225 million due to fraudulent activities such as ICO security issues and online fraud. With the rise of Ethereum fraud, a wide range of unusual transactions have emerged, allowing funds generated by the unusual activities to be used without detection. Through these unusual transactions, criminals convert monetary proceeds from criminal activities into funds from legitimate sources and circumvent regulatory scrutiny. According to reported statistics, the amount of money involved in unusual transactions on Ethereum has steadily increased from 2015 to 2024, reaching a staggering $23.8 billion in losses in 2022 alone, bringing the cumulative losses to a staggering $67 billion. Anomalous transactions facilitate a range of potentially serious criminal offenses and ultimately threaten the security of the financial system. To effectively identify and prevent online fraud and unusual transactions, current efforts include comprehensive monitoring, detailed below.

[0004] In the field of Ethereum fraud detection, existing technologies primarily rely on account labels for risk identification. Early fraud detection efforts focused on identifying unusual transaction websites, relying on analysis of website content and URL features. With the development of blockchain technology, researchers have shifted to fraud detection methods based on transaction features. These methods rely on manually extracted features (such as transaction amount, transaction frequency, account activity, and so on) and are trained using traditional machine learning classifiers. For example, Lin et al. proposed a user-aware graph neural network-based KYC-GNN solution, combining a multi-hop aggregator and an importance-based neighbor sampling strategy to improve feature extraction accuracy and model training efficiency. These handcrafted feature-based machine learning methods, while performing well on small datasets, have recently been proposed. Fraud detection methods based on transaction semantics have been proposed, uncovering hidden fraud signatures through in-depth analysis of fund flows and transaction behavior patterns. Wu et al. proposed a motivation-driven transaction semantic representation method, MoTS, which uses lightweight and efficient ETL tools to collect blockchain transaction data, construct a fund transfer network, and extract transaction semantic features through high-order network models. This method significantly improves the ability to understand complex transaction behavior.

[0005] With the development of graph neural networks (GNNs), graph representation learning methods have gradually become a cutting-edge technology for Ethereum fraud detection. This method models the Ethereum transaction network as a graph structure, with nodes representing accounts and edges representing transaction relationships. By automatically learning embedded features of nodes, it overcomes the reliance of traditional methods on artificial features and has greater versatility and scalability. Graph representation learning methods generate local structural information of nodes through a random walk process. Common methods include DeepWalk and Node2Vec. According to the research of Beres et al., node embedding algorithms are a type of graph representation learning method that maps graph nodes into a low-dimensional vector space, bringing node vectors with similar neighborhood structures into proximity in the vector space, thereby capturing the relationships between nodes. Beres et al. first applied node embedding technology to the Ethereum transaction graph, capturing the transaction relationships between accounts by mapping accounts into a low-dimensional vector space. This type of method effectively improves the accuracy of account anomaly identification and risk assessment.

[0006] In the field of traditional anti-abnormal trading research, the early focus was on anomaly analysis and detection. For example, Chen et al. constructed complex data analysis models to attempt to identify abnormal trading behavior from massive amounts of financial transaction data; Gao et al. used time series analysis to track the flow of funds in accounts to determine whether there were abnormal fluctuations; Huang et al. focused on understanding trading behavior patterns and applied data mining techniques to identify potential abnormal characteristics; Victor et al. employed machine learning classification algorithms to classify transaction data and identify abnormal transactions. Considering the limitations of traditional anti-abnormal trading technology, Zhong et al. constructed a hierarchical weighted transaction behavior feature description system and proposed outlier detection and small cluster detection methods to quantitatively measure the degree of suspiciousness of abnormal transactions, from transaction behavior to trading users.

[0007] As their research deepened, Li et al. achieved a breakthrough, pioneering a graph-based approach to detecting anomalous trading behavior. They constructed financial transaction data as a complex transaction relationship graph, where nodes represent accounts and edges depict the flow of funds between accounts. By deeply analyzing the fund flow patterns in the graph (such as the direction of funds, the amount of flow, and the closeness of connections between accounts), they successfully identified potential clues to anomalous transactions.

[0008] In the field of blockchain-based financial anti-abnormal transactions, traditional anti-abnormal transaction methods are difficult to directly apply due to the unique characteristics of blockchain transactions, such as anonymity and decentralization. Researchers have conducted numerous innovative explorations. Alarab et al. utilized cutting-edge ensemble learning methods to organically combine multiple machine learning algorithms, such as decision trees, support vector machines, and neural networks. Leveraging the strengths of these algorithms in feature extraction and model training, they conducted a comprehensive and in-depth analysis of Bitcoin transaction data on the blockchain, effectively detecting abnormal transactions. However, ensemble learning methods face challenges, such as complex model integration and high computational resource consumption.

[0009] Lorenz et al. have taken a different approach, innovatively combining active learning with unsupervised learning methods. Active learning proactively selects the most valuable data from a large amount of unlabeled data and labels it, making full use of limited labeled data; unsupervised learning excels at uncovering underlying patterns and structures in data. Combining these two approaches, they uncovered a rich set of patterns of anomalous trading activity in a Bitcoin transaction dataset, providing a new approach to combating anomalous trading in blockchain finance.

[0010] Existing Ethereum fraud detection methods based on graph representation learning effectively capture the topological relationships within the transaction network, but most fail to fully consider key transaction information, such as transaction amounts, timestamps, and gas prices. This lack of information prevents node embedding features from fully reflecting the actual transaction behavior of accounts, hindering the model's ability to identify complex fraud patterns and reducing detection accuracy and robustness. Furthermore, the complex nature of transactions between abnormal and legitimate accounts in the Ethereum transaction network leads to an excessively large number of accounts involved in abnormal transaction incidents. Existing solutions lack efficient means to filter legitimate transactions to accurately identify suspicious accounts when detecting abnormal transaction behavior, resulting in low detection efficiency. Summary of the Invention

[0011] The present invention solves the problem of low detection efficiency in the existing technology by providing a method for identifying abnormal transaction behavior in the blockchain, realizes risk assessment and identification of large-scale Ethereum accounts, and strengthens the Ethereum regulatory capability.

[0012] The present invention provides a method for identifying abnormal transaction behavior in a blockchain, the method comprising:

[0013] Constructing a first transaction network graph related to an active account set, a second transaction network graph related to an account set with abnormal behavior, and a third transaction network graph related to an account set with abnormal transaction sources;

[0014] Calculate the embedding vector of each node in the second transaction network graph according to the biased walking strategy;

[0015] Performing unsupervised clustering on the first transaction network graph according to the embedding vector to obtain a plurality of clusters;

[0016] Calculating multi-dimensional suspiciousness indicators for each node in the third transaction network graph, obtaining a comprehensive suspiciousness value by aggregating the multi-dimensional suspiciousness indicators, and gradually removing the least suspicious nodes in the third transaction network graph using an iterative pruning strategy to generate a series of subgraphs. During the pruning process, dynamically calculating the total suspiciousness of each subgraph, and selecting the subgraph corresponding to the maximum total suspiciousness as a dense suspicious subgraph;

[0017] Performing maximum flow detection in the dense suspicious subgraph to obtain a set of abnormal transaction source accounts;

[0018] The risk level of each account in each cluster is determined based on the abnormal transaction source account set and the abnormal behavior account set.

[0019] In one possible implementation, before constructing the first transaction network graph related to the active account set, the second transaction network graph related to the account set with abnormal behavior, and the third transaction network graph related to the abnormal transaction source account set, the method further includes:

[0020] Data preprocessing is performed on transaction data related to active account sets, transaction data related to account sets with abnormal behavior, and transaction data related to account sets that are sources of abnormal transactions. Data preprocessing specifically includes:

[0021] Deduplication and abnormal condition filtering are performed on the transaction data to obtain first preprocessed data;

[0022] Normalizing the amount and formatting the time on the first preprocessed data to obtain second preprocessed data;

[0023] Information extraction is performed on the second preprocessed data to generate preprocessed transaction data.

[0024] In a possible implementation, calculating the embedding vector of each node in the second transaction network graph according to the biased walking strategy includes:

[0025] Set the preset walk length and bias parameters in the biased walk strategy, and calculate the probability of each neighbor node adjacent to the current node being selected;

[0026] Based on a biased wandering strategy that integrates transaction amount, time, and natural gas price, the transition probability formula is used to calculate the transition probability of each neighboring node corresponding to the current node, and the neighboring node with the largest transition probability is determined as the next wandering node in the wandering path. This continues until the wandering length of the current node is equal to the preset wandering length. The wandering path of the current node is saved to obtain the node wandering path.

[0027] The node wandering path is mapped to obtain an embedding vector.

[0028] In one possible implementation, the biased wandering strategy based on the integration of transaction amount, time, and natural gas price calculates the transition probability of each neighboring node corresponding to the current node using a transition probability formula, and determines the neighboring node with the largest transition probability as the next wandering node in the wandering path, including:

[0029] Based on the amount-based biased walk method, the first transition probability of each neighboring node corresponding to the current node is calculated;

[0030] Based on the time-based biased walk method, the second transition probability of each neighboring node corresponding to the current node is calculated;

[0031] Based on the biased walk method of natural gas prices, the third transition probability of each neighboring node corresponding to the current node is calculated;

[0032] Calculate the transition probability of each neighbor node according to the first transition probability, the second transition probability, the third transition probability of each neighbor node and the probability of each neighbor node being selected;

[0033] The transition probability of each neighbor node is screened to obtain the neighbor node corresponding to the maximum transition probability.

[0034] In a possible implementation, calculating the transition probability of each neighbor node according to the first transition probability, the second transition probability, the third transition probability of each neighbor node, and the probability of each neighbor node being selected includes:

[0035] Calculating the transition probability of each neighbor node using a transition probability formula based on the first transition probability, the second transition probability, the third transition probability, and the probability of each neighbor node being selected;

[0036] The transition probability formula is expressed as:

[0037] π ux =PA ux α ·PT ux β PG ux 1-α-β ;

[0038] Among them, A ux represents the first transition probability between neighbor node x and current node u; β represents the deviation parameter; α is the bias parameter; P represents the selection probability of neighbor node x; T ux represents the second transition probability between neighbor node x and current node u; G ux Represents the third transition probability between neighbor node x and current node u.

[0039] In one possible implementation, calculating the multi-dimensional suspicion index of each node in the third transaction network graph and obtaining a comprehensive suspicion value by aggregating the multi-dimensional suspicion indexes may include:

[0040] Calculating a topological suspicion index, a time suspicion index, and a currency suspicion index for each node in the third transaction network graph;

[0041] The topological suspicion index, the time suspicion index and the currency suspicion index are multiplied together according to the natural joint probability method to obtain a comprehensive suspicion value.

[0042] In a possible implementation, the calculation formula of the topology suspicion index is expressed as:

[0043]

[0044] The calculation formula of the time suspicion index is expressed as:

[0045]

[0046] The calculation formula of the currency suspiciousness index is expressed as follows:

[0047] γ i (G) = bal*KL[R i (S),R i (V\S)];

[0048] where e ji represents the transaction frequency from node j to node i; e ki The transaction frequency from node k to node i; T i (S) represents the transaction timestamp set between node i and other nodes in subgraph S; T i (V) represents the transaction timestamp set of node i and other nodes in the set V; φ[.] represents the participation function of the node in a specific time period; bal represents the intermediate parameter; KL[.] represents the divergence calculation function; R i (S) represents the transaction score of node i in subgraph S; V represents the set of all nodes in the third transaction network graph; S represents the subgraph; α i (S) represents the topological suspicion index, E represents the set of all edges in the third transaction network graph; γ i (S) represents the time suspiciousness index, γ i (S) represents the currency suspicion index.

[0049] In a possible implementation, performing maximum flow detection in the dense suspicious subgraph to obtain an abnormal transaction source account set includes:

[0050] Determine a flow constraint and a source-sink constraint, perform maximum flow detection based on the flow constraint and the source-sink constraint, and obtain a set of abnormal transaction source accounts; wherein the flow constraint is:

[0051] 0 <x ij <Capacity ij ;

[0052] The source-sink constraints are:

[0053] ∑ (s,j)∈E x sj -∑ (j,s)∈E x js =Supply s ;

[0054] ∑ (i,t)∈E x it -∑ (t,k)∈Ex tk =Supply t ;

[0055] Among them, Capacity ij Indicates the upper limit of the transaction amount between user i and user j; Supply s Indicates the net outflow of the source account; Supply t represents the net outflow of the foreign exchange account; x ij represents the capital flow from user i to user j; x sj represents the capital flow from user s to user j; x it represents the capital flow from user i to user t; x js represents the capital flow from user j to user s; x tk represents the capital flow from user t to user k; E represents the set of all edges in the third transaction network graph.

[0056] In one possible implementation, the risk level calculation satisfies:

[0057] Risk(u)=λ1·Phish(u)+λ2·ML(u);

[0058] Among them, Phish(u) represents the risk level of the current account u as a fraud account; ML(u) represents the risk level of the current account u as an abnormal transaction account; λ1 represents the fraud weight coefficient; λ2 represents the abnormal transaction weight coefficient, and Risk(u) represents the risk level of the current account u.

[0059] One or more technical solutions provided in the present invention have at least the following technical effects or advantages:

[0060] The present invention utilizes a biased walk strategy to integrate key information such as transaction time and amount into the walk process, resulting in superior performance on the Ethereum network compared to other node embedding algorithms. To address the issue of strengthening the prevention and subsequent tracking and oversight of abnormal transaction events on Ethereum, the present invention filters normal accounts in the transaction network graph based on multi-dimensional suspiciousness indicators, forming a dense suspicious subgraph. This graph then captures the set of abnormal transaction source accounts using a maximum flow detection method. Combining the set of abnormal transaction source accounts with the set of accounts with abnormal behavior, the present invention provides a variety of account indicator combinations that can be combined based on the specific characteristics of different event cases, offering strong adaptability. The suspicious flow detection algorithm searches for dense subgraphs based on explicit descriptive features and uses a maximum flow algorithm to supplement their connections. The method provided by the present invention is transparent and easy to interpret. To address the risk assessment of large-scale accounts on Ethereum, where fraudulent and abnormal transaction behavior detection results only account for a relatively small proportion, the present invention uses unsupervised account clustering of the first transaction network graph using embedding vectors to simplify the problem. Accounts with similar behavior are aggregated and merged, and abnormal accounts identified in the detection module are matched to label the risk levels of related accounts in the clusters, significantly expanding the scope of risk assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 A flowchart of the method for identifying abnormal blockchain transaction behavior provided by an embodiment of the present invention;

[0062] Figure 2 A schematic diagram of the transaction network structure provided by an embodiment of the present invention;

[0063] Figure 3 A schematic diagram of a roaming strategy provided by an embodiment of the present invention;

[0064] Figure 4 A schematic diagram of a fraud detection process provided by an embodiment of the present invention;

[0065] Figure 5 A schematic diagram of a transaction network diagram comprising abnormal transaction groups and normal accounts provided in an embodiment of the present invention;

[0066] Figure 6 A schematic diagram of an abnormal transaction process provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0067] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of the present invention.

[0068] The present invention provides a method for identifying abnormal transaction behavior in blockchain. Figure 1 , the method includes the following steps S101 to S106.

[0069] S101, constructing a first transaction network graph related to an active account set, a second transaction network graph related to an account set with abnormal behavior, and a third transaction network graph related to an abnormal transaction source account set;

[0070] Specifically, before step S101, the following steps are included:

[0071] (1) Preprocessing the transaction data related to the active account set, the transaction data related to the account set with abnormal behavior, and the transaction data related to the account set with abnormal transaction sources; wherein the data preprocessing specifically includes:

[0072] (1.1) Deduplication of transaction data and filtering of data based on abnormal conditions to obtain first preprocessed data;

[0073] (1.2) Normalizing the amount and formatting the time on the first preprocessed data to obtain second preprocessed data;

[0074] (1.3) Extract information from the second preprocessed data to generate preprocessed transaction data.

[0075] For example, before constructing a transaction network graph, the original transaction data needs to be cleaned and preprocessed to output data in a format that complies with the requirements for constructing the transaction network graph. This process includes the following four aspects:

[0076] Deduplication: This section is designed to filter out duplicate transactions. When obtaining transaction data corresponding to accounts acting as senders and receivers, if two different accounts are transacting with each other, the same transaction will be obtained repeatedly. In this case, duplicate transactions need to be filtered to prevent duplication.

[0077] Filtering abnormal transactions: This section aims to filter out meaningless transaction data. Transactions initiated by Ethereum accounts can fail due to various violations. On the other hand, transactions with zero amounts are often of little value to detection. Failed transactions (status = error) and transactions with zero amounts need to be filtered out.

[0078] Normalized Amount: This part converts the amount in the transaction data into a format that is easier for machines to process. The amount of the transaction recorded on Ethereum is in Wei format. In order to facilitate data analysis in the subsequent machine learning process, the amount data in the transaction is multiplied by 10. 10 , converted into the amount of Ether.

[0079] Time formatting: This section converts the timestamps in transaction data into a format that is easier for machines to process. Transactions recorded on Ethereum use a long string of numbers. To facilitate data analysis in subsequent machine learning processes, transaction timestamps are converted to a standard format, such as YYYY-MM-DD HH:MM:SS.

[0080] Construct a transaction network graph. This process takes preprocessed transaction data as input and outputs a transaction network graph G = (V, E, W). This graph is a directed weighted graph containing the following key information:

[0081] Node set V: records all unique sender and receiver account addresses.

[0082] Edge E: records transactions, each edge represents a transaction.

[0083] Edge weight W: Add weight information to the edge, including transaction amount, transaction time, transaction gas price and other information.

[0084] The specific process of constructing the transaction network graph is as follows:

[0085] Step 1: Create an empty graph for subsequent visualization of the transaction network graph, and create a sparse matrix to store relevant data in the graph, including account nodes, connecting edges, and edge weights.

[0086] Step 2: Read a new transaction data, extract the sender and receiver as two nodes in the graph, and determine whether the nodes already exist in the graph. If not, execute step 3; otherwise, execute step 4.

[0087] Step 3: Add the two new nodes to the graph and add connecting edges.

[0088] Step 4: Find the transaction object of the existing node and add a connecting edge.

[0089] Step 5: Repeat step 2 until no new transactions appear.

[0090] See also Figure 2 This is the final transaction network diagram.

[0091] S102, calculating the embedding vector of each node in the second transaction network graph according to the biased walking strategy;

[0092] Specifically, in step S102, according to the biased walking strategy, the embedding vector of each node in the second transaction network graph is calculated, including the following steps S1201 to S1024.

[0093] S1021, setting a preset walking length and bias parameters in the biased walking strategy, and calculating the probability of each neighboring node adjacent to the current node being selected;

[0094] S1022, based on the biased wandering strategy that integrates transaction amount, time, and natural gas price, calculate the transition probability of each neighboring node corresponding to the current node using the transition probability formula, and determine the neighboring node with the highest transition probability as the next wandering node in the wandering path;

[0095] Here, based on the biased wandering strategy that integrates transaction amount, time, and gas price, the transition probability formula is used to calculate the transition probability of each neighboring node corresponding to the current node, and the neighboring node with the largest transition probability is determined as the next wandering node in the wandering path, including:

[0096] (1) Based on the amount-based biased walk method, the first transition probability of each neighboring node corresponding to the current node is calculated;

[0097] (2) Based on the time-based biased walk method, the second transition probability of each neighboring node corresponding to the current node is calculated;

[0098] (3) Based on the biased walk method of natural gas prices, the third transition probability of each neighboring node corresponding to the current node is calculated;

[0099] (4) Based on the first transition probability, the second transition probability, the third transition probability of each neighbor node and the probability of each neighbor node being selected, the transition probability of each neighbor node is calculated using the transition probability formula;

[0100] (5) Screen the transition probabilities of each neighbor node and obtain the neighbor node corresponding to the maximum transition probability.

[0101] S1023, until the length of the current node's wandering is equal to the preset wandering length, the wandering path of the current node is saved to obtain the node wandering path;

[0102] S1024: Map the node's wandering path to obtain an embedding vector.

[0103] Exemplarily, a second transaction network graph is constructed according to step S101 for fraudulent behavior on Ethereum. The second transaction network graph is constructed by obtaining corresponding transaction data on the Etherscan.io website by combining a set of accounts with abnormal behavior marked by authoritative websites and an equal number of normal accounts.

[0104] In random walk-based network embedding algorithms, selecting appropriate neighbors during the walk is crucial. For example, the Node2Vec algorithm defines two parameters, p and q, to ​​interpolate between depth-first and breadth-first searches. This highly adaptable algorithm considers both local and global information. The results presented in the transaction network graph construction section show that each transaction edge is weighted by a specific amount and time. Traditional random walk algorithms fail to capture this information, resulting in a poorly-quality feature vector output. To more comprehensively understand the characteristics of accounts in the transaction network, this paper designs a biased walk strategy based on transaction amount and time, and introduces a bias parameter α to comprehensively consider the impact of both on the walk strategy.

[0105] During a biased walk, the starting node (current node) v0 starts from a node in the second transaction network graph, selects the next node (one of its neighboring nodes) based on the edge weights of the graph, and continues moving along the edges of the graph. After a set number of steps, the downstream paths are recorded, and these paths are used to construct node representations (i.e., embedding vectors).

[0106] The goal of biased walking is to capture the relationship between a node and its neighbors by simulating the local neighborhood of a node in the graph, representing the node as an embedding vector in the embedding space, and bringing nodes with similar neighborhood structures closer together in the embedding space. The specific process of the algorithm is as follows:

[0107] (1) Initialize parameters and set the relevant parameters of the biased walk strategy, including the walk length l and the bias parameter α.

[0108] (2) Start biased wandering. For a given second transaction network graph G = (V, E, W), wander according to the following rules: where V represents the node set of the second transaction network graph; E represents the edge set of the second transaction network graph; and W represents the edge weight set of the second transaction network graph.

[0109] (2.1) Starting node: Start from node v0.

[0110] (2.2) Node selection rule: For the current node v i , select the next node v from its neighbor nodes i+1 The probability formula for each neighbor node being selected is expressed as:

[0111]

[0112] Among them, π ux represents the non-normalized transition probability from the current node u to the neighbor node x; Z represents the normalization constant; x represents the neighbor node; u represents the current node; E represents the edge set; v iIndicates the node of the current step in the walking path; v i+1 Indicates the next node to be visited in the walking path.

[0113] (2.3) Stop condition: When the specified walk length l is reached, the random walk ends.

[0114] In the probability formula for selecting the next-hop neighbor, the bias parameter a is introduced in combination with the Ethereum fraud detection requirements. The present invention considers the following three biased walking methods.

[0115] Biased movement based on amount: In Ethereum, transactions between accounts often involve amounts, especially accounts involved in fraudulent activities, where transaction amounts are usually higher than normal transactions. Therefore, an increase in transaction amount means a stronger or closer relationship between the two related nodes. u It is represented as a set of nodes directly connected to the current node u, and a linear function is used to incorporate the quantity information into the sampling probability. Under the amount-based biased walk strategy, starting from the current node u, the current node u to the neighbor node x∈V u The transition probability, that is, the first transition probability is expressed as:

[0116]

[0117] Where A(u,x) represents the total transaction amount between the current node u and the neighbor node x; Represents the total transaction amount between the current node u and all neighboring nodes; PA ux represents the probability that node u selects neighbor node x as the next step based on the transaction amount; x′ represents any one of all neighbor nodes.

[0118] Time-based biased walk: Each edge has a unique transaction time. Assume that the later a transaction event occurs, the greater its impact on the node's current relationship. Let T:E→Z be a function that sorts event edges in ascending time order, defining the influence of time. Similarly, under time-based biased walk, starting from the current node u, the second transition probability from the current node u to the neighbor node x∈Vu is expressed as:

[0119]

[0120] Where T(u,x) represents the transaction time between the current node u and the neighbor node x; PT ux represents the probability that node u selects neighbor node x as the next step according to the transaction time weight; Represents the time weight between the current node u and all neighboring nodes.

[0121] Bias parameter α: In order to simultaneously consider the impact of time and amount on the fraud detection task, this paper introduces a bias parameter α (0≤α≤1) to balance the relationship between amount and time. The final transition probability formula becomes:

[0122] π ux =PA ux α ·PT ux 1-α ;

[0123] See also Figure 3 , a schematic diagram of the roaming strategy is given. When only the transaction amount is considered, the current node u prefers neighbor node v4 as the next hop node; when only the transaction time is considered, the current node u prefers neighbor node v1 as the next hop node. When the bias parameter α is initialized to 0.5, according to the next hop node selection probability formula, it can be observed that the current node u prefers neighbor node v1 as the next hop node.

[0124] Record the walking path. Each walk generates an initial node walking path W=v0,v1,...,v t , record the local neighborhood structure of the node in the initial node wandering path. According to the set number of wandering times r for each node, collect a large number of initial node wandering paths, which will be used to train the node embedding model. The node embedding function f: The initial node wandering path W=v0,v1,...,v t Mapped to the initial embedding vector.

[0125] The model was trained using a support vector machine (SVM). This model performs best in binary classification and is widely adopted. The resulting fraudulent account detection model is used to detect unknown accounts.

[0126] See also Figure 4 ,The specific process of fraud detection model training is as follows:

[0127] (1) Set partitioning: Based on the initial embedding vector, it is divided into training set and validation set by setting the parameter train_size.

[0128] (2) Model training: The training set is input into the SVM to train the fraud detection model.

[0129] (3) Model verification: The verification set is input into the fraud detection model, and the performance of the model in the actual fraud detection task is verified by comparing the verification set with the model output results.

[0130] In the actual account identification process, the initial node wandering path needs to be further limited.

[0131] Considering that fraud detection involves biased walking in a transaction network graph with an equal number of fraudulent accounts and normal accounts, the bias parameter α is reasonable in a high-density fraudulent account transaction network. However, in the vast Ethereum transaction network, the proportion of fraudulent accounts is far smaller than that of fraudulent transaction networks. Considering only time and amount information is not enough to distinguish the behavioral relationships between different types of accounts. In transaction information, in addition to transaction time and amount, the manually controlled fields also include the gas price (GasPrice) setting, which indicates the price the sender is willing to pay for each unit of fuel in the transaction. Therefore, this solution introduces the parameter β on the basis of the fraud detection task, and jointly controls the walking bias with the parameter α, comprehensively considering the influence of transaction amount, time and gas price to complete the account feature extraction process. Referring to the walking process in the fraud detection module, the bias selection process after introducing β is given below:

[0132] Biased walk based on gas prices: When processing transactions on the chain, validators often consider transaction data with higher bids first. Fraudulent accounts usually set GasPrices higher than the average level to ensure that transactions are quickly packaged and confirmed by validators, thereby completing fraudulent operations before the network detects abnormalities. On the other hand, they may also set a low GasPrice to make transactions stay in the network longer, reducing the risk of being quickly discovered by delaying confirmation. Under the biased walk strategy based on gas prices, starting from the current node u, the current node u to the neighboring node x∈V u The third transition probability is expressed as:

[0133]

[0134] Where G(u,x) represents the transaction gas price between the current node u and the neighbor node x; Represents the total transaction gas price between the current node u and all neighboring nodes; PA ux It represents the probability that the current node u selects the neighbor node x as the next step to walk based on the transaction gas price.

[0135] Search bias parameter β: In order to take into account the impact of natural gas consumption, time and amount, the parameter β (0≤α+β≤1) is introduced on the basis of α to balance the influence of the three. The transfer probability formula is expressed as:

[0136] π ux =PA ux α ·PT ux β PG ux 1-α-β ;

[0137] Among them, Aux represents the first transition probability between neighbor node x and current node u; β represents the deviation parameter; α is the bias parameter; P represents the selection probability of neighbor node x; T ux represents the second transition probability between neighbor node x and current node u; G ux Represents the third transition probability between neighbor node x and current node u.

[0138] According to π ux Record the walking path. Each walk generates a node walking path W=v0,v1,...,v t , record the local neighborhood structure of the node in the node wandering path. According to the set number of wandering times r for each node, a large number of node wandering paths are collected, which will be used to train the node embedding model. The node embedding function f: The node wandering path W=v0,v1,...,v t Mapped to embedding vector.

[0139] Through the above-mentioned biased walking strategy, combined with the training node embedding process in the fraud detection module, we can finally obtain the feature dataset of each account node.

[0140] S103, performing unsupervised clustering on the first transaction network graph according to the embedding vector to obtain a plurality of clusters;

[0141] Exemplarily, this process aggregates and categorizes account node features to form clusters of accounts with highly similar behavioral characteristics. Due to the large scale of Ethereum accounts and the diverse behaviors of different account types, it is difficult to predetermine the number of clusters. This paper introduces the OPTICS clustering algorithm, a density-based, unsupervised clustering method that automatically identifies cluster structures of varying sizes. Using an embedding vector as input, it ultimately generates multiple clusters.

[0142] S104: Calculate multi-dimensional suspiciousness indicators for each node in the third transaction network graph, aggregate the multi-dimensional suspiciousness indicators to obtain a comprehensive suspiciousness value, and use an iterative pruning strategy to gradually remove the nodes with the lowest suspicion in the third transaction network graph to generate a series of subgraphs. During the pruning process, dynamically calculate the total suspicion of each subgraph, and use the subgraph with the maximum total suspicion as the dense suspicious subgraph.

[0143] Specifically, in step S104, the multi-dimensional suspicion index of each node in the third transaction network diagram is calculated, and the comprehensive suspicion value is obtained by aggregating the multi-dimensional suspicion index, including the following steps S1041 to S1042.

[0144] S1041, calculating the topological suspicion index, time suspicion index, and currency suspicion index of each node in the third transaction network graph;

[0145] S1042: Multiply the topological suspicion index, the time suspicion index, and the currency suspicion index according to the natural joint probability method to obtain a comprehensive suspicion value.

[0146] For example, see Figure 6 In response to abnormal transaction events on Ethereum, the present invention designs a suspicious flow detection algorithm, the goal of which is to detect suspicious abnormal transaction groups and capture capital flows. Combined with the source account of the abnormal transaction event marked by the authoritative website, the corresponding transaction data is obtained on the Etherscan.io website. At this time, the transaction object with the source account is represented as a first-order account. In order to further construct the abnormal transaction network diagram, it is necessary to expand outward layer by layer based on the first-order account. The specific operation is to obtain the transaction data of the first-order account and use the transaction object as the second-order abnormal transaction event account, and so on, until the final transaction object is a service provider (such as an exchange, etc., an account that can provide fund conversion). See Figure 5 , gives an example of a transaction network consisting of abnormal trading gangs and normal accounts.

[0147] The third transaction network graph contains the groups involved in the abnormal trading incidents, as well as transaction data between these accounts and normal accounts. This is primarily intended to conceal the abnormal trading process and increase regulatory oversight. To this end, the present invention designs a suspicion metric that evaluates each account node in the third transaction network graph across multiple dimensions, assigning a degree of suspicion to indicate the account's risk level. This further filters low-risk accounts to form a densely packed suspicious subgraph. The present invention proposes three designed suspicion metrics and combines them to create an aggregated index.

[0148] Topological Suspicion: Abnormal accounts build large and dense fund transfer networks within the anomalous trading ring, but transactions with external accounts decrease dramatically. Therefore, when an account primarily trades with suspicious accounts and less with other accounts, the account becomes more suspicious. This can be represented by defining the topological suspicion of node i within a subgraph S within a suspicious subgraph. The topological suspicion index is calculated as:

[0149]

[0150] Among them, e ji represents the transaction frequency from node j to node i, α i (S) measures the density and participation rate of node i in subgraph S.

[0151] It can be understood that the subgraph S described here is a subgraph of the third transaction network graph.

[0152] Suspicious timing: Abnormal trading often involves frequent fund transfers within a short period of time, leading to short-term spikes in trading activity for these accounts. Furthermore, to evade detection by cryptocurrency service providers, these accounts are often used once, resulting in a sharp drop in activity after the transfer. Consequently, abnormal trading accounts often exhibit a "peak-and-end" pattern in their transaction time series.

[0153] First, we need to detect the awakening point (the starting point of activity) and peak point (the most active point) of the time series. The trading activity data of abnormal trading accounts are arranged in chronological order as input. Through the MultiBurst algorithm, the awakening point and peak point are expressed as (t o ,a o ) and (t p ,t p ). t represents the transaction timestamp, a represents the transaction amount. The time suspicion of node i β i (S) represents the degree to which the node participates in the transaction peak in the subgraph S, and the temporal suspiciousness β of node i among all nodes V in the subgraph S i (S) is expressed as:

[0154]

[0155] T i (S) represents the transaction timestamp set of node i with other nodes within subgraph S. φ[·] is the participation function of the node in a specific time period, which is used to quantify the activity of the node in the transaction peak.

[0156] The participation of node i in subgraph S φ[T i (S)] is defined as the peak intensity divided by the frequency of occurrence and is calculated as follows:

[0157]

[0158] Currency Suspicion: If the transfer amount of a transaction suddenly increases within a certain period of time, the transaction becomes more suspicious. The transaction's suspicion rating is considered to be related to the ratio of the total transaction amount within a specific period to the total transaction amount for the entire duration. The timestamp set of the third transaction network graph G is sliced ​​according to a certain time span. For each transaction, the total amount of all transactions within each slice is calculated.

[0159] A(τ) represents the sum of the amounts of all transactions within the timestamp set τ. τ(t) represents the time slice containing the transaction timestamp τ. The suspicious score R(i,j,a,t) of a transaction (i,j,a,t) is calculated as follows:

[0160]

[0161] Among them, e ji represents the transaction frequency from node j to node i; e ki The transaction frequency from node k to node i; T i (S) represents the transaction timestamp set between node i and other nodes in subgraph S; T i (V) represents the transaction timestamp set of node i and other nodes in the set V; φ[.] represents the participation function of the node in a specific time period; bal represents the intermediate parameter; KL[.] represents the divergence calculation function; R i (S) represents the transaction score of node i in subgraph S; V represents the set of all nodes in the third transaction network graph; S represents the subgraph.

[0162] △a op =a p -a o , k op Indicates that (t o ,a o ) and (t p ,t p )The slope of the straight line between two points, It is an indicator function; the interval [td,t+d] represents the set of transaction timestamps within a period of time before and after the transaction timestamp t.

[0163] Because abnormal trading accounts typically have more suspicious transactions than ordinary accounts, their score distributions are also different. To quantify the differences in transaction score distributions, the Kullback-Leibler divergence (KL) is used to calculate the difference between the transaction score distribution of node i in subgraph S and its complement (i.e., all nodes in V\S). The fund suspicion score γ of node i in subgraph S is calculated as follows:

[0164]

[0165] γ i (S)=bal*KL[R i (S),R i (V\S)];

[0166] Among them, R i (S) represents the set of transaction scores of node i in subgraph S. The complement V\S is used to measure the distribution difference instead of the entire V to avoid the trivial case where too many transaction scores come from subgraph S.

[0167] Suspiciousness indicator aggregation: After taking into account topological, temporal, and monetary suspiciousness indicators, these indicators are multiplied using the natural joint probability method:

[0168]

[0169] Among them, f i (S) represents the joint suspiciousness of node i to subgraph S, b is a hyperparameter, e ji represents the edge weight from node j to node i. This method can dynamically update the suspiciousness of nodes as the set S continues to evolve. In addition, the total suspiciousness of subgraph S is defined as follows:

[0170]

[0171] Among them, g(S) represents the overall suspicion score of subgraph S, taking the average value of node suspicion.

[0172] Combining the problem definition and the design rules for suspiciousness metrics, the goal of constructing a dense suspicious subgraph is to find a subgraph S that maximizes the objective function g(S). Inspired by Charikar's greedy stripping method, the suspicious flow detection algorithm optimizes by iteratively identifying and removing the least suspicious nodes and updating the suspicion of the associated nodes. Each iteration requires traversing all nodes to find the least suspicious node, which results in high computational overhead.

[0173] To solve this problem, we first construct a priority tree for the subgraph S, which contains the following rules:

[0174] The leaf nodes of the priority tree represent the nodes in the subgraph S.

[0175] An internal node of the tree records the minimum suspiciousness value among its child nodes.

[0176] The root node stores the global minimum value, which allows efficient finding of the node with the least suspicion.

[0177] By setting the priority tree, the time complexity of the function is optimized from O(|S|) to O(log|S|). For node i in subgraph S, its weight (and priority) is defined as:

[0178] ω i (S) = f i (S);

[0179] Adopt the greedy approximation algorithm based on the priority tree mentioned above: input the directed graph G, initialize all nodes V of the third transaction network graph G, and the iterative process is as follows:

[0180] Suspicion calculation: The suspicion score of each node is calculated based on the suspicion indicators.

[0181] Node removal: Based on the priority weight, select the node with the lowest suspicion and remove it.

[0182] Neighborhood update: Update the weights of its connected nodes so that the suspicion score is dynamically adjusted.

[0183] Suspicious subgraph comparison: record the remaining node set S(x) in the current subgraph to form a descending subgraph sequence: Until all nodes are removed.

[0184] Suspicious subgraph screening: Output the subgraph s with the highest final suspicious score g(S) as the dense suspicious subgraph S * .

[0185] S105, in the dense suspicious subgraph S * Perform maximum flow detection in the ,and obtain the abnormal transaction source account set;

[0186] Specifically, in step S105, a maximum flow detection is performed in the dense suspicious subgraph to obtain an abnormal transaction source account set, including:

[0187] Determine the flow constraints and source-sink constraints, perform maximum flow detection based on the flow constraints and source-sink constraints, and obtain the abnormal transaction source account set; the flow constraints are:

[0188] 0 <x ij <Capacity ij ;

[0189] The source and sink constraints are:

[0190] ∑ (s,j)∈E x sj -∑ (j,s)∈E x js =Supply s ;

[0191] ∑ (i,t)∈E x it -∑ (t,k)∈E x tk =Supply t ;

[0192] Among them, Capacity ij Indicates the upper limit of the transaction amount between user i and user j; Supply s Indicates the net outflow of the source account; Supply t represents the net outflow of the foreign exchange account; x ij represents the capital flow from user i to user j; x sj represents the capital flow from user s to user j; x it represents the capital flow from user i to user t; x tk Represents the flow of funds from user t to user k.

[0193] Exemplary, dense suspicious subgraph S *The goal is to identify the fund flow paths from the source account to these participating groups and capture the accounts involved in the process. The maximum flow detection algorithm is used to mine abnormal transaction paths. The maximum flow detection algorithm has demonstrated good fund flow detection capabilities in the Ethereum network. The goal of the maximum flow problem is to find the maximum fund flow between the source node and the sink node. The expression is as follows:

[0194] max∑ (i,j)∈E x ij ;

[0195] Among them, x ij represents the capital flow from node i to node j, and E represents the dense suspicious subgraph S * All the edges in .

[0196] Flow constraints and source-sink constraints have been given in the above description.

[0197] The maximum flow algorithm is used to track the flow of funds from the source account to various abnormal transaction accounts. The set of accounts that maximize the flow is defined as the abnormal transaction source account set.

[0198] S106 , judging the risk level of each account in each cluster based on the abnormal transaction source account set and the abnormal behavior account set.

[0199] Specifically, in step S106, the risk level calculation satisfies:

[0200] Risk(u)=λ1·Phish(u)+λ2·ML(u);

[0201] Where Phish(u) represents the risk level of the current account u as a fraud account; ML(u) represents the risk level of the current account u as an abnormal transaction account; λ1 represents the fraud weight coefficient; and λ2 represents the abnormal transaction weight coefficient.

[0202] For example, based on the risk level definition, a risk level can be given for each account. Accounts that are usually identified by both fraud and abnormal transaction detection have the highest level and are classified as high-risk accounts; accounts that are only identified by one module are classified as risky accounts; accounts that are not identified but are in the same cluster as (high) risk accounts are classified as medium-risk accounts; and the remaining data are classified as low-risk accounts.

[0203] The various embodiments in this specification are described in a progressive manner. References to the same or similar parts between the various embodiments are sufficient. Each embodiment focuses on the differences from other embodiments. All or part of the present invention can be used in a variety of general or specialized computer system environments or configurations. For example, personal computers, server computers, handheld or portable devices, tablet devices, mobile communication terminals, multiprocessor systems, microprocessor-based systems, programmable electronic devices, network PCs, minicomputers, mainframe computers, and distributed computing environments that include any of the above systems or devices.

[0204] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments may still be modified, or some or all of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the present invention.

Claims

1. A method for identifying abnormal transaction behavior in blockchain, characterized in that: include: Constructing a first transaction network graph related to an active account set, a second transaction network graph related to an account set with abnormal behavior, and a third transaction network graph related to an account set with abnormal transaction sources; Calculate the embedding vector of each node in the second transaction network graph according to the biased walking strategy; Performing unsupervised clustering on the first transaction network graph according to the embedding vector to obtain a plurality of clusters; Calculating multi-dimensional suspiciousness indicators for each node in the third transaction network graph, obtaining a comprehensive suspiciousness value by aggregating the multi-dimensional suspiciousness indicators, and gradually removing the least suspicious nodes in the third transaction network graph using an iterative pruning strategy to generate a series of subgraphs. During the pruning process, dynamically calculating the total suspiciousness of each subgraph, and selecting the subgraph corresponding to the maximum total suspiciousness as a dense suspicious subgraph; Performing maximum flow detection in the dense suspicious subgraph to obtain a set of abnormal transaction source accounts; The risk level of each account in each cluster is determined based on the abnormal transaction source account set and the abnormal behavior account set.

2. The method for identifying abnormal blockchain transaction behavior according to claim 1 is characterized in that: Before constructing the first transaction network graph related to the active account set, the second transaction network graph related to the account set with abnormal behavior, and the third transaction network graph related to the abnormal transaction source account set, the method further includes: Perform data preprocessing on transaction data related to active account sets, transaction data related to account sets with abnormal behavior, and transaction data related to account sets that are sources of abnormal transactions; Data preprocessing specifically includes: Deduplication is performed on the transaction data, and data is filtered according to abnormal conditions to obtain first preprocessed data; Normalizing the amount and formatting the time on the first preprocessed data to obtain second preprocessed data; Information extraction is performed on the second preprocessed data to generate preprocessed transaction data.

3. The method for identifying abnormal blockchain transaction behavior according to claim 1 is characterized in that: The step of calculating the embedding vector of each node in the second transaction network graph according to the biased walking strategy includes: Set the preset walk length and bias parameters in the biased walk strategy, and calculate the probability of each neighbor node adjacent to the current node being selected; Based on a biased wandering strategy that integrates transaction amount, time, and natural gas price, the transition probability of each neighboring node corresponding to the current node is calculated, and the neighboring node with the largest transition probability is determined as the next wandering node in the wandering path. This continues until the wandering length of the current node is equal to the preset wandering length. The wandering path of the current node is saved to obtain the node wandering path. The node wandering path is mapped to obtain an embedding vector.

4. The method for identifying abnormal blockchain transaction behavior according to claim 3 is characterized in that: The biased wandering strategy based on the integration of transaction amount, time, and natural gas price uses the transition probability formula to calculate the transition probability of each neighboring node corresponding to the current node, and determines the neighboring node with the largest transition probability as the next wandering node in the wandering path, including: Based on the amount-based biased walk method, the first transition probability of each neighboring node corresponding to the current node is calculated; Based on the time-based biased walk method, the second transition probability of each neighboring node corresponding to the current node is calculated; Based on the biased walk method of natural gas prices, the third transition probability of each neighboring node corresponding to the current node is calculated; Calculate the transition probability of each neighbor node according to the first transition probability, the second transition probability, the third transition probability of each neighbor node and the probability of each neighbor node being selected; The transition probability of each neighbor node is screened to obtain the neighbor node corresponding to the maximum transition probability.

5. The method for identifying abnormal blockchain transaction behavior according to claim 3 is characterized in that: The calculating, based on the first transition probability, the second transition probability, the third transition probability, and the probability of each neighbor node being selected, the transition probability of each neighbor node includes: Calculating the transition probability of each neighbor node using a transition probability formula based on the first transition probability, the second transition probability, the third transition probability, and the probability of each neighbor node being selected; The transition probability formula is expressed as: p ux =PA ux α ·PT ux β ·PG ux 1-α-β Among them, A ux represents the first transition probability between neighbor node x and current node u; β represents the deviation parameter; α is the bias parameter; P represents the selection probability of neighbor node x; T ux represents the second transition probability between neighbor node x and current node u; G ux Represents the third transition probability between neighbor node x and current node u.

6. The method for identifying abnormal blockchain transaction behavior according to claim 1 is characterized in that: The calculating of the multi-dimensional suspiciousness index of each node in the third transaction network graph and obtaining a comprehensive suspiciousness value by aggregating the multi-dimensional suspiciousness indexes include: Calculating a topological suspicion index, a time suspicion index, and a currency suspicion index for each node in the third transaction network graph; The topological suspicion index, the time suspicion index and the currency suspicion index are multiplied together according to the natural joint probability method to obtain a comprehensive suspicion value.

7. The method for identifying abnormal blockchain transaction behavior according to claim 6 is characterized in that: The calculation formula of the topology suspiciousness index is expressed as: The calculation formula of the time suspicion index is expressed as: The calculation formula of the currency suspiciousness index is expressed as follows: γ i (S)=bal*KL[R i (S),R i (V\S)]; Among them, e ji represents the transaction frequency from node j to node i; e ki The transaction frequency from node k to node i; T i (S) represents the transaction timestamp set between node i and other nodes in subgraph S; T i (V) represents the transaction timestamp set of node i and other nodes in the set V; φ[.] represents the participation function of the node in a specific time period; bal represents the intermediate parameter; KL[.] represents the divergence calculation function; R i (S) represents the transaction score of node i in subgraph S; V represents the set of all nodes in the third transaction network graph; S represents the subgraph; α i (S) represents the topological suspicion index, E represents the set of all edges in the third transaction network graph; β i (S) represents the time suspiciousness index, γ i (S) represents the currency suspicion index.

8. The method for identifying abnormal blockchain transaction behavior according to claim 1 is characterized in that: The maximum flow detection is performed in the dense suspicious subgraph to obtain an abnormal transaction source account set, including: Determine a flow constraint and a source-sink constraint, perform maximum flow detection based on the flow constraint and the source-sink constraint, and obtain a set of abnormal transaction source accounts; wherein the flow constraint is: 0<x ij <Capacity ij ; The source-sink constraints are: ∑ (s,j)∈E x sj -∑ (j,s)∈E x js =Supply s , ∑ (i,t)∈E x it -∑ (t,k)∈E x tk =Supply t ; Among them, Capacity ij Indicates the upper limit of the transaction amount between user i and user j; Supply s Indicates the net outflow of the source account; Supply t represents the net outflow of the foreign exchange account; x ij represents the capital flow from user i to user j; x sj represents the capital flow from user s to user j; x js represents the capital flow from user j to user s; x it represents the capital flow from user i to user t; x tk represents the capital flow from user t to user k; E represents the set of all edges in the third transaction network graph.

9. The method for identifying abnormal blockchain transaction behavior according to claim 1 is characterized in that: The risk level calculation satisfies: Risk(u)=λ1·Phish(u)+λ2·ML(u); Among them, Phish(u) represents the risk level of the current account u as a fraud account; ML(u) represents the risk level of the current account u as an abnormal transaction account; λ1 represents the fraud weight coefficient; λ2 represents the abnormal transaction weight coefficient, and Risk(u) represents the risk level of the current account u.

Images