Anti-money laundering method and device

Abstract

The invention discloses an anti-money laundering method and an anti-money laundering device, which are used for solving the technical problem that the existing anti-money laundering method cannot effectively integrate account behaviors and fund flow information on multiple chains, so that the money laundering detection precision is poor. The method comprises the steps of obtaining transaction records and contract event logs of a plurality of target block chains; generating a unified node set and a multi-layer dynamic graph corresponding to the unified node set according to the transaction records and the contract event logs of the multiple target block chains; performing suspicious node detection on the unified node set according to the multilayer dynamic graph by adopting a sliding window incremental shelling algorithm to generate a suspicious node set; and performing money laundering detection on the suspicious node set to generate a high-risk cross-chain money laundering result.

Description

Technical Field

[0001] This invention relates to the field of transaction detection technology, and in particular to an anti-money laundering method and apparatus. Background Technology

[0002] Blockchain is a distributed ledger technology that ensures trusted intermediary transactions between nodes in a non-trusted environment. It can also be described as a trusted distributed database maintained based on a consensus mechanism in a peer-to-peer network. Blockchain technology boasts significant advantages in decentralization, unforgeability, anonymity, and openness, and is therefore considered a next-generation disruptive core technology, widely applied across various fields. Among these applications, the most important and well-known is digital cryptocurrency.

[0003] EVM (Ethereum Virtual Machine) is the Ethereum Virtual Machine, and EVM-compatible chains refer to a series of blockchains and different networks compatible with the Ethereum Virtual Machine. With the proliferation and rapid development of EVM-compatible chains, a multi-chain ecosystem has gradually formed, and transactions and fund flows are increasingly occurring across multiple blockchains. However, with the booming development of virtual trade, the shortcomings of blockchain have become increasingly apparent. Many criminals exploit the anonymity and decentralization of blockchain to open numerous accounts and engage in mixed transactions. These mixed transactions not only occur within a single blockchain but also on other blockchains, or even several blockchains combined, to achieve money laundering. This large-scale money laundering activity has caused huge losses to investors and threatens the blockchain ecosystem. At the same time, this multi-layered money laundering chain also presents significant challenges to regulators, highlighting the urgent need for research into anti-money laundering (AML) strategies. Existing AML technologies often lack solutions tailored to blockchain scenarios and are ineffective at tracing money laundering paths, making investigations and evidence collection challenging.

[0004] Most existing anti-money laundering methods focus on a single blockchain, using rule engines or machine learning to extract features, identify suspicious behavior, and mark high-risk address clusters on a single blockchain for tracking and early warning. However, because these methods have independent ledgers and lack address mapping between blockchains, money laundering paths are artificially fragmented between chains, making it impossible to effectively integrate account behavior and fund flow information across multiple chains, resulting in poor accuracy in money laundering detection. Summary of the Invention

[0005] This invention provides an anti-money laundering method and apparatus to solve the technical problem that existing anti-money laundering methods cannot effectively integrate account behavior and fund flow information across multiple chains, resulting in poor accuracy in money laundering detection.

[0006] The first aspect of this invention provides an anti-money laundering method, comprising:

[0007] Obtain transaction records and contract event logs from multiple target blockchains;

[0008] Based on the transaction records and contract event logs of multiple target blockchains, a unified node set and a multi-layer dynamic graph corresponding to the unified node set are generated.

[0009] The sliding window incremental peeling algorithm is used to detect suspicious nodes in the unified node set based on the multi-layer dynamic graph, and a suspicious node set is generated.

[0010] Money laundering detection is performed on the set of suspicious nodes to generate high-risk cross-chain money laundering results.

[0011] Optionally, generating a unified node set and a multi-layered dynamic graph corresponding to the unified node set based on transaction records and contract event logs of multiple target blockchains includes:

[0012] Classify the aforementioned transaction records and generate transaction classification results;

[0013] A identity mapping process is performed on the transfer addresses in each transaction record and the contract call addresses in each contract event log to generate a unified node set;

[0014] Based on the unified node set and the transaction classification results, construct an edge set;

[0015] Based on the edge set and the unified node set, a multi-layer dynamic graph corresponding to the unified node set is constructed.

[0016] Optionally, the step of using a sliding window incremental peeling algorithm to detect suspicious nodes in the unified node set based on the multi-layer dynamic graph, and generating a suspicious node set, includes:

[0017] Based on the multi-layer dynamic graph, the edge weights of each node in the unified node set are determined;

[0018] Calculate the time average density corresponding to the unified node set based on the edge weights of each node in the unified node set;

[0019] Determine whether the time-averaged density corresponding to the unified node set reaches a preset density threshold.

[0020] If not, calculate the cross-level degree for each node in the unified node set and output the cross-level degree of each node in the unified node set.

[0021] In the unified node set, the node corresponding to the smallest cross-layer degree is removed to determine a new unified node set;

[0022] Based on the new unified node set, a new multi-layer dynamic graph is constructed;

[0023] Jump to execute the step of determining the edge weight of each node in the unified node set based on the multi-layer dynamic graph, until the time average density of the unified node set reaches the preset density threshold.

[0024] The set of unified nodes that is determined when the time average density of the unified node set reaches a preset density threshold is designated as the set of suspicious nodes.

[0025] Optionally, it also includes:

[0026] If the time-average density of a unified node set reaches a preset density threshold, then the unified node set is considered a suspicious node set.

[0027] Optionally, the step of performing money laundering detection on the set of suspicious nodes and generating a high-risk cross-chain money laundering result includes:

[0028] Based on the set of suspicious nodes, construct a candidate dense subgraph corresponding to the set of suspicious nodes;

[0029] Calculate the risk score for the candidate dense subgraph and output the risk score corresponding to the candidate dense subgraph;

[0030] Compare the risk score with a preset score threshold;

[0031] If the risk score is greater than the preset score threshold, a high-risk cross-chain money laundering result is generated.

[0032] Optionally, the calculation process of the risk score is as follows:

[0033] ;

[0034] in, The risk score corresponding to the candidate dense subgraph; , , These are the weighting coefficients; , , , Let A represent the total graph statistics within the window period, where D represents the ratio of the number of edges to the number of nodes, and A represents the sum of the funds from all transactions within the graph. This represents the average structure density of the entire graph within the current window, and calculates the average connectivity of all nodes / subgraphs in the entire graph. This represents the standard deviation of the structure density of the entire image within the current window, measuring the volatility of the structure density across the entire image. This represents the average cross-chain fund size across the entire graph within the current window, and calculates the average fund flow across all transactions / subgraphs within this time window. This represents the standard deviation of cross-chain funds within the current window, measuring the volatility of the fund size. The structural density index of candidate dense subgraphs; Candidate dense subgraph; This refers to the cumulative cross-chain funding size of the candidate dense subgraph, i.e., the cumulative cross-chain amount. , Let i be the edge weight between nodes i and j in the l-th layer within time window t. Let be the set of edges in the l-th layer under time window t; The number of target blockchains covered by the candidate dense subgraph; and the number of different chains covered by the subgraph. The total number of all target blockchains.

[0035] A second aspect of the present invention provides an anti-money laundering device, comprising:

[0036] The acquisition module is used to acquire transaction records and contract event logs from multiple target blockchains;

[0037] The generation module is used to generate a unified node set and a multi-layer dynamic graph corresponding to the unified node set based on the transaction records and contract event logs of multiple target blockchains.

[0038] The suspicious node detection module is used to perform suspicious node detection on the unified node set based on the multi-layer dynamic graph using a sliding window incremental peeling algorithm, and generate a suspicious node set.

[0039] The money laundering detection module is used to perform money laundering detection on the set of suspicious nodes and generate high-risk cross-chain money laundering results.

[0040] A computer device provided in a third aspect of the present invention includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the anti-money laundering method as described in any of the preceding claims.

[0041] The fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the steps of the anti-money laundering method as described in any of the preceding claims.

[0042] The fifth aspect of the present invention provides a computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein, when the program instructions are executed by a computer, the computer performs the steps of the anti-money laundering method as described in any of the preceding claims.

[0043] As can be seen from the above technical solutions, the present invention has the following advantages:

[0044] The above-mentioned technical solution of the present invention provides an anti-money laundering method, which obtains transaction records and contract event logs of multiple target blockchains; generates a unified node set and a multi-layer dynamic graph corresponding to the unified node set based on the transaction records and contract event logs of multiple target blockchains; uses a sliding window incremental peeling algorithm to detect suspicious nodes in the unified node set based on the multi-layer dynamic graph, generating a suspicious node set; performs money laundering detection on the suspicious node set, generating a high-risk cross-chain money laundering result; based on the above solution, the present invention aggregates transaction records and contract event logs of multiple target blockchains, constructs a unified node set and a multi-layer dynamic graph, then uses a sliding window incremental peeling algorithm to dynamically mine suspicious node clusters with abnormal structures in the cross-chain transaction network, and finally performs cross-chain money laundering feature verification on the suspicious clusters to output risk results. This process can avoid the omission and misjudgment of cross-chain disguise behavior by single-chain analysis, thereby improving the accuracy of money laundering detection. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a flowchart of the steps of an anti-money laundering method provided in Embodiment 1 of the present invention;

[0047] Figure 2 This is an overall framework diagram of an anti-money laundering method provided in Embodiment 1 of the present invention;

[0048] Figure 3 This is a structural block diagram of an anti-money laundering device provided in Embodiment 2 of the present invention. Detailed Implementation

[0049] This invention provides an anti-money laundering method and apparatus to address the technical problem that existing anti-money laundering methods cannot effectively integrate account behavior and fund flow information across multiple chains, resulting in poor money laundering detection accuracy.

[0050] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0051] Terminology Explanation:

[0052] 1) Blockchain: Blockchain is a decentralized distributed ledger that is stored in blocks, is immutable, secure and reliable. It combines distributed storage, peer-to-peer transmission, consensus mechanisms, cryptography and other technologies to record transactions and information through a continuously growing chain of data blocks, ensuring data security and transparency.

[0053] 2) Transaction: A transaction is the basic unit of state change in a blockchain system. It is signed by the transaction initiator and broadcast to the network. It is usually used for the transfer of digital assets, the invocation of smart contracts, or the updating of account status. It is the core driving mechanism for the operation of blockchain.

[0054] 3) Money laundering: Money laundering refers to the process of "cleaning" illegally obtained funds through a series of complex financial transactions to conceal their illicit origin and make them appear legitimate. In the blockchain environment, money laundering typically involves multi-level, multi-address, and multi-chain transactions, with highly complex paths involving highly anonymous wallet addresses, cross-chain transfers, and coin mixing techniques.

[0055] 4) Multi-chain ecosystem: A multi-chain ecosystem refers to an overall system that enables interconnection and cooperation between multiple blockchain systems and assets, supporting various types of interactions such as inter-chain transactions, asset migration, and smart contract operations, especially including infrastructure such as EVM-compatible chains.

[0056] 5) EVM-compatible chains: These refer to blockchain systems compatible with the Ethereum Virtual Machine (EVM) execution environment. They support the same smart contract bytecode format, operating mechanism, and development toolchain as Ethereum. They typically support smart contracts written in Solidity and can directly deploy and execute contract logic built on the Ethereum ecosystem, possessing cross-chain deployment and interaction capabilities. Typical EVM-compatible chains include, but are not limited to: Binance Smart Chain (BSC), Polygon, and Optimism.

[0057] 6) Cross-chain transactions: Cross-chain transactions refer to the exchange or interaction of assets between two or more blockchains. They are usually completed through cross-chain bridges, relays, interoperability protocols or atomic swap mechanisms to achieve value exchange and functional synergy between different chains.

[0058] 7) Dense Subgraph: In graph theory, a dense subgraph is a subgraph structure where the connections between nodes are significantly close, typically exhibiting characteristics such as high edge density and high clustering coefficients. This structure has significant application value in social group identification, anomaly detection, and group behavior modeling.

[0059] 8) Dense Subgraph Algorithms: Dense subgraph algorithms are a class of methods used to find subgraphs with dense connections between nodes in a graph. They are widely used in social network analysis, fraud detection, bioinformatics, recommender systems and other fields.

[0060] 9) Multi-layer network: A multi-layer network refers to a graph structure consisting of multiple layers. Each layer is a separate graph that represents different types of relationships, but the node sets are usually shared or partially shared.

[0061] Please see Figure 1 , Figure 1 This is a flowchart of the steps of an anti-money laundering method provided in Embodiment 1 of the present invention.

[0062] The present invention provides an anti-money laundering method, comprising:

[0063] Step 101: Obtain transaction records and contract event logs from multiple target blockchains.

[0064] It should be noted that real-time connection to multiple target blockchains is possible. It continuously collects block headers, transaction records, and contract event logs.

[0065] In this embodiment, transaction records and contract event logs from multiple target blockchains can be obtained through three core approaches: First, by calling the official or third-party node APIs (Application Programming Interfaces) of each chain, sending requests according to the chain's protocol specifications (such as the JSON-RPC interface of the EVM (Ethereum Virtual Machine) chain), specifying parameters such as block range and address, and directly pulling transaction records. If contract event logs are required, the contract address and event signature (such as the hash value of a Solidity event) must be additionally passed in. Second, by deploying full nodes or light nodes on each target chain, synchronizing all on-chain data from the genesis block, and capturing transaction information and contract event trigger records in newly generated blocks in real time to ensure data integrity. Third, by leveraging cross-chain data aggregation services (such as the data interfaces of TheGraph and Chainalysis). These services are adapted to multi-chain data formats and can directly obtain structured transaction records and contract event logs, reducing the complexity of multi-chain interface adaptation.

[0066] Step 102: Based on the transaction records and contract event logs of multiple target blockchains, generate a unified node set and a multi-layer dynamic graph corresponding to the unified node set.

[0067] It should be noted that transaction records are first categorized into types such as ordinary transfers, contract calls, and DeFi (Decentralized Finance) operations; then, through hash merging, bridge contract event association, and known VASP tags, a identity mapping is established between transaction transfer addresses and contract call addresses to generate a unified node set; subsequently, based on... An edge set is constructed based on the transaction classification results: for ordinary transfers, a fund flow edge marked with amount and timestamp is built between the transfer-out and transfer-in nodes; for contract calls, an interaction edge recording the call method is built between the caller and the contract node; for DeFi operations, participating nodes and protocol contract nodes are associated and marked with lending / exchange types; finally, a shared edge set is constructed based on the edge set and dynamic updates over time. The multi-layered dynamic graph depicts the relationships between funds, contracts, and time series in each layer.

[0068] In this embodiment, the present invention introduces an address identity mapping function. This achieves global node identifier unification across different on-chain addresses. It organizes the "blockchain dimension - interaction semantic dimension - time window dimension" into a three-dimensional, multi-layered dynamic graph. Each layer can be dynamically added or deleted, supporting flexible expansion at both the chain and semantic levels.

[0069] Specifically, step 102 may include the following sub-steps S21-S24:

[0070] Step S21: Classify each transaction record and generate transaction classification results;

[0071] Step S22: Perform identity mapping on the transfer addresses in each transaction record and the contract call addresses in each contract event log to generate a unified node set;

[0072] Step S23: Construct an edge set based on the unified node set and transaction classification results;

[0073] Step S24: Based on the edge set and the unified node set, construct a multi-layer dynamic graph corresponding to the unified node set.

[0074] It should be noted that transactions are categorized by interaction type (ordinary transfers, contract calls, DeFi operations, etc.), and the transaction categorization results are output, thereby further subdividing into sub-layers. Next, using methods such as hash merging, bridge contract events, and known VASP (Virtual Asset Service Provider) tags, an address identity mapping table is established based on the transfer addresses in the transaction records and the contract call addresses in the contract event logs. Thus, a unified set of nodes is obtained. All layers share a unified set of nodes. This enables a unified identity abstraction across the entire chain.

[0075] Furthermore, based on the unified node set and transaction classification results, an edge set is constructed; wherein, when constructing the edge set, the unified node set is used as the basis. Based on the transaction classification results (ordinary transfers, contract calls, DeFi operations, etc.), corresponding related edges are established for different types of transactions: In the ordinary transfer scenario, a transfer edge is built between the unified nodes of the transfer-out and transfer-in, marking the transaction amount and timestamp; In the contract call scenario, a contract call edge is built between the user node initiating the call and the contract node being called, recording the call method and parameters; In the DeFi operation scenario (such as lending), a DeFi interaction edge is built between the user node participating in the interaction and the protocol contract node, associating attributes such as operation type (lending / exchange) and asset flow direction, ultimately forming a set of edges covering multiple transaction types and carrying transaction details.

[0076] Furthermore, based on the edge set and the unified node set, a multi-layer dynamic graph corresponding to the unified node set is constructed; where, for the multi-layer dynamic graph... Definition: ,in, For layer Time window The corresponding set of edges describes the relationships between nodes (such as transfers and contract calls). Indicates the corresponding blockchain Or interactive semantic category, representing the first Target blockchain; The number of target blockchains; For time windows, it represents a sliding window of length Δ (e.g., 10 minutes or 1 block); It is the set of natural numbers.

[0077] Step 103: Use the sliding window incremental peeling algorithm to detect suspicious nodes in the unified node set based on the multi-layer dynamic graph, and generate a suspicious node set.

[0078] It should be noted that when using the sliding window incremental peeling algorithm, real-time data of the multi-layer dynamic graph is first captured according to a preset time window (e.g., 1 hour). The node association features are incrementally updated based on the detection results of the previous window (to avoid full recalculation). Then, the peeling begins from the outer layer of the network: the first round calculates the cross-layer interaction strength of the nodes (combining edge weights and cross-chain frequency of each layer), and nodes with strength below the threshold are marked as normal and peeled off. The remaining nodes enter the second round, focusing on analyzing their interaction density and time sequence patterns with high-risk contracts (e.g., known money laundering-related contracts) (e.g., rapid multi-chain jumps in a short period of time), and nodes that do not meet the suspicious characteristics are peeled off again. The above process is iterated until a core cluster is selected. The nodes in this cluster exhibit abnormal patterns such as "intensive cross-chain interaction and rapid splitting and aggregation of funds" in the multi-layer dynamic graph, ultimately forming a set of suspicious nodes.

[0079] In this embodiment, the present invention introduces a multi-layer dense subgraph identification algorithm (ML-DenseFlow). In multi-chain, multi-layer networks, an incremental dense subgraph mining algorithm based on multi-layer degree is designed to extend the traditional DenseFlow method. This algorithm can efficiently mine address subgraphs with abnormally active collaboration across multiple chains, and supports real-time processing and sliding window updates.

[0080] Specifically, step 103 may include the following sub-steps S31-S38:

[0081] Step S31: Based on the multi-layer dynamic graph, determine the edge weights of each node in the unified node set;

[0082] Step S32: Calculate the time average density corresponding to the unified node set based on the edge weights of each node in the unified node set.

[0083] Step S33: Determine whether the time average density corresponding to the unified node set reaches the preset density threshold.

[0084] Step S34: If not achieved, calculate the cross-level degree for each node in the unified node set and output the cross-level degree of each node in the unified node set.

[0085] Step S35: In the unified node set, remove the node corresponding to the smallest cross-level degree to determine a new unified node set;

[0086] Step S36: Based on the new unified node set, construct a new multi-layer dynamic graph;

[0087] Step S37: Jump to the step of determining the edge weights of each node in the unified node set based on the multi-layer dynamic graph, until the time average density of the unified node set reaches the preset density threshold.

[0088] Step S38: The unified node set determined when the time average density of the unified node set reaches the preset density threshold is taken as the suspicious node set.

[0089] It should be noted that the acquisition of edge weights requires consideration of transaction type and quantitative characteristics: In ordinary transfer scenarios, the core characteristics are transaction amount (fund size) and the number of transactions per unit time (interaction frequency), weighted according to a preset ratio (e.g., amount accounts for 60%, frequency accounts for 40%); in contract call scenarios, the focus is on the number of calls and the depth of contract interaction (e.g., parameter complexity), and a time decay factor is introduced (recent interactions have higher weight); DeFi operations additionally incorporate the scale of asset circulation and the on-chain influence of the operation (e.g., the proportion of protocol locked value). All characteristics are first normalized (eliminating dimensional differences), and then the edge weights are obtained through weighted summation to quantify the strength of the correlation between nodes. Specifically, regarding edge weights... Definition: Layer Time window Within the window, the association strength index from node i to j is calculated by weighting quantifiable features such as transfer amount (scale of fund flow) and number of contract calls (interaction frequency) (e.g., the larger the amount and the more frequent the calls, the higher the weight), representing the relationship within the window. Weighted metrics such as transfer amount and number of calls.

[0090] Furthermore, for any time window t, the calculation process for the time-averaged density corresponding to the unified node set first calculates its corresponding layer-weighted density:

[0091] ;

[0092] Where t is the sliding time window number of the current analysis (such as the t-th 10-minute window), marking the time slice of the data to adapt to the dynamic nature of blockchain transactions; L represents the unified set of nodes to be detected; L is the number of layers in the multi-layer dynamic graph, i.e., the total number of the target blockchain. For the first Layer weights; For time window t, layer Below, the set of edges within the unified set of nodes to be detected; For time window t, layer Below, the edge weights of nodes i and j are calculated by weighting features such as transfer amount, number of contract calls, and interaction frequency to quantify the strength of the association between the two nodes. for The scale (i.e.) (Number of nodes included).

[0093] Next, based on the layer-weighted density, the time-averaged density is taken for T consecutive windows, that is, the time-averaged density corresponding to the unified node set is calculated:

[0094] ;

[0095] Where T is the number of consecutive time windows; The time-averaged density corresponding to a unified set of nodes; This represents the average time density of a unified set of nodes within a time window tk.

[0096] Furthermore, upon the arrival of each new window t, the mining process... The largest subgraph (or the set of all subgraphs that satisfy the preset density threshold τ) is used to determine whether the time average density corresponding to the unified node set reaches the preset density threshold. If the time average density corresponding to the unified node set reaches the preset density threshold, then the unified node set is regarded as a suspicious node set.

[0097] Furthermore, if the temporal average density corresponding to the unified node set does not reach the preset density threshold, this invention proposes an enhancement algorithm adapted to multi-layer graphs based on the "sliding window incremental peeling" method of the Multi-Layer DenseFlow algorithm (ML-DenseFlow). This algorithm uses multi-layer degree to measure node importance and maintains a cross-layer-temporal density kernel. Specifically: it calculates the cross-layer degree of each node in the unified node set;

[0098] ;

[0099] in, For node t under time window t Cross-layer weighted degree; For time window t; For node t under time window t The weighted degree at level l; Let's consider the edge weights between nodes u and v in the l-th layer within time window t. Let be the set of edges in the l-th layer under time window t.

[0100] Furthermore, within the unified node set, iteratively remove the node with the lowest current multi-level degree (the node corresponding to the smallest cross-level degree). ,renew The process involves removing the node corresponding to the smallest cross-layer degree to obtain a new unified node set. Based on this new unified node set, a new multi-layer dynamic graph is constructed, and step S31 is executed until the time-averaged density of the unified node set reaches a preset density threshold. The unified node set determined when the time-averaged density of the unified node set reaches the preset density threshold is then used as a suspicious node set.

[0101] It's worth noting that in the peeling sequence, the subset that maximizes the weighted density is retained as the candidate dense subgraph for this window. To adapt to streaming updates, for each new window, only the degree value and peeling position of the changed nodes are locally updated, resulting in a time complexity of [missing information]. A queue is used to cache the dense sub-maps of the most recent T windows, and then the calculation is performed. And maintain the global optimum.

[0102] Step 104: Perform money laundering detection on the suspicious node set and generate high-risk cross-chain money laundering results.

[0103] It should be noted that this invention constructs a multi-dimensional risk scoring function that combines indicators such as subgraph density, cumulative transaction amount, and chain coverage, which supports scoring, ranking, and automatic alerting of identified high-risk groups, providing a basis for on-chain tracking and compliance supervision.

[0104] Specifically, step 104 may include the following sub-steps S41-S44:

[0105] Step S41: Based on the set of suspicious nodes, construct the candidate dense subgraph corresponding to the set of suspicious nodes;

[0106] It's important to note that the candidate dense subgraph construction process is as follows: First, the suspicious nodes obtained in the previous step serve as the node base for the candidate subgraph. Then, relevant edges are extracted: In the multi-layered dynamic graph, edges between these suspicious nodes (transfers, contract calls, DeFi interactions, etc.) are retained, while edges with external ordinary nodes are removed. This forms a subgraph structure, with "suspicious nodes + edges between them" as the core, resulting in a local subgraph. The final subgraph presents as a small network with "dense internal transactions." It's called a "candidate dense subgraph" because it's only a preliminary identification result; further risk scoring (steps S42–S44) is needed to confirm whether it truly belongs to a high-risk money laundering group.

[0107] Step S42: Calculate the risk score for the candidate dense subgraph and output the risk score corresponding to the candidate dense subgraph;

[0108] Step S43: Compare the risk score with the preset score threshold;

[0109] Step S44: If the risk score is greater than the preset score threshold, a high-risk cross-chain money laundering result is generated.

[0110] It should be noted that a risk score is given to the output subgraph S* (candidate dense subgraph) based on its density, funding size, and chain coverage.

[0111] ;

[0112] in, The risk score corresponding to the candidate dense subgraph; , , The weighting coefficient can be adjusted based on regulatory experience or historical cases. , , , For the full graph statistics within the window period, D represents the ratio of the number of edges to the number of nodes, and A represents the sum of funds of all transactions in the graph (total cross-chain amount). This represents the average structural density of the entire graph within the current window, and calculates the average connectivity of all nodes / subgraphs in the entire graph (representing the average density of a normal network within this time window). This represents the standard deviation of the structure density of the entire image within the current window, measuring the volatility of the overall structure density (if the density of a candidate subgraph is much higher than the average, multiple...). This indicates that it is very unusual (it may be a gang crime). This represents the average cross-chain fund size of the entire graph within the current window, and calculates the average fund flow of all transactions / subgraphs within this time window (representing the average amount of funds involved in each subgraph under normal circumstances). This represents the standard deviation of cross-chain funding volume across the entire graph within the current window, measuring the volatility of funding volume (if the funding volume of a certain subgraph is significantly higher than the average level). This indicates that it is highly likely to be a large, unusual transfer (signs of money laundering). The structural density index of candidate dense subgraphs; Candidate dense subgraph; This refers to the cumulative cross-chain funding size of the candidate dense subgraph, i.e., the cumulative cross-chain amount. , Let i be the edge weight between nodes i and j in the l-th layer within time window t. Let be the set of edges in the l-th layer under time window t; The number of target blockchains covered by the candidate dense subgraph; and the number of different chains covered by the subgraph. The total number of all target blockchains.

[0113] Furthermore, when the risk score exceeds a preset threshold, a high-risk cross-chain money laundering result is generated, and a high-risk cross-chain money laundering group alert is automatically generated. All transaction hashes, block heights, and other evidence information are archived, generating a traceable evidence package (transaction hashes, block heights, subgraph topology). If the risk score is less than or equal to the preset threshold, a high-risk cross-chain money laundering group alert is not required.

[0114] For comparison of technological effectiveness, existing technologies can be used as a reference. Early anti-money laundering technologies were mainly applied in the traditional financial sector, relying on account-level feature analysis, rule engines, or supervised learning models, which were difficult to adapt to the anonymity, decentralization, and high-frequency trading characteristics of blockchain. After entering the blockchain scenario, some research began to try to use graph structures to model on-chain transaction behavior, proposing methods based on graph mining and machine learning to detect suspicious activities.

[0115] For example, methods like FlowScope and CubeFlow model on-chain accounts and transactions as graph structures, identifying abnormal fund flow paths through subgraph feature analysis. Wu et al. used heuristic rules to trace attack fund flows in Ethereum, depicting money laundering patterns. Furthermore, some studies have attempted to identify abnormal account types (such as phishing addresses, Ponzi schemes, and fraudulent accounts) using classification models, but these often focus on individual account identification, lacking a structural characterization of "group collaboration" and "path integrity."

[0116] In the field of generalized graph mining, various anomaly detection methods have been applied to financial anti-fraud tasks: HoloScope and FRAUDAR propose to discover anomalous nodes from topological fluctuations and anti-masking structures. ANTICO and AntiBenford introduce dense subgraph analysis and distribution deviation metrics for unsupervised detection. ETTracker, in the Ethereum scenario, constructs a complete fund trajectory based on graph expansion and transfer path tracing. Although these methods provide structural modeling and unsupervised identification capabilities, they are still mainly used for single-chain, static graph structures and have not been effectively extended to inter-chain data fusion and multi-dimensional behavioral modeling.

[0117] Regarding money laundering activities in the blockchain, considering its covert nature and technical characteristics, the following three typical behavioral patterns can be summarized:

[0118] (1) Highly concentrated transaction time: Money laundering gangs complete multiple rounds of large-scale fund transfers in a short period of time, with transaction intervals significantly shorter than those of ordinary users, demonstrating obvious suddenness and intensity. This behavioral characteristic is to circumvent the real-time monitoring and risk modeling of on-chain regulatory systems, thereby achieving "rapid laundering".

[0119] (2) Tight transaction topology: There are frequent interactions between money laundering accounts, forming a highly coupled local structure (such as strongly connected subgraphs or bidirectional multilateral interactions). In contrast, the transaction connections between ordinary on-chain users are sparse and structurally dispersed, forming a stark contrast.

[0120] (3) Complex and varied inter-chain paths: Cross-chain operations have become one of the mainstream money laundering strategies. Criminals use cross-chain bridges, centralized exchanges or anonymous relay nodes to achieve rapid migration and "off-chain and back-chain" of crypto assets, forming a highly complex and difficult-to-trace hidden flow pattern of inter-chain paths.

[0121] Due to the openness and transparency of blockchain technology, historical transaction data on most mainstream public chains can be publicly accessed and collected. Based on this characteristic, existing technologies generally model blockchain transactions as interconnected directed networks, where nodes represent blockchain account addresses, and edges between nodes represent transfers, contract calls, or other interactions between addresses. Existing algorithms, such as the DenseFlow algorithm, identify high-density subgraphs with tightly structured local structures in the transaction graph to pinpoint potential money laundering paths and suspicious account groups. In existing technical solutions, especially on EVM-compatible chains like Ethereum, DenseFlow has demonstrated the effectiveness of detecting money laundering through graph mining.

[0122] Based on the above, the shortcomings of existing anti-money laundering methods can be roughly divided into six parts: 1) Lack of unified multi-chain modeling capability. Most current anti-money laundering methods focus on a single chain and cannot effectively integrate account behavior and fund flow information on multiple chains. Due to the independence of ledgers and the lack of address mapping between chains, money laundering paths are artificially fragmented between chains, seriously affecting the integrity and accuracy of overall behavior tracking. 2) Insufficient modeling of multiple relationships and semantic interactions. Real-world money laundering behavior includes not only ordinary transfers but also complex interaction types such as contract calls, decentralized exchange (DEX) operations, and liquidity migration. Most existing methods only analyze one or a few types of interaction methods, ignoring the potential correlation between behavioral semantics, leading to information gaps and misjudgment risks in suspicious behavior identification. 3) Lack of dynamic, efficient, and scalable detection mechanisms. Existing algorithms rely on static graph structures for full computation or dense subgraph search, resulting in high computational overhead and low update frequency, making them unsuitable for handling real-time, large-scale on-chain transaction flows. Especially in high-frequency trading and fast-paced asset migration scenarios, existing solutions struggle to quickly respond to and identify sudden money laundering risks. 4) High false positives and low interpretability. Existing methods mostly rely on single-chain structures and static features to construct detection rules, making it difficult to adapt to the actual behavior patterns of money laundering groups colluding across multiple chains. This results in high false positive rates and low recall rates. Furthermore, the lack of cross-layer structural evidence to support the detection results makes it difficult to provide interpretable on-chain evidence for regulatory authorities and judicial investigations. 5) Ledger segregation and relationship dilution. In multi-chain ecosystems, ledgers are separated and addresses are inconsistent across different chains. Existing anti-money laundering methods often only analyze within a single chain or a single relationship layer (such as a transfer graph), making it difficult to establish a unified view across different chains, assets, or interaction types (transfers, contract calls, DeFi operations, etc.). This leads to fragmented money laundering paths and difficulty in reconstructing hidden relationships. 6) Dense subgraph recognition algorithms cannot be directly transferred. Dense subgraph detection algorithms, as an important means of identifying money laundering group behavior, are difficult to directly transfer when faced with multi-layer graph structures. Existing algorithms suffer from significant accuracy drops and high computational complexity in multilayer networks with inconsistent interlayer structures, large differences in edge density, and high noise interference, making it difficult to meet the needs of real-time monitoring and large-scale data processing.

[0123] For the above issues, please refer to Figure 2This invention provides an anti-money laundering method, a multi-chain anti-money laundering technology based on a dense subgraph recognition algorithm for multi-layer networks. It addresses the key technical pain points of cross-chain money laundering patterns—difficulty in detection, interpretation, and real-time early warning—by employing a unified multi-layer network modeling method, a layer collaborative density index, and an efficient subgraph mining algorithm. This invention establishes a multi-layer network model by abstracting and merging multi-chain ecosystem data, extending DenseFlow to cross-chain environments. This supports real-time tracking of cross-chain money laundering behavior on EVM-compatible chains, improving the accuracy and visualization of money laundering detection. By introducing multi-layer dynamic graph modeling and a dense subgraph recognition mechanism, it achieves accurate mining and real-time early warning of cross-chain collaborative money laundering behavior. Specific objectives include: 1) Establishing a unified multi-chain multi-layer dynamic graph model. Through address identity mapping and semantic abstraction, it integrates different blockchains and various interaction relationships to construct a multi-layer dynamic graph with a three-dimensional structure of chain layer, semantic layer, and time window, providing a unified carrier for subsequent efficient analysis. 2) Design an efficient multi-layer dense subgraph identification algorithm to extend the density definition and peeling strategy in existing single-layer graphs, and to uncover suspicious address groups that are actively cooperating across multiple chains. This extends to a three-dimensional space of multi-chain, multi-type interaction, and time series, enabling real-time identification and risk quantification of complex cross-chain money laundering activities. 3) Propose an interpretable cross-chain money laundering risk scoring mechanism that integrates transaction amount, inter-chain activity, and structural characteristics to achieve quantitative assessment and automated alerts for abnormal groups.

[0124] Among them, in multi-layer diagrams In this context, the goal is to find a set of nodes. The subset satisfies at least one of the following two conditions: 1) It exhibits high density in multiple layers (i.e., the subgraph has many edges and the nodes are closely connected). 2) It has the highest density in a specified layer, satisfying a certain layer consistency.

[0125] In summary, this invention constructs a multi-layered dynamic graph structure and, through a unified address mapping mechanism, achieves integrated modeling of transaction behaviors across multiple chains, interaction types, and time periods. This solves the problem of data fragmentation between chains, significantly improves the traceability and overall path reconstruction capabilities of money laundering activities, and enhances detection accuracy. Employing a multi-layered dense subgraph mining method, it discovers multiple on-chain collaboratively active suspicious address groups, effectively identifying organized, high-frequency, and highly interconnected suspicious money laundering groups, thus improving the recall and accuracy of anomaly identification. Simultaneously, this invention employs incremental peeling and sliding window mechanisms, enabling the system to rapidly update local graph structures and mine subgraphs even in scenarios with continuously updated on-chain data. This avoids redundant calculations and full graph traversal, significantly reducing processing overhead and meeting the real-time monitoring needs of large-scale multi-chain data. Furthermore, this invention constructs a quantifiable and adjustable scoring system by combining risk assessment functions with multi-dimensional indicators such as density, amount, and chain coverage. This system supports the generation of structured evidence packages, facilitating direct use and citation by regulatory agencies in compliance audits and judicial evidence collection scenarios. It also supports parallel and multi-chain expansion, adapting to the actual deployment needs of complex multi-chain ecosystems.

[0126] In this embodiment of the invention, an anti-money laundering method is provided, which involves acquiring transaction records and contract event logs of multiple target blockchains; generating a unified node set and a corresponding multi-layer dynamic graph based on the transaction records and contract event logs of the multiple target blockchains; using a sliding window incremental peeling algorithm to detect suspicious nodes in the unified node set based on the multi-layer dynamic graph, generating a suspicious node set; performing money laundering detection on the suspicious node set, generating a high-risk cross-chain money laundering result; based on the above scheme, this invention aggregates transaction records and contract event logs of multiple target blockchains, constructs a unified node set and a multi-layer dynamic graph, then uses a sliding window incremental peeling algorithm to dynamically mine suspicious node clusters with abnormal structures in the cross-chain transaction network, and finally performs cross-chain money laundering feature verification on the suspicious clusters to output risk results. This process can avoid the omission and misjudgment of cross-chain disguise behavior by single-chain analysis, thereby improving the accuracy of money laundering detection.

[0127] Please see Figure 3 , Figure 3 This is a structural block diagram of an anti-money laundering device provided in Embodiment 2 of the present invention.

[0128] The present invention provides an anti-money laundering device, comprising:

[0129] The acquisition module 301 is used to acquire transaction records and contract event logs from multiple target blockchains;

[0130] The generation module 302 is used to generate a unified node set and a multi-layer dynamic graph corresponding to the unified node set based on the transaction records and contract event logs of multiple target blockchains.

[0131] The suspicious node detection module 303 is used to perform suspicious node detection on a unified node set based on a multi-layer dynamic graph using a sliding window incremental peeling algorithm, and generate a suspicious node set.

[0132] The money laundering detection module 304 is used to detect money laundering on a set of suspicious nodes and generate high-risk cross-chain money laundering results.

[0133] Furthermore, the generation module 302 is specifically used for:

[0134] Classify each transaction record and generate transaction classification results;

[0135] Perform identity mapping on the transfer addresses in each transaction record and the contract call addresses in each contract event log to generate a unified set of nodes;

[0136] Construct an edge set based on the unified node set and transaction classification results;

[0137] Based on the edge set and the unified node set, a multi-layer dynamic graph corresponding to the unified node set is constructed.

[0138] Furthermore, the suspicious detection module 303 is specifically used for:

[0139] Based on a multi-layer dynamic graph, determine the edge weights of each node in a unified node set;

[0140] Calculate the time average density corresponding to the unified node set based on the edge weights of each node in the unified node set;

[0141] Determine whether the time-averaged density of the unified node set reaches a preset density threshold.

[0142] If not, calculate the cross-level degree for each node in the unified node set and output the cross-level degree for each node in the unified node set.

[0143] In the unified node set, the node corresponding to the smallest cross-level degree is removed to determine a new unified node set;

[0144] A new multi-layered dynamic graph is constructed based on the new unified node set;

[0145] The jump execution is based on a multi-layer dynamic graph, which determines the edge weights of each node in a unified node set until the time average density of the unified node set reaches a preset density threshold.

[0146] The set of unified nodes that is determined when the time average density of the unified node set reaches a preset density threshold is designated as the set of suspicious nodes.

[0147] In one optional device embodiment, it further includes:

[0148] The first module is used to identify a unified node set as a suspicious node set if the time-averaged density of the unified node set reaches a preset density threshold.

[0149] Furthermore, the money laundering detection module 304 is specifically used for:

[0150] Based on the set of suspicious nodes, construct a candidate dense subgraph corresponding to the set of suspicious nodes;

[0151] Calculate the risk score for each candidate dense subgraph and output the risk score corresponding to the candidate dense subgraph.

[0152] Compare the risk score with the preset score threshold;

[0153] If the risk score is greater than the preset score threshold, a high-risk cross-chain money laundering result will be generated.

[0154] Furthermore, the calculation process for the risk score is as follows:

[0155] ;

[0156] in, The risk score corresponding to the candidate dense subgraph; , , These are the weighting coefficients; , , , Let A represent the total graph statistics within the window period, where D represents the ratio of the number of edges to the number of nodes, and A represents the sum of the funds from all transactions within the graph. This represents the average structure density of the entire graph within the current window, and calculates the average connectivity of all nodes / subgraphs in the entire graph. This represents the standard deviation of the structure density of the entire image within the current window, measuring the volatility of the structure density across the entire image. This represents the average cross-chain fund size across the entire graph within the current window, and calculates the average fund flow across all transactions / subgraphs within this time window. This represents the standard deviation of cross-chain funds within the current window, measuring the volatility of the fund size. The structural density index of candidate dense subgraphs; Candidate dense subgraph; This refers to the cumulative cross-chain funding size of the candidate dense subgraph, i.e., the cumulative cross-chain amount. , Let i be the edge weight between nodes i and j in the l-th layer within time window t. Let be the set of edges in the l-th layer under time window t; The number of target blockchains covered by the candidate dense subgraph; and the number of different chains covered by the subgraph. The total number of all target blockchains.

[0157] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described device and module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0158] This invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program; when the computer program is executed by the processor, the processor performs the steps of the anti-money laundering method as described in any of the above embodiments.

[0159] This invention also provides a computer-readable storage medium storing a computer program / instructions thereon, which, when executed by a processor, implement the steps of the anti-money laundering method as described in any of the above embodiments.

[0160] This invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the anti-money laundering method as described in any of the above embodiments.

[0161] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0162] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0163] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An anti-money laundering method, characterized in that, include: Obtain transaction records and contract event logs from multiple target blockchains; Based on the transaction records and contract event logs of multiple target blockchains, a unified node set and a multi-layer dynamic graph corresponding to the unified node set are generated. The sliding window incremental peeling algorithm is used to detect suspicious nodes in the unified node set based on the multi-layer dynamic graph, and a suspicious node set is generated. Money laundering detection is performed on the set of suspicious nodes to generate high-risk cross-chain money laundering results.

2. The anti-money laundering method according to claim 1, characterized in that, The step of generating a unified node set and a multi-layered dynamic graph corresponding to the unified node set based on transaction records and contract event logs of multiple target blockchains includes: Classify the aforementioned transaction records and generate transaction classification results; A identity mapping process is performed on the transfer addresses in each transaction record and the contract call addresses in each contract event log to generate a unified node set; Based on the unified node set and the transaction classification results, construct an edge set; Based on the edge set and the unified node set, a multi-layer dynamic graph corresponding to the unified node set is constructed.

3. The anti-money laundering method according to claim 2, characterized in that, The step of using a sliding window incremental peeling algorithm to detect suspicious nodes in the unified node set based on the multi-layer dynamic graph, and generating a suspicious node set, includes: Based on the multi-layer dynamic graph, the edge weights of each node in the unified node set are determined; Calculate the time average density corresponding to the unified node set based on the edge weights of each node in the unified node set; Determine whether the time-averaged density corresponding to the unified node set reaches a preset density threshold. If not, calculate the cross-level degree for each node in the unified node set and output the cross-level degree of each node in the unified node set. In the unified node set, the node corresponding to the smallest cross-layer degree is removed to determine a new unified node set; Based on the new unified node set, a new multi-layer dynamic graph is constructed; Jump to execute the step of determining the edge weight of each node in the unified node set based on the multi-layer dynamic graph, until the time average density of the unified node set reaches the preset density threshold. The set of unified nodes that is determined when the time average density of the unified node set reaches a preset density threshold is designated as the set of suspicious nodes.

4. The anti-money laundering method according to claim 3, characterized in that, Also includes: If the time-average density of a unified node set reaches a preset density threshold, then the unified node set is considered a suspicious node set.

5. The anti-money laundering method according to claim 1, characterized in that, The process of performing money laundering detection on the set of suspicious nodes and generating high-risk cross-chain money laundering results includes: Based on the set of suspicious nodes, construct a candidate dense subgraph corresponding to the set of suspicious nodes; Calculate the risk score for the candidate dense subgraph and output the risk score corresponding to the candidate dense subgraph; Compare the risk score with a preset score threshold; If the risk score is greater than the preset score threshold, a high-risk cross-chain money laundering result is generated.

6. The anti-money laundering method according to claim 5, characterized in that, The calculation process for the risk score is as follows: ； in, The risk score corresponding to the candidate dense subgraph; , , These are the weighting coefficients; , , , Let A represent the total graph statistics within the window period, where D represents the ratio of the number of edges to the number of nodes, and A represents the sum of the funds from all transactions within the graph. This represents the average structure density of the entire graph within the current window, and calculates the average connectivity of all nodes / subgraphs in the entire graph. This represents the standard deviation of the structure density of the entire image within the current window, measuring the volatility of the structure density across the entire image. This represents the average cross-chain fund size across the entire graph within the current window, and calculates the average fund flow across all transactions / subgraphs within this time window. This represents the standard deviation of cross-chain funds within the current window, measuring the volatility of the fund size. The structural density index of candidate dense subgraphs; Candidate dense subgraph; This refers to the cumulative cross-chain funding size of the candidate dense subgraph, i.e., the cumulative cross-chain amount. , Let i be the edge weight between nodes i and j in the l-th layer within time window t. Let be the set of edges in the l-th layer under time window t; The number of target blockchains covered by the candidate dense subgraph; and the number of different chains covered by the subgraph. The total number of all target blockchains.

7. An anti-money laundering device, characterized in that, include: The acquisition module is used to acquire transaction records and contract event logs from multiple target blockchains; The generation module is used to generate a unified node set and a multi-layer dynamic graph corresponding to the unified node set based on the transaction records and contract event logs of multiple target blockchains. The suspicious node detection module is used to perform suspicious node detection on the unified node set based on the multi-layer dynamic graph using a sliding window incremental peeling algorithm, and generate a suspicious node set. The money laundering detection module is used to perform money laundering detection on the set of suspicious nodes and generate high-risk cross-chain money laundering results.

8. A computer device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of the anti-money laundering method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the anti-money laundering method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, wherein when the program instructions are executed by a computer, the computer performs the anti-money laundering method as described in any one of claims 1-6.

Images