Method and system for unsupervised domain adaptation to detect encryption fraud

Abstract

A method of identifying fraudulent cryptocurrency transactions using a deep neural network includes receiving, by a receiver of a processing server, a source data set including tagged source data associated with a plurality of source features and associated with a source domain; receiving, by a receiver of the processing server, a target data set, the target data set comprising unlabeled target data associated with a plurality of target features and associated with a target domain; combining, by a processor of the processing server, at least a subset of the plurality of source features and at least a subset of the plurality of target features into a combined data layer; a deep neural network is trained by a processor of the processing server using a domain adaptation algorithm and the combined data layer to identify a final feature set.

Description

[0001] Cross Reference to Related Applications

[0002] This application claims the benefit of and priority to U.S. Patent Application No. 18 / 242,167, filed September 5, 2023. The entire disclosure of the above application is incorporated herein by reference. TECHNICAL FIELD

[0003] The present disclosure relates to detecting crypto fraud using unsupervised domain adaptation, and in particular, using unsupervised domain adaptation to leverage labeled data of other types of transactions to identify a useful feature set for identifying fraudulent transactions from unlabeled crypto data. BACKGROUND

[0004] Blockchain was originally developed as a way to process transactions and exchange cryptographic currency using a decentralized and anonymous system. Decentralization allows for a system that is not controlled by any single entity or group, which can provide advantages to users over traditional payment processing systems. Anonymity can allow users to make payment transactions without being tracked or having to provide personally identifiable information. However, while the benefits of decentralization and anonymity can be beneficial to users, blockchain architecture has also been used for money laundering purposes.

[0005] For traditional payment transactions that utilize electronic payment cards, such as credit or debit cards processed via a payment network, sophisticated fraud tools exist to detect when money laundering or other fraudulent behavior is attempted via a new payment transaction. However, no such tools have been developed for blockchain transactions that utilize cryptographic currency, also referred to herein as crypto currency transactions. The lack of such tools has resulted in over $1 billion in money laundering per year using various blockchain currencies. Fraud tools were developed for traditional payment transactions by leveraging rich historical data that includes both known fraudulent transactions and known true transactions. Due to the severe lack of data regarding fraudulent blockchain transactions, fraud tools for blockchain transactions have not been developed to date.

[0006] Accordingly, there is a need for a technical improvement that can leverage labeled data of electronic payment transactions for detecting fraud in unlabeled blockchain transactions. SUMMARY

[0007] The present disclosure provides a description of systems and methods for identifying fraudulent crypto currency transactions using deep neural networks. Labeled data of electronic payment transactions including a set of features is received along with unlabeled data of crypto transactions also including a set of features. An autoencoder can be used to identify more useful features from the crypto features set. The set of features for electronic payment transactions and crypto transactions can be combined into a single set of features. A deep neural network can then be trained via use of the combined set of features and a domain adaptation algorithm such as Deep CORAL, where the algorithm enables alignment of features from labeled electronic payment transaction data with features from unlabeled crypto currency transaction data. In an exemplary embodiment, the deep neural network can be trained until the difference between the CORAL loss and the classification loss is within a predetermined value. This training can result in identification of a final set of features that can be applied to unlabeled crypto currency transaction data in order to identify fraudulent blockchain transactions with a high success rate without requiring previously identified fraudulent blockchain transactions.

[0008] A method for identifying fraudulent crypto currency transactions using deep neural networks, comprising: receiving, by a receiver of a processing server, a source data set including labeled source data associated with a plurality of source features and associated with a source domain; receiving, by a receiver of the processing server, a target data set including unlabeled target data associated with a plurality of target features and associated with a target domain; combining, by a processor of the processing server, at least a subset of the plurality of source features and at least a subset of the plurality of target features into a combined data layer; training, by a processor of the processing server, a deep neural network using a domain adaptation algorithm and the combined data layer to identify a final set of features.

[0009] A system for identifying fraudulent crypto currency transactions using deep neural networks, comprising: a processing server including a receiver that receives a source data set and a target data set, the source data set including labeled source data associated with a plurality of source features and associated with a source domain, the target data set including unlabeled target data associated with a plurality of target features and associated with a target domain, and a processor that combines at least a subset of the plurality of source features and at least a subset of the plurality of target features into a combined data layer, and trains a deep neural network using a domain adaptation algorithm and the combined data layer to identify a final set of features. BRIEF DESCRIPTION OF DRAWINGS

[0010] The scope of the disclosure is best understood with reference to the following detailed description of exemplary embodiments when read in conjunction with the accompanying drawings. Included in the drawings are the following figures:

[0011] Figure 1This is a block diagram illustrating an advanced system architecture for identifying fraudulent cryptocurrency transactions according to an exemplary embodiment.

[0012] Figure 2 This illustrates an exemplary embodiment for identifying fraudulent cryptocurrency transactions. Figure 1 A block diagram of the processing server in the system.

[0013] Figure 3 This illustrates an exemplary embodiment. Figure 1 The flowchart shows the process of identifying fraudulent cryptocurrency transactions in the system.

[0014] Figure 4 This illustrates an exemplary embodiment. Figure 1 The flowchart shows the process of generating an adaptation model in the system to identify fraudulent cryptocurrency transactions.

[0015] Figure 5 This is a flowchart illustrating an exemplary method for identifying fraudulent cryptocurrency transactions using a deep neural network according to an exemplary embodiment.

[0016] Figure 6 This is a block diagram illustrating a computer system architecture according to an exemplary embodiment.

[0017] Further areas of applicability of this disclosure will become clear from the detailed description provided below. It should be understood that the detailed description of exemplary embodiments is intended for illustrative purposes only and is therefore not intended to necessarily limit the scope of this disclosure. Detailed Implementation

[0018] System for identifying fraudulent blockchain transactions

[0019] Figure 1 A system 100 for identifying fraudulent blockchain transactions is illustrated, which utilizes a deep neural network and domain adaptation to identify fraud in unlabeled blockchain transaction data using tagged data of electronic payment transactions. System 100 may include a processing server 102. The processing server 102, discussed in more detail below, can be configured to identify a final feature set for identifying fraudulent transactions by training a deep neural network with a domain adaptation algorithm.

[0020] System 100 may also include a blockchain network 104. Blockchain network 104 may include multiple blockchain nodes 106. Each blockchain node 106 may be, for example, in... Figure 5The computing system shown below, discussed in more detail, is configured to perform functions related to the processing and management of the blockchain, including the generation of blockchain data values, the verification of proposed blockchain transactions, the verification of digital signatures, the generation of new blocks, the verification of new blocks, and the maintenance of blockchain copies. In some embodiments, the processing server 102 may be a blockchain node 106.

[0021] A blockchain can be a distributed ledger comprising at least multiple blocks. Each block can include at least a block header and one or more data values. Each block header can include at least a timestamp, a block reference value, and a data reference value. The timestamp can be the time when the block header was generated and can be represented using any suitable method (e.g., UNIX timestamp, DateTime, etc.). The block reference value can be a value that references an earlier block in the blockchain (e.g., based on a timestamp). In some embodiments, the block reference value in the block header can be a reference to the block header of the most recently added block before the corresponding block. In an exemplary embodiment, the block reference value can be a hash value generated by hashing the block header of the most recently added block. The data reference value can similarly be a reference to one or more data values ​​stored in a block that includes a block header. In an exemplary embodiment, the data reference value can be a hash value generated by hashing one or more data values. For example, the block reference value can be the root of a Merkle tree generated using one or more data values.

[0022] Using block reference values ​​and data reference values ​​in each block header could render the blockchain immutable. Any attempt to modify a data value would require generating a new data reference value for that block, which in turn would require generating new block reference values ​​for subsequent blocks, and further, generating new block reference values ​​in each subsequent block. This would have to be performed and updated in every single blockchain node 106 in the blockchain network 104 before a new block could be generated and added to the blockchain to make the changes permanent. Computational and communication limitations could make such modifications extremely difficult, if not impossible, thus rendering the blockchain immutable.

[0023] In some embodiments, the blockchain can be used to store information about blockchain transactions between two different blockchain wallets. A blockchain wallet may include a private key for generating cryptographic key pairs that serve as authorization for a payer in a blockchain transaction, wherein the digital signature can be verified by the blockchain network 104 using the public key of the cryptographic key pair. In some cases, the term "blockchain wallet" may specifically refer to a private key. In other cases, the term "blockchain wallet" may refer to a computing device that stores a private key for use in blockchain transactions. For example, each computing device may have its own private key for a corresponding cryptographic key pair and may each be a blockchain wallet for use in transactions on a blockchain associated with the blockchain network. The computing device can be any type of device suitable for storing and utilizing a blockchain wallet, such as a desktop computer, laptop computer, notebook computer, tablet computer, cellular phone, smartphone, smartwatch, smart TV, wearable computing device, implantable computing device, etc.

[0024] Where applicable, each blockchain data value stored in the blockchain may correspond to a blockchain transaction or other data storage. A blockchain transaction may include at least: the sender's digital signature generated using the sender's private key, the blockchain address of the currency recipient generated using the recipient's public key, and the amount of blockchain currency transferred or other data being stored. In some blockchain transactions, the transaction may also include one or more blockchain addresses where the sender currently stores blockchain currency (e.g., where a digital signature proves its access to such currency), and addresses generated using the sender's public key for any changes that will be retained by the sender. Addresses to which cryptocurrency that can be used in future transactions has been sent are called "output" addresses because each address was previously used to capture the output of a previous blockchain transaction, also known as "unspent transactions" because currency was sent to that address in a previous transaction where the currency is still unspent. In some cases, a blockchain transaction may also include the sender's public key for use by entities when verifying the transaction. For conventional processing of blockchain transactions, such data may be provided by the sender or recipient to blockchain node 106 in blockchain network 104. A node can use the public key from the sender's wallet's cryptographic key pair to verify the digital signature, and also verify the sender's access to the funds (e.g., unspent transactions have not been spent and were sent to the address associated with the sender's wallet)—a process called transaction "confirmation"—which allows the blockchain transaction to be included in a new block. In traditional blockchain implementations, a new block can be verified by the other blockchain nodes 106 in the blockchain network 104 before being added to the blockchain and distributed to all blockchain nodes 106 in the blockchain network 104. Where the blockchain data value may be unrelated to blockchain transactions but is a storage of other types of data, the blockchain data value may still include or otherwise involve the verification of the digital signature.

[0025] In system 100, blockchain nodes 106 in blockchain network 104 can collect transaction data from blockchain transactions into a dataset. As discussed herein, blockchain transactions can be considered the target domain relative to the training and domain adaptation of deep neural networks because the dataset of blockchain transactions can include unlabeled data. As used herein, unlabeled data can refer to unclassified data. The dataset of blockchain transactions can also be referred to as the target dataset in this paper because it is a dataset that includes data from the target domain. In some instances, the target dataset can include a mixture of labeled and unlabeled data. In this case, labeled data can be used in conjunction with labeled source data discussed below during the training of deep neural networks.

[0026] Blockchain node 106 can use suitable communication networks and methods to electronically transmit a target dataset containing unlabeled target data to processing server 102. In some embodiments, system 100 may further include a target data provider 112. Target data provider 112 may be a separate entity and / or system from blockchain node 106 that collects (e.g., from blockchain node 106 or other systems) unlabeled target data with multiple associated characteristics. Target data provider 112 can use this data to generate a target dataset and provide the target dataset to processing server 102 using suitable communication networks and methods.

[0027] System 100 may also include a source data provider 108. Source data provider 108 may be an entity and / or system that collects data on electronic payment transactions. Electronic payment transactions can be considered the source domain relative to the training and domain adaptation of a deep neural network. Data concerning electronic payment transactions may also be referred to herein as source data. Source data can be labeled, which may refer to categorized data. For example, each electronic payment transaction in the source dataset may be categorized as a fraudulent or genuine transaction, where such a classification can be considered a label for the data. Source data provider 108 may collect labeled source data into a source dataset, which includes labeled source data and multiple associated features. Source data provider 108 may use appropriate communication networks and methods to electronically transmit the source dataset with associated features to processing server 102. In some cases, system 100 may also include a payment network 110. Payment network 110 may be a payment processing network configured to process electronic payment transactions via a payment track or other specialized architecture. In some instances, payment network 110 may be source data provider 108 providing the source dataset to processing server 102. In other instances, source data provider 108 may collect source data from one or more payment networks 110. In some embodiments, system 100 may include multiple source data providers 108 and target data providers 112 from which processing server 102 receives source and target data.

[0028] Processing server 102 may receive labeled source data with associated features and unlabeled target data with associated features. Processing server 102 may create a combined feature set using the source features and target features. In some embodiments, processing server 102 may identify a subset of one or both of the feature set before creating the combined feature set. In such embodiments, processing server 102 may train an autoencoder, which may be an unsupervised neural network, to identify a subset of the feature set. The autoencoder may process the feature set, referred to herein as the original features, to identify a subset of that feature set—referred to herein as latent features. In some cases, latent source features and latent target features may be identified and combined into the combined feature set. In other cases, original source features and latent target features may be identified and combined into the combined feature set.

[0029] Once the combined feature set has been created, the processing server 102 can train a deep neural network using a domain adaptation algorithm and the combined feature set. The deep neural network can be trained with appropriate weights until a suitable classification loss and / or domain loss is reached. In some embodiments, the deep neural network can utilize Deep CORAL as its domain adaptation algorithm. Deep CORAL can determine the CORAL loss between the source and target domains of a single feature layer using the following formula:

[0030] (1)

[0031] in Let Cs and CL represent the Frobenius norm of a square matrix. T Let represent the source covariance matrix and the target covariance matrix, respectively, and d represent the dimension. In an exemplary embodiment, a deep neural network can be trained until the difference between the CORAL loss and the classification loss is below a predetermined value. In this case, the loss constrains the distance between the source and target domains, thereby producing better performance in the target domain while maintaining strong classification accuracy in the source domain.

[0032] Once the deep neural network is fully trained, a complete feature set can be identified from it. This complete feature set can be a set of features applicable to unlabeled target data to identify potentially fraudulent blockchain transactions. The result is the identification of fraudulent blockchain transactions using domain adaptation from labeled electronic payment transaction data without using any labeled blockchain data. This allows for fraud detection of crypto transactions and the development of fraud tools without first identifying an adequate number of labeled fraudulent blockchain transactions via other means.

[0033] In some embodiments, the deep neural network can also utilize backpropagation as part of domain adaptation. Backpropagation can be performed during training to backpropagate the classifier loss and domain loss to strengthen the training of the neural network using both source and target data. In some cases, a gradient inversion layer can be used. During forward propagation, the gradient inversion layer can act as an identity transformation. During backpropagation, the gradient inversion layer can take gradients from subsequent layers, multiply them, and pass them to preceding layers. In an exemplary embodiment, the processing server 102 can utilize an autoencoder of the target's original features, a combination of backpropagation and a gradient inversion layer, and Deep CORAL on the combined dataset to identify a final feature set applied to the unlabeled target data. This can produce a powerful feature set that can be used for fraud detection in blockchain transactions using unsupervised domain adaptation with labeled electronic payment transaction data. In some cases, supervised domain adaptation can be performed by using labeled target data in addition to the unlabeled target data, which can further increase performance in some situations.

[0034] Processing server

[0035] Figure 2 It shows Figure 1 An embodiment of the processing server 102 in system 100. It will be clear to those skilled in the art that... Figure 2 The embodiment of the processing server 102 shown is provided for illustrative purposes only, and it is not exhaustive of all possible configurations of the processing server 102 suitable for performing the functions discussed herein. For example, in Figure 5 The computer system 600 shown and discussed in more detail below can be a suitable configuration for processing server 102. In some cases, other components of system 100, such as blockchain node 106, source data provider 108, payment network 110, and target data provider 112, may be included. Figure 2 The components shown in the diagram and discussed below.

[0036] Processing server 102 may include receiving device 202. Receiving device 202 may be configured to receive data over one or more networks via one or more network protocols. In some instances, receiving device 202 may be configured to receive data from blockchain node 106, source data provider 108, payment network 110, target data provider 112, and other systems and entities via one or more communication methods such as radio frequency, local area network, wireless local area network, cellular communication network, Bluetooth, Internet, etc. In some embodiments, receiving device 202 may include multiple devices, such as different receiving devices for receiving data over different networks, such as a first receiving device for receiving data over a local area network and a second receiving device for receiving data over the Internet. Receiving device 202 may receive data signals transmitted electronically, wherein data may be superimposed or otherwise encoded on the data signals and decoded, parsed, read, or otherwise obtained by receiving data signals via receiving device 202. In some instances, receiving device 202 may include a parsing module for parsing the received data signals to obtain the data superimposed thereon. For example, receiving device 202 may include a parser program configured to receive and transform received data signals into usable inputs for functions performed by a processing device to execute the methods and systems described herein.

[0037] Receiving device 202 can be configured to receive data signals electronically transmitted by blockchain node 106 and / or target data provider 112, which are overlaid with or otherwise encoded with the target dataset. These signals may include unlabeled blockchain transactions and multiple associated features. Receiving device 202 can also be configured to receive data signals electronically transmitted by source data provider 108 and / or payment network 110. These data signals may be overlaid with or otherwise encoded with the source dataset. These data signals may include labeled electronic payment transactions and multiple associated features. Receiving device 202 can also be configured to receive data used in training deep neural networks, such as domain adaptation algorithms, weights, requested classifications, and / or CORAL loss values, which may be sent from other systems to processing server 102 or received via suitable input devices.

[0038] Processing server 102 may also include a communication module 204. Communication module 204 may be configured to transfer data between modules, engines, databases, memory, and other components of processing server 102 for performing the functions discussed herein. Communication module 204 may include one or more communication types and utilizes various communication methods for communication within the computing device. For example, communication module 204 may include a bus, contact pin connectors, wires, etc. In some embodiments, communication module 204 may also be configured to communicate between internal components of processing server 102 and external components of processing server 102, such as externally connected databases, display devices, input devices, etc. Processing server 102 may also include a processing device. The processing device may be configured to perform the functions of processing server 102 discussed herein, as will be apparent to those skilled in the art. In some embodiments, the processing device may include multiple engines and / or modules (such as query module 216, generation module 218, training module 220, etc.) specifically configured to perform one or more functions of the processing device and / or consist of multiple engines and / or modules specifically configured to perform one or more functions of the processing device. As used herein, the term "module" can be software or hardware specifically programmed to receive input, perform one or more processes using that input, and provide output. The inputs, outputs, and processes performed by various modules will be apparent to those skilled in the art based on this disclosure.

[0039] Processing server 102 may also include source data 206. Source data 206 may include tagged data and multiple association features that can be used in domain adaptation using the methods discussed herein. In an exemplary embodiment, source data 206 may include data on multiple electronic payment transactions classified as fraudulent or genuine. Processing server 102 may also include target data 208. Target data 208 may include untagged data and multiple association features that can be used in domain adaptation using the methods discussed herein. In an exemplary embodiment, target data 208 may include data on multiple unclassified blockchain transactions. In some cases, target data 208 may include a mixture of tagged and untagged blockchain transaction data.

[0040] Processing server 102 may also include memory 214. Memory 214 may be configured to store data used by processing server 102 in performing the functions discussed herein, such as public and private keys, symmetric keys, etc. Memory 214 may be configured to store data using suitable data formatting methods and patterns and may be any suitable type of memory, such as read-only memory, random access memory, etc. Memory 214 may, for example, include encryption keys and algorithms, communication protocols and standards, data formatting standards and protocols, modules and application code of processing devices, and other data suitable for use by processing server 102 in performing the functions discussed herein, as will be apparent to those skilled in the art. In some embodiments, memory 214 may consist of or otherwise include a relational database that utilizes a structured query language for storing, identifying, modifying, updating, accessing, etc., structured datasets stored therein. Memory 214 may be configured to store, for example, cryptographic keys, key pairs, cryptographic algorithms, encryption algorithms, deep neural network data, autoencoder data, domain adaptation algorithms, weights, loss values, etc.

[0041] Processing server 102 may include query module 216. Query module 216 may be configured to perform queries against a database to identify information. Query module 216 may receive one or more data values ​​or query strings and may execute query strings based on an indicated database (such as the memory 214 of processing server 102) to identify information stored therein. Query module 216 can then output the identified information to an appropriate engine or module of processing server 102 as needed. Query module 216 may, for example, perform queries to identify marked electronic payment transactions and associated features from source data 206 for use in training deep neural networks.

[0042] The processing server 102 may also include a generation module 218. The generation module 218 may be configured to generate data for use by the processing server 102 in performing the functions discussed herein. The generation module 218 may receive instructions as input, generate data based on those instructions, and output the generated data to one or more modules of the processing server 102. For example, the generation module 218 may be configured to generate data messages, notification messages, data entries, etc. In some cases, the generation module 218 may be used to apply untagged blockchain transaction data to an established feature set to identify potentially fraudulent blockchain transactions.

[0043] The processing server 102 may also include a training module 220. The training module 220 may be configured to train a neural network using data and one or more algorithms. The training module 220 may receive instructions for training the neural network, which may include the neural network, data to be used in training, and / or one or more algorithms to be used in training, or the location of such data that the training module 220 may identify after receiving the instructions. The training module 220 may then train the neural network according to the instructions and then output the trained neural network or notifications about its training to another module or engine of the processing server 102.

[0044] The processing server 102 may also include a transmitting device 222. The transmitting device 222 may be configured to transmit data over one or more networks via one or more network protocols. In some instances, the transmitting device 222 may be configured to transmit data to the blockchain node 106, the source data provider 108, the payment network 110, the target data provider 112, and other entities via one or more communication methods, a local area network, a wireless local area network, cellular communication, Bluetooth, radio frequency, the Internet, etc. In some embodiments, the transmitting device 222 may include multiple devices, such as different transmitting devices for transmitting data over different networks, such as a first transmitting device for transmitting data over a local area network and a second transmitting device for transmitting data over the Internet. The transmitting device 222 may electronically transmit a data signal superimposed with data that can be parsed by a receiving computing device. In some instances, the transmitting device 222 may include one or more modules for superimposing, encoding, or otherwise formatting data into a data signal suitable for transmission.

[0045] The sending device 222 can be configured to electronically send data signals to blockchain node 106 and / or target data provider 112, such data signals being overlaid with or otherwise encoded with requests for target data and associated target features. The sending device 222 can also be configured to electronically send data signals to source data provider 108 and / or payment network 110, such data signals being overlaid with or otherwise encoded with requests for source data and associated source features. In some cases, the sending device 222 can also be configured to electronically transmit data signals to other systems, such data signals being overlaid with or otherwise encoded with requests for domain adaptation algorithms, weight values, loss values, etc.

[0046] The process of identifying fraudulent transactions through domain adaptation

[0047] Figure 3 It shows inFigure 1 In system 100, the process 300 executed by processing server 102 utilizes labeled data from the source domain and unlabeled data from the target domain to identify fraudulent blockchain transactions through domain adaptation.

[0048] At 302, the processing server 102 may receive multiple source raw features and labeled source data from one or more source data providers 108. The source raw features may be associated with the source data, and the source data may be labeled with an association class from multiple classes. At 304, the processing server 102 may receive multiple target raw features and unlabeled target data from one or more target providers 112. The target raw features may be associated with the target data, and the target data may be unlabeled relative to the association class. At 306, the training module 220 of the processing server 102 may train an autoencoder to recognize a subset of target features using the target raw features.

[0049] At 308, the generation module 218 of the processing server can generate a combined data layer. The combined data layer may include a combined feature set of source raw features and a subset of target features, and may also include labeled source data and unlabeled target data. The training module 220 of the processing server can then train a deep neural network using Deep CORAL and the combined data layer. At 310, the deep neural network can utilize a feature extractor that extracts features from the features in the combined data layer. At 312, the deep neural network can use a domain classifier with the extracted features to identify a prediction domain 314 (e.g., electronic payment transactions or blockchain transactions) for the data in the combined data layer. At 316, the deep neural network can use a class classifier with the extracted features to identify a prediction class 318 (e.g., fraud or genuine) for the data in the combined data layer.

[0050] The deep neural network can identify a classification loss as the result of predicting the class 318 of the data when compared with known classes in the labeled source data. The deep neural network can also identify a domain loss as the result of predicting the domain 314 of the data when compared with the source and target data in the combined data layer. These losses can be used with backpropagation during further training of the deep neural network until a suitable loss value is determined. A suitable loss value can be the classification loss and / or the domain loss within a predetermined value. In the case of using Deep CORAL, the CORAL loss can be identified directly from the combined data layer as part of domain adaptation from the source data to the target data. In such cases, the deep neural network can continue through training iterations until the CORAL loss is within a predetermined value. In some instances, the predetermined value of the CORAL loss can be a threshold of the difference between the CORAL loss and the classification loss. Once training is sufficient (e.g., one or more loss values ​​are within a suitable value and / or range), the extracted features can be used as the final feature set for identifying fraudulent transactions—including identifying fraudulent blockchain transactions using unlabeled blockchain transaction data.

[0051] The process of generating an adapted fraud model

[0052] Figure 4 This demonstrates the use of domain adaptive generation for... Figure 1 The process of identifying fraudulent cryptocurrency transactions in System 100 400.

[0053] Process 400 may utilize electronic payment transaction data 206 as source data. As discussed above, electronic payment transaction data 206 may include tagged transaction data 402. Tagged transaction data 402 may include multiple data values ​​from multiple electronic payment transactions, including at least one tag, such as a tag indicating whether the corresponding transaction has been identified as fraudulent or genuine. Multiple source raw features 302 may be identified by processing server 102 from the source data—specifically, the tagged transaction data 402.

[0054] Process 400 may also utilize cryptocurrency transaction data 208 as target data. As discussed above, cryptocurrency transaction data 208 may include untagged transaction data 404. Untagged transaction data may include multiple data values ​​from multiple cryptocurrency transactions that are not tagged with a category relative to fraud. Multiple target raw features 304 may be identified by processing server 102 from the target data (specifically, the untagged transaction data 404).

[0055] Processing server 102 can use source raw features 302 and labeled transaction data 402 to identify a set of fraud-labeled data 406. The fraud-labeled data 406 may include electronic payment transaction data 206 classified as fraudulent, where the data is available relative to various source raw features 302. Processing server 102 can use the fraud-labeled data 406 and perform unsupervised domain adaptation, as discussed above, to generate an adapted fraud model 408. The adapted fraud model 408 can be configured to utilize target raw features 304 of cryptocurrency transaction data 208 to determine whether a cryptocurrency transaction is fraudulent or genuine.

[0056] The adapted fraud model 408 can be configured to be applied to unlabeled transaction data 404 with data corresponding to the target original feature 304. The application of the model can utilize the feature data and, based on data learned from labeled transaction data 402, source original features 302, and unsupervised domain adaptation, determine whether the applied cryptocurrency transaction is fraudulent or genuine. The adapted fraud model 408 can be applied to existing unlabeled transaction data 402 and can also be applied to new transactions. For example, blockchain node 106 can electronically transmit transaction data of a proposed new cryptocurrency transaction to processing server 102. Processing server 102 can apply the adapted fraud model 408 to the proposed transaction and, if the transaction is determined to be genuine or fraudulent, return the result to blockchain node 106. Blockchain node 106 can then approve and attempt to confirm the transaction, or reject the transaction accordingly. In some cases, process 400 can be repeated periodically to be updated and further trained on the adapted fraud model 408. In such cases, with the acquisition of new transaction data (e.g., labeled source data and labeled and unlabeled target data), the adapted fraud model 408 can be further improved to achieve even greater accuracy. The result is an efficient adapted fraud model 408 for identifying fraudulent cryptocurrency transactions without the need for labeled target data through unsupervised domain adaptation.

[0057] Exemplary methods for identifying fraudulent cryptocurrency transactions

[0058] Figure 5 A method 500 for identifying fraudulent cryptocurrency transactions by using deep neural networks and domain adaptation is shown.

[0059] In step 502, the source dataset may be received by a receiver (e.g., receiving device 202) of a processing server (e.g., processing server 102). This source dataset includes labeled source data associated with multiple source features and is associated with a source domain (e.g., payment network 110). In step 504, the target dataset may be received by the receiver of the processing server. This target dataset includes unlabeled target data associated with multiple target features and is associated with a target domain (e.g., blockchain network 104).

[0060] In step 506, at least a subset of the multiple source features and at least a subset of the multiple target features can be combined into a combined data layer by the processor of the processing server (e.g., generation module 218). In step 508, the deep neural network can be trained by the processor of the processing server (e.g., training module 220) using a domain adaptation algorithm and the combined data layer to identify the final feature set.

[0061] In one embodiment, method 500 may further include training a first autoencoder on multiple target features by a processor of the processing server (e.g., training module 220) to identify a subset of the multiple target features. In some embodiments, method 500 may further include training a second autoencoder on multiple source features by a processor of the processing server (e.g., training module 220) to identify a subset of the multiple source features. In one embodiment, the domain adaptation algorithm may be DeepCORAL, and a deep neural network may be trained until the difference between the CORAL loss and the classification loss is within a predetermined value. In some embodiments, method 500 may further include transmitting the identified final feature set by a transmitter of the processing server (e.g., transmitting device 222) to apply it to data associated with a target domain.

[0062] In one embodiment, the source domain may be electronic payment transactions, and the target domain may be cryptocurrency transactions. In a further embodiment, method 500 may further include having a processor of the processing server (e.g., generation module 218) apply the identified final feature set to the target dataset to identify one or more fraudulent cryptocurrency transactions. In another further embodiment, method 500 may further include: receiving a new dataset associated with the target domain by a receiver of the processing server; and having a processor of the processing server (e.g., generation module 218) apply the identified final feature set to the new dataset to identify one or more fraudulent cryptocurrency transactions.

[0063] Computer System Architecture

[0064] Figure 6A computer system 600 is illustrated, wherein embodiments of the present disclosure or portions thereof may be implemented as computer-readable code. For example, a processing server 102, a blockchain node 106, a source data provider 108, a payment network 110, and a target data provider 112 may be implemented in the computer system 600 using hardware, a non-transitory computer-readable medium having instructions stored thereon, or a combination thereof, and the processing server 102, blockchain node 106, source data provider 108, payment network 110, and target data provider 112 may be implemented in one or more computer systems or other processing systems. The hardware may embody the implementation... Figures 3-5 The modules and components of the method.

[0065] If programmable logic is used, this logic can be executed on a commercially available processing platform configured with executable software code to become a dedicated computer or dedicated device (e.g., a programmable logic array, application-specific integrated circuit, etc.). Those skilled in the art will recognize that embodiments of the disclosed subject matter can be practiced using a variety of computer system configurations, including multi-core multiprocessor systems, minicomputers, mainframes, computers linked or clustered with distributed functions, and ubiquitous computers or microcomputers that can be embedded in virtually any device. For example, the embodiments described above can be implemented using at least one processor device and memory.

[0066] The processor unit or processor device discussed herein may be a single processor, multiple processors, or a combination thereof. A processor device may have one or more processor "cores". The terms "computer program medium," "non-transitory computer-readable medium," and "computer-usable medium" discussed herein are generally used to refer to tangible media, such as removable storage unit 618, removable storage unit 622, and hard disks installed in hard disk drive 612.

[0067] Various embodiments of this disclosure are described with reference to the example computer system 600. After reading this specification, it will become clear to those skilled in the art how to implement this disclosure using other computer systems and / or computer architectures. Although operations may be described as sequential processes, some operations may actually be performed in parallel, concurrently, and / or in a distributed environment, and the program code may be stored locally or remotely for access by a single or multiple processor machines. Furthermore, in some embodiments, the order of operations may be rearranged without departing from the spirit of the disclosed subject matter.

[0068] Processor device 604 may be a dedicated processor device or a general-purpose processor device specifically configured to perform the functions discussed herein. Processor device 604 may be connected to communication infrastructure 606, such as a bus, message queue, network, multi-core messaging scheme, etc. The network may be any network suitable for performing the functions disclosed herein and may include a local area network (LAN), a wide area network (WAN), a wireless network (e.g., WiFi), a mobile communication network, a satellite network, the Internet, fiber optic cable, coaxial cable, infrared, radio frequency (RF), or any combination thereof. Other suitable network types and configurations will be apparent to those skilled in the art. Computer system 600 may also include main memory 608 (e.g., random access memory, read-only memory, etc.) and may also include secondary memory 610. Secondary memory 610 may include hard disk drive 612 and removable storage drive 614, such as floppy disk drive, tape drive, optical disk drive, flash memory, etc.

[0069] The removable storage drive 614 can read from and / or write to the removable storage unit 618 in a well-known manner. The removable storage unit 618 may include a removable storage medium that can be read from and written to by the removable storage drive 614. For example, if the removable storage drive 614 is a floppy disk drive or a Universal Serial Bus port, the removable storage unit 618 may be a floppy disk or a portable flash drive, respectively. In one embodiment, the removable storage unit 618 may be a non-transitory computer-readable recording medium.

[0070] In some embodiments, auxiliary memory 610 may include optional means for allowing computer programs or other instructions to be loaded into computer system 600, such as removable storage unit 622 and interface 620. As will be apparent to those skilled in the art, examples of such means may include program boxes and box interfaces (e.g., as found in video game systems), removable memory chips (e.g., EEPROM, PROM, etc.) and associated sockets, as well as other removable storage units 622 and interfaces 620.

[0071] Data stored in computer system 600 (e.g., in main memory 608 and / or auxiliary memory 610) can be stored on any type of suitable computer-readable medium, such as optical storage devices (e.g., compact discs, digital multifunction discs, Blu-ray discs, etc.) or magnetic tape storage devices (e.g., hard disk drives). Data can be configured with any type of suitable database configuration (e.g., relational databases, structured query language (SQL) databases, distributed databases, object databases, etc.). The appropriate configuration and storage type will be clear to those skilled in the art.

[0072] Computer system 600 may also include a communication interface 624. Communication interface 624 may be configured to allow the transfer of software and data between computer system 600 and external devices. Exemplary communication interface 624 may include a modem, network interface (e.g., an Ethernet card), communication port, PCMCIA slot, and card, etc. Software and data transferred via communication interface 624 may be in the form of signals, which may be electronic, electromagnetic, optical, or other signals that will be clear to those skilled in the art. Signals may travel via communication path 626, which may be configured to carry signals and may be implemented using wires, cables, optical fibers, telephone lines, cellular telephone links, radio frequency links, etc.

[0073] Computer system 600 may also include a display interface 602. Display interface 602 may be configured to allow data transfer between computer system 600 and external display 630. Exemplary display interface 602 may include a high-resolution multimedia interface (HDMI), a digital video interface (DVI), a video graphics array (VGA), etc. Display 630 may be any suitable type of display for displaying data transferred via display interface 602 of computer system 600, including cathode ray tube (CRT) displays, liquid crystal displays (LCDs), light-emitting diode (LED) displays, capacitive touch displays, thin-film transistor (TFT) displays, etc.

[0074] Computer program media and computer-usable media can refer to memory, such as main memory 608 and auxiliary memory 610, which can be memory semiconductors (e.g., DRAM, etc.). These computer program products can be means for providing software to computer system 600. Computer programs (e.g., computer control logic) can be stored in main memory 608 and / or auxiliary memory 610. Computer programs can also be received via communication interface 624. When executed, such computer programs enable computer system 600 to implement the present methods discussed herein. In particular, when executed, computer programs enable processor device 604 to implement the methods discussed herein. Figures 3-5 The method is illustrated. Therefore, such a computer program can represent the controller of computer system 600. When implementing this disclosure using software, the software can be stored in the computer program product and loaded into computer system 600 using removable storage drive 614, interface 620, and hard disk drive 612 or communication interface 624.

[0075] Processor device 604 may include one or more modules or engines configured to perform the functions of computer system 600. Each module or engine may be implemented using hardware, and in some cases may also utilize software such as program code and / or programs stored in main memory 608 or auxiliary memory 610. In such cases, the program code may be compiled by processor device 604 (e.g., by compiling a module or engine) before being executed by the hardware of computer system 600. For example, the program code may be source code written in a programming language, which is translated into a low-level language such as assembly language or machine code for execution by processor device 604 and / or any additional hardware components of computer system 600. The compilation process may include lexical analysis, preprocessing, parsing, semantic analysis, syntax-guided transformation, code generation, code optimization, and any other techniques that may be suitable for translating the program code into a low-level language suitable for controlling computer system 600 to perform the functions disclosed herein. It will be clear to those skilled in the art that such a process results in computer system 600 being a specially configured computer system 600 uniquely programmed to perform the functions discussed above.

[0076] Using unsupervised domain adaptation to detect crypto fraud, and more specifically, using unsupervised domain adaptation to leverage labeled data from other types of transactions to identify a useful set of features for identifying fraudulent transactions in unlabeled crypto data, offers several technical advantages over current methods for detecting fraudulent cryptocurrency transactions. For example, the techniques disclosed herein provide greater accuracy in fraud detection and thus increase the security of blockchain-based transactions and, more generally, cryptocurrency transactions. These advantages also include leveraging rich historical data, including known fraudulent transactions and known genuine transactions involving traditional payments, to identify a useful set of features for identifying fraudulent transactions in unlabeled crypto data via unsupervised domain adaptation. Without this new technique, fraud might continue to be a significant problem plaguing cryptocurrency transactions for years and could be rapidly adopted because this technique improves the detection of fraud in unlabeled blockchain transactions in a new and non-obvious way by leveraging labeled data from electronic payment transactions.

[0077] Among other features, the technology consistent with this disclosure also provides systems and methods for using deep neural networks to identify fraudulent cryptocurrency transactions. While various exemplary embodiments of the disclosed systems and methods have been described above, it should be understood that they are presented merely for illustrative purposes and not for limitation. They are not exhaustive and do not limit the disclosure to the exact form disclosed. In light of the foregoing teachings, modifications and variations are possible, or can be obtained from practice of this disclosure without departing from its breadth or scope.

Claims

1. A method for identifying fraudulent cryptocurrency transactions using a deep neural network, comprising: The source dataset is received by the receiver of the processing server. The source dataset includes labeled source data associated with multiple source features and associated with a source domain. The target dataset is received by the receiver of the processing server. The target dataset includes unlabeled target data associated with multiple target features and associated with a target domain. The processor of the processing server combines at least a subset of the plurality of source features and at least a subset of the plurality of target features into a combined data layer; The processor of the processing server uses a domain adaptation algorithm and a combined data layer to train a deep neural network to identify the final feature set.

2. The method of claim 1, further comprising: The processor of the processing server trains a first autoencoder on the plurality of target features to identify a subset of the plurality of target features.

3. The method of claim 1, further comprising: The processor of the processing server trains a second autoencoder on the plurality of source features to identify a subset of the plurality of source features.

4. The method of claim 1, wherein The domain adaptation algorithm is Deep CORAL, and The deep neural network is trained until the difference between the CORAL loss and the classification loss is within a predetermined value.

5. The method of claim 1, further comprising: The final set of identified features is sent by the processor server to be applied to the data associated with the target domain.

6. The method of claim 1, wherein The source domain is an electronic payment transaction; and The target domain is cryptocurrency transactions.

7. The method of claim 6, further comprising: The processor of the processing server applies the identified final feature set to the target dataset to identify one or more fraudulent cryptocurrency transactions.

8. The method of claim 6, further comprising: The receiver of the processing server receives a new dataset associated with the target domain; as well as The processor of the processing server applies the final set of identified features to the new dataset to identify one or more fraudulent cryptocurrency transactions.

9. A system for identifying fraudulent cryptocurrency transactions using a deep neural network, comprising: Processing server, the processing server includes A receiver receives a source dataset and a target dataset, the source dataset comprising labeled source data associated with multiple source features and associated with a source domain, and the target dataset comprising unlabeled target data associated with multiple target features and associated with a target domain. processor, the processor At least a subset of the multiple source features and at least a subset of the multiple target features are combined into a combined data layer, and A domain-adaptive algorithm and combined data layers are used to train a deep neural network to identify the final feature set.

10. The system of claim 9, wherein the processor of the processing server trains a first autoencoder on the plurality of target features to identify a subset of the plurality of target features.

11. The system of claim 9, wherein the processor of the processing server trains a second autoencoder on the plurality of source features to identify a subset of the plurality of source features.

12. The system of claim 9, wherein The domain adaptation algorithm is Deep CORAL, and The deep neural network is trained until the difference between the CORAL loss and the classification loss is within a predetermined value.

13. The system of claim 9, wherein the processing server further includes a transmitter that transmits the identified final feature set to be applied to data associated with the target domain.

14. The system of claim 9, wherein The source domain is an electronic payment transaction; and The target domain is cryptocurrency transactions.

15. The system of claim 14, wherein the processor of the processing server applies the identified final feature set to the target dataset to identify one or more fraudulent cryptocurrency transactions.

16. The system of claim 14, wherein The receiver of the processing server receives a new dataset associated with the target domain, and The processor of the processing server applies the final set of identified features to the new dataset to identify one or more fraudulent cryptocurrency transactions.

Images