AI-based interpretable risk early warning system for block chain cross-chain transaction

Abstract

The invention relates to the technical field of block chain cross-chain transactions, in particular to an AI-based interpretable risk early warning system for block chain cross-chain transactions, which comprises a dynamic feature extraction module, a risk factor identification module, a decision logic construction module and an early warning response generation module. According to the method, the dynamic characteristics of the transaction behaviors are analyzed, the historical data and the external environment are combined, the potential risk factor distribution diagram and the risk weight mapping table are generated, the risk early warning information is generated by using the neural network model, and the reliability evaluation is introduced to improve the prediction reliability. According to the invention, the risk node and weight distribution in the cross-chain transaction can be accurately identified, the risk time range is defined, the early warning accuracy and timeliness are improved, the user is helped to avoid economic loss, and the stability of the cross-chain transaction system and the user experience are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of blockchain cross-chain transaction technology, and in particular to an AI-based explainable risk warning system for blockchain cross-chain transactions. Background Art

[0002] The field of blockchain technology involves the core applications of distributed ledger technology and is a crucial component of modern information technology. This area encompasses multiple aspects, including consensus mechanism design, smart contract development, cross-chain interaction protocols, data privacy protection, and transaction performance optimization. In practical applications, blockchain systems are deployed through public, consortium, and private chains, and are applicable to a variety of scenarios, including financial transactions, supply chain management, and digital identity authentication. Key technological development areas in this field include improving transaction efficiency, enhancing security, and optimizing cross-chain interoperability to achieve efficient, reliable, and sustainable distributed collaboration. Specifically, the cross-chain transaction risk warning system is a system used to identify and alert users to potential risks in cross-chain transactions. The system aims to enhance the security and reliability of cross-chain transactions and reduce financial losses or trust crises caused by risk events. By modeling and analyzing real-time transaction data, historical behavior patterns, and network status parameters, the cross-chain transaction risk warning system provides users with proactive risk warnings, adapting to the complexity and variability of cross-chain transactions. This system assists users in developing risk mitigation strategies, optimizing transaction paths, minimizing financial losses, and improving the overall trading experience.

[0003] Existing technical solutions rely on static reputation scoring mechanisms or fixed algorithmic models, lacking dynamic adjustment and deep learning capabilities. This makes it difficult to implement adaptive risk assessments based on real-time transaction data in practical applications. For example, Publication No. CN119168646B describes a compliant public blockchain system for transaction verification. By integrating registration and authentication, smart contracts, and compliance verification modules, it ensures the security, compliance, and efficient execution of on-chain transactions. However, its risk warning mechanism lacks interpretability, failing to provide detailed decision-making basis and a transparent risk analysis process, making it difficult for users to fully understand the sources and influencing factors of risk. Furthermore, Publication No. CN114881624B describes a blockchain-based interbank multi-card payment method and device. This combines pre-set risk categories with a fixed algorithm to calculate potential risk factors. However, its risk warning model is relatively simplistic and lacks adaptability to complex transaction scenarios. Furthermore, its warning results lack transparency and interpretability, failing to clearly display the specific logic and parameter weightings of the risk assessment, making it difficult for users to understand and trust the system's decisions.

[0004] The above characteristics indicate that existing cross-chain blockchain transaction technologies still have room for improvement in terms of dynamic, intelligent, and explainable risk warnings. Therefore, this invention aims to achieve dynamic risk assessment, accurate warnings, and transparent decision-making analysis by introducing deep learning and explainable AI technologies, thereby enhancing the security and user experience of cross-chain transactions. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of the existing technology and propose an AI-based explainable risk warning system for blockchain cross-chain transactions.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: an AI-based explainable risk warning system for cross-chain transactions on blockchains, the system comprising:

[0007] The system comprises:

[0008] The dynamic feature extraction module obtains the behavioral pattern sequence in the real-time data stream of cross-chain transactions and generates the dynamic feature vector of transaction behavior by analyzing the source of transaction requests, asset flow path and network status parameters;

[0009] The risk factor identification module calls the dynamic feature vector of the transaction behavior, combines the historical transaction records on the chain with the external environment data set, and generates a potential risk factor distribution map based on the correlation analysis between the behavior pattern and abnormal events;

[0010] The decision logic construction module collects cross-chain protocol rules and smart contract execution constraints based on the potential risk factor distribution map, deduces the risk nodes of the transaction path layer by layer, and generates a risk weight mapping table;

[0011] The early warning response generation module calls the risk weight mapping table, extracts the key node indexes covering the transaction path at the cross-chain transaction level, marks the risk level difference items of the key nodes, embeds the difference items as risk input features into the early warning reasoning model, and generates risk warning information.

[0012] As a further solution of the present invention, the dynamic feature vector of transaction behavior includes the transaction request frequency fluctuation value, the asset flow path complexity, the network delay distribution index and the transaction source credibility score; the potential risk factor distribution map includes the risk area main axis direction distribution, the risk coverage range index, the abnormal event classification level and the node number mapping table; the risk weight mapping table specifically includes the inter-node transfer probability matrix, the correspondence between risk nodes and paths, the weight adjustment factor set and the spatial overlap density coefficient; the risk warning information includes the risk factor distribution sequence, the node-level risk trend symbol sequence, the prediction value set and the warning segment index structure.

[0013] As a further solution of the present invention, the dynamic feature extraction module includes:

[0014] The behavior pattern analysis submodule obtains the behavior pattern sequence in the real-time data stream of cross-chain transactions, extracts the timestamp, asset type, transaction amount and initiator address of each transaction request, establishes a behavior pattern set, constructs a transaction behavior feature sequence based on the time interval and amount distribution of the behavior pattern sequence, and generates a transaction behavior feature structure sequence;

[0015] The dynamic change calculation submodule calls the transaction behavior feature structure sequence, extracts the attribute values ​​of corresponding transaction nodes in the behavior pattern sequence in adjacent time periods, calculates the relative change vector, constructs a change sequence set based on the ratio between the attribute values, performs a mean operation on the change sequences in consecutive time periods, filters out segments with change amplitudes exceeding a set threshold, and generates a dynamic change gradient value set;

[0016] The source credibility assessment submodule calls the dynamically changing gradient value set, retrieves the reputation score of the initiator address in the historical transaction records on the chain, normalizes the dynamically changing gradient, performs weighted operation on the reputation score, performs segment screening according to the set weight distribution rules, obtains the transaction source credibility score value, and obtains the dynamic feature vector of the transaction behavior.

[0017] As a further solution of the present invention, the risk factor identification module includes:

[0018] The abnormal event extraction submodule calls the dynamic feature vector of transaction behavior, obtains the abnormal event log in the historical transaction record on the chain, identifies the occurrence time window and impact range of the abnormal event in the log, determines the distribution profile of the abnormal event based on the time window set, extracts the directional distribution of the distribution profile and performs vectorized fitting in chronological order to generate the main axis direction sequence of the abnormal event;

[0019] The correlation matching calculation submodule obtains the angular relationship between the vector segment and the behavior pattern direction segment marked in the transaction behavior dynamic feature vector based on the main axis direction sequence of the abnormal event. It sequentially compares the angles between the two sets of direction vectors in the time coordinate plane, selects vector pairs with angle deviation values ​​below a set threshold, calculates and obtains regional correlation index values, and selects blocks with deviation values ​​below the set threshold as matching areas to generate a correlation matching distribution value set.

[0020] The risk area construction submodule retrieves the cross-chain transaction path information within the time period according to the correlation matching distribution value set, establishes a transaction path projection layer in a unified time coordinate system, locates the projection boundary intersection block between the transaction path and the marked abnormal event area, extracts the boundary line index value of the overlapping block and generates a time geometry coverage group to establish a potential risk factor distribution map.

[0021] As a further solution of the present invention, the decision logic building module includes:

[0022] The protocol rule extraction submodule obtains the potential risk factor distribution map, collects cross-chain protocol rules and smart contract execution constraints, extracts the transaction path node numbers involved in the protocol rules and the weight values ​​corresponding to the constraints, sorts the priorities of the nodes in the protocol rules, and generates a node priority set based on the node weight values;

[0023] The risk node deduction submodule calls the node priority set, collects the inter-node transfer probability and inter-node dependency in the cross-chain transaction path, calculates the direction of the risk propagation path between nodes based on the transfer probability, maps the path direction to the time coordinate, determines whether there is overlap with the coverage of the potential risk factor distribution map, obtains the time period when the risk node and the path overlap, and generates the risk node overlap distribution data;

[0024] The weight mapping construction submodule extracts the node set corresponding to the overlapping segment based on the risk node overlap distribution data, identifies the numbered area to which the node belongs in the transaction path, cross-judges the area boundary with the risk node boundary, extracts the node number index corresponding to the intersection point, determines the risk node number and the corresponding time area, and establishes a risk weight mapping table.

[0025] As a further solution of the present invention, the early warning response generation module includes:

[0026] The node signal collection submodule calls the risk weight mapping table, extracts the corresponding node number index at the cross-chain transaction level, collects the unit node transaction success rate and abnormal event count value recorded by the node monitoring, constructs the operation status data group of each node at the current moment, and generates a node operation signal set;

[0027] The trend difference marking submodule obtains the success rate output values ​​of the risk node and the adjacent non-risk nodes at the same time point based on the node operation signal set, compares the difference in change direction, identifies signal items with inconsistent directions, records the difference items in the form of symbolic values, classifies and organizes them into a separate input factor sequence, and obtains a trend difference vector group;

[0028] The early warning information generation submodule calls the trend difference vector group, inputs the neural network input sequence structure completed by historical period sample training, inputs the vector group and the constructed input factor items in parallel, and performs combined deduction based on the transaction success rate, the frequency of abnormal event occurrence and the dependency data input factors between nodes to obtain the predicted value distribution results at the corresponding time point and generate risk early warning information.

[0029] As a further embodiment of the present invention, the system further comprises:

[0030] The trusted label assignment module calls the risk warning information, obtains the predicted value and the actual output value of the node at each prediction time point, compares the root mean square error between the predicted value and the actual output value, and compares it with the set confidence error threshold. The error segments above the threshold are divided into intervals according to the level division rule, each level division segment is marked as a trusted level identifier, and the trusted level information of the risk coverage area is generated and output;

[0031] The risk coverage area output trust level information specifically refers to the error interval level index, the trust label mapping result, the RMSE fluctuation trend group and the trust judgment result number table.

[0032] As a further solution of the present invention, the trusted label assignment module includes:

[0033] The error value calculation submodule calls the risk warning information, obtains the predicted output success rate sequence and the actual output success rate sequence of each node in the prediction time period, constructs a set of error differences between corresponding sequence indexes, and normalizes the error ratio in combination with the predicted success rate to obtain a normalized success rate error index.

[0034] The error segmentation submodule calls and sets the confidence error threshold according to the normalized success rate error index, groups and classifies the index sequence according to the upper limit of the threshold, establishes index labels for the time periods corresponding to the groups, and numbers the error levels corresponding to the groups in sequence to obtain error level mapping interval values;

[0035] The trusted level labeling submodule calls the error level mapping interval value, establishes the trusted level interval corresponding rules based on the time mapping table of level interval and node number, outputs the trusted label result set corresponding to the node in each time period, and establishes the risk coverage area to output the trusted level information.

[0036] Compared with the prior art, the advantages and positive effects of the present invention are:

[0037] In the present invention, by obtaining the behavioral pattern sequence of real-time data streams of cross-chain transactions and analyzing the source of transaction requests, asset flow paths and network status parameters, it is possible to accurately capture the dynamic change characteristics of transaction behaviors and significantly improve the timeliness of transaction risk identification. It combines the distribution direction of abnormal events in the historical transaction records on the chain and the external environment data set to perform correlation matching and time projection, accurately delineate the impact range of potential risk factors on cross-chain transactions in time, clarify the actual position and weight distribution of risk nodes in the transaction path, and realize the refined identification of risk areas. Based on the time mapping and cross-deduction of transaction paths and node layouts, it specifically locks the weight distribution of risk nodes and accurately identifies the risk of cross-chain transactions. By determining the risk node number and time zone, the risk fluctuation of a specific transaction path is clearly predicted, making the prediction results highly time-specific. By establishing a neural network early warning model with risk weight mapping, risk characteristics are directly incorporated into the early warning input, effectively capturing subtle changes in short-term risk fluctuations, and greatly improving the accuracy of early warning responses. Credibility assessment is introduced based on the risk warning results. Through root mean square error level annotation, the degree of prediction deviation is effectively distinguished, and the reliability of the actual application of early warning data is improved, enabling cross-chain transaction users to accurately avoid potential risks, reduce economic losses, reduce trust crises, and enhance the operational stability and user experience of the cross-chain transaction system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 is a system flow chart of the present invention;

[0039] Figure 2 This is a flow chart of obtaining the dynamic feature extraction module of the present invention;

[0040] Figure 3 This is a flow chart for obtaining the risk factor identification module of the present invention;

[0041] Figure 4 A flowchart for obtaining a decision logic building module of the present invention;

[0042] Figure 5 This is a flowchart for obtaining the early warning response generation module of the present invention;

[0043] Figure 6 This is a flowchart of obtaining the trusted tag assignment module of the present invention. DETAILED DESCRIPTION

[0044] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0045] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as an "exemplary" in the present invention should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of the word "exemplary" is intended to present concepts in a concrete manner. Furthermore, in the embodiments of the present invention, "and / or" can mean both or either of the two.

[0046] In the embodiments of the present invention, the terms "image" and "picture" may be used interchangeably. It should be noted that, when the distinction between them is not emphasized, their intended meanings are the same. The terms "of," "corresponding," and "corresponding" may be used interchangeably. It should be noted that, when the distinction between them is not emphasized, their intended meanings are the same.

[0047] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0048] In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0049] See also Figure 1 The present invention provides a technical solution: an AI-based explainable risk warning system for cross-chain transactions on blockchains, the system comprising:

[0050] The dynamic feature extraction module obtains the behavioral pattern sequence in the real-time data stream of cross-chain transactions and generates the dynamic feature vector of transaction behavior by analyzing the source of transaction requests, asset flow path and network status parameters;

[0051] The risk factor identification module calls on the dynamic feature vector of transaction behavior, combines historical transaction records on the chain with external environment data sets, and generates a potential risk factor distribution map based on the correlation analysis between behavior patterns and abnormal events;

[0052] The decision logic construction module collects cross-chain protocol rules and smart contract execution constraints based on the potential risk factor distribution map, deduces the risk nodes of the transaction path layer by layer, and generates a risk weight mapping table;

[0053] The early warning response generation module calls the risk weight mapping table, extracts the key node indexes covering the transaction path at the cross-chain transaction level, marks the risk level differences of the key nodes, and embeds the differences as risk input features into the early warning reasoning model to generate risk warning information;

[0054] The trusted label assignment module calls the risk warning information, obtains the predicted value and the actual output value of the node at each prediction time point, compares the root mean square error between the predicted value and the actual output value, and compares it with the set confidence error threshold. The error segments above the threshold are divided into intervals according to the level division rules, and each level division segment is marked as a trusted level identifier, generating risk coverage area output trusted level information.

[0055] The dynamic feature vector of transaction behavior includes the fluctuation value of transaction request frequency, the complexity of asset flow path, the network delay distribution index and the credibility score of transaction source. The potential risk factor distribution map includes the main axis direction distribution of risk area, risk coverage index, abnormal event classification level and node number mapping table. The risk weight mapping table specifically includes the inter-node transfer probability matrix, the correspondence between risk nodes and paths, the weight adjustment factor set and the spatial overlap density coefficient. The risk warning information includes the risk factor distribution sequence, the node-level risk trend symbol sequence, the prediction value set and the warning segment index structure. The risk coverage area output credibility level information specifically refers to the error interval level index, the credibility label mapping result, the RMSE fluctuation trend group and the credibility judgment result number table.

[0056] See also Figure 2 , the dynamic feature extraction module includes:

[0057] The behavior pattern analysis submodule obtains the behavior pattern sequence in the real-time data stream of cross-chain transactions, extracts the timestamp, asset type, transaction amount and initiator address of each transaction request, establishes a behavior pattern set, constructs a transaction behavior feature sequence based on the time interval and amount distribution of the behavior pattern sequence, and generates a transaction behavior feature structure sequence;

[0058] Obtaining behavioral pattern sequences in the real-time data stream of cross-chain transactions. During specific execution, the system monitors a cross-chain transaction request from the Ethereum network to the Binance Smart Chain. The real-time data stream parser extracts the metadata of the request and identifies the transaction request timestamp as 1749686400, the asset type as Ethereum token ETH, the transaction amount as 50.25 ETH, and the initiator address as 0x123abc…def456. Subsequently, a second transaction request from the same address 0x123abc…def456 was captured at timestamp 1749686475, with the asset type as ETH and the transaction amount as 150.75 ETH. The third transaction was captured at timestamp 1749686540, with the asset type as ETH and the transaction amount as 25.125 ETH. The system combines these discrete metadata points into a behavioral pattern set indexed by the initiator address, namely {“0x123abc…def456”:[{1749686400,ET H,50.25},{1749686475,ETH,150.75},{1749686540,ETH,25.125}]}, then calculate the time interval and amount of adjacent transactions in the behavior pattern sequence. The time interval between the first and second transactions is 75 seconds (1749686475-1749686400), and the time interval between the second and third transactions is 65 seconds (1749686540-1749686475). The corresponding transaction amount sequence [50.25, 150.75, 25.125] is recorded. These calculation results are integrated to construct a transaction behavior feature sequence that includes time dynamics and amount dynamics. It is formalized as {"0x123abc…def456":[(75, 50.25, 150.75), (65, 150.75, 25.125)]}. This sequence records the changes in the continuous transaction behavior of the address in detail and generates a transaction behavior feature structure sequence.

[0059] The dynamic change calculation submodule calls the transaction behavior feature structure sequence, extracts the attribute values ​​of the corresponding transaction nodes in the behavior pattern sequence in adjacent time periods, calculates the relative change vector, constructs a change sequence set based on the ratio between the attribute values, performs a mean operation on the change sequence of consecutive time periods, filters out the segments with change amplitudes exceeding the set threshold, and generates a dynamic change gradient value set;

[0060] Extract the attribute values ​​in adjacent time periods from the sequence [(75, 50.25, 150.75), (65, 150.75, 25.125)] of the address "0x123abc...def456". That is, the amount of the first group of transactions changes from 50.25 ETH to 150.75 ETH, and the amount of the second group of transactions changes from 150.75 ETH to 25.125 ETH. Based on the ratio between the attribute values, a relative change vector is constructed. The first change is calculated as 150.75 / 50.25 = 3.0, and the second change is calculated as 25.125 / 150.75 = 0.1667. From this, the change sequence set [3.0, 0.1667] is constructed. Then, the mean operation is performed on this change sequence: (3.0 + 0.1667) / 2 = 1.5 8335. The threshold here is determined based on the statistical analysis of the change ratio of the cross-chain transaction amount of the same type of asset (ETH) in the past 30 days. By collecting a total of 1,000,000 sample data, the mean μ is calculated to be 1.15, and the standard deviation σ is 0.45. The threshold interval of the normal change range is set to [μ-2σ,μ+2σ], that is, [1.15-2*0.45,1.15+2*0.45], resulting in an interval of [0.25,2.05]. The calculated change sequence [3.0,0.1667] is compared with the threshold interval for screening. Among them, 3.0 is higher than the upper limit of 2.05, and 0.1667 is lower than the lower limit of 0.25. Both values ​​are identified as segments exceeding the set threshold, generating the dynamic change gradient value set {3.0,0.1667}.

[0061] The source credibility assessment submodule calls the dynamically changing gradient value set, retrieves the initiator address reputation score from the historical transaction records on the chain, normalizes the dynamically changing gradient, performs a weighted operation on the reputation score, and performs segment screening based on the set weight distribution rules to obtain the transaction source credibility score value and obtain the dynamic feature vector of the transaction behavior;

[0062] The dynamically changing gradient value set {3.0, 0.1667} is called, and the reputation score of the initiator address 0x123abc…def456 in the historical transaction records on the chain is retrieved. The reputation score is a quantitative value calculated based on multiple dimensions such as the address's historical transaction success rate, whether it has participated in transactions with blacklisted addresses, and the complexity of contract interactions. Its value range is [0, 1], where 1 is the highest reputation. Assume that by querying the on-chain reputation system, the reputation score of the address 0x123abc…def456 is 0.75. Then, the dynamically changing gradient value set is normalized. The normalization here is based on the maximum gradient value V in the historical statistics. max =10.0 and minimum value V min = 0.1, the normalized calculation is (VV min) / (V max -V min ), substituting 3.0 into the calculation, we get (3.0-0.1) / (10.0-0.1)=0.2929, substituting 0.1667 into the calculation, we get (0.1667-0.1) / (10.0-0.1)=0.0067, and obtaining the normalized gradient value set {0.2929,0.0067}. Subsequently, the normalized dynamic change gradient and the reputation score are weighted. The weight distribution rule is based on a regression analysis experiment involving 500 known risk events. The experimental results show that the immediate dynamic change of transaction behavior (gradient value) contributes 60% to risk prediction, while the long-term address reputation score contributes 40%. Therefore, the gradient weight w is set. grad =0.6, reputation score weight w rep = 0.4, the one with the largest absolute deviation in the gradient value set (i.e. 0.2929, whose original value is 3.0 and deviates the most from the benchmark 1.0) is selected for calculation, and the calculation process is: 1-(w grad ×0.2929+w rep ×(1-0.75))=1-(0.6×0.2929+0.4×0.25)=1-(0.17574+0.1)=0.72426. This value is the transaction source credibility score. Finally, this score is combined with other core features of the transaction (such as the normalized value of the transaction amount and the encoding of the asset type) to obtain the transaction behavior dynamic feature vector [1749686475,0.15,0.72426].

[0063] See also Figure 3 , the risk factor identification module includes:

[0064] The abnormal event extraction submodule uses the dynamic feature vector of transaction behavior to obtain abnormal event logs from historical transaction records on the chain, identify the time window and impact range of abnormal events in the logs, determine the distribution profile of abnormal events based on the time window set, extract the directional distribution of the distribution profile, and perform vectorized fitting in chronological order to generate the main axis direction sequence of abnormal events;

[0065] The dynamic feature vector of transaction behavior [1749686475, 0.15, 0.72426] is called, and a detailed abnormal event log is obtained from the historical transaction records on the chain. The log records all events that have been confirmed as attacks or major failures in the past. For example, the log records a "reentrancy attack" that occurred in the time window [1748995200, 1748998800] and affected all transactions through the "BridgeContract_X" contract. The system identified multiple such time windows and The scope of influence is determined, and the distribution profile of abnormal events is determined on the time coordinate axis based on these time window sets. For example, multiple events with similar occurrence times and attack methods (such as continuous flash loan attacks) are aggregated into a continuous distribution profile. Then, the directional distribution of the profile on the two-dimensional plane of "transaction amount-time" is extracted. By performing principal component analysis on all transaction points in the profile, the direction of its first principal component is obtained, which is used as the vector representation of the abnormal event pattern. These vectors are arranged in chronological order to generate a sequence of the main axis directions of abnormal events, such as S anomaly =[v1,v2,v3], where v1 represents the direction vector of the first flash loan attack group (0.95,0.31), and v2 represents the direction vector of the reentry attack (0.80,0.60).

[0066] The correlation matching calculation submodule obtains the angular relationship between the vector segment and the behavior pattern direction segment marked in the transaction behavior dynamic feature vector based on the main axis direction sequence of the abnormal event. It then compares the angles between the two sets of direction vectors in the time coordinate plane, selects vector pairs with angle deviation values ​​below the set threshold, calculates and obtains the regional correlation index value, and selects the blocks with deviation values ​​below the set threshold as matching areas to generate a correlation matching distribution value set.

[0067] According to the abnormal event main axis direction sequence S anomaly =[(0.95,0.31),(0.80,0.60)], and extract the calibrated behavior pattern direction segment from the transaction behavior dynamic feature vector [1749686475,0.15,0.72426]. This direction segment is a vector formed by combining the "time interval-amount change" between the current transaction and the previous transaction, that is, (75,100.5). After normalization, we get the vector v current =(0.6,0.8), then, in the time coordinate plane, compare the current behavior vector v current The angle between each vector v1, v2 in the main axis direction sequence of the abnormal event is calculated by vector dot product to obtain cos(θ)=(v current ·v anomaly ) / (||v current ||·||v anomaly||), calculate v current The cosine of the angle with v1 is (0.6×0.95+0.8×0.31) / (1×1)=0.57+0.248=0.818, so calculate v current The cosine value of the angle with v2 is (0.6×0.80+0.8×0.60) / (1×1)=0.48+0.48=0.96, and the angle deviation threshold θ for screening is set. threshold The corresponding cosine value is 18 degrees, and cos(18°)≈0.951. This threshold is set by statistical analysis of the angle distribution between the historical normal trading behavior vector and the abnormal vector. The minimum angle value that can cover 95% of the known benign trading behaviors is selected. The calculated cosine value is compared with the threshold of 0.951. 0.818 is lower than 0.951 and is discarded. 0.96 is higher than 0.951 and is selected. This vector pair (v current ,v2) is the cosine value 0.96, and the block where the current transaction occurs (block height 19880808) is marked as the area that matches the historical "reentrancy attack" pattern, generating the correlation matching distribution value set {19880808:0.96}.

[0068] The risk area construction submodule matches the distribution value set based on the correlation degree, retrieves the cross-chain transaction path information within the time period, establishes a transaction path projection layer in the unified time coordinate system, locates the projected boundary intersection block between the transaction path and the marked abnormal event area, extracts the boundary line index value of the overlapping block and generates a time geometry cover group to establish a potential risk factor distribution map;

[0069] According to the correlation matching distribution value set {19880808:0.96}, the path information of all cross-chain transactions that occurred in the current time period (for example, block height 19880800 to 19880900) is retrieved. The path of this transaction is: "Lock Contract A" on Ethereum -> Relayer_B on the relay chain -> "Minting Contract C" on the Binance Smart Chain. In the unified time coordinate system, this transaction path A->B->C is established as a projection layer. At the same time, the marked abnormal event area identified in the correlation matching (that is, the area associated with the "reentrancy attack" pattern) is also projected into this coordinate system. Through coordinate comparison, the relay in the transaction path is located. The node "Relayer_B" of the chain happened to execute an operation at the time point of block height 19880808. Its execution time overlapped with the marked abnormal event area in terms of time geometry. The system extracted the boundary line index value of this overlapping block, that is, the start and end timestamps of block height 19880808 [1749686470,1749686480], and generated a time geometry coverage group with this information in the format of {(Relayer_B):[1749686470,1749686480]}. This coverage group clearly defines which node and which time period have a spatiotemporal intersection with the historical risk pattern, and establishes a potential risk factor distribution map.

[0070] Paragraph 7: Obtain the potential risk factor distribution diagram {(Relayer_B):[1749686470,1749686480]}. The system automatically collects and analyzes the cross-chain protocol rules involved and the execution constraints of the three smart contracts "Lock Contract A", "Relay Chain Relayer_B", and "Coin Contract C". The numbers of each node in the transaction path are extracted from the protocol rules. A is node 01, B is node 02, and C is node 03. It is found that the rules clearly stipulate that when the transaction amount is greater than 100 ETH, the Relay Chain Relayer_B will be locked. The processing weight of layer_B (node ​​02) is set to 1.5, while the default weight of other nodes is 1.0. This weight represents the importance of the node in the protocol security model. The transaction amount is 150.75 ETH, which triggers this rule. The system ranks the nodes in the protocol according to this rule. Node 02 has the highest priority, followed by nodes 01 and 03. Combined with the node weights of 1.5, 1.0, and 1.0, the node priority set {node 02: 1.5, node 01: 1.0, node 03: 1.0} is generated.

[0071] See also Figure 4 , the decision logic building blocks include:

[0072] The protocol rule extraction submodule obtains the potential risk factor distribution map, collects cross-chain protocol rules and smart contract execution constraints, extracts the transaction path node numbers involved in the protocol rules and the weight values ​​corresponding to the constraints, sorts the priorities of the nodes in the protocol rules, and generates a node priority set based on the node weight values;

[0073] Obtain the potential risk factor distribution diagram {(Relayer_B):[1749686470,1749686480]}, the system automatically collects and analyzes the cross-chain protocol rules involved and the execution constraints of the three smart contracts "Lock Contract A", "Relay Chain Relayer_B", and "Coin Contract C", and extracts the numbers of each node in the transaction path from the protocol rules. A is node 01, B is node 02, and C is node 03. It is found that the rules clearly stipulate that when the transaction amount is greater than 100ETH, the relay chain Relayer_B will be locked. The processing weight of yer_B (node ​​02) is set to 1.5, while the default weight of other nodes is 1.0. This weight represents the importance of the node in the protocol security model. The transaction amount is 150.75 ETH, which triggers this rule. The system ranks the nodes in the protocol according to this rule. Node 02 has the highest priority, followed by nodes 01 and 03. Combined with the node weights of 1.5, 1.0, and 1.0, the node priority set {node 02: 1.5, node 01: 1.0, node 03: 1.0} is generated.

[0074] The risk node deduction submodule calls the node priority set, collects the inter-node transfer probability and inter-node dependency in the cross-chain transaction path, calculates the direction of the risk propagation path between nodes based on the transfer probability, maps the path direction to the time coordinate, determines whether there is overlap with the coverage of the potential risk factor distribution map, obtains the time period when the risk node and the path overlap, and generates the risk node overlap distribution data;

[0075] The node priority set {node 02: 1.5, node 01: 1.0, node 03: 1.0} is called, and the inter-node transfer probability and inter-node dependency of the historical statistics in the cross-chain transaction path are collected. The data shows that the probability of successful transaction transfer from node 01 to node 02 is 0.995, and the probability of successful transfer from node 02 to node 03 is 0.989. Based on this transfer probability, the system calculates the path direction of risk propagation from upstream nodes to downstream nodes, that is, 01->02->03. Mapping this path direction to the time coordinate, the execution time of node 01 is [1749686460, 1749686465], the execution time of node 02 is [1749686470, 1749686480], and the execution time of node 03 is [1749686470, 1749686480]. The execution time period of node 02 is [1749686485, 1749686495]. Then, it is determined whether there is overlap between the execution time period of this path and the coverage of the potential risk factor distribution diagram {(Relayer_B): [1749686470, 1749686480]}. The comparison shows that the execution time period of node 02 [1749686470, 1749686480] completely overlaps with the time period of the risk distribution diagram. The time period in which the risk node and the path overlap is [1749686470, 1749686480]. The overlapping node is recorded as Relayer_B (node ​​02), and the risk node overlap distribution data {node 02: [1749686470, 1749686480]} is generated.

[0076] The weight mapping construction submodule extracts the node set corresponding to the overlapping segment based on the risk node overlap distribution data, identifies the numbered area to which the node belongs in the transaction path, cross-checks the area boundary with the risk node boundary, extracts the node number index corresponding to the intersection point, determines the risk node number and the corresponding time zone, and establishes a risk weight mapping table;

[0077] Based on the risk node overlap distribution data {node 02: [1749686470, 1749686480]}, the overlapping node set {node 02} is extracted, and the node's location in the complete transaction path A->B->C is identified as numbered region 02. The boundary of the risk node, i.e., the time region [1749686470, 1749686480], is cross-judged with the node region boundary defined in the transaction path to confirm that the risk is completely contained within the execution cycle of node 02. The node number index corresponding to the intersection point is extracted, and the risk node number is determined to be 02, and its corresponding time region is [1749686470, 1749686480]. Based on this information, combined with the priority, historical transition probability, and correlation with historical abnormal events (0.96) of each node obtained in the previous steps, the system quantifies the risk weight using a preset weighted sum model. The weight calculation example is: W = w priority ×P+w assoc ×A, where P is the node priority, A is the relevance, and weight w priority =0.4,w assoc =0.6 is based on the analysis of the contribution of different factors to the final risk event in historical data. Therefore, the risk weight of node 02 is 0.4×1.5+0.6×0.96=0.6+0.576=1.176, while the weights of the risk-free nodes 01 and 03 are 0. A risk weight mapping table is established.

[0078] Table 1 Risk weight mapping table

[0079] Node number Node Name Risk weight value 01 Lock Contract A 0.000 02 Relay Chain Relayer_B 1.176 03 Minting Contract C 0.000

[0080] As shown in Table 1, the table clearly identifies the quantitative risk level of each node on the transaction path.

[0081] See also Figure 5 , the early warning response generation module includes:

[0082] The node signal collection submodule calls the risk weight mapping table, extracts the corresponding node number index at the cross-chain transaction level, collects the unit node transaction success rate and abnormal event count value recorded by the node monitoring, constructs the operating status data group of each node at the current moment, and generates a node operation signal set;

[0083] The risk weight mapping table (as shown in Table 1) is called, and the node number index with a non-zero risk weight value, i.e., node 02, is extracted at the cross-chain transaction level. The real-time monitoring records of this node and its adjacent nodes (nodes 01 and 03) are actively collected. The record content includes the transaction success rate and abnormal event count value of the unit node. At the current time T, the transaction success rate of node 01 is 99.8%, and the abnormal event count value is 0. The transaction success rate of node 02 is 95.1%, and the abnormal event count value is 3 (for example, the gas fee estimation error). The transaction success rate of node 03 is 99.7%, and the abnormal event count value is 0. The system constructs these data into the operating status data group of each node at the current time. For example, the status data group of node 02 is {success_rate: 0.951, error_count: 3}. The data of all relevant nodes are combined to generate a node operation signal set.

[0084] The trend difference marking submodule obtains the success rate output values ​​of the risk node and the adjacent non-risk nodes at the same time point based on the node operation signal set, compares the difference in change direction, identifies signal items with inconsistent directions, records the difference items in the form of symbolic values, and classifies and organizes them into a separate input factor sequence to obtain a trend difference vector group;

[0085] Obtain the success rate output values ​​of node 02 marked as a risk node and nodes 01 and 03 considered as adjacent non-risk nodes at the same time point T, that is, {node 01: 0.998, node 02: 0.951, node 03: 0.997}. The system compares the change direction of the success rate of node 02 with that of node 01. By querying the data at the previous time point T-1, it is known that the success rate of node 01 changed from 99.9% to 99.8% (the change direction is negative), and the success rate of node 02 changed from 98.0% to 95.1% (the change direction is negative). The directions are consistent, so the difference is not marked. Then compare node 02 with node 01. The success rate of node 03 changes. It is known that the success rate of node 03 changes from 99.6% to 99.7% (the change direction is positive). At this time, the change direction of node 02 (negative) is inconsistent with the change direction of node 03 (positive). The system recognizes this signal as a signal item with inconsistent directions and records this difference item in the form of a symbol value. For example, a difference vector is created, in which the difference compared with node 01 is 0, and the difference compared with node 03 is -1 (indicating that the risk node trend is negative, while the adjacent node is positive). These records are classified and organized into a separate input factor sequence to obtain a trend difference vector group [0,-1].

[0086] The early warning information generation submodule calls the trend difference vector group and inputs the neural network input sequence structure completed by historical period sample training. The vector group is input in parallel with the constructed input factor items. Based on the transaction success rate, the frequency of abnormal events and the dependency data between nodes, the combined deduction is performed to obtain the predicted value distribution results at the corresponding time point and generate risk warning information.

[0087] The trend difference vector group [0, -1] is called and sent as one of the input features to a neural network input sequence structure that has been trained with historical cycle samples. The neural network is a long short-term memory network (LSTM), and its input sequence structure is designed to be [trend difference vector group, node operation signal set, trading behavior dynamic feature vector]. Specifically, the vector group [0, -1], the operation signal of node 02 {success_rate: 0.951, error_count: 3}, and the trading behavior dynamic feature vector [1749686475, 0.15, 0.72426] obtained from paragraph 3 are combined in parallel to form a complete input. The model is trained based on the correlation between transaction success rates, frequency of abnormal events, inter-node dependencies, and trend differences in historical data and the final transaction results (success / failure). After receiving the current input, the model performs combined deduction. Its internal neuron activation and weight matrix operations will output a predicted value for the transaction success rate of node 02 at a future time point (for example, T+1). The predicted value distribution output by the model shows that at time T+1, the predicted success rate of node 02 is 88.5%, generating a risk warning message: "Warning: The probability of transaction failure of node 02 (Relay Chain Relayer_B) in the next block cycle has increased significantly, and the predicted success rate has dropped to 88.5%."

[0088] See also Figure 6 ,The trusted label assignment module includes:

[0089] The error value calculation submodule calls the risk warning information, obtains the predicted output success rate sequence and the actual output success rate sequence of each node in the prediction time period, constructs the error difference set between the corresponding sequence indexes, and normalizes the error ratio based on the predicted success rate to obtain the normalized success rate error index.

[0090] The risk warning information "predicted success rate drops to 88.5%" is called, and after the T+1 time point actually occurs, the actual output success rate sequence of node 02 is obtained. Assuming that in the T+1 time period, node 02 processed a total of 100 transactions, of which 92 were successful and 8 failed, the actual output success rate is 92.0%. The system constructs a set of error differences between the predicted output success rate sequence [88.5%] and the actual output success rate sequence [92.0%]. The original error is calculated as |92.0%-88.5%|=3.5%, and the error ratio is normalized based on the predicted success rate to eliminate the impact of different success rate bases. The calculation process is: normalized success rate error index = |actual value-predicted value| / actual value = |0.920-0.885| / 0.920=0.035 / 0.920=0.038.

[0091] The error segmentation submodule calls and sets the confidence error threshold according to the normalized success rate error index, groups and classifies the index sequence according to the upper limit of the threshold, establishes the index label of the time period corresponding to the group, and numbers the error levels corresponding to the group in sequence to obtain the error level mapping interval value;

[0092] According to the normalized success rate error index of 0.038, the system's pre-set confidence error threshold is called. This threshold is determined based on the error distribution obtained by backtesting the model on a test set containing 1 million samples. The specific settings are: the error index in the interval [0, 0.05] is level one (high confidence), in the interval (0.05, 0.15] is level two (medium confidence), and in the interval (0.15, ∞) is level three (low confidence). The system compares the calculated index 0.038 with these threshold upper limits. 0.038 is less than or equal to 0.05, so it is classified into the first-level group. The system establishes a corresponding time period index label for this group, that is, T+1, and numbers the error level corresponding to this group as 1, obtaining the error level mapping interval value {T+1:1}.

[0093] The trust level annotation submodule calls the error level mapping interval value, establishes the trust level interval corresponding rules based on the time mapping table of level interval and node number, outputs the trust label result set corresponding to the node in each time period, establishes the risk coverage area and outputs the trust level information;

[0094] The error level mapping interval value {T+1:1} is called, and based on the time mapping table of level intervals and node numbers, which records which node was predicted in which time period, that is, (T+1, node 02), the corresponding rules of the trust level intervals are established. The rules are: map error level 1 to the "high trust" label, level 2 to the "medium trust" label, and level 3 to the "low trust" label. According to this rule, the system outputs the trust label corresponding to the warning information received by node 02 in the T+1 time period as "high trust". Finally, this trust label is integrated with risk warning information, risk source and other data to establish the risk coverage area output trust level information: "In the T+1 time period, the risk warning for node 02 (prediction success rate 88.5%) has a credibility rating of 'high trust'".

[0095] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. An AI-based explainable risk warning system for cross-chain transactions, characterized by: The system comprises: The dynamic feature extraction module obtains the behavioral pattern sequence in the real-time data stream of cross-chain transactions and generates the dynamic feature vector of transaction behavior by analyzing the source of transaction requests, asset flow path and network status parameters; The risk factor identification module calls the dynamic feature vector of the transaction behavior, combines the historical transaction records on the chain with the external environment data set, and generates a potential risk factor distribution map based on the correlation analysis between the behavior pattern and abnormal events; The decision logic construction module collects cross-chain protocol rules and smart contract execution constraints based on the potential risk factor distribution map, deduces the risk nodes of the transaction path layer by layer, and generates a risk weight mapping table; The early warning response generation module calls the risk weight mapping table, extracts the key node indexes covering the transaction path at the cross-chain transaction level, marks the risk level difference items of the key nodes, embeds the difference items as risk input features into the early warning reasoning model, and generates risk warning information.

2. The AI-based explainable risk warning system for cross-chain transactions in blockchain according to claim 1 is characterized by: The dynamic feature vector of transaction behavior includes the transaction request frequency fluctuation value, the asset flow path complexity, the network delay distribution index and the transaction source credibility score. The potential risk factor distribution map includes the risk area main axis direction distribution, the risk coverage range index, the abnormal event classification level and the node number mapping table. The risk weight mapping table specifically includes the node-to-node transfer probability matrix, the correspondence between risk nodes and paths, the weight adjustment factor set and the spatial overlap density coefficient. The risk warning information includes the risk factor distribution sequence, the node-level risk trend symbol sequence, the prediction value set and the warning section index structure.

3. The AI-based explainable risk warning system for cross-chain transactions in blockchain according to claim 1 is characterized in that: The dynamic feature extraction module includes: The behavior pattern analysis submodule obtains the behavior pattern sequence in the real-time data stream of cross-chain transactions, extracts the timestamp, asset type, transaction amount and initiator address of each transaction request, establishes a behavior pattern set, constructs a transaction behavior feature sequence based on the time interval and amount distribution of the behavior pattern sequence, and generates a transaction behavior feature structure sequence; The dynamic change calculation submodule calls the transaction behavior feature structure sequence, extracts the attribute values ​​of corresponding transaction nodes in the behavior pattern sequence in adjacent time periods, calculates the relative change vector, constructs a change sequence set based on the ratio between the attribute values, performs a mean operation on the change sequences in consecutive time periods, filters out segments with change amplitudes exceeding a set threshold, and generates a dynamic change gradient value set; The source credibility assessment submodule calls the dynamically changing gradient value set, retrieves the reputation score of the initiator address in the historical transaction records on the chain, normalizes the dynamically changing gradient, performs weighted operation on the reputation score, performs segment screening according to the set weight distribution rules, obtains the transaction source credibility score value, and obtains the dynamic feature vector of the transaction behavior.

4. The AI-based explainable risk warning system for cross-chain transactions in blockchain according to claim 1 is characterized in that: The risk factor identification module includes: The abnormal event extraction submodule calls the dynamic feature vector of transaction behavior, obtains the abnormal event log in the historical transaction record on the chain, identifies the occurrence time window and impact range of the abnormal event in the log, determines the distribution profile of the abnormal event based on the time window set, extracts the directional distribution of the distribution profile and performs vectorized fitting in chronological order to generate the main axis direction sequence of the abnormal event; The correlation matching calculation submodule obtains the angular relationship between the vector segment and the behavior pattern direction segment marked in the transaction behavior dynamic feature vector based on the main axis direction sequence of the abnormal event. It sequentially compares the angles between the two sets of direction vectors in the time coordinate plane, selects vector pairs with angle deviation values ​​below a set threshold, calculates and obtains regional correlation index values, and selects blocks with deviation values ​​below the set threshold as matching areas to generate a correlation matching distribution value set. The risk area construction submodule retrieves the cross-chain transaction path information within the time period according to the correlation matching distribution value set, establishes a transaction path projection layer in a unified time coordinate system, locates the projection boundary intersection block between the transaction path and the marked abnormal event area, extracts the boundary line index value of the overlapping block and generates a time geometry coverage group to establish a potential risk factor distribution map.

5. The AI-based explainable risk warning system for cross-chain transactions in blockchain according to claim 1 is characterized in that: The decision logic building block includes: The protocol rule extraction submodule obtains the potential risk factor distribution map, collects cross-chain protocol rules and smart contract execution constraints, extracts the transaction path node numbers involved in the protocol rules and the weight values ​​corresponding to the constraints, sorts the priorities of the nodes in the protocol rules, and generates a node priority set based on the node weight values; The risk node deduction submodule calls the node priority set, collects the inter-node transfer probability and inter-node dependency in the cross-chain transaction path, calculates the direction of the risk propagation path between nodes based on the transfer probability, maps the path direction to the time coordinate, determines whether there is overlap with the coverage of the potential risk factor distribution map, obtains the time period when the risk node and the path overlap, and generates the risk node overlap distribution data; The weight mapping construction submodule extracts the node set corresponding to the overlapping segment based on the risk node overlap distribution data, identifies the numbered area to which the node belongs in the transaction path, cross-judges the area boundary with the risk node boundary, extracts the node number index corresponding to the intersection point, determines the risk node number and the corresponding time area, and establishes a risk weight mapping table.

6. The AI-based explainable risk warning system for cross-chain transactions in blockchain according to claim 1 is characterized in that: The early warning response generation module includes: The node signal collection submodule calls the risk weight mapping table, extracts the corresponding node number index at the cross-chain transaction level, collects the unit node transaction success rate and abnormal event count value recorded by the node monitoring, constructs the operation status data group of each node at the current moment, and generates a node operation signal set; The trend difference marking submodule obtains the success rate output values ​​of the risk node and the adjacent non-risk nodes at the same time point based on the node operation signal set, compares the difference in change direction, identifies signal items with inconsistent directions, records the difference items in the form of symbolic values, classifies and organizes them into a separate input factor sequence, and obtains a trend difference vector group; The early warning information generation submodule calls the trend difference vector group, inputs the neural network input sequence structure completed by historical period sample training, inputs the vector group and the constructed input factor items in parallel, and performs combined deduction based on the transaction success rate, the frequency of abnormal event occurrence and the dependency data input factors between nodes to obtain the predicted value distribution results at the corresponding time point and generate risk early warning information.

7. The AI-based explainable risk warning system for cross-chain transactions in blockchain according to claim 1 is characterized in that: The system further comprises: The trusted label assignment module calls the risk warning information, obtains the predicted value and the actual output value of the node at each prediction time point, compares the root mean square error between the predicted value and the actual output value, and compares it with the set confidence error threshold. The error segments above the threshold are divided into intervals according to the level division rule, each level division segment is marked as a trusted level identifier, and the trusted level information of the risk coverage area is generated and output; The risk coverage area output trust level information specifically refers to the error interval level index, the trust label mapping result, the RMSE fluctuation trend group and the trust judgment result number table.

8. The AI-based explainable risk warning system for cross-chain transactions in blockchain according to claim 7 is characterized in that: The trusted label assignment module includes: The error value calculation submodule calls the risk warning information, obtains the predicted output success rate sequence and the actual output success rate sequence of each node in the prediction time period, constructs a set of error differences between corresponding sequence indexes, and normalizes the error ratio in combination with the predicted success rate to obtain a normalized success rate error index. The error segmentation submodule calls and sets the confidence error threshold according to the normalized success rate error index, groups and classifies the index sequence according to the upper limit of the threshold, establishes index labels for the time periods corresponding to the groups, and numbers the error levels corresponding to the groups in sequence to obtain error level mapping interval values; The trusted level labeling submodule calls the error level mapping interval value, establishes the trusted level interval corresponding rules based on the time mapping table of level interval and node number, outputs the trusted label result set corresponding to the node in each time period, and establishes the risk coverage area to output the trusted level information.

Images