A blockchain abnormal account detection method based on graph test time migration and graph motif

Abstract

The application provides a blockchain abnormal account detection method based on graph test time migration and graph motif, and the method comprises the following steps: acquiring transaction data of a target blockchain network, and constructing a target domain transaction graph with accounts as nodes and transactions as edges; performing graph motif extraction on the target domain transaction graph to obtain a graph motif set containing multiple three-element time sequence graph motifs; converting the graph motif set into graph motif features, and fusing the graph motif features with original node transaction features to obtain fused features; based on a pre-trained source domain graph neural network model, using the fused features, performing model adaptation on the target domain transaction graph through a graph test time migration method to obtain an adapted graph neural network model; and outputting an abnormal account identifier. The method can fully utilize the high-dimensional interaction feature information in the blockchain transaction graph, quickly and low-costly adapt to newly emerging abnormal patterns, and improve the performance and generalization ability of the detection method.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, specifically a blockchain abnormal account detection method based on graph time migration and graph schema. Background Technology

[0002] Blockchain networks, due to their openness and anonymity, are widely used in the cryptocurrency and financial fields. On mainstream blockchain networks, over a million transactions are created and processed daily. However, these characteristics also contribute to the emergence of illicit transactions, severely disrupting the normal financial trading market and posing challenges to regulatory agencies and institutions. Therefore, effectively identifying various abnormal behaviors on blockchain networks and labeling the relevant wallet nodes has become an important research topic.

[0003] Because transactions on blockchain networks naturally form graph data structures, mainstream research primarily models transactions as multi-edge graphs with accounts as nodes, aggregating transaction behavior features into the node graphs. Based on this, graph neural network methods, such as GCN (Graph Convolutional Network) and GraphSAGE (Graph Sample and Aggregate), are applied to classify nodes, achieving anomaly behavior identification and account detection on blockchain networks. However, these methods only focus on the transaction features of the account node itself and its neighbors, neglecting the high-dimensional interaction features between account nodes. Therefore, some transaction behavior pattern information in the blockchain network is not well utilized, leading to suboptimal identification results.

[0004] Meanwhile, blockchain networks are rife with diverse anomalous behaviors, with vastly different internal account interaction logics. Furthermore, due to offensive and defensive actions, these anomalous patterns change over time. Therefore, on the one hand, datasets and models built for a specific pattern struggle to adapt to different anomalous behaviors and emerging patterns; on the other hand, when new patterns appear, collecting data to build labeled datasets is extremely costly and time-consuming, posing further challenges to the detection of on-chain events.

[0005] Although existing graph node classification methods can achieve a certain level of detection effectiveness in detecting abnormal accounts in blockchain transaction networks, they still have the following main drawbacks: The model is strongly tied to the training data: Most existing methods only focus on the test accuracy after training on the same dataset, without considering the changes in patterns over time across events and due to attack and defense issues in real-world scenarios. This directly leads to the current methods being highly dependent on the complete training process, which can only be carried out after experts provide reliable labels, making it difficult to apply to the highly volatile on-chain supervision and early warning in real-world scenarios.

[0006] Lack of awareness of high-dimensional interaction features in transactions: Existing methods mainly rely on the design of graph neural networks (GNNs) for graph structure information. However, mainstream GNN methods focus primarily on pairwise connections between nodes, neglecting high-dimensional interaction features. As a result, in blockchain anomaly account detection scenarios, high-dimensional interaction features between accounts (such as multi-hop transactions and distributed transactions) are difficult for existing GNN methods to capture, making it impossible to utilize a large amount of useful information.

[0007] In summary, existing methods do not yet consider the variability of patterns and the utilization of high-dimensional interaction features in blockchain anomaly account detection scenarios. Therefore, there is an urgent need for a solution that can leverage the high-dimensional interaction features between account nodes to achieve cross-event and pattern transfer, thereby improving the generalization ability and detection performance of graph neural network-based solutions in blockchain anomaly account detection scenarios. Summary of the Invention

[0008] The existing methods addressed by this invention have not yet considered the variability of patterns and the utilization of high-dimensional interactive features in blockchain abnormal account detection scenarios.

[0009] To address the aforementioned issues, this invention provides a blockchain abnormal account detection method, apparatus, and electronic device based on graph test migration and graph schema.

[0010] In a first aspect, the present invention provides a blockchain abnormal account detection method based on graph test-time migration and graph schema, the method comprising: Obtain transaction data from the target blockchain network and construct a target domain transaction graph with accounts as nodes and transactions as edges; The target domain transaction graph is subjected to graph motif extraction to obtain a graph motif set containing multiple ternary time series graph motifs; The graph schema body set is converted into graph schema body features and fused with the original node transaction features to obtain fused features; Based on the pre-trained source domain graph neural network model, the fusion features are used to adapt the model on the target domain transaction graph through the graph test-time transfer method, resulting in an adapted graph neural network model. The adapted graph neural network model is used to detect anomalies in the account nodes of the target domain transaction graph and output anomaly account identifiers.

[0011] Optionally, graph motif extraction is performed on the target domain transaction graph to obtain a graph motif set containing multiple ternary time-series graph motifs, including: Sort the transaction data by timestamp to obtain the edge set; The edge set is subjected to repeated edge aggregation processing, which aggregates multiple transaction edges with the same source node and target node within a preset time window into an aggregated edge, forming an aggregated edge set; For each current edge in the aggregated edge set, within a forward sliding time window with its timestamp as the cutoff time, select a preset number of other aggregated edges; Traverse the combination of the current edge and other selected aggregated edges, and determine whether the current edge and two of the other aggregated edges can form a ternary time sequence graph module; Combinations that can form a ternary time series graph motif are added to the graph motif set.

[0012] Optionally, the repeated edge aggregation process includes: for each edge that has not been aggregated, adding it to the aggregated edge set, and within a preset aggregation time difference range, marking all edges with the same source node and target node as aggregated.

[0013] Optionally, the graph schema set is converted into graph schema features and fused with the original node transaction features to obtain fused features, including: Based on the graph schema set, count the role of each node in each ternary graph schema and generate a node-schema role counting matrix; The node-motif counting matrix is ​​mapped to a graph motif feature matrix using a learnable motif character representation matrix. The fused features are obtained by mapping and fusing the graph model feature matrix with the original node transaction feature matrix in the feature space.

[0014] Optionally, the fusion is achieved through a multilayer perceptron, including: The original node transaction feature matrix is ​​transformed by a linear layer and then added to the graph model feature matrix; The summation result is then input into a multilayer perceptron for nonlinear fusion to obtain the fused feature.

[0015] Optionally, the graph-time transfer learning method is implemented based on a teacher-student model framework, including: The pre-trained source domain graph neural network model is initialized as a teacher model and a student model, respectively; Based on the target domain transaction graph and the fusion features, calculate the predicted output of the student model; Calculate the teacher-student representation contrast loss based on the predicted output of the teacher model and the predicted output of the student model; Based on the student model's prediction output for different samples in the target domain transaction graph, calculate the inter-sample comparison loss; Based on a preset confidence sample screening threshold, confidence samples with confidence levels within a set range are selected. Based on the reliable samples, the student model is optimized using the overall loss consisting of the teacher-student representation contrast loss and the sample-to-sample contrast loss; The teacher model parameters are updated using the optimized student model parameters by employing the exponential moving average method. The process is repeated multiple times, and the final teacher model is used as the adapted graph neural network model.

[0016] Optionally, before computing the predicted output of the student model, the target domain transaction graph is augmented with random edge dropping to generate an enhanced view.

[0017] Optionally, the confidence sample screening threshold includes an upper confidence threshold and a lower confidence threshold, and samples with a confidence level lower than the lower threshold or higher than the upper threshold are masked in the loss calculation.

[0018] Secondly, embodiments of the present invention provide a blockchain abnormal account detection device based on graph test-time migration and graph schema, comprising: The graph construction module is used to obtain transaction data from the target blockchain network and construct a target domain transaction graph with accounts as nodes and transactions as edges. The module is used to extract graph motifs from the target domain transaction graph to obtain a graph motif set containing multiple ternary time series graph motifs. The feature fusion module is used to convert the graph model set into graph model features and fuse them with the original node transaction features to obtain fused features; The transfer adaptation module is used to adapt the pre-trained source domain graph neural network model to the target domain transaction graph using the fusion features and a graph test-time transfer method, thereby obtaining an adapted graph neural network model. An anomaly detection module is used to perform anomaly detection on account nodes in the target domain transaction graph using the adapted graph neural network model and output anomaly account identifiers.

[0019] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a communication interface, a memory, and a bus, wherein the processor, the communication interface, and the memory communicate with each other through the bus, and the processor can call logical instructions in the memory to execute the steps of the method provided in the first aspect.

[0020] Fourthly, embodiments of the present invention provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the blockchain abnormal account detection method based on graph-based test-time migration and graph schema as described in the first aspect.

[0021] The beneficial effects of the blockchain abnormal account detection method based on graph test-time migration and graph schema of the present invention are as follows: To address the issue that existing methods do not consider the variability of patterns and the utilization of high-dimensional interaction features in blockchain anomaly account detection scenarios, this method extracts high-dimensional interaction modal features from the interactions between account nodes. Then, using a graph-based time-of-use transfer method adapted to blockchain transaction characteristics, it efficiently transfers the effective knowledge learned in the source domain to the target domain with a small amount of unlabeled data. This effectively improves the feature utilization and adaptability of existing methods in blockchain anomaly account detection scenarios when faced with high-dimensional interaction patterns and newly emerging anomaly patterns. This method can fully utilize the high-dimensional interaction feature information in the blockchain transaction graph, quickly and cost-effectively adapt to newly emerging anomaly patterns, and improve the performance and generalization ability of the detection method. Attached Figure Description

[0022] Figure 1 This is a flowchart of the blockchain abnormal account detection method based on graph test-time migration and graph phasor in an embodiment of the present invention; Figure 2 This is a framework diagram of the blockchain abnormal account detection method based on graph test migration and graph schema in an embodiment of the present invention; Figure 3 This is a structural block diagram of a blockchain abnormal account detection device based on graph test migration and graph phasor in an embodiment of the present invention; Figure 4 This is a structural block diagram of the electronic device in an embodiment of the present invention. Detailed Implementation

[0023] To better understand the purpose, technical solution, and advantages of this application, the application is described and explained below in conjunction with the accompanying drawings and embodiments.

[0024] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0025] like Figure 1 and Figure 2 As shown in the figure, the blockchain abnormal account detection method based on graph test-time migration and graph schema provided in this embodiment of the invention has the following steps: S1. Obtain transaction data from the target blockchain network and construct a target domain transaction graph with accounts as nodes and transactions as edges; Specifically, suppose there is a graph in the source domain. GNN model trained on ,Right now ,in, For inclusion A graph node vector of a blockchain address. For inclusion The set of edges for each transaction, further, each edge is represented as a sequence of edges originating from the source node. Target node and timestamp The tuples formed, i.e. , Let be the feature matrix of the nodes, where For feature dimension, This is a vector consisting of the labels corresponding to the nodes in the source domain graph. These are the trainable parameters of the model. The goal is to build a graph-moment extraction algorithm. , with a in the test domain graph Up-transfer GNN model .

[0026] S2. Extract graph modules from the target domain transaction graph to obtain a graph module set containing multiple ternary time series graph modules; Graph motif extraction is performed on the target domain transaction graph to obtain a graph motif set containing multiple ternary time series graph motifs, including: Sort the transaction data by timestamp to obtain the edge set; The edge set is subjected to repeated edge aggregation processing, which aggregates multiple transaction edges with the same source node and target node within a preset time window into an aggregated edge, forming an aggregated edge set; For each current edge in the aggregated edge set, select a preset number of other aggregated edges within a forward sliding time window with its timestamp as the cutoff time; Iterate through the combinations of the current edge and other selected aggregated edges, and determine whether the current edge and two of the other aggregated edges can form a ternary time sequence graph module. Add combinations that can form a ternary time series graph motif to the graph motif set.

[0027] Furthermore, the repeated edge aggregation process includes: for each edge that has not been aggregated, adding it to the aggregated edge set, and within a preset aggregation time difference range, marking all edges with the same source node and target node as aggregated.

[0028] In this method, an efficient ternary temporal graph motif extraction algorithm is proposed. By introducing a sliding window mechanism and a repeated edge merging mechanism, the computational complexity challenge in traditional graph motif extraction algorithms is solved. Furthermore, by adding data structure optimization, the algorithm can be accelerated by parallel computing, further improving computational efficiency.

[0029] The overall algorithm flow is shown in the following example: Input: Transaction edge set ; Parameter: Time window Maximum number of edges Repeated edge aggregation threshold ; Output: Set of graph phantoms ; 1: Sort by transaction timestamp Transactions in the middle; 2: Initialize the empty graph module set ; 3: For each edge set The edge in ; 4: If it has not been aggregated, then put it into the edge set after aggregation. and the current edge and Nodes within the same range that share the same starting point (source node) and the endpoint (target node) The edges are marked as aggregated; 5: End the loop; 6: For each aggregation, the edge set is... The edge in ; 7: From the time window Sampling in descending order of time One transaction; 8: Initialize the current round diagram module set ; 9: Yes Each of them ; 10: Yes Each of them ; 11: If It can be used to form a graphic model; 12: Add the model to the current round of the model set. ; 13: End judgment; 14: End the loop; 15: Use the current round diagram model set Update the set of graph models ; 16: End the loop; 17: Return to the collection of graph models .

[0030] By designing a module extraction algorithm for blockchain transaction graphs, and employing a sliding window mechanism and edge aggregation optimization method, this algorithm achieves efficient extraction of ternary time-series transaction graph modules. The algorithm optimizes the solution of complex ternary time-series transaction graph modules into a series of linear permutations and combinations, and can reduce time requirements through parallel computation in applications.

[0031] S3. Convert the graph schema body set into graph schema body features and fuse them with the original node transaction features to obtain fused features; The graph schema body set is converted into graph schema body features, and then fused with the original node transaction features to obtain fused features, including: Based on the graph schema set, count the role of each node in each ternary graph schema and generate a node-schema role counting matrix; By utilizing a learnable motif character representation matrix, the node-motif character counting matrix is ​​mapped to a graph motif feature matrix; The graph model feature matrix and the original node transaction feature matrix are mapped and fused in the feature space to obtain the fused features.

[0032] Furthermore, fusion is achieved through a multilayer perceptron, including: The original node transaction feature matrix is ​​transformed by a linear layer and then added to the graph model feature matrix; The summation result is then input into a multilayer perceptron for nonlinear fusion to obtain the fused features.

[0033] Since graph model features and transaction features come from different feature spaces and have large dimensional differences, directly concatenating the features can lead to difficulties in the model in allocating information and dimensional weights between the two spaces. Therefore, this method introduces a graph model feature fusion module that performs feature fusion at the front end of the GNN.

[0034] First, the graph motif feature fusion module aggregates the graph motif set into a counting matrix. ,in represent The role of each node in a three-node graph model is defined by a matrix indicating the participation of each graph node in the graph model and the node's position. Then, the graph-motif feature fusion module introduces a learnable representation matrix oriented towards the graph-motif role. and the positional encoding matrix including the temporal and spatial positions of the phantom The learnable representation matrix updates the weights during downstream GNN learning, thus reflecting the knowledge the model acquires from graph motif features. The graph motif features are synthesized into a high-dimensional feature matrix that includes node motif count features, higher-order semantic features of the motif, and temporal position information features of nodes within the motif. .

[0035] Finally, the graph-moment feature fusion module maps graph-moment features and transaction features located in different feature spaces to the same space through linear layers and multilayer perceptrons, thereby enhancing the model's ability to understand features, i.e.: ; in, and These are learnable parameters in a linear layer. These are the original characteristics of the transaction. They will be used to replace the original transaction features and participate in the learning of the downstream GNN.

[0036] To address the need for fusing high-dimensional interactive graph motif features from existing transaction features, and to maintain compatibility with existing GNN methods, this application introduces a learnable graph motif feature fusion module attached to the front end of the GNN. This module utilizes the GNN and its internal learnable parameters to optimize a semantic representation for each motif and its internal nodes. This module is highly flexible, applicable to various GNN types, and enhances the semantic consistency of high-dimensional interactive graph motif features through learnable semantic representations, providing structural semantic anchors for subsequent transfer processing.

[0037] S4. Based on the pre-trained source domain graph neural network model, the model is adapted to the target domain transaction graph using the graph test-time transfer method by utilizing fusion features, thus obtaining the adapted graph neural network model. The graph-based time-of-trial transfer method is implemented based on a teacher-student model framework, including: The pre-trained source domain graph neural network model is initialized as a teacher model and a student model, respectively; Based on the target domain transaction graph and fusion features, the predicted output of the student model is calculated; Calculate the teacher-student representation contrast loss based on the predicted outputs of the teacher model and the student model. Based on the student model's predicted output for different samples in the target domain transaction graph, calculate the inter-sample comparison loss; Based on a preset confidence sample screening threshold, confidence samples with confidence levels within a set range are selected. By combining reliable samples, the student model is optimized using the overall loss consisting of teacher-student representation contrast loss and sample-to-sample contrast loss; The exponential moving average method is used to update the teacher model parameters using the optimized student model parameters. Repeat the iterations multiple times, and use the final teacher model as the adapted graph neural network model.

[0038] Before computing the predicted output of the student model, the target domain transaction graph is augmented with random edge dropping to generate an enhanced view.

[0039] The confidence sample screening thresholds include an upper confidence threshold and a lower confidence threshold. Samples with confidence scores below the lower threshold or above the upper threshold are masked in the loss calculation.

[0040] To better adapt to the test-time migration task of abnormal account detection methods on the blockchain, this method proposes a graph test-time migration module that combines the exponential moving average method and the sample contrast loss. The execution flow of this module is as follows: First, the pre-trained GNN is used on the test graph. Inference is performed on the above to obtain the model's confidence output for each node in the test graph as an outlier sample. This is used to calculate reliable samples: ; in, and Two hyperparameters are used to define the upper and lower bounds of the confidence level of the credible samples. Simultaneously, the GNN is replicated to obtain the teacher model. and student model .

[0041] Then, the model undergoes multiple rounds of optimization. In each round: first, random masking enhancement is applied to the test image. ; Then, the confidence scores of the teacher model and the student model for each node in the test graph as an outlier are calculated separately: ; And use this to calculate the test-time adaptation loss for this training: ; in, To define the hyperparameters of loss importance, The calculation model predicts the high-dimensional distance between the output vectors, while Calculate the distance between positive samples in the training samples, and finally optimize the student model based on the calculated loss value, and update the teacher model: ; in To define the hyperparameters for learning the momentum of the model, and These are teacher models and student model Model parameters.

[0042] Finally, the transferred teacher model This is the output of this module.

[0043] By proposing a graph-based time-of-test transfer learning method, two student models learn synchronously on the target domain, while a teacher model acquires target domain knowledge from the student model with minimal momentum. This ensures the preservation of source domain knowledge and the learning of target domain knowledge during the transfer process. Reasonable teacher-student representation contrast loss and target domain sample contrast loss are designed to optimize the model's efficiency in utilizing limited information. A reliable sample screening mechanism is combined to avoid contaminating the model with excessively high or low confidence samples, preventing overconfidence or noisy learning. This module effectively improves the model's transfer efficiency in unlabeled blockchain transaction data with limited target domains, ensuring that prior knowledge from the source domain is preserved while learning target domain knowledge, thus guaranteeing the effectiveness of model learning during the transfer process.

[0044] S5. Use the adapted graph neural network model to perform anomaly detection on account nodes in the target domain transaction graph and output anomaly account identifiers.

[0045] For example, the input is a target domain transaction graph to be detected (containing node features that incorporate graph schema features). The model performs inference calculations, calculates an "anomaly probability" score, compares the score with a preset judgment threshold, and marks accounts with scores higher than the threshold as "anomalies". An identifier containing all accounts marked as anomalies is generated and returned.

[0046] In summary, by combining graph time-transfer methods and graph schema features, the adaptability of existing blockchain anomaly account detection methods to new events and their ability to perceive high-dimensional structural features between transactions are enhanced. Specifically: This graph test-time transfer learning module innovatively incorporates the moving exponential averaging teacher-student method and contrastive loss as its foundational framework. Combined with contrastive loss, it establishes dual constraints—between distributions and between samples—to achieve efficient test-time transfer. Furthermore, by constructing upper and lower bounds for reliable samples, it avoids the inclusion of excessively high or low confidence samples in the optimization process during transfer, ensuring the model does not enter an overconfident state or become affected by noise, thus effectively improving transfer efficiency.

[0047] For blockchain transaction graph design, this method introduces a three-node graph schema design with temporal information covering three nodes, addressing common semantic patterns in blockchain transaction graphs. This allows high-dimensional interaction information around nodes to be embedded in node feature vectors and captured by downstream GNNs. Simultaneously, this method designs a module that fuses node transaction features and graph schema features. By embedding a globally learnable graph schema role representation matrix and feature space mapping mechanism, the semantic information of the graph schema can be globally shared in a unified space. Table 1. Post-transfer accuracy (metric: AUC-PRC) of different GNNs under direct transfer (Origin) and the graph-tested transfer method (Ours) of this application.

[0048] Table 2 Evaluation accuracy of different GNNs with original features (w / o motif) and graph motif feature enhancement (w / motif) (metric: AUC-PRC)

[0049] As shown in Tables 1 and 2, compared with the prior art, the blockchain abnormal account detection method based on graph test-time transfer and graph schema proposed in this application effectively solves key problems in the blockchain abnormal account detection scenario, such as the difficulty of the model to perceive high-dimensional interaction features, the strong binding between the trained model and the data, and the reliance on high-quality labeled data for transfer. It has the following significant technical advantages and effects: Enhancing the model's adaptability to new patterns: This method utilizes graph-time transfer learning to allow the model to transfer knowledge from the source domain to the target domain while retaining prior knowledge from the source domain. This enables the model to transfer quickly and efficiently in diverse scenarios, avoiding the problems of traditional methods that require complete training and rely on expensive labeled datasets. On datasets constructed from real-world blockchain anomalies—AlphaHomora (Alpha), CryptopiaHacker (Crypto), and PlusTokenPonzi (Plus)—the performance of the three GNN backbone networks, GCN, GraphSAGE (SAGE), and DGA-GNN (DGA), improved by 126%, 130%, and 105% respectively compared to before adaptation, significantly improving the model's recognition accuracy in the target domain.

[0050] Enhancing the model's ability to perceive structural information in blockchain transaction graph scenarios: To verify the enhancement effect of graph motif features in this method on the high-dimensional interaction features of blockchain transaction graphs, three real-world datasets and three GNN backbone networks were used. The strategies of retaining the original dataset transaction features and incorporating graph motif features were adopted respectively. The overall performance was improved to 105%, with the highest improvement exceeding 118%. This shows that the graph motif features in this method can effectively capture the high-dimensional interaction features in the blockchain abnormal account detection scenario and enhance the model's ability to perceive structural information.

[0051] Efficient Graph Module Extraction Algorithm: The proposed graph module extraction algorithm combines a sliding window mechanism and an edge aggregation optimization method to achieve efficient extraction on blockchain transaction graphs, reducing the algorithm complexity from full graph matching. Reduced to In a 48-thread parallel scenario, enabling two acceleration mechanisms reduces the average runtime by 461% compared to a single one, enabling graph models to be applied in blockchain abnormal account detection scenarios.

[0052] This invention also provides a blockchain abnormal account detection device based on graph test-time migration and graph schema. This device is used to implement the above-described method embodiments, and details already described will not be repeated. The terms "module," "unit," and "subunit" used below refer to combinations of software and / or hardware that perform a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation or a combination of software and hardware is also possible and contemplated.

[0053] like Figure 3 As shown, Figure 3 This is a structural block diagram of the blockchain abnormal account detection device based on graph test-time migration and graph schema in this invention. The device includes: Graph construction module 101 is used to obtain transaction data of the target blockchain network and construct a target domain transaction graph with accounts as nodes and transactions as edges; The motif extraction module 102 is used to extract graph motifs from the target domain transaction graph to obtain a graph motif set containing multiple ternary time series graph motifs. Feature fusion module 103 is used to convert the graph model set into graph model features and fuse them with the original node transaction features to obtain fused features; The transfer adaptation module 104 is used to adapt the pre-trained source domain graph neural network model to the target domain transaction graph using the fusion features and the graph test-time transfer method to obtain the adapted graph neural network model. The anomaly detection module 105 is used to perform anomaly detection on account nodes in the target domain transaction graph using the adapted graph neural network model and output anomaly account identifiers.

[0054] like Figure 4 As shown in the figure, an electronic device provided by an embodiment of the present invention includes: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute the following method: S1. Obtain transaction data from the target blockchain network and construct a target domain transaction graph with accounts as nodes and transactions as edges; S2. Extract graph modules from the target domain transaction graph to obtain a graph module set containing multiple ternary time series graph modules; S3. Convert the graph model body set into graph model body features, and fuse them with the original node transaction features to obtain fused features; S4. Based on the pre-trained source domain graph neural network model, the fusion features are used to adapt the model on the target domain transaction graph through the graph test-time transfer method to obtain the adapted graph neural network model. S5. Use the adapted graph neural network model to perform anomaly detection on the account nodes in the target domain transaction graph and output anomaly account identifiers.

[0055] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0056] This invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform the methods provided in the above embodiments.

[0057] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0058] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A blockchain abnormal account detection method based on graph test-time migration and graph schema, characterized in that, The method includes: Obtain transaction data from the target blockchain network and construct a target domain transaction graph with accounts as nodes and transactions as edges; The target domain transaction graph is subjected to graph motif extraction to obtain a graph motif set containing multiple ternary time series graph motifs; The graph schema body set is converted into graph schema body features and fused with the original node transaction features to obtain fused features; Based on the pre-trained source domain graph neural network model, the fusion features are used to adapt the model on the target domain transaction graph through the graph test-time transfer method, resulting in an adapted graph neural network model. The adapted graph neural network model is used to detect anomalies in the account nodes of the target domain transaction graph and output anomaly account identifiers.

2. The method according to claim 1, characterized in that, The target domain transaction graph is subjected to graph motif extraction to obtain a graph motif set containing multiple ternary time series graph motifs, including: Sort the transaction data by timestamp to obtain the edge set; The edge set is subjected to repeated edge aggregation processing, which aggregates multiple transaction edges with the same source node and target node within a preset time window into an aggregated edge, forming an aggregated edge set; For each current edge in the aggregated edge set, within a forward sliding time window with its timestamp as the cutoff time, select a preset number of other aggregated edges; Traverse the combination of the current edge and other selected aggregated edges, and determine whether the current edge and two of the other aggregated edges can form a ternary time sequence graph module; Combinations that can form a ternary time series graph motif are added to the graph motif set.

3. The method according to claim 2, characterized in that, The repeated edge aggregation process includes: for each edge that has not been aggregated, adding it to the aggregated edge set, and within a preset aggregation time difference range, marking all edges with the same source node and target node as aggregated.

4. The method according to claim 1, characterized in that, The graph schema set is converted into graph schema features and fused with the original node transaction features to obtain fused features, including: Based on the graph schema set, count the role of each node in each ternary graph schema and generate a node-schema role counting matrix; The node-motif counting matrix is ​​mapped to a graph motif feature matrix using a learnable motif character representation matrix. The fused features are obtained by mapping and fusing the graph model feature matrix with the original node transaction feature matrix in the feature space.

5. The method according to claim 4, characterized in that, The fusion is achieved through a multilayer perceptron, including: The original node transaction feature matrix is ​​transformed by a linear layer and then added to the graph model feature matrix; The summation result is then input into a multilayer perceptron for nonlinear fusion to obtain the fused feature.

6. The method according to claim 1, characterized in that, The graph-based time-of-use transfer method is implemented based on a teacher-student model framework, including: The pre-trained source domain graph neural network model is initialized as a teacher model and a student model, respectively; Based on the target domain transaction graph and the fusion features, calculate the predicted output of the student model; Calculate the teacher-student representation contrast loss based on the predicted output of the teacher model and the predicted output of the student model; Based on the student model's prediction output for different samples in the target domain transaction graph, calculate the inter-sample comparison loss; Based on a preset confidence sample screening threshold, confidence samples with confidence levels within a set range are selected. Based on the reliable samples, the student model is optimized using the overall loss consisting of the teacher-student representation contrast loss and the sample-to-sample contrast loss; The teacher model parameters are updated using the optimized student model parameters by employing the exponential moving average method. The process is repeated multiple times, and the final teacher model is used as the adapted graph neural network model.

7. The method according to claim 6, characterized in that, Before calculating the predicted output of the student model, the target domain transaction graph is augmented with random edge dropping to generate an enhanced view.

8. The method according to claim 6, characterized in that, The confidence sample screening threshold includes an upper confidence threshold and a lower confidence threshold. Samples with a confidence level lower than the lower confidence threshold or higher than the upper confidence threshold are masked in the loss calculation.

9. A blockchain abnormal account detection device based on graph test-time migration and graph schema, characterized in that, include: The graph construction module is used to obtain transaction data from the target blockchain network and construct a target domain transaction graph with accounts as nodes and transactions as edges. The module is used to extract graph motifs from the target domain transaction graph to obtain a graph motif set containing multiple ternary time series graph motifs. The feature fusion module is used to convert the graph model set into graph model features and fuse them with the original node transaction features to obtain fused features; The transfer adaptation module is used to adapt the pre-trained source domain graph neural network model to the target domain transaction graph using the fusion features and a graph test-time transfer method, thereby obtaining an adapted graph neural network model. An anomaly detection module is used to perform anomaly detection on account nodes in the target domain transaction graph using the adapted graph neural network model and output anomaly account identifiers.

10. An electronic device, characterized in that, Including memory and processor; The memory is used to store computer programs; The processor is configured to, when executing the computer program, implement the blockchain abnormal account detection method based on graph-based time-of-use migration and graph schema as described in any one of claims 1 to 8.

Images