Method and system for collecting block chain addresses

Abstract

The invention discloses a block chain address collection method and system, and belongs to the technical field of block chains, and the key points of the technical scheme comprise a data collection module, an integrated learning classification module, a transaction graph construction module, a transaction graph construction module, an optimization graph algorithm processing module, and a result collection module. The method has the advantages that the advantages of a machine learning algorithm and a graph algorithm are combined, the calculation mode of the graph algorithm is improved, the problem of long consumed time under the condition of large data volume is effectively avoided, the time required by calculation is shortened, and the accuracy is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchains, and more particularly to a method and system for aggregating blockchain addresses. BACKGROUND

[0002] A blockchain address generally refers to a wallet address. A wallet on a blockchain is a tool for managing digital assets, and the transfer of digital assets is realized through the wallet. In a blockchain system, a private key is generally a 256-bit binary string randomly generated by a special random algorithm, and a public key is generated from the private key through an irreversible algorithm. A user can operate his or her wallet account through the private key, so we can only see the public account information and cannot infer the specific user information. A user can generate any number of accounts to manage digital assets, and illegal beneficiaries often use fund transfers between multiple addresses to evade supervision. Therefore, blockchain address aggregation (identifying multiple addresses controlled by the same principal) is a core technical requirement for combating illegal blockchain activities.

[0003] Currently, machine learning and graph algorithms have been widely used in the financial field to prevent and discover fraud [Ma Qingda, Huang Xiaomin, Cao Feifei <Research on the explainability of anti-money laundering models based on graph algorithm semi-supervised learning> Computer Programming Techniques and Maintenance, June 18, 2021], and these technologies are applied to the blockchain field, i.e., using machine learning algorithms and graph algorithms to calculate the categories of each account and their relevance, which can effectively discover the principal behind the public address account.

[0004] Since the results of machine learning algorithms are still probabilistic rather than deterministic, the results cannot fully meet the requirements. Graph algorithms have special requirements for the format of the underlying data, and as the amount of data increases, the computing power required is higher, the computing time is longer, and the complexity is also increased. Therefore, the above-mentioned two methods still have the defects of poor accuracy and slow speed in actual use.

[0005] Therefore, the present application provides a method and system for aggregating blockchain addresses to solve the above problems. SUMMARY

[0006] In view of the deficiencies of the prior art, the present application aims to provide a method and system for aggregating blockchain addresses, which has the advantages of combining the advantages of machine learning algorithms and graph algorithms and improving the calculation method of graph algorithms, effectively avoiding the problem of long time consumption under large amounts of data, reducing the time required for calculation, and improving the accuracy.

[0007] To achieve the above-mentioned purpose, the present application provides the following technical solution: a system for aggregating blockchain addresses, comprising:

[0008] a data collection module configured to collect address data and transaction data in a blockchain network, the address data including labeled addresses and unlabeled addresses, the labeled addresses including hot wallets, cold wallets and ordinary wallets, and the transaction data including transaction amounts, transaction times and interaction frequencies between addresses;

[0009] an integrated learning classification module configured to receive the address data and the transaction data output by the data collection module, extract address features, train a classification model in combination with label information of the labeled addresses, and output preliminary type labels of all addresses with confidence;

[0010] a transaction graph construction module configured to receive the preliminary type labels and corresponding labeled addresses output by the integrated learning classification module, extract interaction addresses and corresponding transaction data of the labeled addresses, and construct a transaction graph conforming to an input format of a graph algorithm;

[0011] the optimization graph algorithm processing module includes:

[0012] the improved community discovery unit adopts an optimization algorithm based on a Louvain algorithm, and blocks traversal of addresses that do not meet the conditions in combination with the preliminary type labels and address features of the integrated learning classification module, so as to reduce the number of calculations and realize division of address groups in the transaction graph;

[0013] the label propagation unit adopts a label propagation algorithm, and performs label propagation and completion on addresses that are not labeled or have low confidence labels in the transaction graph based on the high-confidence labels output by the integrated learning classification module;

[0014] a result collection module configured to receive the address group division results and the completed address type labels output by the optimization graph algorithm processing module, and comprehensively generate an address collection report, the report including a group to which each address belongs, a type label and associated transaction information.

[0015] The application further preferably comprises:

[0016] an address collection unit configured to collect labeled addresses and random unlabeled addresses in batches through a blockchain browser API or a node interface;

[0017] a transaction collection unit configured to collect transaction data of each address within a set time, and perform deduplication and format standardization on the transaction data.

[0018] The application further preferably comprises that the integrated learning algorithm of the integrated learning classification module adopts a fusion architecture of a random forest sub-model combined with a gradient boosting tree XGBoost sub-model, wherein the random forest sub-model is used to extract global features of the addresses, and the gradient boosting tree XGBoost sub-model is used to capture local key features.

[0019] The application further preferably comprises a model updating module, which collects newly added labeled addresses and transaction data every month, performs incremental training on the integrated learning classification model, updates the transaction graph according to the newly added transaction data, triggers the optimization graph algorithm processing module to re-execute group division and label completion, and ensures the adaptability of the system to new addresses and new transaction modes.

[0020] A method for collecting blockchain addresses, comprising the following steps:

[0021] S1: data collection, collecting labeled addresses, unlabeled addresses and corresponding transaction data through a data collection module, the ratio of labeled addresses to unlabeled addresses being 5:95;

[0022] S2: integrated learning classification, the integrated learning classification module extracts address features, trains a fusion classification model, and outputs preliminary type labels and confidence of the addresses;

[0023] S3: transaction graph construction, based on high-confidence labeled addresses and labeled addresses, extracting interaction addresses and transaction data to construct a transaction graph;

[0024] S4: optimization graph algorithm processing, improving the community discovery unit to block invalid traversal to realize address group division, and the label propagation unit to complete the label of unmarked addresses;

[0025] S5: result collection, combining the group division result and the completed label to generate an address collection report;

[0026] S6: model and graph updating, periodically incrementally training the classification model, updating the transaction graph and the collection result.

[0027] The application further preferably comprises the following steps in the address feature extraction process in step S2:

[0028] S21: transaction frequency feature, counting the number of transactions per month of the address, and distinguishing hot wallets, ordinary wallets and cold wallets;

[0029] S22: interaction address feature, counting the total number of interaction addresses of the address in a set number of months, the value range of the interaction address number of hot wallets, the value range of ordinary wallets, and the value range of cold wallets;

[0030] S23: transaction amount feature, calculating the average transaction amount and the maximum transaction amount of the address, the value range of the maximum transaction amount of cold wallets, the value range of ordinary wallets, and the value range of hot wallets;

[0031] S24: feature standardization, mapping all features to the interval [-1, 1] through Z-score standardization to eliminate dimensional differences.

[0032] The improved community discovery unit further preferably comprises:

[0033] S41: initialize the traversal list, and only high-confidence label addresses output by the integrated learning classification module and addresses directly interacting with the high-confidence label addresses are included in the initial traversal range;

[0034] S42: in the traversal process, if the address feature meets the node, the subsequent traversal is blocked, and the associated address is no longer expanded;

[0035] S43: a modularity maximization strategy is used to divide the remaining nodes into communities, and an address group is output, and the number of traversals is reduced by more than 40% compared with the traditional Louvain algorithm.

[0036] The propagation rule of the label propagation unit further preferably comprises:

[0037] S4a: the high-confidence label addresses output by the integrated learning classification module are taken as seed nodes, and initial label weights are assigned;

[0038] S4b: each unlabeled address calculates its label probability according to the label weight of the adjacent node;

[0039] S4c: the highest probability label is selected as the complete label of the current address, and if the highest probability is less than 60%, the address is marked as: to be verified, and the information of the adjacent high-confidence label address is associated;

[0040] S4d: repeat S4b-S4c until all unlabeled addresses complete label completion or reach a preset iteration number.

[0041] The specific implementation process of the improved community discovery unit in step S4 further preferably comprises:

[0042] S411: import the transaction graph and the preliminary type label, and select addresses with a confidence degree greater than or equal to 80% as core nodes;

[0043] S412: build a direct interaction address list of the core nodes to form an initial traversal subset;

[0044] S413: perform feature judgment on the addresses in the initial traversal subset, if the address label is a cold wallet and the interaction frequency is within a set range, mark the address as: a blocked node, and do not include the address in subsequent expansion;

[0045] S414: for non-blocked nodes, a Louvain algorithm is used to calculate the modularity, and the communities with improved modularity are merged until the modularity is maximized;

[0046] S415: output the final address group, and each group includes a core node, a non-blocked interaction node and associated transaction information.

[0047] In summary, the present application has the following advantages:

[0048] A mature application system is provided, which combines the application of machine learning and graph calculation, and optimizes the calculation method of the graph algorithm. The system can not only analyze the wallet address attributes, but also effectively distinguish ordinary user addresses, hot wallet addresses and cold wallet address labels. At the same time, the analysis of the wallet address attributes and relationships can help track malicious user addresses and related events, help relevant personnel obtain more rich information, effectively avoid the problem of long time consumption under large data, reduce the required time for calculation, and improve the accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 is a system framework diagram of the present application;

[0050] Figure 2 is a flowchart of the present application. DETAILED DESCRIPTION

[0051] The present application will be further described in detail below in combination with the drawings.

[0052] As shown in Figure 1 , 2 , a system for collecting blockchain addresses, comprising:

[0053] A data acquisition module, the data acquisition module is used for acquiring address data and transaction data in a blockchain network, the address data includes labeled addresses and unlabeled addresses, wherein the authoritative labels include hot wallets, cold wallets and ordinary wallets, the acquisition ratio of the labeled addresses and the unlabeled addresses is 5:95, and the transaction data includes the transfer amount between addresses, transaction time and interaction frequency;

[0054] An integrated learning classification module, the integrated learning classification module is built-in with an integrated learning algorithm, receives the address data and the transaction data output by the data acquisition module, extracts address features, wherein the address features include transaction frequency, interaction address quantity and single transaction amount, trains a classification model in combination with the label information of the labeled addresses, outputs preliminary type labels with confidence for all addresses, and the preliminary type labels are matched with the corresponding hot wallets, cold wallets and ordinary wallets;

[0055] A transaction graph construction module, the transaction graph construction module receives the preliminary type labels output by the integrated learning classification module, that is, addresses with a confidence of greater than or equal to 80% and labeled addresses, extracts the interaction addresses and corresponding transaction data of these addresses, and constructs a transaction graph in the form of address as node, transaction relationship as edge and transaction amount / frequency as edge weight, which conforms to the input format of the graph algorithm;

[0056] The optimization graph algorithm processing module includes an improved community discovery unit and a label propagation unit; the improved community discovery unit adopts an optimization algorithm based on the Louvain algorithm, combines the preliminary type label and the address feature of the integrated learning classification module, blocks the iteration of the address that does not meet the condition, reduces the number of calculations, and realizes the division of the address group in the transaction graph; the label propagation unit adopts a label propagation algorithm based on the high-confidence label output by the integrated learning classification module, i.e., the confidence ≥ 80% is set as the high-confidence label, and the label propagation is performed on the address in the transaction graph that is not labeled or has a low-confidence label to complete the label.

[0057] The result collection module receives the address group division result and the completed address type label output by the optimization graph algorithm processing module, and comprehensively generates an address collection report, which includes the group to which each address belongs, the type label and the associated transaction information.

[0058] Preferably, the data collection module includes an address collection unit and a transaction collection unit; the address collection unit collects addresses with authoritative labels and random unlabeled addresses in batches through a blockchain browser API or a node interface, and ensures that the ratio of labeled addresses to unlabeled addresses is 5:95; the transaction collection unit collects transaction data of each address in the past 12 months, including transaction hash, transfer initiation address, receiving address, transaction amount, transaction timestamp and interaction frequency, and performs de-duplication and format standardization on the transaction data.

[0059] Preferably, the integrated learning algorithm of the integrated learning classification module adopts a fusion architecture of “random forest + gradient boosting tree XGBoost”; wherein the random forest sub-model is used to extract global features of the address, such as transaction frequency distribution and interaction address topology; the XGBoost sub-model is used to capture local key features, such as single largest transaction amount and low-frequency high-amount features unique to cold wallets; the address features specifically include hot wallet features, cold wallet features and ordinary wallet features, wherein the hot wallet features have a transaction frequency > 100 times / month and an interaction address number > 50; the cold wallet features have a transaction frequency < 10 times / year and a single amount > 100 ETH; the ordinary wallet features have a transaction frequency of 10-50 times / month and an interaction address number of 10-30; during the training of the classification model, 5-fold cross-validation is adopted, and the accuracy and F1 score are used as evaluation indexes, and the training is stopped when the accuracy of the verification set ≥ 90%.

[0060] Preferably, it further includes a model updating module, which collects new labeled addresses and transaction data every month, performs incremental training on the integrated learning classification model, freezes 80% of the decision tree parameters, only updates 20% of the new feature related parameters, updates the transaction graph according to the new transaction data, triggers the optimization graph algorithm processing module to re-execute the group division and label completion, and ensures the adaptability of the system to new addresses and new transaction modes.

[0061] Preferably, the optimization logic of the improved community discovery unit comprises:

[0062] S41: initialize the traversal list, only high-confidence label addresses output by the integrated learning classification module and addresses directly interacting with them are included in the initial traversal range;

[0063] S42: during the traversal process, nodes with address features meeting the "cold wallet label + interaction frequency <5 times + no cross-group transactions" are blocked from subsequent traversal;

[0064] S43: adopt the modularity maximization strategy, target modularity ≥0.3, and perform community division on the remaining nodes to output address groups, which reduces the traversal times by more than 40% compared to the traditional Louvain algorithm.

[0065] Preferably, the propagation rule of the label propagation unit comprises:

[0066] S4a: set high-confidence label addresses output by the integrated learning classification module, i.e. confidence ≥80%, as high-confidence label addresses, as seed nodes, and assign initial label confidence;

[0067] S4b: each unlabeled address calculates its label probability according to the label confidence of its adjacent nodes, i.e. addresses directly connected in the transaction graph, i.e. probability = sum of adjacent node label weights / total number of adjacent nodes;

[0068] S4c: select the label with the highest probability as the completed label of the current address, if the highest probability <60%, mark it as "to be verified" and associate it with the information of its adjacent high-confidence label addresses;

[0069] S4d: repeat S4b-S4c until all unlabeled addresses complete label completion or reach the preset iteration of 50 times.

[0070] As shown in Figure 1 , 2 A method for collecting blockchain addresses, comprising the following steps:

[0071] S1: data collection, collect labeled addresses, unlabeled addresses and corresponding transaction data through a data collection module, the ratio of labeled addresses to unlabeled addresses is 5:95;

[0072] S2: integrated learning classification, the integrated learning classification module extracts address features, trains a "random forest + XGBoost" fusion classification model, and outputs address preliminary type labels and confidence;

[0073] S3: Transaction graph construction, based on high-confidence label addresses and labeled addresses, extract interaction addresses and transaction data, construct transaction graph, wherein the confidence of the high-confidence label address is ≥80%;

[0074] S4: Optimization graph algorithm processing, improve community discovery unit to block invalid traversal to realize address group division, and label propagation unit to complete unmarked address label;

[0075] S5: Result collection, combine group division results and completed labels to generate address collection report;

[0076] S6: Model and graph update, periodically incrementally train classification model, update transaction graph and collection results.

[0077] Preferably, the address feature extraction process in step S2 includes:

[0078] S21: Transaction frequency feature, count the number of transactions per month of the address, and distinguish hot wallet >100 times / month, normal wallet 10-50 times / month, and cold wallet <10 times / year;

[0079] S22: Interaction address feature, count the total number of interaction addresses of the address in the past 12 months, hot wallet interaction address number >50, normal wallet 10-30, cold wallet <5;

[0080] S23: Transaction amount feature, calculate the average amount and maximum amount of single transaction of the address, cold wallet single maximum amount >100 ETH, normal wallet 1-10 ETH, hot wallet no fixed range;

[0081] S24: Feature standardization, map all features to the [-1, 1] interval through Z-score standardization to eliminate dimensional differences.

[0082] Preferably, the specific implementation process of improving the community discovery unit in step S4 includes:

[0083] S411: Import transaction graph and preliminary type label, and select addresses with confidence ≥80% as core nodes;

[0084] S412: Build a list of direct interaction addresses of the core nodes to form an initial traversal subset;

[0085] S413: Perform feature judgment on the addresses in the initial traversal subset, if the address label is cold wallet and the interaction frequency is <5 times, mark it as "block node" and do not include it in the subsequent expansion;

[0086] S414: For non-block nodes, use the Louvain algorithm to calculate the module degree, and merge communities with improved module degree until the maximum module degree ≥0.3;

[0087] S415: output the final address group, each group containing core nodes, non-blocking interaction nodes and associated transaction information.

[0088] The working process and beneficial effects of the present application are as follows:

[0089] Through the mature application system, the application of machine learning and graph calculation is combined, the calculation mode of the graph algorithm is optimized, and the combination of the two achieves the effect of 1+1>2. The system can not only analyze the wallet address attributes, but also effectively distinguish ordinary user addresses, hot wallet addresses and cold wallet address labels. At the same time, the analysis of the wallet address attributes and relationships can help track malicious user addresses and related events, and in view of the insufficient accuracy of the machine learning model and the complexity and time-consuming of the graph algorithm calculation, it is helpful for relevant personnel to obtain more rich information, effectively avoid the problem of long time under large data volume, reduce the time required for calculation, and improve the accuracy.

[0090] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. within the design concept of the present application shall be included in the protection scope of the present application.

Claims

1. A system for aggregating blockchain addresses, characterized in that: include: The data acquisition module is used to collect address data and transaction data in the blockchain network. The address data includes tagged addresses and untagged addresses. Tagged addresses include hot wallets, cold wallets, and ordinary wallets. The transaction data includes the transfer amount between addresses, transaction time, and interaction frequency. The ensemble learning classification module has a built-in ensemble learning algorithm. It receives address data and transaction data output from the data acquisition module, extracts address features, trains a classification model by combining the label information of labeled addresses, and outputs preliminary type labels with confidence for all addresses. The transaction graph construction module receives the preliminary type labels and corresponding labeled addresses output by the integrated learning classification module, extracts the interaction addresses with labeled addresses and the corresponding transaction data, and constructs a transaction graph that conforms to the input format of the graph algorithm. The optimized graph algorithm processing module includes: The improved community detection unit adopts an optimized algorithm based on the Louvain algorithm. Combined with the preliminary type labels and address features of the integrated learning classification module, it blocks traversal of addresses that do not meet the conditions, reduces the number of calculations, and realizes the division of address groups in the transaction graph. The label propagation unit uses a label propagation algorithm to propagate and complete the unlabeled or low-confidence labeled addresses in the transaction graph based on the high-confidence labels output by the integrated learning classification module. The result collection module receives the address group division results and the completed address type labels output by the optimization graph algorithm processing module, and generates an address collection report. The report includes the group to which each address belongs, the type label, and related transaction information.

2. The system for aggregating blockchain addresses according to claim 1, characterized in that: The data acquisition module includes: The address collection unit collects tagged addresses and random untagged addresses in batches through the blockchain explorer API or node interface; The transaction collection unit collects transaction data from each address within a set time period and performs deduplication and format standardization on the transaction data.

3. The system for aggregating blockchain addresses according to claim 1, characterized in that: The ensemble learning algorithm of the ensemble learning classification module adopts a fusion architecture of random forest sub-model and gradient boosting tree XGBoost sub-model. The random forest sub-model is used to extract global features of the address, and the gradient boosting tree XGBoost sub-model is used to capture local key features.

4. The system for aggregating blockchain addresses according to claim 1, characterized in that: It also includes a model update module, which collects newly added labeled address and transaction data every month, incrementally trains the ensemble learning classification model, updates the transaction graph based on the new transaction data, and triggers the optimization graph algorithm processing module to re-execute group division and label completion to ensure the system's adaptability to new addresses and new transaction patterns.

5. A method for aggregating blockchain addresses based on the system of claim 1, characterized in that: Includes the following steps: S1: Data Acquisition. The data acquisition module collects tagged addresses, untagged addresses, and corresponding transaction data. The ratio of tagged to untagged addresses is 5:

95. S2: Ensemble learning classification. The ensemble learning classification module extracts address features, trains the fusion classification model, and outputs preliminary address type labels and confidence scores. S3: Transaction graph construction: Based on high-confidence tagged addresses and labeled addresses, extract interaction addresses and transaction data to construct a transaction graph; S4: Optimize graph algorithm processing, improve community detection unit to block invalid traversal to achieve address group partitioning, and label propagation unit to complete unlabeled address labels; S5: Results aggregation, combining group segmentation results and complete labels to generate an address aggregation report; S6: Model and graph updates, periodically incrementally train the classification model, and update the transaction graph and aggregation results.

6. A method for aggregating blockchain addresses according to claim 5, characterized in that: The address feature extraction process in step S2 includes: S21: Transaction frequency characteristics, which counts the number of transactions an address makes each month and distinguishes between hot wallets, regular wallets, and cold wallets; S22: Interaction address characteristics, statistics on the total number of interaction addresses in the last set number of months, hot wallet interaction address value range, ordinary wallet value range, cold wallet value range; S23: Transaction amount characteristics, calculate the average and maximum amount of a single transaction at the address, the maximum amount range for a single transaction in a cold wallet, the range for a regular wallet, and no fixed range for a hot wallet. S24: Feature standardization, which maps all features to the [-1,1] interval through Z-score standardization to eliminate dimensional differences.

7. A method for aggregating blockchain addresses according to claim 5, characterized in that: The optimization logic of the improved community detection unit includes: S41: Initialize the traversal list, only including the high-confidence label addresses output by the ensemble learning classification module and the addresses that directly interact with it in the initial traversal range; S42: During the traversal, if the address characteristics match a node, the subsequent traversal is blocked, and its associated addresses are no longer expanded; S43: Employs a modularity maximization strategy to divide the remaining nodes into communities and output address groups, reducing the number of traversals by more than 40% compared to the traditional Louvain algorithm.

8. A method for aggregating blockchain addresses according to claim 5, characterized in that, The propagation rules of the tag propagation unit include: S4a: Use the high-confidence label address output by the ensemble learning classification module as the seed node and assign it initial label weights; S4b: Each unlabeled address calculates its own label probability based on the label weights of its neighboring nodes; S4c: Select the label with the highest probability as the completion label for the current address. If the highest probability is less than 60%, mark it as: to be verified, and associate it with the information of its adjacent high-confidence label addresses. S4d: Repeat S4b-S4c until all unlabeled addresses are labeled or the preset number of iterations is reached.

9. A method for aggregating blockchain addresses according to claim 7, characterized in that: The specific implementation process of the improved community detection unit in step S4 includes: S411: Import transaction graphs and preliminary type labels, and select addresses with a confidence level ≥ 80% as core nodes; S412: Construct a list of direct interaction addresses for core nodes to form an initial traversal subset; S413: Perform feature judgment on the addresses in the initial traversal subset. If the address label is a cold wallet and the interaction frequency is within the set range, mark it as a blocked node and do not include it in the subsequent expansion. S414: For non-blocking nodes, use the Louvain algorithm to calculate the modularity, merge communities with improved modularity, until the modularity is maximized; S415: Outputs the final address groups, each group containing core nodes, non-blocking interaction nodes, and related transaction information.

Images