Block chain intelligent contract abnormal transaction tracing method and system
By employing semi-supervised learning and multi-dimensional automated traceability analysis, the problem of low efficiency in tracing abnormal transactions in blockchain smart contracts has been solved. This has enabled efficient and accurate tracing of abnormal transactions and accumulation of threat intelligence, thereby enhancing the security defense capabilities of the blockchain.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- STATE GRID ELECTRIC POWER RES INST
- Filing Date
- 2025-12-09
- Publication Date
- 2026-04-24
AI Technical Summary
Existing methods for tracing abnormal transactions in blockchain smart contracts suffer from low efficiency and insufficient accuracy, especially when facing complex and multi-step attack scenarios, making it difficult to quickly identify and track abnormal transactions.
An anomaly detection process using semi-supervised learning is adopted, combined with multi-dimensional automated source tracing analysis, including training of anomaly transaction detection models, deep contract analysis, fund flow tracing and contract interaction analysis, to construct an entity profile of the attacker and match it with a knowledge base to generate a source tracing path map.
It enables efficient and accurate tracing of abnormal transactions, quickly identifies complex attack chains, improves security incident response efficiency, accumulates threat intelligence, and enhances defense strategies.
Smart Images
Figure CN121921020A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of blockchain security technology, specifically relating to a method and system for tracing abnormal transactions in blockchain smart contracts. Background Technology
[0002] As programs that automatically execute pre-defined business logic and protocol terms on the blockchain, smart contracts are a key tool for realizing the potential of blockchain applications, greatly expanding their functionality and application scenarios. However, the widespread use of smart contracts has also brought increasingly prominent security risks.
[0003] Faced with increasingly complex and evolving security threats, current methods for tracing abnormal smart contract transactions still have many shortcomings: Blockchain data is massive, and full-node parsing, transaction graph construction, and indexing are costly and difficult to achieve low-latency real-time tracking; anonymization and obfuscation techniques render traditional rules based on fund flow or address clustering ineffective or highly inaccurate, and many methods focus on static address characteristics or single transaction attributes, making it difficult to identify attackers' strategic and phased operations. Because transaction graphs and blockchain data are high-dimensional, dense, and highly time-series data structures, traditional batch processing and heuristic rules struggle to balance efficiency and accuracy.
[0004] Therefore, there is an urgent need for a new method for tracing abnormal transactions, in order to improve tracking efficiency while ensuring the accuracy of tracing. Summary of the Invention
[0005] Purpose of the invention: To address existing problems, this invention proposes a method and system for tracing abnormal transactions in blockchain smart contracts. It employs a semi-supervised learning-enhanced anomaly detection process and closely integrates a multi-dimensional, automated anomaly tracing analysis process after the detection process, covering the complete lifecycle of abnormal transaction tracing.
[0006] Technical solution:
[0007] This invention proposes a method for tracing abnormal transactions in blockchain smart contracts, including:
[0008] A semi-supervised model is established based on an autoencoder architecture. Multi-source heterogeneous blockchain data is collected to train the semi-supervised model to obtain an abnormal transaction detection model. Real-time transaction data of the target blockchain platform is collected, preprocessed, and then input into the abnormal transaction detection model to obtain the risk rating of the current transaction.
[0009] If the risk rating of the current transaction meets the preset traceability conditions, collect complete information about the current transaction and enrich the data to obtain an abnormal transaction sequence that includes the context information of the current transaction.
[0010] Deep contract analysis is performed on the abnormal transaction sequence, including transaction chain tracing, fund flow tracing, and contract interaction analysis, to identify key addresses in the abnormal transaction sequence; based on the key addresses, an attacker's entity profile is constructed and matched with the existing knowledge base to confirm the attack pattern of the current transaction;
[0011] Based on the results of the deep contract analysis, a traceability path diagram is output, a structured report is generated, and the knowledge base is updated.
[0012] Furthermore, the semi-supervised model includes an encoder and a classifier, and the multi-source heterogeneous blockchain data is preprocessed to extract numerical features that effectively describe blockchain transactions and entity behavior.
[0013] The training includes unsupervised pre-training of the encoder based on a large amount of unlabeled multi-source heterogeneous blockchain data, and semi-supervised optimization and calibration of the classifier by fusing a small amount of labeled multi-source heterogeneous blockchain data.
[0014] Furthermore, the complete information includes: the sender of the transaction, the recipient contract, the function called and its parameters, the event generated, and the internal transaction;
[0015] The data enrichment includes: collecting historical transaction data, balance changes, first occurrence time, and receiver's bytecode of the sender and receiver; if the receiver has been verified, then obtaining the receiver's source code and ABI.
[0016] Furthermore, the transaction chain tracking includes: constructing a local transaction directed graph centered on the current transaction, where nodes are account addresses, edges are transactions or internal calls, and edge attributes include transaction time, value, and function call information.
[0017] Furthermore, the fund flow tracking includes source tracing and destination analysis:
[0018] The source tracing starts from the input party of the abnormal transaction and recursively traces the direct and indirect source accounts of the funds, identifies the initial fund injection point and key intermediate accounts, and analyzes the antecedent conditions or preceding transaction sequences that led to the abnormal transaction.
[0019] The destination analysis starts from the output of the abnormal transaction and recursively traces the direct and indirect destination accounts of the funds, identifies the fund aggregation point, the withdrawal address flowing to the exchange, and the path to other DApps or cross-chain bridges, and analyzes the chain reaction that the abnormal transaction may trigger or the impact on other contracts / accounts.
[0020] Furthermore, the contract interaction analysis includes:
[0021] Perform trace analysis on the current transaction and use the tools of the blockchain node to obtain the detailed execution trajectory of the abnormal transaction at the Ethereum Virtual Machine level;
[0022] Reconstruct the complete function call stack during the transaction execution process, including external calls and message calls between internal contracts; track the changes in key state variables of relevant contracts before and after the current transaction execution to determine whether there are any unexpected state modifications;
[0023] By combining the parameters and order recorded in the event log, verify whether the execution of the contract logic meets expectations.
[0024] Furthermore, identifying key addresses in the abnormal transaction sequence includes:
[0025] Based on the results of fund flow tracking, identify the initial fund injection point, key intermediary accounts, fund aggregation points, withdrawal addresses flowing to exchanges, and accounts involved in the path to other DApps or cross-chain bridges; the key intermediary accounts include newly created accounts and accounts that interact with the coin mixing service;
[0026] Review the feature vectors of current transactions in the abnormal transaction detection model, and identify the addresses corresponding to the features that contribute significantly to the abnormal score;
[0027] The entities involved in abnormal transactions are compared with external threat intelligence platforms, blacklist address databases, or contract vulnerability databases to identify known risky entity addresses.
[0028] Furthermore, confirming the current transaction attack pattern includes:
[0029] Create historical behavior profiles for key source accounts, intermediate accounts, and target accounts represented by key addresses in abnormal transaction sequences, including transaction frequency, transaction amount, type of interactive contract, gas usage habits, diversity of funding sources, and correlation with other known risk entities;
[0030] Based on the behavioral patterns identified from the historical behavioral profiles, combined with abnormal behavioral characteristics, fund flow characteristics, and contract exploitation techniques, the patterns are matched with attack patterns in the existing knowledge base to analyze the attack patterns existing in the abnormal transaction sequences.
[0031] Furthermore, the matching with existing knowledge bases includes:
[0032] The identified behavioral patterns are associated with specific patterns, common TTP fingerprints, and malicious entity tags in the knowledge base. The specific patterns include continuously accumulating small amounts of funds and then transferring them out in large amounts, calling multiple DeFi protocols to achieve arbitrage, and continuously probing and testing the permissions of target accounts.
[0033] This invention also proposes a blockchain smart contract abnormal transaction tracing system, comprising:
[0034] An abnormal transaction detection module is used to build a semi-supervised model based on an autoencoder architecture, collect multi-source heterogeneous blockchain data to train the semi-supervised model, and obtain an abnormal transaction detection model; collect real-time transaction data of the target blockchain platform, preprocess it and input it into the abnormal transaction detection model to obtain the risk rating of the current transaction;
[0035] The abnormal information collection and enrichment module is used to collect complete information of the current transaction and enrich the data when the risk level of the current transaction meets the preset traceability conditions, so as to obtain an abnormal transaction sequence including the current transaction context information.
[0036] The deep contract analysis module is used to perform deep contract analysis on the abnormal transaction sequence, including transaction chain tracing, fund flow tracing and contract interaction analysis, to identify key addresses in the abnormal transaction sequence; based on the key addresses, an attacker entity profile is constructed and matched with the existing knowledge base to confirm the attack pattern of the current transaction;
[0037] The tracing result output and update module is used to output a tracing path diagram based on the results of deep contract analysis, generate a structured report, and update the knowledge base.
[0038] Beneficial effects:
[0039] (1) Provides more insightful anomaly scoring and decision support, and achieves efficient automated tracing. The reconstruction error of the autoencoder is not only an anomaly score, but its component differences in different feature dimensions can indicate which aspects of behavior led to the anomaly determination. The tracing mechanism integrated in this invention can, on this basis, automatically or semi-automatically delve into the root causes, attack paths, and fund flows of anomaly events, providing powerful and actionable intelligence for rapid response to security incidents, loss control, evidence collection, and accountability.
[0040] (2) Enhance the ability to identify and analyze complex, multi-step attack scenarios: Through refined transaction chain and contract interaction path tracing, it is possible to clearly reveal complex attack chains and collaborative behaviors that consist of a series of seemingly isolated transactions but constitute malicious intent as a whole.
[0041] (3) Improve the efficiency and effectiveness of security incident response: Automated source tracing analysis significantly shortens the time for manual investigation and evidence collection, enabling security teams to understand the full picture of the attack more quickly, formulate effective countermeasures, and promptly report risks to the community or relevant parties.
[0042] (4) Promote the accumulation and sharing of threat intelligence: Through systematic source tracing analysis of a large number of abnormal events, a knowledge base on attacker TTPs, malicious addresses / contracts, and new vulnerability exploitation methods can be continuously accumulated and updated. This knowledge can be used to improve detection models, enhance defense strategies, and can be selectively shared with the industry to improve the security level of the entire ecosystem. Attached Figure Description
[0043] Figure 1 A flowchart of the abnormal transaction tracing method;
[0044] Figure 2 This is a flowchart of the first stage of model training in the method of the present invention;
[0045] Figure 3 This is a flowchart of the abnormal transaction tracing mechanism in the second to fifth stages of the method of the present invention. Detailed Implementation
[0046] The invention will be further explained below with reference to the accompanying drawings and specific embodiments. This invention proposes a method for tracing abnormal transactions in blockchain smart contracts, the specific process of which is as follows: Figure 1 As shown, it specifically includes:
[0047] Phase 1: Preprocessing and initialization.
[0048] A semi-supervised model is established based on an autoencoder architecture. Multi-source heterogeneous blockchain data is collected to train the semi-supervised model to obtain an abnormal transaction detection model. Real-time transaction data of the target blockchain platform is collected, preprocessed, and then input into the abnormal transaction detection model to obtain the risk rating of the current transaction.
[0049] This embodiment employs a deep fully connected autoencoder to establish a semi-supervised model. First, the encoder undergoes unsupervised pre-training using multi-source heterogeneous blockchain data. This multi-source heterogeneous blockchain data is pre-processed to extract numerical features that effectively describe blockchain transactions and entity behavior. These features include: inherent and execution characteristics of transactions, account profiles and behavioral patterns, temporal and session characteristics, network and market state characteristics, and graph / network structure characteristics.
[0050] Then, utilizing the latent space features extracted by the encoder, and fusing diverse semi-supervised optimization and calibration strategies with a small amount of labeled data, an XGBoost classifier is trained for semi-supervised anomaly detection. The small amount of labeled data can be obtained from public datasets or from manually labeled multi-source heterogeneous blockchain data. The strategies include supervised calibration and adaptive threshold optimization based on reconstruction error, end-to-end fine-tuning of the entire autoencoder or specific parts thereof, supervised classifier training based on latent space representation, iterative self-training based on pseudo-labeling, and graph-based semi-supervised learning (if applicable). The above training process is as follows: Figure 2 As shown.
[0051] The trained abnormal transaction detection model can calculate the abnormal score of corresponding transactions based on newly acquired transaction data from the blockchain platform. The XGBoost classifier then assigns a risk rating to the transaction, thus achieving abnormal transaction detection. The abnormal score ranges from 0 to 1. The correspondence between the abnormal score and the risk rating is pre-set according to the actual situation. In this embodiment, the risk classification standard is as follows: an abnormal score S in the range of 0 ≤ S < 0.60 is judged as "low risk," and the system treats it as a normal transaction and ignores it; an abnormal score S in the range of 0.60 ≤ S < 0.85 is judged as "medium risk," indicating that the transaction has suspicious characteristics but requires further analysis; an abnormal score S in the range of 0.85 ≤ S < 1.0 is judged as "high risk," representing that the transaction is highly likely to be a malicious attack or a serious abnormal event.
[0052] If the current transaction's risk level meets the traceability criteria, the traceability process is initiated. The traceability criteria are preset; in this embodiment, they are set to a risk rating of "medium risk and above." The traceability analysis process of this invention is as follows: Figure 3 As shown, this specifically includes stages two through five, as described below.
[0053] Taking a reentrancy attack event captured in this embodiment as an example, the system collected a transaction to be detected.
[0054] Tx anomaly In the data preprocessing and feature extraction stage, the model extracted the sender's address in the transaction, Addr. S Multidimensional feature display: Addr S This is a newly created address (account profile characteristic), with very few historical transactions, but on Tx anomalyA Gas Price (transaction execution feature) significantly higher than the current block average is set to ensure transactions are prioritized for packaging. After these numerical features are input into the trained semi-supervised anomaly detection model, the reconstruction error of the autoencoder part increases significantly, indicating that its behavior pattern deviates from the baseline distribution of normal users. Finally, the XGBoost classifier integrates the features from all dimensions and outputs an anomaly score P for the transaction. anomaly The value was 0.92 (greater than 0.85). Based on the above risk classification standards, the transaction was judged as "high-risk anomaly," triggering the subsequent source tracing analysis process.
[0055] Phase Two: Collecting information on abnormal transactions.
[0056] Collect complete information about the current transaction and enrich the data. The complete information includes the sender and receiver contracts, the functions called and their parameters, the events generated, and internal transactions. Data enrichment includes collecting historical transaction data, balance changes, first occurrence times, and the receiver's bytecode for both the sender and receiver. If the receiver has been verified, obtain the receiver's source code and ABI. The collected abnormal transaction information forms a sequence of abnormal transactions.
[0057] In this embodiment, a transaction Tx anomaly abnormal score P anomaly A value greater than 0.90 indicates a "high-risk anomaly" in the transaction, triggering a source tracing analysis process to extract complete Txanomaly information, specifically including: the address of the transaction initiator (attacker) marked as Addr. S The recipient's (victim's contract) address is marked as Addr. C The function Func called X The function is identified as `withdraw(uint256 amount)` (the withdrawal function) and its parameter `Params`. X Events generated X Internal Transactions (InternalTxs) X .
[0058] Data enrichment specifically includes collecting Addr S and Addr C Historical transaction data, balance changes, first appearance time, and whether it is associated with other known risky addresses are required; in addition, Address must be obtained. C If the bytecode has been verified, its source code and ABI are obtained. In this embodiment, querying historical on-chain data reveals that Addr S It is a new account created less than 24 hours ago, with no prior DeFi interaction records and only a small amount of ETH used to pay gas fees.
[0059] Phase 3: In-depth contract analysis.
[0060] This includes transaction chain tracing, fund flow tracing, and contract interaction analysis to identify key addresses in abnormal transaction sequences.
[0061] The transaction chain tracing constructs a local directed graph centered on the current abnormal transaction. Nodes in the graph represent account addresses (EOA or contract), and edges represent transactions or internal calls. Edge attributes include transaction time, value, and function call information.
[0062] The fund flow tracing includes source tracing and destination analysis. For anomalies involving fund transfers, the system recursively traces the direct and indirect source accounts of the funds, starting from the input party of the anomaly transaction. It identifies the initial fund injection point, key intermediary accounts (such as newly created accounts or accounts interacting with the mixing service), and analyzes the antecedent conditions or preceding transaction sequences that led to the anomaly.
[0063] Starting with the sender of the anomalous transaction, recursively trace the direct and indirect destinations of funds. Identify fund aggregation points, withdrawal addresses to exchanges, and paths to other DApps or cross-chain bridges. Analyze the potential cascading effects of the anomalous transaction or its impact on other contracts / accounts.
[0064] Optionally, review the feature vectors of the abnormal transaction in the first stage, especially those features that contribute significantly to the anomaly score, to provide initial direction for tracing the source. If the abnormal transaction sequence accesses external threat intelligence platforms, blacklist address databases, contract vulnerability databases, etc., compare the entities (addresses, contracts) involved in the abnormal transaction with the aforementioned external access objects to obtain additional clues.
[0065] Tx in this embodiment anomaly This is a suspicious large-scale transfer of funds. The initial investigation should trace it upstream to Addr. S Funding sources: Building on Addr S Starting with the fund inflow graph, tracing back N layers (setting N=5), we find Addr S The main funding came from a newly created address, Addr source new And Addr source new The funds also originated from a known coin mixing service address, Addr. mixer (e.g., Tornado Cash). This funding path (mixer → new address → attacker) conforms to typical characteristics of hackers concealing funds, increasing the likelihood of misdirection. S Suspiciousness of the behavior.
[0066] Then trace Tx downstream anomaly In this embodiment, the funds flow to Addr.dest : Build with Addr dest Starting with the outflow of funds, the same approach is to trace back N layers. This embodiment traces downstream Tx... anomaly A large sum of money was discovered to have been transferred to Addr dest After passing through two intermediary wallets, the money was finally transferred to the hot wallet address Addr of a well-known centralized exchange. exchange It is suspected that they are cashing out.
[0067] Optionally, based on the above analysis, the fund flow path of the current abnormal transaction sequence can be visualized: Addr mixer →Addr source new →Addr S Tx anomaly Addr dest →⋯→Addr exchange .
[0068] The contract interaction analysis first involves transaction trace analysis. Using tools such as `debug_traceTransaction` provided by the blockchain node, a detailed execution trajectory of the abnormal transaction at the Ethereum Virtual Machine (EVM) level is obtained, including each opcode, gas consumption, stack state, memory changes, and storage read / write operations. The complete function call stack during transaction execution is reconstructed, including external calls and internal contract message calls (CALL, DELEGATECALL, STATICCALL instructions). Changes in key state variables of relevant contracts before and after the abnormal transaction execution are tracked to determine if any unexpected state modifications occurred.
[0069] In this embodiment, the analysis conducted through this step revealed that in Addr S Call Addr C During the `withdraw` function, the program executes a transfer operation (CALL instruction), but at this time the contract's state variable (user balance) has not yet been updated (the `SSTORE` instruction is executed after the transfer). Before deducting the user balance, there exists a value for `Addr`. S The external call: attacher_contract.call.value(amount)(). Utilizing this gap, Addr S The fallback function is triggered, and Addr is called recursively again. C The `withdraw` function was used. Since the balance wasn't deducted, the second withdrawal was still successful. This process repeated multiple times until the contract funds were exhausted.
[0070] By combining the parameters and sequence recorded in the event log, we can verify whether the contract logic execution meets expectations and identify specific event sequences related to abnormal behavior. This embodiment observes that in a Tx... anomaly in, Addr C Multiple calls to Addr were generated S The Transfer event occurred, and the amount was inconsistent with expectations. The reconstructed contract interaction path and state changes were compared with known smart contract vulnerability patterns (such as reentrancy, integer overflow, access control flaws, etc.). For suspected reentrancy attacks, it was checked whether there were calls to external contracts preceding state updates, and whether these external calls could call back functions of the original contract. For flash loan attacks, it was analyzed whether profits were made in the atomic transactions of borrowing, executing a series of operations (such as manipulating oracles, arbitrage), and repayment.
[0071] Following the above process, deep contract analysis is performed on the abnormal transaction sequence to identify the key addresses of the abnormal transaction sequence. The set of key addresses identified in this embodiment includes: the attacker's address Addr that initiated the malicious call. S (Funding injection point and transaction initiation point), the attacked contract address (Addr) C (Vulnerability Trigger Point), Address associated with the coin mixing service that provides initial funds to attackers (Addr) source new and Addr mixer (The key intermediary account from which the funds originated), and the exchange's hot wallet address that ultimately received the stolen funds (Addr). exchange (Fund collection and withdrawal points). These addresses constitute the core entities for subsequent profiling analysis.
[0072] Phase 4: Entity profiling and behavioral pattern attribution.
[0073] In-depth account analysis: This involves creating comprehensive historical behavioral profiles of key source accounts, intermediary accounts, and target accounts identified during the tracing process. This includes transaction frequency, transaction amount, types of interactive contracts, gas usage habits, diversity of funding sources, and correlation with other known risk entities. Optionally, by analyzing the coordinated behavior of multiple suspicious accounts in terms of time, funds, and contract interactions, attempts can be made to identify potential attack groups or related criminal activities.
[0074] Preliminary attribution of attacker TTPs (Tactics, Techniques, and Procedures): Combining anomalous behavioral characteristics, fund flow patterns, and contract exploitation techniques, attempts are made to correlate attack behaviors with commonly used TTPs of known attack organizations or hacker groups in the knowledge base, providing a reference for threat intelligence accumulation and subsequent defense.
[0075] The knowledge base pre-loads features typical attack patterns extracted from historical security incidents, fingerprints of commonly used TTPs (transaction techniques) from known hacker groups (such as specific versions of coin mixing scripts and attack contract templates), and malicious entity tags. In this step, the system performs similarity retrieval and matching between the attacker behavior feature vector extracted in the current attribution phase and entries in the knowledge base. Through comparison, the system can quickly determine whether the current attack belongs to a variant of a known attack family or whether it was launched by a specific APT group, thereby achieving accurate characterization and attribution of the attack source and significantly reducing the difficulty of manual analysis.
[0076] Analyze whether a specific pattern exists in the sequence, including:
[0077] (1) Large sums of money are continuously collected and then transferred out (money laundering).
[0078] (2) Making calls to multiple DeFi protocols to achieve arbitrage (flash loan attack);
[0079] (3) Conduct continuous permission probing and exploratory attacks on the target account.
[0080] The specific judgment logic is as follows: For mode (1), the system analyzes whether the fund flow graph has a typical fan-in or fan-out structure and layered cleaning characteristics; for mode (2), it checks whether the transaction trace contains lending events, and whether it interacts with multiple different DeFi protocols in the same transaction and finally repays the loan; for mode (3), it detects whether there are multiple failed calls or extremely small non-functional transactions from the same source address within the time window before the abnormal transaction occurs. It should be noted that the specific modes are not limited to the above three, and this system supports expanding new attack mode rules by updating the knowledge base.
[0081] In this embodiment, Tx anomaly This was a successful reentrancy attack, and the specific manifestation of the associated entity profile is: Addr S The attacker created a profile and found that the address was newly created with very few historical transactions, only related to Addr. C The system interacts with only a few addresses used for fund transfers, and the Gas Price is typically set high to ensure priority execution of transactions, exhibiting characteristics of "high-frequency interaction, using high Gas Price to preemptively execute, and concealed fund sources." The system compares the execution trajectory of "external call first, then status update" with vulnerability patterns in the knowledge base. Through feature fingerprint matching, it confirms that this abnormal transaction is a typical re-entrancy attack.
[0082] Phase 5: Output the source tracing path diagram and source tracing report, and update the knowledge base.
[0083] The results of source tracing analysis (such as transaction chain diagrams, fund flow diagrams, contract call relationship diagrams, and key account profiles) are presented to security analysts in an interactive and easy-to-understand visualization. It supports operations such as graph zooming, panning, node / edge information querying, and path highlighting.
[0084] Automatically generate structured reports containing details of abnormal transactions, detection basis, source tracing analysis, estimated capital loss (if possible), relevant address and contract information, and suspected attack patterns.
[0085] New attack patterns and malicious entity signatures are added to the knowledge base of the attribution module, including verified attribution results and newly discovered attack patterns, malicious addresses, and other information. This information is used to optimize future detection models, enhance attribution rules, and share threat intelligence, thereby improving the efficiency and accuracy of future attribution efforts.
Claims
1. A method for tracing abnormal transactions in blockchain smart contracts, characterized in that, include: A semi-supervised model is established based on an autoencoder architecture. Multi-source heterogeneous blockchain data is collected to train the semi-supervised model, resulting in an abnormal transaction detection model. Real-time transaction data from the target blockchain platform is collected, preprocessed, and then input into the abnormal transaction detection model to obtain the risk rating of the current transaction. If the risk rating of the current transaction meets the preset traceability conditions, collect complete information about the current transaction and enrich the data to obtain an abnormal transaction sequence that includes the context information of the current transaction. Deep contract analysis is performed on the abnormal transaction sequence, including transaction chain tracing, fund flow tracing and contract interaction analysis, to identify key addresses in the abnormal transaction sequence; Based on key addresses, an attacker's entity profile is constructed and matched with an existing knowledge base to confirm the attack pattern of the current transaction. Based on the results of the deep contract analysis, a traceability path diagram is output, a structured report is generated, and the knowledge base is updated.
2. The abnormal transaction tracing method according to claim 1, characterized in that, The semi-supervised model includes an encoder and a classifier. The multi-source heterogeneous blockchain data is preprocessed to extract numerical features that effectively describe blockchain transactions and entity behavior. The training includes unsupervised pre-training of the encoder based on a large amount of unlabeled multi-source heterogeneous blockchain data, and semi-supervised optimization and calibration of the classifier by fusing a small amount of labeled multi-source heterogeneous blockchain data.
3. The abnormal transaction tracing method according to claim 2, characterized in that, The complete information includes: the sender of the transaction, the recipient contract, the function called and its parameters, the event generated, and the internal transaction; The data enrichment includes: collecting historical transaction data, balance changes, first occurrence time, and receiver's bytecode of the sender and receiver; if the receiver has been verified, then obtaining the receiver's source code and ABI.
4. The abnormal transaction tracing method according to claim 3, characterized in that, The transaction chain tracking includes: constructing a local transaction directed graph centered on the current transaction, where nodes are account addresses, edges are transactions or internal calls, and edge attributes include transaction time, value, and function call information.
5. The abnormal transaction tracing method according to claim 4, characterized in that, The fund flow tracking includes source tracing and destination analysis: The source tracing starts from the input party of the abnormal transaction and recursively traces the direct and indirect source accounts of the funds, identifies the initial fund injection point and key intermediate accounts, and analyzes the antecedent conditions or preceding transaction sequences that led to the abnormal transaction. The destination analysis starts from the output of the abnormal transaction and recursively traces the direct and indirect destination accounts of the funds, identifies the fund aggregation point, the withdrawal address flowing to the exchange, and the path to other DApps or cross-chain bridges, and analyzes the chain reaction that the abnormal transaction may trigger or the impact on other contracts / accounts.
6. The abnormal transaction tracing method according to claim 5, characterized in that, The contract interaction analysis includes: Perform trace analysis on the current transaction and use the tools of the blockchain node to obtain the detailed execution trajectory of the abnormal transaction at the Ethereum Virtual Machine level; Reconstruct the complete function call stack during the transaction execution process, including external calls and message calls between internal contracts; track the changes in key state variables of relevant contracts before and after the current transaction execution to determine whether there are any unexpected state modifications; By combining the parameters and order recorded in the event log, verify whether the execution of the contract logic meets expectations.
7. The abnormal transaction tracing method according to claim 6, characterized in that, The identification of key addresses in the abnormal transaction sequence includes: Based on the results of fund flow tracking, identify the initial fund injection point, key intermediary accounts, fund aggregation points, withdrawal addresses flowing to exchanges, and accounts involved in the path to other DApps or cross-chain bridges; the key intermediary accounts include newly created accounts and accounts that interact with the coin mixing service; Review the feature vectors of current transactions in the abnormal transaction detection model, and identify the addresses corresponding to the features that contribute significantly to the abnormal score; The entities involved in abnormal transactions are compared with external threat intelligence platforms, blacklist address databases, or contract vulnerability databases to identify known risky entity addresses.
8. The abnormal transaction tracing method according to claim 7, characterized in that, The confirmation of the current transaction attack mode includes: Create historical behavior profiles for key source accounts, intermediate accounts, and target accounts represented by key addresses in abnormal transaction sequences, including transaction frequency, transaction amount, type of interactive contract, gas usage habits, diversity of funding sources, and correlation with other known risk entities; Based on the behavioral patterns identified from the historical behavioral profiles, combined with abnormal behavioral characteristics, fund flow characteristics, and contract exploitation techniques, the patterns are matched with attack patterns in the existing knowledge base to analyze the attack patterns existing in the abnormal transaction sequences.
9. The abnormal transaction tracing method according to claim 8, characterized in that, The matching with existing knowledge bases includes: The identified behavioral patterns are associated with specific patterns, common TTP fingerprints, and malicious entity tags in the knowledge base. The specific patterns include continuously accumulating small amounts of funds and then transferring them out in large amounts, calling multiple DeFi protocols to achieve arbitrage, and continuously probing and testing the permissions of target accounts.
10. A blockchain smart contract abnormal transaction tracing system, characterized in that, include: An abnormal transaction detection module is used to build a semi-supervised model based on an autoencoder architecture, collect multi-source heterogeneous blockchain data to train the semi-supervised model, and obtain an abnormal transaction detection model; collect real-time transaction data of the target blockchain platform, preprocess it and input it into the abnormal transaction detection model to obtain the risk rating of the current transaction; The abnormal information collection and enrichment module is used to collect complete information of the current transaction and enrich the data when the risk level of the current transaction meets the preset traceability conditions, so as to obtain an abnormal transaction sequence including the current transaction context information. The deep contract analysis module is used to perform deep contract analysis on the abnormal transaction sequence, including transaction chain tracing, fund flow tracing and contract interaction analysis, to identify key addresses in the abnormal transaction sequence; based on the key addresses, an attacker entity profile is constructed and matched with the existing knowledge base to confirm the attack pattern of the current transaction; The tracing result output and update module is used to output a tracing path diagram based on the results of deep contract analysis, generate a structured report, and update the knowledge base.