A cross-chain transaction data anomaly detection method based on graph structure perception and gradient guided perturbation

Abstract

The present application relates to the technical field of data anomaly detection, and in particular to a cross-chain transaction data anomaly detection method based on graph structure perception and gradient guided perturbation. The method comprises edge condition semantic feature coding based on cross-chain execution graph, including heterogeneous edge feature injection and message modulation, edge condition local neighborhood aggregation and state update; structure integrity detection and missing dependency inference based on coded features, including structure perturbation and key edge search based on projected gradient descent, adversarial missing set discovery and structure pseudo-label construction, parameterized relationship context and structure anomaly inference network construction; by introducing a structure perturbation detection mechanism based on projected gradient descent (PGD), key missing dependencies sensitive to decision boundaries are simulated and mined in continuous space, and the logical bypass behavior implemented by the attacker through the missing verification step is accurately captured.

Description

Technical Field

[0001] This invention relates to the field of data anomaly detection technology, and in particular to a cross-chain transaction data anomaly detection method based on graph structure perception and gradient-guided perturbation. Background Technology

[0002] Blockchain technology enables decentralized applications to operate without trusted intermediaries and has been widely adopted in financial systems due to its transparency and immutability. As blockchain platforms with heterogeneous execution environments develop independently, cross-chain bridges have become essential infrastructure for transferring assets and information across different blockchains. A typical cross-chain operation typically involves three phases. First, the source chain locks user assets and issues an event. Second, an off-chain verification mechanism captures and verifies the legitimacy of the transaction. Finally, the target chain executes the corresponding asset release or minting operation upon receiving the verified message. While this establishes basic connectivity, this workflow heavily relies on strict sequential dependencies to ensure security.

[0003] This complex cross-chain execution logic introduces significant security risks. Throughout the history of decentralized finance, many of the most destructive exploits have been related to cross-chain bridges. Typical cross-chain transactions involve multiple verification steps, including message verification, signature checks, and enforcement of state consistency. Previous research has shown that a large proportion of exploits specifically target cross-chain business logic. In these scenarios, attackers deliberately bypass critical verification mechanisms typically required in benign workflows. Therefore, the resulting execution graph may appear semantically plausible, but it is structurally incomplete due to a lack of verification-related dependencies.

[0004] To mitigate cross-chain security risks, early research primarily relied on heuristics, invariant checks, and formal verification to enforce cross-chain state consistency and prevent asset loss. For example, some existing tools depend on predefined security patterns and strict deposit and withdrawal pairing to identify anomalies. However, these methods struggle to identify vulnerabilities that bypass logic. Their sensitivity decreases significantly when attackers deliberately decouple their attack from the source chain to exploit the asynchronous nature of cross-chain operations, effectively invalidating state transition assumptions without violating pre-defined invariants. As attacks become increasingly sophisticated, recent research has shifted towards data-driven detection methods. Some deep learning frameworks transform transaction logs into image-like representations or linearized sequences of emitted events. This sequence modeling approach often fails to fully capture the complex non-Euclidean topological dependencies that define cross-chain logic, inevitably leading to a loss of structural context during the coding phase and difficulty in capturing distributed state operations across disjoint contracts.

[0005] Recently, modeling transactions as execution graphs has proven effective in capturing complex interactions between contracts, accounts, and assets. These graph-based methods typically classify anomalies by learning patterns that distinguish between malicious and benign transactions. However, while effective, existing methods primarily focus on explicitly present execution behaviors within transactions. Crucially, they implicitly assume the structural integrity of the execution graph and treat missing edges merely as a lack of interaction, rather than intentional omissions. When attackers bypass verification logic without introducing anomalous actions, the observed execution graph may still resemble a benign transaction. Furthermore, attackers may obfuscate their footprint by hiding cross-chain traces, leading to structural sparsity in the graph. This sparsity undermines the stability of static motif patterns in graph-based models, posing a significant obstacle to traditional anomaly detection. Without explicitly modeling this integrity, behavior-based detection methods struggle to differentiate these covert attacks from legitimate transactions.

[0006] Furthermore, standard graph neural network models typically treat edges merely as scalar weights used for connectivity metrics or normalization, which is theoretically insufficient to capture fine-grained execution logic. Malicious intent is often encoded in specific execution parameters, rather than simply identity. This theoretical deficiency makes standard graph models highly vulnerable to semantic spoofing attacks, where attackers mimic the topology of legitimate users while executing illegitimate flows. If high-dimensional edge attributes such as function selectors and dynamic transaction fees cannot be directly integrated into the messaging protocol, the system struggles to distinguish between benign operations with isomorphic topologies but drastically different execution semantics and spoofing attacks.

[0007] In summary, existing cross-chain anomaly detection technologies urgently need a novel graph data mining framework that can explicitly assess execution integrity, jointly model execution behavior and dependency structure, and effectively resist structure avoidance and semantic masquerading. Summary of the Invention

[0008] To address the shortcomings of implicit topological integrity assumptions, lack of fine-grained execution logic representation, and imbalance in heterogeneous feature fusion in current cross-chain transaction anomaly detection methods, this invention provides a cross-chain transaction data anomaly detection method based on graph structure perception and gradient-guided perturbation.

[0009] Firstly, the present invention provides a method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation, which adopts the following technical solution:

[0010] A method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation includes:

[0011] Obtain cross-chain transaction data;

[0012] Based on the acquired cross-chain transaction data, cross-chain execution graph construction and feature initialization are performed, including cross-chain transaction topology construction and high-dimensional heterogeneous edge attribute feature encoding;

[0013] Edge condition semantic feature encoding is performed based on cross-chain execution graph, including heterogeneous edge feature injection and message modulation, edge condition local neighborhood aggregation and state update;

[0014] Structural integrity detection and missing dependency inference based on encoded features include structural perturbation and key edge search based on projective gradient descent, adversarial omission set discovery and structural pseudo-label construction, and parameterized relational context and structural anomaly inference network construction.

[0015] Adaptive gating fusion and joint optimization decision-making based on inference results include aligning scalar structure risk scores with semantic feature distributions, adaptive gating mechanisms with dynamic feature weighted fusion, multi-objective joint optimization, and cross-chain anomaly classification decision-making.

[0016] Secondly, a cross-chain transaction data anomaly detection system based on graph structure awareness and gradient-guided perturbation includes:

[0017] The data acquisition module is configured to acquire cross-chain transaction data;

[0018] The initialization module is configured to construct and initialize the cross-chain execution graph based on the acquired cross-chain transaction data, including cross-chain transaction topology construction and high-dimensional heterogeneous edge attribute feature encoding.

[0019] The feature encoding module is configured to perform edge condition semantic feature encoding based on the cross-chain execution graph, including heterogeneous edge feature injection and message modulation, edge condition local neighborhood aggregation and state update;

[0020] The inference module is configured to perform structural integrity detection and missing dependency inference based on encoded features, including structural perturbation and key edge search based on projective gradient descent, adversarial omission set discovery and structural pseudo-label construction, and parameterized relational context and structural anomaly inference network construction.

[0021] The decision module is configured to perform adaptive gating fusion and joint optimization decisions based on the inference results, including aligning scalar structure risk scores with semantic feature distributions, fusion of adaptive gating mechanisms with dynamic feature weighting, multi-objective joint optimization, and cross-chain anomaly classification decisions.

[0022] Thirdly, the present invention provides a computer-readable storage medium storing a plurality of instructions adapted for loading and execution by a processor of a terminal device of the method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation.

[0023] Fourthly, the present invention provides a terminal device, including a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, the instructions being adapted to be loaded and executed by the processor as described in the "Cross-chain Transaction Data Anomaly Detection Method Based on Graph Structure Awareness and Gradient-Guided Perturbation".

[0024] In summary, the present invention has the following beneficial technical effects:

[0025] Compared to existing cross-chain fraud detection methods, which suffer from technical bottlenecks such as insufficient semantic extraction of heterogeneous execution, difficulty in detecting structure evasion attacks, rigid weights in multi-view feature fusion, and huge inference overhead under large-scale real-time monitoring, this invention addresses the intelligent diagnostic needs of "cross-chain bridge security defense and malicious behavior monitoring" by constructing a cross-chain execution graph anomaly monitoring system based on adversarial enhanced edge detection and structure inference.

[0026] First, by constructing a deep semantic encoding path of "topology structure + high-dimensional heterogeneous edge attributes," the system solves the semantic alignment problem between unstructured logs and graph topology in cross-chain transactions, effectively integrating core execution logic such as asset value, transaction fee price, and function signature, significantly enhancing the system's recognition depth against semantic spoofing attacks. Second, by introducing a structure perturbation detection mechanism based on projective gradient descent (PGD), the system simulates and mines key missing dependencies sensitive to decision boundaries in a continuous space, accurately capturing logical bypassing behaviors implemented by attackers through omitted verification steps. Furthermore, by fusing a parameterized structure inference network with an adaptive gating module, the high cost of adversarial search is transformed into efficient single forward inference, dynamically balancing the contribution weights of semantic evidence and structural risk evidence, achieving real-time perception and recognition of latent structure evasion attacks. Finally, through a multi-objective joint optimization strategy, the system simultaneously improves classification decision accuracy and structural consistency constraints, enhancing the robustness of diagnostic results in scenarios with extremely unbalanced asset distribution.

[0027] In typical cross-chain bridge malicious transaction monitoring tasks, the method of this invention, under the challenging environment of adversarial structural perturbations, improves the F1 score of cross-chain anomaly detection to 92.75%; the precision remains stable above 95.1%; the recall rate is significantly improved from less than 70% in traditional graph learning methods to 90.4%; the AUC-PR (area under the PR curve) reaches 94.8%; and the average inference time per transaction is only 4.2 seconds, which is superior to iterative adversarial search models and simple multimodal feature splicing models. This invention possesses excellent detection accuracy, time response efficiency, and structural robustness, significantly enhancing the system's early warning capabilities against risks such as early malicious asset transfers, verification logic bypass, and cross-chain reentrancy attacks. It demonstrates strong practical deployment value and engineering promotion potential in the fields of distributed ledger security auditing and real-time risk control of cross-chain bridges. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of a cross-chain transaction data anomaly detection method based on graph structure perception and gradient-guided perturbation according to Embodiment 1 of the present invention;

[0029] Figure 2 This is a performance comparison chart of different methods in the cross-chain fraud detection task according to Embodiment 1 of the present invention;

[0030] Figure 3 This is a comparison chart of the inference time of different methods in Embodiment 1 of the present invention;

[0031] Figure 4 The different methods in Embodiment 1 of this invention are mostly compared using radar charts for cross-chain fraud detection tasks;

[0032] Figure 5 This is a framework diagram of cross-chain transaction data mining and anomaly detection according to Embodiment 1 of the present invention. Detailed Implementation

[0033] The present invention will be further described in detail below with reference to the accompanying drawings.

[0034] Example 1

[0035] Reference Figure 1 This embodiment of a method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation includes:

[0036] (1) Cross-chain execution graph construction and feature initialization module

[0037] 1) Construction of cross-chain transaction topology

[0038] In cross-chain bridge security monitoring, transaction execution trajectories are the most intuitive representation of business logic. The continuous interaction between external accounts and smart contracts on the source and target chains reflects core operations such as asset locking, message passing, verification, and release. However, these cross-chain interactions often exhibit high asynchronicity, cross-platform heterogeneity, and extremely high concurrency. Furthermore, the large amount of unstructured underlying call information and redundant routine transfer records contained in the original transaction logs can interfere with the extraction of core execution logic if processed in isolation. Therefore, a robust topology construction path must be designed to systematically preserve the dependencies and high-frequency interaction characteristics of cross-chain business entities.

[0039] To achieve effective encoding of unstructured transaction logs, this module uses a directed attribute multigraph as the core topology carrier. The basic idea is to extract verified transaction traces and establish fine-grained directed connections between participating entities, thereby extracting the actual cross-chain operation flow from the original ledger.

[0040] The input cross-chain transaction graph is formalized as follows:

[0041] ,

[0042] Among them, the node set The unique entities involved in the transaction include externally owned accounts and smart contracts; initial feature matrix Includes the node's initial semantic properties.

[0043] For the edge set To capture frequent transaction dynamics, a multi-graph structure is used to preserve parallel edges:

[0044] ,

[0045] in, This is the original cross-chain transaction log collection; Represents the first element in the set. One transaction event; To extract the operation functions of the entity that initiated the transaction; Operation functions for extracting the transaction recipient entity; The transaction initiating node extracted through the initiator function; The transaction receiving node is extracted through the receiver function; Represents a node With nodes Between the first Secondary interactive connections. This collection As a static representation of cross-chain topology, it does not compress any interaction details and captures repeated high-frequency transaction patterns between entities, which is the structural basis for discovering potential money laundering and repeated reentrancy attacks.

[0046] 2) High-dimensional heterogeneous edge attribute feature encoding

[0047] Since topology only provides connectivity information between entities, and malicious intent in cross-chain attacks is often subtly encoded in specific execution parameters, it is a crucial component in determining transaction legitimacy. Traditional graph modeling often treats edges as scalar weights, failing to express complex cross-chain call logic. Cross-chain logs, however, contain heterogeneous variables such as transaction amounts, transaction fees, and function signatures, providing vital evidence of smart contract execution intent. To avoid feature space shifts caused by high-dimensional heterogeneous data, composite attribute vectors must be extracted.

[0048] Specifically, for each transaction event, its high-dimensional attribute features are extracted:

[0049] ,

[0050] in, , and They represent the first The asset value, transaction fee parameters, and function signature variables for this transaction event; It is a numerical normalization function used to eliminate scale differences in large assets; This is a one-hot encoded mapping used to handle discrete function selectors; This represents the concatenation operation of feature vectors; A learnable linear projection matrix used to map the concatenated underlying heterogeneous attributes to a unified dimension. In the latent feature space; The high-dimensional heterogeneous edge attribute features constructed mainly encode the specific transaction execution logic and parameter semantics, and their role is to provide a priori signals as to whether the interaction contains maliciously disguised parameters.

[0051] The full graph edge attribute feature space formed by all edge feature vectors , and cross-chain topology Together, they completed the full graph structure transformation of unstructured cross-chain logs. The topological and attribute features output from these two steps will be input into the downstream edge conditional semantic feature encoding module, serving as the core message modulator in the message passing process of the graph neural network, and used to construct a deep cross-chain execution graph resistant to semantic masquerading.

[0052] (2) Edge condition semantic feature encoding module

[0053] 1) Heterogeneous edge feature injection and message modulation

[0054] In cross-chain transaction graph neural network modeling tasks, the effective transmission of node features is crucial for capturing global business logic. The evolving interaction state between cross-chain smart contracts and external accounts reflects the specific execution stages of the cross-chain bridge workflow. However, traditional models typically treat edges merely as scalar weights used for neighborhood aggregation and normalization, completely missing the fine-grained business logic hidden in high-dimensional execution parameters such as function calls, making them highly vulnerable to semantic spoofing attacks. Therefore, a feature injection process must be designed to elevate edge attributes to the core message modulator. The specific implementation process is as follows.

[0055] Since the initial semantic features of the nodes and the edge attribute features extracted in the first step are in different feature spaces and have different dimensions, a learnable projection weight matrix and bias vector are first used to perform a linear transformation on the extracted edge attribute features to achieve dimensional alignment of the heterogeneous feature spaces. The formula for this projection alignment process is as follows:

[0056] ,

[0057] in, This represents the edge attribute feature vector after dimension alignment; For the first The learnable projective weight matrix of the layer; This represents the high-dimensional explicit edge feature vector extracted in Module 1; This is the corresponding projection bias vector.

[0058] Subsequently, the transformed edge feature vector is directly injected into the semantic feature vector of the transaction initiator's source node by element-wise addition, achieving physical coupling between the node's identity state and the cross-chain execution logic. The formula for this feature coupling process is as follows:

[0059] ,

[0060] in, This represents the intermediate feature vector after the source node state and edge execution logic are coupled; This indicates that the source node $u$ is at the th... Semantic feature representation of the layer.

[0061] Next, the coupled intermediate feature vector is input into a linear rectified activation function for nonlinear transformation, ultimately generating a modulated message containing a specific transaction semantic imprint. The formula for this nonlinear modulation process is as follows:

[0062] ,

[0063] in, Indicates the first From source node in layered network Transmitted to the target node The final modulated message feature vector; It is a linear rectification activation function.

[0064] The three consecutive steps described above together complete the computational path for transforming the original heterogeneous edge attributes into the core modulation message of the graph neural network, forming the basis for identifying malicious execution parameters.

[0065] 2) Edge-condition local neighborhood aggregation and state update

[0066] After generating the modulation message, the target node needs to aggregate interaction information from all its neighbors to update its own state. Simple mean-pooling operations can easily lead to over-smoothing of features, failing to capture distributed state operations across disjoint contracts. Furthermore, over-aggregation in deep graph networks can cause nodes to lose their initial identity information. Therefore, the following multi-stage local neighborhood aggregation and feature calibration process is constructed.

[0067] First, local neighborhood interaction context aggregation is performed. For each target node in the graph, the modulation message feature vectors pointing to that target node from first-order local neighbor nodes are collected and accumulated, summarizing the cross-chain interaction context. The formula for this aggregation process is as follows:

[0068] ,

[0069] in, Represents the target node In the The local neighborhood context vector obtained by layer aggregation; Represents the target node The set of all first-order local neighbors; accumulation symbol This indicates that the summation operation is performed on all message vectors within the set; Indicates from the source node Transmitted to the target node The modulated message feature vector.

[0070] Next, the first layer of latent vector space mapping is performed. The aggregated context vector is input into the first layer of the multilayer perceptron network, and low-order local neighborhood structure and semantic mixture features are extracted through linear transformation and activation function. The formula for this mapping process is as follows:

[0071] ,

[0072] in, This represents the hidden layer feature vector after extraction from the first layer; This represents the learnable weight matrix of the first layer in a multilayer perceptron. This is the bias vector corresponding to the first layer; It is a linear rectification activation function.

[0073] Subsequently, a second layer of deep, high-order feature extraction is performed. The aforementioned hidden layer feature vectors are then fed into the second layer of the multilayer perceptron for further mapping to obtain higher-order global perceptual features. The formula for this high-order extraction process is as follows:

[0074] ,

[0075] in, This represents the deep hybrid feature vector extracted by the complete multilayer perceptron; This represents the learnable weight matrix of the second layer in a multilayer perceptron. This is the bias vector corresponding to the second layer; It is a non-linear activation function.

[0076] Finally, residual identity feature calibration is performed. To prevent excessive smoothing of node features caused by information transmission in deep graph networks, the original semantic state vector of the target node in the previous layer is multiplied by a learnable scalar calibration parameter, and then weighted and summed with the deep hybrid features to obtain the final updated semantic representation of the node in the current layer. The formula for this calibration and update process is as follows:

[0077] ,

[0078] in, Represents the target node After a complete graph convolutional layer update, it is located at the... The deep semantic feature representation vector of the layer; For nodes In the original semantic state of the previous layer; It is a learnable scalar parameter used for residual calibration, which controls the proportion of the node that retains its own historical information.

[0079] After iteratively executing the above process through a multi-layer graph neural network, this module ultimately outputs a deep semantic feature representation of all nodes in the entire graph, incorporating fine-grained execution parameters. These deep semantic feature representations successfully overcome the theoretical limitations of implicit edge weights and will be fully input into the downstream structural integrity detection and missing dependency inference module as a behavioral baseline for measuring whether the execution trajectory is normal.

[0080] (3) Structural integrity detection and missing dependency inference module

[0081] 1) Structural perturbation and critical edge search based on projective gradient descent

[0082] In cross-chain anomaly detection tasks, attackers often deliberately omit essential verification steps in cross-chain operations to evade detection. This logic-bypassing attack does not introduce abnormal operational instructions, making the generated execution trajectory appear semantically perfectly legitimate. Since existing graph neural networks implicitly assume the observed topology is complete, they will treat the absence of such key connections merely as a lack of interaction between entities, leading to severe missed detections. Therefore, an active detection mechanism is designed to find the key topological connections that have the greatest impact on system decisions by simulating the absence of dependencies in a continuous space. The specific implementation process is as follows.

[0083] First, we construct a constrained adversarial maximization problem. The core idea is to find a discrete structural perturbation matrix based on the original graph adjacency matrix, such that the model's classification loss is maximized under this perturbation, while limiting the number of perturbation edges to expose the most vulnerable structural dependencies. The formula for this maximization objective is as follows:

[0084] ,

[0085] in, Represents the discrete structural perturbation matrix; This represents the classification loss function of the model under the current structure; This represents the adjacency matrix of the original observed cross-link graph. This formula seeks the edge combination that most disrupts the model's current predictions within a limited budget.

[0086] Next, continuous relaxation and gradient calculation are performed on the discrete structure. Since the discrete graph structure is non-differentiable, direct optimization is difficult. Therefore, the discrete perturbation matrix is ​​relaxed to a continuous variable space. Using the backpropagation mechanism, the gradient of the classification loss function with respect to the current continuous perturbation matrix is ​​calculated to obtain the direction of the fastest increase in loss. The formula for gradient calculation is as follows:

[0087] ,

[0088] in, Indicates the first The gradient matrix calculated in the next iteration; This represents the operation of taking the partial derivative with respect to a continuously perturbated variable; Indicates the first The state of the continuous perturbation matrix during the next iteration.

[0089] Finally, an iterative solution is obtained using a projected gradient descent strategy. The sign direction of the gradient matrix is ​​extracted, multiplied by the set learning rate step size, and added to the current perturbation state. Then, a projection function is used to map the updated continuous values ​​back to the valid zero-to-one range. The formula for this iterative update is as follows:

[0090] ,

[0091] in, Indicates the first The continuous perturbation matrix after the next iteration; The projection operation function is used to limit the variable space; The learning rate step size is used to control the magnitude of perturbation updates; This is a function to extract the sign direction of matrix elements.

[0092] After multiple rounds of iterative optimization, the final output optimal continuous perturbation matrix contains rich adversarial gradient signals. Among them, the entries with high gradient values ​​clearly indicate the potential critical connections most sensitive to the decision boundary, that is, the verification logic that attackers are very likely to deliberately omit. This lays the computational foundation for generating reliable structural pseudo-labels downstream.

[0093] 2) Adversarial omission set discovery and structural pseudo-label construction

[0094] After obtaining the optimal continuous perturbation matrix containing the gradient signal, it needs to be transformed into a set of explicit discrete edges to provide labeled signals for supervised learning of the subsequent inference network. The gradient signal reflects the destructive importance of missing edges to model decisions, but in actual cross-chain execution graphs, edges are represented as discrete states of presence or absence. Furthermore, to meet the real-time requirements of online detection, these discretized results must be used as prior knowledge to guide the training of the parameterized network. Therefore, a threshold filtering and pseudo-label assignment process was constructed. The specific implementation process is as follows.

[0095] First, saliency threshold filtering and adversarial omission set extraction are performed. All elements in the obtained optimal continuous perturbation matrix are traversed, and candidate edges whose gradient optimization values ​​are greater than a preset saliency threshold and do not exist in the original observation graph topology are selected. These candidate edges represent missing validation logic that would significantly alter the model's prediction results if forcibly added to the graph. These edges are combined to form the adversarial omission set. The extraction formula for this set is as follows:

[0096] ,

[0097] in, This represents the constructed adversarial omission set; and These represent the source node and the target node of the edge, respectively. This represents the gradient optimization value of the corresponding node pair in the optimal continuous perturbation matrix; The set significance threshold; Represents the set of cross-chain topological edges observed in the original dataset; the logical AND sign and the NOT-belong sign are used as dual screening conditions to limit candidate edges.

[0098] Next, a binary assignment of structural pseudo-labels is performed. The union of the originally observed set of edges and the previously mined adversarial omission set is taken. Edges within this union are considered structurally necessary positive samples, while all other possible edges in the graph are considered negative samples. This process constructs deterministic binary structural pseudo-labels for the entire graph. The assignment formula is as follows:

[0099] ,

[0100] in, Represented as a binary pseudo-label assigned to node pairs; This is an indicator function that returns one when the given condition is met, i.e., the edge belongs to the union, otherwise it returns zero; the union symbol is used to merge the actual observed edges with the mined adversarial missing edges.

[0101] The above data processing procedure successfully transformed the time-consuming continuous gradient adversarial search results into deterministic discrete structure labels, which not only revealed the hidden evasion attack intentions, but also laid a solid data foundation for training efficient parameterized structure inference networks downstream.

[0102] 3) Parameterized relational context and structural anomaly inference network

[0103] While the projective gradient descent strategy can accurately identify missing validation dependencies, its iterative computation cost is extremely high, completely failing to meet the millisecond-level real-time alert requirements of cross-chain anomaly detection systems in real-world environments. To achieve efficient online inference, a parameterized neural network module must be designed, using constructed structural pseudo-labels for supervised training, enabling it to directly infer the structural anomaly probability from the features of nodes and edges in a single forward pass. The specific implementation process is as follows.

[0104] First, the relational context features are concatenated and constructed. To comprehensively evaluate whether there is hidden interaction logic between two nodes, deep semantic features of the source and target nodes are extracted. These features are then concatenated with the initial input features to preserve the original identity information. Finally, they are globally concatenated with the extracted heterogeneous edge attribute features to form a context representation containing rich local topology and execution logic. The formula for this context construction process is as follows:

[0105] ,

[0106] in, Represented as a relational context vector constructed from node pairs; and These represent the deep semantic features of the source node and the target node after being encoded by the graph network, respectively. and Represents the initial attribute characteristics of the source node and the target node; Represents the explicit high-dimensional edge feature vector between two nodes; This represents the concatenation operation of feature vectors.

[0107] Next, a two-stage neural network inference of structural interaction probabilities is performed. The constructed relational context vector is input into the inference network. First, high-order association features are extracted through the hidden layers of a multilayer perceptron. Then, the output layer and a non-linear activation function map these features to anomaly probabilities of edges between zero and one. The formula for this two-stage inference process is as follows:

[0108] ,

[0109] ,

[0110] in, This represents the hidden layer correlation feature vector extracted by the inference network; and These are the learnable weight matrices for the first and second layers of the inference network, respectively. and This is the corresponding bias vector; This represents the probability of structural anomalies in the node pairs output by the inference network. and These are the weight vector and bias scalar of the output layer.

[0111] Finally, the node-level scalar structural risk scores are aggregated. The probabilities of all inferred edges related to the target node are summed and averaged to calculate the overall degree to which the node deviates from the complete cross-chain execution structure, generating a scalar structural anomaly risk score. The aggregation formula for this score is as follows:

[0112] ,

[0113] in, This represents the final generated target node-level scalar structure risk score; This represents the set of all candidate interaction nodes associated with the target node; This represents the total number of nodes in the set.

[0114] This scalar structural risk score precisely quantifies the probability of a single entity participating in structural evasion attacks. This output, along with the high-dimensional deep semantic features, is passed as a dual-view input source to the downstream adaptive gating fusion module, jointly determining the final cross-chain anomaly classification result.

[0115] (4) Adaptive Gated Fusion and Joint Optimization Decision Module

[0116] 1) Alignment of scalar structural risk scores with semantic feature distributions

[0117] In the final decision-making stage of cross-chain transaction anomaly detection, the effective fusion of multi-view features is crucial for achieving comprehensive evaluation. After processing by the pre-module, the system obtains a high-dimensional semantic feature vector encoding the cross-chain execution logic and a scalar structural risk score quantifying the probability of missing dependencies. However, these two types of features exhibit significant heterogeneity in numerical distribution and feature space. The high-dimensional semantic features contain rich business details and have a wide range of numerical fluctuations, while the structural risk score is only a single scalar limited to the zero-to-one range. Simply concatenating and fusing these heterogeneous semantic features and structural scores often leads to severe numerical instability, causing the high-dimensional component to dominate network training and easily drowning out critical structural warning signals. Therefore, a distribution alignment process was designed to map the scalar score to a hidden space compatible with the semantic features.

[0118] First, the output scalar structured risk score is standardized using statistical information from the current training batch to eliminate numerical differences between different trading samples and enhance training stability. The formula for this standardization process is as follows:

[0119] ,

[0120] in, This represents the standardized, smoothed structural risk score. The inferred original scalar structure risk score; and These represent the statistical mean and statistical variance of the structural risk scores of all nodes within the current data batch, respectively. It is a minimal constant used to ensure that the denominator is not zero.

[0121] Next, to address the mismatch in feature dimension between the standardized scalar features and the output high-dimensional semantic features, a learnable linear projection weight matrix is ​​introduced to map the scalar features into the high-dimensional latent space. The formula for this dimension-aligned projection process is as follows:

[0122] ,

[0123] in, This represents the structural feature vector initially projected into the high-dimensional space; It is a learnable linear projection weight matrix, whose function is to expand one-dimensional features to the same dimension as the deep semantic features of nodes.

[0124] Finally, bias compensation is introduced to further fine-tune the distribution of features in the latent space, generating the final structural embedding representation. The formula for this bias compensation process is as follows:

[0125] ,

[0126] in, This represents the final generated normalized high-dimensional structure embedding vector; is the learnable bias vector for the linear projection operation.

[0127] This operation essentially amplifies the fragile scalar warning signal and transforms it into a structured multidimensional representation, effectively avoiding feature-dominated bias during multi-view feature fusion. The output high-dimensional structured embedding vector will be input into an adaptive gating mechanism to dynamically evaluate the collaborative importance weights of each view feature in the current transaction state.

[0128] 2) Adaptive gating mechanism and dynamic feature weighted fusion

[0129] After aligning the distribution of multi-view features, the system faces the challenge of dynamically balancing semantic and structural evidence based on different transaction contexts. In normal cross-chain workflows, semantic features are usually sufficient to describe the legitimacy of a transaction; however, in complex logic bypass attacks, structural integrity signals are more discriminative. Traditional static weighting or simple concatenation mechanisms cannot characterize this collaborative perception characteristic between views, easily leading to key anomaly signals being drowned out by background noise. To address this, this module proposes an adaptive gating modeling mechanism that dynamically adjusts the ecological responsiveness of each view at different times by constructing contextual associations between views. The specific implementation process is as follows.

[0130] First, a joint context is constructed for the multi-view features. The output high-dimensional deep semantic feature vector is horizontally concatenated with the generated normalized high-dimensional structure embedding vector to form an enhanced feature matrix containing dual-view information. The formula for this joint context construction process is as follows:

[0131] ,

[0132] in, Represented as nodes Constructed joint view feature vector; This represents the deep semantic feature vector output by the second-step module; This represents the output normalized high-dimensional structure embedding vector.

[0133] Next, the importance weights of the views are automatically evaluated. The concatenated joint feature vector is input into a single-layer feedforward neural network. By learning the non-linear interaction relationships between views, a dynamic weight factor between zero and one is calculated. This weight factor represents the system's real-time evaluation of the current transaction semantic credibility. The formula for the weight calculation process is as follows:

[0134] ,

[0135] in, Represented as nodes The calculated adaptive gating weight factor; Here is the learnable weight matrix for the gated network; This is the corresponding bias vector.

[0136] Subsequently, interactive modulation of the feature space is performed. Using the calculated weight factors and their complements, the semantic view and structural view are scaled element-wise, respectively. This modulation process essentially suppresses or enhances the feature intensity of different views based on the risk propensity of the current transaction. The formula for the modulation process is as follows:

[0137] ,

[0138] ,

[0139] in, and These represent the modulated semantic features and structural features, respectively. This represents the element-wise multiplication operation between eigenvectors.

[0140] Finally, a linear fusion of weighted features is performed. The modulated features from the two views are summed to reconstruct the collaborative representation vector of each entity. The specific fusion formula is as follows:

[0141] ,

[0142] in, This represents the final generated adaptive fusion feature representation vector.

[0143] This operation learns structured relationships through changes in responses between views, enabling the system to automatically identify which views are more suitable for describing the current cross-chain transaction. When the system detects severe structural deficiencies, the weighting factors are automatically reduced, thus incorporating more structural response information into the final representation. The final output fused feature vector is then fed into a multi-objective joint optimization module to model the evolutionary trajectory in time and space and to make the final anomaly classification decision.

[0144] 3) Multi-objective joint optimization and cross-chain anomaly classification decision

[0145] After obtaining the multi-view fusion feature representation, the system needs to establish a final anomaly detection mechanism and train the entire detection framework end-to-end through a joint optimization strategy. Cross-chain transaction data often exhibits severe class imbalance, with attack samples accounting for only a very small proportion. Simultaneously, to ensure that the system can not only identify anomalous results but also accurately infer missing structural dependencies, a joint optimization objective with multiple loss constraints is designed, incorporating both classification accuracy and structural consistency into the monitoring scope. The specific implementation process is as follows.

[0146] First, the final anomaly classification prediction is performed. The generated adaptive fusion feature representation vector is input into a graph classifier containing an output layer and a non-linear activation function to calculate the predicted probability that the transaction node belongs to an anomaly attack. The formula for this classification mapping process is as follows:

[0147] ,

[0148] in, Represents a node The predicted probability value of being judged as an abnormal transaction; is the learnable weight matrix of the classifier; This is the adaptive fusion feature vector output from the previous section; For classification bias items; This is an activation function that compresses the output to the range of zero to one.

[0149] Next, a classification loss function is constructed to address class imbalance. Considering the scarcity of cross-chain attack samples, a focus loss function is adopted as the classification optimization objective. A modulation factor is introduced to reduce the weight of easily classified samples, thereby forcing the model to pay more attention to attack samples that are difficult to distinguish. The formula for calculating this classification loss is as follows:

[0150] ,

[0151] in, This represents the calculated classification loss value; A focusing parameter for controlling the weighting of easy and difficult samples; It is a logarithmic function.

[0152] Meanwhile, to enhance the system's accuracy in perceiving missing verification logic, a structural consistency auxiliary loss is introduced. Using the binary cross-entropy loss function, the deviation between the structural interaction probabilities generated by the inference network in the structural integrity detection and missing dependency inference modules and the pseudo-labels of the structures obtained through gradient guidance is measured, forcing the inference network to approximate the key dependencies discovered by the optimal perturbation. The formula for calculating this structural loss is as follows:

[0153] ,

[0154] in, This represents the structural consistency loss value; The probability of node-to-structure interaction inferred in the structural integrity detection and missing dependency inference module; Structural pseudo-labels constructed for the structural integrity detection and missing dependency inference module; This is the set of node pairs participating in the training.

[0155] Finally, a multi-objective joint optimization objective function is constructed for end-to-end parameter updates. By introducing a balanced hyperparameter, the classification loss and structural loss are weighted and summed to guide the model to improve detection accuracy while also possessing the ability to explain hidden structure avoidance behavior. The joint optimization formula is as follows:

[0156] ,

[0157] in, This represents the overall joint loss function for training the full graph model; A regularization hyperparameter to balance the importance of the two tasks.

[0158] By minimizing the aforementioned joint loss function, this invention can simultaneously optimize the accuracy of edge condition semantic encoding and structural integrity detection. The final output predicted probability represents whether the cross-chain transaction carries the risk of bypassing verification logic. This determination not only integrates fine-grained execution logic parameters but also explicitly includes an assessment of the structural integrity of the execution trajectory, achieving high-precision real-time monitoring and deep security early warning for complex cross-chain evasion attacks.

[0159] Experimental verification

[0160] To systematically verify the performance advantages of the method of this invention in cross-chain execution graph fraud detection, an execution graph dataset based on mainstream Ethereum cross-chain bridge protocols was constructed. The dataset consists of three core data dimensions: ① Topology: containing entity nodes and multi-graph edges of cross-chain interactions, reflecting fund flows and call paths; ② Execution semantics: extracting asset value, fee parameters, and method signatures from transaction logs for modeling fine-grained contract execution logic; ③ Structural integrity features: using the key edge omission set mined by projective gradient descent as a structural reference for measuring the risk of logic bypass. Four transaction states are labeled in the dataset: ① Normal cross-chain interaction; ② Logic bypass attack; ③ Semantic spoofing fraud; ④ Cross-chain reentrancy attack. A total of 4200 cross-chain execution subgraph samples were constructed, of which 3000 were used for training and 1200 for testing, ensuring coverage of different asset sizes, protocol types, and multiple attack variants.

[0161] To test the system's robustness and structural defect modeling capabilities in complex adversarial environments, the following five mainstream comparison methods were set up: ① GCN: A typical graph convolutional network that extracts features only through topological neighborhood aggregation, ignoring the modulating effect of high-dimensional edge attributes; ② GAT: A graph neural network that introduces an attention mechanism, learning the weights between nodes but failing to effectively handle structural defects; ③ RGCN: A relational graph convolutional network that models heterogeneous edge types to distinguish different cross-chain operations; ④ MLP-Concat: A naive fusion method that directly concatenates node and transaction attribute features into a multilayer perceptron; ⑤ The method of this invention: Introduces edge conditional semantic encoding, structural integrity detection, and adaptive gating fusion mechanisms.

[0162] All methods were evaluated under the same training and test sets. Evaluation metrics: ① F1 score: comprehensively evaluates the balance between precision and recall in identifying malicious transactions; ② Area under the curve (AUC): measures the overall discrimination performance of the model at different thresholds, avoiding evaluation bias caused by sample imbalance; ③ Precision: reflects the accuracy of the model's fraud alerts, used to reduce the risk of false positives; ④ Recall: measures the system's ability to capture actual malicious attacks, used to reduce the risk of asset loss; ⑤ Inference time: the time required for a single subgraph to go from data input to outputting risk judgment results, measuring the efficiency of the system's real-time risk control deployment.

[0163] Table 1. Comparison of data from different methods under five major indicators.

[0164]

[0165] The experimental results are shown in Table 1. Figure 2 , Figure 3 , Figure 4 , Figure 5 As shown, in the complex environment of cross-chain adversarial disturbances, traditional methods exhibit significant performance limitations. MLP-Concat, as a direct feature concatenation model, cannot identify logic bypass attacks hidden under legitimate topologies when there is no spatial topology or structural dependency modeling, resulting in a recall rate as low as 59.84%. Although GCN preserves the topology structure of cross-chain transactions, it lacks detection capabilities when facing evasion attacks that deliberately omit verification of connections, resulting in severe false negatives, with its F1-score being only 72.48%.

[0166] GAT improves the feature weight allocation capability with the help of the attention mechanism, but because it cannot effectively capture structural missing features, its AUC only reaches 80.24%, which is difficult to support the deep judgment task of complex attacks; RGCN improves the perception capability of heterogeneous cross-chain semantics with the help of relation graph convolution, but the processing time is long (4.8 seconds), which is difficult to meet the real-time requirements of high-frequency monitoring of cross-chain bridges.

[0167] In comparison, the method of this invention has achieved systematic breakthroughs in multiple dimensions: the F1-score reaches 92.75% and the AUC reaches 94.82%, both of which are the highest values; the precision and recall are improved to 95.12% and 90.48% respectively, which are better than all the comparison models; the single inference time is controlled at 4.2 seconds, which is better than the graph relation method (RGCN) with the same complex modeling ability, demonstrating excellent inference efficiency.

[0168] In summary, this method not only has significant advantages in fraud diagnosis accuracy and structural modeling capabilities, but also leads the way in two key dimensions: real-time performance and attack avoidance detection. This fully demonstrates its application value in real-time anomaly monitoring of heterogeneous transactions across large-scale cross-chain bridges, and it possesses broad engineering deployment potential and digital asset security decision support capabilities.

[0169] Example 2

[0170] This embodiment provides a cross-chain transaction data anomaly detection system based on graph structure perception and gradient-guided perturbation.

[0171] A computer-readable storage medium storing a plurality of instructions adapted for loading and execution by a processor of a terminal device, the method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation.

[0172] A terminal device includes a processor and a computer-readable storage medium, the processor being used to implement various instructions; the computer-readable storage medium being used to store multiple instructions, the instructions being adapted to be loaded and executed by the processor as described in the "Cross-Chain Transaction Data Anomaly Detection Method Based on Graph Structure Awareness and Gradient-Guided Perturbation".

[0173] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation, characterized in that, include: Obtain cross-chain transaction data; Based on the acquired cross-chain transaction data, cross-chain execution graph construction and feature initialization are performed, including cross-chain transaction topology construction and high-dimensional heterogeneous edge attribute feature encoding; Edge condition semantic feature encoding is performed based on cross-chain execution graph, including heterogeneous edge feature injection and message modulation, edge condition local neighborhood aggregation and state update; Structural integrity detection and missing dependency inference based on encoded features include structural perturbation and key edge search based on projective gradient descent, adversarial omission set discovery and structural pseudo-label construction, and parameterized relational context and structural anomaly inference network construction. Adaptive gating fusion and joint optimization decision-making based on inference results include aligning scalar structure risk scores with semantic feature distributions, adaptive gating mechanisms with dynamic feature weighted fusion, multi-objective joint optimization, and cross-chain anomaly classification decision-making.

2. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 1, characterized in that, The construction of the cross-chain transaction topology and the encoding of high-dimensional heterogeneous edge attribute features include using a directed attribute multigraph as the topology carrier, extracting verified transaction trajectories, and establishing fine-grained directed connections between participating entities. The input cross-chain transaction graph is formalized as follows: , where the set of nodes The unique entities involved in the transaction include externally owned accounts and smart contracts; initial feature matrix Includes the initial semantic properties of nodes, for the edge set. The construction uses a multigraph structure to preserve parallel edges, represented as: ,in, This is the original cross-chain transaction log collection; Represents the first element in the set. One transaction event; To extract the operation functions of the entity that initiated the transaction; Operation functions for extracting the transaction recipient entity; The transaction initiating node extracted through the initiator function; The transaction receiving node is extracted through the receiver function; Represents a node With nodes Between the first The second interaction connection; then, to avoid feature space shift caused by high-dimensional heterogeneous data, high-dimensional attribute features are extracted for each transaction event: ,in, , and They represent the first The asset value, transaction fee parameters, and function signature variables for this transaction event; It is a numerical normalization function; This is a one-hot encoding mapping; This represents the concatenation operation of feature vectors; A learnable linear projection matrix used to map the concatenated underlying heterogeneous attributes to a unified dimension. In the latent feature space; To construct high-dimensional heterogeneous edge attribute features; finally, to construct the full graph edge attribute feature space composed of all edge feature vectors. , and cross-chain topology Complete the full graph structure transformation of unstructured cross-chain logs.

3. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 2, characterized in that, The heterogeneous edge feature injection and message modulation include first performing a linear transformation on the extracted edge attribute features using a learnable projection weight matrix and bias vector to achieve dimensional alignment of the heterogeneous feature space, as shown below: ,in, This represents the edge attribute feature vector after dimension alignment; For the first The learnable projective weight matrix of the layer; This represents the high-dimensional explicit edge feature vector extracted in Module 1; The corresponding projection bias vector is then used. Subsequently, the transformed edge feature vector is directly injected into the semantic feature vector of the transaction initiator source node by element-wise addition, thereby achieving physical coupling between node identity state and cross-chain execution logic, as shown below: ,in, This represents the intermediate feature vector after the source node state and edge execution logic are coupled; This indicates that the source node $u$ is at the th... The semantic feature representation of the layer is then input into a linear rectified activation function for nonlinear transformation, ultimately generating a modulated message containing a specific transaction semantic imprint, represented as: ,in, Indicates the first From source node in layered network Transmitted to the target node The final modulated message feature vector; It is a linear rectification activation function.

4. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 3, characterized in that, The edge condition local neighborhood aggregation and state update include first performing local neighborhood interaction context aggregation. For each target node in the graph, the modulation message feature vectors of all first-order local neighbor nodes pointing to the target node are collected and accumulated, and the cross-chain interaction context is summarized as follows: ,in, Represents the target node In the The local neighborhood context vector obtained by layer aggregation; Represents the target node The set of all first-order local neighbors; accumulation symbol This indicates that the summation operation is performed on all message vectors within the set; Indicates from the source node Transmitted to the target node The modulated message feature vector is then obtained; next, the first layer of latent vector space mapping is performed, and the aggregated context vector is input into the first layer of the multilayer perceptron network. Low-order local neighborhood structure and semantic mixture features are extracted through linear transformation and activation function, represented as: ,in, This represents the hidden layer feature vector after extraction from the first layer; This represents the learnable weight matrix of the first layer in a multilayer perceptron. This is the bias vector corresponding to the first layer; The activation function is a linear rectified function; subsequently, a second layer of deep, higher-order feature extraction is performed, and the hidden layer feature vector is further input into the second layer of the multilayer perceptron network to obtain higher-order global perceptual features, represented as: ,in, This represents the deep hybrid feature vector extracted by the complete multilayer perceptron; This represents the learnable weight matrix of the second layer in a multilayer perceptron. This is the bias vector corresponding to the second layer; The activation function is non-linear. Finally, residual identity feature calibration is performed. To prevent excessive smoothing of node features caused by information transmission in deep graph networks, the original semantic state vector of the target node in the previous layer is multiplied by a learnable scalar calibration parameter, and then weighted and summed with the deep hybrid features to obtain the final updated semantic representation of the node in the current layer, as follows: ,in, Represents the target node After a complete graph convolutional layer update, it is located at the... The deep semantic feature representation vector of the layer; For nodes In the original semantic state of the previous layer; It is a learnable scalar parameter used for residual calibration, which controls the proportion of the node that retains its own historical information.

5. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 4, characterized in that, The structure perturbation and key edge search based on projective gradient descent includes constructing a constrained adversarial maximization problem. Based on the original graph adjacency matrix, a discrete structure perturbation matrix is ​​found that maximizes the model's classification loss under perturbation, expressed as: ,in, Represents the discrete structural perturbation matrix; This represents the classification loss function of the model under the current structure; Let represent the adjacency matrix of the original observed cross-link graph; then, continuous relaxation and gradient calculation are performed on the discrete structure, and the gradient of the classification loss function with respect to the current continuous perturbation matrix is ​​calculated using the backpropagation mechanism, expressed as: ,in, Indicates the first The gradient matrix calculated in the next iteration; This represents the operation of taking the partial derivative with respect to a continuously perturbated variable; Indicates the first The continuous perturbation matrix state during the next iteration; finally, the projected gradient descent strategy is used for iterative solution, the sign direction of the above gradient matrix is ​​extracted, multiplied by the set learning rate step size and added to the current perturbation state, and then the updated continuous value is mapped back to the legal zero-to-one range using the projection function, expressed as: ,in, Indicates the first The continuous perturbation matrix after the next iteration; The projection operation function is used to limit the variable space; The learning rate step size is used to control the magnitude of perturbation updates; This is a function to extract the sign direction of matrix elements.

6. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 5, characterized in that, The adversarial omission set discovery and structural pseudo-label construction include, after obtaining the optimal continuous perturbation matrix containing gradient signals, first performing saliency threshold filtering and adversarial omission set extraction. By traversing all elements in the obtained optimal continuous perturbation matrix, candidate edges whose gradient optimization values ​​are greater than a preset saliency threshold and do not exist in the original observation graph topology are selected and combined to form the adversarial omission set, represented as: ,in, This represents the constructed adversarial omission set; and These represent the source node and the target node of the edge, respectively. This represents the gradient optimization value of the corresponding node pair in the optimal continuous perturbation matrix; The set significance threshold; This represents the set of cross-chain topological edges originally observed. Next, a binary assignment of structural pseudo-labels is performed. The union of the originally observed edge set and the mined adversarial omission set is taken. Edges within this union are considered structurally necessary positive samples, while all other possible edges in the graph are considered negative samples. This process constructs deterministic binary structural pseudo-labels for the entire graph. The label assignment formula is expressed as: ,in, Represented as a binary pseudo-label assigned to node pairs; This is an indicator function.

7. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 6, characterized in that, The construction of the parameterized relational context and structural anomaly inference network includes firstly concatenating and constructing relational context features, extracting deep semantic features from the output source and target nodes, concatenating them with the initial input features to retain the original identity information, and then globally concatenating them with the extracted heterogeneous edge attribute features to form a context representation containing rich local topology and execution logic. The context construction process is as follows: ,in, Represented as a relational context vector constructed from node pairs; and These represent the deep semantic features of the source node and the target node after being encoded by the graph network, respectively. and Represents the initial attribute characteristics of the source node and the target node; Represents the explicit high-dimensional edge feature vector between two nodes; This represents the concatenation operation of feature vectors; next, a two-stage neural network inference of structural interaction probabilities is performed. The constructed relational context vector is input into the inference network. First, high-order association features are extracted through the hidden layers of a multilayer perceptron, and then mapped to edge anomaly probabilities between zero and one through the output layer and a non-linear activation function. The two-stage inference process is as follows: , ,in, This represents the hidden layer correlation feature vector extracted by the inference network; and These are the learnable weight matrices for the first and second layers of the inference network, respectively. and This is the corresponding bias vector; This represents the probability of structural anomalies in the node pairs output by the inference network. and The output layer contains the weight vector and bias scalar. Finally, the node-level scalar structural risk scores are aggregated. The probabilities of all inferred edges related to the target node are summed and averaged to calculate the overall degree to which the node deviates from the complete cross-chain execution structure, generating a scalar structural anomaly risk score, expressed as: ,in, This represents the final generated target node-level scalar structure risk score; This represents the set of all candidate interaction nodes associated with the target node; This represents the total number of nodes in the set.

8. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 7, characterized in that, The scalar structured risk score is aligned with the semantic feature distribution. This involves first standardizing the output scalar structured risk score using statistical information from the current training batch to eliminate numerical magnitude differences between different transaction samples and enhance training stability. This is expressed as: ,in, This represents the standardized, smoothed structural risk score. The inferred original scalar structure risk score; and These represent the statistical mean and statistical variance of the structural risk scores of all nodes within the current data batch, respectively. Here, a minimal constant is used to ensure the denominator is not zero; then, to address the mismatch between the standardized scalar features and the output high-dimensional semantic features in terms of feature dimension, a learnable linear projection weight matrix is ​​introduced to map the scalar features to the high-dimensional latent space, expressed as: ,in, This represents the structural feature vector initially projected into the high-dimensional space; The linear projection weight matrix is ​​learnable; finally, bias compensation is introduced to fine-tune the distribution of features in the latent space, generating the final structural embedding representation, as follows: ,in, This represents the final generated normalized high-dimensional structure embedding vector; is the learnable bias vector for the linear projection operation.

9. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 8, characterized in that, The adaptive gating mechanism and dynamic feature weighted fusion include, after completing the distribution alignment of multi-view features, dynamically adjusting the ecological response capabilities of each view at different times by constructing contextual associations between views. First, a joint contextual construction of multi-view features is performed. Then, the output high-dimensional deep semantic feature vector is horizontally concatenated with the generated normalized high-dimensional structure embedding vector to form an enhanced feature matrix containing dual-view information, represented as: ,in, Represented as nodes Constructed joint view feature vector; This represents the deep semantic feature vector output by the second-step module; This represents the output normalized high-dimensional structure embedding vector; next, automatic evaluation of view importance weights is performed, and the concatenated joint feature vector is input into a single-layer feedforward neural network. By learning the nonlinear interaction relationship between views, the dynamic weight factor is calculated, expressed as: ,in, Represented as nodes The calculated adaptive gating weight factor; This represents the learnable weight matrix of the gated network; This is the corresponding bias vector; subsequently, interactive modulation of the feature space is performed, using the calculated weight factors and their complements to scale the semantic view and structural view element by element, as shown below: , ,in, and These represent the modulated semantic features and structural features, respectively. This represents the element-wise multiplication operation between feature vectors; finally, a weighted linear fusion of features is performed, summing the modulated features from the two views to reconstruct the collaborative representation vector of each entity, as follows: ,in, This represents the final generated adaptive fusion feature representation vector.

10. The method for detecting anomalies in cross-chain transaction data based on graph structure awareness and gradient-guided perturbation according to claim 9, characterized in that, The multi-objective joint optimization and cross-chain anomaly classification decision-making process includes, after obtaining the multi-view fusion feature representation, incorporating both classification accuracy and structural consistency into the monitoring scope based on the joint optimization objective of multiple loss constraints. First, a final anomaly classification prediction is performed. The generated adaptive fusion feature representation vector is input into a graph classifier containing an output layer and a nonlinear activation function to calculate the predicted probability value of a transaction node belonging to an anomalous attack, expressed as: ,in, Represents a node The predicted probability value of being judged as an abnormal transaction; is the learnable weight matrix of the classifier; This is the adaptive fusion feature vector output from the previous section; For category bias items; An activation function is used to compress the output to the zero-to-one range. Next, a classification loss function is constructed to address class imbalance, employing a focus loss function as the classification optimization objective. A modulation factor is introduced to reduce the weight of easily classified samples, thus forcing the model to pay more attention to difficult-to-distinguish attack samples. This is expressed as: ,in, This represents the calculated classification loss value; A focusing parameter for controlling the weighting of easy and difficult samples; The function is logarithmic. Simultaneously, to enhance the accuracy of detecting missing validation logic, a structural consistency auxiliary loss is introduced. The binary cross-entropy loss function is used to measure the deviation between the structural interaction probabilities generated by the inference network and the pseudo-labels obtained through gradient guidance. The structural loss calculation process is as follows: ,in, This represents the structural consistency loss value; The probability of node-to-structure interaction; These are structural pseudo-tags; The set of node pairs participating in training is defined. Finally, a multi-objective joint optimization objective function is constructed for end-to-end parameter updates. By introducing a balanced hyperparameter, the classification loss and structural loss are weighted and summed to guide the model to improve detection accuracy while also possessing the ability to explain hidden structure avoidance behavior. The joint optimization formula is as follows: ,in, This represents the overall joint loss function for training the full graph model; A regularization hyperparameter to balance the importance of the two tasks.

Images