Ethereum fraud detection method based on deep integration of transaction semantics and graph structure

Abstract

This invention belongs to the field of blockchain information security technology and relates to an Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure. The method includes: acquiring Ethereum transaction records and preprocessing them to obtain account transaction sequences; inputting the account transaction sequences into a trained transaction sequence feature extraction network to output a sequence embedding matrix; inputting the weighted undirected graph and the self-transaction sequences of the sequence embedding matrix into a trained graph neural network to output a structural feature embedding matrix; performing element-wise fusion of the self-transaction sequences of the sequence embedding matrix and the structural feature embedding matrix; inputting the self-transaction sequences of the sequence embedding matrix and the fused structural embedding matrix into a trained classifier to obtain sequence prediction scores and structural prediction scores; merging the sequence prediction scores and structural prediction scores to obtain an account prediction score; and determining whether the transaction account is a fraudulent account or a legitimate account based on the account prediction score. This method can achieve high-precision identification of fraudulent accounts.

Description

Technical Field

[0001] This invention belongs to the field of blockchain information security technology, specifically relating to an Ethereum fraud detection method based on the deep integration of transaction semantics and graph structure. Background Technology

[0002] As a distributed and trusted data storage technology, blockchain features decentralization, tamper-proofing, traceability, and scalability, ensuring the authenticity and security of data records. Ethereum, currently the largest blockchain platform supporting smart contracts and the second-largest cryptocurrency platform, leverages its anonymity and unsupervised mechanisms to achieve the advantages of decentralization, but also amplifies the security risks of crypto assets. Among these, Ethereum fraud is one of the most significant threats to transaction security. Therefore, detecting and preventing fraud on Ethereum has become a crucial research topic.

[0003] Current mainstream Ethereum fraud detection methods are mainly divided into two categories: static transaction network analysis and dynamic transaction sequence modeling. The former relies on graph models to mine the topological relationships between accounts, while the latter draws on natural language processing techniques to capture the temporal behavior of accounts. For example, Bert4ETH is a pre-trained Transformer model for Ethereum fraud detection. It focuses on semantic modeling of transaction sequences, utilizing the excellent sequence modeling capabilities of the Transformer to capture the sequential behavior patterns of Ethereum user accounts. It also incorporates three strategies: reducing repetition, mitigating skew, and handling heterogeneity, achieving significant progress in phishing account detection and deanonymization tasks.

[0004] However, in terms of transaction context modeling, existing Ethereum fraud detection methods mostly rely on static transaction network analysis, typically simplifying transaction events into numerical features. They lack in-depth modeling of transaction semantics and interaction intent, failing to distinguish between seemingly similar but intentionally different transaction behaviors. Regarding behavioral similarity modeling, previous methods have paid less attention to fine-grained correlations between transaction attributes, failing to identify highly deceptive fraudulent behaviors with complex interaction patterns. In terms of multimodal information fusion, some studies have attempted to combine graph structure and sequence information, but most employ a post-fusion strategy, i.e., training separately and then concatenating features, failing to leverage the synergistic effect of the two and limiting overall detection performance. Summary of the Invention

[0005] To address the aforementioned problems in existing technologies, this invention provides an Ethereum fraud detection method based on a deep fusion of transaction semantics and graph structure. The technical problem to be solved by this invention is achieved through the following technical solution:

[0006] This invention provides an Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure, comprising the following steps:

[0007] The Ethereum transaction records are retrieved, and data cleaning and self-transaction sequence insertion are performed to obtain the account transaction sequence.

[0008] The account transaction sequence is input into a trained transaction sequence feature extraction network, and the dynamic semantic features of the transaction are captured by the self-attention mechanism, and the sequence embedding matrix containing deep semantics is output.

[0009] A weighted undirected graph is constructed based on the Ethereum transaction records. The weighted undirected graph and the self-transaction sequence of the sequence embedding matrix are input into a trained graph neural network for feature update, and the output is a structural feature embedding matrix containing global topological patterns.

[0010] The self-transaction sequence of the sequence embedding matrix is ​​fused with the structural feature embedding matrix element-wise using trained fusion coefficients to obtain the fused structural embedding matrix.

[0011] The self-transaction sequence of the sequence embedding matrix and the fused structure embedding matrix are respectively input into the trained classifier to obtain the sequence prediction score and the structure prediction score. The sequence prediction score and the structure prediction score are then combined to obtain the account prediction score.

[0012] Based on the predicted account score, the transaction account is determined to be either a fraudulent account or a legitimate account, and the detection result is obtained.

[0013] In one embodiment of the present invention, each Ethereum transaction record includes an address, transaction amount, timestamp, sender / receiver type, account type, count, and location index.

[0014] In one embodiment of the present invention, Ethereum transaction records are acquired and data cleaning and self-transaction sequence insertion are performed to obtain an account transaction sequence, including:

[0015] Remove failed original transactions from the Ethereum transaction log to obtain valid transactions;

[0016] Duplicate transactions with the same address, consistent sending and receiving types, and consecutive occurrences within 72 hours among the valid transactions are aggregated into a single transaction. The transaction amounts are summed and the timestamp of the first transaction is retained to obtain the aggregated valid transactions.

[0017] The aggregated valid transactions are arranged in descending order of timestamp, and a self-transaction sequence is inserted at the beginning of the sequence to obtain the account transaction sequence; wherein, the address of the self-transaction sequence is the account itself, and the other characteristics are null values.

[0018] In one embodiment of the present invention, the account transaction sequence is input into a trained transaction sequence feature extraction network, and a self-attention mechanism is used to capture the dynamic semantic features of the transactions, outputting a sequence embedding matrix containing deep semantics, including:

[0019] A differentiated embedding strategy is adopted to convert the address, transaction amount, timestamp, receipt / delivery type, account type, count, and location index of the account transaction sequence into corresponding embedding vectors through embedding matrices; the embedding vectors of the seven-dimensional features are added element by element and stacked vertically to form the initial sequence matrix;

[0020] The trained Transformer encoder is used to capture the dynamic semantic features of the initial sequence matrix and output the sequence embedding matrix containing deep semantics.

[0021] In one embodiment of the present invention, a weighted undirected graph is constructed based on the Ethereum transaction records, and the weighted undirected graph and the self-transaction sequence of the sequence embedding matrix are input into a trained graph neural network for feature update, outputting a structural feature embedding matrix containing global topological patterns, including:

[0022] A weighted undirected graph is constructed based on the Ethereum transaction records, and the adjacency matrix and weight matrix of the weighted undirected graph are also constructed. The weighted undirected graph is represented as follows:

[0023] ;

[0024] in, For a set of account nodes, For the edge Set, edge weight For account and accounts The number of transactions;

[0025] The node features of the weighted undirected graph are initialized as the self-transaction sequence of the sequence embedding matrix to obtain an initial node feature matrix. The weighted undirected graph and the initial node feature matrix are then input into the trained graph neural network for feature updating, outputting a structural feature embedding matrix containing the global topological pattern. The feature updating in the trained graph neural network includes:

[0026] ;

[0027] ;

[0028] in, The normalized adjacency matrix, For degree matrix, It is the identity matrix. For the first The node feature matrix of the layer It is a non-linear activation function. For the first The node feature matrix of the layer For the first The learnable weight matrix of the layer.

[0029] In one embodiment of the present invention, the self-transaction sequence of the sequence embedding matrix and the structural feature embedding matrix are fused element-wise using trained fusion coefficients to obtain a fused structural embedding matrix, including:

[0030] Align the self-transaction sequence of the sequence embedding matrix with the features of the structural feature embedding matrix;

[0031] The self-transaction sequence and the structural feature embedding matrix after feature alignment are element-wise weighted and merged using trained fusion coefficients to obtain the fused structural embedding matrix.

[0032] In one embodiment of the present invention, the self-transaction sequence of the sequence embedding matrix and the fused structure embedding matrix are respectively input into a trained classifier to obtain a sequence prediction score and a structure prediction score. The sequence prediction score and the structure prediction score are then combined to obtain an account prediction score, including:

[0033] The self-transaction sequence of the sequence embedding matrix and the fused structure embedding matrix are respectively input into the trained multilayer perceptron to output the sequence prediction score and the structure prediction score:

[0034] ;

[0035] ;

[0036] in, Predict scores for the sequence. For the structure prediction score, For a sequence embedding matrix, a self-transaction sequence, The fused structure embedding matrix, It is a multilayer perceptron. For activation function, For sequence, For graph structure;

[0037] The account prediction score is obtained by merging the sequence prediction score and the structure prediction score through linear interpolation:

[0038] ;

[0039] in, Predict a score for the account. The fusion coefficient is a learnable coefficient.

[0040] In one embodiment of the present invention, the transaction sequence feature extraction network, the graph neural network, the classifier, and the fusion coefficient are obtained through joint training, the joint training process including:

[0041] Obtain the original Ethereum transaction records and perform data cleaning and self-transaction sequence insertion to obtain the original account transaction sequence;

[0042] The transaction addresses in the original account transaction sequence are randomly masked at a preset ratio and replaced with [MASK] to obtain the masked original account transaction sequence;

[0043] The original account transaction sequence after the mask is input into the transaction sequence feature extraction network to capture the dynamic semantic features of the transaction, and the output is the original sequence embedding matrix containing deep semantics;

[0044] A weighted undirected graph is constructed based on the original Ethereum transaction records. The weighted undirected graph and the self-transaction sequence of the original sequence embedding matrix are then input into the graph neural network for feature updates, and the output is an original structural feature embedding matrix containing global topological patterns.

[0045] The self-transaction sequence of the original sequence embedding matrix and the original structural feature embedding matrix are fused element-wise using a fusion coefficient to obtain the fused original structural embedding matrix.

[0046] The self-transaction sequence of the original sequence embedding matrix and the fused original structure embedding matrix are respectively input into the classifier to obtain the original sequence prediction score and the original structure prediction score. The original sequence prediction score and the original structure prediction score are then combined to obtain the original account prediction score.

[0047] The parameters of the transaction sequence feature extraction network, the graph neural network, the classifier, and the fusion coefficients are updated through backpropagation until the joint loss function converges, resulting in a trained transaction sequence feature extraction network, a trained graph neural network, a trained classifier, and trained fusion coefficients. The joint loss function includes a context address recovery loss function and a classification loss function based on the transaction sequence feature extraction network.

[0048] In one embodiment of the present invention, the context address recovery loss function is:

[0049] ;

[0050] in, For context address recovery loss function, The set of mask addresses in the sequence. It is the output of the transaction sequence feature extraction network, targeting the mask position. Contextual semantic embedding vector, For address embedding of mask address, For the negative sample set Address embedding of negative addresses, negative sample set For addresses other than the real address, This indicates transpose.

[0051] In one embodiment of the present invention, the classification loss function is:

[0052] ;

[0053] in, For classification loss function, For the final predicted score, For the properly labeled, This represents a fraudulent account. This represents a normal account.

[0054] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0055] The detection method of this invention first uses a transaction sequence feature extraction network to capture local conditional dependencies and long-range behavioral patterns using a self-attention mechanism, while guiding the model to learn implicit interaction patterns and improve the generalization of the representation. Next, in terms of structural modeling, a weighted undirected graph is constructed to represent the global account, and multi-hop neighbor information is aggregated through a graph neural network to obtain embeddings that reflect the community structure and topological location, thus supplementing the cross-account collaborative behavior that is difficult to reveal with a single transaction sequence and achieving a unified expression of the semantic and structural layers. Considering the complementarity of sequence and structural representations, a "hidden-explicit" dual learning mechanism is proposed to realize self-transaction sequence and structural representation at the embedding level. The structural feature embedding matrix element-level fusion merges sequence prediction scores and structural prediction scores at the output level, thereby achieving complementary synergy and synergistic optimization of the two types of features and enhancing the model's ability to distinguish cross-domain and long-tail fraud patterns. Therefore, by simultaneously modeling the dynamic transaction behavior and static interaction structure of accounts, this method significantly enhances the ability to understand transaction semantics and model account structural relationships, achieves two-stage fusion and joint optimization of multimodal information, improves the ability to capture dynamic transaction patterns, and enhances robustness in anonymity and missing scenarios. Thus, it can effectively identify long-term dependent and evolutionary fraud patterns and achieve high-precision identification of fraudulent accounts. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating an Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure, provided as an embodiment of the present invention.

[0057] Figure 2 This is a framework diagram of an Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure, provided in an embodiment of the present invention. Detailed Implementation

[0058] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0059] Example 1

[0060] Please see Figure 1 and Figure 2 , Figure 1 This is a flowchart illustrating an Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure, as provided in an embodiment of the present invention. Figure 2 This is a framework diagram of an Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure, provided by an embodiment of the present invention. The framework diagram describes the complete technical chain from data input to model output, following the design concept of "layered progression, dual-track parallelism, and deep fusion". It is divided into four stages: data preprocessing, transaction sequence feature extraction, dual learning, and phishing detection. Each module forms an organic whole that works collaboratively with data flow as the link.

[0061] This embodiment of the Ethereum fraud detection method based on the deep fusion of transaction semantics and graph structure specifically includes the following steps:

[0062] S11. Obtain Ethereum transaction records, perform data cleaning and self-transaction sequence insertion to obtain the account transaction sequence.

[0063] Specifically, each Ethereum transaction record includes seven dimensions: address, transaction amount, timestamp, sender / receiver type, account type, count, and location index. Among these, Figure 2 In the diagram, A0, A1, A2, A3, ..., A n Indicates the transaction address; P0, P1, P2, P3, ..., P n Indicates the location index; in the receipt / outgoing type, I indicates receipt type, O indicates outgoing type; 1, 2, 4 represent amount; T1, T2, T3, ..., T n Represents a timestamp.

[0064] Furthermore, based on blockchain data parsing technology, Ethereum transaction records are formatted, denoised, and sorted by time: First, failed original transaction records are removed from the Ethereum transaction records to obtain valid transactions, avoiding interference from invalid data; then, duplicate transactions with the same address, consistent sender / receiver type, and consecutive occurrences within 72 hours are aggregated into single transactions, summing the transaction amounts and retaining the timestamp of the first transaction to obtain aggregated valid transactions, reducing data duplication rate; finally, the aggregated valid transactions are arranged in descending order by timestamp, and a self-transaction sequence is inserted at the beginning of the sequence to obtain the account transaction sequence; where the address of the self-transaction sequence is the account itself, and the remaining characteristics are null values, such as... Figure 2 As shown, the transaction sequence CLS is the self-transaction sequence. The self-transaction sequence serves as a global anchor for sequence semantics, providing a unified starting point for subsequent feature extraction.

[0065] S12. Input the account transaction sequence into the trained transaction sequence feature extraction network, use the self-attention mechanism to capture the dynamic semantic features of the transaction, and output a sequence embedding matrix containing deep semantics.

[0066] Step S12 specifically includes:

[0067] S121. Using a differentiated embedding strategy, the address, transaction amount, timestamp, receipt / delivery type, account type, count, and location index of the account transaction sequence are converted into corresponding embedding vectors through the embedding matrix. The embedding vectors of the seven-dimensional features are added element by element and stacked vertically to form the initial matrix of the sequence.

[0068] Specifically, in the embedding layer, a differentiated embedding strategy is used to transform the seven-dimensional features of each Ethereum transaction record into embedding vectors. Discrete features are transformed into dense vectors of fixed dimensions using an embedding matrix, continuous features are first discretized using equal-width binning before embedding, and the position index captures the temporal order of the transaction using the corresponding embedding matrix. Finally, the embedding vectors of the seven-dimensional features are summed element-wise to form the initial representation vector of a single transaction. This initial representation vector incorporates all attribute information of the transaction. The initial representation vectors of N transactions belonging to the same account are then arranged sequentially in chronological order to form a matrix, resulting in a vertically stacked sequence initial matrix H. (0) .

[0069] In the seven-dimensional features, the address is a discrete feature. Each address is assigned a unique index and then mapped to a dense vector of fixed dimensions using an embedding matrix, resulting in the address embedding vector. The transaction type is represented by O and I, belonging to the binary discrete feature category. O and I are mapped to their corresponding dense vectors using an independent embedding matrix, yielding the transaction type embedding vector. The account type is a discrete feature, with 1 representing a phishing account and 0 representing a legitimate account. It is converted to its corresponding embedding vector using an independent embedding matrix. The transaction amount is a continuous feature, represented as a floating-point number. It is first discretized using equal-width binning and then mapped to a dense vector using an embedding matrix, yielding the corresponding embedding vector. The timestamp is a continuous feature, represented as an integer. It is also discretized using equal-width binning (divided by time interval) and then embedded into a vector. The embedding matrix corresponding to the location index is a learnable parameter matrix, where each row represents a unique vector for the corresponding location. To incorporate temporal information, the embedding vector Pi of location i is added to the feature vector of the transaction at that location. Thus, even if two transactions have identical content (e.g., the amount and object are the same), as long as their temporal order is different (different location indices), adding different location vectors will result in different final representations, allowing the model to perceive the "sequential order." The counts are continuous features, represented by integers. They are first discretized using equal-width binning (divided according to the count interval), and then mapped to a dense vector of fixed dimensions using the embedding matrix to obtain the embedding vector for the counts.

[0070] S122. Use the trained Transformer encoder to capture the dynamic semantic features of the initial sequence matrix and output a sequence embedding matrix containing deep semantics.

[0071] Specifically, the initial matrix H of the sequence (0) The input to the trained Transformer encoder consists of L Transformer encoding layers. Each Transformer encoding layer contains a multi-head attention sublayer, a first residual connection and layer normalization layer, a position feedforward sublayer, and a second residual connection and layer normalization layer, all connected sequentially. The multi-head attention sublayer calculates the similarity between the query (Q), key (K), and value (V) matrices, enabling the representation of each transaction to incorporate bidirectional contextual information and effectively capture long-range temporal dependencies. The position feedforward sublayer enhances the model's ability to fit complex semantics through a non-linear transformation of the GELU activation function. Furthermore, each layer is equipped with a residual connection and layer normalization layer to prevent gradient vanishing, ultimately outputting a sequence embedding matrix H containing deep semantics. ( ) .

[0072] This embodiment uses a Transformer encoder to transform the complete transaction history of an account into a sequence representation with fine-grained semantics, incorporating multi-dimensional information such as transaction address, amount, timestamp, and account type. It utilizes a self-attention mechanism to capture local conditional dependencies and long-range behavioral patterns between transactions, achieving a deep understanding of transaction semantics and interaction intent. This allows for the differentiation of homogeneous but significantly different transaction behaviors (such as normal high-frequency transfers and fraudulent bulk transfers), solving the problem that existing technologies only simplify transactions to numerical features and cannot deeply understand transaction semantics and interaction intent.

[0073] S13. Construct a weighted undirected graph based on Ethereum transaction records, and input the weighted undirected graph and the self-transaction sequence of the sequence embedding matrix into the trained graph neural network for feature update, and output a structural feature embedding matrix containing global topological patterns.

[0074] Step S13 specifically includes:

[0075] S131. Construct a weighted undirected graph based on Ethereum transaction records, and simultaneously construct the adjacency matrix A and weight matrix W of the weighted undirected graph to quantize the graph structure.

[0076] Specifically, weighted undirected graphs focus on the global topological relationships between accounts, also known as global account interaction graphs, such as... Figure 2 As shown, the weighted undirected graph is represented as:

[0077] ;

[0078] in, For a set of account nodes, For the edge Set, edge This indicates that there are transactions between the accounts, on the side weight For account and accounts The number of transactions.

[0079] S132. Initialize the node features of the weighted undirected graph as a self-transaction sequence of the sequence embedding matrix, i.e., the sequence embedding matrix H. ( ) h in the first position ( ) 0, obtain the initial node feature matrix; and input the weighted undirected graph and the initial node feature matrix into the trained graph neural network for feature update, outputting a structural feature embedding matrix containing the global topological pattern.

[0080] Graph Neural Networks (GCNs) consist of an input layer, a first GCN convolutional layer, a second GCN convolutional layer, and an output layer. Feature updates in a trained GCN involve: first, normalizing the adjacency matrix, and then aggregating multi-hop neighbor information using an iterative formula, expressed as:

[0081] ;

[0082] ;

[0083] in, The normalized adjacency matrix, For degree matrix, It is the identity matrix. For the first The node feature matrix of the layer It is a non-linear activation function. For the first The node feature matrix of the layer For the first The learnable weight matrix of the layer.

[0084] This embodiment constructs a weighted undirected graph to represent the global account interaction graph, and uses the self-transaction sequence of the sequence embedding matrix as the initial node feature matrix. It then generates a structural feature embedding matrix of the global topology pattern through a graph neural network, thus overcoming the deficiency of existing schemes that rely solely on sequence modeling and lack global account interaction topology awareness.

[0085] S14. Using the trained fusion coefficients, the self-transaction sequence of the sequence embedding matrix and the structural feature embedding matrix are fused element-wise to obtain the fused structural embedding matrix.

[0086] Specifically, firstly, the self-transaction sequences of the sequence embedding matrix are aligned with the features of the structural feature embedding matrix; then, the feature-aligned self-transaction sequences and the structural feature embedding matrix are element-wise weighted and merged using trained fusion coefficients to obtain the fused structural embedding matrix.

[0087] S15. Input the self-transaction sequence of the sequence embedding matrix and the fused structure embedding matrix into the trained classifier to obtain the sequence prediction score and the structure prediction score respectively. Combine the sequence prediction score and the structure prediction score to obtain the account prediction score.

[0088] Specifically, the self-transaction sequence of the sequence embedding matrix and the fused structure embedding matrix are respectively input into the trained multilayer perceptron to output the sequence prediction score and the structure prediction score:

[0089] ;

[0090] ;

[0091] in, Predict scores for the sequence. For the structure prediction score, For a sequence embedding matrix, a self-transaction sequence, The fused structure embedding matrix, It is a multilayer perceptron. For activation function, For sequence, It is a graph structure.

[0092] The account prediction score is obtained by merging the sequence prediction score and the structure prediction score through linear interpolation:

[0093] ;

[0094] in, Predict a score for the account. The fusion coefficient is a learnable coefficient.

[0095] Steps S14 and S15 form the dual learning stage of the detection method in this embodiment, which is crucial for achieving deep synergy of dual-modal information. The fusion is completed in two stages: implicit embedding fusion in step S14 and explicit output fusion in step S15. In the implicit embedding fusion stage, element-wise weighted fusion of the sequence embedding matrix and the structural feature embedding matrix in the latent space balances the weights of local transaction semantics and global topological information, achieving interaction between the two. In the explicit output fusion stage, decision consistency is strengthened, reducing the risk of misjudgment in a single modality. This dual fusion mechanism achieves deep synergy between sequence semantics and structural topology, solving the problem that existing simple fusion schemes, which only merge results after feature concatenation or separate training, cannot leverage the synergistic effect of multimodal information.

[0096] S16. Determine whether the trading account is a fraudulent account or a normal account based on the account prediction score, and obtain the detection result.

[0097] Specifically, account predicted score A value greater than 0.5 indicates a fraudulent account, while a value less than or equal to 0.5 indicates a legitimate account.

[0098] The detection method of this invention first uses a transaction sequence feature extraction network to capture local conditional dependencies and long-range behavioral patterns using a self-attention mechanism, while guiding the model to learn implicit interaction patterns and improve the generalization of the representation. Next, in terms of structural modeling, a weighted undirected graph is constructed to represent the global account, and multi-hop neighbor information is aggregated through a graph neural network to obtain embeddings that reflect the community structure and topological location, thus supplementing the cross-account collaborative behavior that is difficult to reveal with a single transaction sequence and achieving a unified expression of the semantic and structural layers. Considering the complementarity of sequence and structural representations, a "hidden-explicit" dual learning mechanism is proposed to realize self-transaction sequence and structural representation at the embedding level. The structural feature embedding matrix element-level fusion merges sequence prediction scores and structural prediction scores at the output level, thereby achieving complementary synergy and synergistic optimization of the two types of features and enhancing the model's ability to distinguish cross-domain and long-tail fraud patterns. Therefore, by simultaneously modeling the dynamic transaction behavior and static interaction structure of accounts, this method significantly enhances the ability to understand transaction semantics and model account structural relationships, achieves two-stage fusion and joint optimization of multimodal information, improves the ability to capture dynamic transaction patterns, and enhances robustness in anonymity and missing scenarios. Thus, it can effectively identify long-term dependent and evolutionary fraud patterns and achieve high-precision identification of fraudulent accounts.

[0099] In one specific embodiment, such as Figure 2 As shown, the transaction sequence feature extraction network, graph neural network, classifier, and fusion coefficients are obtained through joint training. The joint training process includes:

[0100] S21. Obtain the original Ethereum transaction records and perform data cleaning and self-transaction sequence insertion to obtain the original account transaction sequence.

[0101] S22. Randomly mask the transaction addresses in the original account transaction sequence using a preset ratio α and replace them with [MASK] to obtain the masked original account transaction sequence. For example, such as... Figure 2 As shown, the transaction address A2 is masked.

[0102] S23. Input the masked original account transaction sequence into the transaction sequence feature extraction network to capture the dynamic semantic features of the transaction, and output the original sequence embedding matrix containing deep semantics.

[0103] Specifically, the original account transaction sequence after masking is transformed into an initial sequence matrix, which is then input into a Transformer encoder to extract semantic representations of the mask positions. After extracting the semantic representations of the mask positions, the embeddings of the real addresses corresponding to the mask addresses are used as positive samples, and negative address embeddings that exclude the real addresses are randomly sampled from the global address pool as negative samples. By comparing the context address recovery loss function, the model is driven to maximize the similarity between positive samples and the semantic representations of the mask positions and minimize the similarity between negative samples and the semantic representations of the mask positions. This guides the model to learn the implicit relationship between transaction context and addresses, solving the problem that the Ethereum address space is too large to be directly normalized.

[0104] This embodiment allows the model to learn implicit interaction patterns between accounts without enumerating the massive Ethereum address space, overcoming the limitations of traditional mask pre-training in scenarios with excessively large address spaces.

[0105] S24. Construct a weighted undirected graph based on the original Ethereum transaction records, and input the weighted undirected graph and the self-transaction sequence of the original sequence embedding matrix into the graph neural network for feature update, and output the original structural feature embedding matrix containing the global topological pattern.

[0106] S25. The self-transaction sequence of the original sequence embedding matrix and the original structural feature embedding matrix are fused element-wise using the fusion coefficient to obtain the fused original structural embedding matrix.

[0107] S26. Input the self-transaction sequence of the original sequence embedding matrix and the fused original structure embedding matrix into the classifier to obtain the original sequence prediction score and the original structure prediction score, respectively. Combine the original sequence prediction score and the original structure prediction score to obtain the original account prediction score.

[0108] S27. Update the parameters of the transaction sequence feature extraction network, the graph neural network, the classifier, and the fusion coefficients through backpropagation until the joint loss function converges, and obtain the trained transaction sequence feature extraction network, the trained graph neural network, the trained classifier, and the trained fusion coefficients. The joint loss function includes the context address recovery loss function and the classification loss function based on the transaction sequence feature extraction network.

[0109] Specifically, the context address recovery loss function and the classification loss function are used as a joint loss function to drive end-to-end optimization.

[0110] The Context Address Recovery (CAR) loss function is used to calculate the CAR task, which aims to infer the masked address information from the context. Its expression is:

[0111] ;

[0112] in, For context address recovery loss function, The set of mask addresses in the sequence. It is the output of the transaction sequence feature extraction network, targeting the mask position. Contextual semantic embedding vector, Address embedding for the mask address (i.e., positive embedding), For the negative sample set Address embedding of negative addresses, negative sample set It is the set of addresses other than physical addresses. This indicates transpose.

[0113] For each account's transaction sequence, collect a negative sample set. To improve computational efficiency and ensure the effectiveness of contrastive learning, the negative sample set... The size is fixed at each training step. To address the characteristics of address distribution, the following two sampling strategies are adopted: The first is uniform sampling, which, to ensure the widespread distribution of negative samples, uses samples from the global address pool. The probability of each candidate address being selected is as follows: (The text abruptly ends here, so the translation stops as well.) The second method is weighted sampling. To reduce the bias of high-frequency, popular addresses on the feature space, frequency-based weighted sampling is introduced, incorporating the frequency of candidate addresses into the weighting function. The corrected sampling distribution is ,in, , For smoothing exponent, The frequency of candidate addresses is used to improve the model's ability to distinguish long-tail low-frequency addresses while retaining the characteristics of high-frequency addresses.

[0114] The classification loss function uses cross-entropy loss to calculate the final predicted score. With real labels The difference is expressed as:

[0115] ;

[0116] in, For classification loss function, For the final predicted score, For the properly labeled, This represents a fraudulent account. This represents a normal account.

[0117] Furthermore, the Adam optimizer is employed during backpropagation to propagate the joint loss layer by layer to each module, simultaneously updating the Transformer encoder parameters, graph neural network parameters, classifier parameters, and fusion coefficients. This ensures end-to-end collaborative optimization of the entire model, improving its generalization ability and fraud detection accuracy. During the Transformer encoder parameter update process, the embedding matrix is ​​also updated. Finally, after 100 training epochs, a trained Transformer encoder, a trained graph neural network, a trained classifier, and trained fusion coefficients are obtained. The optimal model is then saved based on the validation set performance.

[0118] This embodiment introduces a transaction semantic encoding module based on a Transformer encoder and a context address recovery training mechanism. It randomly masks partial address information in the transaction sequence and recovers it using context prediction. This captures potential dependencies between transaction semantics during the self-supervised learning stage, significantly improving the model's ability to understand transaction context. The model can distinguish semantically similar but different intentions between transactions, and can reconstruct transaction chains even in missing or anonymized scenarios, improving the accuracy of transaction semantic feature representation. Testing shows that the accuracy of this embodiment's model in semantic discrimination tasks is approximately 15%–20% higher than the BERT4ETH model.

[0119] This embodiment constructs a weighted undirected graph and employs a graph neural network to perform multi-hop aggregation and feature extraction of transaction relationships between accounts, thereby encoding the interaction structure between accounts. The model can simultaneously learn the local interactions and global structural features of accounts, significantly improving the ability to identify multi-account collaborative fraud. Experimental results show that the recall rate is improved by approximately 12% to 18% in collaborative fraud detection tasks.

[0120] This embodiment proposes an implicit-explicit dual learning stage. In the implicit layer, structure and sequence embeddings are aligned; in the explicit layer, linear interpolation fuses the two types of prediction results, achieving a two-stage fusion and joint optimization of multimodal information. This results in complementary enhancement of structural and semantic information, improving the overall stability and generalization ability of the model. Experiments show that the overall detection performance is improved by approximately 10%–15% compared to BERT4ETH.

[0121] This embodiment models the temporal behavioral characteristics of accounts through a transaction-level Transformer encoder. It also combines graph neural networks to aggregate global multi-hop neighbor information and introduces time-location encoding and dynamic interaction graph update strategies to model the evolutionary characteristics of transactions in the time dimension. This achieves time-structure joint learning, which can effectively identify fraudulent behaviors with staged or cyclical dependency characteristics. The detection accuracy of multi-stage fraud patterns is improved by about 17%, significantly enhancing the model's temporal perception capability.

[0122] This embodiment guides the model to learn the potential account dependency structure during the training phase through a context address recovery mechanism, enabling it to infer the relationship between accounts even in scenarios where counterparty addresses are missing or anonymized. The tolerance for missing data is significantly improved, and it can still maintain a detection performance of over 90% under a 30% address missing ratio, while BERT4ETH only achieves about 70%. This effectively enhances the robustness and stability of the model in real and complex environments.

[0123] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. An Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure, characterized in that, Including the following steps: Ethereum transaction records are obtained and data cleaning and self-transaction sequence insertion are performed to obtain the account transaction sequence; each Ethereum transaction record includes address, transaction amount, timestamp, sender / receiver type, account type, count, and location index; The account transaction sequence is input into a trained transaction sequence feature extraction network, and the dynamic semantic features of the transaction are captured by the self-attention mechanism, and the sequence embedding matrix containing deep semantics is output. A weighted undirected graph is constructed based on the Ethereum transaction records, and the adjacency matrix and weight matrix of the weighted undirected graph are also constructed. The weighted undirected graph is represented as follows: ； in, For a set of account nodes, For the edge Set, edge weight For account and accounts The number of transactions; The node features of the weighted undirected graph are initialized as the self-transaction sequence of the sequence embedding matrix to obtain an initial node feature matrix. The weighted undirected graph and the initial node feature matrix are then input into a trained graph neural network for feature updating, outputting a structural feature embedding matrix containing the global topological pattern. The feature updating in the trained graph neural network includes: ； ； in, The normalized adjacency matrix, For degree matrix, It is the identity matrix. For the first The node feature matrix of the layer It is a non-linear activation function. For the first The node feature matrix of the layer For the first The learnable weight matrix of the layer; Align the self-transaction sequence of the sequence embedding matrix with the features of the structural feature embedding matrix, and use trained fusion coefficients to perform element-wise weighted merging of the feature-aligned self-transaction sequence and the structural feature embedding matrix to obtain the fused structural embedding matrix; the address of the self-transaction sequence is the account itself, and the other features are null values; The self-transaction sequence of the sequence embedding matrix and the fused structure embedding matrix are respectively input into the trained classifier to obtain the sequence prediction score and the structure prediction score. The sequence prediction score and the structure prediction score are then combined to obtain the account prediction score. Based on the predicted account score, the transaction account is determined to be either a fraudulent account or a legitimate account, and the detection result is obtained.

2. The Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure according to claim 1, characterized in that, The Ethereum transaction records are retrieved, cleaned, and self-transaction sequence inserted to obtain the account transaction sequence, including: Remove failed original transactions from the Ethereum transaction log to obtain valid transactions; Duplicate transactions with the same address, consistent sending and receiving types, and consecutive occurrences within 72 hours among the valid transactions are aggregated into a single transaction. The transaction amounts are summed and the timestamp of the first transaction is retained to obtain the aggregated valid transactions. The aggregated valid transactions are arranged in descending order of timestamp, and a self-transaction sequence is inserted at the beginning of the sequence to obtain the account transaction sequence.

3. The Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure according to claim 1, characterized in that, The account transaction sequence is input into a trained transaction sequence feature extraction network, which uses a self-attention mechanism to capture the dynamic semantic features of the transactions, and outputs a sequence embedding matrix containing deep semantics, including: A differentiated embedding strategy is adopted to convert the address, transaction amount, timestamp, receipt / delivery type, account type, count, and location index of the account transaction sequence into corresponding embedding vectors through embedding matrices; the embedding vectors of the seven-dimensional features are added element by element and stacked vertically to form the initial sequence matrix; The trained Transformer encoder is used to capture the dynamic semantic features of the initial sequence matrix and output the sequence embedding matrix containing deep semantics.

4. The Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure according to claim 1, characterized in that, The self-transaction sequence of the sequence embedding matrix and the fused structure embedding matrix are respectively input into a trained classifier to obtain sequence prediction scores and structure prediction scores. The sequence prediction scores and structure prediction scores are then combined to obtain the account prediction score, including: The self-transaction sequence of the sequence embedding matrix and the fused structure embedding matrix are respectively input into the trained multilayer perceptron to output the sequence prediction score and the structure prediction score: ； ； in, Predict scores for the sequence. For the structure prediction score, For a sequence embedding matrix, a self-transaction sequence, The fused structure embedding matrix, It is a multilayer perceptron. For activation function, For sequence, For graph structure; The account prediction score is obtained by merging the sequence prediction score and the structure prediction score through linear interpolation: ； in, Predict a score for the account. The fusion coefficient is a learnable coefficient.

5. The Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure according to claim 1, characterized in that, The transaction sequence feature extraction network, the graph neural network, the classifier, and the fusion coefficient are obtained through joint training. The joint training process includes: Obtain the original Ethereum transaction records and perform data cleaning and self-transaction sequence insertion to obtain the original account transaction sequence; The transaction addresses in the original account transaction sequence are randomly masked at a preset ratio and replaced with [MASK] to obtain the masked original account transaction sequence; The original account transaction sequence after the mask is input into the transaction sequence feature extraction network to capture the dynamic semantic features of the transaction, and the output is the original sequence embedding matrix containing deep semantics; A weighted undirected graph is constructed based on the original Ethereum transaction records. The weighted undirected graph and the self-transaction sequence of the original sequence embedding matrix are then input into the graph neural network for feature updates, and the output is an original structural feature embedding matrix containing global topological patterns. The self-transaction sequence of the original sequence embedding matrix and the original structural feature embedding matrix are fused element-wise using a fusion coefficient to obtain the fused original structural embedding matrix. The self-transaction sequence of the original sequence embedding matrix and the fused original structure embedding matrix are respectively input into the classifier to obtain the original sequence prediction score and the original structure prediction score. The original sequence prediction score and the original structure prediction score are then combined to obtain the original account prediction score. The parameters of the transaction sequence feature extraction network, the graph neural network, the classifier, and the fusion coefficients are updated through backpropagation until the joint loss function converges, resulting in a trained transaction sequence feature extraction network, a trained graph neural network, a trained classifier, and trained fusion coefficients. The joint loss function includes a context address recovery loss function and a classification loss function based on the transaction sequence feature extraction network.

6. The Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure according to claim 5, characterized in that, The context address recovery loss function is: ； in, For context address recovery loss function, The set of mask addresses in the sequence. It is the output of the transaction sequence feature extraction network, targeting the mask position. Contextual semantic embedding vector, For the address embedding of the mask address, For the negative sample set Address embedding of negative addresses, negative sample set For addresses other than the real address, This indicates transpose.

7. The Ethereum fraud detection method based on deep fusion of transaction semantics and graph structure according to claim 5, characterized in that, The classification loss function is: ； in, For classification loss function, For the final predicted score, For the properly labeled, This represents a fraudulent account. This represents a normal account.

Images