Price manipulation transaction detection method and terminal based on hypergraph neural network

Abstract

The invention discloses a price manipulation transaction detection method based on a hypergraph neural network and a terminal, belongs to the technical field of data monitoring, and aims at a hypergraph formed by heterogeneous entities in a decentralized financial protocol to execute bidirectional feature aggregation from nodes to hyperedges and from hyperedges to nodes; for the aggregated hypergraph time sequence features, capturing long-term time sequence dependence by adopting expansion causal convolution, aggregating the time sequence features through attention pooling, and capturing dynamic changes of the time sequence features; applying disturbance to the space-time fusion feature by using a fast gradient symbol method, generating an adversarial sample, constructing a mixed training set of the original sample and the adversarial sample, and performing adversarial training based on the mixed training set to obtain an attack detection model; and deploying the attack detection model on the to-be-detected data transaction node for detection. According to the method, the high-order interaction relationship among multiple entities can be accurately represented, the time sequence and dynamic characteristics in the transaction data are effectively captured, and the real-time performance and the sensitivity are improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data monitoring, and particularly relates to a price manipulation transaction detection method and terminal based on a hypergraph neural network. BACKGROUND

[0002] The rapid development of decentralized finance (DeFi) protocols has made DeFi transaction markets a target for many price manipulation attacks. These attacks often use complex transaction patterns, including multi-contract, multi-user high-frequency interactions, and cross-platform operations, which have high concealment and dynamics. Existing attack detection methods mainly rely on rule engines, statistical models, graph neural networks (GNNs), and large language models (LLMs). However, these technologies still have many shortcomings when faced with complex and high-frequency transaction patterns.

[0003] Existing DeFi protocol price manipulation detection methods usually rely on rule engines and statistical models to identify attack behavior according to price fluctuations and transaction volume patterns in transaction data. Traditional methods such as DeFiRanger (a DeFi price manipulation attack detection framework based on advanced semantic analysis), LeiShen (a lightning loan attack automatic detection tool based on asset transfer analysis), etc. detect price manipulation behavior by defining rules and pattern matching. Although these methods can detect some common attacks to some extent, they still have the following shortcomings when dealing with complex, high-dimensional data and multi-contract, multi-user interactions:

[0004] High false positive rate: Traditional rule engines are prone to misjudging attacks when faced with market fluctuations and normal transaction behavior, resulting in high false positive rates and affecting the accuracy of detection results;

[0005] Static feature limitation of attack patterns: Rule engines and statistical models usually rely on static price fluctuation patterns and are difficult to adapt to the dynamic evolution of attack patterns, making it difficult to quickly adapt when attack patterns change;

[0006] Lack of real-time response capability: Existing methods are usually difficult to process large-scale transaction data in real time, especially in high-frequency trading and complex interaction scenarios, and cannot provide accurate attack detection in a timely manner.

[0007] In recent years, emerging technologies such as graph neural networks (GNNs) and large language models (LLMs) have been applied to attack detection in DeFi protocols. Methods such as DeFiGuard (a comprehensive security protection framework for DeFi) attempt to capture complex attack patterns by constructing transaction cash flow graphs and analyzing transaction behavior using GNNs. Methods such as DeFiScope (a decentralized finance protocol monitoring framework) and AiRacleX (an AI-driven DeFi strategy optimization framework) introduce LLMs to enhance attack detection capabilities through reasoning and knowledge mining. Although these methods have improved attack detection capabilities to some extent, they still face the following problems:

[0008] Limited capture of complex interaction behavior: Although GNNs can capture relationships in transaction networks, existing GNN methods mainly rely on fixed topologies and node-edge interaction forms, making it difficult to fully represent complex interaction behavior between multiple contracts and users, especially in cross-contract and cross-platform attack scenarios, where the expressiveness is still insufficient.

[0009] Inadequate capture of temporal dynamics: Although LLMs and GNNs have enhanced dynamic detection capabilities to some extent, they still struggle to effectively model the temporal evolution of transaction behavior, especially in high-frequency trading environments, where the real-time performance and accuracy of existing methods are still not ideal.

[0010] In light of the deficiencies of the above-mentioned existing detection schemes, there is an urgent need to provide an optimized price manipulation transaction detection scheme that can more accurately represent high-order interaction relationships between multiple entities to more effectively capture temporal and dynamic characteristics in transaction data, addressing the shortcomings of traditional methods in terms of real-time performance and sensitivity.

[0011] The information disclosed in this Background section is intended only to increase an understanding of the general context of the present application, and it should not be construed as admitting that the information constitutes prior art to the present application in any form. SUMMARY

[0012] The present application aims to provide a price manipulation transaction detection method and terminal based on a hypergraph neural network, which can more accurately represent high-order interaction relationships between multiple entities, more effectively capture temporal and dynamic characteristics in transaction data through dynamic weight calculation and spatiotemporal feature modeling, and address the shortcomings of traditional methods in terms of real-time performance and sensitivity.

[0013] To achieve the above-mentioned purpose, the present application provides a price manipulation transaction detection method based on a hypergraph neural network, comprising the following steps:

[0014] For a hypergraph composed of heterogeneous entities in a decentralized finance protocol, bidirectional feature aggregation from nodes to hyperedges and from hyperedges to nodes is performed to obtain the temporal features of the hypergraph. The heterogeneous entities include users, contracts, and tokens.

[0015] For the aggregated hypergraph temporal features, dilated causal convolution is used to capture long-term temporal dependencies, and then attention pooling is used to aggregate the temporal features to capture the dynamic changes of the temporal features and obtain spatiotemporal fusion features.

[0016] The spatiotemporal fusion features are perturbed using the fast gradient sign method to generate adversarial examples. A mixed training set of original and adversarial examples is constructed. Adversarial training is performed based on the mixed training set to obtain an attack detection model.

[0017] The attack detection model is deployed on the data transaction node to be tested to detect the real-time data in the data transaction node.

[0018] Optionally, in the bidirectional feature aggregation steps from node to hyperedge and from hyperedge to node,

[0019] The node-to-hyperedge aggregation step includes using a multi-head attention mechanism for heterogeneous nodes within the hyperedge, generating query vectors, key vectors, and value vectors for each node, calculating the attention coefficients between nodes using cosine similarity, and weighting and aggregating node features to generate hyperedge embeddings.

[0020] The aggregation step from superedge to node involves weighting the embedded features of the superedge and then propagating them back to the participating nodes.

[0021] Optionally, the steps from a node to a superedge specifically include:

[0022] For hyper-edge Heterogeneous nodes within Query vector Key vector Value vector The calculation formula is: , in For learnable parameter matrix, It is a node The original feature representation.

[0023] Optionally, the steps for aggregating hyperedges to nodes specifically include:

[0024] Attention coefficient The calculation formula, based on the Softmax function and cosine similarity, is as follows: , in This is the expansion factor, used to scale the dot product result; For query vector With key vector The dot product is used to measure the number of nodes. The similarity between and j; Indicates the superedge Attention calculations are performed on all nodes within the scope;

[0025] Then, hyperedge feature generation and hyperedge embedding are performed. Obtained from the weighted aggregation node features: , Wherein, the weight is the attention coefficient. .

[0026] Optionally, in the step of capturing long-term temporal dependencies using dilated causal convolution, the causal convolutional layer uses dilated causal convolution to capture long-term dependencies of the hyperedge feature sequence: , in, As the expansion factor, The kernel size is [size]. Indicating the first digit in the expanded causal convolution kernel Weight parameters for each position; Represents the hyperedge embedding of the input At any moment eigenvalues; This is the current processing time step;

[0027] To prevent gradient vanishing, residual blocks are introduced. The formula for calculating residual blocks is as follows: , in, For the residual block at time The temporal characteristics, That is, the output of the dilated causal convolution in the previous formula, Represents the hyperedge embedding of the input At any moment eigenvalues.

[0028] Optionally, in the classifier part after the causal convolutional layer, an attention pooling layer is used to aggregate the temporal features of the entire image. : , in, This is a learnable attention query vector. For vectors With time series characteristics The inner product, Then we obtain the attention weights for each superedge. Then based on attention weights and super edge At any moment Temporal characteristics Attention-weighted aggregation is performed to obtain the temporal features of the entire image. :

[0029] Then, online classification decisions are made, and the classifier parameters are updated based on incremental learning. The full-image temporal features are input into the classifier to obtain the model's prediction of the current time step. The probability of an attack: .

[0030] Optionally, the classification loss function is weighted cross-entropy: , in, The label indicates whether the transaction is an attack; 1 = attack, 0 = normal. This is the binary cross-entropy loss, used to train the attack detection classifier.

[0031] Optionally, the step of performing adversarial training based on the hybrid training set specifically includes:

[0032] Adversarial hyperedge features are generated using gradient perturbation and based on the fast gradient sign method. : , in, The disturbance intensity is represented by .

[0033] Optionally, after the step of performing adversarial training based on the hybrid training set, the method further includes:

[0034] The abrupt changes in features between adjacent hyperedges are limited by feature smoothing constraints, as shown in the following formula: , in For super-edge The set of adjacent superedges, For two adjacent superedges, Feature embedding for the two hyperedges, For feature smoothing loss;

[0035] Finally, the total loss function is expressed as the joint optimization classification loss and regularization term: , in, This is the total loss, used for final training. For the hyperedge feature smoothing regularization term, Let λ be the classification loss and λ be the weight hyperparameter.

[0036] In a second aspect, the present invention also provides a price manipulation transaction detection terminal based on a hypergraph neural network, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0037] For a hypergraph composed of heterogeneous entities in a decentralized finance protocol, bidirectional feature aggregation from nodes to hyperedges and from hyperedges to nodes is performed to obtain the temporal features of the hypergraph. The heterogeneous entities include users, contracts, and tokens.

[0038] For the aggregated hypergraph temporal features, dilated causal convolution is used to capture long-term temporal dependencies, and then attention pooling is used to aggregate the temporal features to capture the dynamic changes of the temporal features.

[0039] Adversarial examples are generated using the fast gradient sign method, and a hybrid training set of original and adversarial examples is constructed. Adversarial training is performed based on the hybrid training set to obtain an attack detection model.

[0040] The attack detection model is deployed on the data transaction node to be tested to detect the real-time data in the data transaction node.

[0041] Compared with the prior art, the price manipulation transaction detection method and terminal based on hypergraph neural network according to the present invention has the following advantages or beneficial effects;

[0042] This invention is the first to apply hypergraph neural networks to the detection of price manipulation transactions in DeFi protocols. By utilizing the "node-hyperedge-node" aggregation mechanism of hypergraph neural networks, it accurately represents the complex interaction relationships between multiple contracts, users and tokens, breaking through the limitations of traditional graph models in capturing multi-contract and multi-user interactions, and improving the ability to detect complex attack patterns.

[0043] This invention combines temporal modeling with dynamic graph classification technology, which can dynamically construct temporal hypergraphs based on the spatiotemporal features of trading behavior, and use temporal attention pooling method to aggregate features, capture the temporal evolution pattern of trading, and detect price manipulation behavior in real time in high-frequency trading scenarios, and optimize detection accuracy through temporal learning.

[0044] This invention proposes an adversarial example generation and training strategy based on hypergraph neural networks. It employs adversarial example generation technology, leveraging perturbation graph structures and transaction features to enhance the model's robustness. Through this training strategy, the invention can effectively cope with changing attack patterns in complex environments, ensuring the detection system possesses strong generalization capabilities.

[0045] Through the above-mentioned improvements, this invention provides a novel detection method for price manipulation transactions in DeFi protocols. It can achieve efficient and real-time attack detection in complex and dynamic transaction networks, and significantly improve the accuracy and robustness of the model in high-frequency, multi-contract interaction scenarios. Attached Figure Description

[0046] Figure 1 A flowchart of a price manipulation transaction detection method based on a hypergraph neural network according to an embodiment of the present invention;

[0047] Figure 2 A logical framework diagram of a price manipulation transaction detection method based on a hypergraph neural network according to an embodiment of the present invention;

[0048] Figure 3 A schematic diagram of the structure of a price manipulation transaction detection terminal based on a hypergraph neural network according to an embodiment of the present invention;

[0049] Labeling: 1. A price manipulation transaction detection terminal based on hypergraph neural network; 2. Memory; 3. Controller. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein.

[0052] It should be understood that in the various embodiments of the present invention, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0053] It should be understood that in this invention, "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0054] It should be understood that in this invention, "multiple" refers to two or more. "And / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, "and / or B" can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "Contains A, B, and C", "Contains A, B, and C" means that all three A, B, and C are contained; "Contains A, B, or C" means that one of A, B, and C is contained; "Contains A, B, and / or C" means that any one, two, or three of A, B, and C are contained.

[0055] It should be understood that in this invention, "B corresponding to A", "B corresponding to A", "A and B correspond", or "B and A correspond" means that B is associated with A, and B can be determined based on A. Determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information. Matching A and B is defined as a similarity between A and B that is greater than or equal to a preset threshold.

[0056] Depending on the context, "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection."

[0057] With the rapid development of decentralized finance (DeFi) protocols, their trading markets have become a major target for price manipulation attacks. These attacks rely on complex patterns such as multi-contract, multi-user high-frequency interactions, and cross-platform operations, exhibiting strong concealment and dynamic evolution characteristics. While existing detection methods encompass technologies such as rule engines, statistical models, graph neural networks (GNNs), and large-scale language models (LLMs), they still have significant limitations. These limitations include high false positive rates that easily interfere with normal trading, static features that struggle to adapt to dynamic changes in attack patterns, and insufficient real-time processing capabilities for large-scale, high-frequency data. Although the emerging GNN and LLM methods have improved detection accuracy by constructing transaction graphs or enhancing inference capabilities, they are still limited by the fixed topology of GNNs in representing complex multi-contract and cross-platform interactions, and the lack of modeling capabilities for the temporal evolution of transactions in high-frequency scenarios by LLM and GNNs, making it difficult to meet the demands for real-time, accurate detection. To address the shortcomings of existing methods in capturing dynamic transactions and representing multi-entity interactions, this patent proposes a price manipulation attack detection method based on hypergraph neural networks. Unlike traditional graph models, hypergraphs allow a single hyperedge to connect multiple nodes, enabling more accurate representation of higher-order interactions between multiple entities. Furthermore, hypergraph neural networks can more effectively capture the temporal and dynamic features of transaction data through dynamic weight calculation and spatiotemporal feature modeling, overcoming the shortcomings of traditional methods in terms of real-time performance and sensitivity.

[0058] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0059] like Figure 1 and Figure 2 As shown, the price manipulation transaction detection method based on a hypergraph neural network according to a preferred embodiment of the present invention includes the following steps:

[0060] For hypergraphs composed of heterogeneous entities in decentralized finance (DeFi) protocols, bidirectional feature aggregation from nodes to hyperedges and from hyperedges to nodes is performed to obtain the temporal features of the hypergraph. These heterogeneous entities include users, contracts, and tokens, for example... Figure 2 As shown, multiple transaction nodes (such as n1, n2…n8) communicate through a “hyperedge” ( 1, 2, (3) Connection, the global features of the hyperedge are passed back to the nodes, and the feature matrix is ​​combined to represent different feature dimensions to realize the reverse injection of the hyperedge's group context information to a single node, so that each transaction node can learn the global association features of its group.

[0061] For the aggregated hypergraph temporal features, dilated causal convolution is first used to capture long-term temporal dependencies. To simultaneously model the changing trends at different time scales, multiple dilated convolutional layers are stacked in parallel, and multi-granularity features are fused through skip connections to obtain a more robust temporal representation. Subsequently, as... Figure 2 As shown, the processed sequence features are input into a Bi-LSTM to capture deep correlation patterns across time periods (such as the linkage of trading behaviors over multiple days). Based on this, Temporal Attention Pooling automatically assigns higher weights to key time steps, emphasizing abnormal trading periods, thereby improving the ability to identify manipulation patterns. After passing through a fully connected layer (FC) and Softmax, the final output is a classification result indicating whether it is a "price manipulation transaction".

[0062] The spatiotemporal fusion features are perturbed using the Fast Gradient Sign Method (FGSM) to generate adversarial examples, constructing a hybrid training set of original and adversarial examples, where the original and adversarial examples are paired and mixed in a 1:1 ratio. To address the class imbalance problem in the original data, a resampling strategy is further employed to balance the overall class distribution. Adversarial training is then performed based on this hybrid training set to obtain an attack detection model. Specifically, perturbations are applied to the hyperedge features to generate semantically equivalent but structurally heterogeneous adversarial examples, with the perturbation amplitude ϵ ≤ 0.1%·‖h. e 2. Avoid disrupting the original transaction logic. For example... Figure 2 As shown, an "adversarial perturbation" is applied to the original sample transaction sequence by a "generator" to simulate a "disruptive transaction pattern." The "original sample" and the "adversarial sample" are then fused by a "mixer" to form a hybrid training sample. Training the model with this hybrid training sample can improve its detection capability in complex and disruptive scenarios. Traditional adversarial training only targets a single attack pattern; this method improves the model's generalization ability by covering multiple types of attacks, such as price manipulation and flash loans, through a hybrid training set.

[0063] The attack detection model is deployed on the data transaction node to be tested to detect the real-time data in the data transaction node.

[0064] In this embodiment of the invention, during the bidirectional feature aggregation steps from node to hyperedge and from hyperedge to node,

[0065] The node-to-hyperedge aggregation step includes aggregating the features of heterogeneous nodes within the hyperedge, using a multi-head attention mechanism to capture the complex dependencies between nodes, generating query vectors, key vectors, and value vectors for each heterogeneous node, measuring the mutual importance between nodes and hyperedges by calculating cosine similarity, generating corresponding attention coefficients, and weighting and aggregating node features to generate hyperedge embeddings.

[0066] The aggregation step from hyperedges to nodes involves weighted averaging of the hyperedge embedding features and then propagating them back to the participating nodes. It should be noted that during the aggregation process between hyperedges and nodes, the hyperedge features are propagated back to each participating node, and a weighted average is used to generate the hyperedge embedding. Each hyperedge embedding reflects the interaction features between the nodes it connects to, further strengthening the semantic representation of the hyperedge.

[0067] In this embodiment of the invention, the aggregation step from node to hyperedge specifically includes:

[0068] For hyper-edge Heterogeneous nodes within (e.g., users, contracts, tokens), design a multi-head attention mechanism to capture cross-modal feature dependencies and query vectors. Key vector Value vector The calculation formula is: , in For learnable parameter matrix, It is a node The original feature representation.

[0069] In this embodiment of the invention, the step of aggregation from hyperedge to node specifically includes:

[0070] Node importance is measured using cosine similarity, and the attention coefficient is used. The calculation formula, based on the Softmax function and cosine similarity, is as follows: , in This is the expansion factor, used to scale the dot product result; For query vector With key vector The dot product is used to measure the number of nodes. The similarity between and j; Indicates the superedge Attention calculations are performed on all nodes within the scope;

[0071] Then, hyperedge feature generation and hyperedge embedding are performed. Obtained from the weighted aggregation node features: , in, Indicates the superedge Attention is calculated for all nodes within the scope, with weights equal to the attention coefficients. .

[0072] Through this "node-hyperedge-node" aggregation mechanism, the embodiments of the present invention can effectively integrate the characteristics of different types of nodes and capture cross-contract and cross-platform transaction relationships.

[0073] Transactions in DeFi protocols typically exhibit temporal evolution characteristics, which traditional graph neural networks struggle to capture. To enhance the model's temporal modeling capabilities, this invention introduces a Temporal Convolutional Network (TCN) and Dilated Causal Convolution, using a dilation factor... and kernel size To capture dependencies over a longer time span and effectively model temporal features in transaction data, this method effectively avoids the information loss problem in conventional convolutional networks and enhances the ability to model the long-term evolution of transaction patterns. In this embodiment of the invention, in the step of capturing long-term temporal dependencies using dilated causal convolution, the causal convolutional layer uses dilated causal convolution to capture the long-term dependencies of the hyperedge feature sequence: , in, As the expansion factor, The kernel size; Indicating the first digit in the expanded causal convolution kernel Weight parameters for each position; Represents the hyperedge embedding of the input At any moment eigenvalues; It is the current "time step" being processed.

[0074] Furthermore, residual blocks are introduced to prevent gradient vanishing and increase model depth. The formula for calculating residual blocks is as follows: , in, The temporal characteristics of the residual block at time t are shown. That is, the output of the dilated causal convolution in the previous formula, Represents the hyperedge embedding of the input The eigenvalue at time t.

[0075] In this embodiment of the invention, an attention pooling layer is used to aggregate temporal features of the entire image in the classifier part after the causal convolutional layer. : , in, This is a learnable attention query vector. For vectors With time series characteristics The inner product, Then we obtain the attention weights for each superedge. Then, based on attention weights and super edge At any moment Temporal characteristics Attention-weighted aggregation is performed to obtain the temporal features of the entire image. .

[0076] Then, online classification decisions are made, and the classifier parameters are updated based on incremental learning. The full-image temporal features are input into the classifier to obtain the model's prediction of the current time step. The probability of an attack: The classification loss function is the weighted cross-entropy, calculated as follows: , in, The label indicates whether the transaction is an attack (1 = attack, 0 = normal). This is the binary cross-entropy loss, used to train the attack detection classifier.

[0077] Regarding the adversarial training strategy, a hybrid training set is constructed, which mixes the original samples and adversarial samples in a certain proportion. Then, adversarial training is used to improve the robustness of the model. In this embodiment of the invention, the step of adversarial training based on the hybrid training set specifically includes: using gradient perturbation to generate adversarial hyperedge features based on the Fast Gradient Sign Method (FGSM). Disrupt the feature data in the transaction flow to generate attack samples that are semantically equivalent but structurally different: , in, The perturbation strength is represented by these adversarial hyperedge feature samples, which help the model learn stronger attack pattern recognition capabilities during training. Simultaneously, by randomly permuting the transaction order in the attack chain, semantically equivalent but structurally heterogeneous adversarial examples are constructed.

[0078] In this embodiment of the invention, after the step of performing adversarial training based on the hybrid training set, the method further includes:

[0079] By restricting abrupt changes in adjacent hyperedge features through feature smoothing constraints, the robustness of the model remains unaffected under complex attack environments, thus enhancing model stability. The model trained using this regularization method can cope with diverse attack scenarios in the real world. The formula is as follows: , in, For super-edge The set of adjacent superedges, For two adjacent superedges, Feature embedding for the two hyperedges, For feature smoothing loss.

[0080] By constraining the geometric similarity of adjacent hyperedge features, the model is forced to learn smooth topological relationships, thus avoiding misjudgments caused by abrupt changes in local features introduced by adversarial examples. The attack chain length can be dynamically adjusted according to the attack scenario, enhancing adaptability to complex attack paths.

[0081] Finally, the total loss function is expressed as the joint optimization classification loss and regularization term: , in, This is the total loss, used for final training. For the hyperedge feature smoothing regularization term, For classification loss (attack detection). These are weighted hyperparameters. (The text abruptly ends here, likely due to an incomplete sentence or a formatting error.) To balance classification performance with feature smoothing requirements, the model avoids overfitting adversarial examples or ignoring key attack patterns. It learns attack-discriminating features through classification loss, while a regularization term suppresses irrelevant feature fluctuations; these two measures work together to improve model stability.

[0082] This invention utilizes a "node-hyperedge-node" feature aggregation mechanism to aggregate features of heterogeneous entities in DeFi protocols through hyperedges. Simultaneously, through temporal feature modeling and dynamic graph classification methods, it can capture the spatiotemporal characteristics of transaction behavior in real time, accurately identifying cross-contract and cross-platform price manipulation attacks. Furthermore, this invention combines anti-sample generation and training mechanisms to enhance the model's ability to identify abnormal behavior, especially when facing new attack patterns, by strengthening the model's robustness through adversarial training. Through these innovations, this invention provides an efficient and real-time solution for transaction monitoring and price manipulation attack detection in DeFi protocols.

[0083] This invention also provides an embodiment of a price manipulation transaction detection terminal based on a hypergraph neural network, specifically as follows: Figure 3 As shown, the terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps:

[0084] For a hypergraph composed of heterogeneous entities in a decentralized finance protocol, bidirectional feature aggregation from nodes to hyperedges and from hyperedges to nodes is performed to obtain the temporal features of the hypergraph. The heterogeneous entities include users, contracts, and tokens.

[0085] For the aggregated hypergraph temporal features, dilated causal convolution is used to capture long-term temporal dependencies, and then attention pooling is used to aggregate the temporal features to capture the dynamic changes of the temporal features.

[0086] Adversarial examples are generated using the fast gradient sign method, and a hybrid training set of original and adversarial examples is constructed. Adversarial training is performed based on the hybrid training set to obtain an attack detection model.

[0087] The attack detection model is deployed on the data transaction node to be tested to detect the real-time data in the data transaction node.

[0088] It should be noted that the program executed by the processor in the price manipulation transaction detection terminal based on the hypergraph neural network described above is based on the same concept as the method embodiment of this application. It is the step corresponding to the price manipulation transaction detection method based on the hypergraph neural network described above. All implementation methods in the above method embodiment are applicable to the embodiment of this terminal. For details on its specific functions and the resulting technical effects, please refer to the method embodiment section, which will not be repeated here.

[0089] This application is described with reference to flowchart illustrations and / or block diagrams of methods, terminals, and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0090] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0091] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0092] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A method for detecting price manipulation transactions based on a hypergraph neural network, characterized in that, Includes the following steps: For a hypergraph composed of heterogeneous entities in a decentralized finance protocol, bidirectional feature aggregation from nodes to hyperedges and from hyperedges to nodes is performed to obtain the temporal features of the hypergraph. The heterogeneous entities include users, contracts, and tokens. For the aggregated hypergraph temporal features, dilated causal convolution is used to capture long-term temporal dependencies, and then attention pooling is used to aggregate the temporal features to capture the dynamic changes of the temporal features and obtain spatiotemporal fusion features. The spatiotemporal fusion features are perturbed using the fast gradient sign method to generate adversarial examples. A mixed training set of original and adversarial examples is constructed. Adversarial training is performed based on the mixed training set to obtain an attack detection model. The attack detection model is deployed on the data transaction node to be tested to detect the real-time data in the data transaction node.

2. The price manipulation transaction detection method based on hypergraph neural network according to claim 1, characterized in that, In the bidirectional feature aggregation steps from node to hyperedge and from hyperedge to node, The node-to-hyperedge aggregation step includes using a multi-head attention mechanism for heterogeneous nodes within the hyperedge, generating query vectors, key vectors, and value vectors for each node, calculating the attention coefficients between nodes using cosine similarity, and weighting and aggregating node features to generate hyperedge embeddings. The aggregation step from superedge to node involves weighting the embedded features of the superedge and then propagating them back to the participating nodes.

3. The price manipulation transaction detection method based on hypergraph neural network according to claim 2, characterized in that, The steps from a node to a superedge specifically include: For hyper-edge Heterogeneous nodes within Query vector Key vector Value vector The calculation formula is: ， in For learnable parameter matrix, It is a node The original feature representation.

4. The price manipulation transaction detection method based on hypergraph neural network according to claim 2, characterized in that, The steps for aggregating hyperedges to nodes specifically include: Attention coefficient The calculation formula, based on the Softmax function and cosine similarity, is as follows: ， in This is the expansion factor, used to scale the dot product result; For query vector With key vector The dot product is used to measure the number of nodes. The similarity between and j; Indicates the superedge Attention calculations are performed on all nodes within the scope; Then, hyperedge feature generation and hyperedge embedding are performed. Obtained from the weighted aggregation node features: ， Wherein, the weight is the attention coefficient. .

5. The price manipulation transaction detection method based on hypergraph neural network according to claim 1, characterized in that, In the step of capturing long-term temporal dependencies using dilated causal convolution, the causal convolutional layer uses dilated causal convolution to capture long-term dependencies of the hyperedge feature sequence: ， in, As the expansion factor, The kernel size is [size]. Indicating the first digit in the expanded causal convolution kernel Weight parameters for each position; Represents the hyperedge embedding of the input At any moment eigenvalues; This is the current processing time step; To prevent gradient vanishing, residual blocks are introduced. The formula for calculating residual blocks is as follows: ， in, The temporal characteristics of the residual block at time t are shown. That is, the output of the dilated causal convolution in the previous formula, Represents the hyperedge embedding of the input The eigenvalue at time t.

6. The price manipulation transaction detection method based on a hypergraph neural network according to claim 5, characterized in that, In the classifier part after the causal convolutional layer, an attention pooling layer is used to aggregate the temporal features of the entire image. : ， in, This is a learnable attention query vector. For vectors With time series characteristics The inner product, Then we obtain the attention weights for each superedge. Then based on attention weights and super edge At any moment Temporal characteristics Attention-weighted aggregation is performed to obtain the temporal features of the entire image. ; Then, online classification decisions are made, and the classifier parameters are updated based on incremental learning. The full-image temporal features are input into the classifier to obtain the model's prediction of the current time step. The probability of an attack: .

7. The price manipulation transaction detection method based on a hypergraph neural network according to claim 6, characterized in that, The classification loss function is the weighted cross-entropy: ， in, The label indicates whether the transaction is an attack; 1 = attack, 0 = normal. This is the binary cross-entropy loss, used to train the attack detection classifier.

8. The price manipulation transaction detection method based on hypergraph neural network according to claim 1, characterized in that, The step of performing adversarial training based on the hybrid training set specifically includes: Adversarial hyperedge features are generated using gradient perturbation and based on the fast gradient sign method. : ， in, The disturbance intensity is represented by .

9. The price manipulation transaction detection method based on a hypergraph neural network according to claim 8, characterized in that, Following the step of performing adversarial training based on the hybrid training set, the method further includes: The abrupt changes in features between adjacent hyperedges are limited by feature smoothing constraints, as shown in the following formula: ， in, For super-edge The set of adjacent superedges, For two adjacent superedges, Feature embedding for the two hyperedges, For feature smoothing loss; Finally, the total loss function is expressed as the joint optimization classification loss and regularization term: ， in, This is the total loss, used for final training. For the hyperedge feature smoothing regularization term, For classifying losses, This is a weighted hyperparameter.

10. A price manipulation transaction detection terminal based on a hypergraph neural network, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it performs the following steps: For a hypergraph composed of heterogeneous entities in a decentralized finance protocol, bidirectional feature aggregation from nodes to hyperedges and from hyperedges to nodes is performed to obtain the temporal features of the hypergraph. The heterogeneous entities include users, contracts, and tokens. For the aggregated hypergraph temporal features, dilated causal convolution is used to capture long-term temporal dependencies, and then attention pooling is used to aggregate the temporal features to capture the dynamic changes of the temporal features. Adversarial examples are generated using the fast gradient sign method, and a hybrid training set of original and adversarial examples is constructed. Adversarial training is performed based on the hybrid training set to obtain an attack detection model. The attack detection model is deployed on the data transaction node to be tested to detect the real-time data in the data transaction node.

Images