Decentralized carbon trading platform cross-domain anomaly detection method, system, device and medium

Abstract

The application discloses a decentralized carbon trading platform cross-domain anomaly detection method, system, device and medium, the method comprises the following steps: S1, local multi-modal data feature construction; S2, local double modal model feature extraction; S3, double federation collaborative training and safe aggregation; S4, dynamic attention gate feature fusion; S5, dynamic threshold determination based on extreme value theory; S6, abnormal evidence chaining and hierarchical risk control response. The application ensures that the carbon trading platform can identify cross-domain collaborative attacks, realizes joint perception of multiple participants on abnormal behaviors such as cross-protocol and cross-link, realizes the verifiability and security of the model collaborative training process and the aggregation result, maintains a low false alarm rate, realizes the automatic response from risk discovery to risk closed-loop disposal, and forms a complete regulatory closed loop.

Description

Technical Field

[0001] This application relates to the fields of digital finance and green finance technology, and in particular to methods, systems, equipment and media for detecting cross-domain anomalies in decentralized carbon trading platforms. Background Technology

[0002] As the global goal of carbon neutrality progresses, the carbon market is evolving from a single centralized exchange to a decentralized finance (DeFi) ecosystem. Protocols such as KlimaDAO and Toucan have enabled the on-chain tokenization of carbon assets, making carbon trading involve multiple independently operating entities (such as DEXs, cross-chain bridges, and lending protocols). In these scenarios, abnormal trading behaviors (such as wash trading, fraudulent injections, and price manipulation) exhibit cross-domain characteristics (spanning different contract addresses), concealment (using complex topologies to mask their true nature), and dynamism (attack patterns that evolve over time).

[0003] Currently, anomaly detection technologies in carbon trading platforms primarily employ centralized or single-model analysis models. Typical implementations include threshold detection methods based on rule engines and anomaly identification methods based on time-series models. However, these solutions largely rely on the assumption of centralized data acquisition and unified modeling, making them ill-suited to the real-world operating environment of decentralized carbon trading platforms, characterized by multi-party participation, highly distributed data, and strict privacy constraints. Current anomaly detection technologies in carbon trading suffer from the following limitations, failing to meet regulatory requirements: ① Data silos prevent the identification of cross-domain coordinated attacks. Existing solutions mostly rely on local data from a single platform for independent modeling. However, malicious users often exploit "data gaps" to commit malicious acts, such as buying on platform A and selling on platform B. Due to commercial privacy barriers between decentralized exchanges (DEXs) and bridging protocols, the original transaction graph cannot be shared. The pain point of existing technologies: the lack of a collaborative detection mechanism without leaking original transaction privacy leads to missed detections of "local compliance, global anomalies." ② The disconnect between graph structure and temporal characteristics. Existing detection models are typically fragmented: either based solely on rules (e.g., threshold alerts) or focusing only on a single modality. Using only time-series models (e.g., LSTM) ignores the topological relationships of fund flows between accounts, making it impossible to identify organized crime. Using only static graph models (e.g., GCN) ignores the unique compliance cycle and sudden volatility of carbon trading (e.g., it is extremely difficult to distinguish between compliant trading and abnormal price spikes as the compliance period approaches). Current technological pain points: The lack of a fusion model capable of simultaneously handling the heterogeneous graph structure of carbon assets' dual-track attributes (quotas and credits) and multi-scale time dependencies; ③ Lack of verifiability for collaborative training. In traditional federated learning schemes, the central server (coordinator) or participating nodes may engage in malicious behavior (such as poisoning attacks). Current technical challenges: Existing schemes cannot prove that the gradients uploaded by participants are calculated based on real data, nor can they prove that the aggregation results have not been tampered with; they lack an end-to-end on-chain trust mechanism. ④ High false alarm rate due to static thresholds. The carbon market is greatly affected by policies, and prices fluctuate wildly. Traditional methods use fixed thresholds (such as 3-sigma), which generate a large number of false alarms during periods of sharp market volatility, causing the system to frequently "falsely" kill legitimate transactions. Summary of the Invention

[0004] This application provides a method for detecting cross-domain anomalies in decentralized carbon trading platforms, which solves the technical problems of existing carbon trading platforms being unable to identify cross-domain coordinated attacks, having fragmented detection models, lacking verifiability of coordinated training, and having a high false alarm rate.

[0005] This application is achieved through the following solution: A method for detecting cross-domain anomalies on decentralized carbon trading platforms, including the following steps: S1. On the one hand, each participating node listens to the smart contract event log in the local environment and constructs a local dynamic heterogeneous transaction subgraph including anonymized address nodes and carbon asset transaction edges; on the other hand, for each address node, the sliding window length is determined according to the Fourier main frequency of the historical transaction cycle, and a multivariate time series matrix including transaction, price and carbon asset semantic sequences is aggregated and constructed. S2. Each participating node utilizes a locally deployed temporal heterogeneous graph attention network model to extract graph embedding vectors reflecting address relationships through type-level aggregation and semantic-level fusion. Simultaneously, a causal dilated convolutional network model is employed to extract temporal anomaly embedding vectors reflecting behavioral evolution under the premise of satisfying causal constraints. ; S3. The above model is updated using a federated learning mechanism. During the update, each node uploads the encrypted model gradient to the federated coordinator. The coordinator generates global gradients using a secure aggregation protocol and simultaneously generates zero-knowledge proofs based on arithmetic circuit constraints. After the proof is verified by the on-chain smart contract, the updated global parameters will be broadcast to all participating nodes. S4. Each participating node performs local inference using the updated model. The adaptive gating unit dynamically calculates the gating coefficient based on the graph embedding vector, the temporal embedding vector, and the market macro-environment state vector. Based on this, the graph anomaly score and the time series anomaly score are weighted and fused to obtain a comprehensive anomaly score. ; S5. An update algorithm based on extreme value theory is adopted, which uses the extreme value samples of the scoring sequence within the sliding window to fit a generalized Pareto distribution and calculates the dynamic judgment threshold in real time. ; S6. When the comprehensive anomaly score exceeds the dynamic threshold, an anomaly evidence package including zero-knowledge assertions is generated and stored in the decentralized storage system; then, the on-chain smart contract is called to register the storage certificate, triggering a tiered risk control procedure including warnings, transaction rate limits, or transaction suspension.

[0006] Further, step S1 specifically includes the following steps: S11. Event Listening and Data Extraction: Listen to smart contract events within its jurisdiction and extract key transaction metadata; S12. Constructing a Locally Dynamic Heterogeneous Transaction Subgraph: Constructing a locally dynamic heterogeneous transaction subgraph ,in, It is a set of anonymized address nodes that have undergone irreversible hashing. For the set of transaction edges, This represents the set of node types, which are used by the model to apply differentiated weights to different node types. The set of edge types includes: (1) Node feature embedding: For any node , build dimensional initial feature vector This vector is derived from on-chain information. Off-chain information and market information Cascaded together: ; The on-chain information includes transaction frequency, gas consumption distribution, and capital inflow / outflow ratio; the off-chain information includes carbon credit audit rating, project geographic location entropy, and Herfindahl index of corporate holdings; and the market information includes market carbon price and volatility. (2) Heterogeneous edges and timeliness weights: edge This includes attributes such as asset type (asset_type), transaction type (tx_type), blockchain (chain_id), quantity (amount), and timestamp. The asset type (asset_type) ∈ {carbon allowances, carbon credits}, and the transaction type (tx_type) ∈ {minting, transfer, ..., cross-chain}. Edge types are labeled with {asset_type, tx_type, chain_id}. For each edge... According to its transaction time With current time The difference is used to calculate the time decay weight: ; in, This is a time decay factor used to enhance the impact of recent transactions on anomaly detection; S13. Construct a multidimensional time series matrix: For each account address, use an adaptive sliding window to aggregate and construct a multivariate time series matrix. ,include Each feature dimension.

[0007] Furthermore, step S2 specifically includes the following steps: S21. Construct a temporally heterogeneous graph attention network and adopt a hierarchical aggregation mechanism: (1) Type-level Aggregation: For nodes In a specific relationship Neighbor set Calculate aggregation features : ; in, For the target node In a specific relationship type The intermediate feature vector below does not yet include information about other relationships; it only aggregates information about neighbors of the same type of relationship. For non-linear activation functions, LeakyReLU or ELU functions are used to introduce non-linear factors and improve the model's ability to fit non-convex data distributions. For nodes In relation The set of neighboring nodes; For set Any neighboring node in the list; For neighboring nodes The initial feature vector has a dimension of . ; Indicates specific to a relationship The linear transformation matrix has dimensions of . This matrix represents the learnable parameters of the model, used to map inputs from different feature spaces to the same hidden layer space. The normalized attention coefficient, with a value ranging from (0, 1), is used to quantify neighbors. For the target node The importance of these neighbors enables the model to automatically learn to focus on those with large transaction amounts or unusual frequency, rather than treating all neighbors equally. (2) Semantic-level fusion: The aggregated features of different relation types are weighted and fused to generate the final graph embedding vector. : ; in, : Represents a node The final graph embedding vector; this vector integrates semantic information from all relation types and will serve as input to the subsequent anomaly detection module; : Represents a predefined set of heterogeneous relationships; Representing relations The semantic importance weights, which are automatically learned by the model, are used to determine under which transaction relationships anomalies are more likely to occur. S22. Constructing a time series processing module: A causal dilated convolutional network is used. The input to this time series processing module is a multidimensional time series matrix under a sliding window. ,in For time step, Let be the feature dimension, where: (1) The core algorithm is: for a certain moment in the time series and the Layer feature input Define dilated convolution operation as follows: ; in, Represents the void factor. With the number of floors Exponential growth, i.e. ; This indicates the kernel size, set to 2 or 3; Indicates a causal constraint index; Indicates the first Layer Learnable convolutional kernel weight matrix at each position; Represents the bias vector; This represents the dilated convolution operator; (2) Residual block structure: Deep networks are trained by stacking residual blocks, and residual connections are introduced to preserve mutation features. The output of each residual block The calculation formula is: ; in, Indicates the first Layer in The hidden state vector at time step; The representation layer normalization operation is used to prevent gradient explosion. Indicates residual connection; (3) Timing Embedded Output: After After processing each residual block, take the last time step. The output of is mapped by a multilayer perceptron to obtain the temporal anomaly embedding vector: ; in, Represents the top-level hidden state vector (i.e., after passing through) After layer calculation, in (High-dimensional abstract vector output at each time step) This represents the final generated temporal anomaly embedding vector, whose dimension is the same as the final graph embedding vector output by the graph neural network. They must be identical to facilitate subsequent weighted fusion. This represents a multilayer perceptron at the output layer, used to map high-dimensional temporal features to the semantic space of anomaly detection.

[0008] Furthermore, step S3 specifically includes the following steps: S31, Participating Nodes After completing model training locally, the encrypted model gradients are uploaded to the federated coordinator deployed in the L2Rollup layer; S32. The federated coordinator uses the SecAgg protocol to securely aggregate the cryptographic gradients from each participating node, generating a global model update and simultaneously generating ZK-SNARK zero-knowledge proofs. This is used to verify that the aggregation process does not leak any original graph structure data or time series data, ensuring privacy and integrity; S33. The federated coordinator updates the global model and the corresponding zero-knowledge proof. Submitting to a smart contract on the blockchain; S34. The blockchain / smart contract receives and executes the on-chain verification procedure to verify zero-knowledge proofs. The validity of the aggregation results is verified; if the verification passes, the aggregation results of this round are confirmed to be reliable. S35. After successful verification, the blockchain / smart contract will broadcast the updated global model parameters to all participating nodes, completing one round of federated learning iteration.

[0009] Furthermore, in step S32, the federated coordinator uses the SecAgg protocol to securely aggregate the cryptographic gradients from each participating node, specifically including the following steps: (1) Gradient masking: Each participating node The original gradient obtained from its training Processed as mask gradient : ; in, This is the set of participating nodes that are currently online. For nodes With the node with the larger number The peer-to-peer random mask vectors generated through Diffie-Hellman key exchange; For nodes With smaller number nodes The symmetric mask terms generated between them are used to cancel out the corresponding masks of neighboring nodes by using opposite signs; For arithmetic circuits, the prime modulus is 0. (2) Aggregation principle: The federation coordinator receives data from all nodes. And sum them up, since and They cancel each other out, ultimately resulting in an encrypted global gradient that achieves secure aggregation. .

[0010] Furthermore, step S4 specifically includes the following steps: S41. Dynamic Attention Fusion Mechanism: Each node uses the trained dual model for local inference, designs adaptive gating units, and embeds graphs... Timing Embedding Market macroeconomic environment state vector Dynamically calculate the gating coefficient : ; in, This includes volatility, liquidity, and spreads in quotas and credit; This is the gated weight matrix, with dimension 1. ; This represents a vector concatenation operation; This is a bias term used to adjust the initial tendency of the gating unit; , representing the model's preference for "graph structure features", when When the model relies more on graph features; when In some cases, the gating mechanism relies more on timing characteristics; when the market fluctuates sharply, the gating mechanism will automatically adjust. Values, the weights of structural anomalies and temporal abrupt changes in the balance plot; S42. Dual-modal feature weighted fusion: based on gating coefficients The discriminator outputs of the two modalities are weighted to calculate the final anomaly probability score. : ; in, The final anomaly score has a range of values. The higher the value, the greater the likelihood that the address and its transaction behavior are abnormal. and The discriminators are graph modality and temporal modality, respectively, which output preliminary anomaly risk assessment values ​​from two independent dimensions: spatial correlation and temporal behavior.

[0011] Furthermore, step S5 specifically includes the following steps: S51. An update algorithm based on extreme value theory is adopted, which uses extreme value samples of the scoring sequence within the sliding window to fit a generalized Pareto distribution and calculates the dynamic judgment threshold in real time. ; in, This represents the preset initial observation threshold, used to analyze the original scoring sequence. Extract extreme value samples that exceed this level as the basis for fitting the generalized Pareto distribution; These are the shape and scale parameters of the GPD, respectively. This represents the total number of all abnormal scores generated by the system within the current sliding window. The number of samples exceeding the initial threshold; The preset target probability quantile is used to characterize the system's tolerance to extreme abnormal behavior.

[0012] This application also provides a cross-domain anomaly detection system for decentralized carbon trading platforms, including: The local multimodal data feature construction module is used by each participating node to listen to smart contract event logs in the local environment and construct a local dynamic heterogeneous transaction subgraph including anonymized address nodes and carbon asset transaction edges. On the other hand, for each address node, the sliding window length is determined according to the Fourier main frequency of the historical transaction cycle, and a multivariate time series matrix including transaction, price and carbon asset semantic sequences is aggregated and constructed. The local bimodal model feature extraction module is used by participating nodes to extract graph embedding vectors reflecting address relationships through type-level aggregation and semantic-level fusion using a locally deployed temporal heterogeneous graph attention network model. Simultaneously, a causal dilated convolutional network model is employed to extract temporal anomaly embedding vectors reflecting behavioral evolution under the premise of satisfying causal constraints. ; The dual-fed collaborative training and secure aggregation module is used to update the aforementioned model using a federated learning mechanism. During the update, each node uploads the encrypted model gradient to the federated coordinator. The coordinator generates global gradients using a secure aggregation protocol and simultaneously generates zero-knowledge proofs based on arithmetic circuit constraints. After the proof is verified by the on-chain smart contract, the updated global parameters will be broadcast to all nodes. The dynamic attention-gated feature fusion module is used by participating nodes to perform local inference using the updated model. The adaptive gating unit dynamically calculates the gating coefficient based on the graph embedding vector, temporal embedding vector, and macro-market environment state vector. Based on this, the graph anomaly score and the time series anomaly score are weighted and fused to obtain a comprehensive anomaly score. ; The dynamic threshold determination module employs an update algorithm based on extreme value theory, using extreme value samples of the scoring sequence within a sliding window to fit a generalized Pareto distribution and calculate the dynamic determination threshold in real time. ; The abnormal evidence on-chain and tiered risk control response module is used to generate an abnormal evidence package, including zero-knowledge assertions, and store it in a decentralized storage system when the comprehensive abnormal score exceeds the dynamic threshold. Then, it calls the on-chain smart contract to register the storage certificate and triggers a tiered risk control procedure, including warnings, transaction rate limits, or transaction suspension.

[0013] This application also provides an electronic device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the computer program, implements the aforementioned method for detecting cross-domain anomalies in a decentralized carbon trading platform.

[0014] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the aforementioned method for detecting cross-domain anomalies in a decentralized carbon trading platform.

[0015] This application also provides a computer program product, including a computer program or computer-executable instructions, which, when executed by a processor, implement the aforementioned method for detecting cross-domain anomalies in a decentralized carbon trading platform.

[0016] Compared with the prior art, this application can produce the following significant beneficial effects: 1. Achieving global anomaly detection capability under privacy constraints. By introducing a parallel collaborative mechanism of federated graph modeling and federated time series modeling, this application can achieve joint identification of cross-protocol and cross-link anomaly behaviors in carbon trading under the premise that the original transaction graph topology and private time series are strictly not shared among the participating parties; 2. Achieve multi-dimensional and accurate characterization of the unique patterns of carbon trading, effectively reducing false alarms and missed alarms. By constructing a time-series heterogeneous trading graph for carbon asset perception and combining it with a multi-scale time series feature extraction model that satisfies causal constraints, the system simultaneously possesses the capabilities of "structural correlation perception" and "time dynamic perception." 3. A decentralized trust foundation is built without the need for a trusted third party, significantly enhancing security. By combining a secure aggregation protocol with a zero-knowledge proof verification mechanism, end-to-end verifiability of the model collaborative training and parameter aggregation processes is achieved. 4. Establish a fully automated regulatory closed loop encompassing "detection-evidence storage-response." This application deeply integrates anomaly judgment results, confidence scores generated by dynamic gating, and blockchain smart contract mechanisms; 5. Possesses excellent ecological scalability and cross-domain versatility. The design architecture of this application does not rely on a specific underlying chain protocol and supports multiple participating entities, multiple carbon asset types, and multiple heterogeneous blockchain environments.

[0017] In addition to the purposes, features, and advantages described above, this application has other purposes, features, and advantages. A further detailed description of this application will be provided below with reference to the figures. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein: Figure 1 This is a schematic diagram of the overall architecture of the decentralized carbon trading platform cross-domain anomaly detection system according to a preferred embodiment of this application; Figure 2 This is a flowchart illustrating a preferred embodiment of the cross-domain anomaly detection method for a decentralized carbon trading platform according to this application. Figure 3 This is a schematic flowchart illustrating a preferred embodiment of the federal collaborative training in this application; Figure 4 This is a schematic diagram illustrating the principle of cross-domain anomaly fusion detection; Figure 5 This is a schematic diagram of the modules of the decentralized carbon trading platform cross-domain anomaly detection system according to a preferred embodiment of this application; Figure 6 This is a schematic block diagram of an electronic device according to a preferred embodiment of this application; Figure 7 This is a schematic diagram of the internal structure of a computer device according to a preferred embodiment of this application. Detailed Implementation

[0020] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0021] Explanation of technical terms: A Decentralized Carbon Trading Platform (DCTP) refers to a carbon asset trading ecosystem built on blockchain technology and operating on a distributed ledger. Its key feature is the tokenization of carbon allowances and carbon credits through smart contracts, with the trading process distributed across multiple independent decentralized exchanges (DEXs), liquidity pools, and cross-chain protocols, eliminating the presence of a single central controlling entity.

[0022] Federated Learning (FL) is a distributed machine learning framework that allows participating nodes to collaboratively train a global model by exchanging model gradients or parameters without exchanging raw data (such as transaction logs or account balances). In this application, it specifically refers to a privacy-preserving collaborative computation mode targeting graph topology and temporal features.

[0023] Heterogeneous graph: refers to a graph structure containing multiple types of nodes (such as account addresses, contract addresses, and asset pool addresses) and multiple types of edges (such as transfer relationships, staking relationships, authorization relationships, and cross-chain bridging relationships). In this application, it is used to characterize the different semantic relationships between carbon allowances and carbon credits in complex trading networks.

[0024] Causal Dilated Convolution: An improved convolutional neural network operator. "Causal" means the output depends only on the current and past inputs, not on future information, ensuring the model conforms to real-time prediction logic. "Dilated" refers to the exponential expansion of the receptive field without increasing the number of parameters by inserting gaps into the convolution kernel, thus enabling the simultaneous capture of intraday short-term fluctuations and quarterly long-term cyclical patterns in carbon trading.

[0025] Secure Aggregation (SecAgg): A privacy-preserving computation protocol, typically based on homomorphic encryption or secret sharing techniques. Its purpose is to ensure that the coordinator (or server) can only obtain the weighted sum of the gradients uploaded by each node, and cannot deconstruct the specific model parameters contributed by any single node, thus preventing the inference of sensitive transaction privacy through model gradients.

[0026] Zero-Knowledge Proofs (ZKPs): Specifically refers to ZK-SNARKs (Concise Non-Interactive Zero-Knowledge Proofs) used in this application. It allows the prover (participating node or coordinator) to prove the truth of a statement to the verifier (smart contract) without revealing the specific computation process and original data (e.g., proving that the aggregation result of the global model is indeed calculated from the valid gradients of each legitimate node).

[0027] Extreme Value Theory (EVT) is a branch of statistics that focuses on modeling the tails of distributions (i.e., extremely rare events). In this application, it is used to dynamically model anomaly scores to calculate dynamic judgment thresholds at specific market volatility levels, rather than using fixed, static empirical thresholds.

[0028] Federated Graph Attention Network (GAT): This applies Graph Attention Network (GAT) to federated scenarios. It automatically learns the importance of neighboring nodes' contributions to the central node through an attention mechanism, enabling privacy-preserving extraction of cross-domain transaction topology features within a federated framework.

[0029] Federated graph and time series collaborative modeling: refers to a technical framework in which multiple participants collaboratively train graph neural networks and time series models through security protocols without sharing the original transaction graph structure and time series data, and then fuse the outputs of the two to perform joint anomaly detection.

[0030] Cross-domain collaboration: In the context of this application, "domain" refers to different blockchain networks (such as Ethereum and Polkadot), different transaction protocols (such as Uniswap and Curve's carbon asset pool), or different operating entities. Cross-domain collaboration refers to the use of federated protocols to jointly model anomalous characteristics scattered across these independent logical regions, thereby identifying covert behaviors such as cross-chain monetization.

[0031] Cross-domain anomalies refer to abnormal behavior that occurs across multiple data domains (such as different protocols, different blockchains, and different asset types), which cannot be independently identified by a single participant based on local data. For example, address A buys carbon credits on platform X, and address B sells them on platform Y, forming a closed-loop wash sale without any real economic purpose.

[0032] Feature embedding refers to the technique of mapping high-dimensional, sparse raw transaction data (such as complex graph topologies or long-sequence logs) to a low-dimensional, continuous vector space. The generated "embedded vectors" retain the core semantic information of the original data, facilitating subsequent classification and anomaly detection.

[0033] It should be noted that the executing entity in this embodiment can be a computing service system with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or a decentralized carbon trading platform cross-domain anomaly detection system capable of achieving the above functions. The following example uses a decentralized carbon trading platform cross-domain anomaly detection system (see...). Figure 1 Taking the implementing entity as an example, this embodiment and the following embodiments will be described to realize the detection of cross-domain carbon trading anomalies without sharing the original transaction data.

[0034] like Figure 2 As shown, a preferred embodiment of this application provides a method for detecting cross-domain anomalies in a decentralized carbon trading platform, with each participating node... (Such as decentralized exchanges (DEX), carbon credit pools, and cross-chain bridges) perform corresponding operations within their local computing environment without leaving their local data domain, including the following steps: S1. On the one hand, each participating node listens to the smart contract event logs in the local environment to construct a local dynamic heterogeneous transaction subgraph including anonymized address nodes and carbon asset transaction edges; on the other hand, for each address node, the sliding window length is determined according to the Fourier main frequency of the historical transaction cycle, and a multivariate time series matrix including transaction, price and carbon asset semantic sequences is constructed. S2. Each participating node utilizes a locally deployed Temporal-Heterogeneous Graph Attention Network (GAT) model to extract graph embedding vectors reflecting address relationships through type-level aggregation and semantic-level fusion. Simultaneously, a causal dilated convolutional network model (CD-TCN) is employed to extract temporal anomaly embedding vectors reflecting behavioral evolution while satisfying causal constraints. ; S3. The above model is updated using a federated learning mechanism. During the update, each node uploads the encrypted model gradient to the federated coordinator. The coordinator generates global gradients using the secure aggregation protocol (SecAgg) and simultaneously generates zero-knowledge proofs (ZK-SNARK) based on arithmetic circuit constraints. After the proof is verified by the on-chain smart contract, the updated global parameters will be broadcast to all participating nodes. S4. Each participating node performs local inference using the updated model. The adaptive gating unit dynamically calculates the gating coefficient based on the graph embedding vector, the time-series embedding vector, and the market macro-environment state vector (such as volatility, price spread, etc.). Based on this, the graph anomaly score and the time series anomaly score are weighted and fused to obtain a comprehensive anomaly score. ; S5. An update algorithm based on extreme value theory (EVT) is adopted, which uses extreme value samples of the scoring sequence within the sliding window to fit a generalized Pareto distribution (GPD) and calculates the dynamic judgment threshold in real time. ; S6. When the comprehensive anomaly score exceeds the dynamic threshold, an anomaly evidence package including zero-knowledge assertions is generated and stored in the decentralized storage system; then, the on-chain smart contract is invoked to register the storage certificate (CID), triggering a tiered risk control procedure including warnings, transaction rate limits, or transaction suspension.

[0035] Compared with the prior art, this embodiment can produce the following significant beneficial effects: 1. Achieving global anomaly detection capability under privacy constraints. By introducing a parallel collaborative mechanism of federated graph modeling and federated time series modeling, this application can achieve joint identification of cross-protocol and cross-link anomaly behaviors in carbon trading under the premise that the original transaction graph topology and private time series are strictly not shared among the participating parties; 2. Achieve multi-dimensional and accurate characterization of the unique patterns of carbon trading, effectively reducing false alarms and missed alarms. By constructing a time-series heterogeneous trading graph for carbon asset perception and combining it with a multi-scale time series feature extraction model that satisfies causal constraints, the system simultaneously possesses the capabilities of "structural correlation perception" and "time dynamic perception." 3. A decentralized trust foundation is built without the need for a trusted third party, significantly enhancing security. By combining a secure aggregation protocol with a zero-knowledge proof verification mechanism, end-to-end verifiability of the model collaborative training and parameter aggregation processes is achieved. 4. Establish a fully automated regulatory closed loop encompassing "detection-evidence storage-response." This application deeply integrates anomaly judgment results, confidence scores generated by dynamic gating, and blockchain smart contract mechanisms; 5. Possesses excellent ecological scalability and cross-domain versatility. The design architecture of this application does not rely on a specific underlying chain protocol and supports multiple participating entities, multiple carbon asset types, and multiple heterogeneous blockchain environments.

[0036] Preferably, step S1 specifically includes the following steps: S11. Event Listening and Data Extraction: Listen to smart contract events (such as Transfer, Mint, etc.) within its jurisdiction and extract key transaction metadata; S12. Constructing a Locally Dynamic Heterogeneous Transaction Subgraph: Constructing a locally dynamic heterogeneous transaction subgraph ,in, It is a set of anonymized address nodes that have undergone irreversible hashing. For the set of transaction edges, This represents the set of node types (such as ordinary accounts, smart contract accounts, and cross-chain bridge contract addresses), which are used by the subsequent model to apply differentiated weights to different node types. A set of edge types; (1) Node Embedding: For any node , build dimensional initial feature vector This vector is derived from on-chain information. Off-chain information and market information Cascaded together: ; On-chain information typically includes transaction frequency, gas consumption distribution, and capital inflow / outflow ratio; off-chain information typically includes carbon credit audit ratings, project geographical entropy, and the Herfindahl-Hirschman Index (HHI) for corporate holdings; market information typically includes market carbon prices and volatility. (2) Heterogeneous edges and timeliness weights: edge This includes attributes such as asset type (asset_type), transaction type (tx_type), blockchain (chain_id), quantity (amount), and timestamp. The asset type (asset_type) ∈ {carbon allowances, carbon credits}, and the transaction type (tx_type) ∈ {minting, transfer, ..., cross-chain}. Edge types are labeled with {asset_type, tx_type, chain_id}. For each edge... According to its transaction time With current time The difference is used to calculate the time decay weight: ; in, This is a time decay factor used to enhance the impact of recent transactions on anomaly detection; S13. Construct a multidimensional time-series sequence matrix: For each account address, use an adaptive sliding window (window length...). (Determined by the Fourier dominant frequency of historical trading cycles), and aggregated to construct a multivariate time series matrix. ,include Features include time-series features (such as transaction behavior sequences (number of transactions, frequency, net inflow, etc.), price behavior sequences (average transaction price, price volatility, etc.), and carbon asset semantic sequences (remaining performance period, credit project dispersion, etc.)).

[0037] Preferably, step S2 specifically includes the following steps: S21. Construct a graph neural network module, specifically a temporal-heterogeneous graph attention network (GAT), to address the differences in the dual-track attributes of carbon assets (quotas and credits) using a hierarchical aggregation mechanism: (1) Type-level Aggregation: For nodes In a specific relationship Neighbor set Calculate aggregation features : ; in, For the target node In a specific relationship type The intermediate feature vector under (such as "quota transfer" or "credit offset") does not yet include information about other relationships, but only aggregates the neighbor information of the same relationship; For non-linear activation functions, LeakyReLU or ELU functions are preferred in implementation to introduce non-linear factors and improve the model's ability to fit non-convex data distributions. For nodes In relation The set of neighboring nodes, for example, if If the value is "transfer", then the set includes all funds transferred to the transfer account. Transfer or receiving The address node for the transfer; For set Any neighboring node in the list; For neighboring nodes The initial feature vector (i.e., the concatenated vector constructed in step one, including on-chain, off-chain, and market features) has a dimension of ; Indicates specific to a relationship The linear transformation matrix (WeightMatrix) has dimensions of . This matrix represents the learnable parameters of the model, used to map inputs from different feature spaces to the same hidden layer space. The normalized attention coefficient, with a value ranging from (0, 1), is used to quantify the neighbors. For the target node The importance of these neighbors enables the model to automatically learn to focus on those with large transaction amounts or unusual frequency, rather than treating all neighbors equally. (2) Semantic-level fusion: Weighted fusion of aggregated features of different relation types to generate the final graph embedding vector. : ; in, : Represents a node The final graph embedding vector; this vector integrates semantic information from all relation types and will serve as input to the subsequent anomaly detection module; : Represents a predefined set of heterogeneous relationships, such as carbon allowance transfer, carbon credit retire, and carbon allowance minting; Representing relations The semantic attention weight is automatically learned by the model and is used to determine which transaction relationships are more prone to anomalies. For example, if the current attack patterns are concentrated on "carbon credit laundering," the model will automatically increase the corresponding weight. of Value, while reducing regular quota trading The weights; S22. Constructing a Time Series Processing Module: To capture the multi-scale time dependencies in carbon trading data and prevent future information leakage (such as short-term price volatility and long-term quarterly compliance cycle trends), this embodiment abandons the traditional RNN / LSTM structure and adopts a multi-scale time series feature extraction network structure that satisfies causal constraints: Causal Dilated Temporal Convolutional Network (CD-TCN). The input of this time series processing module is a multi-dimensional time series matrix under a sliding window. ,in For time step, For feature dimensions: (1) Core algorithm: For a certain moment in the time series and the Layer feature input Define dilated convolution operation as follows: ; in, In this embodiment, the dilation factor represents the void factor. With the number of floors Exponential growth, i.e. (e.g., 1, 2, 4, 8...), this design allows shallow networks to focus on "intraday high-frequency trading details", while deep networks can capture "monthly or quarterly fulfillment cycle patterns"; This indicates the kernel size, which is usually set to 2 or 3. This represents the Causal Constraint Index, which ensures... The output at time depends only on Historical data up to and including the time (i.e.) Strictly prohibit models from using "future information" for predictions. This is crucial for financial risk control scenarios and prevents inflated accuracy rates caused by data leaks. Indicates the first Layer Learnable convolutional kernel weight matrix at each position; Represents the bias vector; This refers to the dilated convolution operator, which, unlike ordinary convolution, allows the convolution kernel to "skip" samples on the input sequence by adjusting the dilation factor. The exponentially expanded receptive field enables the system to capture both short-term intraday abnormal high-frequency trading patterns and long-term annual performance cycle trends without significantly increasing computational overhead. Furthermore, it strictly adheres to causal constraints, ensuring the real-time nature and logical rigor of online detection. (2) Residual block structure: Deep networks are trained by stacking residual blocks, and residual connections are introduced to preserve mutation features. The output of each residual block The calculation formula is: ; in, Indicates the first Layer in The hidden state vector at time step; Layer normalization is used because carbon trading data fluctuates greatly (e.g., a single transaction may range from 1 ton to 100,000 tons). Layer normalization can effectively accelerate model convergence and prevent gradient explosion. Residual connections allow the original information to flow directly to the next layer, preserving the abrupt changes in the original trading signals (such as sudden sell-offs and price surges) and preventing them from being smoothed out in deeper networks. (3) Timing Embedded Output: After After processing each residual block, take the last time step. The output of is mapped by a multilayer perceptron to obtain the temporal anomaly embedding vector: ; in, Represents the top-level hidden state vector (i.e., after passing through) After layer calculation, in (High-dimensional abstract vector output at each time step) This represents the final generated temporal anomaly embedding, whose dimension is the same as the final graph embedding vector output by the graph neural network. They must be identical to facilitate subsequent weighted fusion. This represents a multilayer perceptron at the output layer, used to map high-dimensional temporal features to the semantic space of anomaly detection.

[0038] Preferably, step S3 specifically includes the following steps: S31, Participating Nodes After the model training is completed locally, the encrypted model gradients (masked gradients or parameter differences) are uploaded to the federated coordinator deployed in the L2 Rollup layer. S32. The federated coordinator uses the SecAgg protocol to securely aggregate the cryptographic gradients from each participating node, generating a global model update and simultaneously generating ZK-SNARK zero-knowledge proofs. This is to verify that the aggregation process does not leak any original graph structure data or time series data, ensuring privacy and integrity; S33. The federated coordinator updates the global model and the corresponding zero-knowledge proof. Submitting to a smart contract on the blockchain; S34. The blockchain / smart contract receives and executes the on-chain verification procedure to verify zero-knowledge proofs. The validity of the aggregation results is verified; if the verification passes, the aggregation results of this round are confirmed to be reliable. S35. After successful verification, the blockchain / smart contract will broadcast the updated global model parameters to all participating nodes, completing one round of federated learning iteration.

[0039] like Figure 3 As shown, the above process achieves secure federated collaborative training based on trusted computing and blockchain consensus mechanisms while protecting data privacy. This effectively prevents tampering or malicious behavior by intermediate nodes, and ensures the auditability and decentralization of the model update process.

[0040] Specifically, in step S32, when the federated coordinator uses the SecAgg protocol to securely aggregate the cryptographic gradients from each participating node, each node... The original gradient is processed using the SecAgg protocol based on Shamir secret sharing. Generate by performing masking The coordinator is for all Summing yields the global gradient Because the masks cancel each other out, the coordinator cannot resolve the values ​​of a single node. This achieves input privacy, specifically through the following steps: (1) Gradient Masking: Each participating node The original gradient obtained from its training Processed as mask gradient : ; in, This is the set of participating nodes that are currently online. For nodes With the node with the larger number The peer-to-peer random mask vectors generated through Diffie-Hellman key exchange; For nodes With smaller number nodes The symmetric mask terms generated between them are used to cancel out the corresponding masks of neighboring nodes by using opposite signs; For arithmetic circuits, the prime modulus is 0. (2) Aggregation principle: The federation coordinator receives data from all nodes. And sum them up, since and They cancel each other out, ultimately resulting in an encrypted global gradient that achieves secure aggregation. .

[0041] To achieve synchronized updates of the global model while protecting the local data privacy of all participating parties (such as DEXs, cross-chain bridges, and carbon auditing agencies), the embodiments described above employ a dual security mechanism based on "Secure Aggregation with Secret Sharing (SecAgg) and Zero-Knowledge Proofs (ZK-SNARKs)." Its core objectives are to ensure that: the coordinator cannot obtain the plaintext gradients of any single node; nodes cannot maliciously shift the global model by forging gradients; and the correctness of the aggregation process is verifiable on-chain.

[0042] In the above embodiments, to prevent malicious nodes or the coordinator from tampering with the aggregation results, the coordinator broadcasts a global gradient. When doing so, zero-knowledge proofs must be submitted. This proof is generated based on arithmetic circuit constraints and aims to prove that the aggregation result satisfies consistency constraints (the sum of the encrypted and decrypted gradients equals the public global gradient), range constraints (to prevent gradient explosion attacks), and identity constraints. Proof generation and verification: ① Generation (Prove): The coordinator uses private inputs (plaintext gradients from each node) and circuit parameters to generate a short proof. ② Verification: The blockchain smart contract calls the pre-compiled contract to verify the proof. Only when the return value is 1, the verification is successful, and the on-chain contract will trigger the model version update instruction.

[0043] In the carbon trading market, single-dimensional detection has limitations. For example, during periods of high market volatility (high volatility), the noise in time-series features is significant, necessitating increased reliability of graph structure features (such as abnormal correlations between accounts). Conversely, during periods of market stability, subtle time-series deviations (such as regular, small-amount wash trades) are crucial for identifying puppet accounts. Therefore, this application designs a dynamic attention gating unit that perceives market conditions, such as... Figure 4 As shown, step S4 specifically includes the following steps: S41. Dynamic Attention Fusion Mechanism: Each participating node uses the trained dual model for local inference, designs an adaptive gating unit, and embeds it according to the graph. Timing Embedding Market macroeconomic environment state vector Dynamically calculate the gating coefficient : ; in, This includes volatility, liquidity, and spreads between quotas and credit; This is the gated weight matrix, with dimension 1. ; This represents a vector concatenation operation; This is a bias term used to adjust the initial tendency of the gating unit; , representing the model's preference for "graph structure features", when When the model relies more on graph features; when In some cases, the gating mechanism relies more on timing characteristics; when the market fluctuates sharply, the gating mechanism will automatically adjust. Values, the weights of structural anomalies and temporal abrupt changes in the balance plot; S42. Dual-modal feature weighted fusion: based on gating coefficients The discriminator outputs of the two modalities are weighted to calculate the final anomaly probability score. : ; in, The final anomaly score has a range of values. The higher the value, the greater the likelihood that the address and its transaction behavior are abnormal (such as cross-protocol laundering). and The discriminators are graph modality and temporal modality, respectively, which output preliminary anomaly risk assessment values ​​from two independent dimensions: spatial correlation and temporal behavior.

[0044] Preferably, step S5 specifically includes the following steps: S51. To avoid a high false alarm rate caused by a fixed threshold, this embodiment further adopts a dynamic threshold update algorithm based on "Extreme Value Theory (EVT)": ; in, This represents the preset initial observation threshold, used to analyze the original scoring sequence. Extract extreme value samples that exceed this level as the basis for fitting the generalized Pareto distribution (GPD); These are the shape and scale parameters of the GPD, respectively. This represents the total number of all abnormal scores generated by the system within the current sliding window. The number of samples exceeding the initial threshold; The preset target probability quantile is used to characterize the system's tolerance to extreme abnormal behavior.

[0045] In step S6, when the comprehensive anomaly score exceeds the dynamic threshold, an anomaly evidence package including zero-knowledge assertions is generated and stored in a decentralized storage system: when Exceeding the threshold for dynamic updates At this time, the system generates an anomaly evidence package. The evidence package contains hashes of key data and zero-knowledge assertions (ZK-Assertion) to prove the authenticity of the local computation results without disclosing private data. Subsequently, when the on-chain smart contract is called to register the storage certificate (CID), triggering a tiered risk control procedure including warnings, transaction rate limiting, or transaction suspension, the on-chain responses involved include: ① Upload the abnormal evidence package to decentralized storage (such as IPFS) to obtain the Content Identifier Certificate (CID); ② Call the on-chain smart contract to write the CID and timestamp into the on-chain log; ③ Trigger a tiered risk control response (such as warning → rate limit → trading suspension → reporting to DAO governance, etc.).

[0046] In summary, the key innovations of this application compared to existing technologies are mainly reflected in the following five mutually synergistic and inseparable combinations of technical features: 1. Constructing a dual-track collaborative privacy computing architecture of "Federated Graph + Federated Time Series". This application proposes a collaborative modeling architecture of federated graph and federated time series for decentralized carbon trading platforms. Its core innovation lies in breaking the limitation of traditional federated learning, which can only process single vector data, and achieving joint perception of abnormal behaviors across protocols and links by multiple participating entities without sharing the original transaction graph topology and time series. This architecture, to a certain extent, solves the underlying technical contradiction between "global risk monitoring needs" and "local data privacy constraints" in decentralized scenarios. 2. Constructing a dynamic heterogeneous transaction graph representation model with semantic awareness of carbon assets. Addressing the fundamental differences between carbon allowances and carbon credits in the carbon trading market in terms of policy attributes, liquidity, and trading frequency, this application introduces a type-specific message passing and semantic-level attention mechanism. This mechanism can automatically identify and assign different feature weights to different asset conversion relationships, enabling the model to accurately characterize the semantic information of unique behaviors such as cross-chain bridging and carbon pool deregistration, significantly improving the accuracy of identifying unique abnormal patterns in the carbon trading field (such as fraudulent green cleansing transactions). 3. Introducing a Multi-Scale Temporal Feature Capture Mechanism Satisfying Strong Causal Constraints: At the temporal modeling level, this application innovatively introduces a multi-scale feature extraction operator with causal dilated convolution. This mechanism can not only capture micro-mutations caused by intraday high-frequency manipulations, but also perceive the non-stationary long-range evolution characteristics brought about by the seasonal compliance cycle of carbon trading. By enforcing temporal causal constraints, it ensures that the model will not generate "future information leakage" during real-time inference, greatly enhancing the stability and engineering robustness of anomaly detection results in complex and dynamic operating environments. 4. Constructing a verifiable trust closed loop based on zero-knowledge proofs (ZK) and secure aggregation. This application deeply integrates the secure aggregation mechanism (SecAgg) based on Shamir secret sharing with non-interactive zero-knowledge proofs (ZK-SNARKs). Its key breakthrough lies in achieving "end-to-end on-chain verifiability" of the model collaborative training process and aggregation results, shifting the trust foundation from "relying on third-party institutions" to "relying on mathematical algorithms." This mechanism effectively prevents gradient poisoning attacks by malicious participating nodes and parameter tampering by the coordinator, providing an auditable and non-repudiable trusted collaborative computing foundation for decentralized carbon trading scenarios. 5. Design of an Environment-Aware Multimodal Dynamic Gating Fusion and Automated Response Mechanism. This application designs an anomaly judgment mechanism based on dynamic attention gating, using the market macro-state vector (such as market volatility) as the gating control signal. This mechanism can adaptively adjust the discrimination weights of "topological structure features" and "temporal behavior features" according to the market environment, enabling the system to maintain a low false alarm rate even under extreme market conditions. Simultaneously, combined with on-chain notarization of anomaly evidence packages (IPFS + smart contracts), it achieves automated response from risk discovery to risk closed-loop handling, forming a complete regulatory closed loop.

[0047] In addition to the technical solutions described in the above embodiments, this application also includes the following alternative measures: 1. Replacement of the feature extraction model: ① Graph Model: In addition to the Dynamic Heterogeneous GAT used in this embodiment, the graph neural network module can be replaced with Dynamic Graph Convolutional Network (DGCN) or similar to enhance the ability to capture fine-grained graph topology evolution.

[0048] ② Temporal Model: The Causal Hollow TCN can be replaced by a Transformer encoder structure (with causal mask) or a variant of the Gated Recurrent Unit (GRU) to extract temporal anomaly features from different dimensions. If the trust level among the participants is high, it can be simplified to a non-federated graph construction + federated temporal model (i.e., only temporal data federated). 2. Replacement of privacy-preserving computation protocols: The Secure Aggregation Protocol (SecAgg) can be replaced with Fully Homomorphic Encryption (FHE) to support more complex gradient weighting logic, depending on the computing power requirements; or it can adopt Differential Privacy technology to inject noise with a specific distribution into the gradient to further enhance its resistance to member inference attacks.

[0049] 3. Replacement of zero-knowledge proof schemes: ZK-SNARKs can be replaced with ZK-STARKs to obtain quantum resistance without requiring a Trusted Setup; or, when computational resources are limited, the Bulletproofs scheme can be used to shorten the proof length.

[0050] 4. Decentralized storage and consensus layer: The storage medium for the anomalous evidence package can be replaced by Arweave or Filecoin from IPFS to achieve permanent storage of anomalous credentials; in addition to being deployed in L2 Rollups, the federated coordinator can also be deployed in trusted execution environments (TEEs, such as Intel SGX) nodes to provide hardware-level security.

[0051] 5. Fusion mechanism variant: The dynamic gating unit can be replaced by a multimodal alignment network, which directly determines cross-modal consistency anomalies by calculating the cosine similarity or mutual information between graph embedding and temporal embedding.

[0052] like Figure 5 As shown, another preferred embodiment of this application also provides a cross-domain anomaly detection system for a decentralized carbon trading platform, including: The local multimodal data feature construction module is used by each participating node to listen to smart contract event logs in the local environment and construct a local dynamic heterogeneous transaction subgraph including anonymized address nodes and carbon asset transaction edges. On the other hand, for each address node, the sliding window length is determined according to the Fourier main frequency of the historical transaction cycle, and a multivariate time series matrix including transaction, price and carbon asset semantic sequences is aggregated and constructed. The local bimodal model feature extraction module is used by participating nodes to extract graph embedding vectors reflecting address relationships through type-level aggregation and semantic-level fusion using a locally deployed Temporal-Heterogeneous Graph Attention Network (GAT) model. Simultaneously, a causal dilated convolutional network model (CD-TCN) is employed to extract temporal anomaly embedding vectors reflecting behavioral evolution while satisfying causal constraints. ; The dual-fed collaborative training and secure aggregation module is used to update the above model using a federated learning mechanism. During the update, each node uploads the encrypted model gradient to the federated coordinator. The coordinator uses the secure aggregation protocol (SecAgg) to generate global gradients and simultaneously generates zero-knowledge proofs (ZK-SNARK) based on arithmetic circuit constraints. After the proof is verified by the on-chain smart contract, the updated global parameters will be broadcast to all nodes. The dynamic attention-gated feature fusion module is used by each participating node to perform local inference using the updated model. The adaptive gating unit dynamically calculates the gating coefficient based on the graph embedding vector, the temporal embedding vector, and the macroeconomic environment state vector (such as volatility, price spread, etc.). Based on this, the graph anomaly score and the time series anomaly score are weighted and fused to obtain a comprehensive anomaly score. ; The dynamic threshold determination module employs an update algorithm based on extreme value theory (EVT), using extreme value samples of the scoring sequence within a sliding window to fit a generalized Pareto distribution (GPD) and calculate the dynamic determination threshold in real time. ; The abnormal evidence on-chain and tiered risk control response module is used to generate an abnormal evidence package, including zero-knowledge assertions, and store it in a decentralized storage system when the comprehensive abnormal score exceeds the dynamic threshold. Then, it calls the on-chain smart contract to register the storage certificate (CID) and triggers a tiered risk control procedure, including warnings, transaction rate limits, or transaction suspension.

[0053] The decentralized carbon trading platform cross-domain anomaly detection system provided in this embodiment adopts the decentralized carbon trading platform cross-domain anomaly detection method in the above embodiments, solving the technical problems of existing carbon trading platforms being unable to identify cross-domain coordinated attacks, fragmented detection models, lack of verifiability of coordinated training, and high false positive rates. Each module can be deployed on the same node or in a distributed deployment using a microservice approach. Compared with the prior art, the beneficial effects of the decentralized carbon trading platform cross-domain anomaly detection system provided in this embodiment are the same as those of the decentralized carbon trading platform cross-domain anomaly detection method provided in the above embodiments, and other technical features of the decentralized carbon trading platform cross-domain anomaly detection system are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0054] like Figure 6 As shown, a preferred embodiment of this example also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the decentralized carbon trading platform cross-domain anomaly detection method described in the above embodiment.

[0055] This embodiment provides an electronic device that employs the cross-domain anomaly detection method for decentralized carbon trading platforms described in the above embodiments. This addresses the technical problems of existing carbon trading platforms, such as their inability to identify cross-domain coordinated attacks, fragmented detection models, lack of verifiability for coordinated training, and high false alarm rates. Compared with the prior art, the beneficial effects of the electronic device provided in this embodiment are the same as those of the cross-domain anomaly detection method for decentralized carbon trading platforms provided in the above embodiments. Furthermore, other technical features of the electronic device are the same as those disclosed in the methods of the above embodiments, and will not be elaborated upon here.

[0056] like Figure 7 As shown in the preferred embodiment, this embodiment also provides a computer device, which may be a terminal or a liveness detection server, and its internal structure diagram may be as follows. Figure 7As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with other external computer devices via a network connection. When the computer program is executed by the processor, it implements the steps of the aforementioned decentralized carbon trading platform cross-domain anomaly detection method.

[0057] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the solution of this embodiment, and does not constitute a limitation on the computer device to which the solution of this embodiment is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0058] The computer equipment provided in this application adopts the cross-domain anomaly detection method for decentralized carbon trading platforms in the above embodiments, which solves the technical problems of existing carbon trading platforms being unable to identify cross-domain coordinated attacks, fragmented detection models, lack of verifiability of coordinated training, and high false alarm rates. Compared with the prior art, the beneficial effects of the computer equipment provided in this embodiment are the same as those of the cross-domain anomaly detection method for decentralized carbon trading platforms provided in the above embodiments, and other technical features in the electronic equipment are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0059] A preferred embodiment of this example also provides a storage medium, which includes a stored program that, when the program is executed, controls the device where the storage medium is located to perform the steps of the decentralized carbon trading platform cross-domain anomaly detection method described in the above embodiment.

[0060] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0061] If the functions described in this embodiment are implemented as software functional units and sold or used as independent products, they can be stored in one or more computing device-readable storage media. Based on this understanding, the parts of this embodiment that contribute to the prior art or the technical solution can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a computing device (which may be a personal computer, server, mobile computing device, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this embodiment. The aforementioned storage media include: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0062] Those skilled in the art will understand that the embodiments of this example can be provided as methods, systems, or computer program products. Therefore, this example can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this example can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code. The solutions in this example can be implemented using various computer languages, such as the object-oriented programming language C++ and the embedded programming language C.

[0063] This embodiment is described with reference to flowchart illustrations and / or block diagrams of the method, apparatus (system), and computer program product according to this embodiment. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0064] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0065] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0066] This embodiment also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the decentralized carbon trading platform cross-domain anomaly detection method described above.

[0067] The computer program product provided in this embodiment solves the technical problems of existing carbon trading platforms, such as their inability to identify cross-domain coordinated attacks, fragmented detection models, lack of verifiability for coordinated training, and high false positive rates. Compared with the prior art, the beneficial effects of the computer program product provided in this embodiment are the same as those of the cross-domain anomaly detection method for decentralized carbon trading platforms provided in the above embodiments, and will not be repeated here.

[0068] Obviously, those skilled in the art can make various modifications and variations to this embodiment without departing from the spirit and scope of this embodiment. Therefore, if these modifications and variations of this embodiment fall within the scope of the claims of this embodiment and their equivalents, this embodiment is also intended to include these modifications and variations.

Claims

1. A method for detecting cross-domain anomalies in decentralized carbon trading platforms, characterized in that, Including the following steps: S1. On the one hand, each participating node listens to the smart contract event log in the local environment and constructs a local dynamic heterogeneous transaction subgraph including anonymized address nodes and carbon asset transaction edges; on the other hand, for each address node, the sliding window length is determined according to the Fourier main frequency of the historical transaction cycle, and a multivariate time series matrix including transaction, price and carbon asset semantic sequences is aggregated and constructed. S2. Each participating node utilizes a locally deployed temporal heterogeneous graph attention network model to extract graph embedding vectors reflecting address relationships through type-level aggregation and semantic-level fusion. Simultaneously, a causal dilated convolutional network model is employed to extract temporal anomaly embedding vectors reflecting behavioral evolution under the premise of satisfying causal constraints. ; S3. The above model is updated using a federated learning mechanism. During the update, each node uploads the encrypted model gradient to the federated coordinator. The coordinator generates global gradients using a secure aggregation protocol and simultaneously generates zero-knowledge proofs based on arithmetic circuit constraints. After the proof is verified by the on-chain smart contract, the updated global parameters will be broadcast to all participating nodes. S4. Each participating node performs local inference using the updated model. The adaptive gating unit dynamically calculates the gating coefficient based on the graph embedding vector, the temporal embedding vector, and the market macro-environment state vector. Based on this, the graph anomaly score and the time series anomaly score are weighted and fused to obtain a comprehensive anomaly score. ; S5. An update algorithm based on extreme value theory is adopted, which uses the extreme value samples of the scoring sequence within the sliding window to fit a generalized Pareto distribution and calculates the dynamic judgment threshold in real time. ; S6. When the comprehensive anomaly score exceeds the dynamic threshold, an anomaly evidence package including zero-knowledge assertions is generated and stored in the decentralized storage system; then, the on-chain smart contract is called to register the storage certificate, triggering a tiered risk control procedure including warnings, transaction rate limits, or transaction suspension.

2. The method for detecting cross-domain anomalies in a decentralized carbon trading platform according to claim 1, characterized in that, Step S1 specifically includes the following steps: S11. Event Listening and Data Extraction: Listen to smart contract events within its jurisdiction and extract key transaction metadata; S12. Constructing a Locally Dynamic Heterogeneous Transaction Subgraph: Constructing a locally dynamic heterogeneous transaction subgraph ,in, It is a set of anonymized address nodes that have undergone irreversible hashing. For the set of transaction edges, This represents the set of node types, which are used by the model to apply differentiated weights to different node types. The set of edge types includes: (1) Node feature embedding: For any node , build dimensional initial feature vector This vector is derived from on-chain information. Off-chain information and market information Cascaded together: ； The on-chain information includes transaction frequency, gas consumption distribution, and capital inflow / outflow ratio; the off-chain information includes carbon credit audit rating, project geographic location entropy, and Herfindahl index of corporate holdings; and the market information includes market carbon price and volatility. (2) Heterogeneous edges and timeliness weights: edge This includes attributes such as asset type (asset_type), transaction type (tx_type), blockchain (chain_id), quantity (amount), and timestamp (timestamp). The asset type (asset_type) ∈ {carbon allowances, carbon credits}, and the transaction type (tx_type) ∈ {minting, transfer, ..., cross-chain}. Edge types are labeled with {asset_type, tx_type, chain_id}. For each edge... According to its transaction time With current time The difference is used to calculate the time decay weight: ； in, This is a time decay factor used to enhance the impact of recent transactions on anomaly detection; S13. Construct a multidimensional time series matrix: For each account address, use an adaptive sliding window to aggregate and construct a multivariate time series matrix. ,include Each feature dimension.

3. The method for detecting cross-domain anomalies in a decentralized carbon trading platform according to claim 2, characterized in that, Step S2 specifically includes the following steps: S21. Construct a temporally heterogeneous graph attention network and adopt a hierarchical aggregation mechanism: (1) Type-level Aggregation: For nodes In a specific relationship Neighbor set Calculate aggregation features : ； in, For the target node In a specific relationship type The intermediate feature vector below does not yet include information about other relationships; it only aggregates information about neighbors of the same type of relationship. For non-linear activation functions, LeakyReLU or ELU functions are used to introduce non-linear factors and improve the model's ability to fit non-convex data distributions. For nodes In relationship The set of neighboring nodes; For set Any neighboring node in the list; For neighboring nodes The initial feature vector has a dimension of . ; Indicates specific to a relationship The linear transformation matrix has dimensions of . This matrix represents the learnable parameters of the model, used to map inputs from different feature spaces to the same hidden layer space. The normalized attention coefficient, with a value ranging from (0, 1), is used to quantify neighbors. For the target node The importance of these neighbors enables the model to automatically learn to focus on those with large transaction amounts or unusual frequency, rather than treating all neighbors equally. (2) Semantic-level fusion: The aggregated features of different relation types are weighted and fused to generate the final graph embedding vector. : ； in, : Represents a node The final graph embedding vector; this vector integrates semantic information from all relation types and will serve as input to the subsequent anomaly detection module; : Represents a predefined set of heterogeneous relationships; Representing relations The semantic importance weights, which are automatically learned by the model, are used to determine under which transaction relationships anomalies are more likely to occur. S22. Constructing a time series processing module: A causal dilated convolutional network is used. The input to this time series processing module is a multidimensional time series matrix under a sliding window. ,in For time step, Let be the feature dimension, where: (1) The core algorithm is: for a certain moment in the time series and the Layer feature input Define dilated convolution operation as follows: ； in, Represents the void factor. With the number of floors Exponential growth, i.e. ; This indicates the kernel size, set to 2 or 3; Indicates a causal constraint index; Indicates the first Layer Learnable convolutional kernel weight matrix at each position; Represents the bias vector; This represents the dilated convolution operator; (2) Residual block structure: Deep networks are trained by stacking residual blocks, and residual connections are introduced to preserve mutation features. The output of each residual block The calculation formula is: ； in, Indicates the first Layer in The hidden state vector at time step; The representation layer normalization operation is used to prevent gradient explosion. Indicates residual connection; (3) Timing Embedded Output: After After processing each residual block, take the last time step. The output of is mapped by a multilayer perceptron to obtain the temporal anomaly embedding vector: ； in, Represents the top-level hidden state vector. This represents the final generated temporal anomaly embedding vector, whose dimension is the same as the final graph embedding vector output by the graph neural network. They must be identical to facilitate subsequent weighted fusion. This represents a multilayer perceptron at the output layer, used to map high-dimensional temporal features to the semantic space of anomaly detection.

4. The method for detecting cross-domain anomalies in a decentralized carbon trading platform according to claim 3, characterized in that, Step S3 specifically includes the following steps: S31, Participating Nodes After completing model training locally, the encrypted model gradients are uploaded to the federated coordinator deployed in the L2Rollup layer; S32. The federated coordinator uses the SecAgg protocol to securely aggregate the cryptographic gradients from each participating node, generating a global model update and simultaneously generating ZK-SNARK zero-knowledge proofs. This is used to verify that the aggregation process does not leak any original graph structure data or time series data, ensuring privacy and integrity; S33. The federated coordinator updates the global model and the corresponding zero-knowledge proof. Submitting to a smart contract on the blockchain; S34. The blockchain / smart contract receives and executes the on-chain verification procedure to verify zero-knowledge proofs. The validity of the aggregation results is verified; if the verification passes, the aggregation results of this round are confirmed to be reliable. S35. After successful verification, the blockchain / smart contract will broadcast the updated global model parameters to all participating nodes, completing one round of federated learning iteration.

5. The method for detecting cross-domain anomalies in a decentralized carbon trading platform according to claim 4, characterized in that, In step S32, the federated coordinator uses the SecAgg protocol to securely aggregate the cryptographic gradients from each participating node, specifically including the following steps: (1) Gradient masking: Each participating node The original gradient obtained from its training Processed as mask gradient : ； in, This is the set of participating nodes that are currently online. For nodes With the node with the larger number The peer-to-peer random mask vectors generated through Diffie-Hellman key exchange; For nodes With smaller number nodes The symmetric mask terms generated between them are used to cancel out the corresponding masks of neighboring nodes by using opposite signs; For arithmetic circuits, the prime modulus is 0. (2) Aggregation principle: The federation coordinator receives data from all nodes. And sum them up, since and They cancel each other out, ultimately resulting in an encrypted global gradient that achieves secure aggregation. 。 6. The method for detecting cross-domain anomalies in a decentralized carbon trading platform according to claim 5, characterized in that, Step S4 specifically includes the following steps: S41. Dynamic Attention Fusion Mechanism: Each node uses the trained dual model for local inference, designs adaptive gating units, and embeds graphs... Timing Embedding Market macroeconomic environment state vector Dynamically calculate the gating coefficient : ； in, This includes volatility, liquidity, and spreads in quotas and credit; This is the gated weight matrix, with dimension 1. ; This represents a vector concatenation operation; This is a bias term used to adjust the initial tendency of the gating unit; , representing the model's preference for "graph structure features", when When the model relies more on graph features; when In some cases, the gating mechanism relies more on timing characteristics; when the market fluctuates sharply, the gating mechanism will automatically adjust. Values, the weights of structural anomalies and temporal abrupt changes in the balance plot; S42. Dual-modal feature weighted fusion: based on gating coefficients The discriminator outputs of the two modalities are weighted to calculate the final anomaly probability score. : ； in, The final anomaly score has a range of values. The higher the value, the greater the likelihood that the address and its transaction behavior are abnormal. and The discriminators are graph modality and temporal modality, respectively, which output preliminary anomaly risk assessment values ​​from two independent dimensions: spatial correlation and temporal behavior.

7. The method for detecting cross-domain anomalies in a decentralized carbon trading platform according to claim 1, characterized in that, Step S5 specifically includes the following steps: S51. An update algorithm based on extreme value theory is adopted, which uses extreme value samples of the scoring sequence within the sliding window to fit a generalized Pareto distribution and calculates the dynamic judgment threshold in real time. ； in, This represents the preset initial observation threshold, used to analyze the original scoring sequence. Extract extreme value samples that exceed this level as the basis for fitting the generalized Pareto distribution; These are the shape and scale parameters of the GPD, respectively. This represents the total number of all abnormal scores generated by the system within the current sliding window. The number of samples exceeding the initial threshold; The preset target probability quantile is used to characterize the system's tolerance to extreme abnormal behavior.

8. A cross-domain anomaly detection system for decentralized carbon trading platforms, characterized in that: include: The local multimodal data feature construction module is used by each participating node to listen to smart contract event logs in the local environment and construct a local dynamic heterogeneous transaction subgraph including anonymized address nodes and carbon asset transaction edges. On the other hand, for each address node, the sliding window length is determined according to the Fourier main frequency of the historical transaction cycle, and a multivariate time series matrix including transaction, price and carbon asset semantic sequences is aggregated and constructed. The local bimodal model feature extraction module is used by participating nodes to extract graph embedding vectors reflecting address relationships through type-level aggregation and semantic-level fusion using a locally deployed temporal heterogeneous graph attention network model. Simultaneously, a causal dilated convolutional network model is employed to extract temporal anomaly embedding vectors reflecting behavioral evolution under the premise of satisfying causal constraints. ; The dual-fed collaborative training and secure aggregation module is used to update the aforementioned model using a federated learning mechanism. During the update, each node uploads the encrypted model gradient to the federated coordinator. The coordinator generates global gradients using a secure aggregation protocol and simultaneously generates zero-knowledge proofs based on arithmetic circuit constraints. After the proof is verified by the on-chain smart contract, the updated global parameters will be broadcast to all nodes. The dynamic attention-gated feature fusion module is used by participating nodes to perform local inference using the updated model. The adaptive gating unit dynamically calculates the gating coefficient based on the graph embedding vector, temporal embedding vector, and macro-market environment state vector. Based on this, the graph anomaly score and the time series anomaly score are weighted and fused to obtain a comprehensive anomaly score. ; The dynamic threshold determination module employs an update algorithm based on extreme value theory, using extreme value samples of the scoring sequence within a sliding window to fit a generalized Pareto distribution and calculate the dynamic determination threshold in real time. ; The abnormal evidence on-chain and tiered risk control response module is used to generate an abnormal evidence package, including zero-knowledge assertions, and store it in a decentralized storage system when the comprehensive abnormal score exceeds the dynamic threshold. Then, it calls the on-chain smart contract to register the storage certificate and triggers a tiered risk control procedure, including warnings, transaction rate limits, or transaction suspension.

9. An electronic device, the electronic device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the method for detecting cross-domain anomalies in a decentralized carbon trading platform as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for detecting cross-domain anomalies in a decentralized carbon trading platform as described in any one of claims 1 to 7.

Images