Block chain abnormal user detection method and system based on resistance perception

Abstract

The invention relates to the technical field of block chain anomaly detection, in particular to a block chain anomaly user detection method and system based on resistance perception. The method comprises the following steps: performing node feature extraction, structure coding and feature fusion on the basis of preprocessed data to obtain a node feature matrix; performing feature enhancement on the node feature matrix by using an effective resistance-based feature enhancement mechanism; aggregating the enhanced features by using a multi-hop aggregation mechanism based on resistance perception to obtain node high-dimensional embedded features; and carrying out classification and optimization training on the node high-dimensional embedded features, and outputting a risk prediction result. According to the method, efficient modeling of an interactive network on a complex chain and accurate detection of abnormal users are realized. Compared with a traditional graph neural network model which only depends on local neighborhood statistics, the method can capture local interaction relation and global structure dependence at the same time, and significantly improves the accuracy and robustness of abnormal user identification.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of blockchain anomaly detection, in particular to a blockchain anomaly user detection method and system based on resistance perception. BACKGROUND

[0002] With the development of graph neural network (GNN) technology, the existing technology begins to regard an account as a graph node, and regards a transaction as a weighted or directed edge, learns a node representation through neighborhood aggregation, and typical methods include GCN, GraphSAGE, GAT and the like. Such a model has achieved certain performance improvement in the chain anomaly identification task compared with traditional methods. However, the blockchain transaction network has the characteristics of complex fund flow direction, explicit long-range association, frequent multi-level covert transfer structure and the like, and the existing GNN model usually depends on local neighborhood average aggregation and fixed level propagation, and has two types of core adaptability problems: firstly, legal batch collection behavior and multi-level complex transaction link can all be expressed as a highly close local neighborhood structure, and uniform weighted neighborhood propagation is difficult to accurately distinguish the two; secondly, a long-range fund chain often crosses more than three hops, and shallow propagation is difficult to capture global dependence, and blindly increasing the number of aggregation layers is easy to cause feature oversmoothing and information degradation. In addition, there are a large number of structural noise edges introduced by airdrop, robot account and batch transfer on the chain, and the traditional GNN is easy to amplify the noise by multiple times in the message passing process, thereby causing the abnormal identification boundary to deviate.

[0003] In view of the characteristics of high noise, weak link dependence and cross-level behavior association commonly existing in the blockchain transaction graph, researchers begin to introduce an effective resistance and other global connectivity measurement tools to re-measure the association strength between nodes. The effective resistance can reflect the overall accessibility of the fund transmission path, and performs excellently in tasks such as graph sparsification and community division. However, the existing methods directly use the resistance measurement through edge deletion or graph topology reconstruction, which is easy to damage the original semantic consistency of the transaction graph; at the same time, how to continuously, learnably and adaptively fuse the effective resistance and the feature aggregation process of the graph neural network still lacks effective solutions, which limits the direct application of resistance in the blockchain fraud detection scene.

[0004] Therefore, there is an urgent need for a unified modeling framework that can retain the original transaction semantic structure, re-label the strength of weak related links, and realize adaptive feature aggregation in multi-hop propagation. SUMMARY

[0005] In order to solve the problems of structural noise interference, long-range dependence modeling deficiency, high misjudgment rate caused by data imbalance and difficulty in multi-hop evolution feature extraction in the blockchain anomaly user detection, the application provides a blockchain anomaly user detection method and system based on resistance perception.

[0006] In a first aspect, the present application provides a blockchain abnormal user detection method based on resistance perception, which adopts the following technical solution: An original transaction data set is obtained. The obtained original transaction data set is preprocessed. Node feature extraction, structure coding and feature fusion are performed based on the preprocessed data to obtain a node feature matrix. The node feature matrix is enhanced based on an effective resistance-based feature enhancement mechanism. The enhanced features are aggregated based on a multi-hop aggregation mechanism based on resistance perception to obtain node high-dimensional embedding features. The node high-dimensional embedding features are classified and optimized, and a risk prediction result is output.

[0007] In a second aspect, a blockchain abnormal user detection system based on resistance perception is provided, which comprises: A data acquisition module configured to obtain an original transaction data set. A preprocessing module configured to preprocess the obtained original transaction data set. A feature matrix module configured to perform node feature extraction, structure coding and feature fusion based on the preprocessed data to obtain a node feature matrix. A feature enhancement module configured to enhance the node feature matrix based on an effective resistance-based feature enhancement mechanism. An aggregation module configured to aggregate the enhanced features based on a multi-hop aggregation mechanism based on resistance perception to obtain node high-dimensional embedding features. A prediction module configured to classify and optimize the node high-dimensional embedding features and output a risk prediction result.

[0008] In a third aspect, the present application provides a computer-readable storage medium having a plurality of instructions stored therein, the instructions being adapted to be loaded and executed by a processor of a terminal device to implement the blockchain abnormal user detection method based on resistance perception.

[0009] In a fourth aspect, the present application provides a terminal device comprising a processor and a computer-readable storage medium, the processor being configured to implement the instructions, and the computer-readable storage medium being configured to store a plurality of instructions, the instructions being adapted to be loaded and executed by the processor to implement the blockchain abnormal user detection method based on resistance perception.

[0010] In summary, the present application has the following beneficial technical effects: The present application aims at the technical bottlenecks of the existing blockchain abnormal user detection method, such as insufficient global structure perception, improper feature propagation control, weak model robustness and poor result interpretability, and proposes a blockchain abnormal user identification method based on resistance enhancement and multi-hop attention aggregation. The method realizes efficient modeling of complex interaction network on the chain and accurate detection of abnormal users through global topology modeling guided by resistance, adaptive propagation of hop number and multi-layer attention aggregation mechanism. Compared with the traditional graph neural network model which only relies on local neighborhood statistics, the present application can simultaneously capture local interaction relationships and global structure dependencies, significantly improving the accuracy and robustness of abnormal user identification.

[0011] In terms of feature structure modeling, the resistance weighting mechanism proposed by the present application redefines the weight of the edge in the graph by calculating the effective resistance between nodes, making the connectivity strength of the transaction path more consistent with the real fund flow relationship. This mechanism realizes continuous modeling of global structure at the network level, effectively suppressing isolated noise transactions and redundant edges that interfere with feature propagation. At the same time, combined with the resistance-guided hop number adaptive control strategy, the model can automatically determine the optimal propagation depth according to the decay trend of the average resistance weight, balancing the information transmission range and the risk of feature degradation, thereby effectively avoiding the problems of over-smoothing and feature dissipation in traditional graph neural networks. Further, through the multi-hop attention aggregation module, the model can adaptively fuse feature information at different propagation levels, focusing on strengthening the interaction signals on low-resistance and high-correlation paths, and ensuring accurate capture of latent abnormal user groups and multi-layer value chain transfer relationships.

[0012] In terms of model optimization and stability, the present application introduces structure disturbance and node regularization strategies to improve the generalization ability and anti-interference performance of the model by randomly discarding part of the edge connections (DropEdge) and applying feature noise during the training phase. Experimental verification based on real data shows that the proposed method significantly outperforms the mainstream control models in key evaluation indicators. On the test set, the Micro-F1 value reaches 88.3%, the Macro-F1 value is 86.1%, the precision and recall are 87.9% and 84.7% respectively, all of which are higher than those of GAT, GraphSAGE and Cluster-GCN models; at the same time, the single batch inference time is only 0.78 seconds, which is about 19% higher than the 0.96 seconds of Cluster-GCN. In addition, the robustness retention rate (RI) in the high disturbance scene is still as high as 0.88, significantly leading the average level of 0.79 of traditional models. In summary, the present application realizes systematic breakthroughs in structure modeling, propagation control and stability optimization, and has strong engineering deployment value and promotion potential. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 is a schematic diagram of a blockchain abnormal user detection method based on resistance perception according to an embodiment of the present application; Figure 2 is a performance comparison diagram of the blockchain abnormal user detection method of embodiment 1 of the present application; Figure 3 is a method reasoning time consumption comparison diagram of embodiment 1 of the present application; Figure 4 is a precision diagram of different methods under disturbance of embodiment 1 of the present application; Figure 5 is a method model framework diagram of the present application of embodiment 1 of the present application. DETAILED DESCRIPTION

[0014] The present application will be further described in detail below with reference to the accompanying drawings.

[0015] Embodiment 1 Referring to Figure 1 , the abnormal user detection method based on resistance perception of the present application comprises: (1) Data collection and transaction network construction module 1) Data acquisition and preprocessing In the blockchain abnormal user detection task, the on-chain transaction data is the most basic information source that can reflect the real behavior pattern of the account. Through the blockchain node interface or the third-party on-chain monitoring platform, the fund interaction process between accounts can be continuously collected to reflect the dynamic structural characteristics such as transaction frequency, fund direction, and in-degree and out-degree changes. However, the on-chain transaction record often has problems such as heterogeneous data sources, non-uniform field formats, and a high proportion of noise transactions, and is also accompanied by a large number of background transactions unrelated to abnormal detection (such as zero-amount transfer, system internal call, batch automated clearing, etc.), which will weaken the discriminant ability of the account behavior pattern. Therefore, a robust on-chain data acquisition and preprocessing process needs to be designed to extract the semantic structure that can stably represent the account interaction characteristics.

[0016] In the data collection stage, the present application continuously acquires transaction records through the blockchain full node program or the public data interface. The collected data includes transaction hash, sending account address, receiving account address, transaction amount, timestamp, transaction fee, and transaction type, etc. multi-dimensional attributes. In order to ensure the structural consistency, the system uses the standard block synchronization mechanism to update the on-chain state regularly, and ensures the data integrity and time continuity.

[0017] For the collected original transaction data, considering that it has problems such as heterogeneous sources, non-uniform field definitions, and containing a large number of redundant transactions, the technical solution designs a data preprocessing process.

[0018] Let the original transaction data set be represented as: , wherein,T Total number of transactions, C Number of characteristic channels of transactions, including amount, timestamp, gas fee, etc.

[0019] In order to reduce noise interference and improve feature quality, the system performs filtering operation on the original transaction data. The filtering function is defined as: , Wherein, d represents a single transaction record, amount is the transaction amount, and type is the transaction type. This filtering operation is used to retain transactions with real value transfer, eliminate zero amount, internal call and non-monetary transactions, so as to improve the effectiveness and robustness of data.

[0020] After completing data cleaning, the system constructs a transaction network based on the transaction relationship between accounts. Define the adjacency matrix A As follows: , Thus, the edge set . The node set V in the network represents the on-chain account entity, and each edge represents the fund flow relationship between accounts.

[0021] After data preprocessing and feature extraction, the standardized transaction network finally obtained can be expressed as: , Wherein, is the data processing and network construction function; V is the node set; E is the edge set; Y is the account category label matrix.

[0022] This transaction network realizes the structural expression of the interaction relationship between on-chain accounts in technology, and can retain the transaction topology and behavior pattern at the same time. Through the above method, the interference of redundant transactions on feature extraction can be effectively reduced, the stability and accuracy of the subsequent abnormal account identification model can be improved, and high-quality modeling of account behavior network can be realized.

[0023] 2) Node feature extraction and structure coding Transaction behavior feature extraction The transaction sequence of each node v i at time step (t) can be expressed as: , Wherein is the transaction timestamp, is the transaction amount, is the number of transactions.

[0024] System calculation statistical characteristics: , An 8-dimensional transaction statistical vector is formed to characterize the fund flow pattern of an account.

[0025] Structural topology feature extraction To capture the location and local connection patterns of accounts within the network, this invention calculates the following metrics: degree With out This reflects the balance between account activity and fund flows; clustering coefficient PageRank measures the degree of closure between a node and its neighbors; This represents the centrality and influence of an account within the overall transaction network. It forms a structural feature vector: , Position encoding and global structure embedding To incorporate global geometric information, this invention computes the directed graph Laplacian matrix. And obtain the matrix composed of its first s non-trivial eigenvectors: , in for L The eigenvectors represent the relative positions of nodes in the global topology space. U This will be used as the node location encoding input to subsequent modules to help capture cross-regional value flow relationships.

[0026] 3) Feature fusion and normalization Based on the above characteristics, a complete node feature matrix is ​​constructed: , in This indicates a feature concatenation operation. To eliminate scale differences between features of different dimensions, the system performs... Zero-mean standardization and normalization were performed on each dimension: , in , The first j The mean and standard deviation of the features are calculated. After normalization, an input matrix with a uniform scale is obtained, ensuring that different features are comparable during model learning.

[0027] This module outputs the transaction network structure. and node feature matrix This serves as the input for the subsequent "resistance feature enhancement module." This invention reconstructs the dynamic interaction relationships between on-chain accounts at the graph structure level and achieves the transformation from raw transaction records to a high-dimensional structured representation at the feature level, providing a stable and discriminative representation basis for downstream abnormal account identification.

[0028] (2) Resistance sensing feature enhancement module In on-chain account interaction graphs, the value flow relationships between nodes (addresses) are complex and highly heterogeneous. Conventional feature propagation methods based on adjacency matrices only consider local one-hop or fixed multi-hop neighbors, failing to capture potential global structural dependencies between nodes. Especially in on-chain abnormal behavior identification scenarios, high-risk accounts often conceal their true behavioral characteristics through multi-level transfers, fictitious address chains, or asset return paths, making it difficult for traditional graph models to characterize the features of "remote dependencies" and "global coupling" at the structural level.

[0029] To address this problem, this invention proposes a feature enhancement mechanism based on effective resistance to measure the global connection strength between nodes and accordingly apply resistance-aware weighting to the adjacency matrix, thereby strengthening important structural paths and suppressing noise relationships at the propagation level of the graph neural network.

[0030] 1) Theoretical Motivation and Problem Modeling In electrical network theory, the effective resistance between nodes can be considered as "resistance" to information flow, reflecting the ease of information transmission between two nodes. When there are multiple short and reliable paths between nodes, the equivalent resistance is small, indicating high communication efficiency between them; conversely, if the connection paths are sparse or there are bottlenecks, the resistance value is high, indicating limited interaction between nodes. This property has a natural correspondence with the strength of value flow between addresses in a blockchain on-chain account interaction network. Therefore, incorporating effective resistance into the adjacency weight model of graph neural networks can achieve a quantitative representation of the global correlation of nodes.

[0031] Assume the original transaction network is a weighted directed graph. G =( V , E , W ),in V For a set of account nodes, E For the set of transaction edges, W ij Indicates from account i to account j The transaction strength. The out-degree of a node is defined as: , The total volume of the graph is defined as Further define the degree matrix. And the transition probability matrix: , in P ij Indicates from node i To the node j The transition probability. The stationary distribution vector can be obtained from random walk theory. ,satisfy .remember The Laplace matrix of a directed graph is defined as: , in I It is an identity matrix. This Laplace matrix comprehensively considers the inflow and outflow of nodes and the transition characteristics of random walks, and is an important tool for characterizing the directional structure of transaction graphs.

[0032] 2) Effective resistance calculation and global connectivity In this invention, the effective resistance between nodes is defined as: , in The Moore-Penrose pseudoinverse of the Laplace matrix. and They are nodes u and v The unit basis vector. This quantity reflects the "energy consumption" of information propagation between two nodes, and can naturally characterize the diversity and accessibility of global paths in the graph.

[0033] In a physical interpretation, if each edge in the view represents a resistor... For wires with high resistance, the smaller the effective resistance, the stronger the equivalent conductivity between the two nodes; conversely, a higher effective resistance indicates stronger structural isolation. Since fraudulent accounts often form close interactions through high-frequency fund transfers, their equivalent resistance is significantly lower than that of ordinary nodes. Therefore, this indicator can be directly used as a physical quantitative basis for the strength of node association.

[0034] To reduce computational complexity during the calculation process, this invention employs a random walk subgraph approximation method. That is, for each target node... v Perform a finite-step random walk to construct a subgraph containing its multi-hop neighborhood. Calculate the Laplace of its subgraph Then, the approximate effective resistance is obtained through pseudo-inverse operation: , in( i , j ) are nodes ( v , u )exist The index in the matrix. This approximate calculation method can significantly reduce the matrix inversion overhead while ensuring the ability to represent global features, making it suitable for large-scale blockchain transaction networks.

[0035] 3) Resistor-guided adjacency weighting and affinity normalization After obtaining the effective resistance between node pairs, the present invention further constructs... A resistance-guided affinity matrix is ​​constructed to replace the original adjacency relationships, achieving the goal of "strengthening important connections and weakening noise paths." The affinity function is defined as follows: , in Control the decay rate, The degree of nonlinearity affected by the resistance is adjusted. To maintain numerical stability, a small constant is set, and the adjacency weight of each node is normalized: , The normalized resistance-sensing adjacency matrix is ​​denoted as This matrix reconstructs the connection weights of the transaction network at the topological level, enabling the model to automatically focus on low-resistance, high-reliability path structures during subsequent information propagation.

[0036] From a geometric perspective, the resistance reweighting operation is equivalent to performing a nonlinear transformation on neighboring nodes in the feature space based on path accessibility, compressing the influence range of distant, low-confidence neighbors, and expanding the weight of local tight clusters, so that the feature propagation process of nodes exhibits the characteristics of "resistance-guided aggregation".

[0037] 4) Resistance enhancement feature fusion mechanism After obtaining the resistance-aware adjacency matrix, this invention generates enhanced feature representations of nodes through neighborhood-weighted aggregation. For any node... v Its enhanced features are calculated as follows: , in x v For the characteristics of the node itself, w ( v , u ) represents the resistance weighting coefficient, and Concat represents the concatenation operation. This formula integrates the local attributes of a node with the weighted features of its low-resistance neighbors, achieving a unity of structure awareness and semantic aggregation.

[0038] In terms of system implementation, this module outputs a resistance-weighted adjacency matrix. With enhanced feature matrix This serves as the input to the subsequent resistor-guided multi-hop aggregation module, providing the model with globally perceptible structural priors. Through this mechanism, the system gains the ability to transition from local relation modeling to global topology awareness, laying the foundation for global reasoning in the identification of fraudulent accounts in complex blockchain networks.

[0039] (3) Resistor-guided multi-hop aggregation module In blockchain user interaction networks, the behavioral patterns of abnormal users are usually not limited to directly connected value transfer relationships, but rather form complex structural dependencies spanning multiple hops through multi-level transit paths, circular backflow channels, or implicit value transfer chains. Traditional graph neural network models that rely solely on one- or two-hop neighborhood propagation struggle to capture this type of long-range interaction information; while blindly increasing the number of propagation layers can lead to overly smoothed features, causing the model to lose its ability to distinguish between different users. To resolve these contradictions, this invention proposes a resistance-aware multi-hop aggregation mechanism. This mechanism adaptively adjusts the cross-hop feature propagation intensity through resistance-weighted adjacency relationships and combines attention weights for multi-scale fusion, thereby maintaining the ability to capture global dependencies while avoiding ineffective diffusion.

[0040] 1) Motivation and Modeling Approach for Multi-hop Propagation Blockchain user interaction graphs exhibit "small-world" and "local cluster" characteristics, meaning a heterogeneous connection structure is formed by a small number of highly active users and a large number of low-frequency users. Abnormal users often transfer value across multiple clusters, forming hidden connections through small transfers. If only one-hop neighborhoods are considered, the model can only obtain local patterns; if the propagation depth is increased uncontrollably, a large amount of noise will be introduced. Based on this, this invention proposes a resistance-guided multi-hop propagation mechanism. Utilizing the physical property that resistance affinity decreases with the number of hops, it automatically controls the depth and intensity of information diffusion, achieving "global perception within a bounded range."

[0041] Let the adjacency matrix after processing by the resistance feature enhancement module be: The node feature matrix is To model multi-hop propagation relationships, this invention generates propagation features for different hop counts through matrix exponentiation: , in Represents the characteristics of the node itself. Indicates the process k The global response state of nodes after hop propagation. Matrix exponentiation essentially simulates the multi-layered diffusion process of messages in a graph structure, allowing each node to... k Within the jump, it senses information about high-confidence nodes with lower resistance in its neighborhood.

[0042] 2) Resistance attenuation law and adaptive jump number truncation During propagation, as the number of hops increases, the resistivity between nodes decreases. The propagation exhibits an exponential decay trend. This means that information transmission between distant nodes is limited, and after a certain number of hops, the contribution of new information gradually approaches zero. Continued propagation not only introduces nodes with high resistance noise but may also cause over-smoothing of features, making all node representations converge. To address this, this invention proposes a resistance-guided hop count truncation criterion, which adaptively determines the optimal propagation depth by monitoring the decay of average resistance affinity with the number of hops. .

[0043] Definition of the first k The set of jump node pairs is: , in Represents a node ( u , v The shortest path length between () nodes. For the node pairs in this set, calculate the average resistance weight: , Set tolerance parameters Define the set of acceptable jumps: , The optimal hop count cutoff depth is: , This criterion can dynamically balance the "depth" and "effectiveness" of feature propagation: when the resistance average weight attenuation exceeds a threshold... At this point, the model stops spreading to prevent excessive propagation from amplifying noise.

[0044] 3) Skip Feature Sequence Modeling and Spatial Projection After determining the effective hop count range, this invention stacks the hop features hierarchically to form a cross-scale feature sequence, which is used to capture the state changes of nodes under different propagation radii. For nodes v Its multi-hop feature sequence is defined as: , in This is the feature projection matrix, used to map different jump features to a unified semantic space. This feature sequence spatially characterizes the multi-level aggregation state evolution of nodes from local to global, providing a basic representation for subsequent attention aggregation.

[0045] In this way, the system can explicitly express the "response curves of nodes at different resistance scales." That is, in low-resistance neighborhoods, node characteristics are mainly affected by local isomorphism, while in high-resistance extended regions, global topological constraints are reflected. Multi-scale modeling enables the model to have differentiated perception capabilities for transaction dependencies at different levels.

[0046] 4) Multi-hop attention convergence mechanism To select the most discriminative structural information from different hop features, this invention designs a resistor-guided multi-hop attention mechanism that adaptively weights and fuses each hop feature. Attention weights The calculation formula is: , in For nodes v The k Jump embedding vector, For the learnable attention parameter vector, LeakyReLU is a linear rectified function with leakage, ensuring that the gradient is preserved in the negative region.

[0047] The final node representation is calculated as follows: , By using attention weighting, the model can adaptively allocate contribution weights for different hop features based on the node context. For example, for highly aggregated fraud clusters, smaller hop features are often more identifiable; while for multi-level fund transfer chains, longer hop features contain more potential fraud patterns.

[0048] This mechanism not only improves the structural adaptability of the model, but also enhances the interpretability of features, making it easier to visualize and interpret the detection results in security audit scenarios.

[0049] 5) Residual connectivity and stable training strategies To avoid feature decay or gradient vanishing during multi-hop aggregation, this invention introduces a residual connection mechanism in each aggregation operation, linearly superimposing the current layer output with the previous layer input: , in This represents the node representation at level l. For trainable weight matrix, It is a non-linear activation function. The residual structure allows the model to maintain information flow as the number of layers increases, avoiding excessive gradient decay in deep networks.

[0050] In terms of system implementation, the output of this module includes: the final node embedding matrix. each of the rows Representation Nodes vThe overall structural state; and the skip-level attention weight matrix. This module can be used as input and for visual interpretation in the subsequent fraud account classification module. It enables the entire system to perform hierarchical analysis of transaction patterns at multiple scales, providing solid structural support for the identification and tracking of complex blockchain fraud.

[0051] (4) User classification and model training module This module is primarily responsible for classifying and optimizing the high-dimensional embedded features of nodes output by the resistor-guided multi-hop aggregation module, thereby enabling intelligent identification and risk warning of normal users and various types of abnormal users in a blockchain environment. This module establishes a supervised learning mechanism, combining cross-entropy loss, regularization constraints, and dynamic optimization strategies to ensure stable convergence and generalization performance of the model on large-scale sparse transaction networks. Its core processes include: classification mapping modeling, loss function design, parameter optimization training, and system inference output.

[0052] 1) Classification mapping modeling After the aforementioned resistance sensing and multi-hop aggregation processing, each node v All have embedding vectors that contain both global structural and local behavioral features. This feature vector comprehensively reflects the multi-layered semantic information of an account, including its topological position in the transaction network, fund flow characteristics, and the strength of its association with suspicious accounts. To transform these embedded vectors into distinguishable account type labels, this invention designs a multi-layered linear mapping and probability normalization module.

[0053] Define the classification mapping function: , in, A set embedded for all nodes. This is the classification weight matrix. Let C be the bias vector, and C be the total number of classes. The Softmax function maps the output to a multi-class probability distribution: , This module outputs the probability value of each node belonging to different categories (such as resource-consuming users, high-frequency intermediary users, regular trading users, high-volatility trading users, risk-transfer related users, high-frequency random interaction users, etc.), thereby providing a probability quantification basis for subsequent risk identification and security warning.

[0054] To enhance the nonlinear representation capability of features, this invention optionally adds one or more nonlinear transformation layers before the classifier: , in The hidden layer weight matrix is... It is a non-linear activation function (such as ReLU or GELU). This design further improves the model's ability to fit complex boundary distributions, enabling the classifier to distinguish similar transaction features under different abnormal behaviors.

[0055] 2) Loss function design and regularization constraints To achieve effective training of the model in semi-supervised scenarios, this invention uses the cross-entropy loss function as the main optimization objective, applying it only to the set of labeled nodes. Supervised learning is performed. The loss function is defined as: , in Represents a node v The true label distribution This represents the predicted probability value. The loss function measures the difference in distribution between the model output and the true label, and optimizes the classifier and previous layer parameters through gradient backpropagation.

[0056] To improve the model's generalization ability and prevent overfitting, this invention introduces parameter regularization constraints. The overall optimization objective is defined as: , in Represents the complete set of trainable parameters of the model (including wait), This is the regularization coefficient, used to limit model instability caused by excessively large weights. The introduction of the regularization term can suppress overlearning of noisy features while maintaining classification accuracy.

[0057] Furthermore, to enhance the robustness and anti-interference ability of the model, this invention introduces the DropEdge strategy and a node perturbation regularization term. The DropEdge strategy reduces the strong dependence of specific local structures on the model by randomly discarding a portion of edge connections in each training iteration, thereby improving its resistance to network perturbations. The node perturbation regularization term enhances the model's stability in nearest-neighbor states by applying small perturbations to node embeddings in the feature space. Its expression is as follows: in This is Gaussian perturbation noise. This represents the network mapping function. The final combined loss is: 3) Parameter optimization and training mechanism The model training employs a phased joint optimization strategy. First, the resistance affinity parameter... Pre-tuning is performed to ensure that the adjacency reweighting process stably reflects the global structural relationships between nodes. Then, the Adam optimizer is used for end-to-end gradient updates, with a learning rate set to [value missing]. And enable the learning rate decay strategy to prevent oscillations.

[0058] During training, this invention employs a batch node sampling mechanism to reduce the memory burden of large-scale graph computation. Specifically, in each iteration, a subset of subgraphs is randomly selected for forward propagation and gradient updates, allowing the model to gradually converge to the global optimum on local substructures. For the resistance pseudo-inverse calculation, the system uses a sparse matrix block approximation method to avoid the computational explosion problem caused by directly solving the full graph pseudo-inverse matrix. This method achieves this by randomly sampling multiple local subgraphs. Compute approximate pseudo-inverses on each subgraph The results are then weighted and fused across the entire graph to achieve a balance between computational complexity and accuracy.

[0059] 4) Model Inference and Abnormal User Identification After the model is trained, the system performs forward propagation on all nodes in the graph during the inference phase, outputting the category probability vector for each user. According to the principle of maximum probability: , The predicted category for each user is obtained. For anomaly detection tasks, the system focuses on nodes categorized as "suspicious behavior" or "abnormal interaction," and further calculates anomaly risk scores. , in This is a set of fraud categories. The risk score reflects the confidence level that a user is judged to be an abnormal type and can be used to generate tiered alerts. The system classifies the prediction results into low-risk, medium-risk, and high-risk users, generating automated early warning reports.

[0060] This invention transforms the high-dimensional embedding vectors output by a graph neural network into actionable abnormal user risk prediction results through this module, forming a closed-loop process from "structural modeling—resistance sensing—multi-hop propagation—risk identification." The method ultimately outputs account classification results, fraud risk scores, and corresponding explanatory reports, providing an efficient, intelligent, and interpretable solution for blockchain ecosystem security and on-chain behavior compliance analysis.

[0061] 4. Experimental verification To systematically verify the performance advantages of the proposed blockchain abnormal user identification method in complex on-chain interactive network scenarios, a large-scale blockchain user interaction graph experimental dataset was constructed. The data originated from the publicly available XBlock platform, collecting real blockchain transaction records and account characteristic information. The dataset consists of the following three types of structural features: ① Transaction topology features: the transfer connections and transaction frequency between accounts, reflecting the capital flow structure between accounts; ② Account behavior features: including statistical features such as total transaction amount, average in-degree, average out-degree, income-expenditure ratio, transaction interval time, and balance change rate, used to characterize the dynamic behavior patterns of accounts; ③ Graph structure features: describing the global correlation between node pairs by calculating the effective resistance between nodes and the graph Laplacian matrix inversion results.

[0062] This dataset contains 1,402,220 nodes and 2,815,028 edges. Nodes represent on-chain user entities, and edges represent value interaction behaviors. Based on publicly available annotations and on-chain audit information, users are categorized into six types: ① resource-consuming users; ② high-frequency intermediary users; ③ regular transaction users; ④ high-volatility transaction users; ⑤ risk-transfer related users; and ⑥ high-frequency random interaction users. 816 labeled nodes were selected as supervised samples, while the remaining unlabeled nodes participated in semi-supervised propagation learning. The dataset was divided into training, validation, and test sets in a 6:2:2 ratio to ensure a balanced distribution across categories.

[0063] To verify the advantages of the method of this invention in terms of robustness, classification accuracy and computational efficiency, the following four mainstream benchmark models were compared: ①GCN: standard graph convolutional network, based on local neighborhood feature propagation; ②GAT: neighborhood weighted model based on attention mechanism; ③GraphSAGE: structural model based on sampled aggregation; ④Cluster-GCN: adopts graph partitioning strategy to improve the training efficiency of large-scale graphs.

[0064] All methods were evaluated under the same data partitioning and experimental environment. To test the robustness of the model under characteristic noise conditions, three levels of perturbation were set: ① Mild perturbation (10%): 10% Gaussian noise was randomly injected into node features to simulate mild feature interference; ② Moderate perturbation (20%): The noise injection ratio was increased to 20% to simulate partial feature loss and spoofed transactions on the real chain; ③ Strong perturbation (30%): 30% noise was randomly injected into node features and a small number of edge connections were discarded to simulate extreme anomalies and severe feature contamination environments. This perturbation design can systematically evaluate the robustness and anti-interference performance of the model under different noise intensities.

[0065] Evaluation metrics include: ① Precision (Prec) and Recall (Rec): assessing fine-grained classification performance; ② Micro-F1 score and Macro-F1 score: measuring overall and class balance performance; ④ Inference time (Time): latency of single-batch data processing, reflecting system deployment efficiency.

[0066] Table 1. Comparison of data from different methods under five major indicators. Method name Prec Rec Micro-F1 Macro-F1 Time(s) GCN 79.2% 77.1% 78.1% 75.5% 1.24 GAT 80.5% 78.3% 79.4% 76.8% 1.32 GraphSAGE 82.4% 80.1% 81.2% 78.9% 1.10 Cluster-GCN 83.6% 81.8% 82.6% 80.8% 0.96 The method of the present invention 87.9% 84.7% 88.3% 86.1% 0.78 The experimental results are shown in Table 1. Figure 2 , Figure 3 , Figure 4 As shown, the method of this invention achieves the best results in precision, recall, and overall F1 score, improving the Micro-F1 score by approximately 5.7% compared to the existing best method, Cluster-GCN. Furthermore, in terms of computational efficiency, the single-batch inference time is only 0.78 seconds, significantly better than GCN's 1.24 seconds and GAT's 1.32 seconds, demonstrating superior structural modeling and computational efficiency.

[0067] To further verify the robustness of the model, performance changes were evaluated under different feature perturbation intensities (10%, 20%, and 30%). The results show that when the noise proportion is 10%, the performance degradation of the proposed method is less than 1.8%; at 20% perturbation, it decreases by approximately 3.1%; even in a strong noise environment with 30% perturbation, the model's Micro-F1 value remains above 0.85, while traditional models experience an average degradation of 7%–12%. This indicates that the proposed method possesses significant feature robustness and anti-interference capability. Furthermore, through visualization analysis of the resistance adjacency matrix and multi-hop attention weight distribution, the model can focus on high-conductivity paths and low-resistance subgraph regions, thereby accurately identifying suspicious fund circulation and multi-level transfer accounts. These results verify the superiority of the resistance enhancement mechanism and multi-hop aggregation strategy in the present invention in terms of feature propagation effectiveness and interpretability.

[0068] In summary, the method of this invention demonstrates significant advantages in four dimensions: classification accuracy, robustness, time efficiency, and interpretability. Compared to traditional graph neural networks based on local propagation, this method achieves a "depth-efficiency" balance in feature diffusion by introducing global resistance relationship modeling and an adaptive multi-hop aggregation strategy. It maintains high recognition rates and stable outputs in interaction graphs on large-scale heterogeneous blockchains, fully demonstrating its practical application value and potential for widespread application in blockchain security monitoring, fraud detection, and user behavior profiling.

[0069] Example 2 This embodiment provides a blockchain abnormal user detection system based on resistance sensing; A computer-readable storage medium storing a plurality of instructions adapted for loading and execution by a processor of a terminal device, the aforementioned resistance-sensing-based blockchain abnormal user detection method.

[0070] A terminal device includes a processor and a computer-readable storage medium, the processor being configured to implement various instructions; the computer-readable storage medium being configured to store multiple instructions adapted for loading and execution by the processor of the described resistance-sensing-based blockchain abnormal user detection method.

[0071] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A blockchain abnormal user detection method based on resistance sensing, characterized in that, include: Obtain the original transaction dataset; Perform data preprocessing on the acquired raw transaction dataset; Based on the preprocessed data, node feature extraction, structural encoding, and feature fusion are performed to obtain the node feature matrix. Feature enhancement of the node feature matrix is ​​performed using a feature enhancement mechanism based on effective resistance; The enhanced features are aggregated using a resistance-sensing multi-hop aggregation mechanism to obtain high-dimensional embedding features of nodes; The high-dimensional embedded features of nodes are classified and optimized for training, and the risk prediction results are output.

2. The blockchain abnormal user detection method based on resistance sensing according to claim 1, characterized in that, The data preprocessing of the acquired raw transaction dataset includes assuming the raw transaction dataset is represented as: ,in, T The total number of transactions. C To determine the number of feature channels for a transaction, and to reduce noise interference and improve feature quality, a filtering operation is performed on the original transaction data. The filtering function is defined as follows: ， in, d This represents a single transaction record, where amount is the transaction amount and type is the transaction type. After data cleaning, a transaction network is constructed based on transaction relationships, and an adjacency matrix is ​​defined. A for: ， This yields the edge set. The set of nodes in a network V Each edge represents an on-chain account entity, and each edge represents the fund flow relationship between accounts. After data preprocessing and feature extraction, the final standardized transaction network is represented as follows: in, Functions for data processing and network construction; V A set of nodes; E Let it be the set of edges; Y This is a matrix of account category labels.

3. The blockchain abnormal user detection method based on resistance sensing according to claim 2, characterized in that, The process of extracting node features, encoding structures, and fusing features based on preprocessed data to obtain a node feature matrix includes first extracting transaction behavior features, and then assigning each node ( v i The transaction sequence at time step (t) is represented as: ,in For transaction timestamps, For the transaction amount, The number of transactions; and then the statistical characteristics are calculated: ， This generates an 8-dimensional transaction statistical vector; then, structural topological features are extracted to capture the positional relationships and local connectivity patterns of accounts within the network, by calculating the in-degree of the indicator. , out-degree Clustering coefficient and PageRank value This forms the structural feature vector: Next, positional encoding and global structure embedding are performed. To incorporate global geometric information, the directed graph Laplacian matrix is ​​calculated. And obtain the matrix composed of its first s non-trivial eigenvectors: in for L The eigenvectors represent the relative positions of nodes in the global topological space. U The node position is encoded as input; finally, feature fusion and normalization are performed to construct a complete node feature matrix by combining the features: ,in This indicates a feature splicing operation.

4. The blockchain abnormal user detection method based on resistance sensing according to claim 3, characterized in that, The feature enhancement mechanism based on effective resistance for node feature matrix enhancement includes incorporating effective resistance into the adjacency weight model of graph neural networks to quantify the global correlation of nodes. The original transaction network is assumed to be a weighted directed graph. G =( V , E , W ),in V For a set of account nodes, E For the set of transaction edges, W ij Indicates from account i to account j The transaction strength is defined by the out-degree of a node as: The total volume of the graph is defined as Define the degree matrix And the transition probability matrix: ,in P ij Indicates from node i To the node j The transition probability, obtained from random walk theory, is the stationary distribution vector. ,satisfy ,remember The Laplace matrix of a directed graph is defined as: in I It is an identity matrix.

5. The blockchain abnormal user detection method based on resistance sensing according to claim 4, characterized in that, The feature enhancement mechanism based on effective resistance for node feature matrix enhancement also includes defining the effective resistance between nodes: ， in The Moore-Penrose pseudoinverse of the Laplace matrix. and They are nodes u and v The unit basis vectors; using the random walk subgraph approximation method, for each target node... v Perform a finite-step random walk to construct a subgraph containing its multi-hop neighborhood. Calculate the Laplace subgraph Then, the approximate effective resistance is obtained through pseudo-inverse operation: ， in( i , j ) are nodes ( v , u )exist The index in the matrix is ​​used to reduce the matrix inversion overhead while ensuring global feature representation. After obtaining the effective resistance between node pairs, a resistance-guided affinity matrix is ​​constructed to replace the original adjacency relationship, where the affinity function is defined as follows: ， in Control the decay rate, To adjust the degree of nonlinearity of the resistance effect and maintain numerical stability, a small constant is set. And the adjacency weight of each node is normalized: ， The normalized resistance-sensing adjacency matrix is ​​denoted as ; After obtaining the resistance-aware adjacency matrix, an enhanced feature representation of the nodes is generated through neighborhood weighted aggregation. For any node... v The enhanced features are calculated as follows: ， in x v For the characteristics of the node itself, w ( v , u ) represents the resistance weighting coefficient, and Concat indicates the splicing operation.

6. The blockchain abnormal user detection method based on resistance sensing according to claim 5, characterized in that, The enhanced features are aggregated using a resistance-sensing multi-hop aggregation mechanism to obtain high-dimensional embedded features of nodes. This includes using a resistance-guided multi-hop propagation mechanism to control the depth and intensity of information diffusion, achieving global perception within a bounded range. First, let the adjacency matrix after processing by the resistance feature enhancement module be... The node feature matrix is To model multi-hop propagation relationships, propagation features with different numbers of hops are generated through matrix exponentiation: ， in Represents the characteristics of the node itself. Indicates the process k The global response state of node features after jump propagation; During propagation, as the number of hops increases, the resistivity between nodes decreases. Exhibiting an exponential decay trend, the optimal propagation depth is adaptively determined by using a resistance-guided hop count cutoff criterion and monitoring the change in average resistance affinity as the hop count decreases. , where the definition of the first k The set of jump node pairs is: ， in Represents a node ( u , v Find the shortest path length between the nodes in the set, and calculate the average resistance weight for each pair of nodes in the set. ， Set tolerance parameters Define the set of acceptable jumps: ， The optimal hop count cutoff depth is: .

7. The blockchain abnormal user detection method based on resistance sensing according to claim 6, characterized in that, The process involves aggregating the enhanced features using a resistance-sensing-based multi-hop aggregation mechanism to obtain high-dimensional embedding features for the nodes. It also includes stacking the hop features hierarchically after determining the effective hop count range to form a cross-scale feature sequence, used to capture the state changes of nodes under different propagation radii. v The multi-hop feature sequence is defined as follows: ， in This is the feature projection matrix, used to map different jump features to a unified semantic space. Then, to select the most discriminative structural information from different hop features, a resistance-guided multi-hop attention mechanism is used to adaptively weight and fuse the hop features, with attention weights... The calculation formula is: ， in For nodes v The k Jump embedding vector, Given a learnable attention parameter vector, LeakyReLU is a linear rectified function with leakage, and the final node representation is calculated as follows: Finally, to avoid feature decay or gradient vanishing during multi-hop aggregation, a residual connection mechanism is introduced in each aggregation operation to linearly superimpose the output of the current layer with the input of the previous layer. ,in This represents the node representation at level l. For trainable weight matrix, It is a non-linear activation function.

8. The blockchain abnormal user detection method based on resistance sensing according to claim 7, characterized in that, The process involves classifying and optimizing the high-dimensional embedded features of nodes, and outputting risk prediction results, including classification mapping modeling. After the aforementioned resistance sensing and multi-hop aggregation processing, each node... v Embedded vectors containing both global structural and local behavioral features First, using multi-level linear mapping and probability normalization, we define a classification mapping function: ， in, A set embedded for all nodes. This is the classification weight matrix. Here, C is the bias vector, and C is the total number of classes. The Softmax function is used to map the output to a multi-class probability distribution. ， Then, to enhance the nonlinear expressive power of features, a nonlinear transformation layer is added before the classifier: ,in The hidden layer weight matrix is... The activation function is non-linear; next, a loss function and regularization constraints are constructed. To achieve effective training of the model in a semi-supervised scenario, the cross-entropy loss function is used as the main optimization objective for the labeled node set. For supervised learning, the loss function is defined as: ， in Represents a node v The true label distribution This is the predicted probability value.

9. A blockchain abnormal user detection method based on resistance sensing according to claim 8, characterized in that, The process of classifying and optimizing the high-dimensional embedded features of nodes and outputting risk prediction results also includes introducing parameter regularization constraints and defining the overall optimization objective as: ， in This represents the complete set of trainable parameters of the model. The regularization coefficient is then introduced, followed by the DropEdge strategy and node perturbation regularization term, expressed as: ， in This is Gaussian perturbation noise. The network mapping function represents the final comprehensive loss as follows: ， Finally, a parameter optimization and training mechanism is implemented, employing a phased joint optimization strategy. First, the resistance affinity parameter is optimized. After pre-tuning, the Adam optimizer is used for end-to-end gradient updates. After model training is complete, forward propagation is performed on all nodes in the graph during the inference phase to output the class probability vector for each user. According to the principle of maximum probability: ， To obtain the predicted category for each user, an anomaly risk score is further calculated for the anomaly detection task. ,in This is a collection of fraud categories.

10. A blockchain abnormal user detection system based on resistance sensing, characterized in that, include: The data acquisition module is configured to acquire the raw transaction dataset; The preprocessing module is configured to preprocess the acquired raw transaction dataset. The feature matrix module is configured to perform node feature extraction, structural encoding, and feature fusion based on the preprocessed data to obtain a node feature matrix. The feature enhancement module is configured to enhance the node feature matrix using a feature enhancement mechanism based on effective resistance. The aggregation module is configured to aggregate the enhanced features using a resistance-aware multi-hop aggregation mechanism to obtain high-dimensional embedding features of the nodes. The prediction module is configured to classify and optimize the high-dimensional embedded features of nodes and output risk prediction results.

Images