A knowledge graph-based digital currency intelligent monitoring method

Abstract

This invention discloses a knowledge graph-based intelligent monitoring method for digital currencies, comprising the following steps: acquiring and preprocessing original records to obtain a standard record set; connecting cross-source records based on shared primary keys and primary key inheritance relationships to form an evidence body; dividing running pages according to changes in running status and establishing page chain relationships; constructing a knowledge graph based on assets, running pages, evidence bodies, and external targets; inputting the knowledge graph into CompGCN to obtain node representations and relationship representations; encapsulating stable associated objects with running pages as the main shell to form a composite shell entity and generating candidate triples; inputting the candidate triples into ComplEx for scoring to obtain illegal mining monitoring results and corresponding evidence chains. This invention achieves continuous monitoring and structured tracing of illegal mining behavior, significantly improving cross-source association analysis capabilities and the clarity of evidence chains.

Description

Technical Field

[0001] This invention relates to the field of digital currency monitoring technology, and in particular to a digital currency intelligent monitoring method based on knowledge graphs. Background Technology

[0002] As cryptocurrency mining activities become more distributed, covert, and collaborative across domains, illegal mining activities are no longer limited to a single host or network connection. Instead, they simultaneously manifest as abnormal power consumption, abnormal host operation, abnormal network communication, and abnormal correlations with mining pools, wallets, domains, network endpoints, and sample families. Existing monitoring technologies typically employ methods such as traffic feature identification, host process detection, power consumption threshold alarms, or blacklist matching to independently analyze data from a single source. Some solutions also aggregate data from multiple sources and perform correlation queries.

[0003] Most existing technologies use raw records or discrete events as the direct analysis object, lacking a unified organization of continuous relationships between records from different sources, making it difficult to accurately merge the same operational process scattered across different data sources. For representing operational status, existing solutions often use fixed time windows, failing to form structural units that better reflect actual operational boundaries based on changes in operational status, easily leading to the fragmentation of the same abnormal process or the mixing of different processes. For modeling associated targets, existing solutions typically use a single device, a single record, or a single external object as the analysis unit, making it difficult to stably represent the coupling relationships between multiple evidence bodies and multiple external targets within an operational page. This results in discrete monitoring results, loose correlation paths, and incomplete evidence chains, thus failing to meet the requirements for continuous, correlated, and structured monitoring in illegal mining scenarios.

[0004] Therefore, how to provide a knowledge graph-based intelligent monitoring method for digital currency is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a knowledge graph-based intelligent monitoring method for digital currencies. This invention combines primary key concatenation, runtime variable point pagination with CompGCN encoding, and composite shell entity construction with ComplEx scoring to perform structured correlation analysis on records related to illegal mining. It has the advantages of accurate characterization of continuous operation process, strong cross-source correlation capability, stable monitoring results, and clear evidence chain.

[0006] A knowledge graph-based intelligent monitoring method for digital currency according to an embodiment of the present invention includes the following steps:

[0007] Obtain the original record set, perform preprocessing on the original record set, and obtain the standard record set;

[0008] Based on the shared primary key and primary key inheritance relationship in the standard record set, cross-source records are sequentially concatenated, chained and merged, and separated by breakpoints to generate evidence bodies corresponding to the continuous running chains. The record order, inheritance start point and inheritance end point are stored in each evidence body.

[0009] Establish a time series for evidence related to the same asset, determine the operational change point based on the change in operational status, generate operational pages from the continuous segments between adjacent operational change points, classify the evidence located in the continuous segments into the corresponding operational pages, and establish the page chain relationship between the preceding and following operational pages.

[0010] A knowledge graph is constructed based on assets, running pages, evidence bodies, and external targets. External targets are mining pools, wallets, domains, network endpoints, and sample families that are related to the evidence bodies. Node sets, relationship triple sets, and page chain relationships are written into the knowledge graph.

[0011] Input the knowledge graph into CompGCN, perform relation-aware propagation on the adjacency relationships of the node set corresponding to different relation types, and obtain node representations and relation representations;

[0012] Using the running page as the main shell, select evidence bodies that maintain stable association within the same running page and external targets for encapsulation to construct a composite shell entity, and generate candidate triples based on the composite shell entity;

[0013] The candidate triples are input into ComplEx for scoring, which yields the monitoring results of illegal cryptocurrency mining and the corresponding evidence chain.

[0014] Optionally, the preprocessing specifically includes:

[0015] Raw records from power monitoring, main unit operation, network communication and intelligence data are collected to form a raw record set;

[0016] Preprocessing is performed on the original record set, including time unification, format normalization, object mapping, duplicate elimination and anomaly removal, to obtain a standard record set;

[0017] Extract the primary key based on the object identifier, event identifier, and association identifier in the standard record set;

[0018] Establish a shared primary key association for records with the same primary key;

[0019] The primary key succession relationship is determined based on the preceding and following reference relationships, upstream and downstream correspondence relationships, and consecutive occurrence relationships between records;

[0020] Write the association between the primary key and shared primary key, as well as the primary key inheritance relationship, into the standard record set.

[0021] Optionally, generating evidence bodies corresponding to consecutive running chains specifically includes:

[0022] Records with shared primary key associations are used as the initial merge unit, and the records in the initial merge unit are arranged in chronological order.

[0023] Starting from the primary key corresponding to each record in the initial merge unit, search for subsequent records along the direction of the primary key inheritance relationship, and sequentially connect cross-source records with primary key inheritance relationships after the current record to form a sequential chain.

[0024] Perform chain merging on multiple sequential chains pointing to the same continuous process, and determine the merged set of records as a single body of evidence.

[0025] During the sequential connection process, if any of the following situations occur: no subsequent primary key succession relationship, the time interval between adjacent records exceeds the preset interval threshold, the direction of the primary key succession relationship is inconsistent, or the same primary key corresponds to more than one subsequent branch, a breakpoint separation is performed at the current record to divide the records before and after the breakpoint into different evidence bodies.

[0026] For each piece of evidence, the records are generated in sequence according to their positions in the sequential chain. The first record in the sequential chain is used to determine the starting point, and the last record in the sequential chain is used to determine the ending point.

[0027] The evidence body identifier, recording order, starting point and ending point are written into the standard record set.

[0028] Optionally, establishing the page chain relationship between the preceding and following running pages specifically includes:

[0029] For the same asset, all evidence is collected, and corresponding operational status segments are formed based on the starting point, ending point and internal records of each evidence segment. The operational status segments constitute the time sequence of evidence for the same asset.

[0030] For each operational state segment, an operational state identifier is extracted. The operational state identifier is jointly determined by changes in resource usage, communication activity, parsing activity, and execution activity within the assigned interval.

[0031] Compare the running status identifiers corresponding to adjacent running status segments. When the running status identifier changes and the duration reaches the preset duration threshold, or when the primary key connection between adjacent evidence bodies is interrupted and the time interval reaches the preset page interval threshold, the corresponding boundary is determined as a running change point.

[0032] Evidence bodies with consistent running status identifiers between adjacent running change points are grouped into the same continuous segment. A unique running page identifier is assigned to each continuous segment, a running page is generated, and the page start time and page end time corresponding to the running page are recorded.

[0033] For each running page generated under the same asset, a page chain relationship is established based on the continuity between the page end time and the start time of the adjacent page, and the running page identifier, page start time, page end time and page chain relationship are written into the standard record set.

[0034] Optionally, the construction of the knowledge graph based on assets, runtime pages, evidence bodies, and external targets specifically includes:

[0035] Assets, running pages, evidence bodies, and external targets are written into the knowledge graph as different types of nodes. External targets are mining pools, wallets, domains, network endpoints, and sample families that are related to the evidence bodies.

[0036] Based on the attribution, inclusion, association, and page chain relationships in the standard record set, establish attribution connections between assets and operating pages, inclusion connections between operating pages and evidence bodies, association connections between evidence bodies and external targets, and page chain connections between preceding and subsequent operating pages.

[0037] For different evidence bodies within the same running page, retain the corresponding associated paths; for the association relationship of the same external target in different running pages, retain the corresponding running page source.

[0038] By writing the node set, relationship set, and page chain relationship into the knowledge graph, a knowledge graph with hierarchical associations of assets, running pages, evidence bodies, and external targets is obtained.

[0039] Optionally, the process of performing relation-aware propagation on the adjacency relationships corresponding to different relation types of the node set specifically includes:

[0040] Read the node set and relation set in the knowledge graph, and treat the page chain relation as one of the relation types in the relation set;

[0041] Generate initial node representations and initial relation representations based on node type and relation type, respectively;

[0042] According to the adjacency relationship corresponding to different relationship types, read the adjacency information from the associated nodes of each node, and perform relationship-aware propagation in combination with the corresponding relationship type;

[0043] Update the node representation of each node and the relation representation of each relation type based on the relation-aware propagation results;

[0044] Output the updated node and relation representations.

[0045] Optionally, the construction of the composite shell entity specifically includes:

[0046] For each running page, the evidence belonging to the running page and the external targets that are related to the evidence are collected. Based on the duration of the association within the same running page, the recurrence of the association, and the continuity of the page, the evidence and external targets that maintain stable association are determined.

[0047] Using the running page identifier as the main shell identifier, a unique composite shell entity identifier is assigned to each group of evidence bodies and external targets that maintain stable association. The main shell correspondence between the composite shell entity and the running page is established, and the evidence bodies and external targets are written into the internal member set of the composite shell entity.

[0048] The composite shell entity is used as the unified entity for constructing external participation relationships, and the composite shell entity identifier is used to replace the internal member identifier in subsequent relationship construction.

[0049] When evidence or external targets within the same running page are added, deleted, replaced, or split, the relationship between the composite shell entity identifier and the main shell remains unchanged, and only the internal member set and member correspondence record are updated.

[0050] Based on the updated composite shell entity, candidate triples are generated between the composite shell entity and the asset, runtime page, and external target. Independent candidate triple sets are retained for composite shell entities corresponding to different runtime pages.

[0051] Optionally, the step of inputting candidate triples into ComplEx for scoring specifically includes:

[0052] Read the candidate triples, node representations, and relation representations, and map the entities and relations in the candidate triples to the complex representations corresponding to ComplEx;

[0053] The score is calculated based on the complex representation of the head entity, the complex representation of the relation, and the complex representation of the tail entity corresponding to each candidate triple;

[0054] Target candidate triples are selected based on the score, and then merged according to assets, running pages, and composite shell entities;

[0055] The results of monitoring illegal cryptocurrency mining will be determined based on the consolidation results.

[0056] A corresponding evidence chain is generated based on the relationship between the composite shell entity, running page, evidence body, and external target corresponding to the target candidate triple.

[0057] The beneficial effects of this invention are:

[0058] (1) This invention sequentially connects and merges cross-source records based on shared primary keys and primary key inheritance relationships, separates them into chains, organizes the scattered original records into evidence bodies of corresponding continuous running chains, and then carries out subsequent analysis and processing. This avoids the problem of association breakage caused by the prior art directly judging discrete records. It enables records from different sources belonging to the same running process to be merged and represented in a unified structure, improving the integrity and consistency of cross-source data association in illegal mining monitoring.

[0059] (2) The present invention determines the operation change point based on the change of operation status, generates operation pages by continuous segments between adjacent operation change points, and classifies the continuous and consistent evidence bodies under the same asset into the same operation page, replacing the fixed time window division method in the prior art. This can better fit the boundary expression of the actual operation process, reduce the situation where the same abnormal process is fragmented or different operation processes are mixed, and improve the ability to characterize the continuous operation behavior of illegal mining.

[0060] (3) This invention constructs a composite shell entity with the running page as the main shell, and combines CompGCN and ComplEx to complete knowledge graph representation learning and candidate relationship scoring. This enables the evidence body and external target that maintain stable association within the running page to participate in relationship construction and result judgment in a unified entity form, thereby enhancing the overall expressive ability of the coupling relationship of multiple evidence bodies and multiple external targets. The monitoring results obtained have stronger structural stability and can be traced back to form a clear evidence chain. Attached Figure Description

[0061] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0062] Figure 1 This is a flowchart of a knowledge graph-based intelligent monitoring method for digital currency proposed in this invention;

[0063] Figure 2 This is a schematic diagram illustrating the evidence generation of a knowledge graph-based intelligent monitoring method for digital currency proposed in this invention.

[0064] Figure 3 This is a schematic diagram of the knowledge graph structure of the digital currency intelligent monitoring method based on knowledge graph proposed in this invention. Detailed Implementation

[0065] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0066] refer to Figures 1-3A knowledge graph-based intelligent monitoring method for digital currency includes the following steps:

[0067] Obtain the original record set, perform preprocessing on the original record set, and obtain the standard record set;

[0068] Based on the shared primary key and primary key inheritance relationship in the standard record set, cross-source records are sequentially concatenated, chained and merged, and separated by breakpoints to generate evidence bodies corresponding to the continuous running chains. The record order, inheritance start point and inheritance end point are stored in each evidence body.

[0069] Establish a time series for evidence related to the same asset, determine the operational change point based on the change in operational status, generate operational pages from the continuous segments between adjacent operational change points, classify the evidence located in the continuous segments into the corresponding operational pages, and establish the page chain relationship between the preceding and following operational pages.

[0070] A knowledge graph is constructed based on assets, running pages, evidence bodies, and external targets. External targets are mining pools, wallets, domains, network endpoints, and sample families that are related to the evidence bodies. Node sets, relationship triple sets, and page chain relationships are written into the knowledge graph.

[0071] Input the knowledge graph into CompGCN, perform relation-aware propagation on the adjacency relationships of the node set corresponding to different relation types, and obtain node representations and relation representations;

[0072] Using the running page as the main shell, select evidence bodies that maintain stable association within the same running page and external targets for encapsulation to construct a composite shell entity, and generate candidate triples based on the composite shell entity;

[0073] The candidate triples are input into ComplEx for scoring, which yields the monitoring results of illegal cryptocurrency mining and the corresponding evidence chain.

[0074] In this embodiment, the preprocessing specifically includes:

[0075] Raw records from power monitoring, host operation, network communication and intelligence data are collected to form a raw record set; the raw records in the intelligence data include mining pool identifier records, wallet identifier records, domain name identifier records, network endpoint identifier records and sample family identifiers;

[0076] The original record set is preprocessed, including time unification, format normalization, object mapping, deduplication, and anomaly removal, to obtain a standard record set. Format normalization includes unifying field names, field types, encoding methods, and record separation methods. Object mapping involves mapping different identifiers of the same asset in original records from different sources to the same object identifier. Deduplication involves removing duplicate records with the same timestamp, object identifier, and event content. Anomaly removal involves deleting records with missing key time information, missing object identifiers, abnormal record lengths, or sample values ​​exceeding a preset range, where the preset range is set according to the collection rules of each source record. Assets refer to unified objects at the device or host level formed after object mapping.

[0077] The primary key is extracted based on the object identifier, event identifier, and association identifier in the standard record set; the primary key can be a single-field primary key or a composite-field primary key; when a single identifier can uniquely represent a record, the single identifier is directly used as the primary key; when a single identifier is insufficient to uniquely represent a record, at least two of the object identifier, event identifier, and time information are combined as a composite primary key.

[0078] Establish shared primary key associations for records with the same primary key; group records with completely identical primary keys into the same shared primary key set and assign a unique set number to each shared primary key set; when records in the same shared primary key set come from two or more data sources, retain the source marker and time order of each record;

[0079] Primary key inheritance relationships are determined based on the preceding and following references, upstream and downstream correspondences, and consecutive occurrence relationships between records. The preceding and following references include the correspondence where the identifier of the next record is stored in the previous record or vice versa. The upstream and downstream correspondences include the correspondence between requests and responses, parsing and joining, generation and execution, and input and output. The consecutive occurrence relationships include the correspondence where the same object continues from one record to the next within a consecutive time period. When determining primary key inheritance relationships, matching is first performed chronologically within the shared primary key set, and then matching is performed between different shared primary key sets based on reference relationships, correspondences, and consecutive time intervals. A primary key inheritance relationship is established between the corresponding primary keys of two successfully matched records, recording the inheritance direction.

[0080] Write the association between the primary key and shared primary key, as well as the primary key inheritance relationship, into the standard record set.

[0081] In this embodiment, generating evidence bodies corresponding to the continuous operation chains specifically includes:

[0082] Records with shared primary key associations are used as the initial merge unit, and the records in the initial merge unit are arranged in chronological order. Records belonging to the same shared primary key set are identified as one initial merge unit.

[0083] Starting from the primary key of each record in the initial merge unit, search for subsequent records along the direction of the primary key inheritance relationship. Records with primary key inheritance relationships across different data sources are sequentially appended to the current record, forming a sequential chain. Each record in the initial merge unit is used as the starting record, and the primary key inheritance relationship of the starting record's corresponding primary key in the standard record set is read. Following the inheritance direction, subsequent records are searched one by one among records from different data sources. The found subsequent records are appended to the current record, and the search continues until no new subsequent records exist. Cross-source records must come from at least two different data sources.

[0084] Chain merging is performed on multiple sequential chains pointing to the same continuous process, and the merged set of records is determined as a single evidence body. When two sequential chains meet at least one of the following conditions: they are contiguous, they have common records, they share a common primary key set, they correspond to the same asset, and their time segments are continuous, the two sequential chains are merged into the same continuous process. Chain merging is performed using an iterative merging method, first merging sequential chains with direct continuation relationships, then merging sequential chains that continue from the merged results, until no new sequential chains that can be merged are available.

[0085] During the sequential concatenation process, if any of the following situations occur: no subsequent primary key succession relationship exists, the time interval between adjacent records exceeds the preset interval threshold, the direction of the primary key succession relationship is inconsistent, or the same primary key corresponds to more than one subsequent branch, a breakpoint separation is performed at the current record to divide the records before and after the breakpoint into different evidence bodies. The preset interval threshold is set according to the combination of data sources. When adjacent records come from host operation and network communication, the preset interval threshold is set to 10 minutes; when adjacent records come from power monitoring and host operation, the preset interval threshold is set to 30 minutes. When the breakpoint separation is performed, the current record is determined as the termination record of the previous evidence body, and the first record after the breakpoint is determined as the starting record of the next evidence body. When the same primary key corresponds to more than one subsequent branch, multiple sequential concatenation chains are generated according to the succession direction, and the evidence body splitting is completed at the branch starting point.

[0086] For each piece of evidence, the records are generated in sequence according to their positions in the sequential chain. The first record in the sequential chain is used to determine the starting point, and the last record in the sequential chain is used to determine the ending point.

[0087] The evidence body identifier, recording order, starting point and ending point are written into the standard record set.

[0088] In this embodiment, establishing the page chain relationship between the preceding and following running pages specifically includes:

[0089] For the same asset, all evidence bodies are collected, and corresponding operational state segments are formed based on the starting point, ending point and internal records of each evidence body. The operational state segments constitute the time series of evidence bodies for the same asset. When the time intervals of two evidence bodies overlap and the primary key connection is continuous, the two evidence bodies are merged and mapped into the same operational state segment.

[0090] For each running state segment, a running state identifier is extracted. The running state identifier is jointly determined by changes in resource usage, communication activity, parsing activity, and execution activity within the receiving interval. Changes in resource usage are characterized by at least one of the following: processor utilization rate, graphics processor utilization rate, memory utilization rate, and power consumption change magnitude within the receiving interval. Changes in communication activity are characterized by at least one of the following: number of connections, connection hold duration, and number of times the connection target changes. Changes in parsing activity are characterized by at least one of the following: number of parsing requests and number of times the parsing result changes. Changes in execution activity are characterized by at least one of the following: number of process starts, number of process exits, and number of file executions. The results of each representation are mapped to discrete state values ​​according to a preset hierarchical interval, and then combined to generate the running state identifier.

[0091] Compare the running status identifiers corresponding to adjacent running status segments. When the running status identifier changes and the duration reaches the preset duration threshold, or when the primary key connection between adjacent evidence bodies is interrupted and the time interval reaches the preset page interval threshold, the corresponding boundary is determined as a running change point.

[0092] Evidence bodies with consistent running status identifiers between adjacent running change points are grouped into the same continuous segment. A unique running page identifier is assigned to each continuous segment, a running page is generated, and the page start time and page end time corresponding to the running page are recorded.

[0093] For each running page generated under the same asset, a page chain relationship is established based on the continuity between the page end time and the start time of the adjacent page, and the running page identifier, page start time, page end time and page chain relationship are written into the standard record set.

[0094] In this implementation, the construction of a knowledge graph based on assets, runtime pages, evidence bodies, and external targets specifically includes:

[0095] Assets, running pages, evidence bodies, and external targets are written into the knowledge graph as different types of nodes. External targets are mining pools, wallets, domains, network endpoints, and sample families that are related to the evidence bodies.

[0096] Based on the attribution, inclusion, association, and page chain relationships in the standard record set, attribution connections are established between assets and running pages, inclusion connections are established between running pages and evidence bodies, association connections are established between evidence bodies and external targets, and page chain connections are established between preceding and subsequent running pages; each running page corresponds to one asset, each evidence body corresponds to one running page, each evidence body is associated with several external targets, and one page chain connection is established between adjacent running pages;

[0097] For different evidence bodies within the same running page, retain their corresponding association paths. For the association of the same external target in different running pages, retain the corresponding running page source. When multiple evidence bodies within the same running page point to the same external target, retain the independent connection records from each evidence body to the external target, and do not perform merging processing. When the same external target appears repeatedly in multiple running pages, record the corresponding association source according to the running page identifier. Each association path must contain at least three nodes: running page, evidence body, and external target.

[0098] By writing the node set, relationship set, and page chain relationship into the knowledge graph, a knowledge graph with hierarchical associations of assets, running pages, evidence bodies, and external targets is obtained.

[0099] In this embodiment, the mining pool, wallet, domain name, network endpoint, and sample family specifically include:

[0100] Mining pool: refers to a digital currency mining service object that receives the results of computing power submissions and distributes the profits. In this scheme, it is used as an external target associated with the evidence body to characterize the mining service that the monitored object connects to, requests, submits to, or belongs to during the operation of the monitoring object.

[0101] Wallet: refers to the address object used to identify the recipient of digital currency earnings. In this scheme, it serves as an external target associated with the evidence and is used to characterize the earnings collection object, earnings receiving object, or configuration target object corresponding to the monitored object during operation.

[0102] Domain name: refers to the domain name identifier used to locate the target service during network communication. In this scheme, it is used as an external target associated with the evidence body to characterize the name object to which the monitored object points during the operation of the resolution, request or connection.

[0103] Network endpoint: refers to the address access object used to determine the communication peer during network communication. In this scheme, it is determined by both address identifier and port identifier, and is used to characterize the target access location of the monitored object in operation, which is actually connected, maintains the session or exchanges data.

[0104] Sample family: refers to the classification object formed by similar program samples based on code characteristics, behavioral characteristics or configuration characteristics. In this scheme, it serves as an external target associated with the evidence body and is used to characterize the mining program category corresponding to the monitored object during operation.

[0105] In this embodiment, performing relation-aware propagation on the adjacency relationships corresponding to different relation types of a node set specifically includes:

[0106] Read the node set and relation set from the knowledge graph, and treat page chain relations as one of the relation types in the relation set; before inputting into CompGCN, retain the original direction for each relation type, supplement the corresponding reverse relation for each original direction relation, and supplement the self-loop relation for each node; page chain relations participate in subsequent propagation calculations as an independent relation type between running page nodes; the original approach of CompGCN allows directed edge propagation along the original and reverse directions, and handles self-loop relations separately;

[0107] Generate initial node representations and initial relation representations based on node type and relation type, respectively;

[0108] According to the adjacency relationships corresponding to different relation types, the adjacency information of each node is read from its associated nodes, and relation-aware propagation is performed in combination with the corresponding relation type. For each target node, the representation of the associated nodes connected to the target node and the corresponding relation representation are read according to the relation type. The associated node representation and the corresponding relation representation are first combined, and then the combination result is used as the adjacency information under the relation type for aggregation. The combination operation adopts any one of subtraction, element-wise multiplication or cyclic correlation. The original directional relation, reverse relation and self-loop relation are processed with independent parameter matrices, and then the processing results are summed and aggregated and then nonlinearly activated to obtain the propagation result. The core technology of CompGCN is to first combine the entity representation and relation representation, and then convolve and aggregate them according to the three channels of the original direction, reverse direction and self-loop.

[0109] The node representation of each node and the relation representation of each relation type are updated based on the relation-aware propagation results; the propagation result corresponding to each node is used as the node representation of the next layer, and a relation transformation matrix is ​​used to perform a linear transformation on the relation representation of each relation type to obtain the relation representation of the next layer; the relation transformation matrix is ​​shared by all relation types; after the node is updated, CompGCN also performs a separate transformation on the relation representation so that subsequent layers can continue to use the updated relation representation;

[0110] Output the updated node and relation representations.

[0111] In this embodiment, constructing the composite shell entity specifically includes:

[0112] For each running page, evidence bodies belonging to that running page and external targets associated with those evidence bodies are collected. Based on the association duration interval, association recurrence, and page continuity within the same running page, evidence bodies and external targets that maintain stable associations are determined. Using a single running page as the encapsulation scope, all evidence bodies belonging to that running page and external targets associated with those evidence bodies are read. The association duration interval is characterized by the continuous time length during which the same evidence body and the same external target maintain an association within the running page, with a duration threshold set to 12 hours. The association recurrence is characterized by the number of times the same evidence body and the same external target are repeatedly associated within the running page, with a recurrence threshold set to 100 times. Page continuity is characterized by the existence of a primary key connection between evidence bodies and the interruption interval not exceeding a preset continuity threshold, which is set to 30 minutes. When the association duration interval reaches the duration threshold, the association recurrence reaches the recurrence threshold, and the page continuity meets at least two of the preset continuity thresholds, the corresponding evidence body and external target are determined as evidence bodies and external targets that maintain stable associations.

[0113] Using the runtime page identifier as the primary shell identifier, a unique composite shell entity identifier is assigned to each group of evidence bodies and external targets that maintain stable association. A primary shell correspondence is established between the composite shell entities and the runtime page. The evidence bodies and external targets are written into the internal member set of the composite shell entity. A composite shell entity is generated for each group of evidence bodies and external targets that maintain stable association within each runtime page. One runtime page corresponds to several composite shell entities, and one composite shell entity corresponds to only one runtime page. The internal member set contains at least one evidence body and one external target. Each member in the internal member set is recorded with its member identifier, member type, addition time, and source runtime page identifier.

[0114] The composite shell entity serves as the unified entity for constructing external participation relationships, and its identifier replaces internal member identifiers in subsequent relationship construction. During this phase, all external connections use the composite shell entity identifier as the connection start or end point, instead of directly using the evidence body identifier or external target identifier from the internal member set. External connections include at least the ownership relationship between the composite shell entity and the asset, the encapsulation relationship between the composite shell entity and the runtime page, and the association relationship between the composite shell entity and the external target. When multiple internal members point to the same external target, only the external connection between the composite shell entity and the external target is retained, while the corresponding member record is preserved in the composite shell entity's internal member set.

[0115] When evidence or external targets within the same running page are added, deleted, replaced, or split, the correspondence between the composite shell entity identifier and the main shell remains unchanged; only the internal member set and its corresponding records are updated. Additions include adding new evidence or external targets to the internal member set; deletions include removing existing evidence or external targets from the internal member set; replacements include replacing existing member identifiers with new evidence or external target identifiers for the same member type; splitting involves dividing some members in the original internal member set into new internal member subsets. When additions, deletions, replacements, or splits occur, the correspondence between the original composite shell entity identifier and the original running page identifier is retained; only the member identifier, number of members, member type, addition time, removal time, and change type records in the internal member set are rewritten. In the case of splitting, the original composite shell entity retains the member set that has not been split, and the split member subset generates a new composite shell entity, establishing a new correspondence between the composite shell entity identifier and the main shell identifier of the same running page.

[0116] Based on the updated composite shell entity, candidate triples are generated between the composite shell entity and assets, runtime pages, and external targets. Independent sets of candidate triples are retained for composite shell entities corresponding to different runtime pages. For each updated composite shell entity, candidate triples are generated between the composite shell entity and its associated assets, between the composite shell entity and its associated runtime page, and between the composite shell entity and the external targets associated with its internal member set. Each composite shell entity corresponds to one independent set of candidate triples. Candidate triple sets for different composite shell entities within the same runtime page are stored separately, and cross-composite shell entity merging is not performed. When the internal member set changes, candidate triples corresponding to removed members are deleted, candidate triples corresponding to newly added members are added, and candidate triples corresponding to unchanged members are retained.

[0117] In this embodiment, inputting candidate triples into ComplEx for scoring specifically includes:

[0118] Read the candidate triples, node representations, and relation representations, and map the entities and relations in the candidate triples to their corresponding complex representations in ComplEx. For each entity input representation and relation input representation, perform real part mapping and imaginary part mapping respectively to obtain the corresponding complex representation. The real part mapping and imaginary part mapping are generated using a linear mapping method, and the dimension of the mapped complex representation is the same as the dimension of the input representation. The head entity, relation, and tail entity in the candidate triples are all represented using complex numbers of the same dimension.

[0119] The score is calculated based on the complex representation of the head entity, the complex representation of the relation, and the complex representation of the tail entity corresponding to each candidate triple; for each candidate triple, the corresponding complex representation of the head entity, the complex representation of the relation, and the complex representation of the tail entity are read, and the score is calculated according to the ComplEx scoring function; the score is a real value, and the value range is set to 0 to 1; the score is calculated for each candidate triple, and a set of score results is formed.

[0120] Target candidate triples are selected based on the score, and then merged according to assets, running pages, and composite shell entities;

[0121] The monitoring results for illegal cryptocurrency mining are determined based on the merging results; the monitoring results for illegal cryptocurrency mining shall at least record the corresponding asset identifier, running page identifier, composite shell entity identifier, number of target candidate triples, and scoring results;

[0122] A corresponding evidence chain is generated based on the relationship between the composite shell entity, running page, evidence body, and external target corresponding to the target candidate triple.

[0123] Example 1: To verify the feasibility of this invention in practice, it was applied to a scenario of monitoring illegal cryptocurrency mining. In this scenario, the monitoring system needs to simultaneously collect power consumption data, host operation logs, network communication records, and intelligence data, and integrate data from different sources. Traditional monitoring methods suffer from problems such as the inability to continuously correlate cross-source data, difficulty in accurately classifying operational states, and incomplete evidence chains, making it difficult to detect illegal mining activities in a timely manner. This invention addresses these problems by providing an intelligent monitoring method based on knowledge graphs, which achieves the integration of cross-source records, continuous analysis of operational states, and structured association of multiple evidence bodies with external targets, thereby improving monitoring accuracy and the completeness of the evidence chain.

[0124] In practical applications, the system collects various raw records and performs preprocessing operations, including time unification, format standardization, object mapping, duplicate elimination, and anomaly removal, to obtain a standard record set. Based on shared primary keys and primary key inheritance relationships, it performs sequential concatenation, chain-like merging, and breakpoint separation on cross-source records to generate a continuously running chain of evidence, recording the order and start and end points of the evidence. This solves the problem of incomplete association caused by record fragmentation in traditional methods. The system establishes a time series for evidence bodies associated with the same asset, determines operational change points by analyzing changes in operational status, generates operational pages from continuous segments between adjacent change points, and establishes page chain relationships between preceding and following operational pages. This step effectively ensures a complete characterization of continuous operational behavior.

[0125] When constructing the knowledge graph, assets, running pages, evidence bodies, and their associated mining pools, wallets, domains, network endpoints, and sample families are written as different types of nodes, generating corresponding relation sets and page chain relationships. After the knowledge graph is input into CompGCN, relation-aware propagation is performed on the adjacency relationships corresponding to different relation types to obtain node representations and relation representations. These representations provide basic data for the subsequent construction of composite shell entities. Using the running page as the main shell, evidence bodies and external targets that maintain stable associations within the same running page are selected for encapsulation to form composite shell entities. Candidate triples are generated based on the composite shell entities, and finally, the candidate triples are input into ComplEx for scoring to obtain the monitoring results of illegal cryptocurrency mining and the corresponding evidence chain.

[0126] In practical applications, this invention can not only accurately detect abnormal behavior of individual assets, but also identify illegal mining behavior across assets and operating pages, ensuring that the monitoring system has high reliability and scalability, and is suitable for large-scale, multi-source digital currency monitoring scenarios.

[0127] Table 1: Performance Comparison of Detection Methods for Illegal Cryptocurrency Mining

[0128] index Traditional fixed window method Method of the present invention Average number of pieces of evidence 130 210 Average number of pages 45 80 Cross-source association completeness 62% 97% Continuous operation cutting error 0.35 0.12 Completeness of the chain of evidence 55% 97.8% Monitoring accuracy 78.4% 94.6% Recall rate 74.1% 91.2% Average chain of evidence length 12 17

[0129] The method of this invention outperforms traditional fixed-window analysis methods in all metrics. The increased number of evidence bodies and running pages reflects a more complete integration capability across source records; the improved cross-source correlation completeness indicates effective merging of multi-source records for the same running process; and the reduced continuous running segmentation error suggests that running page partitioning more closely matches actual behavioral boundaries. The evidence chain integrity improved to 97.8%, indicating that the composite shell entity encapsulation and candidate triple generation methods effectively preserved key evidence. Monitoring accuracy and recall are both close to or exceed 90%, demonstrating that this method can efficiently identify illegal mining activities in actual monitoring, providing a complete and traceable evidence chain, and offering a reliable basis for subsequent decision-making and accountability. Overall, the data shows that the method of this invention achieves improvements in continuity, correlation, and structured monitoring capabilities.

[0130] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A knowledge graph-based intelligent monitoring method for digital currency, characterized in that, Includes the following steps: Obtain the original record set, perform preprocessing on the original record set, and obtain the standard record set; Based on the shared primary key and primary key inheritance relationship in the standard record set, cross-source records are sequentially concatenated, chained and merged, and separated by breakpoints to generate evidence bodies corresponding to the continuous running chains. The record order, inheritance start point and inheritance end point are stored in each evidence body. Establish a time series for evidence related to the same asset, determine the operational change point based on the change in operational status, generate operational pages from the continuous segments between adjacent operational change points, classify the evidence located in the continuous segments into the corresponding operational pages, and establish the page chain relationship between the preceding and following operational pages. A knowledge graph is constructed based on assets, running pages, evidence bodies, and external targets. External targets are mining pools, wallets, domains, network endpoints, and sample families that are related to the evidence bodies. Node sets, relationship triple sets, and page chain relationships are written into the knowledge graph. Input the knowledge graph into CompGCN, perform relation-aware propagation on the adjacency relationships of the node set corresponding to different relation types, and obtain node representations and relation representations; Using the running page as the main shell, select evidence bodies that maintain stable association within the same running page and external targets for encapsulation to construct a composite shell entity, and generate candidate triples based on the composite shell entity; The candidate triples are input into ComplEx for scoring, which yields the monitoring results of illegal cryptocurrency mining and the corresponding evidence chain.

2. The digital currency intelligent monitoring method based on knowledge graphs according to claim 1, characterized in that, The preprocessing specifically includes: Raw records from power monitoring, main unit operation, network communication and intelligence data are collected to form a raw record set; Preprocessing is performed on the original record set, including time unification, format normalization, object mapping, duplicate elimination and anomaly removal, to obtain a standard record set; Extract the primary key based on the object identifier, event identifier, and association identifier in the standard record set; Establish a shared primary key association for records with the same primary key; The primary key succession relationship is determined based on the preceding and following reference relationships, upstream and downstream correspondence relationships, and consecutive occurrence relationships between records; Write the association between the primary key and shared primary key, as well as the primary key inheritance relationship, into the standard record set.

3. The digital currency intelligent monitoring method based on knowledge graphs according to claim 2, characterized in that, The generation of evidence bodies corresponding to the continuous running chains specifically includes: Records with shared primary key associations are used as the initial merge unit, and the records in the initial merge unit are arranged in chronological order. Starting from the primary key corresponding to each record in the initial merge unit, search for subsequent records along the direction of the primary key inheritance relationship, and sequentially connect cross-source records with primary key inheritance relationships after the current record to form a sequential chain. Perform chain merging on multiple sequential chains pointing to the same continuous process, and determine the merged set of records as a single body of evidence. During the sequential connection process, if any of the following situations occur: no subsequent primary key succession relationship, the time interval between adjacent records exceeds the preset interval threshold, the direction of the primary key succession relationship is inconsistent, or the same primary key corresponds to more than one subsequent branch, a breakpoint separation is performed at the current record to divide the records before and after the breakpoint into different evidence bodies. For each piece of evidence, the records are generated in sequence according to their positions in the sequential chain. The first record in the sequential chain is used to determine the starting point, and the last record in the sequential chain is used to determine the ending point. The evidence body identifier, recording order, starting point and ending point are written into the standard record set.

4. The digital currency intelligent monitoring method based on knowledge graphs according to claim 3, characterized in that, The establishment of the page chain relationship between the pre- and post-running pages specifically includes: For the same asset, all evidence is collected, and corresponding operational status segments are formed based on the starting point, ending point and internal records of each evidence segment. The operational status segments constitute the time sequence of evidence for the same asset. For each operational state segment, an operational state identifier is extracted. The operational state identifier is jointly determined by changes in resource usage, communication activity, parsing activity, and execution activity within the assigned interval. Compare the running status identifiers corresponding to adjacent running status segments. When the running status identifier changes and the duration reaches the preset duration threshold, or when the primary key connection between adjacent evidence bodies is interrupted and the time interval reaches the preset page interval threshold, the corresponding boundary is determined as a running change point. Evidence bodies with consistent operational status identifiers between adjacent operational change points are grouped into the same continuous segment. A unique operational page identifier is assigned to each continuous segment, an operational page is generated, and the start and end times of the corresponding operational page are recorded. For each running page generated under the same asset, a page chain relationship is established based on the continuity between the page end time and the start time of the adjacent page, and the running page identifier, page start time, page end time and page chain relationship are written into the standard record set.

5. The digital currency intelligent monitoring method based on knowledge graphs according to claim 4, characterized in that, The construction of the knowledge graph based on assets, runtime pages, evidence bodies, and external targets specifically includes: Assets, running pages, evidence bodies, and external targets are written into the knowledge graph as different types of nodes. External targets are mining pools, wallets, domain names, network endpoints, and sample families that are related to the evidence bodies. Based on the attribution, inclusion, association, and page chain relationships in the standard record set, establish attribution connections between assets and operating pages, inclusion connections between operating pages and evidence bodies, association connections between evidence bodies and external targets, and page chain connections between preceding and subsequent operating pages. For different evidence bodies within the same running page, retain the corresponding associated paths; for the association relationship of the same external target in different running pages, retain the corresponding running page source. By writing the node set, relationship set, and page chain relationship into the knowledge graph, a knowledge graph with hierarchical associations of assets, running pages, evidence bodies, and external targets is obtained.

6. The digital currency intelligent monitoring method based on knowledge graphs according to claim 5, characterized in that, The specific steps of performing relation-aware propagation on the adjacency relationships of the node set corresponding to different relation types include: Read the node set and relation set in the knowledge graph, and treat the page chain relation as one of the relation types in the relation set; Generate initial node representations and initial relation representations based on node type and relation type, respectively; According to the adjacency relationship corresponding to different relationship types, read the adjacency information from the associated nodes of each node, and perform relationship-aware propagation in combination with the corresponding relationship type; Update the node representation of each node and the relation representation of each relation type based on the relation-aware propagation results; Output the updated node and relation representations.

7. The digital currency intelligent monitoring method based on knowledge graphs according to claim 6, characterized in that, The constructed composite shell entity specifically includes: For each running page, the evidence belonging to the running page and the external targets that are related to the evidence are collected. Based on the duration of the association within the same running page, the recurrence of the association, and the continuity of the page, the evidence and external targets that maintain stable association are determined. Using the running page identifier as the main shell identifier, a unique composite shell entity identifier is assigned to each group of evidence bodies and external targets that maintain stable association. The main shell correspondence between the composite shell entity and the running page is established, and the evidence bodies and external targets are written into the internal member set of the composite shell entity. The composite shell entity is used as the unified entity for constructing external participation relationships, and the composite shell entity identifier is used to replace the internal member identifier in subsequent relationship construction. When evidence or external targets within the same running page are added, deleted, replaced, or split, the relationship between the composite shell entity identifier and the main shell remains unchanged, and only the internal member set and member correspondence record are updated. Based on the updated composite shell entity, candidate triples are generated between the composite shell entity and the asset, runtime page, and external target. Independent candidate triple sets are retained for composite shell entities corresponding to different runtime pages.

8. The digital currency intelligent monitoring method based on knowledge graphs according to claim 7, characterized in that, The specific steps of inputting candidate triplets into ComplEx for scoring include: Read the candidate triples, node representations, and relation representations, and map the entities and relations in the candidate triples to the complex representations corresponding to ComplEx; The score is calculated based on the complex representation of the head entity, the complex representation of the relation, and the complex representation of the tail entity corresponding to each candidate triple; Target candidate triples are selected based on the score, and then merged according to assets, running pages, and composite shell entities; The results of monitoring illegal cryptocurrency mining will be determined based on the consolidation results. A corresponding evidence chain is generated based on the relationship between the composite shell entity, running page, evidence body, and external target corresponding to the target candidate triple.

Images