Method of Wasabi mixed currency transaction detection model based on TuGraph and graph neural network
By analyzing the Wasabi wallet source code and combining graph neural networks and TuGraph to construct transaction subgraphs, the random forest model was optimized, solving the problem of insufficient accuracy in Wasabi coin mixing transaction detection and achieving higher recall and accuracy.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- JIANGSU UNIV
- Filing Date
- 2025-12-31
- Publication Date
- 2026-04-10
AI Technical Summary
In existing Wasabi coin mixing transaction detection methods, heuristic detection techniques gradually become ineffective as coin mixing transaction rules are updated and iterated, while traditional machine learning methods cannot effectively capture the influence of neighboring nodes, resulting in insufficient detection accuracy and recall.
By analyzing the Wasabi wallet source code, combining graph neural networks and TuGraph to construct transaction subgraphs, using graph convolutional neural networks for feature learning, optimizing the random forest model, and constructing a Wasabi coin mixing transaction detection model based on TuGraph and graph neural networks.
It improves the recall and accuracy of coin mixing transactions, enabling more effective identification of Wasabi coin mixing transactions and adapting to changes in coin mixing transaction rules.
Smart Images
Figure CN121836732A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application relates to an interdisciplinary technology, in particular to a method of a Wasabi coin mixing transaction detection model based on TuGraph and a graph neural network. BACKGROUND
[0002] Bitcoin originated in 2008, proposed by Satoshi Nakamoto, aiming to achieve direct transactions without intermediaries through decentralized technology. In the early stage of the release of Bitcoin, the daily transaction volume was less than 1000, and the price was only $0.003 in the first public transaction in 2010. With the ICO boom and the influx of retail investors into the market, Bitcoin entered a bull market in 2017, with a 300% increase in transaction volume year-on-year. As of May 2024, Bitcoin has accumulated more than 1 billion transactions. With the development of the Bitcoin market, its drawbacks began to emerge. Although the transaction records of Bitcoin are open, the identity information of the transaction parties is not transparent. Users can complete transactions through anonymous wallet addresses (without real-name authentication), and there is no direct correlation between multiple addresses of the same holder, making it difficult to track the overall picture of the funds. For example, criminals conduct transactions and fund transfers through Bitcoin, using its anonymity to cover illegal sources. In order to effectively combat illegal activities related to Bitcoin transactions, Bitcoin de-anonymization technology has emerged.
[0003] Bitcoin de-anonymization technology is a method system that penetrates the "pseudo-anonymity" cover of Bitcoin through technical means, identifying the real identity or associated entity behind the transaction address. Its core logic is to use the openness and transparency of the blockchain, combined with big data analysis, protocol rule design, and cross-chain tracking technology, to establish a correlation between scattered transaction addresses and real-world identities. Early research on de-anonymization mainly focused on address clustering, with two recognized heuristic address clustering rules: multiple input address clustering: when a transaction's input comes from multiple addresses, these input addresses are likely to belong to the same entity, as users often combine multiple unspent transaction outputs (UTXO) for payment. Change address identification clustering: wallets often return excess change to new addresses after a transaction. If some addresses repeatedly appear as "change-only after immediately spending" patterns in multiple transactions, they may be associated with the main input address. Researchers can use this address clustering rule to weaken the anonymity of Bitcoin transactions to some extent. The development of Bitcoin de-anonymization technology has attracted opposition from some scholars. Gregory Maxwell proposed the CoinJoin protocol, which merges multiple user transactions to confuse the correspondence between inputs and outputs, cutting off the fund flow tracking chain, making address clustering techniques ineffective in tracking coin mixing transactions. Therefore, this research is aimed at the de-anonymization technology of Wasabi coin mixing transactions based on the CoinJoin protocol.
[0004] The current Wasabi coin mixing transaction method is roughly divided into two categories, the first method is a heuristic coin mixing detection technology, which identifies Wasabi transactions by analyzing the principle of coin mixing transactions, the conditions for transaction generation and using heuristic detection technology, the second method is to analyze transaction characteristics, calculate transaction characteristic values, and use traditional machine learning to learn and classify Wasabi transactions. The first detection method is in the update iteration of the coin mixing transaction wallet, and the rules of the coin mixing transaction are also changing, so the heuristic detection technology will gradually lose the ability to identify the Wasabi coin mixing function. The second method can learn the changes of transaction characteristics to a certain extent, but the number of its inherent characteristics also limits the expression of the characteristics of the Wasabi transaction, and the influence of the neighbor node on the classified transaction node is not considered. In order to solve the above problems, first, the program is used to obtain the to-be-identified transaction and the neighbor node, and the subgraph of the to-be-identified transaction is constructed in TuGraph, and the feature learning is carried out by using the graph convolutional neural network, and the experimental results of the method are compared with the existing classification method, and the effectiveness of the method is verified. SUMMARY
[0005] Firstly, by analyzing the Wasabi wallet source code, the new transaction generation conditions and characteristic values are analyzed and sorted out, and the traditional heuristic Wasabi coin mixing detection technology and the random forest model are optimized, compared with the traditional detection coin mixing transaction recall rate and accuracy, which is improved. At the same time, the present application designs a Wasabi coin mixing transaction detection model based on TuGraph and graph neural network, first, the program is used to obtain the to-be-identified transaction and the neighbor node, and the subgraph of the to-be-identified transaction is constructed in TuGraph, and the feature learning is carried out by using the graph convolutional neural network, and the experimental results of the method are compared with the existing detection classification method, and the effectiveness of the method is verified.
[0006] The present application proposes a Wasabi coin mixing transaction detection model based on TuGraph and graph neural network, comprising:
[0007] Step 1, analyze the Wasabi wallet source code, learn the characteristics of the reliable Wasabi coin mixing transaction, and verify the Wasabi coin mixing transaction by using the heuristic coin mixing detection technology;
[0008] Step 2, randomly obtain non-Wasabi coin mixing transactions by using the under-sampling method, so that the sample number of Wasabi coin mixing transactions and non-Wasabi coin mixing transactions is relatively balanced. Then, according to the analyzed transaction characteristics, the sample data set is processed by calculating the characteristic values, and the data set is segmented by using the stratified sampling method, so that each data subset can reflect the class of the original data set. The sample data is trained by using the random forest (Random Forest) model;
[0009] Step 3, use Cypher language to create data nodes and data edges model and complete the construction of data subgraph, use Graph Isomorphism Network (GIN) model to train sample data on the processed subgraph dataset;
[0010] Step 4, use the classification model obtained in steps 2 and 3 on the test dataset to obtain the prediction results and evaluate the importance of features and the classification performance of the model.
[0011] In the first aspect, the specific steps of step 1 are as follows:
[0012] Step 1.1, download Wasabi wallet source code (versions from v0.7.2 to v1.1.10) from github.com website, open it with PyCharm tool, read platform program, and understand the design intention of platform developers;
[0013] Step 1.2, analyze and explore the characteristics of Wasabi mixing transactions, and find that the mixing transaction needs to meet new conditions: the address type of transaction input needs to be SegWit type, all transaction output amounts are greater than 0.0001BTC or 1% standardized transaction output amount, and at least one transaction amount is repeated more than twice in the output;
[0014] Step 1.3, since the core of Wasabi mixing is to realize the privacy enhancement of Bitcoin transaction through CoinJoin technology, platform service providers will not easily provide real mixing transactions, so it is necessary to verify the reliability of the obtained Wasabi mixing transactions. Use idea tool to write new heuristic mixing detection code, then detect the mixing transactions, get recall rate of 98.94%, and ensure that the training data of subsequent model is reliable.
[0015] In the second aspect, the specific process of the random forest model training includes:
[0016] Step 2.1, use undersampling method to randomly extract a certain number of non-Wasabi transactions every day from July 19, 2018 to December 21, 2021, and obtain 29908 non-Wasabi mixing transactions. By reducing the number of majority class samples, the positive and negative class sample ratio tends to be balanced, thereby improving the recognition ability of the model for minority classes;
[0017] Step 2.2, the number of cluster addresses of each transaction output address is calculated as a feature value using the multi-input address clustering method, and the principle is that the transaction output based on the CoinJoin protocol should not belong to a larger address cluster. The transaction feature values are calculated: the number of unique output values, the ratio of the number of inputs to the number of outputs, the minimum output value, the range of output values (i.e. the difference between the maximum and minimum values), the average number of decimal places of the output value (BTC units), the number of input addresses reused as output addresses in the same transaction, the uniqueness of transaction input addresses, the number of transaction input addresses that are native segregated witness addresses, the average size of the output address cluster, and the number of the largest number of output addresses with the same amount, wherein the feature value is converted to dollars with respect to the unit of the amount.
[0018] Step 2.3, the first N columns of the data are read as training samples and stored in the X list, and the data in the N+1 column is the label of the data and stored in the y list. The data set is randomly divided in proportion (80% training, 20% testing) using stratified random sampling method. A random forest model with 100 classification trees is created through cross-validation. The training set x_train [x1, x2,..., x 10 ] is trained. The purity improvement formula for evaluating node splitting is:
[0019] (Gini impurity);
[0020] (information gain);
[0021] where represents the current data set, represents the total number of classes in the data set , represents the proportion of samples belonging to the th class in the data set, represents the left subset of the data set after splitting by a certain feature, represents the right subset of the data set after splitting by a certain feature.
[0022] Step 3.1, use the Java client to connect to TuGraph, and use Cypher to create a subgraph model of the transaction to be classified containing three point types (input address associated transactions, transactions to be classified, output address associated transactions) and two edge types (input address associated edges, output address associated edges);
[0023] Step 3.2, according to the different number of output, input address of each transaction, make an integration scheme, make feature extraction processing to multiple outputs of each transaction, get the minimum amount, the maximum amount, the average amount, the most output amount value and the corresponding number of times, and the input of each transaction is the same. The transaction original data and the calculated feature values are attached to the point type as node attributes, and the transaction input and output amount values are attached to the edge type as weight attributes. Use the data import function of TuGraph to import all transaction data into the TuGraph subgraph model;
[0024] Step 3.3, first, the node features are upgraded from 17 dimensions to 32 dimensions to provide a larger "representation space" for the model, so that the node can encode more semantic information. At the same time, generate a three-layer convolution combined with neighborhood aggregation and multilayer perception, use mean pooling and maximum pooling in each layer output to enhance the expression ability of graph structure features. Thus, create a graph neural network GIN model to train and learn the data set.
[0025] In the fourth aspect, the specific steps of the above step 4 are as follows:
[0026] Step 4.1, according to the random forest model obtained in step 2, the transaction classification of the test sample set is carried out, and according to the prediction result, the importance of the feature and the classification performance of the model are obtained;
[0027] Step 4.2, according to the graph neural network model obtained in step 3, the transaction classification of the test sample set is carried out, and according to the prediction result, the classification performance of the model is obtained, and the random forest model is compared and analyzed.
[0028] Compared with the prior art, the present application has the beneficial effects:
[0029] 1. First, by analyzing the Wasabi wallet source code, new transaction generation conditions and feature values are analyzed and sorted out, and the traditional heuristic Wasabi coin mixing detection technology and the random forest model are optimized, and compared with the traditional detection of coin mixing transaction recall rate and accuracy.
[0030] 2. At the same time, the present application designs a Wasabi coin mixing transaction detection model based on TuGraph and graph neural network, first uses the program to obtain the to-be-recognized transaction and the neighbor node, constructs a subgraph of the to-be-recognized transaction in TuGraph, and uses a graph convolutional neural network to learn features. Compared the experimental results of the present method with the existing classification methods, the effectiveness of the present method is verified. BRIEF DESCRIPTION OF DRAWINGS
[0031] Figure 1 It is a general flowchart of a Wasabi coin mixing transaction detection method based on TuGraph and graph neural network.
[0032] Figure 2 Figure is a detailed flow chart of a Wasabi coin mixing transaction detection method based on TuGraph and a graph neural network.
[0033] Figure 3 Figure is a typical transaction subgraph generated by the data sample used in the experimental section of the application, (a) is Wasabi, and (b) is non-Wasabi.
[0034] Figure 4 Figure is the ranking of feature value importance after the random forest model learns, predicts and classifies the data set. Feature 1 represents the number of the largest number of transaction outputs, feature 2 represents the number of unique output values, feature 3 represents that the transaction input address is a native isolated witness address, feature 4 represents the range of output values (i.e. the difference between the maximum and minimum values), feature 5 represents the average number of decimal places of the output value (BTC unit), feature 6 represents the ratio of the number of inputs to the number of outputs, feature 7 represents the minimum output value, feature 8 represents the average size of the transaction output address cluster, feature 9 represents the number of input addresses reused as output addresses in the same transaction, and feature 10 represents the uniqueness of the transaction input address. DETAILED DESCRIPTION
[0035] The application will be further described below in conjunction with the drawings and implementation examples, and it should be pointed out that the described implementation examples are only intended to facilitate the understanding of the application and do not limit it in any way.
[0036] The application aims to solve the problem that the transaction structure features and the new features generated by the coin mixing in the update iteration are ignored during feature extraction when building a coin mixing detection model for Wasabi coin mixing detection. A method of constructing a transaction subgraph based on TuGraph is proposed to establish a better detection model for Wasabi coin mixing transaction detection, and a large number of experiments have proved the feasibility and efficiency of the method.
[0037] As shown in Figure 1 A Wasabi coin mixing transaction detection based on TuGraph and a graph neural network according to the application comprises:
[0038] Step 201 downloads the Wasabi wallet source code (versions from v0.7.2 to v1.1.10) from github.com, reads the platform program, understands the original intention of the platform developer, analyzes and explores the new features of Wasabi coin mixing transaction, integrates the new features into the heuristic coin mixing detection technology published by the platform developer, uses idea to write new heuristic coin mixing detection code, and then detects the coin mixing transaction.
[0039] The purpose of the embodiment of the present application is to detect the heuristic coin mixing transaction. The core of Wasabi coin mixing is to realize the privacy enhancement of Bitcoin transaction through CoinJoin technology, mix multiple user Bitcoin transactions together, and redistribute them to new addresses. This process breaks the direct association between the input address (sender) and the output address (recipient), making it difficult for external observers to track the flow of funds. Platform service providers will not easily provide sample data of real Wasabi coin mixing transactions, so the new heuristic detection technology generated based on the new characteristics of the Wasabi coin mixing transaction discovered and the heuristic detection technology published by the platform developer is used to verify the reliability of the obtained Wasabi coin mixing transaction, and to ensure that the subsequent model obtains reliable data.
[0040] Step 2011 uses PyCharm tool to read platform source code, analyzes the characteristics of Wasabi coin mixing transaction, and finds new conditions that need to be met for this coin mixing transaction compared to previous ones.
[0041] The analysis of the new transaction characteristics includes: obtaining the source code of multiple versions of the platform, understanding the design ideas of the platform developer, summarizing the conditions that need to be met for the generation of this coin mixing transaction, comparing with previous ones, and discovering new transaction characteristics: the address type of the transaction input needs to be SegWit type, the transaction output amount is greater than 0.0001BTC or 1% standardized transaction output amount, and at least one transaction amount is repeated more than twice in the output.
[0042] Step 2012 uses the heuristic detection technology of new characteristics to verify the reliability of the obtained Wasabi coin mixing transaction.
[0043] The specific process of heuristic detection includes: combining the characteristics involved in the heuristic detection technology published by the platform developer: the transaction contains at least one Wasabi fixed address (Wasabi coin mixing was released in the early stage, and the coordination fee of the transaction is fed back to the platform developer in the form of a fixed address), the number of transaction inputs is greater than or equal to the number of standardized transaction output amounts of the output amount, the standardized transaction output amount is in the amount interval (0.1-0.02, 0.1+0.02) BTC, and the new discovered coin mixing transaction characteristics, use idea to write new heuristic coin mixing transaction detection code to detect the obtained Wasabi transaction, the recall rate of the new heuristic detection coin mixing technology reaches 98.94%, which is 0.24% higher than that of the previous detection technology, and through the appeal operation, it can be known that the obtained Wasabi coin mixing transaction is reliable.
[0044] The under-sampling method is used to randomly obtain non-Wasabi coin mixing transactions, so that the number of Wasabi coin mixing transactions and non-Wasabi coin mixing transactions is relatively balanced. Then, according to the analyzed transaction characteristics, the feature value calculation and processing of the sample data set are carried out, and the stratified sampling segmentation method is used for data set segmentation, so as to ensure that each data subset can reflect the categories of the original data set. The random forest model is used to train the sample data
[0045] Step 202, use the under-sampling method to randomly obtain non-Wasabi coin mixing transactions, and use the stratified sampling method for data set segmentation. The steps of training the sample data by using the random forest model are as follows:
[0046] Step 2021, use the under-sampling method to randomly extract a certain number of non-Wasabi transactions every day from July 19, 2018 to December 21, 2021, and obtain 29908 non-Wasabi transactions in total. By reducing the number of majority class samples, the positive and negative class sample ratio tends to be balanced, thereby improving the recognition ability of the model for the minority class. The number of clustered addresses of each transaction output address is calculated as a feature value by using the multi-input address clustering method. The principle is that the transaction output based on the CoinJoin protocol should not belong to a larger address cluster. The transaction feature values are calculated: the number of unique output values, the ratio of the number of inputs to the number of outputs, the minimum output value, the range of output values (i.e. the difference between the maximum value and the minimum value), the average number of decimal places of the output value (BTC unit), the number of input addresses reused as output addresses in the same transaction, the uniqueness of transaction input addresses, the number of transaction input addresses that are SegWit addresses, the average size of the output address cluster, the number of the largest number of output amounts, and the number of the largest number of output amounts, wherein the feature value is replaced by the unit of dollars.
[0047] Step 2022, read the first N columns of data as training samples and store them in the X list, and the data in the N+1 column is the label of the data and is stored in the y list. The data set is randomly divided in proportion (80% training, 20% testing) by using stratified random sampling method. A random forest model with 100 classification trees is created by cross-validation, and the training set x_train [x1, x2,..., x 10 ] is trained. The purity improvement formula for evaluating node splitting is:
[0048] (Gini impurity);
[0049] (Information gain);
[0050] Wherein represents the current data set, represents the data set the total number of classes in the data set, the proportion of the data set belonging to the first the proportion of the data set belonging to the first the left subset of the data set split by a certain feature, the right subset of the data set split by a certain feature.
[0051] Step 203, using Cypher to create a model of data nodes and data edges and complete the construction of a data subgraph, and using a graph neural network GIN model to train the sample data of the processed subgraph data set as follows:
[0052] Step 2031, using a Java client to complete the connection to TuGraph, and using Cypher to create a subgraph model of the transaction to be classified containing three point types (associated transactions of input addresses, transactions to be classified, and associated transactions of output addresses) and two edge types (edges associated with input addresses and edges associated with output addresses). According to the different number of output and input addresses of each transaction, an integration scheme is made, the multiple outputs of each transaction are processed for feature extraction, the minimum amount, maximum amount, average amount, maximum output amount value and corresponding number of times are obtained, and the inputs of each transaction are processed in the same way. The transaction original data and the calculated feature values are attached to the point type as node attributes, and the transaction input and output amount values are attached to the edge type as weight attributes. Using the data import function of TuGraph, all transaction data is imported into the TuGraph subgraph model.
[0053] Step 2032, first, the node features are upgraded from 17 dimensions to 32 dimensions to provide a larger "representation space" for the model and enable the node to encode more rich semantic information. At the same time, a three-layer convolution combining neighborhood aggregation and multilayer perception is generated, and the mean pooling and maximum pooling are used for each layer output to enhance the expression ability of the graph structure features. Thus, a graph neural network GIN model is created to train and learn the data set.
[0054] Step 204, according to the classification model obtained in steps 2 and 3, taking a test sample set to classify the data, and according to the prediction result, evaluating the prediction performance of the model as follows:
[0055] Step 2041, using the random forest model obtained in step 2 to classify the test sample set, and according to the prediction result, obtaining the importance of the features and the classification performance of the model;
[0056] Step 2042, using the graph neural network model obtained in step 3 to classify the test sample set, and according to the prediction result, obtaining the classification performance of the model and comparing and analyzing it with the random forest model.
[0057] The present application mainly aims at the problem that the transaction feature extraction is not comprehensive enough. We combine the node to be classified and its neighbor nodes in TuGraph to construct a subgraph, so that the graph neural network can more systematically and comprehensively obtain the features of the transaction to be classified. Figure 3 A typical coin mixing subgraph constructed in the experiment is shown.
[0058] Figure 4 The importance of the feature values is sorted after the random forest model learns and predicts the classification of the data set. Among them, the number of transactions with the same output amount and the number of unique output values are significantly represented in the feature importance.
[0059] As can be seen from Table 1, the traditional heuristic coin mixing detection technology and the random forest model are optimized, and compared with the traditional detection coin mixing transaction recall rate and accuracy, the accuracy is improved. The graph neural network model proposed in the present application can obtain a relatively accurate Wasabi coin mixing detection effect, which is due to the fact that the algorithm fully considers the structural relationship between the transaction nodes. Although the current accuracy is slightly lower than that of the random forest model, with the update and iteration of the coin mixing technology, the two traditional technologies cannot obtain the transaction features more comprehensively, and the effect of detecting the coin mixing will gradually decrease, and the effect of detecting the coin mixing by the graph neural network model will gradually increase. Therefore, the method proposed in the present application can effectively classify the Wasabi coin mixing transaction.
[0060] Table 1 shows the accuracy, false positive rate and false negative rate of the sample classification experiment using different schemes:
[0061] .
Claims
1. A method of a Wasabi coin mixing transaction detection model based on TuGraph and a graph neural network, characterized in that, Includes the following steps: Step 1: Analyze the Wasabi wallet source code to learn the characteristics of reliable Wasabi coin mixing transactions, and use heuristic coin mixing detection technology to verify Wasabi coin mixing transactions. Step 2: Use undersampling to randomly obtain non-Wasabi mixing transactions to balance the number of Wasabi mixing transactions and non-Wasabi mixing transactions. Then, perform feature value calculation on the sample dataset based on the analyzed transaction characteristics. Use stratified sampling to split the dataset to ensure that each data subset can reflect the category of the original dataset. Use the Random Forest model to train the sample data. Step 3: Use Cypher language to create models of data nodes and data edges and complete the construction of data subgraphs. Use the Graph Isomorphism Network model to train sample data on the processed subgraph dataset. Step 4: The classification models obtained in steps 2 and 3 are applied to the test dataset to obtain prediction results, thereby evaluating the importance of features and the classification performance of the model.
2. A method according to claim 1, characterized in that The specific implementation of step 1 includes the following steps: Step 1.1: Download the Wasabi wallet source code from github.com, open it with PyCharm, read the platform program, and understand the platform developers' design intentions. Step 1.2: Analyze and discover the characteristics of Wasabi coin mixing transactions. Compared with the previous discovery, new conditions need to be met for this coin mixing transaction: the address type of the transaction input must be SegWit, all amounts of the transaction output are greater than 0.0001 BTC or 1% of the normalized transaction output amount, and at least one transaction amount is repeated more than or equal to twice in the output. Step 1.3: Summarize and analyze the heuristic coin mixing detection technology released by the platform developers, incorporate the newly discovered coin mixing transaction conditions, use the IntelliJ IDEA tool to write new heuristic coin mixing detection code, and then detect coin mixing transactions to ensure that the training data for subsequent models is reliable.
3. The method of claim 1, wherein, The specific implementation of step 2 includes the following steps: Step 2.1: Using the undersampling method, a certain number of non-Wasabi transactions are randomly selected each day within a certain period of time, and a total of several non-Wasabi coin mixing transactions are obtained. By reducing the number of majority class samples, the ratio of positive and negative class samples tends to be balanced, thereby improving the model's ability to identify the minority class. Step 2.2, the number of clustered addresses of each transaction output address is calculated as a feature value using the multi-input address clustering method, and the principle is that the transaction output based on the CoinJoin protocol should not belong to a larger address cluster. The transaction feature values are calculated: the number of unique output values, the ratio of the number of inputs to the number of outputs, the minimum output value, the range of output values, the average number of decimal places of output values, the number of input addresses reused as output addresses in the same transaction, the uniqueness of transaction input addresses, the transaction input address as a native segregated witness address, the average size of the output address cluster, and the number of output amounts. The feature values are converted to dollars based on the unit of the amount; the range of output values is the difference between the maximum and minimum values, and the unit of the output value is BTC; Step 2.3, read the first N columns of the data as training samples into the X list, and the data in the N+1 column is the label of the data into the y list, use stratified random sampling method to randomly divide the data set in proportion, create a random forest model with 100 classification trees through cross-validation, train the training set x_train [x1, x2,..., x 10 ] to evaluate the purity improvement formula of node splitting: ； ； wherein, Gini impurity, information gain, denotes the current data set, denotes the data set total number of classes in, denotes the proportion of samples in the data set belonging to the class, denotes the left subset of the data set split by a certain feature, denotes the right subset of the data set split by a certain feature.
4. The method of claim 1, wherein, The specific implementation of the step 3 includes the following steps: Step 3.1, use the Java client to connect to TuGraph, and use Cypher to create a subgraph model containing three point types: input address associated transactions, transactions to be classified, and output address associated transactions, and two edge types: the subgraph model of the transaction to be classified. The two edge types are input address associated edges and output address associated edges. Step 3.2, for different numbers of output and input addresses of each transaction, make an integration plan, extract features from multiple outputs of each transaction to get the minimum amount, maximum amount, average amount, most output amount, and corresponding number of times. The input of each transaction is the same. Attach the original transaction data and the calculated feature values to the point type as node attributes, and attach the transaction input and output amount to the edge type as weight attributes. Use the data import function of TuGraph to import all transaction data into the TuGraph subgraph model. Step 3.3, first, upgrade the node features from 17 dimensions to 32 dimensions to provide a larger "representation space" for the model, allowing the node to encode more semantic information. At the same time, generate a three-layer convolution combined with neighborhood aggregation and multilayer perception, use mean pooling and maximum pooling for each layer output to enhance the expression ability of the graph structure features, and create a graph neural network GIN model to train and learn the data set.
5. The method of claim 1, wherein, The specific implementation of the step 4 includes the following steps: Step 4.1, use the random forest model obtained in step 2 to classify the test sample set, and according to the prediction results, obtain the importance of the features and the classification performance of the model; Step 4.2, use the graph neural network model obtained in step 3 to classify the test sample set, and according to the prediction results, obtain the classification performance of the model, and compare and analyze it with the random forest model.