Digital asset account security report generation method based on large language model

Abstract

The invention relates to the technical field of security evaluation of digital asset accounts, in particular to a digital asset account security report generation method based on a large language model. The method comprises a training process and a reasoning process, wherein the training process comprises report collection and cleaning (redundancy removal and core field extraction), structured processing, transaction data acquisition preprocessing (comprising structured fields and derivative features), subgraph construction enhancement (comprising time sequence slicing and feature definition), semantic extraction, corpus construction and model fine tuning; the reasoning process comprises demand acquisition, real-time data acquisition, sub-graph construction, semantic extraction and report generation post-processing, and semantic understanding is deeply integrated in combination with graph neural network structure learning and large language model semantic analysis capability to capture fine-grained features. According to the method, account transaction spatio-temporal characteristics and semantic information can be comprehensively captured, evaluation accuracy, real-time performance and interpretability are improved, a report meeting financial risk control requirements is generated, and the practical application value in the financial security field is enhanced.

Description

Technical Field

[0001] This invention relates to the field of security assessment technology for digital asset accounts, and more specifically to a method for generating security reports for digital asset accounts based on a large language model. Background Technology

[0002] As a core infrastructure of the Web 3.0 ecosystem, blockchain technology supports the rapid development of emerging economic forms such as decentralized finance and NFT trading (Non-Fungible Tokens, digital assets based on blockchain technology). With the exponential growth in the complexity of on-chain economic activities, account behavior risks exhibit characteristics such as dynamic anonymity, cross-chain coupling, and pattern evolution, making it difficult for traditional manual review and rule engines to achieve accurate, real-time, and explainable account security assessments.

[0003] Dynamic concealment refers to the fact that an account's risky behavior is not fixed but constantly changing, and its risk characteristics are often hidden in normal trading activities, making it difficult to detect directly. This concealment makes it difficult for traditional risk identification methods to accurately capture potential risk points, because risky behavior may change its manifestation with changes in time, trading scenarios, and other factors, increasing the difficulty of risk identification.

[0004] Cross-chain coupling refers to the fact that in a multi-chain interactive environment, an account's risk behavior is no longer limited to a single blockchain network, but may cross multiple blockchains, forming interconnected and mutually influential risk relationships. The flow of funds and information exchange between different blockchains causes account risks to be mutually coupled during cross-chain processes. Risk assessments on a single chain cannot fully reflect the overall risk status of an account, posing a greater challenge to risk control.

[0005] Pattern evolution means that an account's risk behavior patterns will continuously evolve and upgrade. This evolutionary nature causes existing risk identification models and rules to quickly become ineffective, necessitating continuous updates and optimization of risk identification methods to address ever-changing risk patterns.

[0006] Existing methods for mining transaction patterns can be mainly divided into three categories: graph representation learning, temporal modeling, and generative large language models.

[0007] Graph representation methods demonstrate significant advantages in capturing complex topological relationships between accounts. Through node embedding and neighborhood information aggregation mechanisms, they can effectively identify local features such as community structure and risk transmission paths in financial networks. However, this method struggles to fully express fine-grained numerical semantics and continuous-time dynamic information, and its black-box feature representation makes it difficult to generate interpretable decision-making basis that meets financial risk control requirements.

[0008] Temporal modeling methods have certain advantages in modeling single-account behavior. Through memory units and sliding window mechanisms, they can accurately capture dynamic evolutionary characteristics such as account transaction frequency and fund flow cycle. However, this method only focuses on the vertical temporal dimension of a single account during the modeling process and fails to establish a horizontal spatiotemporal correlation matrix between accounts. This results in an inability to effectively identify new risk patterns such as distributed fraud, and this deficiency is particularly evident when facing complex scenarios.

[0009] Generative large language model methods, through instruction fine-tuning and thought chain technology, can automatically generate natural language reports containing risk ratings and evidence chain analysis, significantly improving the readability of the results. However, this method lacks a dedicated graph structure semantic injection mechanism, resulting in insufficient understanding of key elements such as the topological characteristics of the transaction network and the spatiotemporal logic of fund flows. This directly leads to fundamental defects in the generated reports, such as factual illusions and logical gaps, severely limiting its practical application value in the field of financial security.

[0010] In summary, existing technologies still face challenges in addressing the high-level task of security report generation, including insufficient multimodal semantic fusion, defects in dynamic temporal modeling, and uncontrollable structured output. Summary of the Invention

[0011] In view of this, this invention provides a method for generating digital asset account security reports based on a large language model, aiming to solve the problems of insufficient multimodal semantic fusion, defects in dynamic temporal modeling, and uncontrollable structured output in existing technologies for the high-order task of security report generation. Specifically, it addresses the issues that graph representation methods cannot fully express fine-grained numerical semantics and continuous-time dynamic information, and feature representation methods cannot generate interpretable decision-making basis; temporal modeling methods fail to establish a horizontal spatiotemporal correlation matrix between accounts, thus failing to effectively identify new cross-account risk patterns; and generative large language model methods suffer from defects such as factual illusions and logical gaps in generated reports due to the lack of a dedicated graph structure semantic injection mechanism. This invention improves the accuracy, real-time performance, and interpretability of digital asset account security assessment, achieving comprehensive capture of the spatiotemporal characteristics and semantic information of account transaction behavior, generating security reports that meet financial risk control requirements, and enhancing its practical application value in the field of financial security.

[0012] To achieve the above objectives, the present invention adopts the following technical solution:

[0013] A method for generating digital asset account security reports based on a large language model, characterized by including a training process and an inference process;

[0014] The training process includes the following steps:

[0015] T1. Collect and clean account security reports, which include risk assessment tags, transaction behavior statistics and anomaly detection results. The cleaning process includes removing redundant information and extracting core fields.

[0016] T2. Based on a predefined security report template, a large model is used to convert the cleaned account security report into a structured format, which includes risk assessment, behavior analysis, and anomaly detection fields;

[0017] T3. Obtain and preprocess all transaction data of the account, wherein the transaction data includes structured fields and derived features;

[0018] T4. Construct and enhance the transaction subgraph of the preprocessed transaction data to obtain the enhanced subgraph;

[0019] T5. Based on the self-supervised learning task, the transaction semantic representation vector is extracted from the augmented subgraph through the transaction semantic encoder;

[0020] T6. Construct a supervised fine-tuning corpus. The input of the supervised fine-tuning corpus is the concatenation of the representation vectors of human instructions and transaction semantics, and the output is the structured security report obtained in T2.

[0021] T7. Use the aforementioned supervised fine-tuning corpus to perform supervised fine-tuning on the large language model;

[0022] The reasoning process includes the following steps:

[0023] R1. Obtain user requests for security report assessment of the target account;

[0024] R2. Real-time acquisition of full transaction data for the target account;

[0025] R3. Perform the transaction subgraph construction and enhancement steps as described in training process T4 on the real-time acquired transaction data to obtain the real-time enhanced subgraph;

[0026] R4. Use the trained transaction semantic encoder to extract the representation vector of real-time transaction semantics from the real-time augmented subgraph;

[0027] R5. After concatenating the representation vectors of human instructions and real-time transaction semantics, input them into the fine-tuned large language model to generate a security report and perform post-processing. The processed security report is then returned to the user.

[0028] In a specific implementation scheme, the training process T1 includes removing redundant information, which includes removing unstructured text; and extracting core fields, which includes extracting risk assessment level, abnormal transaction address and active time window through regular expression matching and manual verification.

[0029] In a specific feasible implementation, the training process T2, which uses a large model to convert the cleaned account security report into a structured format, includes: generating a summary of the cleaned account security report using the large model, extracting risk assessment criteria and abnormal pattern descriptions; and outputting the extracted results in a structured manner according to risk assessment, behavioral analysis, and anomaly detection fields, wherein risk assessment includes quantitative scores and risk levels, behavioral analysis includes transaction frequency distribution and fund flow network topology, and anomaly detection includes suspicious transaction timestamps and a list of associated addresses.

[0030] In a specific feasible implementation, the structured fields in the training process T3 include transaction hash, timestamp, sender address, receiver address, and transaction amount; the derived features include account balance time-series changes, transaction amount variance, and cross-address transaction frequency.

[0031] In a specific feasible implementation, the transaction subgraph construction and enhancement in the training process T4 includes: dividing the transaction data into time segments according to fixed time windows to generate time segment sequences; applying random edge deletion, transaction amount perturbation, and time window offset operations to each time segment sequence to generate positive sample pairs for comparative learning; defining node features as multidimensional vectors containing transaction frequency, average amount, amount variance, and balance change rate; and defining edge features as weighted adjacency matrices, wherein the weights of the weighted adjacency matrix are the normalized product of transaction amount and frequency.

[0032] In a specific implementation scheme, the training process T5, which extracts the representation vector of transaction semantics based on the self-supervised learning task, includes: using the internal structure and patterns of the transaction subgraph, automatically learning the implicit features of transaction semantics through a transaction semantic encoder to obtain the representation vector of transaction semantics.

[0033] In one specific implementation scheme, in the training process T6, the format of the manual instruction is "Based on the semantic representation of the given account, <semantic>[Representation vector of transaction semantics]< / semantic> "Analyze its security risks and issue a security report"; the structured security report encapsulates risk assessment and behavior analysis fields in JSON format.

[0034] In one specific implementation scheme, in the training process T7, the training objective of supervised fine-tuning is to maximize the likelihood probability between the generated text and the structured security report, using cross-entropy as the loss function and the Adam optimizer for model optimization.

[0035] In a specific implementation scheme, the real-time acquisition of the full transaction data of the target account in the inference process R2 includes: if the transaction data of the target account is in the server cache, then the transaction data is retrieved directly; if the transaction data of the target account is not in the server cache, then it is retrieved in real time through the blockchain platform API.

[0036] In one specific implementation scheme, the post-processing of the generated security report in the inference process R5 includes: matching predefined template fields using regular expressions; detecting contradictory descriptions in the report using a rule engine, triggering an alarm when a contradictory description is detected; and returning the verified security report to the user in JSON format.

[0037] Compared with existing technologies, the present invention provides a method for generating security reports for digital asset accounts based on a large language model. This method is used for security assessment of digital asset accounts and for generating security reports. By constructing a complete technical solution that includes training and inference processes, and combining the structural learning capabilities of graph neural networks and the semantic analysis capabilities of generative large language models, it achieves comprehensive capture of the spatiotemporal characteristics and semantic information of account transaction behavior. This effectively improves the accuracy, real-time performance, and interpretability of digital asset account security assessments, and has the following beneficial effects:

[0038] During the training phase, a combination of unsupervised learning and supervised fine-tuning is used to ensure that the model can accurately capture semantic information in transaction data, which solves the problems of insufficient multimodal semantic fusion, defects in dynamic temporal modeling, and uncontrollable structured output in existing technologies.

[0039] The inference phase directly generates a security report for the new account through model inference, providing users with real-time risk assessment and transaction behavior analysis. The generated report meets financial risk control requirements, enhances its practical application value in the field of financial security, and overcomes the shortcomings of traditional methods in assessing complex account behavior risks in terms of inaccuracy, timeliness, and poor interpretability. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0041] Figure 1 This is a flowchart of the training process for a digital asset account security report generation method based on a large language model, as described in this invention.

[0042] Figure 2 This is a flowchart illustrating the reasoning process of a digital asset account security report generation method based on a large language model, as described in this invention. Detailed Implementation

[0043] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] This invention proposes a method for generating digital asset account security reports based on a large language model. This method combines the structural learning of graph neural networks with the semantic analysis capabilities of a large language model, deeply integrating semantic understanding into transaction behavior analysis. When analyzing account transaction behavior, it simultaneously considers and integrates both "spatiotemporal features" and "semantic information," comprehensively capturing the spatiotemporal characteristics and semantic information of digital asset account transaction behavior, thereby generating accurate and interpretable account security reports. Specifically:

[0045] "Spatiotemporal characteristics" include features in both time and space dimensions: the time dimension involves dynamic evolutionary features such as the temporal changes of transactions and active time windows; the space dimension involves correlation features such as the topological relationships between accounts and the network structure of fund flows.

[0046] "Semantic information" refers to the meaning of transaction behavior implied by these spatiotemporal characteristics, such as the basis for risk assessment and description of abnormal patterns.

[0047] By constructing and enhancing transaction subgraphs to capture spatiotemporal features, and by fine-tuning transaction semantics and large language models to achieve semantic understanding and integration, spatiotemporal features and semantic information are organically integrated to generate accurate and interpretable account security reports.

[0048] The present invention provides a method for generating digital asset account security reports based on a large language model, which includes a training process and an inference process. The training process forms a complete process from transaction data processing to model fine-tuning, while the inference process forms a complete process from user input to response and return of a security report.

[0049] like Figure 1 As shown, the training process includes the following steps:

[0050] S1. Account Security Report Collection and Cleaning

[0051] To obtain the basic data required for model training, historical account security reports are first collected from publicly available blockchain data analysis platforms (such as Etherscan, DuneAnalytics, and Nansen). These reports must cover core information for account risk assessment, specifically including: risk assessment labels (e.g., clearly marked as "high risk," "medium risk," or "low risk"), transaction behavior statistics (e.g., transaction frequency over the past 30 days, distribution range of single transaction amounts, and proportion of cross-chain transactions), and anomaly detection results (e.g., transaction records marked as "suspicious," and the time points of abnormal fund flows).

[0052] The original report is denoised to remove redundant information and extract key fields: First, unstructured text (such as system log fragments, duplicate risk warning descriptions, redundant format symbols, etc.) is removed; then, regular expression matching (such as using \d{4}-\d{2}-\d{2}\d{2}:\d{2}:\d{2} to match timestamps and 0x[a-fA-F0-9]{40} to match blockchain addresses) combined with manual verification is used to extract core fields such as risk assessment level (such as a score of 1-10), list of addresses involved in abnormal transactions, and account activity time window (such as 9:00-18:00 per day as high-frequency trading period) to form standardized training base data.

[0053] S2. Structured generation of security reports

[0054] Based on a commonly used security reporting framework in the financial risk control field, a predefined structured template is provided, comprising three core modules: risk assessment, behavioral analysis, and anomaly detection. A large language model (such as GPT-4 or LLaMA 2) is used to convert unstructured reports into this template; the specific process includes semantic parsing and template filling.

[0055] Using a large language model, a summary is generated from the cleaned report in S1, extracting core content such as risk assessment criteria (e.g., "marked as high-risk due to transactions with 3 known high-risk addresses in the past 7 days") and descriptions of abnormal patterns (e.g., "a single transaction amount suddenly increased by more than 10 times, and the transaction object was an anonymous mixing address"). The parsed results are then output in a structured format according to template fields.

[0056] Risk assessment: includes a quantitative score of 0-100 (below 60 points is low risk, 60-80 points is medium risk, and above 80 points is high risk) and corresponding risk level labels;

[0057] Behavioral analysis includes the temporal distribution of transaction frequency (e.g., weekday transaction frequency is twice that of weekends) and the topology of fund flow networks (e.g., funds mainly flow to exchange addresses, accounting for 75%).

[0058] Anomaly detection: Includes precise timestamps of suspicious transactions (e.g., 2024-03-15 14:30:22) and a list of associated addresses (e.g., 0x7a250d5630b4cf539739df2c5dacb4c659f2488d, etc.).

[0059] S3. Transaction Data Acquisition and Preprocessing

[0060] By synchronizing through API interfaces provided by the blockchain platform (such as JSON-RPC API, Binance Smart Chain HTTP API) or local full nodes (such as Geth nodes), the full transaction data of the target account can be obtained. The data covers two categories: structured fields and derived features.

[0061] Structured fields include transaction hash (e.g., 0x9f7a...), timestamp of the transaction, sender address, receiver address, transaction amount (in native token, e.g., ETH), gas fee, and transaction status (success / failure).

[0062] Derived features: These are calculated from structured fields and include time-series changes in account balance (such as hourly balance fluctuations), variance of transaction amount (reflecting the stability of transaction amount), frequency of cross-address transactions (the number of first transactions with a new address in the past 30 days), and proportion of large transactions (the proportion of transactions with a single amount exceeding 10% of the total account assets).

[0063] The raw data is cleaned by removing failed transaction records, filling in missing timestamp fields, and standardizing transaction amounts (e.g., converting them to USD). The final result is input data that can be used to construct a transaction graph.

[0064] S4. Transaction Subgraph Construction and Data Augmentation

[0065] To capture the spatiotemporal characteristics of account transactions, the transaction subgraph is constructed and enhanced through the following steps:

[0066] Time-series slicing: The S3 preprocessed transaction data is divided into time-slice sequences according to fixed time windows (e.g., 1 hour / 1 day, preferably 12 hours). Among them G t This represents the transaction subgraph within the t-th time window, where T is the total number of time segments. Each subgraph uses account addresses as nodes and transaction relationships as edges, visually reflecting the fund flow network within that time period.

[0067] Subgraph augmentation: To improve the model's robustness to noise in transaction data, contrastive learning positive sample pairs are generated for each G_t:

[0068] Random edge deletion: Edges in the subgraph are randomly removed with probability p (p is preferably 0.1-0.2) to simulate the situation of missing transaction records in real-world scenarios;

[0069] Transaction amount perturbation: Gaussian noise is added to the edge weights (i.e., transaction amounts). The noise standard deviation is 10% of the original amount, and the simulated amount recording error is also included.

[0070] Time window offset: Randomly offset the window boundary by Δt (Δt is preferably 30 minutes to 2 hours) to enhance the model's adaptability to fluctuations in time granularity.

[0071] Feature definition:

[0072] Node feature X t : is a d-dimensional vector (d preferably 12-32), containing indicators such as the frequency of transactions of a node (account) within a t-window, the average transaction amount, the variance of the amount, the rate of change of the balance, and the proportion of cross-chain transactions;

[0073] Edge feature A t : This is a weighted adjacency matrix, where the element value is the normalized product of transaction amount and transaction frequency (i.e., (amount / maximum amount) × (frequency / maximum frequency)), reflecting the closeness of transactions.

[0074] S5. Transaction Semantics Extraction Based on Self-Supervised Learning

[0075] To extract deep semantic information from transaction subgraphs, a self-supervised learning task is designed to train a transaction semantic encoder (using a graph neural network, such as GAT or GraphSAGE). The specific process is as follows:

[0076] Two types of self-supervised tasks are constructed: one is the subgraph reconstruction task, which reconstructs the node and edge features of the original subgraph through the subgraph features extracted by the encoder; the other is the contrastive learning task, which maximizes the feature similarity of the same subgraph after different enhancement operations (such as edge deletion and amount perturbation in S4) and minimizes the feature similarity of different subgraphs.

[0077] After training through the above tasks, the encoder can extract a fixed-dimensional (e.g., 768-dimensional) transaction semantic representation vector from the transaction subgraph (including G_t and the augmented subgraph). This vector contains the subgraph's topological structure (e.g., the strength of the relationship between accounts), temporal features (e.g., changes in transaction activity), and implicit semantics (e.g., patterns such as "fund aggregation" and "decentralized transfer"), enabling a deep semantic understanding of transaction behavior.

[0078] S6. Construction of Supervised Fine-Tuning Corpus

[0079] A corpus in InstructionTuning format is constructed for subsequent supervised fine-tuning of the large language model. The input and output of the corpus are defined as follows:

[0080] Input: Uses a standardized instruction format, i.e., "Based on the semantic representation of a given account, <semantic> [Transaction semantic representation vector X_l]< / semantic> The system analyzes its security risks and issues a security report. "Where X_l is the transaction semantic representation vector extracted by S5 (linearly projected to a space matching the input dimension of the large language model);"

[0081] Output: A structured security report generated for S2, packaged in JSON format, as shown in the example below:

[0082]

[0083] The corpus is ideally sized to 100,000 to 1 million entries to ensure coverage of account samples with different risk types and transaction patterns.

[0084] S7. Supervised Fine-Tuning of Large Language Models: A pre-trained large language model (such as GPT-3.5 or LLaMA 2-70B) is selected, and supervised fine-tuning is performed using the corpus constructed in S6 to optimize the model's ability to generate security reports. The training objective of fine-tuning is to maximize the likelihood probability between the generated text and the target report (i.e., the corpus output). The loss function used is cross-entropy.

[0085]

[0086] Where, x i For input instructions, y i The target report text is N, where N is the number of corpus samples, and P(y) is the number of samples in the corpus. i |x i X l ) is the model in input x i and semantic vector X l Generate y under the condition i The probability of this is determined. The fine-tuning process uses the Adam optimizer, setting the learning rate to 5e-5 (adjustable to 1e-5 to 2e-4 depending on model size), the batch size to 32 (which can be increased to 64 if available in GPU memory), and the training epochs to 5-10. Simultaneously, the perplexity and report generation accuracy of the model are monitored using a validation set. Training stops when the validation metrics stabilize, resulting in a fine-tuned model adapted for account security report generation.

[0087] Through the above training process, the large language model can fully integrate the spatiotemporal features and semantic information of transaction data, laying the foundation for generating accurate and interpretable security reports in the subsequent reasoning stage.

[0088] like Figure 2 As shown, the reasoning process includes the following steps:

[0089] S1. User Needs Acquisition

[0090] The system receives security report assessment requests submitted by users through clients such as web interfaces, API interfaces, and mobile applications. The requests must clearly specify the unique identifier of the target account (e.g., blockchain address 0x7a250d5630b4cf539739df2c5dacb4c659f2488d) and the required parameters for report generation (e.g., assessment timeframe of the past 30 days, inclusion of cross-chain transaction risk analysis, etc.). The system verifies the validity of the request. Once the target account format is confirmed to be valid and the parameters meet the preset range, the system proceeds to the next step.

[0091] S2. Real-time Acquisition of Account Transaction Data

[0092] Based on the target account identifier, the server-side cache system (such as Redis or MongoDB) is searched. If the cache contains the account's full transaction data for the past 90 days and the data timeliness meets the requirements (e.g., the last update time is no more than 5 minutes from the current time), the data is directly extracted and processed. If the cached data is missing or expired, the full transaction data of the target account is retrieved through the real-time API interface provided by the blockchain platform (such as the eth_getTransactionByAddress interface or Polygon's getTransactions interface), including:

[0093] Structured fields: transaction hash, timestamp, sender / receiver address, transaction amount (native token and ERC-20 / ERC-721 token), gas fee, transaction status, etc.

[0094] Derived features: time-series change curve of account balance (hourly granularity), variance and standard deviation of transaction amount, frequency of cross-address transactions (distinguishing between new and old addresses), number of interactions with high-risk labeled addresses, etc., are consistent with the features defined in training process S3.

[0095] The acquired data is standardized in format (e.g., timestamps are standardized to UTC format and amounts are converted to USD) and then used as input for constructing the transaction subgraph.

[0096] S3. Real-time Construction and Enhancement of Transaction Subgraphs

[0097] The real-time trading subgraph is constructed and enhanced according to the method defined in training procedure S4. The specific steps are as follows:

[0098] Time-series slicing: Based on the user-specified evaluation time range, real-time transaction data is divided into fixed time windows (consistent with the training phase, preferably 12 hours) to generate time-slice sequences. Where G′ t Let T' represent the real-time transaction subgraph within the t-th window, where T' is the total number of time segments.

[0099] Subgraph enhancement: for each G′ t Perform the same augmentation operations as during the training phase: randomly delete edges with probability p (0.1-0.2 as during training) to simulate packet loss in real-time data transmission; add Gaussian noise to the transaction amount. The time window is randomly shifted by ±30 minutes to ensure that the subgraph features are consistent with the distribution of the training data.

[0100] Feature definition: Node feature X′ t Includes metrics such as transaction frequency, average amount, and balance change rate within the real-time window, with edge feature A′. t The normalized product matrix of transaction amount and frequency, with feature dimensions and calculation method similar to X in the training phase. t A t Complete consistency ensures the consistency of model inputs.

[0101] S4. Transaction semantic extraction based on self-supervised learning

[0102] Load the transaction semantic encoder that has been trained in training process S5 (parameters frozen, no updates), and load the real-time augmented subgraph G′ constructed in S3. t The input encoder extracts the topological and temporal features of the subgraph through graph convolutional layers and attention mechanisms, and then performs pooling operations to obtain a 768-dimensional real-time transaction semantic representation vector X′. l This vector contains the target account's transaction patterns (such as fund flows, counterparty types, and frequency patterns) and potential risk characteristics (such as the intensity of interaction with anonymous addresses) within the assessment time frame.

[0103] S5. Security Report Generation and Post-processing

[0104] Report generation: Combines human commands (such as "Analyze the security risks of account 0x7a250d56... in the past 30 days and generate a report including risk level and a list of abnormal transactions") with real-time semantic vector X′ l By concatenating the components, the model input is formed: Input = [instruction] + <semantic> X'_l< / semantic> The input is fed into the finely tuned large language model (such as the finely tuned GPT-3.5) in the training process S7, and the initial security report text is obtained through the autoregressive generation mechanism (Token-by-Token generation).

[0105] Post-processing:

[0106] Template matching: Use regular expressions (e.g., risk level: [high|medium|low] risk) to extract core fields from the report and verify whether they cover the three major modules of risk assessment, behavior analysis, and anomaly detection;

[0107] Conflict detection: Logical conflicts are detected through a rule engine (such as Drools). For example, when a report simultaneously shows "Risk level: low risk" and "There are 5 anonymous transactions with a single amount exceeding 100 ETH in the past 7 days", an alarm is triggered and it is marked as requiring manual review.

[0108] Standardize the format: Convert the validated report into JSON format, as shown in the example below:

[0109]

[0110]

[0111] Return result: The standardized JSON format report is returned to the user client via HTTPS interface, and a snapshot of the report is retained on the server for audit traceability.

[0112] Through the above reasoning process, end-to-end automated processing from user request submission to security report generation can be achieved, with response time controlled within 3-10 seconds (depending on the amount of transaction data and network latency), meeting the needs of real-time risk control scenarios.

[0113] The various embodiments described in this specification are presented in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating digital asset account security reports based on a large language model, characterized in that, This includes the training process and the inference process; The training process includes the following steps: T1. Collect and clean account security reports, which include risk assessment tags, transaction behavior statistics and anomaly detection results. The cleaning process includes removing redundant information and extracting core fields. T2. Based on a predefined security report template, a large model is used to convert the cleaned account security report into a structured format, which includes risk assessment, behavior analysis, and anomaly detection fields; T3. Obtain and preprocess all transaction data of the account, wherein the transaction data includes structured fields and derived features; T4. Construct and enhance the transaction subgraph of the preprocessed transaction data to obtain the enhanced subgraph; T5. Based on the self-supervised learning task, the transaction semantic representation vector is extracted from the augmented subgraph through the transaction semantic encoder; T6. Construct a supervised fine-tuning corpus. The input of the supervised fine-tuning corpus is the concatenation of the representation vectors of human instructions and transaction semantics, and the output is the structured security report obtained in T2. T7. Use the aforementioned supervised fine-tuning corpus to perform supervised fine-tuning on the large language model; The reasoning process includes the following steps: R1. Obtain user requests for security report assessment of the target account; R2. Real-time acquisition of full transaction data for the target account; R3. Perform the transaction subgraph construction and enhancement steps as described in training process T4 on the real-time acquired transaction data to obtain the real-time enhanced subgraph; R4. Use the trained transaction semantic encoder to extract the representation vector of real-time transaction semantics from the real-time augmented subgraph; R5. After concatenating the representation vectors of human instructions and real-time transaction semantics, input them into the fine-tuned large language model to generate a security report and perform post-processing. The processed security report is then returned to the user.

2. The method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the training process T1, removing redundant information includes removing unstructured text; extracting core fields includes extracting risk assessment level, abnormal transaction address and active time window through regular expression matching and manual verification.

3. The method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the training process T2, the process of converting the cleaned account security report into a structured format using a large model includes: generating a summary of the cleaned account security report using the large model, extracting risk assessment criteria and abnormal pattern descriptions; and outputting the extracted results in a structured manner according to risk assessment, behavioral analysis, and anomaly detection fields. The risk assessment includes quantitative scores and risk levels, the behavioral analysis includes transaction frequency distribution and fund flow network topology, and the anomaly detection includes suspicious transaction timestamps and a list of associated addresses.

4. The method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the training process T3, the structured fields include transaction hash, timestamp, sender address, receiver address, and transaction amount; Derivative features include time-series changes in account balances, variance in transaction amounts, and frequency of cross-address transactions.

5. The method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the training process T4, the construction and enhancement of the transaction subgraph includes: dividing the transaction data into time segments according to a fixed time window to generate a time segment sequence; applying random edge deletion, transaction amount perturbation, and time window offset operations to each time segment sequence to generate positive sample pairs for comparative learning; defining node features as a multi-dimensional vector containing transaction frequency, average amount, amount variance, and balance change rate; and defining edge features as a weighted adjacency matrix, wherein the weight of the weighted adjacency matrix is ​​the normalized product of transaction amount and frequency.

6. The method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the training process T5, the extraction of the representation vector of transaction semantics based on the self-supervised learning task includes: using the internal structure and pattern of the transaction subgraph, the implicit features of transaction semantics are automatically learned by the transaction semantic encoder to obtain the representation vector of transaction semantics.

7. The method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the training process T6, the format of the manual instruction is "Based on the semantic representation of the given account, <semantic> [Representation vector of transaction semantics]< / semantic> "Analyze its security risks and issue a security report"; the structured security report encapsulates risk assessment and behavior analysis fields in JSON format.

8. The method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the training process T7, the training objective of supervised fine-tuning is to maximize the likelihood probability between the generated text and the structured security report. Cross-entropy is used as the loss function, and the Adam optimizer is used to optimize the model.

9. The method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the inference process R2, obtaining the full transaction data of the target account in real time includes: if the transaction data of the target account is in the server cache, then the transaction data is retrieved directly; if the transaction data of the target account is not in the server cache, then it is retrieved in real time through the blockchain platform API.

10. A method for generating a digital asset account security report based on a large language model according to claim 1, characterized in that, In the inference process R5, the post-processing of the generated security report includes: matching predefined template fields using regular expressions; detecting contradictory descriptions in the report using a rule engine, triggering an alarm when a contradictory description is detected; and returning the verified security report to the user in JSON format.

Images