An account identification method and system based on entity clustering and pre-training

Abstract

This invention provides an account identification method and system based on entity clustering and pre-training. The method includes the following steps: determining the corresponding on-chain account address based on the target entity; constructing a first address set based on the addresses that interact with the on-chain account addresses on the blockchain; constructing edges between the nodes corresponding to the interacting addresses on the blockchain as nodes to obtain a network graph; inputting the network graph into a graph neural network model to obtain the embedding representation of each node in the network graph; updating the first address set based on the embedding representation of each node to obtain a second address set; acquiring transactions related to the addresses in the second address set; inputting the transaction features of each transaction into a BERT model to obtain the corresponding transaction feature matrix; and determining whether the corresponding target entity is abnormal based on the transaction feature matrix.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, and in particular to an account identification method and system based on entity clustering and pre-training. Background Technology

[0002] In recent years, blockchain technology, represented by Ethereum, has been widely adopted in numerous fields such as finance, supply chain, and the Internet of Things due to its decentralized, transparent, and immutable characteristics. Ethereum, in particular, has enabled richer and more complex decentralized applications through smart contracts, greatly expanding the application scenarios of blockchain technology. However, the anonymity and immutability of smart contracts have also made Ethereum a hotspot for illicit transactions and malicious attacks. Current mainstream technologies use graph network methods, such as Trans2Vec and I2BGNN, to construct network embeddings with addresses as nodes for abnormal account identification. These technologies have achieved some success in identifying general abnormal behavior, but they still have significant limitations in capturing entity association patterns where attackers use multiple addresses to conceal their actions.

[0003] Most existing technologies are based on address-level transaction modeling, failing to effectively capture the correlation between multiple addresses and a single entity. This results in limited identification capabilities when dealing with attackers using multiple addresses to hide their activities. Secondly, the scarcity of labeled data greatly limits the application of supervised learning methods. Existing models generally rely on small amounts of manually labeled datasets, failing to fully exploit the rich on-chain data resources and making it difficult to accurately locate abnormal users. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide an account identification method and system based on entity clustering and pre-training to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of the present invention provides an account identification method based on entity clustering and pre-training, the method comprising the steps of:

[0006] Based on the target entity, the corresponding on-chain account address is determined, and based on the addresses of the on-chain account addresses that have interactions on the blockchain, a first address set is constructed.

[0007] By using at least some addresses on the blockchain as nodes, and constructing edges between nodes corresponding to addresses that have interactions, a network graph is obtained.

[0008] The network graph is input into a graph neural network model to obtain the embedding representation of each node in the network graph. The first address set is updated based on the embedding representation of each node to obtain the second address set.

[0009] Transactions related to addresses in the second address set are obtained, and the transaction features of each transaction are input into the BERT model to obtain the corresponding transaction feature matrix. Based on the transaction feature matrix, it is determined whether the corresponding target entity is abnormal.

[0010] Adopting the above scheme, this approach first constructs an entity address relationship dataset based on the on-chain account addresses of exchanges, thereby achieving unified modeling of multiple addresses controlled by blockchain entities. Furthermore, a network graph is constructed and extended using a graph neural network model. Based on this dataset, an entity-oriented BERT training method is proposed, which can fully mine and express the transaction behavior characteristics of entities across addresses. By pre-training on large-scale unlabeled data and combining it with supervised fine-tuning using a small amount of labeled data, the model can achieve efficient and accurate identification and classification of abnormal accounts in complex and ever-changing blockchain transaction environments. This method effectively overcomes the limitations of traditional single-address-based modeling, significantly improving the accuracy and generalization ability of abnormal account detection, providing strong technical support for the secure operation of blockchain platforms, and accurately locating abnormal users.

[0011] In some embodiments of the present invention, in the step of determining whether the corresponding target entity is abnormal based on the transaction feature matrix, the transaction feature matrix is ​​input into a preset classification model, and the classification model outputs a classification result of whether the target entity is abnormal.

[0012] In some embodiments of the present invention, the graph neural network model includes multiple processing layers. In the step of inputting the network graph into the graph neural network model to obtain the embedding representation of each node in the network graph, the following formula is used in the processing of each processing layer:

[0013]

[0014] in, Layer nodes Representing nodes in a network graph Representing nodes in a network graph Indicates the first Layer nodes Embedded representation, Indicates the first Layer nodes express Layer weights This represents the ReLU activation function.

[0015] In some embodiments of the present invention, the method includes training a graph neural network model, during which a loss function is calculated using the following formula:

[0016]

[0017] in, This represents the loss function of the graph neural network model. Represents the set of positive samples. This represents the node at the final output of the graph neural network model. Embedded representation, This represents the node at the final output of the graph neural network model. Embedded representation, This indicates temperature hyperparameters. Represents the set of negative samples. The final output node of the graph neural network model Embedded representation, This represents the calculation of cosine similarity.

[0018] In some embodiments of the present invention, in the step of updating the first address set based on the embedding representation of each node to obtain the second address set, the embedding representation of each node is based on the belonging probability of each node to the target entity, and the belonging probability is used to determine whether to include the address of the node in the second address set.

[0019] In some embodiments of the present invention, in the step of representing the embedding probability of each node to the target entity based on each node's embedding, the following formula is used to calculate the probability of each node to the target entity:

[0020]

[0021] in, Represents a node target entity The probability of belonging, Let the union of the first addresses of all entities be the set of all entities. Represents the target entity The first set of addresses, This represents the node at the final output of the graph neural network model. Embedded representation, The final output node of the graph neural network model This indicates temperature hyperparameters. This represents the calculation of cosine similarity.

[0022] In some embodiments of the present invention, the method further includes training the BERT model, during which the loss function is calculated using the following formula:

[0023]

[0024] in, This represents the loss function of the BERT model. Represents the second set of addresses. This represents the node at the final output of the graph neural network model. The transpose of the embedded representation. Represents the embedding of positive sample entities. Represents the embedding of negative sample entities. This represents the set of negative samples.

[0025] In some embodiments of the present invention, in the step of obtaining transactions related to addresses in the second address set and inputting the transaction features of each transaction into the BERT model to obtain the corresponding transaction feature matrix, the transaction features of each transaction are obtained, the transaction feature vector of a transaction is obtained based on the transaction features of a transaction, and the transaction feature vectors are combined to obtain the transaction feature matrix.

[0026] In some embodiments of the present invention, in the step of obtaining the transaction characteristics of each transaction, the transaction characteristics include the transacted entity, transaction direction, transaction type, currency type, transaction quantity, block height, and location index.

[0027] A second aspect of the present invention also provides an account recognition system based on entity clustering and pre-training, the system comprising a computer device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions stored in the memory, and the system implementing the steps of the method described above when the computer instructions are executed by the processor.

[0028] A third aspect of the invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned account identification method based on entity clustering and pre-training.

[0029] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the text, or may be learned by practice of the invention. The objects and other advantages of the invention will become apparent from the description and the accompanying drawings.

[0030] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0031] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to limit the scope of the invention.

[0032] Figure 1 This is a schematic diagram illustrating one implementation of the account identification method based on entity clustering and pre-training in this scheme;

[0033] Figure 2 This is a schematic diagram illustrating the processing of the BERT model in this scheme. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0035] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0036] In existing technologies, one proposed a novel network embedding algorithm, Trans2Vec, which extracts address features to calculate the corresponding network embedding representation and uses a single-class support vector machine to classify nodes into normal accounts and phishing accounts. Another proposed a general end-to-end graph neural network model, I2BGNN, which can accept subgraphs as input and learn a function that maps transaction subgraph patterns to account identities, classifying accounts into normal accounts, phishing accounts, and bot accounts based on the inferred identity. A third proposed modeling Ethereum transaction records as a complex network by combining transaction time and amount features, and designing various flexible time-walk strategies for the random walk-based graph representation of this large-scale network. A fourth proposed a graph neural network, TTAGNN, which integrates multiple time edges, using an LSTM network to model the time edges and learning node embedding representations through a graph attention network for phishing account identification. A fifth proposed a novel detection model called PGDetector, optimized using a genetic algorithm, which can use a risky phishing account as a seed to discover potential risky accounts closely related to the seed account within the community. Existing technology six proposes an end-to-end graph neural network framework called Ethident, which uses a hierarchical graph attention encoder as the core of the framework to effectively extract account features at the node level and behavioral patterns at the subgraph level, thereby achieving account deanonymization. Existing technology seven proposes BERT4ETH, a general pre-trained Transformer encoder that leverages the powerful modeling capabilities of the Transformer to capture the dynamic sequence patterns inherent in Ethereum transactions, thereby detecting various fraudulent activities on Ethereum.

[0037] like Figure 1 As shown, this invention proposes an account recognition method based on entity clustering and pre-training. The steps of this method include:

[0038] Step S100: Determine the corresponding on-chain account address based on the target entity, and construct a first address set based on the addresses that interact with the on-chain account address on the blockchain;

[0039] In some embodiments of this invention, the on-chain account address is an address created by the exchange for the user. In the blockchain ecosystem, the exchange, as the core bridge between on-chain and off-chain, plays a crucial role in asset management and circulation. Assuming there is a user... Once an account is registered on an exchange, the exchange will create an on-chain account address for that user, denoted as [address name missing]. , indicating the exchange For users The private key of the created on-chain account is kept by the exchange, while the exchange will also create an off-chain internal exchange account for the user.

[0040] If user To exchange a certain amount of on-chain assets, users must first conduct a C2C (Customer-to-Customer) transaction to exchange real-world assets of equal value for crypto assets. Specifically, users... It depends on the seller The provided payment method transfers an equivalent value of fiat currency from the buyer's off-chain account to the seller's off-chain asset account. After the buyer completes the off-chain transfer, the exchange will transfer the tokens from the seller's internal exchange account to the buyer's internal exchange account off-chain.

[0041] On the blockchain, each user can create any number of addresses; this scheme uses... Indicates user The first set of addresses possessed, in which Indicates the user's first An on-chain address. If a user needs to transfer assets from their on-chain account on the exchange... Transferred to an on-chain account address held by an individual. In this case, a withdrawal request needs to be initiated through the exchange. The exchange maintains a set of on-chain hot wallet addresses for frequent fund transfers, denoted as... ,in Indicates the first A hot wallet address will be selected based on the exchange's internal policy after the exchange verifies the user's withdrawal request. And transfer the user's requested assets from that address to Simultaneously, the corresponding balance is deducted from the user's internal exchange account. At this point, the user has completed the transfer process from off-chain assets to on-chain assets.

[0042] If a user wants to access their blockchain address To deposit funds into an exchange, the tokens need to be transferred from this address to the exchange's on-chain account address. Once the exchange detects this on-chain transfer, it will correspondingly increase the user's internal exchange account balance. Because... The private key is held in escrow by the exchange, but the assets are actually controlled by the exchange. Therefore, the exchange will periodically transfer assets from this address to a designated hot wallet address according to its internal fund management strategy. The value of j is dynamically determined by the exchange's strategy.

[0043] The reason why exchanges don't directly transfer assets from the seller's on-chain exchange account address Transfer to the buyer's on-chain address Instead of transferring assets directly to the buyer's internal exchange account, the funds are first transferred to the buyer's account. This is primarily based on the following considerations: Firstly, C2C transactions are frequent, and completing each transaction via on-chain transfer would incur high gas fees. Transferring assets through the exchange's internal account system significantly reduces transaction costs. Secondly, users typically exchange different types of on-chain assets frequently within the exchange. Continuously synchronizing assets from the exchange's internal account to the exchange would be necessary. Or, asset alignment and management will also bring a lot of on-chain operations and additional overhead.

[0044] While saving costs, this mechanism also creates a unique account address characteristic. When most private on-chain account addresses conduct withdrawal operations, they typically transfer assets to their corresponding exchange on-chain account addresses. Although a user may have multiple on-chain account addresses, these addresses all send data to the same address. A transaction is sent, but other users' on-chain addresses will not initiate transfers to that address. Furthermore, The assets in the exchange will be periodically transferred to a specific hot wallet address on the exchange. Above. Apart from the exchange's cold wallet address, no other address will transfer funds to this hot wallet address. Based on this characteristic, the publicly available hot wallet addresses of various exchanges can be used to identify all users' on-chain exchange account addresses, and then infer the on-chain private account address corresponding to each exchange on-chain account address, thereby establishing a correspondence between on-chain private account addresses and individual users. Therefore, this scheme treats each user as an entity, constructing an entity-address relationship dataset containing the set of on-chain addresses actually controlled by each account.

[0045] Step S200: Using at least some addresses on the blockchain as nodes, construct edges between nodes corresponding to addresses that have interactions to obtain a network graph;

[0046] In the specific implementation process, at least some addresses on the blockchain are used as nodes. The selected addresses can be a preset partial address or all of the addresses.

[0047] Step S300: Input the network graph into the graph neural network model to obtain the embedding representation of each node in the network graph, and update the first address set based on the embedding representation of each node to obtain the second address set;

[0048] Step S400: Obtain transactions related to addresses in the second address set, input the transaction features of each transaction into the BERT model to obtain the corresponding transaction feature matrix, and determine whether the corresponding target entity is abnormal based on the transaction feature matrix.

[0049] In its implementation, this solution addresses the lack of effective early warning for attacks on blockchain platforms. By aggregating addresses in the blockchain, it reduces network complexity and aggregates address features to the entity dimension. Simultaneously, it proposes a malicious account identification method based on entity dimension pre-training, which deeply mines the transaction logic and behavioral patterns of entities, demonstrating stronger robustness in different downstream tasks of malicious account identification.

[0050] Adopting the above scheme, this approach first constructs an entity address relationship dataset based on the on-chain account addresses of exchanges, thereby achieving unified modeling of multiple addresses controlled by blockchain entities. Furthermore, a network graph is constructed and extended using a graph neural network model. Based on this dataset, an entity-oriented BERT training method is proposed, which can fully mine and express the transaction behavior characteristics of entities across addresses. By pre-training on large-scale unlabeled data and combining it with supervised fine-tuning using a small amount of labeled data, the model can achieve efficient and accurate identification and classification of abnormal accounts in complex and ever-changing blockchain transaction environments. This method effectively overcomes the limitations of traditional single-address-based modeling, significantly improving the accuracy and generalization ability of abnormal account detection, providing strong technical support for the secure operation of blockchain platforms, and accurately locating abnormal users.

[0051] In some embodiments of the present invention, in the step of determining whether the corresponding target entity is abnormal based on the transaction feature matrix, the transaction feature matrix is ​​input into a preset classification model, and the classification model outputs a classification result of whether the target entity is abnormal.

[0052] In some embodiments of the present invention, the graph neural network model includes multiple processing layers, and three processing layers can be used. In this scheme, after three layers of propagation, the final embedded representation of each node is obtained.

[0053] In the step of inputting the network graph into the graph neural network model to obtain the embedding representation of each node in the network graph, the following formula is used in the processing of each processing layer:

[0054]

[0055] in, Layer nodes Representing nodes in a network graph Representing nodes in a network graph Indicates the first Layer nodes Embedded representation, Indicates the first Layer nodes express Layer weights This represents the ReLU activation function.

[0056] In the specific implementation process, the graph neural network model adopted is the GraphSAGE graph neural network model;

[0057] In practical applications, some users may not strictly adhere to this pattern due to security considerations such as privacy protection and anti-Syrian attack. This results in the entity-address relationship dataset constructed using rule-based methods only covering a portion of the entity address relationships in the on-chain address space, leading to some degree of missing labels and insufficient coverage. To further improve the comprehensiveness and accuracy of entity attribution, and thus more fully understand and model the real transaction behavior of entities in subsequent model training, this method proposes using the GraphSAGE graph neural network model for semi-supervised learning of the uncovered on-chain addresses. The aim is to utilize the constructed partial entity-address labels as supervisory signals, combined with the node's own behavioral characteristics and graph structure relationships, through multi-layer information aggregation and embedding comparison optimization, to automatically mine and expand more addresses actually controlled by entities.

[0058] Given the extremely large scale of the entire blockchain data, this method extracts a large amount of node transaction data from the publicly available and transparent data on the ETH chain, and constructs a network graph based on this data. ,in It is a set of nodes, representing all accounts in the network. The set of edges represents all transactions in the network. For each address in the address graph, this method extracts multi-dimensional behavioral features and concatenates them to form a node feature vector: 1. Count the amount of all related transactions of the address, divide the amount range into 10 bins, and count the number of transactions or the total amount in each bin; 2. Count the number of transactions that occurred at the address every hour of the day; 3. Count the number of addresses that the address has independently interacted with in all historical transactions; 4. Count the frequency or proportion of different transaction types in all transactions of the address, and use one-hot encoding; 5. Count the types of mainstream tokens involved in all transactions of the address, and use one-hot encoding; 6. Count the number of transactions or the total amount of transactions in which the address is the initiator and receiver, and normalize them; 7. Take the mean, maximum, minimum, and standard deviation of the block height of all transactions of the address and normalize them; 8. Take the mean, maximum, minimum, and standard deviation of the timestamps of all transactions of the address and normalize them. Finally, the feature vector of each node is obtained. , This represents the total dimension after concatenating all features.

[0059] In some embodiments of the present invention, the method includes training a graph neural network model, during which a loss function is calculated using the following formula:

[0060]

[0061] in, This represents the loss function of the graph neural network model. Represents the set of positive samples. This represents the node at the final output of the graph neural network model. Embedded representation, This represents the node at the final output of the graph neural network model. Embedded representation, This indicates temperature hyperparameters. Represents the set of negative samples. The final output node of the graph neural network model Embedded representation, Represents the calculation of cosine similarity. This represents an exponential function.

[0062] In some embodiments of the present invention, in the step of updating the first address set based on the embedding representation of each node to obtain the second address set, the embedding representation of each node is based on the belonging probability of each node to the target entity, and the belonging probability is used to determine whether to include the address of the node in the second address set.

[0063] In some embodiments of the present invention, in the step of representing the embedding probability of each node to the target entity based on each node's embedding, the following formula is used to calculate the probability of each node to the target entity:

[0064]

[0065] in, Represents a node target entity The probability of belonging, Let the union of the first addresses of all entities be the set of all entities. Represents the target entity The first set of addresses, This represents the node at the final output of the graph neural network model. Embedded representation, The final output node of the graph neural network model This indicates temperature hyperparameters. This represents the calculation of cosine similarity.

[0066] Using the above scheme, considering that the main objective of this stage is to categorize addresses potentially controlled by the same entity, nodes that still do not belong to any entity after the above steps are treated as separate new entities. After the model expansion described above, this method yields a new entity-address relationship dataset.

[0067] In some embodiments of the present invention, the method further includes training the BERT model, during which the loss function is calculated using the following formula:

[0068]

[0069] in, This represents the loss function of the BERT model. Represents the second set of addresses. This represents the node at the final output of the graph neural network model. The transpose of the embedded representation. Represents the embedding of positive sample entities. Represents the embedding of negative sample entities. This represents the set of negative samples.

[0070] To reduce the number of model parameters and improve training efficiency, the entity embedding layer shares parameters during positive and negative sample computation. The optimization objective of this loss function is to maximize the similarity between the contextual representation of the masked transaction and its true entity embedding in the latent space, while minimizing its similarity with the negative sample entity embedding. This effectively improves the model's ability to distinguish entity semantics and its generalization capabilities. Negative sample entities originate from publicly available phishing address datasets; these datasets are aggregated with entity account datasets to obtain malicious entities.

[0071] After completing the pre-training described above, the model is able to fully learn and capture the transaction behavior characteristics of entities. Based on this, the model can be further fine-tuned using publicly available malicious account datasets to adapt to specific downstream tasks. For example, in phishing attack detection tasks, entities labeled as phishing accounts are used as positive samples, and ordinary entities as negative samples. Their respective aggregated transaction sequences are input, and the model's classification layer is trained using the cross-entropy loss function, enabling it to distinguish between malicious and legitimate accounts. Through the organic combination of pre-training and fine-tuning, the model can effectively identify malicious accounts in constantly evolving attack methods and complex and ever-changing blockchain environments.

[0072] like Figure 2As shown, in some embodiments of the present invention, in the step of obtaining transactions related to addresses in the second address set and inputting the transaction features of each transaction into the BERT model to obtain the corresponding transaction feature matrix, the transaction features of each transaction are obtained, the transaction feature vector of a transaction is obtained based on the transaction features of a transaction, and the transaction feature vectors are combined to obtain the transaction feature matrix.

[0073] After obtaining the corresponding set of transactions associated with the addresses in the second address set, the BERT model is used to train the previously extracted transaction data. For any edge in the network graph... ,use Indicates the type of token in the transaction, Indicates the number of tokens traded. Indicates the block height at which the transaction occurred. and This indicates the initiator and receiver of the transaction. For each entity... Obtain the set of addresses controlled by the entity from the entity account dataset. , and then from Filter out all entities Related transactions, sorted by time, are defined as follows: To achieve address normalization, a unique virtual address identifier is assigned to each entity. Every transaction Perform the following replacement operation:

[0074] like Then let

[0075] like Then let

[0076] in This is a hash mapping function. After the above changes, the entity... Transactions from all addresses are treated as transactions initiated or received by the same address, thus aggregating transaction behavior. To adapt the aggregated transaction sequence to the input of the Transformer model, such as... Figure 1 As shown, this article focuses on Each transaction generates seven features: 1) Entity 1) The transaction entity; 2) Transaction direction, using 0 and 1 to represent transfer in and transfer out; 3) Transaction type, mainly distinguishing between transfer and contract call; 4) Currency type, assigning a unique category number to each major currency; 5) Transaction quantity, discretized into category features using binning; 6) Block height, reflecting the block information where the transaction occurred; 7) Location index, ordered from... arrive Numbering is performed. In the feature encoding stage, this method uses embedding techniques to vectorize the above features, which are then used as transaction entities. The feature embedding, where Indicates transaction Zhongyu The entity of the transaction. This feature is then embedded with... The initial input embedding is obtained by summing the entity embeddings element by element. .Will Perform the above processing on each transaction to obtain the initial representation matrix of the transaction sequence. :

[0077]

[0078] This will be used as input to the Transformer model. The Transformer's structure consists of an attention mechanism plus a feedforward neural network, where the self-attention mechanism is as follows:

[0079]

[0080]

[0081] , , The first The query, key, and value mapping parameter matrix of the layer. For feature dimensions. The feedforward neural network is:

[0082]

[0083]

[0084] in, and for The weights and bias parameters, This is the activation function. Because the Transformer has a maximum limit on the length of the input sequence, it is denoted as... If the number of transactions of a certain entity If the limit is exceeded, a sliding window strategy is used for processing. Specifically, the sliding window strategy is implemented based on the window length. The algorithm extracts a continuous subsequence from the transaction sequence as input, and slides one position at a time until all transactions are covered. That is, for the ... A window with the following input:

[0085]

[0086] If the number of transactions for a certain entity is less than the maximum length limit, null values ​​are added to the end of the sequence to ensure consistent input length and facilitate batch processing.

[0087] In the model pre-training phase, this paper employs the MAP task. This task is essentially a cloze test, requiring the model to predict the masked address based on contextual information from a transaction sequence. For example... Figure 1 As shown, in the framework proposed in this paper, a portion of the transactions in the sequence are randomly selected and replaced with a special marker [MASK] to form a masked transaction sequence. This sequence is then input into the aforementioned feature embedding layer and Transformer structure for encoding and modeling.

[0088] For each masked transaction Its final representation is ,in This is the final layer of the Transformer, incorporating rich bidirectional contextual information to predict the masked transaction content at that location. It is calculated using the entire vocabulary, unlike the original BERT. Unlike predicting the masked words, this method is not feasible in the Ethereum context. The main reason is that the Ethereum address space is extremely large, with potentially billions of addresses, resulting in extremely high computational complexity and difficulty in convergence.

[0089] In some embodiments of the present invention, in the step of obtaining the transaction characteristics of each transaction, the transaction characteristics include the transacted entity, transaction direction, transaction type, currency type, transaction quantity, block height, and location index.

[0090] Specifically, the transaction includes: 1. Transaction entity, the entity being traded in the transaction; 2. Transaction direction, using 0 and 1 to represent transfer in and transfer out; 3. Transaction type, primarily distinguishing between transfers and contract calls; 4. Currency type, assigning a unique category number to each major currency; 5. Transaction quantity, discretized into category features using binning; 6. Block height, reflecting the block information where the transaction occurred; and 7. Location index, ordered from... arrive Number them.

[0091] This invention also provides an account recognition system based on entity clustering and pre-training. The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0092] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned account identification method based on entity clustering and pre-training. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the art.

[0093] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0094] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0095] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0096] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An account recognition method based on entity clustering and pre-training, characterized in that, The steps of this method include: Based on the target entity, the corresponding on-chain account address is determined, and based on the addresses of the on-chain account addresses that have interactions on the blockchain, a first address set is constructed. By using at least some addresses on the blockchain as nodes, and constructing edges between nodes corresponding to addresses that have interactions, a network graph is obtained. The network graph is input into a graph neural network model to obtain the embedding representation of each node in the network graph. The first address set is updated based on the embedding representation of each node to obtain the second address set. Based on the embedding representation of each node and the probability of each node belonging to the target entity, the probability of each node belonging to the target entity is calculated using the following formula: in, Represents a node For the target entity The probability of belonging, Let the union of the first addresses of all entities be the set of all entities. Represents the target entity The first set of addresses, This represents the node at the final output of the graph neural network model. Embedded representation, The final output node of the graph neural network model Embedded representation, This indicates temperature hyperparameters. Represents the calculation of cosine similarity; Based on the attribution probability, determine whether to include the node's address in the second address set; Transactions related to addresses in the second address set are obtained, and the transaction features of each transaction are input into the BERT model to obtain the corresponding transaction feature matrix. Based on the transaction feature matrix, it is determined whether the corresponding target entity is abnormal.

2. The account identification method based on entity clustering and pre-training according to claim 1, characterized in that, In the step of determining whether the corresponding target entity is abnormal based on the transaction feature matrix, the transaction feature matrix is ​​input into a pre-set classification model, and the classification model outputs the classification result of whether the target entity is abnormal.

3. The account identification method based on entity clustering and pre-training according to claim 2, characterized in that, The graph neural network model includes multiple processing layers. In the step of inputting the network graph into the graph neural network model to obtain the embedding representation of each node in the network graph, the following formula is used in the processing of each processing layer: in, Indicates the first Layer nodes Embedded representation, Representing nodes in a network graph The set of neighboring nodes, Representing nodes in a network graph The neighboring nodes, Indicates the first Layer nodes Embedded representation, Indicates the first Layer nodes Embedded representation, express Layer weights, This represents the ReLU activation function.

4. The account identification method based on entity clustering and pre-training according to claim 3, characterized in that, The method includes training a graph neural network model, during which the loss function is calculated using the following formula: in, This represents the loss function of the graph neural network model. Represents the set of positive samples. This represents the node at the final output of the graph neural network model. Embedded representation, This represents the node at the final output of the graph neural network model. Embedded representation, This indicates temperature hyperparameters. Represents the set of negative samples. The final output node of the graph neural network model Embedded representation, This represents the calculation of cosine similarity.

5. The account identification method based on entity clustering and pre-training according to claim 1, characterized in that, The method further includes training the BERT model, during which the loss function is calculated using the following formula: in, This represents the loss function of the BERT model. Represents the second set of addresses. This represents the node at the final output of the graph neural network model. The transpose of the embedded representation. Represents the embedding of positive sample entities. Represents the embedding of negative sample entities. This represents the set of negative samples.

6. The account identification method based on entity clustering and pre-training according to claim 1, characterized in that, In the step of obtaining transactions related to addresses in the second address set and inputting the transaction features of each transaction into the BERT model to obtain the corresponding transaction feature matrix, the transaction features of each transaction are obtained, the transaction feature vector of a transaction is obtained based on the transaction features of a transaction, and the transaction feature vectors are combined to obtain the transaction feature matrix.

7. The account identification method based on entity clustering and pre-training according to claim 6, characterized in that, In the step of obtaining the transaction characteristics of each transaction, the transaction characteristics include the transaction entity, transaction direction, transaction type, currency type, transaction quantity, block height, and location index.

8. An account recognition system based on entity clustering and pre-training, characterized in that, The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method as described in any one of claims 1 to 7.

Images