A dual-view collaborative fusion method and system based on centrality features and high-order modules

Abstract

The application relates to a dual-view collaborative fusion method based on centrality features and high-order module bodies, which comprises the following steps: firstly, screening a key illegal module body set according to an original transaction network, and obtaining a module adjacency matrix according to the set; utilizing the centrality index of nodes and original node features, constructing a low-dimensional feature matrix, and then fusing the original adjacency matrix and the module adjacency matrix to generate node embedding for each node in the original graph; and finally, classifying the nodes in the original transaction network into legal nodes and illegal nodes through a random forest classifier. It can be seen that the application constructs a dual-view fusion model with topological-semantic alignment, and innovatively designs a parallel and hierarchical aggregation architecture to deeply couple low-order physical fund flow and high-order criminal semantics, so that deeper modeling of complex illegal transaction modes can be realized, and excellent performance can be achieved in standard scenes, and stronger structural robustness can be shown when facing noise interference and topological camouflage.

Description

Technical Field

[0001] This invention relates to the fields of graph data processing, machine learning and information security technology, and to a dual-view collaborative fusion method and system based on centrality features and higher-order motifs. Background Technology

[0002] In recent years, with the rapid development of information technology, the analysis of complex network data has become a key means of uncovering potential value and identifying risks and threats. However, in many network environments, various illegal behaviors continue to exist and evolve, posing a serious challenge to traditional detection methods.

[0003] Against this backdrop, the detection of illicit activities on blockchain transaction networks constitutes a crucial and urgent application branch. As the core paradigm of distributed ledger technology, blockchain, through cryptographic encryption and distributed consensus mechanisms, enables peer-to-peer value transfer without the need for trusted third-party intervention, and has achieved large-scale applications in cryptocurrencies, decentralized finance, non-fungible tokens, and supply chain traceability. However, its inherent characteristics of anonymity, cross-border nature, and irreversible transactions make it fertile ground for illegal activities such as money laundering, ransomware payments, illegal dark web transactions, and fraudulent token issuance. More seriously, criminals continuously iterate their evasion strategies, using complex methods such as coin mixing services, cross-chain bridging, and flash loan arbitrage to split and disguise fund flows, causing traditional detection methods based on rules or shallow statistical features to gradually become ineffective. Therefore, there is an urgent need to construct blockchain illicit transaction detection models that combine accuracy and robustness.

[0004] However, existing methods, particularly those based on expert-defined heuristics, traditional machine learning models, and graph neural networks, have two main limitations when capturing complex patterns of illegal behavior:

[0005] First, there is insufficient awareness of higher-order modalities. Complex illegal acts are not simply the sum of isolated behaviors, but rather organized behaviors achieved through various higher-order collaborative patterns. These patterns are essentially network modalities that satisfy certain illegal transactions, and are key information for distinguishing between legal and illegal behaviors. Their discriminative value far exceeds that of a single first-order direct behavioral relationship.

[0006] Second, the disconnect between feature processing and graph topology. The original features of nodes typically contain hundreds of statistical indicators, which are not only extremely high in dimensionality but also contain a large amount of spurious associations and task-irrelevant noise. Traditional feature processing methods struggle to address this issue due to their graph-irrelevant nature.

[0007] Furthermore, the classification mechanisms of existing graph deep learning models are not well-suited for illegal behavior detection scenarios. In these scenarios, the ratio of positive to negative samples is extremely skewed, and the feature distribution exhibits high nonlinearity. Most existing models use simple fully connected layers to complete the final classification without optimizing for the specific characteristics of the scenario. This causes the end-to-end training of traditional graph neural networks to suffer from oversmoothing or vanishing gradient problems, resulting in convergence of embedded features among different types of nodes and weakening the model's ability to fit complex features.

[0008] It is evident that, whether for the specific scenario of detecting illegal blockchain transactions or extended to the broader task of complex network analysis, a common core technical problem lies in how to design a general graph analysis framework that can explicitly and collaboratively integrate the global topological importance (centrality feature) of nodes with local complex interaction patterns (higher-order motifs) to break through the bottlenecks of existing methods in feature utilization and integration, and achieve more accurate and robust node classification. Summary of the Invention

[0009] To address the limitations of existing detection models in their ability to perceive the structural semantics of higher-order motifs and the representational distortions caused by traditional feature processing methods often being independent of graph topology, this invention provides a dual-view collaborative fusion method and system based on centrality features and higher-order motifs. The aim is to construct a unified analytical framework capable of collaboratively mining higher-order illicit transaction motifs from data and utilizing graph topological centrality to guide the selection of key features, thereby achieving accurate illicit transaction detection. Furthermore, the technical solution of this invention can be applied to technical scenarios involving node classification, anomaly identification, and illegal behavior analysis in complex relational networks.

[0010] On the one hand, according to the design scheme provided by the present invention, a dual-view collaborative fusion method and system based on centrality features and higher-order motifs is provided, including the following:

[0011] Step 1: Obtain the original transaction network, determine the original graph based on the original transaction network, select the candidate motif set from the original graph, process all candidate motifs separately using the enrichment score analysis method to obtain the key illegal motif set, and construct the motif adjacency matrix based on the key illegal motif set;

[0012] Step 2: Extract the original node features from the original graph, calculate the centrality index of all nodes in the original graph using the centrality metric method, combine the centrality index of each node with the original node features to obtain the global importance weight of each feature, and construct a low-dimensional feature matrix based on the global importance weight of each feature.

[0013] Step 3: Based on the low-dimensional feature matrix, fuse the information of the original adjacency matrix and the modal adjacency matrix, and generate node embeddings for each node in the original graph through feature parallel aggregation or feature hierarchical enhancement strategies; the original adjacency matrix is ​​directly obtained from the original transaction network;

[0014] Step 4: Input all node embeddings into a single random forest classifier to classify the nodes in the original transaction network into legitimate nodes and illegitimate nodes.

[0015] Furthermore, the step of selecting a candidate motif set from the original image includes:

[0016] Illegal association subgraphs and legal background subgraphs are constructed from the original graph. The target subgraphs selected from the illegal association subgraphs and legal background subgraphs are processed to obtain the motifs corresponding to all target subgraphs. A set of candidate motifs is selected based on the relationship of each motif in the illegal association subgraph.

[0017] Furthermore, the construction of the illegal association subgraph and the legal background subgraph from the original graph specifically includes:

[0018] The formal representation of the illegal association subgraph is as follows:

[0019]

[0020] The formal representation of the legal background subgraph is:

[0021]

[0022] in, This is the original image, and , and These represent the sets of illegal and legal nodes, respectively. For node set In the figure Induced subgraphs on; Representative node set Forward Jumpable Neighborhood ; It is a valid seed set, and ,and ;

[0023] The neighborhood The formal representation is as follows:

[0024]

[0025] in, Represents the node arrive The directed shortest path length.

[0026] Furthermore, the process of processing the target subgraphs selected from the illegal association subgraphs and the legal background subgraphs to obtain the modifiers corresponding to all target subgraphs specifically includes:

[0027] Select a target subgraph from the illegal associated subgraph and the legal background subgraph. Use an efficient neighborhood expansion sampling strategy guided by edges to extract weakly connected subgraphs in the target subgraph. The weakly connected subgraphs are the modules of the target subgraph. Repeat the selection of the target subgraph to obtain the modules corresponding to all target subgraphs.

[0028] Furthermore, the step of obtaining the phantoms corresponding to all target subgraphs also includes:

[0029] In the process of obtaining a motif, for a motif containing multiple nodes, a motif adjacency matrix is ​​constructed. By normalizing the motif to the smallest lexicographical order in the adjacency matrix sequence under all possible node permutations, a unique identifier for the isomorphic motif is achieved. This process is called the normalized signature of the motif.

[0030] The mold Standard signature The formal representation is as follows:

[0031]

[0032] Among them, for those containing Node motif Let its adjacency matrix be , for The set of all permutations of nodes, for any permutation The corresponding permutation matrix is ​​denoted as , This indicates matrix vectorization operations.

[0033] Furthermore, the enrichment score analysis method is used to process all candidate motifs separately to obtain a set of key illegal motifs, specifically including:

[0034] Based on the constructed set of candidate motifs, the total number of candidate motifs corresponding to a given candidate motif is calculated using the count values ​​of the candidate motifs in the corresponding target subgraphs. The forms of expression are as follows:

[0035]

[0036] in, For the set of candidate motifs, any candidate motif , For the target subgraph corresponding to the candidate phantom The count value in, and , This is an illegal associated subgraph. A valid background subimage;

[0037] Based on the total number of candidate motifs, calculate the normalized occurrence frequency of each candidate motif in the corresponding target subgraph. :

[0038]

[0039] in, The preset Laplace smoothing coefficient, This represents the total number of motif categories in the candidate motif set.

[0040] The enrichment score of the candidate motif is obtained based on the normalized occurrence frequency of the candidate motif in the corresponding target subgraph. :

[0041]

[0042] For each candidate motif, if the enrichment score of the candidate motif is greater than the threshold, the candidate motif is added to the set of key illegal motifs, thereby obtaining the complete set of key illegal motifs.

[0043] Furthermore, step 2 specifically includes:

[0044] A centrality vector is computed for all nodes in the original graph using a centrality metric.

[0045] Obtain the original feature matrix from the original image, and then perform Z-score standardization on the original feature matrix to obtain the standardized feature matrix;

[0046] On the standardized feature matrix, the global importance weight of each feature is calculated by weighting the absolute value of the feature and the centrality vector of each node. All features are then ranked, and the highest-ranking features are selected. We construct a low-dimensional feature matrix based on the features.

[0047] Specifically, the feature parallel aggregation strategy includes:

[0048] First-order topological neighborhood aggregation stage: Based on the original adjacency matrix, a first-order topological neighborhood is determined, and the previous layer embedding of the nodes in the first-order topological neighborhood is aggregated by mean to obtain the first-order neighborhood aggregation feature.

[0049] Higher-order motif neighborhood aggregation stage: Based on the motif adjacency matrix, higher-order motif neighborhoods are determined, and the previous layer embeddings of nodes in the higher-order motif neighborhoods are aggregated by mean to obtain higher-order motif neighborhood aggregation features.

[0050] Feature fusion stage: The previous layer embedding of the node is concatenated with the first-order neighborhood aggregation feature and the higher-order motif neighborhood aggregation feature. After linear transformation and activation function processing, the current layer node embedding is generated. After multiple iterations, parallel fused node embedding is generated.

[0051] Specifically, the feature hierarchy enhancement strategy includes:

[0052] Motif fusion stage: Based on the motif adjacency matrix, determine the higher-order motif neighborhood, perform mean aggregation on the previous layer embedding of the nodes in the higher-order motif neighborhood to obtain the higher-order motif neighborhood aggregation feature, fuse the higher-order motif neighborhood aggregation feature with the previous layer embedding of the node itself, and perform nonlinear integration through the fusion layer to generate the enhanced intermediate node embedding.

[0053] Global fusion stage: Based on the original adjacency matrix, a first-order topological neighborhood is determined. The previous layer embeddings of the nodes in the first-order topological neighborhood are aggregated by mean to obtain the first-order global aggregated features. The first-order global aggregated features are concatenated with the enhanced intermediate state node embeddings. After linear transformation and activation function processing, hierarchical enhanced node embeddings are generated.

[0054] On the other hand, the present invention also provides a dual-view collaborative fusion system based on centrality features and higher-order phantoms, comprising:

[0055] The high-order illegal motif enrichment mining module is used to obtain the original transaction network, determine the original graph based on the original transaction network, filter out the candidate motif set from the original graph, process all candidate motifs separately using the enrichment score analysis method to obtain the key illegal motif set, and construct the motif adjacency matrix based on the key illegal motif set.

[0056] The centrality-aware feature selection module is used to extract the original node features from the original graph, calculate the centrality index of all nodes in the original graph using the centrality measurement method, combine the centrality index of each node with the original node features to obtain the global importance weight of each feature, and construct a low-dimensional feature matrix based on the global importance weight of each feature.

[0057] Dual-view feature aggregation module: Based on the low-dimensional feature matrix, it fuses the information of the original adjacency matrix and the modal adjacency matrix, and generates node embeddings for each node in the original graph through parallel feature aggregation or hierarchical feature enhancement strategies; the original adjacency matrix is ​​directly obtained from the original transaction network;

[0058] The output module is used to input all node embeddings into a single random forest classifier, which then classifies the nodes in the original transaction network into legitimate and illegitimate nodes.

[0059] The beneficial effects of this invention are:

[0060] (1) Traditional methods rely on expert-defined rules to identify illegal patterns, which has limited generalization ability. However, the high-order illegal motif enrichment mining algorithm of this invention can automatically and efficiently mine discriminative high-order illegal motifs from massive transaction data. It provides the model with a key and accurate topological induction bias, enabling it to adaptively learn evolving crime patterns, greatly improving the adaptability and scalability of the method.

[0061] (2) By introducing a centrality-aware feature selection mechanism, this invention integrates the key topological prior knowledge of graph centrality into the feature processing flow. This can significantly reduce feature dimensions and improve computational efficiency while ensuring the retention of the most physically semantic information (such as the importance of nodes in the funding network), thus achieving a deep unification of feature information and graph structure semantics and enhancing the interpretability of the model.

[0062] (3) This invention constructs two dual-view aggregation architectures: parallel (CHIMSAGE-P) and hierarchical (CHIMSAGE-H), providing users with strategic choices. The CHIMSAGE-P architecture efficiently integrates the physical layer and the crime semantic view, ensuring both high performance and computational efficiency; the CHIMSAGE-H architecture achieves deeper feature interaction and more refined modeling through progressive enhancement and fusion. This flexibility enables this invention to adapt to application scenarios with different scales and real-time requirements.

[0063] (4) This invention does not directly embed graph neural networks for classification, but instead feeds them into ensemble classifiers such as random forests for final decision-making. This combination of deep representation and robust decision-making combines the powerful structural representation capabilities of graph neural networks with the excellent anti-overfitting and generalization capabilities of ensemble learning models, forming a more stable and reliable end-to-end detection solution.

[0064] (5) This invention not only provides a high-performance detection model, but its core components (such as automatically mined phantoms and centrality-screened features) all have clear physical or criminal semantics, providing analysts with clues to understand model decisions and enhancing the interpretability of the model, which is crucial in financial regulation and risk control practices. At the same time, the efficient feature selection and flexible architecture design provide solid technical support for deployment in actual large-scale, low-latency blockchain monitoring systems.

[0065] (6) By deeply fusing high-order topological semantics and dual-view features, this invention achieves detection accuracy exceeding existing state-of-the-art baselines on the publicly available benchmark dataset Elliptic++. In particular, the hierarchical architecture (CHIMSAGE-H) enables deeper modeling of complex illegal transaction patterns, not only performing excellently in standard scenarios but also exhibiting stronger structural robustness in the face of noise interference and topological camouflage, effectively solving the core challenges posed by high-dimensional noise and complex topology in blockchain transaction data. Attached Figure Description

[0066] Figure 1 This is one of the flowcharts illustrating a dual-view collaborative fusion method based on centrality features and higher-order motifs in an embodiment.

[0067] Figure 2 This is one of the schematic diagrams of the architecture of a dual-view collaborative fusion system based on centrality features and higher-order motifs in the embodiment;

[0068] Figure 3 This is a second schematic diagram of the architecture of a dual-view collaborative fusion system based on centrality features and higher-order motifs in an embodiment. Detailed Implementation

[0069] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0070] Example 1

[0071] In the detection of illicit blockchain transactions, the existing research paradigm has undergone a leapfrog evolution from heuristic rules to deep graph learning. Before the rise of graph neural network (GNN) technology, the core detection methods in this field relied on expert-driven feature engineering. This method used machine learning classifiers such as random forests and XGBoost to accurately identify illicit transaction nodes, becoming a typical example of early blockchain risk control based on traditional machine learning. However, such methods are not only costly in feature engineering, but also struggle to cope with the complex topological disguises constructed by criminals through coin mixing or multi-hop transfers. In recent years, GNNs have become mainstream due to their powerful data modeling capabilities, effectively capturing topological association information in transaction networks and significantly breaking through the performance bottlenecks of traditional methods. Early research mainly explored the application of GNNs in dynamic modeling and social attribute mining, verifying the huge potential of introducing graph structure information. As research deepened, a series of advanced specialized models for the financial security field were proposed. While achieving innovation, they also exposed limitations in adaptability to complex scenarios. These limitations include, firstly, the perception scope of most models is limited to local direct associations, only able to aggregate first-order neighborhood information, making it difficult to reach complex fund flow links spanning multiple hops; secondly, existing work still disagrees on handling the homogeneity and heterogeneity issues of graphs. Ultimately, the core bottleneck of existing methods lies in their failure to effectively model specific high-order structures strongly correlated with illicit transaction activities. Even MetaFraud-GNN, which attempts to introduce high-order information, focuses more on architectural adaptation in heterogeneous scenarios in its metagraph search mechanism, and has not yet optimized for the statistical enrichment of illicit motifs in isomorphic blockchain graphs, leaving room for further improvement.

[0072] At the feature level, the discriminative power of a feature directly determines the performance ceiling of a graph neural network. In the blockchain scenario, node features typically contain hundreds of statistical indicators and are accompanied by high-intensity noise. Current processing paradigms are mainly divided into two categories: dimensionality reduction and expansion, but both have the limitation of ignoring topological information. Traditional dimensionality reduction methods, such as principal component analysis or feature selection based on conditional mutual information, are widely used, but they are essentially graph-independent. These methods assume that samples are independent and identically distributed, ignoring the differences in the status of nodes in the network topology; for example, the feature importance of core hub nodes should be higher than that of edge nodes. To overcome the bottleneck of feature representation, researchers have proposed a feature expansion strategy, which involves concatenating account attributes into transaction features and combining persistent cohomology techniques to identify illegal transactions where the original features lack discriminative power. Furthermore, by extracting the abstract syntax graph and control flow graph of smart contracts, single features are expanded into structural semantic features containing data dependencies and execution paths to enhance the recognition effect in complex scenarios. Furthermore, researchers expanded features from the temporal and semantic dimensions, capturing short-term transaction burst patterns through n-gram time differences. After textualizing the transaction data, they extracted semantic associations using BERT and dynamically adjusted the transaction graph weights based on amount and time, effectively improving the model's F1 score for detecting blockchain phishing behavior. While this feature expansion strategy increases information content, blindly increasing feature dimensions in large-scale transaction networks inevitably introduces the curse of dimensionality and computational redundancy. In other words, the field of blockchain illicit transaction detection lacks a feature dimensionality reduction mechanism that can perceive the importance of graph topology, i.e., dynamically selecting the most structurally discriminative feature subset based on node centrality.

[0073] At the higher-order topological semantic level, the core limitation of standard graph neural networks in blockchain illicit transaction detection tasks lies in their insufficient ability to perceive higher-order topological structures. Most of these models rely on first-order topological information for feature aggregation, while complex financial crimes are not simply the superposition of direct transactions, but rather organized behaviors achieved through higher-order collaborative patterns such as fund aggregation, chain transfers, and cross-chain bridging. These structural patterns hidden in multi-hop links are the core semantic signals for identifying criminal networks, but they often exceed the receptive field of traditional graph neural networks. Therefore, accurate modeling of higher-order structures has become a key direction for overcoming detection performance bottlenecks. Although higher-order structure analysis has made significant progress in areas such as social networks, existing methods are difficult to directly transfer to blockchain scenarios. Since the expressive power of standard graph neural networks is limited by the upper limit of the Weisfeiler-Lehman test, introducing higher-order structures such as motifs, primitives, and hypergraphs has become the mainstream approach to improve the semantic perception ability of models. Although the above methods have achieved significant results in specific fields, they still have adaptability defects in blockchain illicit transaction detection tasks, including structural incompatibility and task irrelevance. From a structural perspective, existing high-order structural methods are mostly designed for social networks, focusing on reciprocal and closed topological patterns. However, blockchain transaction networks are essentially unidirectional and sparse graphs of fund flows, resulting in some classic motifs appearing very infrequently and lacking statistical significance. From a task adaptability perspective, illicit activities such as money laundering often exhibit non-general, proprietary structures, such as hierarchical stripping chains and decentralized convergence loops. Existing methods rely on expert experience to predefine general motif libraries, failing to capture these specific structures strongly correlated with financial crimes. In other words, how to automatically mine and utilize meaningful motifs highly adapted to illicit detection tasks from massive transaction data has become a crucial research gap that urgently needs to be filled.

[0074] Based on the above, addressing the lack of a feature dimensionality reduction mechanism capable of perceiving graph topological importance and the problem of automatically mining and utilizing meaningful motifs highly adapted to the illegal transaction detection task in blockchain, this invention provides a dual-view collaborative fusion method based on centrality features and higher-order motifs, such as... Figure 1 As shown, it includes:

[0075] S101. Obtain the original transaction network, determine the original graph based on the original transaction network, select a candidate motif set from the original graph, process all candidate motifs separately using the enrichment score analysis method, obtain a key illegal motif set, and construct a motif adjacency matrix based on the key illegal motif set.

[0076] Furthermore, the step of selecting a candidate motif set from the original image includes:

[0077] Illegal association subgraphs and legal background subgraphs are constructed from the original graph. The target subgraphs selected from the illegal association subgraphs and legal background subgraphs are processed to obtain the motifs corresponding to all target subgraphs. A set of candidate motifs is selected based on the relationship of each motif in the illegal association subgraph.

[0078] Furthermore, the construction of the illegal association subgraph and the legal background subgraph from the original graph specifically includes:

[0079] To quantitatively assess the association strength between the motif and illicit activities, two subgraphs were first constructed using the original transaction network. These subgraphs are comparable in topological scale but contrasting in node behavior; these are the illicit association subgraphs. With legal background subgraph Specifically, given a global transaction graph ,in and These represent the sets of illegal and legal nodes, respectively.

[0080] First, considering the crucial importance of the directionality of fund flows in blockchain transactions, a neighborhood concept oriented towards directed paths is defined. (Arbitrary set of nodes) Forward Jumpable Neighborhood , refers to from a set Starting from any node in the middle, along the transaction direction, passing through no more than The set of all nodes reachable in one step is formally defined as follows:

[0081] (1)

[0082] in, Represents the node arrive The directed shortest path length is designed to accurately capture the downstream flow of funds associated with the seed node.

[0083] Node set In the figure Inducer graph on, denoted as It contains All nodes and endpoints belong to All edges of the graph. Based on this, construct two subgraphs.

[0084] Specifically, constructing an illegal association subgraph includes:

[0085] The subgraph formed by illegal nodes and their neighbors is used as a sample for analyzing illegal patterns. Specifically, the illegal association subgraph... Defined as a set of illegal nodes and Jump Neighbor In the original image The induced subgraph generated above, i.e.

[0086] (2)

[0087] Specifically, constructing a legal background subgraph includes:

[0088] To ensure the fairness of the statistical comparison and eliminate scale bias caused by differences in the number of nodes, an undersampling strategy is used to construct a legitimate background subgraph for comparison. The core of this process lies in simulating the generation mechanism of illegal associated subgraphs. First, starting from all legal nodes... A valid seed set of the same size as the invalid node set is constructed by randomly sampling from the data. ,satisfy and Then, the same neighborhood expansion rule as the illegal association subgraph is applied to the legal seed set to generate a legal background subgraph:

[0089] (3)

[0090] By strictly controlling the seed set sizes of the two subgraphs to be equal and the expansion rules to be consistent, it is ensured that... and The comparability at the topological scale makes any significant differences in phantom distribution between the two attributable to the fundamentally different behaviors of their underlying nodes, thus providing a reliable benchmark for subsequent phantom enrichment analysis.

[0091] Furthermore, the step of processing the target subgraphs selected from the illegal association subgraphs and the legal background subgraphs to obtain the phantoms corresponding to all target subgraphs specifically includes: an efficient phantom sampling and graph normalization process.

[0092] Select a target subgraph from the illegal associated subgraph and the legal background subgraph. Use an efficient neighborhood expansion sampling strategy guided by edges to extract weakly connected subgraphs in the target subgraph. The weakly connected subgraphs are the modules of the target subgraph. Repeat the selection of the target subgraph to obtain the modules corresponding to all target subgraphs.

[0093] Specifically, in large-scale networks The time complexity of exact enumeration of node modules increases with The increase is exponential, especially when The computational cost is too high. Therefore, an efficient neighborhood expansion sampling strategy guided by edges is adopted, aiming to reduce the computational cost of finding the neighborhood. The time complexity of the node module is reduced to Levels, among which The sampling number is [number]. Graph normalization techniques are introduced to address graph isomorphism issues and ensure the accuracy of motif statistics. The specific steps are as follows:

[0094] In particular, efficient phantom sampling includes:

[0095] For the target subgraph First, randomly select an edge from its edge set. This serves as the initial anchor point to ensure the connectivity of the sampling starting point. Nodes are then collected. and Construct a candidate node set from all first-order neighbors .from Random selection Each node and the initial edge form a whole. Node set and extract its in The induced subgraphs in the model are used. Ultimately, only weakly connected subgraphs are retained as valid motif instances. (i.e., the motif) to ensure the integrity of the sampling structure and the semantic validity.

[0096] The step of obtaining the phantoms corresponding to all target subgraphs also includes:

[0097] In the process of obtaining a motif, for a motif containing multiple nodes, a motif adjacency matrix is ​​constructed. By normalizing the motif to be the one with the smallest lexicographical order in the adjacency matrix sequence under all possible node permutations, a unique identifier for the isomorphic motif is achieved. This process is called the normalized signature of the motif.

[0098] During the sampling process, isomorphic motifs with identical structures but different node numbers will be counted repeatedly, leading to significant statistical bias. Therefore, a standardized signature mechanism is used to achieve unique identification of isomorphic motifs.

[0099] For a containing Weakly connected modules of nodes Let its adjacency matrix be .definition for The set of all permutations of nodes, for any permutation The corresponding permutation matrix is ​​denoted as .

[0100] phantom Standard signature It is defined as the lexicographically smallest adjacency matrix sequence among all possible node permutations, i.e.:

[0101] (4)

[0102] in This represents a matrix vectorization operation. This mapping ensures that all isomorphic motif instances are uniquely mapped to the same canonical signature.

[0103] Furthermore, the enrichment score analysis method is used to process all candidate motifs separately to obtain a set of key illegal motifs, specifically including: enrichment score analysis and screening process.

[0104] Enrichment analysis aims to filter out those elements in illegal association subgraphs. Frequently appearing in legal background subgraphs The motif structure is relatively sparse. Through large-scale sampling and normalization, we first identify illegal association subgraphs. Obtain the phantom counting vector This vector, indexed by the canonical motif signature, records the corresponding motif in... The valid sample count value in the data. Based on Using non-zero indices, extract all unique canonical motifs that actually exist in illegal scenarios, and then construct a candidate motif set. .

[0105] To perform standardized comparisons across subgraphs, for any candidate motif... Record its position in the target subgraph. (in The count value in ) This value is the counting vector. The corresponding components in the subgraph. First defined in the subgraph. Total number of candidate phantoms sampled :

[0106] (5)

[0107] Based on this, candidate phantoms In subgraph Frequency of normalization in Defined as:

[0108] (6)

[0109] in This is a preset Laplace smoothing coefficient used to prevent numerical calculation errors caused by a certain motif not appearing in the subgraph. This represents the total number of motif categories in the candidate motif set.

[0110] Ultimately, candidate phantoms enrichment fraction Defined as the ratio of its normalized frequency in the illegal association subgraph to that in the legal background subgraph:

[0111] (7)

[0112] If enrichment score This indicates that the candidate motif structure exhibits significant statistical overexpression characteristics within illicit transaction networks, serving as a strong topological indicator for identifying organized blockchain-based illicit criminal activities such as money laundering and fund scrambling. Based on this evaluation metric, specific motif categories highly correlated with illicit activities can be accurately located from a massive number of candidate subgraphs. These enriched and validated motifs will serve as the foundation for constructing higher-order semantic views.

[0113] For each candidate motif, if the enrichment score of the candidate motif is greater than 1, then the candidate motif is added to the set of key illegal motifs, thereby obtaining the complete set of key illegal motifs.

[0114] Furthermore, S101 also includes: the process of constructing the motif adjacency matrix.

[0115] To transform the mined discrete phantoms into structured tensors that can be directly processed by graph neural networks, a phantom adjacency matrix was further constructed. Unlike the original adjacency matrix Only the direct fund flow between transactions is encoded; the module adjacency matrix The aim is to capture implicit connections between nodes based on higher-order co-occurrence relationships. Specifically, for the selected set of key illegal modalities, if the transaction node... and They jointly participated in the same illegal scheme (for example, both belonged to the same specific money laundering loop or were upstream of the same money laundering hub), just... Establish a connecting edge in the middle, that is ;otherwise In this way, nodes that might be geographically distant in the adjacency matrix but are logically closely related in the crime are brought closer together in the phantom view. The resulting phantom adjacency matrix... In effect, a "crime semantic network" was reconstructed, which is related to the original transaction network. This forms a complementary dual-view structure, which is applied together in subsequent S103, enabling the model to aggregate neighborhood information in parallel from both the physical flow of funds and potential crime associations.

[0116] S102. Based on the original node features in the original graph, calculate the centrality index of all nodes in the original graph using the centrality metric method. Combine the centrality index of each node with the original node features to obtain the global importance weight of each feature. Construct a low-dimensional feature matrix based on the global importance weight of each feature.

[0117] Furthermore, S102 includes: a process for quantifying the importance of nodes.

[0118] A centrality vector is computed for all nodes in the original graph using a centrality metric.

[0119] Specifically, the discriminative power of a feature is highly correlated with the importance of the network structure of the nodes it belongs to. Therefore, it is first necessary to accurately quantify the influence of each node in the graph. The centrality metric is treated as a configurable module, allowing the selection of the optimal metric based on different topological characteristics of the graph. In this invention, four widely used and conceptually complementary centrality metric methods are evaluated, each providing a unique perspective on the importance of nodes:

[0120] Degree Centrality:

[0121] This is the most direct indicator for measuring a node's local influence; it assesses its importance by quantifying the number of direct adjacencies between nodes. For any node in the graph... Its in-degree centrality Defined as the number of edges pointing to that node, based on the graph. adjacency matrix Its definition is as follows:

[0122] (8)

[0123] in It is a picture The total number of nodes in a directed graph is defined as follows: when there exists a path from node A to node B, the total number of nodes in the graph is determined by the number of nodes in the directed graph. Pointing to node When an edge is encountered, the elements in the adjacency matrix Otherwise, it is 0.

[0124] In blockchain transaction networks, a high in-degree node usually means that it is the convergence point of multiple fund flows, which is a key heuristic feature in identifying the core entities of illicit financial activities such as fund pool accounts.

[0125] Eigenvector Centrality:

[0126] This metric is based on a more recursive idea: the importance of a node depends on the importance of its neighboring nodes. It defines node centrality as the eigenvector associated with the principal eigenvalues ​​of the graph adjacency matrix. The core formula for eigenvector centrality is:

[0127] (9)

[0128] Wherein, the centrality vector It consists of the eigenvector centrality scores of all nodes. It is an adjacency matrix The largest eigenvalue.

[0129] This equation illustrates the centrality score of a node. It is proportional to the linear combination of the centrality scores of all its incoming neighbor nodes. Therefore, this metric can identify nodes that are pointed to by many high-importance nodes, thus effectively locating the core backbone members in illicit transaction networks.

[0130] PageRank centrality:

[0131] PageRank centrality provides a global perspective for assessing node influence. This centrality metric evaluates node importance by simulating the influence propagation process in a network, considering both the quantity and quality of connections. (Node's PageRank score) It can be calculated using the following iterative formula:

[0132] (10)

[0133] in, It is a node The set of neighbors, It is a node The degree of exit, This is the damping coefficient, usually set to 0.85. It represents the total number of nodes in the network.

[0134] In blockchain transaction networks, PageRank's global influence assessment feature can accurately locate core transit nodes across multiple transactions. This is a key metric with global reference value when identifying hub accounts that connect various transactions in illicit financial networks.

[0135] Katz centrality:

[0136] Katz centrality evaluates node importance by weighting the counts of all paths in the network. Its core mechanism involves applying an exponential decay to the contribution of long paths and assigning a base offset to each node, thereby comprehensively assessing its global influence. This method effectively handles weakly connected networks, balancing the impact of local connectivity and global propagation, and possesses both computational stability and scenario adaptability. The Katz centrality is defined as follows:

[0137] (11)

[0138] in, This represents the total number of nodes in the graph. It is an adjacency matrix elements, Let be the attenuation coefficient, satisfying , It is an adjacency matrix The largest eigenvalue is used to ensure computational convergence. This is an offset term used to assign a fixed basic importance to each node.

[0139] In blockchain transaction networks, this mechanism can identify the core of direct transactions related to short paths, while also preserving the signals of key transit nodes for multi-hop transactions in long paths, providing a more comprehensive dimension for topological importance assessment.

[0140] By selecting a centrality metric A centrality vector can be calculated for all nodes in the graph. This quantifies the topological importance of each node, providing a core basis for the allocation of feature weights for centrality perception.

[0141] Further, S102 includes: a process for calculating the feature weights of centrality perception.

[0142] Obtain the original feature matrix from the original image, and then perform Z-score standardization on the original feature matrix to obtain the standardized feature matrix;

[0143] On the standardized feature matrix, the global importance weight of each feature is calculated by weighting the absolute value of the feature and the centrality vector of each node. All features are then ranked, and the highest-ranking features are selected. We construct a low-dimensional feature matrix based on the features.

[0144] Specifically, this section aims to calculate a global importance weight for each feature to reflect its overall discriminative power at key topological nodes. However, raw features in blockchain transaction data generally suffer from inconsistent dimensions and large numerical ranges. For example, the transaction amount of a transaction node may reach tens of thousands, while the number of transaction inputs and outputs may only be in the single digits. Without preprocessing, features with larger numerical values ​​will dominate the weight calculation, thus masking the true contribution of other features that may be structurally more discriminative.

[0145] To ensure that all features participate in the weight evaluation on a fair scale, the original feature matrix is ​​first sorted column-wise before calculating the weights. Perform Z-score standardization to obtain the standardized feature matrix. For the feature matrix Any feature column in The standardized result The formula for calculating each element in the formula is as follows:

[0146] (12)

[0147] in, It is a node In features The original value on, and These are features The mean and standard deviation across all nodes. Through this transformation, all features are converted to a standard distribution with a mean of 0 and a standard deviation of 1. This not only eliminates the difference in dimensions but also improves the convergence efficiency and stability of the subsequent model optimization process.

[0148] In the standardized feature matrix Based on this, the first Global importance weights of each feature Defined as the weighted sum of the absolute values ​​of the features of each node and their centrality index, its formal expression is as follows:

[0149] (13)

[0150] in, For the j-th feature of the i-th node, Let be the centrality vector of the i-th node.

[0151] Further, step S102 includes: feature sorting and selection to construct a dimensionality-reduced feature matrix.

[0152] Calculate the weight vector of all features Then, sort them in descending order and select the highest-ranked ones. These features are used to construct the final dimensionality-reduced feature matrix. .

[0153] S103. Based on the low-dimensional feature matrix, the information of the original adjacency matrix and the modal adjacency matrix are fused, and node embeddings are generated for each node in the original graph through feature parallel aggregation or feature hierarchical enhancement strategies; the original adjacency matrix is ​​directly obtained from the original transaction network.

[0154] Furthermore, the feature parallel aggregation strategy includes: the CHIMSAGE-P (Parallel) strategy, which is a parallel fusion strategy of first-order topology and higher-order motif information.

[0155] First-order topological neighborhood aggregation stage: First-order topological neighborhood is determined based on the original adjacency matrix. Mean aggregation is performed on the previous layer embedding of the nodes in the first-order topological neighborhood. When calculating the first layer, the nodes in the neighborhood adopt the initial low-dimensional features to obtain the first-order neighborhood aggregation features.

[0156] Higher-order motif neighborhood aggregation stage: Based on the motif adjacency matrix, higher-order motif neighborhoods are determined. The previous layer embeddings of the nodes in the higher-order motif neighborhoods are aggregated by mean. When calculating the first layer, the nodes in the neighborhoods use the initial low-dimensional features to obtain the higher-order motif neighborhood aggregation features.

[0157] Feature fusion stage: The previous layer embedding of the node is concatenated with the first-order neighborhood aggregation feature and the higher-order motif neighborhood aggregation feature. After linear transformation and activation function processing, the current layer node embedding is generated. After multiple iterations, parallel fused node embedding is generated.

[0158] Research shows that combining feature representations of different motifs by splicing injective functions can significantly improve the ability of GNNs to distinguish higher-order structures. Based on this, the CHIMSAGE-P strategy employs a dual-channel parallel aggregation strategy, aiming to process the physical fund flow topology represented by the adjacency matrix and the potential illegal transaction association structure represented by the motif adjacency matrix in parallel.

[0159] Specifically, in the CHIMSAGE-P strategy, nodes Embedded The update process is expanded into three parts:

[0160] Part 1: First-order Topological Neighborhood Aggregation

[0161] In the original adjacency matrix Aggregate first-order neighbor features, and then perform first-order topological neighborhood analysis. The previous layer of embedding performs mean aggregation to capture direct fund transaction patterns, i.e.

[0162] (14)

[0163] in Represents the mean aggregation function. It is a node In the Layer from adjacency matrix First-order topological neighborhood defined in The node embeddings obtained from aggregation.

[0164] Part Two: Neighborhood Aggregation of Higher-Order Motifs

[0165] In the adjacency matrix of the motif Aggregate the features of the motif neighbors, and then analyze the neighborhoods of higher-order motifs. The previous layer of embedding is used for mean aggregation to extract higher-order collaborative fraud patterns, namely...

[0166] (15)

[0167] in It is a node In the Layers are derived from the adjacency matrix of the motifs. The motif neighborhood defined in The node embeddings obtained from aggregation.

[0168] Part Three: Feature Fusion

[0169] Embed the node's own upper layer First-order topological neighborhood aggregation embedding Aggregation and embedding with the neighborhood of higher-order motifs Nodes are generated by splicing, linear transformation, and activation function. The current layer embedding ,Right now

[0170] (16)

[0171] in It is a learnable weight matrix for the fusion stage to ensure that the three types of information are effectively integrated.

[0172] The CHIMSAGE-P strategy employs a parallel aggregation mechanism, using the original adjacency matrix (directly obtained from the original transaction network) and the motif adjacency matrix as dual-view inputs. Based on the low-dimensional feature matrix, it simultaneously aggregates the first-order physical fund flow association information of nodes associated with the original adjacency matrix and the high-order illegal semantic association information of nodes associated with the motif adjacency matrix. This is then concatenated with the initial low-dimensional features of the nodes and subjected to a linear transformation to generate the node embedding process. This process achieves complementarity while preserving the independence of first-order transaction and high-order motif information, making it particularly suitable for feature distributions in blockchain scenarios where direct transactions and collaborative fraud coexist. The core assumption of this architecture is that by providing the model with a parallel view specifically for processing high-order associations, the model can autonomously learn the complementary relationship between topological and motif information.

[0173] Furthermore, the feature hierarchical enhancement strategy includes: the CHIMSAGE-H (Hierarchical) strategy, which is a hierarchical fusion strategy with feature enhancement.

[0174] Motif fusion stage: Based on the motif adjacency matrix, determine the higher-order motif neighborhood, perform mean aggregation on the previous layer embedding of the nodes in the higher-order motif neighborhood, use the initial low-dimensional features of the nodes in the neighborhood during the first layer calculation to obtain the higher-order motif neighborhood aggregation features, fuse the higher-order motif neighborhood aggregation features with the previous layer embedding of the node itself, and perform nonlinear integration through the fusion layer to generate the enhanced intermediate node embedding.

[0175] Global fusion stage: Based on the original adjacency matrix, a first-order topological neighborhood is determined. The previous layer embeddings of the nodes in the first-order topological neighborhood are aggregated by mean. When calculating the first layer, the nodes in the neighborhood use the initial low-dimensional features to obtain the first-order global aggregated features. The first-order global aggregated features are concatenated with the enhanced intermediate state node embeddings. After linear transformation and activation function processing, hierarchical enhanced node embeddings are generated.

[0176] The specific process of the CHIMSAGE-H strategy mainly includes two parts, as shown below:

[0177] Part 1: Local Fusion of Phantom Information

[0178] First, consider the neighborhood of the phantom. To obtain higher-level information, the CHIMSAGE-H strategy first combines the aggregated motif embedding with the node's previous-level embedding to obtain higher-level information. Unlike the CHIMSAGE-P strategy, which directly concatenates the three embeddings, the CHIMSAGE-H strategy first combines the aggregated motif embedding with the node's previous-level embedding. The system then fuses the intermediate states and performs nonlinear integration through a fusion layer to generate an enhanced intermediate embedding. This process can be described as follows:

[0179] (17)

[0180] in, It is the learnable weight matrix in the motif fusion stage. It is the key to realizing local feature enhancement. It is responsible for interacting and reducing the dimensionality of the node's own first-order features and the higher-order structural features of the motif in the feature space, and realizing the deep collaboration of the two types of information through nonlinear transformation.

[0181] Part Two: Global Topology Aggregation

[0182] Based on enhanced node embedding The model then uses it to analyze the first-order topological neighborhood. The aggregation process is performed to ultimately generate the embedding for the current layer. This process can be described as follows:

[0183] (18)

[0184] in, It is a learnable weight matrix in the global fusion stage. This matrix integrates local enhancement features with first-order topological aggregation results, so that the final node representation contains both high-order motif semantics and global topological structure information.

[0185] As can be seen, the CHIMSAGE-H strategy, based on the aforementioned low-dimensional feature matrix, first aggregates the high-order illegal semantic association information of nodes associated with the motif's adjacency matrix and fuses it with the initial low-dimensional features of the nodes for enhancement. Then, it aggregates the first-order physical capital flow association information of nodes associated with the original adjacency matrix. Through a two-level hierarchical interaction, feature enhancement and transformation are completed, generating node embeddings.

[0186] S104. Input all node embeddings into a single independent random forest classifier to classify the nodes in the original transaction network into legitimate nodes and illegitimate nodes.

[0187] After completing the learning of node embeddings, the final layer of node embeddings generated by the two variant strategies of the CHIMSAGE strategy. The data will be uniformly input into a separate random forest classifier, and the final detection of illegal transactions will be completed through an integrated decision-making mechanism.

[0188] As can be seen, the technical solution of this invention can automatically and efficiently mine high-order illicit transaction modalities with discriminative power from massive transaction data. It addresses the key pain point of the disconnect between feature processing and graph structure semantics, and provides a flexible and efficient dual-view fusion architecture, possessing significant practical application value and a solid foundation for interpretability. The core components all have clear physical or criminal semantics, providing analysts with clues to understand model decisions and enhancing model interpretability, which is crucial in financial regulation and risk control practices. Simultaneously, the efficient feature selection and flexible architecture design provide robust technical support for deployment in large-scale, low-latency blockchain monitoring systems.

[0189] Example 2

[0190] On the other hand, the present invention also provides a dual-view collaborative fusion system based on centrality features and higher-order phantoms, comprising:

[0191] It is mainly divided into three modules: High-Order Illegal Motif Enrichment Mining Module (HIMEM), Centrality-Aware Feature Selection Module (CAFS), and Dual-View Feature Aggregation Module. For example... Figure 2 As shown.

[0192] First, the input raw network is processed by the High-Order Illegal Motif Enrichment Mining Module (HIMEM module), which constructs a high-order motif adjacency matrix through subgraph comparison and enrichment screening to capture potential semantic associations related to crime. Simultaneously, the Centrality-Aware Feature Selection Module (CAFS module) calculates node centrality using the original graph topology, using this as a priori guide for weighting and screening the original features to generate a low-dimensional, highly discriminative feature matrix. Subsequently, the dimensionality-reduced feature matrix is ​​input into the CHIMSAGE encoder, which employs a dual-view fusion mechanism, fusing the first-order adjacency matrix and the motif adjacency matrix to generate semantically rich node embeddings through feature enhancement and aggregation. Finally, the model constructs an ensemble decision module, which uses a random forest classifier to process the generated node embeddings to achieve accurate discrimination of illegal behavior.

[0193] The high-order illegal motif enrichment mining module is used to obtain the original transaction network, determine the original graph based on the original transaction network, select a candidate motif set from the original graph, process all candidate motifs separately using the enrichment score analysis method to obtain the key illegal motif set, and construct the motif adjacency matrix based on the key illegal motif set.

[0194] The High-Order Illegal Motif Enrichment Mining Module (HIMEM) utilizes a core idea: instead of using a fixed, universal motif library, HIMEM employs systematic statistical comparative analysis to automatically discover structural patterns that are significantly enriched in illegitimate transaction environments but relatively sparse in legitimate transaction environments. These discovered patterns are termed High-Order Illegal Motifs.

[0195] The centrality-aware feature selection module is used to extract the original node features in the original graph, calculate the centrality index of all nodes in the original graph using the centrality measurement method, combine the centrality index of each node with the original node features to obtain the global importance weight of each feature, and construct a low-dimensional feature matrix based on the global importance weight of each feature.

[0196] The core of the Centrality-Aware Feature Selection (CAFS) module lies in breaking through the limitations of the traditional graph-independent paradigm by introducing the topological importance of nodes as a key inductive bias into the feature ranking process. CAFS's core assumption is that the true importance of a feature is highly correlated with its ability to distinguish key nodes at the topological level. Based on this assumption, CAFS incorporates node centrality indicators into the feature weight evaluation mechanism, prioritizing features that effectively characterize high-influence nodes (such as illicit fund pool accounts or core nodes of coin mixing services) rather than features that only manifest on isolated nodes at the network edge.

[0197] The dual-view feature aggregation module is used to fuse the original adjacency matrix and the modal adjacency matrix information based on the low-dimensional feature matrix, and generate node embeddings for each node in the original graph through parallel feature aggregation or hierarchical feature enhancement strategies; the original adjacency matrix is ​​directly obtained from the original transaction network.

[0198] The core innovation of the dual-view feature aggregation module lies in effectively utilizing the illegal motif information mined through the HIMEM model and improving the expressive power of GraphSAGE. It proposes two graph neural networks capable of fusing high-order information from the motif adjacency matrix. A schematic diagram is shown below. Figure 3 As shown.

[0199] First, a CHIMSAGE-P variant was proposed. This model employs a dual-channel parallel aggregation strategy, aiming to process the physical fund flow topology represented by the adjacency matrix and the potential illicit transaction association structure represented by the module adjacency matrix in parallel.

[0200] The CHIMSAGE-P model establishes a basic paradigm that combines higher-order motif information with first-order topological information. To fully explore the deep interaction between higher-order motif information and first-order topological information and enhance their information synergy effect, the CHIMSAGE-H variant is further proposed.

[0201] The core innovation of the CHIMSAGE-H model lies in the introduction of a feature enhancement mechanism with learnable transformations, constructing a hierarchical fusion process based on two stages: motif fusion and global fusion. The first stage performs motif fusion, aggregating and transforming features corresponding to motif subgraphs to achieve semantic enhancement of node features. The second stage performs global fusion, globally aggregating the enhanced features from motif fusion with topological neighborhood features, thereby achieving progressive collaboration between the two types of information and forming more discriminative node embeddings.

[0202] The output module is used to embed all nodes into a single random forest classifier, which then classifies the nodes in the original transaction network into legitimate and illegitimate nodes.

[0203] By designing the High-Order Illegal Motif Enrichment Mining Module HIMEM, the Centrality-Aware Feature Selection Module CAFS, and the Dual-View Feature Aggregation Module, this invention can achieve the following:

[0204] First, we proposed the High-Order Illegal Module Enrichment Mining (HIMEM) algorithm. This algorithm overcomes the limitations of traditional methods that rely on predefined general modules and proposes a data-driven mining model that can automatically discover and extract high-order illegal transaction patterns (such as money laundering loops and decentralized-convergent structures) with significant statistical enrichment from massive transactions, providing the model with a highly interpretable structural prior.

[0205] Second, a centrality-aware feature selection (CAFS) mechanism was designed. Addressing the high-dimensional noise problem in blockchain transaction data, this mechanism innovatively utilizes graph topological centrality indices to guide feature dimensionality reduction, overcoming the graph-independent nature of traditional feature selection methods. This significantly reduces computational complexity while substantially improving the signal-to-noise ratio of key features.

[0206] Third, a dual-view fusion model with topological and semantic alignment and a cascaded integrated detection strategy were constructed. This model innovatively designed two variants of feature aggregation: parallel and hierarchical, achieving deep coupling between low-order physical fund flow information and high-order criminal semantic information, which significantly enhances the model's ability to represent and capture complex money laundering patterns.

[0207] Fourth, it achieves state-of-the-art (SOTA) performance in illegitimate transaction detection. Extensive experiments on the widely used real-world blockchain transaction dataset Elliptic++ demonstrate that CHIMSAGE achieves significant advantages in illegitimate transaction detection tasks, especially outperforming existing state-of-the-art baseline models in key metrics such as F1 score, proving the model's effectiveness and robustness in illegitimate transaction detection scenarios.

[0208] It should be noted that the dual-view collaborative fusion system based on centrality features and higher-order phantoms provided in this embodiment of the invention is to implement the above method embodiment, and its specific functions can be referred to the above method embodiment.

[0209] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dual-view collaborative fusion method based on centrality features and higher-order motifs, characterized in that, Include: Step 1: Obtain the original transaction network, determine the original graph based on the original transaction network, select the candidate motif set from the original graph, process all candidate motifs separately using the enrichment score analysis method to obtain the key illegal motif set, and construct the motif adjacency matrix based on the key illegal motif set; Step 2: Extract the original node features from the original graph, calculate the centrality index of all nodes in the original graph using the centrality metric method, combine the centrality index of each node with the original node features to obtain the global importance weight of each feature, and construct a low-dimensional feature matrix based on the global importance weight of each feature. Step 3: Based on the low-dimensional feature matrix, fuse the information of the original adjacency matrix and the modal adjacency matrix, and generate node embeddings for each node in the original graph through feature parallel aggregation or feature hierarchical enhancement strategies; the original adjacency matrix is ​​directly obtained from the original transaction network; Step 4: Input all node embeddings into a single random forest classifier to classify the nodes in the original transaction network into legitimate nodes and illegitimate nodes.

2. The dual-view collaborative fusion method based on centrality features and higher-order motifs according to claim 1, characterized in that, The process of selecting a set of candidate phantoms from the original image includes: Illegal association subgraphs and legal background subgraphs are constructed from the original graph. The target subgraphs selected from the illegal association subgraphs and legal background subgraphs are processed to obtain the motifs corresponding to all target subgraphs. A set of candidate motifs is selected based on the relationship of each motif in the illegal association subgraph.

3. The dual-view collaborative fusion method based on centrality features and higher-order motifs according to claim 2, characterized in that, The construction of illegal association subgraphs and legal background subgraphs from the original graph specifically includes: The formal representation of the illegal association subgraph is as follows: The formal representation of the legal background subgraph is: in, This is the original image, and , and These represent the sets of illegal and legal nodes, respectively. For node set In the figure Induced subgraphs on; Representative node set Forward Jumpable Neighborhood ; It is a valid seed set, and ,and ; The neighborhood The formal representation is: in, Represents the node arrive The directed shortest path length.

4. The dual-view collaborative fusion method based on centrality features and higher-order motifs according to claim 2, characterized in that, The process of processing the target subgraphs selected from the illegal association subgraphs and the legal background subgraphs to obtain the modifiers corresponding to all target subgraphs specifically includes: Select a target subgraph from the illegal associated subgraph and the legal background subgraph. Use an efficient neighborhood expansion sampling strategy guided by edges to extract weakly connected subgraphs in the target subgraph. The weakly connected subgraphs are the modules of the target subgraph. Repeat the selection of the target subgraph to obtain the modules corresponding to all target subgraphs.

5. The dual-view collaborative fusion method based on centrality features and higher-order motifs according to claim 4, characterized in that, The step of obtaining the phantoms corresponding to all target subgraphs also includes: In the process of obtaining a motif, for a motif containing multiple nodes, a motif adjacency matrix is ​​constructed. By normalizing the motif to be the one with the smallest lexicographical order in the adjacency matrix sequence under all possible node permutations, a unique identifier for the isomorphic motif is achieved. This process is called the normalized signature of the motif. The mold Standard signature The formal representation is: Among them, for those containing Node motif Let its adjacency matrix be , for The set of all permutations of nodes, for any permutation The corresponding permutation matrix is ​​denoted as , This indicates matrix vectorization operations.

6. The dual-view collaborative fusion method based on centrality features and higher-order motifs according to claim 1, characterized in that, The process of using enrichment fraction analysis to process all candidate motifs separately to obtain a set of key illegal motifs specifically includes: Based on the constructed set of candidate motifs, the total number of candidate motifs corresponding to a given candidate motif is calculated using the count values ​​of the candidate motifs in the corresponding target subgraph. The target subgraph is obtained from the original graph. The forms of expression are as follows: in, For the set of candidate motifs, any candidate motif , For the target subgraph corresponding to the candidate phantom The count value in, and , This is an illegal associated subgraph. A valid background subimage; Based on the total number of candidate motifs, calculate the normalized frequency of occurrence of each candidate motif in the corresponding target subgraph. : in, The preset Laplace smoothing coefficient, This represents the total number of motif categories in the candidate motif set. The enrichment score of the candidate motif is obtained based on the normalized occurrence frequency of the candidate motif in the corresponding target subgraph. : For each candidate motif, if the enrichment score of the candidate motif is greater than the threshold, the candidate motif is added to the set of key illegal motifs, thereby obtaining the complete set of key illegal motifs.

7. The dual-view collaborative fusion method based on centrality features and higher-order motifs according to claim 1, characterized in that, Step 2 specifically includes: A centrality vector is computed for all nodes in the original graph using a centrality metric. Obtain the original feature matrix from the original image, and then perform Z-score standardization on the original feature matrix to obtain the standardized feature matrix; On the standardized feature matrix, the global importance weight of each feature is calculated by weighting the absolute value of the feature and the centrality vector of each node. All features are then ranked, and the highest-ranking features are selected. We construct a low-dimensional feature matrix based on the features.

8. The dual-view collaborative fusion method based on centrality features and higher-order motifs according to claim 1, characterized in that, The feature parallel aggregation strategy includes: First-order topological neighborhood aggregation stage: Based on the original adjacency matrix, a first-order topological neighborhood is determined, and the previous layer embedding of the nodes in the first-order topological neighborhood is aggregated by mean to obtain the first-order neighborhood aggregation feature. Higher-order motif neighborhood aggregation stage: Based on the motif adjacency matrix, higher-order motif neighborhoods are determined, and the previous layer embeddings of nodes in the higher-order motif neighborhoods are aggregated by mean to obtain higher-order motif neighborhood aggregation features. Feature fusion stage: The previous layer embedding of the node is concatenated with the first-order neighborhood aggregation feature and the higher-order motif neighborhood aggregation feature. After linear transformation and activation function processing, the current layer node embedding is generated. After multiple iterations, parallel fused node embedding is generated.

9. The dual-view collaborative fusion method based on centrality features and higher-order motifs according to claim 1, characterized in that, The feature hierarchy enhancement strategy includes: Motif fusion stage: Based on the motif adjacency matrix, determine the higher-order motif neighborhood, perform mean aggregation on the previous layer embedding of the nodes in the higher-order motif neighborhood to obtain the higher-order motif neighborhood aggregation feature, fuse the higher-order motif neighborhood aggregation feature with the previous layer embedding of the node itself, and perform nonlinear integration through the fusion layer to generate the enhanced intermediate node embedding. Global fusion stage: Based on the original adjacency matrix, a first-order topological neighborhood is determined. The previous layer embeddings of the nodes in the first-order topological neighborhood are aggregated by mean to obtain the first-order global aggregated features. The first-order global aggregated features are concatenated with the enhanced intermediate state node embeddings. After linear transformation and activation function processing, hierarchical enhanced node embeddings are generated.

10. A dual-view collaborative fusion system based on centrality features and higher-order phantoms, characterized in that, Include: The high-order illegal motif enrichment mining module is used to obtain the original transaction network, determine the original graph based on the original transaction network, filter out the candidate motif set from the original graph, process all candidate motifs separately using the enrichment score analysis method to obtain the key illegal motif set, and construct the motif adjacency matrix based on the key illegal motif set. The centrality-aware feature selection module is used to extract the original node features from the original graph, calculate the centrality index of all nodes in the original graph using the centrality measurement method, combine the centrality index of each node with the original node features to obtain the global importance weight of each feature, and construct a low-dimensional feature matrix based on the global importance weight of each feature. Dual-view feature aggregation module: Based on the low-dimensional feature matrix, it fuses the information of the original adjacency matrix and the modal adjacency matrix, and generates node embeddings for each node in the original graph through parallel feature aggregation or hierarchical feature enhancement strategies; the original adjacency matrix is ​​directly obtained from the original transaction network; The output module is used to input all node embeddings into a single random forest classifier, which then classifies the nodes in the original transaction network into legitimate and illegitimate nodes.

Images