Ethereum malicious account detection method and device based on semantic and graph structure fusion

Abstract

The invention discloses an Ethereum malicious account detection method and device based on semantic and graph structure fusion, and relates to the technical field of network security, and the method comprises the steps: collecting a transaction sequence of an account on an Ethereum platform; converting the transaction sequence into structured text transaction data, and processing the structured text transaction data by adopting a word segmentation device in a pre-training language model to obtain an embedded vector; processing the embedded vector by adopting an encoder in a pre-training language model to obtain account-level semantic features; according to the transaction data, multiple types of expert statistical characteristics are extracted, and a transaction account graph is constructed; processing the transaction account graph by adopting a trained graph attention network fused with a multi-head attention mechanism to obtain structural features; and carrying out fusion processing on the account-level semantic features and the structural features by adopting a trained cross attention fusion network to obtain an account classification result. According to the invention, the accuracy and generalization ability of Ethereum malicious account detection can be improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to an Ethereum malicious account detection method and device based on the fusion of semantics and graph structure. Background Technology

[0002] In recent years, Ethereum, as an important component of the blockchain ecosystem, has been widely used in areas such as smart contracts and digital asset trading. However, at the same time, malicious accounts (such as phishing addresses and Ponzi scheme operators) have frequently appeared, posing a serious threat to system security and user assets. Designing a detection model capable of accurately identifying malicious Ethereum accounts has become a significant research hotspot in the field of blockchain security.

[0003] Traditional detection methods primarily rely on manually constructed features, such as the number of transactions, time intervals, and average transaction amounts of accounts, which are then input into traditional machine learning models (e.g., logistic regression, random forests, and support vector machines) for classification. However, these methods suffer from limitations in feature representation and reliance on human experience, making it difficult to capture the deep features of complex fraud patterns. To address this, researchers have begun using deep learning methods for feature extraction. Graph Neural Networks (GNNs) can learn node representations using the transaction relationship structure between accounts, capturing the topological dependencies of the transaction network. Pre-trained language models can treat transaction sequences as text, learning the semantic features and contextual information of accounts. However, both methods have limitations. While GNNs can model structural relationships, they struggle to understand the semantics behind the transaction content, and while pre-trained language models excel at understanding textual patterns, they cannot reflect the topological dependencies between accounts.

[0004] Therefore, there is an urgent need to provide a method and device for detecting malicious Ethereum accounts that integrates semantic and graph structure features, in order to improve the shortcomings of existing technologies. Summary of the Invention

[0005] To address the aforementioned problems in existing technologies, this invention provides a method and apparatus for detecting malicious Ethereum accounts based on the fusion of semantics and graph structure. The technical problem to be solved by this invention is achieved through the following technical solution: In a first aspect, the present invention provides an Ethereum malicious account detection method based on the fusion of semantics and graph structure, comprising: Collect transaction data from accounts on the Ethereum platform, and clean and standardize the transaction data to obtain transaction sequences; The transaction sequence is converted into structured text transaction data. The structured text transaction data is processed by the word segmenter in the pre-trained language model to obtain the embedding vector. The embedding vector is then processed by the encoder in the pre-trained language model to obtain account-level semantic features. Based on the transaction data, multi-category expert statistical features are extracted, and a transaction account graph is constructed. The transaction account graph includes multiple nodes, each node representing a trading counterparty. A pre-trained graph attention network with a multi-head attention mechanism is used to process the transaction account graph to obtain structural features. A pre-trained cross-attention fusion network is used to fuse account-level semantic features and structural features to obtain the account classification results.

[0006] Secondly, the present invention also provides an Ethereum malicious account detection device based on the fusion of semantics and graph structure, comprising: The feature acquisition module is used to collect transaction data of accounts on the Ethereum platform, and to clean and standardize the transaction data to obtain transaction sequences; Feature processing module one is used to convert transaction sequences into structured text transaction data. The structured text transaction data is processed by the word segmenter in the pre-trained language model to obtain embedding vectors. The embedding vectors are then processed by the encoder in the pre-trained language model to obtain account-level semantic features. Feature processing module two is used to extract multiple types of expert statistical features based on transaction data and construct a transaction account graph. The transaction account graph includes multiple nodes, each node representing a trading counterparty. A pre-trained graph attention network with a multi-head attention mechanism is used to process the transaction account graph to obtain structural features. The feature fusion module is used to fuse account-level semantic features and structural features using a trained cross-attention fusion network to obtain the account classification results.

[0007] The beneficial effects of this invention are: This invention provides an Ethereum malicious account detection method and device based on the fusion of semantics and graph structure. It achieves adaptive fusion of transaction semantic features and account graph structure features through a cross-attention mechanism, which can effectively improve the accuracy and generalization ability of Ethereum malicious account detection while maintaining feature interpretability.

[0008] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0009] Figure 1 This is a flowchart of an Ethereum malicious account detection method based on semantic and graph structure fusion provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of an Ethereum malicious account detection method based on semantic and graph structure fusion provided in an embodiment of the present invention; Figure 3This is a schematic diagram of a trained graph attention network that integrates a multi-head attention mechanism, provided in an embodiment of the present invention. Figure 4 This is a schematic diagram of an Ethereum malicious account detection device based on the fusion of semantics and graph structure provided in an embodiment of the present invention. Detailed Implementation

[0010] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0011] Please see Figure 1 and Figure 2 , Figure 1 This is a flowchart of an Ethereum malicious account detection method based on the fusion of semantics and graph structure provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of an Ethereum malicious account detection method based on semantic and graph structure fusion provided by an embodiment of the present invention. The Ethereum malicious account detection method based on semantic and graph structure fusion provided by the present invention includes: S101. Collect transaction data of accounts on the Ethereum platform, and clean and standardize the transaction data to obtain transaction sequences.

[0012] Specifically, in this embodiment, the transaction data includes fields such as transaction hash, sending address, receiving address, timestamp, amount, and transaction direction.

[0013] The transaction data is cleaned and standardized, including removing isolated accounts and noisy transactions, timestamp normalization, logarithmic processing of transaction amounts, and reconstruction of transaction sequences based on account grouping. All transactions of each account are sorted by time to construct the transaction sequence.

[0014] S102. Convert the transaction sequence into structured text transaction data, use the word segmenter in the pre-trained language model to process the structured text transaction data to obtain the embedding vector; use the encoder in the pre-trained language model to process the embedding vector to obtain account-level semantic features.

[0015] Specifically, in this embodiment, the transaction sequence is converted into text transaction data, including an index part and a sentence part. The index part represents the index field, and the sentence part represents the text field. For example, the sentence part includes the amount, transaction direction, time difference, etc. To adapt to the pre-trained language model, a classification marker (CLS) is added at the beginning of the sentence part and a separator marker (SEP) is added at the end. That is, the structured text transaction data includes a classification marker at the beginning and a separator marker at the end.

[0016] Furthermore, the structured text transaction data is processed using a word segmenter in a pre-trained language model to obtain embedding vectors, which include word embedding vectors, position embedding vectors, and segment embedding vectors.

[0017] Furthermore, the embedding vectors are processed using the encoder in the pre-trained language model to obtain account-level semantic features, including: The embedded vectors are input into the encoder of the pre-trained language model for processing. The hidden layer state after processing by the attention mechanism is represented as follows: ; in, This represents the hidden layer state after processing by the attention mechanism. Indicates the position index. This represents the attention calculation function. Represents the normalization function. Represents the query matrix. Represents the key matrix. Represents a value matrix, This represents the matrix transpose operation. This represents the dimension of the key vector.

[0018] Based on the hidden layer states, the semantic embedding matrix of the account is obtained, represented as: ; in, The semantic embedding matrix representing the account. Indicates the hidden layer state. Indicates the position index. Indicates the length of the transaction sequence. Represents the semantic feature dimension. Represents the set of real numbers; Take the hidden state vector at the position of the classification marker in the semantic embedding matrix of the account. As an account-level semantic feature, it is represented as: ; in, This represents the total number of layers in the pre-trained language model encoder.

[0019] S103. Based on the transaction data, extract statistical features from multiple expert groups and construct a transaction account graph. The transaction account graph includes multiple nodes, each node representing a counterparty (i.e., a trading party). Use a pre-trained graph attention network that integrates a multi-head attention mechanism to process the transaction account graph and obtain structural features.

[0020] Specifically, in this embodiment, to enhance the structural interpretability of the model, 10 types of expert statistical features are extracted from the account, including: in-degree, out-degree, incoming amount, outgoing amount, active days, transaction time span, transaction frequency, amount entropy, transaction direction ratio, and counterparty account concentration, etc., and the extracted expert statistical features are standardized.

[0021] Further, please see Figure 3 , Figure 3 This is a schematic diagram of a pre-trained graph attention network with a multi-head attention mechanism provided in this embodiment of the invention. In this embodiment, a graph attention network (GAT) with a multi-head attention mechanism is used to process the transaction account graph. The input is the node features (composed of expert feature matrices) and adjacency relationships (DGL format) of the transaction account graph. Implementation: A two-layer graph attention network is used, with each layer including 8 attention heads, each aggregating different associated features. The second layer of the graph attention network continues attention aggregation on the concatenated features output by the first layer. Residual layers and GELU activation functions are used between layers. Finally, the output features of the two layers are concatenated and projected onto a 768-dimensional map to align with the output of the pre-trained language model.

[0022] In this embodiment, the trained graph attention network integrating a multi-head attention mechanism includes a first linear mapping layer, a first-layer graph attention network, a residual layer, a GELU activation function, a second-layer graph attention network, a second linear mapping layer, and a normalization layer. The first-layer and second-layer graph attention networks each include multiple attention heads. The first linear mapping layer is used to map the node features in the transaction account graph to the hidden dimension, resulting in the first feature, represented as: ; in, This represents the processed output of the first linear mapping layer. Each node's characteristics This represents the weight matrix of the linear mapping layer. The first one in the transaction account diagram represents the second one. Initial expert statistical characteristics of each node, Represents the bias vector; The first feature is processed by a first-layer graph attention network. Different attention heads in the first-layer graph attention network aggregate different associated features to obtain different neighborhood aggregated features. The different neighborhood aggregated features are concatenated to obtain the second feature. The second feature is processed using a residual layer to obtain the third feature; The third feature is processed using the GELU activation function to obtain the fourth feature; The fourth feature is processed using a second-layer graph attention network. Different attention heads in the second-layer graph attention network aggregate different associated features to obtain different neighborhood aggregated features. The different neighborhood aggregated features are then concatenated to obtain the fifth feature. The second linear mapping layer is used to process the concatenated features of the second and fifth features to obtain the sixth feature; The sixth feature is processed using a normalization layer to obtain the structural features.

[0023] Furthermore, the first feature is processed using a first-layer graph attention network, including: For any attention head, for a node in the trading account graph Its neighboring nodes The attention coefficients are calculated using the LeakyReLU activation function, and are expressed as follows: ; in, Indicates the attention coefficient. This represents the LeakyReLU activation function. The learnable weight vector representing the attention mechanism. This represents the matrix transpose operation. The weight matrix represents the linear mapping. This represents the first layer of the graph attention network. Layer nodes eigenvectors, This represents the first layer of the graph attention network. Layer nodes eigenvectors; Based on the attention coefficient, the attention weight is calculated and expressed as follows: ; in, Indicates attention weights, Represented by natural constant An exponential function with base 0. This represents the node index in the set of neighboring nodes. Represents a node The set of neighboring nodes, Represents a node Its neighboring nodes Attention coefficient between them; Based on the attention weights, the neighborhood aggregation features of the attention head output are calculated, and expressed as: ; in, This represents the first layer of the graph attention network. The first in the layer Each node outputs attention. Neighborhood aggregation characteristics Indicates the first Attention weights calculated from each attention head Indicates the first The linear mapping weight matrix corresponding to each attention head This represents the first layer of the graph attention network. Layer neighbor nodes eigenvectors, Represents a node One of the neighboring nodes, Indicates the index of the attention head. This represents the index of the layer in the first layer of the graph attention network.

[0024] Furthermore, the second feature is represented as: ; in, Indicates the second characteristic, Indicates the index of the attention head. This indicates the total number of attention heads. This represents the first layer of the graph attention network. The first in the layer Each node outputs attention. Neighborhood aggregation characteristics This represents the first layer of the graph attention network. Layer nodes Input features.

[0025] It should be noted that the processing procedure for the second-layer graph attention network can refer to the processing procedure for the first-layer graph attention network.

[0026] Furthermore, the structural features are represented as follows: ; in, Indicates structural features, The layer normalization function is represented. This represents the weight matrix of the projection layer. This represents the output features of the first layer of the graph attention network. This represents the output features of the second-layer graph attention network. This represents the bias vector. This indicates the number of nodes in the transaction account graph.

[0027] S104. The trained cross-attention fusion network is used to fuse account-level semantic features and structural features to obtain the account classification results.

[0028] Specifically, in this embodiment, to achieve deep fusion of semantic feature embedding and graph structure feature embedding, thereby improving the accuracy and robustness of malicious account detection, a cross-attention fusion network is designed, consisting of three logical layers: semantic aggregation, cross-modal fusion, and global feature fusion. Specifically: In this embodiment, the trained cross-attention fusion network includes a semantic feature aggregation module, a cross-modal fusion module, a global feature fusion module, and a classifier; wherein... The semantic feature aggregation module performs attention calculations on the account-level semantic features to obtain the semantic features, which are represented as follows: ; ; ; ; in, Represents semantic features, A query matrix representing the aggregation of semantic features. This represents the weight of the linear mapping corresponding to the query matrix. The learnable semantic aggregation matrix representing the query matrix. The key matrix represents the aggregation of semantic features. This represents the linear mapping weights corresponding to the key matrix. Represents account-level semantic features. The value matrix represents the aggregation of semantic features. This represents the weights of the linear mapping corresponding to the value matrix. Represents the normalization function. The dimension of the key vector representing the semantic feature aggregation; The semantic features are normalized using the layer normalization layer in the semantic feature aggregation module to obtain normalized semantic features, represented as follows: ; in, The representation of normalized semantic features, The representation layer normalization function; The structural features are expanded to the same dimension as the normalized semantic features. The GELU activation function in the cross-modal fusion module is then used to interact with the expanded structural features and the normalized semantic features feature-by-feature, resulting in the fused features, represented as: ; in, Indicates the characteristics of the fusion state. Represents the Gaussian error linear unit activation function. The projection weight matrix represents the semantic features. The projection weight matrix represents the structural features. This represents the structural features after dimensional expansion. Represents the bias vector; The fused state features are normalized using a layer normalization layer in the cross-modal fusion module, resulting in normalized fused state features, expressed as: ; in, Represents the normalized fusion state characteristics; The global feature fusion module performs attention calculations on the normalized fused features to obtain the global features, which are represented as follows: ; ; ; ; in, Represents global features. This represents the query matrix of global feature fusion. This represents the weight of the linear mapping corresponding to the global query matrix. The learnable matrix representing the global query matrix. The key matrix represents the global feature fusion. This represents the linear mapping weights corresponding to the global key matrix. This represents the value matrix of global feature fusion. This represents the linear mapping weights corresponding to the global value matrix. Represents the normalization function. The dimension of the key vector representing global feature fusion; After flattening the global features, a classifier is used to classify them, resulting in the classification of the accounts.

[0029] This embodiment further includes: constructing a language model, a graph attention network integrating a multi-head attention mechanism, and a cross-attention fusion network; wherein, the language model is initialized with pre-trained weights, while the graph attention network integrating the multi-head attention mechanism and the cross-attention fusion network are randomly initialized, using data from a publicly available Ethereum transaction dataset (e.g., the B4E dataset) as training samples, and using labeled malicious account information and normal account information as labels for the training samples, i.e., as supervised signals, for iterative training until convergence or reaching a preset number of iterations, to obtain a pre-trained language model, a trained graph attention network integrating a multi-head attention mechanism, and a trained cross-attention fusion network.

[0030] In summary, the Ethereum malicious account detection method based on the fusion of semantics and graph structure provided by this invention has the following beneficial effects: First, existing Ethereum malicious account detection methods typically rely on a single feature type, such as using only graph structures or only semantic features. While graph-based models can capture transaction relationships between accounts, they struggle to understand the semantic intent within transaction behavior. Semantic-based models (such as BERT4ETH) can extract contextual information from transaction text but ignore the structural relationships between accounts. This feature fragmentation prevents the model from comprehensively reflecting account behavior patterns, affecting detection accuracy. This invention proposes a semantic and structural bimodal fusion framework (ETH-CAFBG), which adaptively aligns transaction semantic representations and account graph structure representations in the feature space through a cross-attention fusion mechanism. This achieves cross-modal semantic compensation, and the bimodal attention mechanism dynamically learns the interaction weights between semantic and structural features, thereby significantly improving detection accuracy and generalization ability while maintaining feature interpretability.

[0031] Secondly, existing semantic modeling methods typically encode transaction sequences as independent text, without incorporating the topological information of the transaction network. In the Ethereum ecosystem, different accounts may have similar transaction semantics but different structural relationships. For example, fake accounts and real accounts may be semantically similar but structurally different. Due to the lack of structural constraints, the model is prone to misjudgment, leading to biased detection results. This invention addresses this by using a pre-trained language model (BERT) to encode the context of account transaction sequences, treating each account's transaction behavior as a "semantic sentence." A multi-head self-attention mechanism is used to calculate the dependencies between transaction behaviors, and the CLS vector at the beginning is taken as the account semantic summary, forming an account-level semantic embedding. This approach effectively captures behavioral patterns and contextual relationships between accounts, enhancing the pre-trained language model's ability to perceive hidden transaction semantics and overcoming the limitations of traditional statistical feature methods.

[0032] Third, traditional graph neural networks (GCN, GraphSAGE, etc.) typically only consider local node features when aggregating neighborhoods, failing to model cross-level, non-local dependencies in transaction networks. This results in insufficient ability to identify global fraud patterns (such as multi-hop money laundering paths and group transaction behavior). To characterize the complex topological relationships of the Ethereum account network, this invention employs a two-layer multi-head graph attention network (GAT) to extract graph structure features. For each node, multi-head attention aggregates neighbor node information, effectively capturing local structural patterns and global propagation paths in transaction relationships, achieving hierarchical feature aggregation from local neighborhoods to the global graph.

[0033] Fourth, while some existing studies attempt to concatenate semantic and structural embeddings before inputting them into a classifier, this simple concatenation is a static fusion that fails to achieve dynamic information interaction and weighted adjustment between the two modalities. Lacking a fusion mechanism, it cannot adaptively adjust the weights of semantic and structural features based on task characteristics, thus limiting detection performance. This invention proposes a cross-attention fusion mechanism. In the semantic feature aggregation stage, account-level semantic features are adaptively compressed to capture high-level transaction semantics. In the cross-modal fusion stage, linear mapping is used to project semantic and structural features to a unified dimension, and fusion is achieved through a non-linear activation function. In the global feature fusion stage, joint modeling is implemented to effectively fuse semantic and structural features, thereby achieving information complementarity and feature synergy.

[0034] Fifth, existing technologies generally suffer from performance degradation in scenarios such as class imbalance, cross-dataset transfer, or adversarial attacks. Because semantic or structural unimodal models overfit specific feature domains, they exhibit poor generalization across different data distributions, making them ill-suited to dynamically changing malicious account behaviors. This invention introduces learnable identifiers and layer normalization mechanisms into the cross-attention fusion network to ensure stability and gradient flow balance during the fusion process. Simultaneously, GELU activation and residual connections are used to enhance the network's nonlinear expressive power. Furthermore, the cross-attention fusion network maintains stable performance even in complex scenarios such as changing transaction patterns, class imbalance, and adversarial attacks, demonstrating superior interpretability and robustness.

[0035] Sixth, this invention was simulated on a publicly available Ethereum malicious account dataset, and the system was evaluated using three metrics: F1-score, accuracy, and AUC. The results show that ETH-CAFBG improves the F1 score by 6.3% and 5.1% compared to the traditional GAT and BERT single-modal models, respectively, verifying the effectiveness and universality of the model proposed in this invention. Simultaneously, ablation experiments were conducted to verify the independent contributions of each module (semantic encoding, graph structure aggregation, and cross-attention fusion).

[0036] Based on the same inventive concept, please refer to Figure 4 , Figure 4 This is a schematic diagram of an Ethereum malicious account detection device based on semantic and graph structure fusion provided in an embodiment of the present invention. The present invention also provides an Ethereum malicious account detection device based on semantic and graph structure fusion, used to implement the Ethereum malicious account detection method based on semantic and graph structure fusion provided in the above embodiments of the present invention. Implementation examples of the method are described above and will not be repeated here. The device includes: The feature acquisition module 201 is used to collect transaction data of accounts on the Ethereum platform, and to clean and standardize the transaction data to obtain transaction sequences; Feature processing module 202 is used to convert transaction sequences into structured text transaction data. The structured text transaction data is processed by the word segmenter in the pre-trained language model to obtain embedding vectors. The embedding vectors are then processed by the encoder in the pre-trained language model to obtain account-level semantic features. Feature processing module 203 is used to extract multi-class expert statistical features based on transaction data and construct a transaction account graph. The transaction account graph includes multiple nodes, each node representing a trading counterparty. A pre-trained graph attention network with a multi-head attention mechanism is used to process the transaction account graph to obtain structural features. The feature fusion module 204 is used to fuse account-level semantic features and structural features using a trained cross-attention fusion network to obtain the account classification result.

[0037] Specifically, the Ethereum malicious account detection device based on the fusion of semantic features and graph structure features proposed in this embodiment achieves adaptive fusion of transaction semantic features and account graph structure features through a cross-attention mechanism, which can effectively improve the accuracy and generalization ability of Ethereum malicious account detection while maintaining feature interpretability.

[0038] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device comprising said element. Terms such as "connected" or "linked" are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect. The orientations or positional relationships indicated by terms such as "upper," "lower," "left," and "right" are based on the orientations or positional relationships shown in the accompanying drawings and are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0039] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0040] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for detecting malicious Ethereum accounts based on the fusion of semantics and graph structure, characterized in that, include: Collect transaction data of accounts on the Ethereum platform, and clean and standardize the transaction data to obtain transaction sequences; The transaction sequence is converted into structured text transaction data, and the structured text transaction data is processed by the word segmenter in the pre-trained language model to obtain the embedding vector; The embedding vectors are processed using an encoder in a pre-trained language model to obtain account-level semantic features; Based on the transaction data, multiple expert statistical features are extracted, and a transaction account graph is constructed. The transaction account graph includes multiple nodes, each node representing a trading counterparty. The transaction account graph is then processed using a pre-trained graph attention network that incorporates a multi-head attention mechanism to obtain structural features. The account-level semantic features and structural features are fused using a trained cross-attention fusion network to obtain the account classification results.

2. The Ethereum malicious account detection method based on semantic and graph structure fusion according to claim 1, characterized in that, The structured text transaction data includes a category marker at the beginning and a separator marker at the end.

3. The Ethereum malicious account detection method based on semantic and graph structure fusion according to claim 1, characterized in that, The embedding vectors are processed using an encoder in a pre-trained language model to obtain account-level semantic features, including: The embedded vector is input into the encoder of the pre-trained language model for processing. The hidden layer state after attention mechanism processing is represented as follows: ； in, This represents the hidden layer state after processing by the attention mechanism. Indicates the position index. This represents the attention calculation function. Represents the normalization function. Represents the query matrix. Represents the key matrix, Represents a value matrix, This represents the matrix transpose operation. This represents the dimension of the key vector.

4. The Ethereum malicious account detection method based on semantic and graph structure fusion according to claim 3, characterized in that, The embedding vectors are processed using an encoder in a pre-trained language model to obtain account-level semantic features, which also includes: Based on the hidden layer state, the semantic embedding matrix of the account is obtained, represented as: ； in, The semantic embedding matrix representing the account. Indicates the hidden layer state. Indicates the position index. Indicates the length of the transaction sequence. Represents the semantic feature dimension. Represents the set of real numbers; Take the hidden state vector of the classification marker position in the semantic embedding matrix of the account. As an account-level semantic feature, it is represented as: ； in, This represents the total number of layers in the pre-trained language model encoder.

5. The Ethereum malicious account detection method based on semantic and graph structure fusion according to claim 1, characterized in that, The trained graph attention network integrating a multi-head attention mechanism includes a first linear mapping layer, a first-layer graph attention network, a residual layer, a GELU activation function, a second-layer graph attention network, a second linear mapping layer, and a normalization layer. The first-layer and second-layer graph attention networks each include multiple attention heads. The first linear mapping layer is used to map the node features in the transaction account graph to the hidden dimension to obtain the first feature; The first feature is processed using the first layer graph attention network. Different attention heads in the first layer graph attention network aggregate different associated features to obtain different neighborhood aggregated features. The different neighborhood aggregated features are concatenated to obtain the second feature. The residual layer is used to process the second feature to obtain the third feature; The third feature is processed using the GELU activation function to obtain the fourth feature; The fourth feature is processed using the second-layer graph attention network. Different attention heads in the second-layer graph attention network aggregate different associated features to obtain different neighborhood aggregate features. The different neighborhood aggregate features are then concatenated to obtain the fifth feature. The second linear mapping layer is used to process the concatenated feature of the second feature and the fifth feature to obtain the sixth feature; The sixth feature is processed using the normalization layer to obtain the structural feature.

6. The Ethereum malicious account detection method based on semantic and graph structure fusion according to claim 5, characterized in that, The first feature is processed using the first layer graph attention network, including: For any attention head, for the nodes in the transaction account graph Its neighboring nodes The attention coefficients are calculated using the LeakyReLU activation function, and are expressed as follows: ； in, Indicates the attention coefficient. This represents the LeakyReLU activation function. The learnable weight vector representing the attention mechanism. This represents the matrix transpose operation. The weight matrix represents the linear mapping. This represents the first layer of the graph attention network. Layer nodes eigenvectors, This represents the first layer of the graph attention network. Layer nodes eigenvectors; Based on the attention coefficient, the attention weight is calculated and expressed as: ； in, Indicates attention weights, Represented by natural constant An exponential function with base 0. This represents the node index in the set of neighboring nodes. Represents a node The set of neighboring nodes, Represents a node Its neighboring nodes Attention coefficient between them; Based on the attention weights, the neighborhood aggregation features output by the attention head are calculated and expressed as follows: ； in, This represents the first layer of the graph attention network. The first in the layer Each node outputs attention. Neighborhood aggregation characteristics Indicates the first Attention weights calculated from each attention head Indicates the first The linear mapping weight matrix corresponding to each attention head This represents the first layer of the graph attention network. Layer neighbor nodes eigenvectors, Represents a node One of the neighboring nodes, Indicates the index of the attention head. This represents the index of the layer in the first layer of the graph attention network.

7. The Ethereum malicious account detection method based on semantic and graph structure fusion according to claim 5, characterized in that, The second feature is represented as: ； in, Indicates the second characteristic, Indicates the index of the attention head. This indicates the total number of attention heads. This represents the first layer of the graph attention network. The first in the layer Each node outputs attention. Neighborhood aggregation characteristics This represents the first layer of the graph attention network. Layer nodes Input features.

8. The Ethereum malicious account detection method based on semantic and graph structure fusion according to claim 5, characterized in that, The structural feature is represented as follows: ； in, Indicates structural features, The layer normalization function is represented. This represents the weight matrix of the projection layer. This represents the output features of the first layer of the graph attention network. This represents the output features of the second-layer graph attention network. This represents the bias vector. This indicates the number of nodes in the transaction account graph.

9. The Ethereum malicious account detection method based on semantic and graph structure fusion according to claim 1, characterized in that, The trained cross-attention fusion network includes a semantic feature aggregation module, a cross-modal fusion module, a global feature fusion module, and a classifier; wherein... The semantic feature aggregation module performs attention calculations on the account-level semantic features to obtain semantic features, which are represented as follows: ； ； ； ； in, Represents semantic features, A query matrix representing the aggregation of semantic features. This represents the weight of the linear mapping corresponding to the query matrix. The learnable semantic aggregation matrix representing the query matrix. The key matrix represents the aggregation of semantic features. This represents the linear mapping weights corresponding to the key matrix. Represents account-level semantic features. The value matrix represents the aggregation of semantic features. This represents the weights of the linear mapping corresponding to the value matrix. Represents the normalization function. The dimension of the key vector representing the aggregation of semantic features; The semantic features are normalized using the layer normalization layer in the semantic feature aggregation module to obtain normalized semantic features, which are represented as follows: ； in, Represents the semantic features of normalization. Indicates the layer normalization function; The dimensions of the structural features are expanded to be the same as the dimensions of the normalized semantic features. The GELU activation function in the cross-modal fusion module is then used to interact the expanded structural features with the normalized semantic features feature-by-feature, resulting in fused features, represented as: ； in, Indicates the characteristics of the fusion state. Represents the Gaussian error linear unit activation function. The projection weight matrix represents the semantic features. The projection weight matrix represents the structural features. This represents the structural features after dimensional expansion. Represents the bias vector; The fused state features are normalized using a layer normalization layer in the cross-modal fusion module to obtain normalized fused state features, represented as follows: ； in, Represents the normalized fusion state characteristics; The global feature fusion module is used to perform attention calculation on the normalized fused state features to obtain global features, which are represented as follows: ； ； ； ； in, Represents global features. This represents the query matrix of global feature fusion. This represents the weight of the linear mapping corresponding to the global query matrix. The learnable matrix representing the global query matrix. The key matrix represents the global feature fusion. This represents the linear mapping weights corresponding to the global key matrix. This represents the value matrix of global feature fusion. This represents the linear mapping weights corresponding to the global value matrix. Represents the normalization function. The dimension of the key vector representing global feature fusion; After flattening the global features, the classifier is used to classify them to obtain the classification result of the account.

10. An Ethereum malicious account detection device based on semantic and graph structure fusion, characterized in that, include: The feature acquisition module is used to collect transaction data of accounts on the Ethereum platform, and to clean and standardize the transaction data to obtain transaction sequences; Feature processing module one is used to convert the transaction sequence into structured text transaction data, process the structured text transaction data using a word segmenter in a pre-trained language model to obtain an embedding vector, and process the embedding vector using an encoder in a pre-trained language model to obtain account-level semantic features. Feature processing module two is used to extract multiple types of expert statistical features based on the transaction data and construct a transaction account graph, which includes multiple nodes, each node representing a trading counterparty; the transaction account graph is processed using a trained graph attention network that integrates a multi-head attention mechanism to obtain structural features; The feature fusion module is used to fuse the account-level semantic features and the structural features using a trained cross-attention fusion network to obtain the account classification result.

Images