Block chain risk address identification method of dual-structure time perception graph neural network

Abstract

The invention discloses a block chain risk address identification method for a dual-structure time perception graph neural network, and the method comprises the steps: carrying out the analysis and cleaning of original data, generating a transaction pair and an account pair based on an effective transaction record, and finally carrying out the standardization processing of a timestamp. Carrying out model training on the marked training data and dividing a data set; and then a double-structure graph model of an account graph and a transaction graph is constructed, heterogeneous characteristics of accounts and transactions in the block chain are distinguished for the first time, an interaction relationship and behavior evolution are modeled respectively, and the comprehensiveness and accuracy of risk identification are improved. Relative and absolute time coding is introduced, short-term behavior modes and long-term trends are captured in a differentiated mode, and the perception ability of dynamic risks is enhanced. Compared with a traditional single graph model, the scheme has the advantages that multi-dimensional information is effectively fused, the model generalization performance is remarkably improved, overfitting is reduced, and the method is suitable for cross-scene and cross-cycle risk detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of graph neural networks and risk identification, and particularly relates to a blockchain risk address identification method based on a double-structure time-aware graph neural network. BACKGROUND

[0002] The rapid development of blockchain technology has led to the widespread application of digital assets in various fields such as finance, gaming, and art. The decentralized, transparent, and tamper-proof nature of blockchain technology provides unprecedented security for asset circulation and transactions. However, these characteristics also inevitably facilitate malicious behavior. Due to its anonymity and tamper-proof nature, a large number of risk addresses are hidden in complex transaction network structures and time evolution relationships. How to accurately identify these risk addresses has become a key problem that needs to be solved in the field of blockchain security.

[0003] To address this challenge, researchers have explored various methods for identifying risk addresses on the blockchain from different perspectives. For example, relying on rule-based design, it is difficult to cope with the changing behavior patterns of attackers and the complex transaction network structure. In addition, rule-based methods often lack the ability to analyze time series features and network overall structure, thus leading to false negatives and false positives.

[0004] With the gradual introduction of machine learning techniques into the field of blockchain security, researchers have begun to use classic machine learning algorithms such as support vector machines and random forests to classify risk addresses. However, these methods usually rely on manually designed features, which can extract hidden patterns to some extent, but due to the high dimensionality and time series nature of blockchain data, manual feature design often fails to fully capture the complex interaction relationships and time evolution information between accounts. In addition, feature engineering requires a lot of domain knowledge support, limiting the generalization ability and automation level of the method. With the development of deep learning, researchers have begun to try using advanced graph learning methods such as graph neural networks to solve the problem of identifying risk addresses on the blockchain. However, this type of method usually only considers a single graph structure (such as a single account graph), ignoring the complex interaction relationships in multiple perspectives and dimensions in the blockchain. In addition, most studies only focus on modeling static graph data, and do not fully exploit the dynamic characteristics of transactions and accounts over time in the blockchain, resulting in ineffective use of time series information.

[0005] Therefore, traditional rule-based methods rely on pre-set rules and lack systematic analysis, resulting in insufficient accuracy and robustness of identification; traditional machine learning methods rely on manually designed features, which are inefficient and have limited generalization ability; existing graph neural network methods only model a single perspective of graph structure, utilize time series information in a single way, and have low modeling ability for high-order network relationships, making it difficult to effectively identify potential risks. SUMMARY

[0006] To solve the above problems, the application provides a blockchain risk address identification method of a double-structure time-aware graph neural network, which realizes more accurate and efficient blockchain risk address identification by constructing a double-structure graph model of an account graph and a transaction graph and introducing a differentiated attention mechanism of relative time and absolute time.

[0007] The application is implemented by the following technical scheme: a blockchain risk address identification method of a double-structure time-aware graph neural network, comprising the following steps: S1, inputting original transaction records on a blockchain chain, and then performing original data analysis and cleaning; S2, inputting a preprocessed node set, an edge set and attributes thereof, and constructing an account graph and a transaction graph to capture behavior patterns in different dimensions; S3, inputting relative time stamps in the edge attributes of the account graph and absolute time stamps in the edge attributes of the transaction graph, and encoding the two types of time information to generate vector representations that can be processed by a graph neural network; S4, constructing a two-layer graph attention network GAT, each layer of which contains 8 attention heads for capturing interaction patterns between accounts; and calculating the attention weight of a neighbor node to a target node by taking the relative time encoding as a dominant factor; S5, constructing a two-layer GAT with the same structure, each layer of which contains 8 attention heads, and the attention mechanism of which takes the absolute time encoding as a dominant factor; S6, after independent modeling of the account graph and the transaction graph, a feature aggregation method based on a subordinate relationship is used for fusion; S7, directly inputting the fused 256-dimensional feature matrix into a LightGBM classifier, and flattening it into independent feature columns, thereby constructing a double-structure time-aware graph neural network identification model; S8, training the constructed double-structure time-aware graph neural network identification model using an Adam optimizer and setting an early stopping mechanism; automatically adjusting during training through back propagation; and finally predicting the test set through the trained model to output the risk probability or category label of the address.

[0008] Specifically, the step S1 comprises the following sub-steps: S11, inputting original transaction records on a blockchain chain, including JSON / CSV format, containing fields: address, transaction timestamp, transaction amount, sender, receiver, transaction hash; analyzing original data in different formats, extracting key fields, including sender address, receiver address, transaction timestamp, transaction amount; then filtering invalid data, i.e., removing empty addresses such as 0x0 or zero addresses, removing duplicate transactions through transaction hash, and filtering abnormal transactions with an amount of 0 or negative; S12, constructing transaction pairs and account pairs based on valid transaction records, and simultaneously counting the cumulative transaction amount of account pairs; S13, convert the transaction timestamp to UTC time zone and format it as YYYY-MM-DD HH:MM:SS, calculate the relative time difference of subsequent transactions based on the earliest transaction time as the baseline, i.e. t=0, and finally output the normalized node set, edge set and attributes to provide basic data for subsequent graph structure construction; S14, input the labeled training data, including risk address labels; first, model training, specifically including dividing the data set into training set, validation set and test set according to 8:1:1.

[0009] Specifically, the step S2 includes the following sub-steps: S21, first define the node type of the account graph as a blockchain address, and attach the following attributes to each node: address type, historical transaction times, and total transaction amount; then define the edge type as "transaction relationship", which represents the fund flow between the sender and the receiver addresses, and the edge weight is selected according to the frequency weight or the amount weight; the edge attribute records the relative timestamp and transaction frequency, which is used for subsequent modeling of the periodicity of interaction; finally, output the account graph, whose nodes are addresses and edges are account pairs, and the edge attribute contains relative time information; S22, define the node type of the transaction graph as a single transaction event Tx, each node contains transaction amount, transaction timestamp and transaction status; then define the edge type as "association relationship", connect two transactions through the same address: if the sender of transaction Tx1 is equal to the receiver of transaction Tx2, then establish the edge Tx1→Tx2; if the receiver of transaction Tx1 is equal to the sender of transaction Tx2, then establish the edge Tx1←Tx2, reflecting the chain-like transfer or reflux of funds; the edge attribute contains absolute timestamp and amount similarity; finally output the transaction graph, whose nodes are transaction events, edges are transaction associations, and edge attributes contain absolute time information, forming a complementary perspective with the account graph.

[0010] Specifically, the step S3 includes the following sub-steps: S31, for the absolute timestamp in the edge attribute of the transaction graph, generate time encoding using the method of sine-cosine position encoding and learnable embedding; S32, for the transaction interval in the edge attribute of the account graph, generate time encoding using the method of linear scaling and periodic encoding.

[0011] Further, the step S31 specifically includes: S311, sine-cosine position encoding: combine the timestamp through different frequency sine and cosine functions to generate a 64-dimensional continuous vector; specifically, use 64 dimensions, i.e. 32 sets of sine-cosine pairs, each pair corresponds to a different frequency, and the frequencies are arranged from low to high to capture the periodicity and continuity features of the timestamp; S312, learnable embedding: segment the timestamp by hour, generate integer label, and then map the label to a 64-dimensional vector through a trainable embedding layer; the embedding layer parameters are automatically optimized through model training to adapt to the sensitivity of the task to time features; finally, output the absolute time encoding vector of the transaction graph as the feature input of the transaction graph edge.

[0012] Further, the step S32 is specifically: S321, linear scaling: calculate the time difference of the last transaction between accounts, divide the time difference by the maximum time interval in the data set, and normalize the result to the interval of 0 to 1 to eliminate the dimensional difference and retain the relative size relationship; S322, periodic encoding: for the transaction behavior that may exist daily, first calculate the value after the time difference is taken modulo 24 hours, and then convert the modulo value into a 64-dimensional vector through sine and cosine functions, that is, 32 groups of sine-cosine pairs, to capture the periodicity; Finally, output the 64-dimensional relative time encoding vector of the account graph as the feature input of the account graph edge; through the above operation, the time encoding module converts the original time information into a high-dimensional vector and injects it into the edge attribute of the transaction graph and the account graph, respectively, to provide time sequence feature support for subsequent graph neural networks.

[0013] Specifically, the step S4 includes the following sub-steps: S41, input vector and attention mechanism design Feature splicing: splice the target node features, neighbor node features, and relative time encoding of the two into a joint feature vector; Attention score calculation: perform linear transformation on the learned parameters and the spliced features, and calculate the attention score after applying the LeakyReLU activation function; the weight proportion of the relative time encoding is positively proportional to the attention weight size obtained by the account pair with a closer time interval; S42, output the feature vector of each account After each attention head independently calculates the score, the weight coefficients are obtained through Softmax normalization, the neighbor features are weighted and aggregated, and finally the 128-dimensional node embedding is generated by splicing the outputs of all heads, wherein each address corresponds to a vector; Add layer normalization and ReLU activation function after each layer of GAT, and relieve gradient disappearance through residual connection; the residual connection is to add the input features and the output features; Further, the step S5 is specifically: (5.1) Input vector and attention mechanism design Splice the target transaction features, neighbor transaction features, and absolute time encoding into a joint feature vector; The attention score calculation, i.e. the attention score is calculated after the interaction of another set of learnable parameters with the spliced features and the application of LeakyReLU; the proportion of the weight of the absolute time coding is proportional to the attention weight size obtained by the transactions closer in time; (5.2) output the feature vector of each transaction The weight coefficients are normalized by Softmax, the neighbor transaction features are weighted and aggregated, and finally a 128-dimensional node embedding is generated, each transaction event corresponding to a vector; after each GAT, layer normalization, ReLU activation and residual connection are also performed to ensure the stability of training.

[0014] Specifically, the step S6 includes the following sub-steps: First, all transaction embedding vectors associated with the same account and their corresponding time weights need to be obtained; that is, the embedding vector of each transaction under the account is multiplied by the weight designed according to the time, and then all the product results are added, and finally divided by the weight sum to normalize, avoiding the influence of feature scale caused by weight difference; then the scattered transaction features are fused into an account-dimension unified vector, which retains the time distribution and statistical characteristics of the transaction behavior, and the dimension is consistent with the single transaction embedding, which is convenient for splicing and fusion with the account features output by the account graph, and finally the transaction information is spliced with the account to which it belongs.

[0015] Further, the LightGBM classifier in the step S6 is specifically: the LightGBM classifier is configured for binary classification, the feature importance analysis double graph contribution, and the optimization Log Loss; the output risk probability (0-1) is output, and the threshold value 0.5 is determined after Sigmoid mapping.

[0016] The beneficial effects of the present application are as follows: The double structure proposed in the present application significantly improves the ability to capture multi-dimensional information, making the identification of risk addresses more comprehensive and accurate. In terms of time feature modeling, the dynamic time information is effectively utilized, significantly improving the ability to identify short-term and long-term risk patterns. The double structure design and time dynamic modeling strategy of the present application enable the model to maintain stable performance when facing new data (such as new risk patterns), greatly enhancing the generalization ability. The present application accurately depicts the behavior patterns of risk addresses. It can also provide technical support for regulatory agencies, and the model can quickly identify risk addresses to maintain the financial order. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 The figure is a schematic diagram of the double-structure time-aware graph neural network method of the present application; Figure 2 The figure is a structural diagram of the fusion module of the present application. DETAILED DESCRIPTION

[0018] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The description of the exemplary embodiments is intended to apply to all alternative embodiments, as would be understood by one skilled in the art. In other words, descriptions of some embodiments in the specification do not necessarily refer only to that particular embodiment, but rather to the other embodiments as well. For example, processes, materials, or machines that are described in the specification in the context of one exemplary embodiment can be understood as being applicable to any of the other exemplary embodiments as well. If the processor-based device is not mentioned below as a part of some embodiments, it does not mean that the processor-based device is not applicable to these embodiments. The processor-based device can be used in all embodiments to perform the functions described in the specification.

[0019] A blockchain risk address identification method of a double-structure time-aware graph neural network provided by the present application will be described in detail below in conjunction with the drawings. The features in the following embodiments and implementation manners can be combined with each other without conflict.

[0020] The present application aims to solve the problems existing in the prior art, such as limited modeling capability of single graph structure, single time information utilization mode, weak model generalization ability, etc. By constructing a double-structure graph model of account graph and transaction graph, and introducing a differentiated attention mechanism of relative time and absolute time, more accurate and efficient blockchain risk address identification is realized. Figure 1 The method is realized by the following steps: Step 1: Raw data preprocessing The input is the raw transaction record on the blockchain (JSON / CSV format, containing fields: address, transaction timestamp, transaction amount, sender, receiver, transaction hash), which is first parsed and cleaned: (1.1) Parse the raw data in different formats, extract the key fields (sender address, receiver address, transaction timestamp (ISO 8601 format), transaction amount (expressed in basic units such as Wei or Satoshi)), and then filter out invalid data (remove empty addresses such as 0x0 or zero addresses, remove duplicate transactions by transaction hash, filter out abnormal transactions with amount of 0 or negative); (1.2) Then generate transaction pairs and account pairs: based on valid transaction records, construct transaction pairs (record the sender→receiver relationship of each transaction and count the frequency such as "account A→account B has 5 transactions") and account pairs (record all address pairs with transaction relationship for subsequent graph structure construction), and count the cumulative transaction amount of account pairs (such as "account A→account B total amount = 10 ETH"); (1.3) Finally, timestamp standardization: convert transaction timestamps to UTC time zone and format as YYYY-MM-DD HH:MM:SS, calculate the relative time difference (unit: seconds / hours) of subsequent transactions based on the earliest transaction time (t=0). Finally, output the normalized node set (address list, transaction event list), edge set (transaction pair, account pair) and attribute (timestamp, amount, frequency) to provide basic data for subsequent graph structure construction.

[0021] (1.4) Divide the data set Input the labeled training data (including risk address labels), first perform model training, the specific operation includes dividing the data set into training set, validation set and test set according to 8:1:1.

[0022] Step 2: Double graph structure construction Input the preprocessed node set (address, transaction event), edge set (transaction pair, account pair) and its attribute (timestamp, amount, frequency), and construct account graph and transaction graph to capture different dimensions of behavior patterns.

[0023] (2.1) Build account graph First, define the node type of the account graph as a blockchain address (such as address 0x...), and add attributes to each node: address type (distinguish between ordinary accounts EOA and contract addresses), historical transaction times (total number of transactions involving this address), and total transaction amount (cumulative amount sent or received by this address). Then define the edge type as "transaction relationship", which represents the flow of funds between addresses (sender→receiver), and the edge weight can be selected as frequency weight (e.g. "A→B transaction 5 times, edge weight=5") or amount weight (e.g. "A→B total amount=10 ETH, edge weight=10") according to demand. Edge attributes record relative timestamps (time difference of the last transaction between account pairs, e.g. 3 hours) and transaction frequency (historical cumulative transaction times between account pairs, e.g. 5 times), which are used to model the periodicity of subsequent interactions. Finally, output the account graph, whose nodes are addresses and edges are account pairs, and edge attributes include relative time information.

[0024] (2.2) Build transaction graph The node type of the transaction graph is defined as a single transaction event (Tx), each node contains the transaction amount, transaction timestamp (standardized to UTC time zone) and transaction status (success / failure). Then the edge type is defined as "association", connecting two transactions through the same address: if the sender of transaction Tx1 is equal to the receiver of transaction Tx2, an edge Tx1→Tx2 is established; if the receiver of transaction Tx1 is equal to the sender of transaction Tx2, an edge Tx1←Tx2 is established, reflecting the chain-like transfer or reflux of funds. The edge attributes include absolute timestamp (take the later time of the two transactions, such as 2025-01-01 12:05:00) and amount similarity (calculate the difference or ratio of the two transaction amounts, such as Tx1=1 ETH, Tx2=0.9 ETH, similarity=0.9). Finally, output the transaction graph, whose nodes are transaction events, edges are transaction associations, and edge attributes include absolute time information, complementing the perspective of the account graph.

[0025] Step 3: Time encoding module Input the relative timestamp in the edge attribute of the account graph and the absolute timestamp in the edge attribute of the transaction graph, respectively encode the two types of time information, and generate vector representations that can be processed by graph neural networks.

[0026] (3.1) Absolute time encoding For the absolute timestamp in the edge attribute of the transaction graph, the following method is used to generate time encoding: Sine-cosine position encoding: convert the timestamp (such as 2023-01-01 12:00:00 into a second-level value) into a 64-dimensional continuous vector by combining sine and cosine functions of different frequencies. Specifically, use 64 dimensions (32 sets of sine-cosine pairs), each pair corresponds to a different frequency, and the frequencies are arranged from low to high to capture the periodicity (such as daily, weekly regularity) and continuity features of the timestamp.

[0027] Learnable embedding: segment the timestamp by hour (such as 0-23 hours), generate integer labels (0-23), and then map the labels to 64-dimensional vectors through a trainable embedding layer. The embedding layer parameters are automatically optimized through model training to adapt to the sensitivity of the task to time features. Finally, output the absolute time encoding vector (64-dimensional) of the transaction graph as the feature input of the transaction graph edge.

[0028] (3.2) Relative time encoding For the transaction interval in the edge attribute of the account graph, the following method is used to generate time encoding: (3.2.1) Linear scaling: The time difference between the last transaction of the account pair (unit: hour) is divided by the maximum time interval in the dataset (e.g., 1000 hours), and the result is normalized to the interval of 0 to 1 to eliminate dimensional differences and preserve the relative size relationship.

[0029] (3.2.2) Periodic encoding: For transaction behaviors that may have daily repetition (such as timed transfers), first calculate the value of the time difference after taking the modulus of 24 hours (e.g., time difference 25 hours → 1 hour after taking the modulus of 24), and then convert the modulus value into a 64-dimensional vector (32 sets of sine-cosine pairs) through the sine and cosine functions to capture periodic patterns.

[0030] The final output is the relative time encoding vector (64-dimensional) of the account graph, which is used as the feature input of the account graph edges. Through the above operations, the time encoding module converts the original time information into a high-dimensional vector and injects it into the edge attributes of the transaction graph and the account graph, providing time sequence feature support for subsequent graph neural networks.

[0031] Step 4: Account graph modeling module A two-layer graph attention network (GAT) is constructed, which contains 8 attention heads in each layer to capture the interaction patterns between accounts. When calculating the attention weight of the neighbor nodes to the target node, the relative time encoding is the dominant factor: (4.1) Input vector and attention mechanism design Feature concatenation: concatenate the target node features (such as the initial feature vector of the address), neighbor node features (feature vectors of other accounts), and their relative time encoding (the time difference between the most recent transaction of the account pair) into a joint feature vector.

[0032] Attention score calculation: perform linear transformation on the concatenated features through learnable parameters (vector of dimension 3x64), and calculate the attention score after applying the LeakyReLU activation function. The weight proportion of the relative time encoding is higher, so that the account pairs with closer time intervals obtain greater attention weights.

[0033] (4.2) Output feature vector of each account After each attention head independently calculates the score, the weight coefficients are obtained through Softmax normalization, the neighbor features are weighted and aggregated, and finally the 128-dimensional node embedding (each address corresponds to a vector) is generated by concatenating the outputs of all heads.

[0034] Layer normalization (LayerNorm) and ReLU activation functions are added after each GAT layer to alleviate the gradient vanishing problem through residual connection (adding the input features and output features).

[0035] Step 5: Transaction graph modeling module (absolute time dominant GAT) Two layers of GAT are constructed with the same structure (8 attention heads per layer), but the attention mechanism is centered on absolute time encoding: (5.1) Input vector and attention mechanism design The target transaction features (such as transaction amount, status), neighbor transaction features (other transactions associated through the same address), and absolute time encoding (specific timestamp of transaction occurrence) are concatenated into a joint feature vector.

[0036] Attention score calculation: interact with the concatenated features through another set of learnable parameters (vector of dimension 3x64), and calculate the attention score after applying LeakyReLU. The weight proportion of absolute time encoding is higher, so that the transactions closer in time obtain greater attention weight.

[0037] (5.2) Output feature vector of each transaction Normalize the weight coefficients by Softmax, aggregate the neighbor transaction features by weight, and finally generate a 128-dimensional node embedding (each transaction event corresponds to a vector). Perform layer normalization, ReLU activation, and residual connection after each GAT layer to ensure training stability.

[0038] Step 6: (Fusion module) As Figure 2 After modeling the account graph and transaction graph independently, feature aggregation based on affiliation is used for fusion. In the step of aggregating by account to generate account-level transaction feature vectors, first, all transaction embedding vectors associated with the same account and their corresponding time weights need to be obtained. The specific operation is as follows: multiply the embedding vector of each transaction under the account (such as the 256-dimensional feature obtained after transaction graph processing) with its time-designed weight (the weight usually adopts exponential decay, etc., giving recent transactions higher weight), then add all the products, and finally divide by the sum of weights to normalize, avoiding the influence of feature scale due to weight differences. Through this process, the scattered transaction features can be fused into a unified vector in the account dimension, which retains the time distribution and statistical characteristics of transaction behavior (such as high-frequency transactions, large transaction proportion, etc.), while the dimension is consistent with the single transaction embedding (256 dimensions), facilitating subsequent concatenation and fusion with the account features output by the account graph.

[0039] Step 7: (Input lightGBM classifier) The 256-dimensional feature matrix after fusion is directly input into the LightGBM classifier and flattened into independent feature columns. The LightGBM classifier is configured for binary classification, feature importance analysis double chart contribution, and optimization of Log Loss. The output is a risk probability (0-1), which is mapped by Sigmoid and judged by threshold 0.5. At this point, the dual-structure time-aware graph neural network model is completed.

[0040] Step 8: (training the double-structure time-aware graph neural network model and making prediction) Each batch of 32 addresses and their associated transaction data is processed using the Adam optimizer (learning rate set to 1e-3, weight decay set to 1e-4 to prevent overfitting), and an early stopping mechanism is set (if the validation set loss does not decrease for 5 consecutive rounds, training is stopped to save computing resources); during training, automatic adjustment is made through back propagation, and finally the trained model is used to predict the test set, outputting the risk probability or category label (such as risk / normal) of the address.

[0041] In summary, the present application first constructs a double-structure model of account graph and transaction graph according to the different characteristics of accounts and transactions in the blockchain network. The double-structure design of the present application can comprehensively depict the complex interaction characteristics of the blockchain network from multiple perspectives. In the account graph, the model focuses on analyzing the transaction relationship between accounts, and by deeply modeling the interaction pattern between accounts, it can mine the potential risk features hidden in the complex network; in the transaction graph, the model pays more attention to the evolution characteristics of transaction behavior, and can depict the behavior pattern of risk addresses from the transaction dimension; and this double-structure design significantly improves the model's ability to capture multi-dimensional information, making the identification of risk addresses more comprehensive and accurate.

[0042] The present application introduces relative time encoding and absolute time encoding according to the different characteristics of account graph and transaction graph, fully mining the influence of time dynamics on risk behavior. In the account graph, by taking the relative time encoding as an important participating factor of the attention mechanism, the model can give higher weight to the interaction behavior of time neighbors, and strengthen the ability to capture short-term behavior patterns; while in the transaction graph, the absolute time encoding is used to model the global dynamic characteristics of transaction behavior, so that the model can identify long-term trends and abnormal behavior at specific time points. This differential design of time encoding mechanism not only makes up for the lack of utilization of time features in the prior art, but also makes the model's ability to mine short-term and long-term risk patterns more balanced and efficient. The double-structure design and time dynamic modeling strategy of the present application enable the model to maintain stable performance when facing new data (such as new types of risk patterns that have not been seen before), so that the model maintains stable and efficient risk identification ability across scenes and time periods, providing technical support for blockchain compliance applications, and greatly increasing the generalization ability.

[0043] In addition, the application can provide technical support for regulatory agencies by accurately depicting the behavior patterns of risk addresses (such as association with known blacklisted addresses and concentrated transactions in abnormal time periods), assisting in tracking illegal fund flows and cracking down on cybercrime. For example, in anti-money laundering regulations such as the "Card Cutting Action", the model can quickly identify risk addresses to maintain financial order. In addition, accurate risk identification can reduce interference with normal users, balance regulatory needs and user privacy protection, improve the social acceptance of blockchain technology, and promote the landing of its compliant applications (such as supply chain finance and copyright identification).

[0044] The above merely describes preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

[0045] The above embodiments are only used to illustrate the design ideas and characteristics of the present application, and the purpose is to enable those skilled in the art to understand the content of the present application and implement it, and the protection scope of the present application is not limited to the above embodiments. Therefore, any equivalent changes or modifications made according to the principles and design ideas disclosed by the present application are within the scope of protection of the present application.

Claims

1. A blockchain risk address identification method based on a dual-structure time-aware graph neural network, characterized in that: The following steps are involved: S1. Input the original transaction records on the blockchain, and then parse and clean the original data; S2, input the preprocessed node set, edge set and their attributes, and construct the account graph and transaction graph respectively to capture the behavioral patterns of different dimensions; S3. Input the relative timestamps in the edge attributes of the account graph and the absolute timestamps in the edge attributes of the transaction graph, encode the two types of time information respectively, and generate vector representations that can be processed by the graph neural network; S4. Construct a two-layer graph attention network (GAT), with each layer containing 8 attention heads, to capture the interaction patterns between accounts. The relative time encoding is used as the dominant factor to calculate the attention weight of neighbor nodes to the target node. S5. Construct a two-layer GAT with the same structure, with 8 attention heads in each layer, and its attention mechanism is dominated by absolute time encoding; S6. After the account graph and transaction graph are independently modeled, they are integrated using feature aggregation based on affiliation. S7. The fused 256-dimensional feature matrix is ​​directly input into the LightGBM classifier and flattened into independent feature columns. Thus, a dual-structure time-aware graph neural network recognition model is constructed. S8: A dual-structure time-aware graph neural network recognition model is constructed using the Adam optimizer and an early stopping mechanism. Backpropagation is used for automatic adjustments during training, and the trained model is used to predict the test set and output the risk probability or category label of the address.

2. The blockchain risk address identification method based on the dual-structure time-aware graph neural network according to claim 1 is characterized in that: The step S1 is specifically as follows: S11. Input the original transaction records on the blockchain, including JSON / CSV format, containing the following fields: address, transaction timestamp, transaction amount, sender, receiver, and transaction hash; parse the original data in different formats and extract key fields, including sender address, receiver address, transaction timestamp, and transaction amount; Then, invalid data is filtered out, that is, empty addresses such as 0x0 or zero addresses are removed, duplicate transactions are deleted through transaction hash deduplication, and abnormal transactions with 0 or negative amounts are filtered out; S12. Construct transaction pairs and account pairs based on valid transaction records, and calculate the cumulative transaction amount of the account pairs; S13. Convert the transaction timestamp to the UTC time zone and format it as YYYY-MM-DD HH:MM:SS. Calculate the relative time difference of subsequent transactions based on the earliest transaction time, i.e., t=0. Finally, output the normalized node set, edge set, and attributes to provide basic data for subsequent graph structure construction. S14. Input the labeled training data, including the risk address labels; first perform model training, specifically by dividing the dataset into a training set, a validation set, and a test set in an 8:1:1 ratio.

3. The blockchain risk address identification method based on the dual-structure time-aware graph neural network according to claim 1 is characterized in that: The step S2 is specifically as follows: S21. First, define the node type of the account graph as blockchain address, and add attributes to each node: address type, historical transaction count, and total transaction amount. Then define the edge type as "transaction relationship", which represents the flow of funds between the sender and the receiver address. The edge weight can be selected as frequency weight or amount weight according to the needs. The edge attribute records the relative timestamp and transaction frequency, which is used for subsequent modeling of the periodicity of interaction. Finally, output the account graph, whose nodes are addresses, edges are account pairs, and edge attributes contain relative time information. S22. Define the node type of the transaction graph as a single transaction event Tx, with each node containing the transaction amount, transaction timestamp, and transaction status. Then define the edge type as "association relationship" to connect two transactions with the same address: if the sender of transaction Tx1 is equal to the receiver of transaction Tx2, then establish an edge Tx1→Tx2; if the receiver of transaction Tx1 is equal to the sender of transaction Tx2, then establish an edge Tx1←Tx2, reflecting the chain transfer or reflow of funds; edge attributes include absolute timestamps and amount similarity; finally, output the transaction graph, whose nodes are transaction events, edges are transaction associations, and edge attributes include absolute time information, forming a complementary perspective with the account graph.

4. The blockchain risk address identification method based on the dual-structure time-aware graph neural network according to claim 1 is characterized in that: The step S3 is specifically as follows: S31. For the absolute timestamps in the edge attributes of the transaction graph, a time code is generated using sine-cosine position coding and learnable embedding methods. S32. For the transaction intervals in the edge attributes of the account graph, a linear scaling and periodic coding method is used to generate time codes.

5. The blockchain risk address identification method based on the dual-structure time-aware graph neural network according to claim 4 is characterized in that: The step S31 is specifically as follows: S311, Sin-Cos position encoding: The timestamp is combined with sine and cosine functions of different frequencies to generate a 64-dimensional continuous vector. Specifically, 64 dimensions are used, i.e., 32 sine-cosine pairs, each corresponding to a different frequency, arranged from low to high, to capture the periodicity and continuity characteristics of the timestamp. S312, Learnable Embedding: Segment the timestamp into hourly segments, generate integer labels, and then map the labels into 64-dimensional vectors through a trainable embedding layer; The embedding layer parameters are automatically optimized through model training to adapt to the task's sensitivity to temporal features; ultimately, the absolute time encoding vector of the transaction graph is output as the feature input of the transaction graph edge.

6. The blockchain risk address identification method based on the dual-structure time-aware graph neural network according to claim 4 is characterized in that: The step S32 is specifically as follows: S321, Linear Scaling: Calculate the time difference between the most recent transactions between account pairs, divide it by the maximum time interval in the dataset, and normalize the result to the range of 0 to 1 to eliminate dimensional differences and preserve relative size relationships; S322. Periodicity Encoding: For transactions that may repeat daily, first calculate the time difference modulo 24 hours. Then, use the sine and cosine functions to convert this modulo value into a 64-dimensional vector, i.e., 32 sine-cosine pairs, to capture periodic patterns. Finally, the 64-dimensional relative time encoding vector of the account graph is output as the feature input of the account graph edge. Through the above operations, the time encoding module converts the original time information into a high-dimensional vector, which is injected into the edge attributes of the transaction graph and the account graph respectively, providing temporal feature support for the subsequent graph neural network.

7. The blockchain risk address identification method based on the dual-structure time-aware graph neural network according to claim 1 is characterized in that: The step S4 is specifically as follows: S41, input vector and attention mechanism design Feature concatenation: concatenate the target node features, neighbor node features, and their relative time encoding into a joint feature vector; Attention score calculation: The attention score is calculated by linearly transforming the concatenated features with the learnable parameters and applying the LeakyReLU activation function. The weight of the relative time encoding is proportional to the attention weight obtained by the account pair with a closer time interval. S42. Output the feature vector of each account After each attention head calculates the score independently, it obtains the weight coefficient through Softmax normalization, weightedly aggregates the neighbor features, and finally concatenates the outputs of all heads to generate a 128-dimensional node embedding, where each address corresponds to a vector; After each layer of GAT, layer normalization and ReLU activation function are added, and the gradient vanishing problem is alleviated by residual connection; the residual connection is to add the input features to the output features.

8. The blockchain risk address identification method based on a dual-structure time-aware graph neural network according to claim 1 is characterized in that: The step S5 is specifically as follows: (5.1) Input vector and attention mechanism design Concatenate the target transaction features, neighbor transaction features, and absolute time codes into a joint feature vector; Attention scores are calculated by applying LeakyReLU to the concatenated features using another set of learnable parameters. The weight of the absolute time encoding is proportional to the attention weights assigned to transaction pairs closer in time. (5.2) Output the feature vector of each transaction The Softmax normalization weight coefficient is used to weightedly aggregate neighbor transaction features, ultimately generating a 128-dimensional node embedding, where each transaction event corresponds to a vector. Layer normalization, ReLU activation, and residual connection are also performed after each GAT layer to ensure training stability.

9. The blockchain risk address identification method based on a dual-structure time-aware graph neural network according to claim 1 is characterized in that: The step S6 is specifically as follows: First, we need to obtain the embedding vectors of all transactions associated with the same account and their corresponding time weights. This involves multiplying the embedding vector of each transaction under the account by its time-based weight, adding up all the products, and finally dividing by the sum of the weights to normalize the result. This prevents weight differences from affecting the feature scale. The scattered transaction features are then fused into a unified vector of account dimensions. This vector retains the time distribution and statistical characteristics of transaction behavior. At the same time, the dimension is consistent with the embedding of a single transaction, which facilitates splicing and fusion with the account features output by the account graph. Finally, the transaction information is spliced ​​with the account to which it belongs.

10. The blockchain risk address identification method based on a dual-structure time-aware graph neural network according to claim 1 is characterized in that: The LightGBM classifier in step S6 is specifically configured as follows: the LightGBM classifier is configured as a binary classification, feature importance analysis is performed on the dual-image contribution, and Log Loss is optimized; the risk probability (0-1) is output, and the threshold value 0.5 is used for judgment after Sigmoid mapping.

Images