Reentry attack detection system and method based on time sequence transaction aggregation graph network

Abstract

The invention discloses a reentry attack detection system and method based on a time sequence transaction aggregation graph network, and the method comprises the steps: constructing a time sequence multilateral directed transaction graph through a transaction graph generation module, constructing and enhancing the node and edge representation of a block chain transaction graph through a multilayer mechanism in a time sequence transaction aggregation graph network construction module, and the attack detection module carries out weighted fusion on the node features, the time sequence features and the structural features and then inputs the fused features into a logistic regression classifier, a probability value of a reentry attack behavior is calculated through a Sigmoid function, classification judgment is carried out according to a set threshold value, and a reentry attack detection result is obtained. The reentry attack detection method provided by the invention has a real-time monitoring capability, can accurately identify an ongoing reentry attack behavior, and effectively prevents further loss of contract funds through an instant interception mechanism. The method has high adaptability to a continuously evolving block chain transaction environment, and a novel unknown reentry attack mode can be continuously and effectively detected.

Description

Technical Field

[0001] This invention belongs to the technical field of blockchain and attack detection, and mainly relates to a reentrancy attack detection system and method based on a time-series transaction aggregation graph network. Background Technology

[0002] Blockchain technology is built on a block-chain storage architecture, with its core characteristics lying in data immutability and security. As a typical decentralized distributed ledger system, this technology achieves efficient recording of transaction information through continuously expanding data blockchains, thereby ensuring data integrity while maintaining a high degree of system transparency. The automation and immutability of smart contracts have brought revolutionary changes to many fields such as finance, supply chain, and the Internet of Things, but have also raised security issues. Reentrancy attacks exploit reentrancy vulnerabilities to attack contracts. Attackers deploy malicious contracts containing special fallback functions, taking advantage of the victim contract's failure to update its state in a timely manner during external calls, repeatedly invoking the vulnerable parts of the target contract to illegally obtain additional profits.

[0003] Existing methods cannot comprehensively detect all potential vulnerabilities. In addition, with the continuous emergence of new reentrancy attack patterns, reentrancy vulnerabilities in smart contracts are difficult to detect completely. Therefore, researchers have conducted reentrancy attack behavior detection.

[0004] Currently, researchers have proposed various detection methods based on transaction security analysis to effectively detect reentrancy attacks, identifying traditional recursive reentrancy by assessing state inconsistencies. However, as blockchain technology continues to evolve, attackers' methods are also upgrading. In recent years, new variants of cross-domain reentrancy attacks have emerged in blockchains, such as cross-contract reentrancy attacks and read-only reentrancy attacks. These new attack methods are becoming increasingly covert and difficult to detect, making traditional detection methods ineffective in countering them. Summary of the Invention

[0005] This invention addresses the problem that existing detection methods cannot accurately and effectively detect variant reentrancy attacks. It provides a reentrancy attack detection system and method based on a temporal transaction aggregation graph network, comprising a transaction graph generation module, a temporal transaction aggregation graph network construction module, and an attack detection module. The transaction graph generation module extracts the target transaction dataset from the blockchain network and constructs a temporal multi-sided directed transaction graph based on it. The temporal transaction aggregation graph network construction module extracts statistical behavioral features of nodes to construct node vectors, uses a long short-term memory network to model the transaction sequences between node pairs, generates temporal embedding representations of edges, aggregates the interaction information between the target node and its adjacent edges, extracts local temporal context, and finally introduces a graph convolutional network and a graph autoencoder mechanism to fuse structural information and optimize node embeddings through self-supervised processing. The attack detection module weights and fuses node features, temporal features, and structural features, then inputs the weighted fusion into a logistic regression classifier. The probability value of the reentrancy attack behavior is calculated using the Sigmoid function, and classification is performed based on a set threshold to obtain the reentrancy attack detection result. The reentrancy attack detection method proposed in this invention has real-time monitoring capabilities, accurately identifying ongoing reentrancy attack behaviors and effectively preventing further losses to contract funds through an immediate interception mechanism. This method is highly adaptable to the ever-evolving blockchain transaction environment and can continuously and effectively detect new and unknown reentrancy attack patterns.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is: a reentrancy attack detection system based on a time-series transaction aggregation graph network, comprising at least a transaction graph generation module, a time-series transaction aggregation graph network construction module, and an attack detection module.

[0007] The transaction graph generation module extracts the target transaction dataset from the blockchain network and constructs a time-series multi-sided directed transaction graph based on it. In the graph, nodes represent transaction addresses, directed edges represent fund flows, and the edges are attached with timestamps and amount attributes.

[0008] The temporal transaction aggregation graph network construction module extracts the statistical behavioral features of nodes to construct node vectors, uses a long short-term memory network to model the transaction sequence between node pairs, generates temporal embedding representations of edges, aggregates the interaction information between the target node and its adjacent edges, extracts local temporal context, and finally introduces a graph convolutional network and a graph autoencoder mechanism to fuse structural information and optimize node embedding through self-supervision.

[0009] The attack detection module: after weighted fusion of node features, temporal features and structural features, it inputs the data into a logistic regression classifier, calculates the probability value of reentrancy attack behavior through the Sigmoid function, and classifies and judges it according to a set threshold to obtain the result of reentrancy attack detection.

[0010] As an improvement of the present invention, the temporal transaction aggregation graph network construction module includes a node feature extraction module, a temporal edge aggregation module, an Edge2seq module, and a structure enhancement module.

[0011] The node feature extraction module: Based on the node attributes in the temporal multi-sided directed transaction graph constructed by the transaction graph generation module, the nodes are represented by statistical transaction behavior features;

[0012] The time-series edge aggregation module uses a long short-term memory network to extract features from transaction time-series data, treating all transaction records between any two nodes as a time series and sorting them according to transaction timestamps; the long short-term memory network model includes a forget gate, an input gate, a memory unit update gate, and an output gate.

[0013] The Edge2seq module aggregates the interaction relationships between the target node and its adjacent edges, and extracts the local temporal context representation.

[0014] The structure enhancement module extracts features through a graph convolutional network model and optimizes the structure through a self-supervised mechanism.

[0015] To achieve the above objectives, the present invention also adopts the following technical solution: a reentrancy attack detection method based on a time-series transaction aggregation graph network, comprising the following steps:

[0016] S1. Data Preprocessing: Preprocess the data from past reentrancy attack cases, and extract the target transaction dataset from the blockchain network based on the transaction hash values ​​in the past reentrancy attack cases; the target transaction dataset includes at least the addresses of the two parties to the transaction, the transaction timestamp, and the transaction amount;

[0017] S2. Generation of time-series transaction graph: Using transaction addresses as graph nodes and the fund flow relationship between addresses as directed edges, a time-series multi-sided directed transaction graph is constructed; in the transaction graph, multiple directed edges with time-series characteristics are allowed between any pair of nodes, and each directed edge contains the timestamp attribute and transaction amount attribute of the corresponding transaction.

[0018] S3. Node Feature Extraction: Based on the temporal multi-sided directed transaction graph constructed in step S2, the nodes are characterized by statistical transaction behavior features, and node feature vectors are constructed.

[0019] S4. Temporal Modeling: A Long Short-Term Memory (LSTM) network is used to extract features from the transaction time-series data. The transaction sequence information of edges is aggregated. Specifically, all transaction records between any pair of nodes (m, z) are treated as a time series and sorted according to the transaction timestamps. The transaction sequence is represented as follows: in For the transaction amount, Using transaction timestamps, the transaction sequence is sequentially input into the Long Short-Term Memory network model to generate corresponding edge embeddings.

[0020] S5. Edge sequence aggregation: The correlation coefficient between node m and its adjacent edge e is calculated through the attention mechanism. The SoftMax function is introduced to normalize the edge attention weights. After obtaining the attention weights of all neighboring edges, the neighboring edge information is aggregated using a multi-head attention mechanism.

[0021] S6. Structural Enhancement: Feature extraction is performed through a graph convolutional network model, and structural optimization is achieved through a self-supervised mechanism;

[0022] S7. Feature Fusion: Weighted fusion of node features, temporal features and structural features, splicing or projecting them into a single graph feature vector of a unified dimension;

[0023] S8. Reentrancy Attack Classification: Input the single graph feature vector obtained in step S7 into the logistic regression classifier, output the probability value predicted as a reentrancy attack, and classify it according to the decision rule. The determination is made to obtain the detection result of a reentrancy attack; among which, It is the model's predicted probability, and threshold is the classification threshold.

[0024] As an improvement of the present invention, the node feature vector in step S3 includes: in-degree, out-degree, number of transactions, number of independent transaction addresses, total amount sent, total amount received, average amount sent, average amount received, maximum amount sent, minimum amount sent, maximum amount received, minimum amount received, capital inflow rate, capital liquidity, mean of transaction time interval, standard deviation of transaction time interval, number of transactions sent, and number of transactions received.

[0025] As another improvement of the present invention, in step S5, the method for calculating the correlation coefficient between node m and its adjacent edge e is as follows:

[0026]

[0027] Among them, h m and h e denoted as , where is the feature of node m and its neighboring edge e, a is the trainable attention parameter matrix, ‖ denotes the feature concatenation operation, and σ is the non-linear activation function.

[0028] The SoftMax function is as follows:

[0029]

[0030] Where, N m Let N be the set of adjacent edges, and let e∈N be the neighboring edge set. m ;

[0031] After aggregating neighbor information using a multi-head attention mechanism, the temporal representation of node m in the transaction graph Φ is as follows:

[0032]

[0033] Where K represents the number of long positions.

[0034] As another improvement of the present invention, in the graph convolutional network model of step S6, the propagation formula of the hidden layer is:

[0035]

[0036] Among them, H (l) Let L be the feature matrix of the l-th layer in the graph convolutional network model. This indicates adding a self-join to the adjacency matrix A to form a new adjacency matrix. yes The degree matrix, W (l) σ is a trainable weight matrix, and σ is the activation function.

[0037] As another improvement of the present invention, the structure optimization through self-supervised mechanism in step S6 specifically involves: setting the initial node embedding vector as the temporal feature matrix Z, obtaining the final node embedding representation S = GCN(Z,A) through a graph convolutional network model, reconstructing the adjacency matrix using a self-supervised method, and calculating the predicted adjacency matrix. Optimize node representation by minimizing the adjacency matrix reconstruction error. Among them, || || F Let n denote the Frobenius norm, where n is the number of nodes.

[0038] As another improvement of the present invention, in step S7, the fused global graph feature vector X is:

[0039] X = w node ·X node +w seq ·X seq +w structure ·X structure

[0040] Among them, X node X seq X structure These represent node features, temporal features, and structural features, respectively; w node w seq w structure For the corresponding feature fusion weight coefficients, w node +w seq +w structure =1.

[0041] As a further improvement of the present invention, in step S8, the objective function of the logistic regression classifier is:

[0042]

[0043] Where y∈{0,1} are the true labels. It is the probability predicted by the model.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] (1) This invention constructs a temporal multi-sided directed transaction graph, which fully preserves the temporal relationship and multiple interaction behaviors between transactions, thus breaking through the limitations of traditional code-level analysis.

[0046] (2) The present invention combines a deep learning-based transaction graph feature learning method to make full use of the time-dependent information of transactions and enhance the model’s ability to perceive abnormal transaction behavior.

[0047] (3) This invention constructs a reentrancy attack detection method from data acquisition, graph construction to attack prediction, which can not only be used for real-time attack detection, but also provide knowledge support for the secure development of smart contracts. Attached Figure Description

[0048] Figure 1 This is a flowchart of the detection method of the present invention;

[0049] Figure 2 This is a flowchart of the working steps of the transaction graph generation module in the system of the present invention;

[0050] Figure 3 This is a schematic diagram of the temporal edge aggregation in step S4 of the method of the present invention. Detailed Implementation

[0051] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0052] Example 1

[0053] A reentrancy attack detection system based on a time-series transaction aggregation graph network includes at least a transaction graph generation module, a time-series transaction aggregation graph network construction module, and an attack detection module.

[0054] Transaction chart generation module: such as Figure 2As shown, pre-collected reentrancy attack cases are preprocessed to extract target transaction datasets containing information such as transaction addresses, timestamps, and amounts from the blockchain network. Based on this dataset, a temporal multi-sided directed transaction graph is constructed. In the graph, nodes represent transaction addresses, directed edges represent fund flows, and edges are attached with timestamp and amount attributes, generating a structured blockchain temporal transaction graph.

[0055] The temporal transaction aggregation graph network construction module includes a node feature extraction module, a temporal edge aggregation module, an Edge2seq module, and a structural feature extraction module; among them...

[0056] Node feature extraction module: Based on the node attributes in the time-series multi-sided directed transaction graph constructed by the transaction graph generation module, the nodes are represented by statistical transaction behavior features;

[0057] The temporal edge aggregation module uses a long short-term memory network to extract features from transaction time series data. It treats all transaction records between any two nodes as a time series and sorts them according to the transaction timestamp. The long short-term memory network model includes a forget gate, an input gate, a memory unit update gate, and an output gate.

[0058] Edge2seq module: Aggregates the interaction relationship between the target node and its adjacent edges, and extracts the local temporal context representation;

[0059] Structure enhancement module: Features are extracted using a graph convolutional network model, and the structure is optimized through a self-supervised mechanism;

[0060] The temporal transaction aggregation graph network construction module constructs and enhances the node and edge representations of the blockchain transaction graph through a multi-layer mechanism. First, it extracts the statistical behavioral features of nodes to construct node vectors; then, it uses LSTM to model the transaction sequences between node pairs, generating temporal embedding representations of edges; next, it uses the Edge2Seq module to aggregate the interaction information between the target node and its adjacent edges, extracting local temporal context; finally, it introduces a graph convolutional network (GCN) and a graph autoencoder mechanism to fuse structural information and optimize node embeddings through self-supervision.

[0061] The attack detection module weighted and fused node features, temporal features, and structural features to generate a unified-dimensional global graph feature representation, thereby improving the model's comprehensive perception of the overall semantics of the graph. Subsequently, this fused feature is input into a logistic regression classifier, where the probability value of reentrancy attacks is calculated using the Sigmoid function, and classification is performed based on a set threshold. This classification threshold is adaptively determined based on the F1-score optimality principle, effectively ensuring the model's detection performance.

[0062] Example 2

[0063] A reentrancy attack detection method based on temporal transaction aggregation graph network, such as Figure 1 As shown, the specific steps include the following:

[0064] Step S1, Data Preprocessing: Based on the pre-collected characteristics of reentrancy attack cases, obtain the corresponding raw transaction data from the blockchain network; based on the transaction hash value provided in the reentrancy attack case, extract the target transaction dataset associated with the reentrancy attack behavior through the data filtering module; the target transaction dataset contains complete blockchain transaction records including the address information of both parties to the transaction, the transaction timestamp, and the transaction amount.

[0065] Step S2, Generation of Time-Series Transaction Graph: Based on the target transaction dataset obtained from the preprocessing in Step S1, a time-series multi-sided directed transaction graph is constructed. Specifically, each transaction address is used as a node in the graph structure, and the fund transfer relationship between addresses is used as a directed edge. Multiple directed edges with time-series characteristics are allowed between any pair of nodes. Each directed edge contains the timestamp attribute and transaction amount attribute of the corresponding transaction. Finally, multiple blockchain time-series transaction graphs corresponding one-to-one with reentrancy attack cases are generated.

[0066] Step S3: Node Feature Extraction: Due to the high anonymity of user identities in a blockchain system, nodes themselves do not carry any directly usable attribute information. Therefore, it is necessary to characterize nodes through statistical transaction behavior features. In this embodiment, the following eighteen statistical features are extracted from the node's historical transaction behavior to construct a node feature vector, specifically including: in-degree, out-degree, number of transactions, number of independent transaction addresses, total amount sent, total amount received, average amount sent, average amount received, maximum amount sent, minimum amount sent, maximum amount received, minimum amount received, capital inflow rate, capital liquidity, mean transaction time interval, standard deviation of transaction time interval, number of transactions sent, and number of transactions received.

[0067] Step S4: Temporal edge aggregation: such as Figure 3 As shown, to effectively capture the temporal dependencies and behavioral patterns inherent in transaction relationships, this invention introduces a temporal modeling mechanism to aggregate the transaction sequence information of edges. A Long Short-Term Memory (LSTM) network is used to extract features from the transaction time-series data.

[0068] Treat all transaction records between any two nodes as a time series and sort them according to transaction timestamps. For a node pair (m, z), denote the transaction amount for each transaction as... Transaction timestamp is The transaction sequence is then represented as in The sign is used to distinguish the direction of the transaction; a positive value indicates a transfer from node m to node z, and a negative value indicates a transfer from node m to node z. This transaction sequence is then input into the LSTM model to generate the corresponding edge embedding representations:

[0069]

[0070] The structure of an LSTM model includes a forget gate, an input gate, a memory cell update mechanism, and an output gate. Let... σ is the sigmoid activation function, tanh is the tanh activation function, and W... f W i W C It is the weight matrix, b f b i b C b o It's a bias term. The input e x First, pass through the Gate of Oblivion. t =σ(W f ·[h t-1 ,e t ]+b f This determines whether past memories need to be forgotten, and then controls the writing of new information through input gates. t =σ(W i ·[h t-1 ,e t ]+b i ), After obtaining f t i t , Then the memory unit is updated. Finally, the output gate controls the final hidden state. t =σ(W o ·[h t-1 ,e t ]+b o The final output obtained is h. t =o t *tanh(C t Finally, the edge embedding is represented by the output of the above LSTM model, which is used to characterize the temporal transaction relationship between node pairs.

[0071] Step S5, Edge Sequence Aggregation: This invention discloses an edge sequence aggregation mechanism for constructing temporal features of a target node, which aggregates the interaction relationships between the target node and its adjacent edges, and extracts a distinctive local temporal context representation.

[0072] For a target node m, let its set of adjacent edges be N. m For any edge e∈N mThe correlation coefficient between node m and its adjacent edge e is calculated using an attention mechanism. The correlation calculation formula is as follows: Among them, h m and h e Let be the features of node m and its neighbor e, a be the trainable attention parameter matrix, ‖ denote the feature concatenation operation, and σ be the non-linear activation function.

[0073] To achieve normalization of edge attention weights, the SoftMax function is introduced. After obtaining the attention weights of all neighboring edges, a multi-head attention mechanism is used to aggregate the neighboring edge information. Let the number of multi-head attention be K, then the temporal representation of node m in the transaction graph Φ is as follows:

[0074] Step S6, Structural Enhancement: To further enhance the ability to model transaction graph structural information in node representations, a structural feature extraction method based on graph convolutional networks is used.

[0075] Construct a graph G = (N, E), where N represents nodes and E represents edges. This is done by constructing an adjacency matrix. Where A ij =1 indicates that node i is connected to node j, otherwise it is 0. Since the graph structure is unique, the corresponding adjacency matrix A can directly participate in the propagation calculation of the neural network.

[0076] In the GCN model, the update form of the hidden layer representation is H. (l+1) =f(H (l) ,A), where H (l) Let f(·,·) be the feature matrix of the l-th layer of the GCN, and f(·,·) be a specific graph convolution propagation function. In the method of this invention, the standard GCN propagation formula is adopted. in, This indicates adding a self-join to the adjacency matrix A to form a new adjacency matrix. yes The degree matrix, W (l) Here, σ is a trainable weight matrix, and σ is the activation function. The structure is then optimized using a self-supervised mechanism. The initial node embedding vector is set to the temporal feature matrix Z, and the final node embedding representation S = GCN(Z,A) is obtained through GCN. Next, the adjacency matrix is ​​reconstructed using a self-supervised method, and the predicted adjacency matrix is ​​calculated. Finally, the node representation is optimized by minimizing the loss function of the adjacency matrix reconstruction error. Among them, |||| F Let n denote the Frobenius norm, where n is the number of nodes.

[0077] Step S7, Feature Fusion: The node features, temporal features and structural features are weighted and fused, and then spliced ​​or projected into a single graph feature vector of a unified dimension.

[0078] The specific fusion method is X = w node ·X node +w seq ·X seq +w structure ·X structure Where X represents the fused global graph feature vector; X node X seq X structure These represent node features, temporal features, and structural features, respectively; w node w seq w structure The corresponding feature fusion weight coefficients were determined through multiple rounds of experiments and satisfy the normalization constraint w. node +w seq +w structure =1. Finally, the weighted fusion result is concatenated or projected into a single feature vector of a unified dimension, which is used as the input for the subsequent classification module.

[0079] Step S8, Reentrancy Attack Classification: After obtaining the global feature representation X of the graph, it is input into the logistic regression (LR) classifier.

[0080] The basic calculation process of the logistic regression model includes:

[0081] Step 1: z = w T x+b;

[0082] Step Two:

[0083] Where w is the weight vector, b is the bias term, x is the linear combination result, and σ(·) is the Sigmoid function, which is used to map the model output to the interval [0,1], thereby outputting the probability value predicted as a reentrancy attack.

[0084] The model's final classification result is based on the decision rule. The classification threshold is automatically selected based on the probability point corresponding to the maximum F1-score in the Precision-Recall curve.

[0085] To optimize the performance of the logistic regression model during training, a binary cross-entropy loss function is adopted. The objective function is used to measure the deviation between the predicted value and the true label, where y∈{0,1} is the true label. This refers to the model's predicted probability. The model parameters are optimized using the Adam adaptive optimization algorithm. After the model training is complete, the test samples are input into the trained logistic regression classifier to perform a reentrancy attack prediction task, thus obtaining the reentrancy attack detection results.

[0086] This invention discloses a reentrancy attack detection technology based on a temporal transaction aggregation graph network, which can ensure the security of blockchain transaction systems. This invention constructs a temporal multi-sided directed transaction graph, accurately depicting transaction relationships and their evolution. While preserving transaction interaction details, it fully integrates dynamic temporal features, making attack behaviors more identifiable within the graph structure, thereby achieving accurate detection of complex reentrancy attack patterns. Simultaneously, a graph feature learning method combining transaction temporal information is designed, utilizing a deep learning model to automatically extract abnormal behavior features. This not only improves detection accuracy but also significantly enhances adaptability and real-time response capabilities to novel and unknown reentrancy attacks. Furthermore, this invention establishes a complete reentrancy attack detection framework for blockchain platforms, covering modules such as data acquisition, graph construction, feature extraction, and attack prediction, forming an end-to-end detection process.

[0087] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A reentrancy attack detection system based on a time-series transaction aggregation graph network, characterized in that: It includes at least a transaction graph generation module, a time-series transaction aggregation graph network construction module, and an attack detection module. The transaction graph generation module extracts the target transaction dataset from the blockchain network and constructs a time-series multi-sided directed transaction graph based on it. In the graph, nodes represent transaction addresses, directed edges represent fund flows, and the edges are attached with timestamps and amount attributes. The temporal transaction aggregation graph network construction module extracts the statistical behavioral features of nodes to construct node vectors, uses a long short-term memory network to model the transaction sequence between node pairs, generates temporal embedding representations of edges, aggregates the interaction information between the target node and its adjacent edges, extracts local temporal context, and finally introduces a graph convolutional network and a graph autoencoder mechanism to fuse structural information and optimize node embedding through self-supervision. The attack detection module: after weighted fusion of node features, temporal features and structural features, it inputs the data into a logistic regression classifier, calculates the probability value of reentrancy attack behavior through the Sigmoid function, and classifies and judges it according to a set threshold to obtain the result of reentrancy attack detection.

2. The reentrancy attack detection system based on time-series transaction aggregation graph network as described in claim 1, characterized in that: The temporal transaction aggregation graph network construction module includes a node feature extraction module, a temporal edge aggregation module, an Edge2seq module, and a structure enhancement module. The node feature extraction module: Based on the node attributes in the temporal multi-sided directed transaction graph constructed by the transaction graph generation module, the nodes are represented by statistical transaction behavior features; The time-series edge aggregation module uses a long short-term memory network to extract features from transaction time-series data, treating all transaction records between any two nodes as a time series and sorting them according to transaction timestamps; the long short-term memory network model includes a forget gate, an input gate, a memory unit update gate, and an output gate. The Edge2seq module aggregates the interaction relationships between the target node and its adjacent edges, and extracts the local temporal context representation. The structure enhancement module extracts features through a graph convolutional network model and optimizes the structure through a self-supervised mechanism.

3. A reentrancy attack detection method based on time-series transaction aggregation graph networks, characterized in that, Includes the following steps: S1. Data Preprocessing: Preprocess the data from past reentrancy attack cases, and extract the target transaction dataset from the blockchain network based on the transaction hash values ​​in the past reentrancy attack cases; the target transaction dataset includes at least the addresses of the two parties to the transaction, the transaction timestamp, and the transaction amount; S2. Generation of time-series transaction graph: Using transaction addresses as graph nodes and the fund flow relationship between addresses as directed edges, a time-series multi-sided directed transaction graph is constructed; in the transaction graph, multiple directed edges with time-series characteristics are allowed between any pair of nodes, and each directed edge contains the timestamp attribute and transaction amount attribute of the corresponding transaction. S3. Node Feature Extraction: Based on the temporal multi-sided directed transaction graph constructed in step S2, the nodes are characterized by statistical transaction behavior features, and node feature vectors are constructed. S4. Temporal Modeling: A Long Short-Term Memory (LSTM) network is used to extract features from the transaction time-series data. The transaction sequence information of edges is aggregated. Specifically, all transaction records between any pair of nodes (m, z) are treated as a time series and sorted according to the transaction timestamps. The transaction sequence is represented as follows: in For the transaction amount, Using transaction timestamps, the transaction sequence is sequentially input into the Long Short-Term Memory network model to generate corresponding edge embeddings. S5. Edge sequence aggregation: The correlation coefficient between node m and its adjacent edge e is calculated through the attention mechanism. The SoftMax function is introduced to normalize the edge attention weights. After obtaining the attention weights of all neighboring edges, the neighboring edge information is aggregated using a multi-head attention mechanism. S6. Structural Enhancement: Feature extraction is performed through a graph convolutional network model, and structural optimization is achieved through a self-supervised mechanism; S7. Feature Fusion: Weighted fusion of node features, temporal features and structural features, splicing or projecting them into a single graph feature vector of a unified dimension; S8. Reentrancy Attack Classification: Input the single graph feature vector obtained in step S7 into the logistic regression classifier, output the probability value predicted as a reentrancy attack, and classify it according to the decision rule. The determination is made to obtain the detection result of a reentrancy attack; among which, It is the model's predicted probability, and threshold is the classification threshold.

4. The reentrancy attack detection method based on time-series transaction aggregation graph network as described in claim 3, characterized in that: The node feature vector in step S3 includes: in-degree, out-degree, number of transactions, number of independent transaction addresses, total amount sent, total amount received, average amount sent, average amount received, maximum amount sent, minimum amount sent, maximum amount received, minimum amount received, capital inflow rate, capital liquidity, mean of transaction time interval, standard deviation of transaction time interval, number of transactions sent, and number of transactions received.

5. The reentrancy attack detection method based on time-series transaction aggregation graph network as described in claim 3, characterized in that: In step S5, the correlation coefficient between node m and its adjacent edge e is calculated as follows: Among them, h m and h e denoted as , where is the feature of node m and its neighboring edge e, a is the trainable attention parameter matrix, ‖ denotes the feature concatenation operation, and σ is the non-linear activation function. The SoftMax function is as follows: Where, N m Let N be the set of adjacent edges, and let e∈N be the neighboring edge set. m ; After aggregating neighbor information using a multi-head attention mechanism, the temporal representation of node m in the transaction graph Φ is as follows: Where K represents the number of long positions.

6. The reentrancy attack detection method based on time-series transaction aggregation graph network as described in claim 3, characterized in that: In the graph convolutional network model of step S6, the propagation formula of the hidden layer is: Among them, H (l) Let L be the feature matrix of the l-th layer in the graph convolutional network model. This indicates adding a self-join to the adjacency matrix A to form a new adjacency matrix. yes The degree matrix, W (l) σ is the trainable weight matrix, and σ is the activation function.

7. The reentrancy attack detection method based on time-series transaction aggregation graph network as described in claim 6, characterized in that: The structural optimization via self-supervised mechanism in step S6 specifically involves: setting the initial node embedding vector as the temporal feature matrix Z; obtaining the final node embedding representation S = GCN(Z,A) through a graph convolutional network model; reconstructing the adjacency matrix using a self-supervised method; and calculating the predicted adjacency matrix. Optimize node representation by minimizing the adjacency matrix reconstruction error. Among them, |||| F Let n denote the Frobenius norm, where n is the number of nodes.

8. The reentrancy attack detection method based on time-series transaction aggregation graph network as described in claim 3, characterized in that: In step S7, the fused global graph feature vector X is: X=w node ·X node +w seq ·X seq +w structure ·X structure Among them, X node X seq X structure These represent node features, temporal features, and structural features, respectively; w node w seq w struecture For the corresponding feature fusion weight coefficients, w node +w seq +w structure =1.

9. The reentrancy attack detection method based on time-series transaction aggregation graph network as described in claim 3, characterized in that: In step S8, the objective function of the logistic regression classifier is: Where y∈{0,1} are the true labels. It is the probability predicted by the model.

Images