Sybil attack detection method based on machine learning in block chain

Abstract

The invention discloses a Sybil attack detection method based on machine learning in a block chain, and the method specifically comprises the steps: constructing a fixed-length binary code based on a time behavior sequence of an address, and fusing a Hamming distance, a global frequency difference and a local segmentation frequency difference, designing a customized distance measurement algorithm for measuring address time behavior similarity; an interaction sequence of the address and the block chain protocol is regarded as text data, and saliency features used by the protocol are extracted by adopting a word frequency-inverse document frequency technology; and a multi-stage density clustering model is constructed, and automatic clustering and identification of suspected Sybil addresses are realized. Compared with the prior art, the method has the advantages that the user-defined distance measurement and text feature modeling method is introduced, the accuracy and robustness of Sybil address recognition are effectively improved, the attack implementation difficulty is increased, the defense capability of a block chain system to Sybil attacks is enhanced, a new technical path is provided for on-chain security governance, and the method is worthy of popularization and application. The method has high practical value and wide popularization prospect.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of blockchain security technology, and more particularly to a method for detecting Sybil attacks based on machine learning in a cross-chain transaction scenario of a blockchain system. BACKGROUND

[0002] As a rapidly developing decentralized technology system in recent years, blockchain has been widely applied in various fields such as finance, supply chain management, social networks, etc., especially in the decentralized finance (DeFi) scenario. According to public data, as of October 2024, the total locked value (TVL) of DeFi protocols in various blockchain networks worldwide has reached approximately $8.4318 billion, with the TVL of 168 blockchains exceeding $1 million. By providing decentralized lending, trading, asset management, and other services, DeFi platforms are reshaping the operation mode and value transfer mechanism of the traditional financial system. To promote the early development of blockchain projects and encourage user participation, many project parties commonly use the "airdrop" mechanism, which involves free distribution of a certain number of tokens to users as an incentive. However, this incentive mechanism has also been exploited by malicious actors, leading to the so-called "Sybil Attack" problem.

[0003] Sybil Attack generally refers to a single adversary creating and manipulating multiple fake identities (such as nodes or wallet addresses) to gain disproportionate influence or benefits in the system. In the blockchain environment, with the widespread application of the airdrop incentive mechanism, Sybil Attack has evolved into an attack where attackers massively fake wallet addresses and simulate normal user behavior to complete tasks and receive airdrop rewards. This type of attack not only undermines the original fairness of the incentive mechanism, leading to an imbalance in resource allocation, but also distorts on-chain data and wastes network resources, further threatening the healthy development of the entire ecosystem. Especially in the current context of frequent cross-chain transactions, the concealment and scale of such attacks have become increasingly prominent, posing serious challenges to system governance.

[0004] To address the above problems, the current mainstream defense mechanisms mainly rely on the constraints of consensus mechanisms on identity generation capabilities, such as Proof of Work (PoW) and Proof of Stake (PoS). PoW increases the cost of creating malicious identities by introducing computational resource consumption, while PoS requires users to stake certain assets, thereby limiting the risk of identity abuse. In addition, some systems introduce hybrid consensus mechanisms, reputation scoring systems, delay behavior analysis, biometric authentication, and other methods to improve the ability to identify and defend against Sybil attacks.

[0005] In summary, the existing witch attack defense mechanism in the prior art still has many deficiencies in privacy protection, identification efficiency and system compatibility, and generally has problems such as large computational resource overhead, insufficient user privacy protection, limited application scope, and non-transparent verification process. When facing large-scale and diversified user behaviors in cross-chain transaction environments, the recognition accuracy and system scalability still have a large room for improvement. Therefore, it is urgent to propose a new method that can balance anonymity, fairness, scalability and high recognition accuracy to effectively identify and manage witch behaviors in cross-chain transaction scenarios, thereby enhancing the security and trust foundation of the blockchain system. SUMMARY

[0006] The purpose of the present application is to provide a machine learning-based witch attack detection method in a blockchain to address the deficiencies of the prior art. The method uses a multi-dimensional behavior feature modeling and multi-stage density clustering method to automatically cluster and identify suspected witch addresses, effectively improving the fairness and security of the airdrop incentive mechanism in the blockchain system. The method constructs a fixed-length binary code based on the time behavior sequence of the address, fuses the Hamming distance, global frequency difference and local segment frequency difference, and designs a customized distance measurement algorithm to measure the similarity of the address time behavior. The interaction sequence of the address and the blockchain protocol is treated as text data, and the term frequency-inverse document frequency (TF-IDF) technique is used to extract the salient features of the protocol usage, taking into account the protocol usage frequency and discrimination ability. The present application introduces a custom distance measurement and text feature modeling method in the cross-chain transaction scenario of the blockchain system, designs a novel and lightweight identification mechanism that ensures system openness and user anonymity while effectively identifying witch attacks and supporting multi-party verifiability, effectively improving the accuracy and robustness of witch address identification, increasing the difficulty of attack implementation, enhancing the defense capabilities of the blockchain system against witch attacks, providing a new technical path for on-chain security governance, and having high practical value and broad application prospects.

[0007] The technical solution of the present application is: a machine learning-based cross-chain witch attack detection method, characterized in that the method specifically includes:

[0008] Step S1: Cross-chain transaction data acquisition

[0009] Collect cross-chain transaction metadata within a specified time range, including but not limited to: source chain, source chain transaction hash, source chain contract address, sender wallet address, associated protocol, source chain timestamp (UTC), etc.

[0010] Step S2: Feature correlation analysis

[0011] Based on the existing attack feature knowledge base or historical experience, the collected cross-chain metadata is preliminarily analyzed to evaluate the correlation between various transaction features and whether the address is a Sybil address.

[0012] Step S3: Data preprocessing

[0013] The metadata includes: removing addresses with too low transaction frequency or no behavior significance, removing redundant features not directly related to Sybil attacks, and abstracting part of the features for subsequent processing.

[0014] Step S4: Preliminary dimensionality reduction clustering

[0015] Based on the feature data after preliminary cleaning, the first clustering operation is performed to reduce the data size and computational load in subsequent high-complexity calculations.

[0016] Step S5: Introducing time behavior distance

[0017] Based on the transaction behavior time series of the address, a custom Cross-Sybil distance metric is introduced to capture the similarity of transaction patterns in the time dimension.

[0018] Step S6: Behavior pattern refinement clustering

[0019] Use Cross-Sybil distance to refine the preliminary clustering results, re-group addresses with similar transaction behavior, and improve clustering accuracy.

[0020] Step S7: High-dimensional unstructured feature modeling

[0021] Use text mining methods (such as TF-IDF, word vector modeling) to extract semantic features and vectorize discrete text features with long-tail distribution such as protocol usage.

[0022] Step S8: Final clustering of fused features

[0023] Fuse different behavior features and semantic protocol features, perform a final round of density clustering operation, and get high-confidence clustering results of potential Sybil addresses.

[0024] Step S9: Result evaluation and model iteration

[0025] Evaluate the final clustering results, combine labeled data or anomaly detection indicators to perform reverse verification and parameter fine-tuning on the model, and improve recognition accuracy.

[0026] The cross-chain transaction data acquisition of step S1 is the basis for subsequent identification of the witch address behavior. Specifically, the system collects multiple cross-chain transaction records covering a set time range, and extracts the following 11 key feature fields for each transaction:

[0027] 1) Source_Chain: the blockchain where the transaction originated, indicating the sending location of the funds;

[0028] 2) Source_Tx_Hash: the hash value on the source chain that uniquely identifies the transaction, used to accurately retrieve complete transaction information;

[0029] 3) Source_Contract: the smart contract address on the source chain that initiated the transaction, usually called by the sender;

[0030] 4) Destination_Chain: the blockchain where the funds were received, indicating the final inflow location of the funds; 5) Destination_Tx_Hash: the hash value recorded on the target chain for the transaction, used

[0031] to correspond to the receiving end transaction record;

[0032] 6) Destination_Contract: the smart contract address on the target chain that received the transaction, usually called by the recipient;

[0033] 7) Sender_Wallet: the user address that initiated the cross-chain transaction;

[0034] 8) Source_Timestamp_UTC: the UTC timestamp of the transaction recorded on the source chain, indicating the time of the transaction;

[0035] 9) Project: the blockchain protocol or application name involved in processing or initiating the transaction;

[0036] 10) Native_Drop_USD: the number of native tokens issued in the transaction, priced in USD;

[0037] 11) Stargate_Swap_USD: the value of tokens exchanged through the Stargate cross-chain protocol (USD).

[0038] The above 11 initial features constitute the basic description information of each cross-chain transaction, and each transaction data includes the above fields. Since the same address may participate in multiple transactions, for each address, all its associated transaction records will be collected to facilitate subsequent aggregation analysis, pattern recognition and anomaly detection in the time dimension and behavior feature level.

[0039] The step S2 performs feature correlation analysis on the collected cross-chain transaction metadata. Based on the existing knowledge base of witch attack behavior characteristics and historical attack samples, the analysis evaluates the role of the information carried by each field to determine the potential correlation between the field and the witch address. Among them, the field source chain transaction hash (Source_Tx_Hash) and the target chain transaction hash (Destination_Tx_Hash) are only used to identify specific cross-chain transaction records and do not carry effective information for behavior modeling at the semantic level, so they are not used as a basis for judgment in this analysis. According to existing attack behavior research, a group of witch addresses controlled by the same attacker usually exhibit highly similar behavior characteristics. For example, a batch of addresses may initiate transactions using the same blockchain protocol, target chain, and transaction amount within a similar time period or fixed time interval. Although some witch attack behaviors tend to be complex and concealed as attack methods continue to evolve, the remaining nine feature fields (including source chain, target chain, contract address, timestamp, protocol name, airdrop value, etc.) still have high analysis value in attacker behavior modeling. Therefore, in the subsequent steps, modeling and clustering analysis will focus on these nine types of features.

[0040] The step S3 performs preliminary cleaning on the obtained cross-chain transaction metadata, which is based on the feature correlation analysis completed in step S2 and mainly includes the following three aspects: 1) redundant feature elimination: by evaluating the correlation between the transaction field and the witch attack behavior, it is determined that the field source chain transaction hash (Source_Tx_Hash) and the target chain transaction hash (Destination_Tx_Hash) do not have modeling value, so they are removed from the feature set in this step to reduce computational redundancy; 2) low active address filtering: referring to the setting standards of several blockchain project parties on empty investment grids, combined with empirical analysis results, the lower limit threshold of transaction frequency is set to six transactions. Any address below this threshold will be judged as having insufficient transaction activity, which usually cannot constitute an effective attack threat, and thus is filtered in the preprocessing stage to avoid interference with the subsequent identification process; 3) feature abstraction and standardization processing: for the remaining addresses, structural feature variables highly related to witch behavior are extracted, including but not limited to: the number of transactions corresponding to the address, the first transaction time (used to infer whether it is a centralized registration address), the number of blockchains involved (reflecting the inter-chain activity of the address), etc. The above features can be used to reflect the behavior similarity of the witch address in the time and space dimensions, and have good discrimination and dimension reduction characteristics. In order to adapt to the input requirements of the subsequent clustering model, all numerical fields will be normalized or standardized to ensure comparability between feature dimensions.

[0041] The step S4 performs a first clustering operation based on the abstracted structured feature data, aiming to preliminarily divide the large-scale address set to significantly reduce the computational overhead and memory load in the subsequent high-complexity feature processing process. In this and subsequent stages, the HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise) algorithm is used as the clustering method. This algorithm takes density as the core clustering basis and has the following advantages: only the minimum density threshold parameter (MinPts) needs to be set, without the need to predefine the number of clusters; it can automatically identify clusters of any shape; it has good adaptability to scenarios with large differences in the number of samples between clusters, large number of clusters, and a large number of noise points, which is suitable for the uneven distribution characteristics between clusters commonly found in witch address identification scenarios. To maximize the preservation of potential attack address clustering associations, the MinPts parameter is deliberately set to a low value during the clustering process in this stage, thereby relaxing the clustering conditions to reduce the risk of incorrectly dividing addresses controlled by the same attacker into different clusters. This strategy can improve the recall rate in preliminary clustering and lay the foundation for more detailed feature description and behavior modeling in the subsequent stages.

[0042] Step S5 introduces a distance metric to measure the behavioral similarity of addresses over time. Temporal behavioral characteristics play a crucial role in identifying addresses targeted by Sybil attacks. However, traditional distance metrics (such as Euclidean distance, Manhattan distance, and cosine similarity) often fail to capture the deep-seated behavioral commonalities and patterns of change when dealing with discrete transaction patterns in time series. Therefore, this invention proposes a Cross-Sybil distance metric to quantify the similarity of different addresses in temporal behavior. This method is based on Hamming distance and combines it with global frequency distance and grouped frequency distance to form a weighted composite distance model, thereby improving the model's ability to characterize behavioral similarity.

[0043] Hamming distance is defined as follows: Assume the temporal behavior of each address is encoded as a binary string of length n, where each bit corresponds to the activity status of a month (1 indicates a transaction occurred in that month, 0 indicates no transaction). Then the Hamming distance between addresses x and y is defined by the following formula:

[0044] .

[0045] in, and represents the i-th bit of binary strings x and y respectively, and n is the length of the string.

[0046] While Hamming distance can be used to measure fundamental differences, it has limitations in identifying high-level behavioral patterns. For example, multiple addresses may have completely different activity distributions even if they have the same amount of activity.

[0047] Global frequency distance (GFM) measures the difference in overall activity between two addresses, and is defined by the following formula:

[0048] .

[0049] in, The number of 1s in the string is 'n', and 'n' represents the total length of the string.

[0050] To capture local activity patterns, the binary string is divided into k segments, and the activity level within each segment is calculated. Grouped frequency distance is used to further characterize local temporal behavior by dividing the time series into k continuous sub-intervals (each interval having a length of...). The activity difference within each interval is calculated and defined by the following formula:

[0051] .

[0052] in, and This represents the substring corresponding to the i-th segment. It is the length of each segment.

[0053] Taking into account the above metrics, a weighted composite distance metric is constructed, which integrates Hamming distance, global frequency distance, and grouped frequency distance, and is defined by the following formula:

[0054] .

[0055] in, , and These are weighting parameters used to control the influence of each distance component. By adjusting the weights... , and The composite distance can be adjusted to balance global activity, local patterns, and bit-level differences. This flexibility allows clustering algorithms to identify addresses that exhibit similar transaction behavior over time, even if their binary representations show subtle differences.

[0056] Step S6 further refines the preliminary clustering results based on the Cross-Sybil distance metric function constructed in the preceding steps. Specifically, this distance metric function is used to calculate the behavioral similarity between addresses in the time dimension, thereby identifying a more refined sub-cluster structure within the initial cluster. The main objective of this step is to improve the clustering's discriminative power, ensuring that addresses belonging to the same behavioral pattern or controlled by the same attacking entity are aggregated into the same cluster, avoiding the grouping of addresses with similar behaviors into different groups, thus reducing identification accuracy. To improve the model's adaptability and accuracy, this step also introduces reverse verification and parameter fine-tuning mechanisms to further optimize the clustering effect. Finally, this step yields a set of addresses highly similar in transaction time behavior characteristics. These address sets can be considered as target address groups with potential collaborative behavior or operated by the same controller, providing a precise candidate set for subsequent suspicious behavior identification.

[0057] The transaction protocol features in step S7 exhibit significant differences in transaction volume across different addresses, making direct analysis difficult. This invention treats the protocol sequence associated with each address as a text document and introduces a statistical feature extraction method to model these text features, thereby achieving an effective quantitative representation of protocol behavior. Specifically, the Term Frequency–Inverse Document Frequency (TF-IDF) method is used to process the protocol features. This method is widely used in text mining and can be used to measure the importance of a protocol in a specific address while reflecting its prevalence in the overall address set. The TF-IDF value consists of the following two parts:

[0058] ;

[0059]

[0060] .

[0061] Where N is the total number of documents (addresses), This represents the number of documents containing the term. Adding 1 to the denominator prevents division by zero and improves numerical stability. By converting protocol usage into TF-IDF vector form, a compact and information-rich numerical feature representation can be obtained. This representation not only reflects the frequency of protocol usage at specific addresses but also the relative uniqueness of the protocol globally, providing a solid data foundation for subsequent clustering analysis and anomaly detection.

[0062] In step S8, the remaining numerical transaction features, such as the airdrop value of the native token and the exchange value of the Stargate protocol, are fused with the semantic protocol features obtained through text mining methods to construct a unified high-dimensional feature representation. Based on this fused feature representation, a final round of density clustering is performed to obtain a set of highly similar addresses. This set of addresses exhibits significant commonalities in behavioral patterns and is highly likely to constitute a potential Sybil address cluster controlled by the same attacker, providing a reliable basis for subsequent identification and governance.

[0063] In step S9, after completing the final round of clustering, a performance evaluation is conducted on the clustering results. During the evaluation, existing labeled data, unsupervised anomaly detection metrics, and visualization analysis are used to perform reverse verification of the model output results to determine the effectiveness and stability of the clustering model in identifying potential Sybil addresses. Based on the evaluation feedback, key parameters in the clustering model are appropriately adjusted and optimized to further improve the robustness of the model structure and clustering performance, thereby enhancing the accuracy and practicality of identifying potential Sybil addresses.

[0064] Compared with the prior art, the present invention has the following beneficial technical effects and significant technical progress:

[0065] 1) This invention integrates multi-dimensional behavioral feature modeling and multi-stage density clustering strategy to fundamentally achieve effective detection of Sybil attacks;

[0066] 2) This invention does not rely on a centralized identity system or user real-name mechanism. While fully respecting the anonymity of users in the blockchain system, it has good adaptability and scalability, and is suitable for large-scale data processing in multi-chain environments, taking into account both anonymity and openness.

[0067] 3) This invention innovatively constructs a high-dimensional feature space for cross-chain transaction behavior, covering time behavior binary encoding, protocol usage semantic features (TF-IDF), and economic behavior indicators, comprehensively reflecting the typical behavior patterns of Sybil addresses;

[0068] 4) To address the shortcomings of traditional clustering methods in processing temporal behavior patterns, this invention introduces the cross-sybil distance metric method, which combines Hamming distance, global frequency difference, and local frequency difference to effectively improve the discriminative ability of temporal behavior features.

[0069] 5) This invention employs a three-stage HDBSCAN clustering framework to progressively compress the sample space and improve clustering accuracy, achieving a layered filtering mechanism from coarse-grained screening to refined identification, significantly enhancing the ability to identify complex witch behaviors. Simultaneously, it has low equipment performance requirements, ensuring efficient deployment even with low-performance devices.

[0070] 6) While ensuring the characteristics of a decentralized system, this invention achieves high-precision identification of potential Sybil addresses in cross-chain transactions, which can effectively improve the fairness and security of airdrop incentive mechanisms in blockchain systems, and has high practical value and broad prospects for promotion. Attached Figure Description

[0071] Figure 1 This is a schematic diagram of the process of the present invention;

[0072] Figure 2 This is a schematic diagram illustrating the statistical analysis of the cluster size distribution in the experimental results;

[0073] Figure 3 This is a schematic diagram showing the distribution of clusters by size.

[0074] Figure 4 A visual diagram illustrating the distribution of clusters in the feature space;

[0075] Figure 5 This is a schematic diagram illustrating the consistency analysis of heatmaps and their behavior.

[0076] Figure 6 A diagram illustrating the performance comparison of different detection methods in the task of identifying potential witch locations;

[0077] Figure 7 This is a comparative diagram showing the impact of key modules on detection performance. Detailed Implementation Plan

[0078] The following, in conjunction with the accompanying drawings, provides simulation results of experiments conducted on a real Layer Zero dataset using the algorithm framework of this invention as an example. It is also compared with a witch address detection scheme based on common clustering algorithms. However, this example is only provided as an illustration and is intended to explain the invention. It should not be construed as a limitation of the invention.

[0079] Example 1

[0080] This invention utilizes cross-chain data from the Layer Zero project to perform lightweight, coarse-grained localization of on-chain addresses, analyzes the characteristics of Sybil addresses, and proposes a lightweight and effective Sybil attack detection scheme based on historical experience and the current state of research both domestically and internationally.

[0081] See Figure 1 The Sybil attack detection and isolation method based on signal strength implemented in this invention includes the following steps:

[0082] Step S1: Obtaining Cross-Chain Transaction Data

[0083] Collect cross-chain transaction metadata within a set time range. The metadata includes, but is not limited to: the source chain of the transaction, the source chain transaction hash, the source chain contract address, the sender's wallet address, the associated protocol, and the source chain timestamp (UTC).

[0084] Step S2: Feature Correlation Analysis

[0085] A preliminary analysis of the collected cross-chain metadata is conducted, and based on existing attack feature knowledge bases or historical experience, the correlation between various transaction features and whether the address is a Sybil address is assessed.

[0086] Step S3: Data Preprocessing

[0087] The metadata is initially cleaned, including: removing addresses with too low transaction frequency or no behavioral significance; removing redundant features that are not directly related to Sybil attacks; and abstracting some features for subsequent processing.

[0088] Step S4: Preliminary Dimensionality Reduction and Clustering

[0089] Based on the processed feature data, the first clustering operation is performed to reduce the data size and computational load in subsequent high-complexity calculations.

[0090] Step S5: Introduce temporal behavioral distance

[0091] Based on the time series of address-based transaction behavior, a custom Cross-Sybil distance metric is introduced to capture the similarity of transaction patterns across addresses over time.

[0092] Step S6: Refined Clustering of Behavioral Patterns

[0093] The Cross-Sybil distance is used to refine the initial clustering results, and addresses with similar transaction behaviors are regrouped to improve clustering accuracy.

[0094] Step S7: High-dimensional unstructured feature modeling

[0095] For discrete text features with long-tail distribution, such as protocol usage, text mining methods (such as TF-IDF and word vector modeling) are used to extract and vectorize semantic features.

[0096] Step S8: Final clustering of fused features

[0097] By fusing different behavioral features with semantic protocol features, a final round of density clustering is performed to obtain high-confidence clustering results for potential Sybil addresses.

[0098] Step S9: Result Evaluation and Model Iteration

[0099] The final clustering results are evaluated, and the model is back-validated and its parameters are fine-tuned by combining labeled data or anomaly detection indicators to improve recognition accuracy.

[0100] Furthermore, in step S1 mentioned above, acquiring cross-chain transaction data is the foundation for subsequent identification of Sybil address behavior. Specifically, the system collects multiple cross-chain transaction records covering a set time range and extracts the following 11 key feature fields for each transaction: 1. Source Chain: The blockchain initiating the transaction, indicating the location where funds were sent; 2. Source Chain Transaction Hash: A hash value uniquely identifying the transaction on the source chain, used to accurately retrieve complete transaction information; 3. Source Chain Contract Address: The smart contract address that initiated the transaction on the source chain, usually called by the sender; 4. Destination Chain: The smart contract address that initiated the transaction on the source chain. 5. Target Chain Transaction Hash (Destination_Tx_Hash): The hash value of the transaction recorded on the target chain, used to correspond to the receiving end transaction record; 6. Target Chain Contract Address (Destination_Contract): The address of the smart contract that receives the transaction on the target chain, usually called by the recipient; 7. Sender Wallet Address (Sender_Wallet): The user address that initiated the cross-chain transaction; 8. Source Chain Timestamp (Source_Timestamp_UTC): The UTC timestamp of the transaction recorded on the source chain, indicating the time the transaction occurred; 9. Associated Protocol (Project): The name of the blockchain protocol or application involved in processing or initiating the transaction; 10. Native Token Airdrop Value (Native_Drop_USD): The number of native tokens issued in this transaction, denominated in US dollars; 11. Stargate Protocol Swap Value (Stargate_Swap_USD): The value of the tokens swapped through the Stargate cross-chain protocol (denominated in US dollars).

[0101] The aforementioned 11 initial features constitute the basic descriptive information for each cross-chain transaction, and each transaction data includes these fields. Since the same address may participate in multiple transactions, all associated transaction records for each address will be collected to facilitate subsequent aggregation analysis, pattern recognition, and anomaly detection at the time dimension and behavioral feature level.

[0102] Furthermore, in step S2 above, feature correlation analysis is performed on the collected cross-chain transaction metadata. This analysis is based on the existing Sybil attack behavior feature knowledge base and historical attack samples. By evaluating the role of the information carried by each field, it determines the potential correlation between the field and whether the address is a Sybil address. Among them, the fields Source Chain Transaction Hash (Source_Tx_Hash) and Destination Chain Transaction Hash (Destination_Tx_Hash) are only used to identify specific cross-chain transaction records and do not carry effective information that can be used for behavioral modeling at the semantic level. Therefore, they are not used as the basis for judgment in this analysis. According to existing attack behavior research, Sybil address groups controlled by the same attacker usually exhibit highly similar behavioral characteristics. For example, a group of addresses may initiate transaction operations using the same blockchain protocol, target chain, and transaction amount within similar time periods or fixed time intervals. Although some Sybil attack behaviors tend to become more complex and covert as attack methods continue to evolve, the remaining nine feature fields (including source chain, target chain, contract address, timestamp, protocol name, airdrop value, etc.) still have high analytical value in attacker behavior modeling. Therefore, in the subsequent steps, we will focus on modeling and cluster analysis around these nine types of features.

[0103] Furthermore, in step S3, the acquired cross-chain transaction metadata undergoes preliminary cleaning. This process, based on the feature correlation analysis completed in step S2, mainly includes the following three aspects: 1. Redundant feature removal: By evaluating the correlation between transaction fields and Sybil attack behavior, it is determined that the source chain transaction hash (Source_Tx_Hash) and target chain transaction hash (Destination_Tx_Hash) fields have no modeling value. Therefore, they are removed from the feature set in this step to reduce computational redundancy. 2. Low-activity address filtering: Referring to the standards set by several blockchain projects regarding airdrop eligibility, and combined with empirical analysis results, a minimum threshold of six transactions is set. Addresses below this threshold are judged to have insufficient transaction activity and generally cannot pose an effective attack threat. Therefore, they are filtered in the preprocessing stage to avoid interfering with the subsequent identification process. 3. Feature Abstraction and Standardization: For the remaining addresses, structural feature variables highly correlated with Sybil behavior are extracted, including but not limited to: the number of transactions corresponding to the address, the time of the first transaction (used to infer whether it is a centralized registration address), and the number of blockchains involved (reflecting the inter-chain activity of the address). These features can be used to reflect the behavioral similarity of Sybil addresses in both time and space dimensions, possessing good discriminative power and dimensionality reduction characteristics. To adapt to the input requirements of subsequent clustering models, all numerical fields will be normalized or standardized to ensure comparability between feature dimensions.

[0104] Furthermore, in step S4 above, based on the abstracted structured feature data, a first clustering operation is performed to initially divide the large-scale address set, significantly reducing the computational overhead and memory load in subsequent high-complexity feature processing. In this and subsequent stages, the HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise) algorithm is used as the clustering method. This algorithm uses density as the core clustering criterion and has the following advantages: only a minimum density threshold parameter (MinPts) needs to be set, without predefining the number of clusters; it can automatically identify cluster structures of arbitrary shapes; it is well-adapted to scenarios with large differences in the number of samples between clusters, a large number of clusters, and a large number of noise points, making it suitable for the unbalanced distribution characteristics between clusters common in the Sybil address identification scenario. To preserve the clustering associations of potential attack addresses to the greatest extent, the MinPts parameter is deliberately set to a low value during this stage of clustering, thereby relaxing the clustering conditions and reducing the risk of incorrectly assigning addresses controlled by the same attacker to different clusters. This strategy can improve recall in the initial clustering, laying the foundation for subsequent more refined feature characterization and behavior modeling.

[0105] Furthermore, step S5 introduces a distance metric to measure the behavioral similarity of addresses over time. Temporal behavioral characteristics play a crucial role in identifying addresses targeted by Sybil attacks. However, traditional distance metrics (such as Euclidean distance, Manhattan distance, and cosine similarity) often fail to capture the deep-seated behavioral commonalities and patterns of change when dealing with discrete transaction patterns in time series. Therefore, this invention proposes a Cross-Sybil distance metric to quantify the similarity of different addresses in temporal behavior. This method is based on Hamming distance and combines it with global frequency distance and grouped frequency distance to form a weighted composite distance model, thereby improving the model's ability to characterize behavioral similarity.

[0106] Hamming distance is defined as follows: Assuming the temporal behavior of each address is encoded as a binary string of length n, where each bit corresponds to the activity status of a month (1 indicates a transaction occurred in that month, 0 indicates no transaction), the Hamming distance between addresses x and y is defined by the following formula:

[0107] .

[0108] in, and Let represent the i-th bit of binary strings x and y, respectively, and n be the length of the string. While Hamming distance can be used to measure fundamental differences, it has limitations in identifying high-level behavioral patterns. For example, multiple addresses may have completely different activity distributions even if they have the same amount of activity.

[0109] Global frequency distance (GFM) measures the difference in overall activity between two addresses, and is defined by the following formula:

[0110] .

[0111] in, is the number of 1s in the string, and n represents the total length of the string. To capture local activity patterns, we divide the binary string into k segments and calculate the activity level within each segment.

[0112] Grouped frequency distance is used to further characterize local temporal behavior. It divides the time series into k continuous sub-intervals (each interval of length k), and calculates the activity difference within each interval, defined by the following formula:

[0113] .

[0114] in, and This represents the substring corresponding to the i-th segment. It is the length of each segment.

[0115] Taking into account the above metrics, we construct a weighted composite distance metric. This composite distance integrates Hamming distance, global frequency distance, and grouped frequency distance, and is defined by the following formula:

[0116] .

[0117] in, , and These are weighting parameters used to control the influence of each distance component. By adjusting the weights... , and The composite distance can be adjusted to balance global activity, local patterns, and bit-level differences. This flexibility allows clustering algorithms to identify addresses that exhibit similar transaction behavior over time, even if their binary representations show subtle differences.

[0118] Furthermore, in step S6, the preliminary clustering results are further refined based on the Cross-Sybil distance metric function constructed in the previous steps. Specifically, this distance metric function is used to calculate the behavioral similarity between addresses in the time dimension, thereby identifying a more refined sub-cluster structure within the initial cluster. The main goal of this step is to improve the clustering's discriminative power, ensuring that addresses belonging to the same behavioral pattern or controlled by the same attack entity are aggregated into the same cluster, avoiding the division of addresses with similar behaviors into different groups, thus reducing identification accuracy. To improve the model's adaptability and accuracy, this step also introduces reverse verification and parameter fine-tuning mechanisms to further optimize the clustering effect. Finally, this step yields a set of addresses that are highly similar in transaction time behavior characteristics. These address sets can be considered as target address groups with potential collaborative behavior or operated by the same controller, providing a precise candidate set for subsequent suspicious behavior identification.

[0119] Furthermore, the transaction protocol features proposed in step S7 above exhibit significant differences in transaction volume across different addresses, making direct analysis difficult. This invention treats the protocol sequence associated with each address as a text document and introduces a statistical feature extraction method to model these text features, thereby achieving an effective quantitative representation of protocol behavior. Specifically, the Term Frequency–Inverse Document Frequency (TF-IDF) method is used to process the protocol features. This method is widely used in text mining and can be used to measure the importance of a protocol in a specific address while reflecting its prevalence in the overall address set. The TF-IDF value consists of the following two parts:

[0120] ;

[0121]

[0122] .

[0123] Here, N is the total number of documents (addresses), and is the number of documents containing the term. Adding 1 to the denominator prevents division by zero and improves numerical stability. By converting protocol usage into TF-IDF vector form, a compact and information-rich numerical feature representation can be obtained. This representation not only reflects the frequency of protocol usage at specific addresses but also the relative uniqueness of the protocol globally, providing a solid data foundation for subsequent clustering analysis and anomaly detection.

[0124] Furthermore, in step S8, the remaining numerical transaction features, such as the airdrop value of the native token and the exchange value of the Stargate protocol, are fused with the semantic protocol features obtained through text mining methods to construct a unified high-dimensional feature representation. Based on this fused feature representation, a final round of density clustering is performed to obtain a set of highly similar addresses. This set of addresses exhibits significant commonalities in behavioral patterns and is highly likely to constitute a potential Sybil address cluster controlled by the same attacker, providing a reliable basis for subsequent identification and governance.

[0125] Furthermore, in step S9 above, after completing the final round of clustering, a performance evaluation of the clustering results is conducted. During the evaluation, existing labeled data, unsupervised anomaly detection metrics, and visualization analysis are used to perform reverse verification of the model output results to determine the effectiveness and stability of the clustering model in identifying potential Sybil addresses. Based on the evaluation feedback, key parameters in the clustering model are appropriately adjusted and optimized to further improve the robustness of the model structure and clustering performance, thereby enhancing the accuracy and practicality of identifying potential Sybil addresses.

[0126] The following are the experimental results:

[0127] In this embodiment, the relevant experiments were conducted under the following environment and configuration:

[0128] (1) Data source: The real cross-chain transaction dataset provided by LayerZero is selected, which covers multiple mainstream blockchain networks and cross-chain protocols. It is representative and complex, and can fully reflect the actual characteristics of cross-chain transaction behavior.

[0129] (2) Software and platform environment: The experiment was run on the Windows operating system. The core algorithm was written in Python 3.11 and relied on mainstream data analysis libraries such as hdbscan (v0.8.33), scikit-learn (v1.6.0), numpy (v1.26.0), pandas (v2.2.1) and matplotlib (v3.8.0).

[0130] (3) Hardware environment: The test equipment is equipped with an Intel Core i7-12700H processor, 32GB of memory and a 1TB NVMe solid-state drive. Some visualization tasks are accelerated using an NVIDIA RTX 3080 Ti graphics card to ensure computing efficiency and graphics rendering performance.

[0131] Comparison scheme settings:

[0132] Given the current lack of mature research methods for identifying cross-chain Sybil attacks, two classic clustering algorithms, K-means and DBSCAN, are selected as benchmarks for comparison to reasonably evaluate the effectiveness of this invention. These methods are widely used in various unsupervised learning tasks and possess good representativeness and versatility. While maintaining consistent input data and parameter configurations, the benchmark methods and the multi-stage clustering framework proposed in this invention are applied to the same transaction dataset. The system evaluates the number and accuracy of each method in identifying potential Sybil addresses, thereby comparing and verifying the actual performance of this invention.

[0133] This implementation employs a multi-stage clustering strategy to model and identify the behavior of transaction addresses. Combined with high-dimensional feature construction and visualization analysis, it effectively improves the accuracy and interpretability of witch address identification.

[0134] See Figure 2 After initial clustering, the address sizes of each cluster were statistically analyzed, and the cluster sizes were plotted on a logarithmic coordinate system. The results showed a clear long-tail distribution. Most clusters contained no more than 100 addresses, while a few clusters reached thousands to tens of thousands of addresses, demonstrating strong cluster size unevenness and indicating that the clustering algorithm has good sparse noise suppression capabilities.

[0135] See Figure 3 Based on the cluster size characteristics, the clusters were divided into four categories: small (≤ 50 addresses), medium (51–500), large (501–5000), and giant (> 5000). Experiments showed that small and medium-sized clusters constituted the vast majority, reflecting that Sybil attacks primarily involve small-scale operations; while large and giant clusters, though fewer in number, may represent more complex or structured attack patterns and have higher analytical value.

[0136] See Figure 4 To verify the separability of the clusters in the feature space, the high-dimensional feature vectors were reduced to a two-dimensional plane using the t-SNE algorithm, and several clusters were randomly selected for visualization. The results show that the obtained clusters are clearly distributed, have distinct boundaries, and do not show obvious overlap, verifying the effectiveness of the constructed high-dimensional behavioral features in representing behavioral differences between addresses.

[0137] See Figure 5 To further verify the consistency of address behavior within clusters, nine representative clusters were randomly selected, and the transaction behavior sequences of these addresses were visualized using a heatmap. The graph uses time as the vertical axis and address as the horizontal axis, numerically encoding the cross-chain behavior fields (such as source chain, project, target chain, etc.) of each address. The results show that multiple addresses within the same cluster exhibit highly consistent activity patterns across time series. For example, Figure 5a, Figure 5 c and Figure 5 The address shown in g exhibits a completely consistent transaction sequence within a similar time period, indicating that it may be controlled by the same manipulating entity. Figure 5 Although the addresses shown in f differ in start and end times, their transaction behavior in the middle is almost identical, suggesting that attackers may disguise their behavior by perturbing the start and end times. Figure 5 i shows that a large number of addresses maintained highly consistent transaction behavior throughout the entire cycle, exhibiting typical Sybil address cluster characteristics.

[0138] In another embodiment of the present invention, comparative and ablation experiments were designed and conducted to verify the effectiveness of the proposed identification method in detecting potential witch addresses.

[0139] See Figure 6 This study employed several common clustering algorithms (including DBSCAN, HDBSCAN, and K-means) as benchmark methods, performing clustering tasks on the same dataset and recording the number of suspicious addresses identified by each method and its accuracy under LayerZero labels. The input features and parameter configurations used for each method were kept consistent throughout the experiment to ensure fairness and repeatability of the comparison. The experimental results show significant differences in the performance of traditional clustering algorithms in detecting potential witch addresses. Specifically, the DBSCAN method identified approximately 359,213 suspicious addresses with an accuracy of 31.7%; the HDBSCAN method identified 210,143 addresses with an accuracy of 33.7%; and while the K-means method identified a larger number (283,471), it had the lowest accuracy at only 27.7%. In contrast, the proposed method achieves a detection accuracy of 45.4% while identifying a moderate number of addresses, significantly outperforming the aforementioned traditional algorithms. This demonstrates that the proposed method has stronger adaptability and accuracy in identifying airdrop hunters (witch addresses).

[0140] See Figure 7Ablation experiments were conducted to evaluate the specific contributions of key components in the model to overall performance. This experiment sequentially removed the TF-IDF text feature modeling module and the custom distance metric module, recording their impact on the number and accuracy of suspicious address identification. The experiments showed that when the model used only TF-IDF features, the number of identified addresses was 229,701, with a detection accuracy of 37.2%; while when only the custom temporal behavioral distance metric was used, the number of identified addresses increased to 270,317, with an accuracy of 36.1%. When both were used together, the system identified 329,701 suspicious addresses, improving the detection accuracy to 45.4%. These results indicate that text feature modeling and behavioral distance metrics are complementary in capturing witchcraft behavior, respectively improving the model's recognition accuracy and recall. The combined high-dimensional behavioral feature representation significantly enhances the system's overall performance in identifying potential witchcraft addresses in high-noise environments.

[0141] In summary, the multi-stage clustering strategy proposed in this invention, combined with customized behavioral distance metrics and semantic feature modeling methods, can effectively identify potential Sybil address clusters with highly consistent transaction behaviors. It exhibits excellent clustering structure stability and behavioral interpretability, and has good engineering feasibility and practical application value.

[0142] It should be noted that any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a specific logical function or process. Furthermore, the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including in substantially the same manner or in reverse order, depending on the functionality involved, as will be understood by those skilled in the art to which the embodiments of the patent pertain. Although embodiments of the invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the invention without departing from the principles and spirit of the invention.

Claims

1. A machine learning-based method for detecting Sybil attacks in blockchain, characterized in that, The method includes the following steps: Step S1: Obtaining Cross-Chain Transaction Data Collect cross-chain transaction metadata within a specified time range. This metadata includes, but is not limited to: the source chain of the transaction, the source chain transaction hash, the source chain contract address, the sender's wallet address, the associated protocol, and the source chain timestamp. Step S2: Feature Correlation Analysis Based on existing attack signature knowledge bases or historical experience, a preliminary analysis of cross-chain metadata is conducted to assess the correlation between various transaction characteristics and whether an address is a Sybil address. Step S3: Data Preprocessing The metadata is initially cleaned by removing addresses with low transaction frequency or no behavioral significance, and removing redundant features that are not directly related to the Sybil attack. Step S4: Preliminary Dimensionality Reduction Clustering Based on the feature data after initial cleaning, the first clustering operation is performed to reduce the data size and computational load in subsequent high-complexity calculations. Step S5: Introduce temporal behavioral distance Based on the time series of transaction behavior based on addresses, a custom Cross-Sybil distance metric is introduced to capture the similarity of transaction patterns of addresses over time. Step S6: Refined Clustering of Behavioral Patterns The Cross-Sybil distance is used to refine the preliminary clustering results, and addresses with similar transaction behaviors are regrouped to improve clustering accuracy. Step S7: High-dimensional unstructured feature modeling Text mining methods are used to extract semantic features and vectorize discrete text features with long-tail distribution, such as protocol usage. Step S8: Final clustering of fused features By fusing different behavioral features with semantic protocol features, a final round of density clustering is performed to obtain high-confidence clustering results for potential Sybil addresses; Step S9: Result Evaluation and Model Iteration The clustering results are evaluated, and the model is back-validated and its parameters are fine-tuned by combining labeled data or anomaly detection indicators to improve recognition accuracy.

2. The machine learning-based Sybil attack detection method in blockchain according to claim 1, characterized in that, The cross-chain transaction data acquisition in step S1 includes collecting multiple cross-chain transaction records within a set time range, and extracting at least the following feature fields for each transaction: source chain, target chain, sender wallet address, source chain timestamp, associated protocol name, native token airdrop value, and protocol exchange value.

3. The machine learning-based Sybil attack detection method in blockchain according to claim 1, characterized in that, Step S2 performs correlation analysis on each feature field in the cross-chain transaction metadata, and evaluates the correlation between the fields and the Sybil addresses based on the attack behavior knowledge base. The source chain transaction hash and the target chain transaction hash are removed because they are not meaningful for modeling. The remaining nine fields that are strongly correlated with the behavior pattern are retained for subsequent Sybil behavior modeling and clustering identification.

4. The machine learning-based Sybil attack detection method in blockchain according to claim 1, characterized in that, Step S4 uses the HDBSCAN clustering algorithm to perform preliminary clustering on the address feature data after structured processing. The HDBSCAN clustering algorithm uses sample density as the clustering standard and sets a minimum density threshold MinPts.

5. The machine learning-based Sybil attack detection method in blockchain according to claim 1, characterized in that, The Cross-Sybil distance in step S5 is a weighted composite distance metric, specifically including: encoding the transaction time series of each address into binary form based on the monthly transaction activity of each address within a set time interval, and measuring the bitwise difference of the transaction activity status using Hamming distance as the basic indicator, which is defined by the following formula: ； in, and These represent the i-th bits of binary strings x and y, respectively; n is the length of the string. Furthermore, global frequency distance is introduced to measure the difference in overall transaction frequency between addresses, which is defined by the following formula: ； in, The number of 1s in the string; n is the total length of the string; Simultaneously, the time series is divided into multiple continuous sub-intervals, and a group frequency distance metric is introduced to measure the activity deviation within each local interval, which is defined by the following formula: ； in, and This refers to the substring corresponding to the i-th segment; The length of each segment; Finally, by assigning weight parameters to the three distance components, they are synthesized into a unified composite temporal behavioral distance metric for further aggregation of behavioral approximate addresses, defined by the following formula: ； in, , and Weighting parameters are used to control the influence of each distance component.

6. The method for detecting Sybil attacks in blockchain based on machine learning according to claim 1, characterized in that, In step S7, unstructured semantic features are constructed for the protocol fields involved in the address in the cross-chain transaction. Based on the term frequency-inverse document frequency model in text mining methods, the protocol sequence is feature extracted, and the extracted TF-IDF feature vector is used as the semantic embedding result to represent the address's preference and difference in protocol usage dimension.

7. The machine learning-based Sybil attack detection method in blockchain according to claim 1, characterized in that, Step S9 combines manually labeled data or anomaly detection indicators, introduces the silhouette coefficient, Davies-Bouldin index, and Silhouette coefficient to perform reverse verification and effect judgment on the clustering results, and uses visualization analysis to assist in judging the effect of clustering results, thereby improving the system's adaptability and robustness to different attack modes.

Images