An online transaction fraud detection method based on smart contract

Abstract

This invention discloses a smart contract-based method for detecting online transaction fraud, comprising: Step 1: collecting transaction behavior data, encoding it to generate a transaction pre-execution commitment vector, and writing it into a smart contract; Step 2: establishing a shadow ledger resource mapping table based on the transaction pre-execution commitment vector and registering resource pre-occupancy; Step 3: constructing a template for the contract's expected execution path; Step 4: extracting trajectory offset features between the actual execution trajectory and the expected path and constructing a hierarchical empirical distribution; Step 5: performing improved COPOD anomaly calculation based on the hierarchical empirical distribution to obtain path offset anomaly values; Step 6: calculating the resource bounce index and switching to a reversible liquidation state when the anomaly triggering condition is met; Step 7: generating a judgment result and executing the corresponding liquidation path. This invention achieves high-precision detection and hierarchical liquidation control of online transaction fraud.

Description

Technical Field

[0001] This invention relates to the fields of blockchain and anomaly detection technology, and in particular to a method for detecting online transaction fraud based on smart contracts. Background Technology

[0002] With the widespread application of blockchain technology in e-commerce and online payment scenarios, online transaction processing based on smart contracts has gradually become mainstream. The transaction execution process is automatically completed by on-chain contracts, featuring decentralization, traceability, and immutability. While improving transaction transparency, this also places higher demands on transaction fraud detection. Existing technologies mainly rely on detection methods based on account behavior characteristics, transaction amount statistics, or rule matching for online transaction fraud identification. However, these methods commonly suffer from the following problems in complex real-world transaction environments: Traditional detection methods based on statistical features or rule matching focus on analyzing the attributes of a single transaction or the distribution of historical behavior, lacking the ability to dynamically model the smart contract execution process and failing to depict the state evolution characteristics of a transaction along the execution path. This results in insufficient ability to identify fraudulent behaviors such as path deviation. Furthermore, existing methods typically do not model the resource occupation and release relationships during transaction execution, making it difficult to reflect the changes in the relationship between funds, addresses, and session resources, and failing to effectively identify complex behaviors such as repeated resource occupation or abnormal bounces. In addition, existing anomaly detection algorithms often directly apply to raw features or simple statistical features without combining execution path structure and state hierarchy information for constraint modeling, making anomaly judgment results susceptible to noise interference and exhibiting poor stability. Regarding transaction processing mechanisms, existing technologies typically terminate or mark transactions directly after detecting anomalies, lacking a hierarchical settlement control mechanism based on execution state, making it difficult to balance security and transaction continuity.

[0003] Therefore, how to provide a smart contract-based method for detecting online transaction fraud is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] One objective of this invention is to propose a smart contract-based method for detecting online transaction fraud. This invention constructs a transaction pre-execution commitment vector and a shadow ledger resource mapping table, combining execution path templates and trajectory offset feature modeling to achieve a structured characterization of the transaction execution process. In anomaly detection, the invention improves the COPOD algorithm by introducing state hierarchies, sequence changes, and resource associations to enhance anomaly identification accuracy. Furthermore, it implements tiered liquidation control through resource bounce indexes and reversible liquidation mechanisms, thereby improving transaction processing flexibility while ensuring security.

[0005] A method for detecting online transaction fraud based on smart contracts according to an embodiment of the present invention includes the following steps: Step 1: Collect transaction behavior data, encode the transaction behavior data to generate a transaction pre-execution commitment vector, and write it into the smart contract; Step 2: Based on the transaction pre-execution commitment vector, establish a shadow ledger resource mapping table to pre-register the use of funds, preferential resources, address resources, and session resources; Step 3: Construct a contract expected execution path template based on the transaction pre-execution commitment vector and the shadow ledger resource mapping table; Step 4: Record the actual execution trajectory during the transaction execution process, extract trajectory offset features based on the actual execution trajectory and the contract's expected execution path template, generate a trajectory offset feature vector, and construct a hierarchical empirical distribution based on the trajectory offset features corresponding to historical normal transactions; Step 5: Based on the hierarchical empirical distribution, perform COPOD anomaly calculation on the trajectory offset feature vector, and combine state hierarchical constraints, feature order change amount and resource association relationship to obtain path offset anomaly value; Step 6: Based on the shadow ledger resource mapping table, statistical analysis of resource occupation, release, and reoccupation behavior is performed to obtain the resource bounce index. If the path offset anomaly or the resource bounce index meets the anomaly triggering condition, the transaction is switched to a reversible settlement state. Step 7: Generate a judgment result based on the information recorded in the reversible liquidation state, and execute the corresponding liquidation path according to the judgment result.

[0006] Optionally, step one specifically includes: Collect transaction behavior data, which includes transaction request identifier, transaction type identifier, request timestamp and terminal session identifier output by the order access node, account identifier and account status identifier output by the account authentication node, payment path identifier and payment tool category identifier output by the payment gateway node, and contract function identifier and contract call order identifier output by the contract execution node. The transaction behavior data is categorized by field. Based on the data type of the fields and the statistical distribution characteristics of the values ​​of each field in historical transaction samples, the transaction behavior data is divided into transaction request fields, account fields, payment path fields, terminal session fields, and contract call fields, and arranged according to the order in which the fields appear during the transaction execution process. Each field is encoded. For the category field, the frequency of each value in the historical transaction samples is counted, and the values ​​are sorted from highest to lowest frequency. The sorting number is then mapped to a discrete encoded value. For the time field, the difference between adjacent time values ​​in the historical transaction samples is counted, and the distribution range of the time difference is divided into multiple continuous intervals. Each interval is then mapped to an interval code. For the sequence field, an ascending sequence code is assigned according to the order of invocation. For the status field, a flag code is generated according to the set of status values. The encoded fields are concatenated in order to form a field encoding sequence. For missing fields, the code corresponding to the most frequent value is selected based on the frequency of the same type of field in historical transaction samples and filled in. The code is then padded according to the maximum length of the field encoding sequence to obtain the transaction pre-execution commitment vector. Establish the correspondence between the transaction pre-execution commitment vector, the transaction request identifier, and the write timestamp, and write it to the smart contract storage area.

[0007] Optionally, step two specifically involves: Read the corresponding fund identifier field, discount identifier field, address identifier field and session identifier field from the transaction pre-execution commitment vector, extract the resource identifier set, and divide it into fund resource set, discount resource set, address resource set and session resource set according to resource type; Each identifier in the resource identifier set is indexed and numbered according to its order of appearance, forming a sequence of numbered resource identifiers; For each resource identifier with a serial number, a resource mapping unit is generated. The resource mapping unit includes a resource identifier, an occupying entity identifier, an occupation start time, an occupation status flag, and a release condition field. The occupying entity identifier is generated by concatenating the transaction request identifier and the account identifier according to the field concatenation method. The occupation start time is determined by the transaction request timestamp. The occupation status flag is set to the occupation status. The release condition field is assigned a value according to the number of each status node in the transaction execution path. A shadow ledger resource mapping table is established based on each resource mapping unit. The shadow ledger resource mapping table includes a funds resource mapping table, a discount resource mapping table, an address resource mapping table, and a session resource mapping table. Each resource mapping table contains the resource mapping units in the corresponding resource set. Each resource mapping unit is written into the corresponding resource mapping table in the order of the resource identifier sequence. The resource mapping tables are then aggregated to form a shadow ledger resource mapping table, which is then written into the smart contract storage area. At the same time, a correspondence is established between the shadow ledger resource mapping table and the transaction request identifier.

[0008] Optionally, step three specifically includes: Read the transaction type identifier, payment path identifier, and contract function identifier from the transaction pre-execution commitment vector, and read the resource type identifier sequence from the shadow ledger resource mapping table. Read the transaction process node sequence corresponding to the transaction type identifier, and combine the arrangement order of each resource in the resource type identifier sequence to segment and arrange the transaction process nodes to form a transaction execution stage set. A set of state nodes is generated according to the stage order in the transaction execution stage set. A sequence number is assigned to each state node, and each state node is written into the corresponding fields along with its corresponding contract function identifier and resource type identifier. A set of state transition edges is constructed based on the set of state nodes, and directed connections are established between adjacent state nodes to form the initial execution path structure; For each state transition edge, set transition constraint parameters, including state dwell time range, field change number limit, contract function call number set and resource consumption limit. Statistically analyze the dwell time data of each state node in historical transaction samples, calculate the time value range and divide it into state dwell time ranges, statistically analyze the field change number data to determine the field change number limit, and statistically analyze the resource consumption data to determine the resource consumption limit. The set of state nodes, the set of state transition edges, and the corresponding transition constraint parameters are combined to form the contract's expected execution path template, which is then written into the smart contract storage area in the order of the state node numbers.

[0009] Optionally, step four specifically includes: During the transaction execution process, the entry time, exit time, corresponding contract function identifier, and resource type identifier of each state node are collected, and the actual execution trajectory sequence is formed according to the state node number order. Compare the actual execution trajectory sequence with the corresponding node number in the state node sequence of the contract's expected execution path template one by one according to the state node number order, and record the number of unmatched state nodes and the number of missing state nodes. The adjacent state node pairs in the actual execution trajectory sequence are traversed, and the numbers of each adjacent state node are combined to form a transition edge sequence. This sequence is then matched with the set of state transition edges in the contract's expected execution path template, and the number of transition edges that do not appear in the set of state transition edges is counted. The dwell time of each state node is calculated by subtracting the entry time from the exit time to obtain the dwell duration, and then compared with the state dwell duration range of the corresponding state node. The difference in dwell duration exceeding the range is accumulated. The values ​​of fields corresponding to adjacent state nodes are compared, the number of times the values ​​are different is counted, the total number of field changes is recorded, and the number of times resource occupation, release and reoccupation occur in the resource mapping unit is counted to form the resource bounce count; The number of unmatched state nodes, the number of missing state nodes, the number of unmatched transition edges, the difference in dwell time, the total number of field changes, and the number of resource bounces are arranged in the order of the trajectory offset feature vector to form the trajectory offset feature vector. The trajectory offset feature vectors corresponding to historical normal transactions are grouped and stored according to the status node number. The frequency of occurrence and value range of each group of feature values ​​are statistically analyzed to form a hierarchical empirical distribution.

[0010] Optionally, step five specifically includes: Read each feature value in the trajectory offset feature vector, and group the trajectory offset feature vector according to the state node number corresponding to each feature value. Read the sample set corresponding to each state node in the hierarchical empirical distribution, and count the total number of samples for each sample set. For each feature value, count the number of samples greater than the current feature value and the number of samples less than the current feature value in the sample set of the corresponding state node, and calculate the ratio of the number of samples greater than the current feature value to the total number of samples and the ratio of the number of samples less than the current feature value to the total number of samples, to obtain the first tail ratio and the second tail ratio. The negative logarithm of the first tail ratio and the second tail ratio are respectively calculated to obtain the first abnormal score and the second abnormal score, and the maximum value of the first abnormal score and the second abnormal score is taken as the abnormal score of the corresponding feature value. According to the order of the feature values ​​in the trajectory offset feature vector, the anomaly scores corresponding to each feature value are accumulated one by one to obtain the initial anomaly value; The difference between the feature values ​​of adjacent positions in the trajectory offset feature vector is calculated. Each difference is multiplied by the anomaly score of the corresponding position, and the results of each multiplication are accumulated to obtain the order change correction value. The feature values ​​in the trajectory offset feature vector are grouped according to resource type. The anomaly scores corresponding to each group of feature values ​​are weighted and summed according to the association weights corresponding to resource type to obtain the weighted anomaly values ​​corresponding to each resource type. The weighted anomaly values ​​are then accumulated to obtain the resource association correction value. The path offset anomaly value is obtained by summing the initial outlier value, the order change correction value, and the resource association correction value.

[0011] Optionally, step six specifically includes: Read the occupancy status flags and corresponding status node numbers of each resource mapping unit in the shadow ledger resource mapping table, arrange the occupancy status flags of each resource mapping unit in order of status node numbers, and form a status change sequence. The state change sequence of each resource mapping unit is traversed. When the occupied state flag changes from occupied to released and then back to occupied, a reoccupation event is recorded. The reoccupation events of all resource mapping units are accumulated to obtain the resource bounce count. The total number of resource mapping units in the shadow ledger resource mapping table is counted, and the ratio of the number of resource bounces to the total number of resource mapping units is calculated to obtain the resource bounce index. The abnormal path offset value is compared with the anomaly judgment threshold, and the resource bounce index is compared with the bounce judgment threshold. When the abnormal path offset value is greater than or equal to the anomaly judgment threshold or the resource bounce index is greater than or equal to the bounce judgment threshold, the state switching flag is set to 1; otherwise, the state switching flag is set to 0. When the state transition flag is 1, the value of the execution state identifier will be modified to the state code value corresponding to the reversible liquidation state, and the entry time, exit time and state change information of the corresponding resource mapping unit of the subsequent state node will be recorded in the smart contract.

[0012] Optionally, step seven specifically includes: Read the entry time, exit time, and state change sequence of each state node and resource mapping unit recorded in the reversible liquidation state; Calculate the dwell time of each state node and count the number of state nodes whose dwell time exceeds the corresponding state dwell time range; Traverse the state change sequence of the resource mapping unit, count the number of times the occupied state and the released state alternate, and count the number of times the state change direction of the resource mapping unit between adjacent state nodes is the same; The determination is based on a combination of the number of state nodes whose dwell time exceeds the interval and the number of times the resource mapping unit's state changes in the same direction. If the number of state nodes whose dwell time exceeds the interval is greater than or equal to a first threshold and the number of times the resource mapping unit's state changes in the same direction is less than or equal to a second threshold, the determination result is assigned as rollback liquidation. If the number of state nodes whose dwell time exceeds the interval is greater than or equal to the first threshold and the number of times the resource mapping unit's state changes in the same direction is greater than the second threshold, the determination result is assigned as delayed liquidation. If the number of state nodes whose dwell time exceeds the interval is less than the first threshold and the number of times the resource mapping unit's state changes in the same direction is less than or equal to the second threshold, the determination result is assigned as segmented liquidation. If the number of state nodes whose dwell time exceeds the interval is less than the first threshold and the number of times the resource mapping unit's state changes in the same direction is greater than the second threshold, the determination result is assigned as normal liquidation. Execute the corresponding liquidation path based on the judgment result and update the status of the resource mapping unit.

[0013] The beneficial effects of this invention are: This invention addresses the shortcomings of existing online transaction fraud detection methods, such as the lack of execution path modeling, insufficient characterization of resource relationships, and low accuracy in identifying abnormal behavior, by constructing a collaborative modeling mechanism between transaction pre-execution commitment vectors and shadow ledger resource mapping tables. Combined with comparative analysis of contract expected execution path templates and actual execution trajectories, it proposes an execution path structure modeling method based on state node sequence construction and transition constraint definition, significantly improving the ability to express the dynamic evolution characteristics of the transaction execution process. In the feature extraction stage, a trajectory offset feature vector construction strategy is introduced. Through joint encoding of state node matching relationships, transition edge deviations, abnormal dwell time, and field change behavior, a multi-dimensional quantitative representation of path offset behavior is achieved. In the anomaly detection stage, [the following is implied:] ... The COPOD algorithm undergoes structural improvements, processing trajectory offset features hierarchically according to state nodes and introducing feature order change and resource type association weights into outlier calculations. This effectively enhances the ability to identify execution order disturbances and resource interaction anomalies, improving the stability and discriminative power of anomaly detection results. In the execution control phase, a hierarchical processing mechanism based on resource bounce index and reversible liquidation status is constructed. Through dynamic statistics of resource occupancy status changes, state switching and subsequent trajectory recording after anomaly triggering are achieved. Furthermore, multi-condition combinations are used to determine whether to execute different liquidation paths, such as rollback liquidation, delayed liquidation, or segmented liquidation, ensuring transaction security while improving the system's processing flexibility and continuity. Attached Figure Description

[0014] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of the overall process of a smart contract-based method for detecting online transaction fraud proposed in this invention. Figure 2 This is a flowchart of the COPOD anomaly calculation method in a smart contract-based online transaction fraud detection method proposed in this invention. Figure 3 This is a flowchart of the reversible liquidation triggering mechanism in a smart contract-based online transaction fraud detection method proposed in this invention. Detailed Implementation

[0015] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0016] refer to Figures 1-3 A smart contract-based method for detecting online transaction fraud includes the following steps: Step 1: Collect transaction behavior data, encode the transaction behavior data to generate a transaction pre-execution commitment vector, and write it into the smart contract; Step 2: Establish a shadow ledger resource mapping table based on the transaction pre-execution commitment vector to pre-register the use of funds, preferential resources, address resources, and session resources; Step 3: Construct a contract expected execution path template based on the transaction pre-execution commitment vector and the shadow ledger resource mapping table; Step 4: Record the actual execution trajectory during the transaction execution process, extract trajectory offset features based on the actual execution trajectory and the contract's expected execution path template, generate a trajectory offset feature vector, and construct a hierarchical empirical distribution based on the trajectory offset features corresponding to historical normal transactions; Step 5: Based on the hierarchical empirical distribution, perform COPOD anomaly calculation on the trajectory offset feature vector, and combine state hierarchical constraints, feature order change amount and resource association relationship to obtain path offset anomaly value; Step 6: Based on the shadow ledger resource mapping table, statistical analysis of resource occupation, release, and reoccupation behavior is performed to obtain the resource bounce index. If the path offset anomaly or the resource bounce index meets the abnormal triggering condition, the transaction is switched to reversible settlement state. Step 7: Generate a judgment result based on the information recorded in the reversible liquidation state, and execute the corresponding liquidation path according to the judgment result.

[0017] In this embodiment, step one specifically includes: Collect transaction behavior data, which includes transaction request identifier, transaction type identifier, request timestamp and terminal session identifier output by the order access node, account identifier and account status identifier output by the account authentication node, payment path identifier and payment tool category identifier output by the payment gateway node, and contract function identifier and contract call order identifier output by the contract execution node. The transaction behavior data is categorized by field. Based on the data type of the fields and the statistical distribution characteristics of the values ​​of each field in historical transaction samples, the transaction behavior data is divided into transaction request fields, account fields, payment path fields, terminal session fields, and contract call fields, and arranged according to the order in which the fields appear during the transaction execution process. Each field is encoded. For the category field, the frequency of each value in the historical transaction samples is counted, and the values ​​are sorted from highest to lowest frequency. The sorting number is then mapped to a discrete encoded value. For the time field, the difference between adjacent time values ​​in the historical transaction samples is counted, and the distribution range of the time difference is divided into multiple continuous intervals. Each interval is then mapped to an interval code. For the sequence field, an ascending sequence code is assigned according to the order of invocation. For the status field, a flag code is generated according to the set of status values. The encoded fields are concatenated in order to form a field encoding sequence. For missing fields, the code corresponding to the most frequent value is selected based on the frequency of the same type of field in historical transaction samples and filled in. The code is then padded according to the maximum length of the field encoding sequence to obtain the transaction pre-execution commitment vector. Establish the correspondence between the transaction pre-execution commitment vector, the transaction request identifier, and the write timestamp, and write it to the smart contract storage area.

[0018] In this implementation, historical transaction samples are jointly constructed from blockchain node logs and an off-chain synchronous database, and the sample set is continuously updated with the generation of new blocks. During field classification, data types are automatically determined based on the field value structure, and statistical distribution is obtained by calculating the frequency and dispersion of values ​​within a sliding time window. During the encoding process, the encoding mapping relationship of each field is dynamically adjusted with the update of historical samples, and consistency is controlled by version identifiers. When concatenating fields, a fixed field order index table is used to ensure the stability of the vector structure, and missing field filling is determined based on the highest frequency value within the current window. During the smart contract writing process, a key-value mapping structure is used to store the commitment vector and associated identifier, and the writing order and data immutability are ensured through the block confirmation mechanism, thereby forming a continuously updated and structurally consistent transaction pre-execution commitment expression system.

[0019] In this embodiment, step two specifically includes: Read the corresponding fund identifier field, discount identifier field, address identifier field and session identifier field from the transaction pre-execution commitment vector, extract the resource identifier set, and divide it into fund resource set, discount resource set, address resource set and session resource set according to resource type; Each identifier in the resource identifier set is indexed and numbered according to its order of appearance, forming a sequence of numbered resource identifiers; For each resource identifier with a serial number, a resource mapping unit is generated. The resource mapping unit includes a resource identifier, an occupying entity identifier, an occupation start time, an occupation status flag, and a release condition field. The occupying entity identifier is generated by concatenating the transaction request identifier and the account identifier according to the field concatenation method. The occupation start time is determined by the transaction request timestamp. The occupation status flag is set to the occupation status. The release condition field is assigned a value according to the number of each status node in the transaction execution path. A shadow ledger resource mapping table is established based on each resource mapping unit. The shadow ledger resource mapping table includes a funds resource mapping table, a discount resource mapping table, an address resource mapping table, and a session resource mapping table. Each resource mapping table contains the resource mapping units in the corresponding resource set. Each resource mapping unit is written into the corresponding resource mapping table in the order of the resource identifier sequence. The resource mapping tables are then aggregated to form a shadow ledger resource mapping table, which is then written into the smart contract storage area. At the same time, a correspondence is established between the shadow ledger resource mapping table and the transaction request identifier.

[0020] In this implementation, the resource identifier originates from the encoded field in the transaction pre-execution commitment vector and is mapped to a unified format resource key value through field parsing rules. The resource mapping unit adopts a structured key-value pair storage format, where the occupying entity identifier and the resource identifier form a composite index key to ensure the unique location of the resource occupancy record. The state node number corresponding to the release condition field comes from the node sequence in the contract's expected execution path template and is matched with the current state node number during contract execution to update the occupancy status. The shadow ledger resource mapping table adopts a hierarchical storage structure in the smart contract. Each resource mapping table is distinguished by the resource type identifier and maintains cross-resource associations through a unified index table, thereby supporting concurrent occupancy of multiple resources and maintenance of state consistency.

[0021] In this embodiment, step three specifically includes: Read the transaction type identifier, payment path identifier, and contract function identifier from the transaction pre-execution commitment vector, and read the resource type identifier sequence from the shadow ledger resource mapping table. Read the transaction process node sequence corresponding to the transaction type identifier, and combine the arrangement order of each resource in the resource type identifier sequence to segment and arrange the transaction process nodes to form a transaction execution stage set. A set of state nodes is generated according to the stage order in the transaction execution stage set. A sequence number is assigned to each state node, and each state node is written into the corresponding fields along with its corresponding contract function identifier and resource type identifier. A set of state transition edges is constructed based on the set of state nodes, and directed connections are established between adjacent state nodes to form the initial execution path structure; For each state transition edge, set transition constraint parameters, including state dwell time range, field change number limit, contract function call number set and resource consumption limit. Statistically analyze the dwell time data of each state node in historical transaction samples, calculate the time value range and divide it into state dwell time ranges, statistically analyze the field change number data to determine the field change number limit, and statistically analyze the resource consumption data to determine the resource consumption limit. The set of state nodes, the set of state transition edges, and the corresponding transition constraint parameters are combined to form the contract's expected execution path template, which is then written into the smart contract storage area in the order of the state node numbers.

[0022] In this implementation, the transaction process node sequence is jointly provided by the on-chain predefined process template and the off-chain business process configuration table, and is indexed and matched by the transaction type identifier; the resource type identifier sequence is extracted from the writing order of each resource mapping unit in the shadow ledger resource mapping table, which is used to reflect the sequential relationship of resource participation; state nodes and transition edges are stored in the smart contract using an adjacency list structure, with the state node number as the index key, and the transition edge recording the adjacent node number pairs and constraint fields; historical transaction sample data is obtained synchronously through the blockchain log and the off-chain cache library, and the statistical results are continuously updated within the rolling time window; each constraint parameter is written to the contract storage with a version identifier after generation to ensure the consistency and traceability of the path template during execution.

[0023] In this embodiment, step four specifically includes: During the transaction execution process, the entry time, exit time, corresponding contract function identifier, and resource type identifier of each state node are collected, and the actual execution trajectory sequence is formed according to the state node number order. Compare the actual execution trajectory sequence with the corresponding node number in the state node sequence of the contract's expected execution path template one by one according to the state node number order, and record the number of unmatched state nodes and the number of missing state nodes. The adjacent state node pairs in the actual execution trajectory sequence are traversed, and the numbers of each adjacent state node are combined to form a transition edge sequence. This sequence is then matched with the set of state transition edges in the contract's expected execution path template, and the number of transition edges that do not appear in the set of state transition edges is counted. The dwell time of each state node is calculated by subtracting the entry time from the exit time to obtain the dwell duration, and then compared with the state dwell duration range of the corresponding state node. The difference in dwell duration exceeding the range is accumulated. The values ​​of fields corresponding to adjacent state nodes are compared, the number of times the values ​​are different is counted, the total number of field changes is recorded, and the number of times resource occupation, release and reoccupation occur in the resource mapping unit is counted to form the resource bounce count; The number of unmatched state nodes, the number of missing state nodes, the number of unmatched transition edges, the difference in dwell time, the total number of field changes, and the number of resource bounces are arranged in the order of the trajectory offset feature vector to form the trajectory offset feature vector. The trajectory offset feature vectors corresponding to historical normal transactions are grouped and stored according to the status node number. The frequency of occurrence and value range of each group of feature values ​​are statistically analyzed to form a hierarchical empirical distribution.

[0024] In this implementation, the actual execution trajectory sequence is generated by the smart contract writing to the on-chain log each time a state node is triggered. The entry and exit times are recorded by the block timestamp and corrected by the continuous block height. The state node number is used as the primary index key for trajectory sequence alignment and transition edge matching. Field change comparison is performed on the set of key fields in the transaction pre-execution commitment vector. The set of key fields is selected based on the field stability statistics during system initialization. The number of resource bounces is calculated by accumulating the state change records of the shadow ledger resource mapping unit. The trajectory offset feature vector is stored in a fixed-length array structure, with each feature value corresponding to a fixed index position. The hierarchical experience distribution is stored in the form of multiple statistical tables divided by state node number, and the frequency and range of feature values ​​are continuously updated within the rolling time window.

[0025] In this embodiment, step five specifically includes: Read each feature value in the trajectory offset feature vector, and group the trajectory offset feature vector according to the state node number corresponding to each feature value. Read the sample set corresponding to each state node in the hierarchical empirical distribution, and count the total number of samples for each sample set. For each feature value, count the number of samples greater than the current feature value and the number of samples less than the current feature value in the sample set of the corresponding state node, and calculate the ratio of the number of samples greater than the current feature value to the total number of samples and the ratio of the number of samples less than the current feature value to the total number of samples, to obtain the first tail ratio and the second tail ratio. The negative logarithm of the first tail ratio and the second tail ratio are respectively calculated to obtain the first abnormal score and the second abnormal score, and the maximum value of the first abnormal score and the second abnormal score is taken as the abnormal score of the corresponding feature value. According to the order of the feature values ​​in the trajectory offset feature vector, the anomaly scores corresponding to each feature value are accumulated one by one to obtain the initial anomaly value; The difference between the feature values ​​of adjacent positions in the trajectory offset feature vector is calculated. Each difference is multiplied by the anomaly score of the corresponding position, and the results of each multiplication are accumulated to obtain the order change correction value. The feature values ​​in the trajectory offset feature vector are grouped according to resource type. The anomaly scores corresponding to each group of feature values ​​are weighted and summed according to the association weights corresponding to resource type to obtain the weighted anomaly values ​​corresponding to each resource type. The weighted anomaly values ​​are then accumulated to obtain the resource association correction value. The path offset anomaly value is obtained by summing the initial outlier value, the order change correction value, and the resource association correction value.

[0026] In this implementation, a one-to-one correspondence is established between each feature value in the trajectory offset feature vector and the state node number through an index mapping table. The hierarchical empirical distribution maintains an independent sample set for each state node. During the tail ratio calculation, the sample set is sorted and stored, and the number of samples greater than and less than the current feature value is determined by binary search. The negative logarithm operation uses a logarithmic lookup table or numerical approximation to reduce computational overhead. The order change correction is calculated based on the absolute difference between adjacent feature values ​​to ensure sensitivity to abrupt changes. The resource association weight comes from the co-occurrence frequency statistics of different resource types in the shadow ledger, and is normalized before participating in the weighted calculation, thus forming a stable and updatable outlier calculation mechanism. The improved COPOD algorithm of this invention maintains the same basic computational framework as the traditional COPOD algorithm. Both algorithms perform probabilistic modeling of input features based on the empirical distribution of the sample set, calculate the two-tailed ratio by statistically analyzing the relative position of feature values ​​in the sample distribution, and then perform logarithmic transformation and accumulation on the tailed ratio to form an overall anomaly measure, thereby achieving quantitative identification of abnormal samples. Based on this, the present invention makes structural improvements to the COPOD algorithm, hierarchically processes the trajectory offset feature vector according to the state node number, performs tail ratio calculation in the corresponding hierarchical sample set, introduces the calculation of adjacent feature value difference to form order change correction, and introduces correlation weight to participate in weighted calculation after grouping features according to resource type, so that the abnormal score reflects the state level, order change and resource correlation features simultaneously. Through the above improvements, the anomaly detection process is transformed from a single feature distribution judgment to a joint calculation method under multi-dimensional constraints. While maintaining the original distribution-driven characteristics, it enhances the ability to identify abrupt changes in execution trajectory and abnormal resource interactions, improves the stability and discriminativeness of anomaly detection results, and enhances the accuracy of identifying abnormal behaviors in complex transaction scenarios.

[0027] In this embodiment, step six specifically includes: Read the occupancy status flags and corresponding status node numbers of each resource mapping unit in the shadow ledger resource mapping table, arrange the occupancy status flags of each resource mapping unit in order of status node numbers, and form a status change sequence. The state change sequence of each resource mapping unit is traversed. When the occupied state flag changes from occupied to released and then back to occupied, a reoccupation event is recorded. The reoccupation events of all resource mapping units are accumulated to obtain the resource bounce count. The total number of resource mapping units in the shadow ledger resource mapping table is counted, and the ratio of the number of resource bounces to the total number of resource mapping units is calculated to obtain the resource bounce index. The abnormal path offset value is compared with the anomaly judgment threshold, and the resource bounce index is compared with the bounce judgment threshold. When the abnormal path offset value is greater than or equal to the anomaly judgment threshold or the resource bounce index is greater than or equal to the bounce judgment threshold, the state switching flag is set to 1; otherwise, the state switching flag is set to 0. When the state transition flag is 1, the value of the execution state identifier will be modified to the state code value corresponding to the reversible liquidation state, and the entry time, exit time and state change information of the corresponding resource mapping unit of the subsequent state node will be recorded in the smart contract.

[0028] In this implementation, the total number of resource mapping units is denoted as N, the number of resource bounces is denoted as M, and the resource bounce index is calculated as M / N. The anomaly judgment threshold is 2.5, and the bounce judgment threshold is 0.3. When the path offset anomaly value is ≥2.5 or the resource bounce index is ≥0.3, a state switch is triggered. The occupation status flag uses binary encoding, where 1 represents the occupation status and 0 represents the release status. The re-occupation event is defined as the occurrence of a continuous pattern of "1→0→1" in the state sequence. The state switch flag uses binary variables, where a value of 1 indicates entering the reversible liquidation state and a value of 0 indicates maintaining the original execution state. The execution status identifier uses integer encoding, where 0 represents the initial execution state, 1 represents the normal execution state, and 2 represents the reversible liquidation state. Subsequent execution trajectory records are structured records composed of state node number, entry time, exit time, and resource status changes and stored in the smart contract.

[0029] In this embodiment, step seven specifically includes: Read the entry time, exit time, and state change sequence of each state node and resource mapping unit recorded in the reversible liquidation state; Calculate the dwell time of each state node and count the number of state nodes whose dwell time exceeds the corresponding state dwell time range; Traverse the state change sequence of the resource mapping unit, count the number of times the occupied state and the released state alternate, and count the number of times the state change direction of the resource mapping unit between adjacent state nodes is the same; The determination is based on a combination of the number of state nodes whose dwell time exceeds the interval and the number of times the resource mapping unit's state changes in the same direction. If the number of state nodes whose dwell time exceeds the interval is greater than or equal to a first threshold and the number of times the resource mapping unit's state changes in the same direction is less than or equal to a second threshold, the determination result is assigned as rollback liquidation. If the number of state nodes whose dwell time exceeds the interval is greater than or equal to the first threshold and the number of times the resource mapping unit's state changes in the same direction is greater than the second threshold, the determination result is assigned as delayed liquidation. If the number of state nodes whose dwell time exceeds the interval is less than the first threshold and the number of times the resource mapping unit's state changes in the same direction is less than or equal to the second threshold, the determination result is assigned as segmented liquidation. If the number of state nodes whose dwell time exceeds the interval is less than the first threshold and the number of times the resource mapping unit's state changes in the same direction is greater than the second threshold, the determination result is assigned as normal liquidation. Execute the corresponding liquidation path based on the judgment result and update the status of the resource mapping unit.

[0030] In this implementation, the dwell time is calculated by subtracting the entry time from the departure time, and the dwell time range is limited to [1, 30] seconds using historical statistics. The first quantity threshold is 2, indicating that the number of nodes in abnormal dwell states reaches 2 or more. The second quantity threshold is 3, indicating that the number of times the resource state changes in the same direction does not exceed 3. The occupied state and the released state are encoded using 1 and 0 respectively, and the same state change direction is defined as the state change signs of adjacent nodes being the same. The judgment result is represented by integer encoding, where 0 indicates normal liquidation, 1 indicates segmented liquidation, 2 indicates delayed liquidation, and 3 indicates rollback liquidation. The resource mapping unit state update is achieved by replacing the state code, and the subsequent execution trajectory is recorded in the smart contract storage structure in the form of a triple of state node number, timestamp, and resource state code.

[0031] Example 1: To verify the feasibility of this invention in practice, it was applied to the online payment transaction system of a large e-commerce platform. This system processes approximately 1.2 million transaction requests daily, involving multiple payment paths, and the entire process, including order verification, fund freezing, discount redemption, and settlement execution, is handled by smart contracts. In actual operation, the platform faces complex fraudulent activities, including multi-account collaborative operations, duplicate resource usage, path bypass calls, and abnormal execution jumps. Traditional detection methods based on transaction amount thresholds or account historical behavior are insufficient to identify such hidden fraudulent activities occurring along the execution path, resulting in a high false positive rate and delayed response.

[0032] In this scenario, the method of this invention is embedded into the smart contract execution process. Before each transaction is executed, a pre-execution commitment vector is first constructed, uniformly encoding the transaction request identifier, account information, payment path, and contract call order, and writing it into the on-chain storage structure. When the transaction enters the execution phase, a shadow ledger resource mapping table is established based on the commitment vector to register the occupation of the involved financial resources, preferential resources, and session resources. At the same time, a contract expected execution path template is generated to describe the state node sequence and transition relationships that a normal transaction should follow. During the transaction execution process, the system records the entry time, exit time, and resource status changes of each state node in real time, constructs the actual execution trajectory, and compares it with the expected path to generate a trajectory offset feature vector.

[0033] During the anomaly detection phase, an improved COPOD algorithm is introduced to perform hierarchical processing of trajectory deviation features. It calculates path deviation anomalies by statistically analyzing the tail probability of feature values ​​within the historical normal transaction distribution, combined with changes in feature order and resource association weights. Simultaneously, the system analyzes state changes in the resource mapping table, statistically analyzing resource occupation, release, and re-occupancy behaviors, and calculating the resource bounce index. When the path deviation anomaly or the resource bounce index exceeds a set threshold, the transaction is switched to a reversible liquidation state. In this state, the execution trajectory continues to be recorded, and classification is performed based on subsequent state stagnation anomalies and resource change consistency. Different processing paths are then executed, such as rollback liquidation, delayed liquidation, or segmented liquidation, thereby achieving risk control without interrupting the transaction process.

[0034] To verify the beneficial effects of this invention, the method of this invention was compared with traditional detection methods based on rule matching and single statistical features. A total of 8.4 million transaction data points from seven consecutive days were selected, of which approximately 23,000 transactions were flagged as fraudulent. Statistical analysis was performed on the detection results of the two methods on the same dataset, and the experimental results are shown in Table 1.

[0035] Table 1. Comparative Experiment Results of Online Transaction Fraud Detection Methods

[0036] As shown in Table 1, the fraud detection accuracy of the method of the present invention has been improved from 78.2% to 93.6%, significantly reducing the number of missed detections. At the same time, the false positive rate has been reduced to 0.51%, effectively reducing interference with normal transactions. In terms of path offset identification and resource bounce identification, the method of the present invention has achieved 94.1% and 91.3% respectively, which are far higher than traditional methods, indicating that it can effectively capture abnormal behavior in complex execution paths. In addition, due to the use of hierarchical feature modeling and structured path constraints, the detection latency has been reduced to 185ms, meeting the real-time processing requirements of online transactions.

[0037] The above embodiments demonstrate that the present invention can accurately identify hidden fraudulent behavior based on execution path in complex online transaction scenarios, and achieve flexible control through a reversible settlement mechanism. While ensuring transaction security, it improves system processing efficiency and stability, and has good engineering application value.

[0038] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting online transaction fraud based on smart contracts, characterized in that, Includes the following steps: Step 1: Collect transaction behavior data, encode the transaction behavior data to generate a transaction pre-execution commitment vector, and write it into the smart contract; Step 2: Based on the transaction pre-execution commitment vector, establish a shadow ledger resource mapping table to pre-register the use of funds, preferential resources, address resources, and session resources; Step 3: Construct a contract expected execution path template based on the transaction pre-execution commitment vector and the shadow ledger resource mapping table; Step 4: Record the actual execution trajectory during the transaction execution process, extract trajectory offset features based on the actual execution trajectory and the contract's expected execution path template, generate a trajectory offset feature vector, and construct a hierarchical empirical distribution based on the trajectory offset features corresponding to historical normal transactions; Step 5: Based on the hierarchical empirical distribution, perform COPOD anomaly calculation on the trajectory offset feature vector, and combine state hierarchical constraints, feature order change amount and resource association relationship to obtain path offset anomaly value; Step 6: Based on the shadow ledger resource mapping table, statistical analysis of resource occupation, release, and reoccupation behavior is performed to obtain the resource bounce index. If the path offset anomaly or the resource bounce index meets the anomaly triggering condition, the transaction is switched to a reversible settlement state. Step 7: Generate a judgment result based on the information recorded in the reversible liquidation state, and execute the corresponding liquidation path according to the judgment result.

2. The method for detecting online transaction fraud based on smart contracts according to claim 1, characterized in that, Step one specifically involves: Collect transaction behavior data, which includes transaction request identifier, transaction type identifier, request timestamp and terminal session identifier output by the order access node, account identifier and account status identifier output by the account authentication node, payment path identifier and payment tool category identifier output by the payment gateway node, and contract function identifier and contract call order identifier output by the contract execution node. The transaction behavior data is categorized by field. Based on the data type of the fields and the statistical distribution characteristics of the values ​​of each field in historical transaction samples, the transaction behavior data is divided into transaction request fields, account fields, payment path fields, terminal session fields, and contract call fields, and arranged according to the order in which the fields appear during the transaction execution process. Each field is encoded. For the category field, the frequency of each value in the historical transaction samples is counted and sorted from high to low, and the sorting number is mapped to a discrete encoded value. For the time field, the difference between adjacent time periods in the historical transaction samples is counted and divided into multiple continuous intervals according to the distribution range of the time difference, and each interval is mapped to an interval code. For the sequence field, an ascending sequence code is assigned according to the order of invocation. Generate flag bit codes for the status field according to the set of status values; The encoded fields are concatenated in order to form a field encoding sequence. For missing fields, the code corresponding to the most frequent value is selected based on the frequency of the same type of field in historical transaction samples and filled in. The code is then padded according to the maximum length of the field encoding sequence to obtain the transaction pre-execution commitment vector. Establish the correspondence between the transaction pre-execution commitment vector, the transaction request identifier, and the write timestamp, and write it to the smart contract storage area.

3. The method for detecting online transaction fraud based on smart contracts according to claim 1, characterized in that, Step two specifically involves: Read the corresponding fund identifier field, discount identifier field, address identifier field and session identifier field from the transaction pre-execution commitment vector, extract the resource identifier set, and divide it into fund resource set, discount resource set, address resource set and session resource set according to resource type; Each identifier in the resource identifier set is indexed and numbered according to its order of appearance, forming a sequence of numbered resource identifiers; For each resource identifier with a serial number, a resource mapping unit is generated. The resource mapping unit includes a resource identifier, an occupying entity identifier, an occupation start time, an occupation status flag, and a release condition field. The occupying entity identifier is generated by concatenating the transaction request identifier and the account identifier according to the field concatenation method. The occupation start time is determined by the transaction request timestamp. The occupation status flag is set to the occupation status. The release condition field is assigned a value according to the number of each status node in the transaction execution path. A shadow ledger resource mapping table is established based on each resource mapping unit. The shadow ledger resource mapping table includes a funds resource mapping table, a discount resource mapping table, an address resource mapping table, and a session resource mapping table. Each resource mapping table contains the resource mapping units in the corresponding resource set. Each resource mapping unit is written into the corresponding resource mapping table in the order of the resource identifier sequence. The resource mapping tables are then aggregated to form a shadow ledger resource mapping table, which is then written into the smart contract storage area. At the same time, a correspondence is established between the shadow ledger resource mapping table and the transaction request identifier.

4. The method for detecting online transaction fraud based on smart contracts according to claim 1, characterized in that, Step three specifically involves: Read the transaction type identifier, payment path identifier, and contract function identifier from the transaction pre-execution commitment vector, and read the resource type identifier sequence from the shadow ledger resource mapping table. Read the transaction process node sequence corresponding to the transaction type identifier, and combine the arrangement order of each resource in the resource type identifier sequence to segment and arrange the transaction process nodes to form a transaction execution stage set. A set of state nodes is generated according to the stage order in the transaction execution stage set. A sequence number is assigned to each state node, and each state node is written into the corresponding fields along with its corresponding contract function identifier and resource type identifier. A set of state transition edges is constructed based on the set of state nodes, and directed connections are established between adjacent state nodes to form the initial execution path structure; For each state transition edge, set transition constraint parameters, including state dwell time range, field change number limit, contract function call number set and resource consumption limit. Statistically analyze the dwell time data of each state node in historical transaction samples, calculate the time value range and divide it into state dwell time ranges, statistically analyze the field change number data to determine the field change number limit, and statistically analyze the resource consumption data to determine the resource consumption limit. The set of state nodes, the set of state transition edges, and the corresponding transition constraint parameters are combined to form the contract's expected execution path template, which is then written into the smart contract storage area in the order of the state node numbers.

5. The method for detecting online transaction fraud based on smart contracts according to claim 1, characterized in that, Step four specifically involves: During the transaction execution process, the entry time, exit time, corresponding contract function identifier, and resource type identifier of each state node are collected, and the actual execution trajectory sequence is formed according to the state node number order. Compare the actual execution trajectory sequence with the corresponding node number in the state node sequence of the contract's expected execution path template one by one according to the state node number order, and record the number of unmatched state nodes and the number of missing state nodes. The adjacent state node pairs in the actual execution trajectory sequence are traversed, and the numbers of each adjacent state node are combined to form a transition edge sequence. This sequence is then matched with the set of state transition edges in the contract's expected execution path template, and the number of transition edges that do not appear in the set of state transition edges is counted. The dwell time of each state node is calculated by subtracting the entry time from the exit time to obtain the dwell duration, and then compared with the state dwell duration range of the corresponding state node. The difference in dwell duration exceeding the range is accumulated. The values ​​of fields corresponding to adjacent state nodes are compared, the number of times the values ​​are different is counted, the total number of field changes is recorded, and the number of times resource occupation, release and reoccupation occur in the resource mapping unit is counted to form the resource bounce count; The number of unmatched state nodes, the number of missing state nodes, the number of unmatched transition edges, the difference in dwell time, the total number of field changes, and the number of resource bounces are arranged in the order of the trajectory offset feature vector to form the trajectory offset feature vector. The trajectory offset feature vectors corresponding to historical normal transactions are grouped and stored according to the status node number. The frequency of occurrence and value range of each group of feature values ​​are statistically analyzed to form a hierarchical empirical distribution.

6. The method for detecting online transaction fraud based on smart contracts according to claim 1, characterized in that, Step five specifically involves: Read each feature value in the trajectory offset feature vector, and group the trajectory offset feature vector according to the state node number corresponding to each feature value. Read the sample set corresponding to each state node in the hierarchical empirical distribution, and count the total number of samples for each sample set. For each feature value, count the number of samples greater than the current feature value and the number of samples less than the current feature value in the sample set of the corresponding state node, and calculate the ratio of the number of samples greater than the current feature value to the total number of samples and the ratio of the number of samples less than the current feature value to the total number of samples, to obtain the first tail ratio and the second tail ratio. The negative logarithm of the first tail ratio and the second tail ratio are respectively calculated to obtain the first abnormal score and the second abnormal score, and the maximum value of the first abnormal score and the second abnormal score is taken as the abnormal score of the corresponding feature value. According to the order of the feature values ​​in the trajectory offset feature vector, the anomaly scores corresponding to each feature value are accumulated one by one to obtain the initial anomaly value; The difference between the feature values ​​of adjacent positions in the trajectory offset feature vector is calculated. Each difference is multiplied by the anomaly score of the corresponding position, and the results of each multiplication are accumulated to obtain the order change correction value. The feature values ​​in the trajectory offset feature vector are grouped according to resource type. The anomaly scores corresponding to each group of feature values ​​are weighted and summed according to the association weights corresponding to resource type to obtain the weighted anomaly values ​​corresponding to each resource type. The weighted anomaly values ​​are then accumulated to obtain the resource association correction value. The path offset anomaly value is obtained by summing the initial outlier value, the order change correction value, and the resource association correction value.

7. The method for detecting online transaction fraud based on smart contracts according to claim 1, characterized in that, Step six specifically involves: Read the occupancy status flags and corresponding status node numbers of each resource mapping unit in the shadow ledger resource mapping table, arrange the occupancy status flags of each resource mapping unit in order of status node numbers, and form a status change sequence. The state change sequence of each resource mapping unit is traversed. When the occupied state flag changes from occupied to released and then back to occupied, a reoccupation event is recorded. The reoccupation events of all resource mapping units are accumulated to obtain the resource bounce count. The total number of resource mapping units in the shadow ledger resource mapping table is counted, and the ratio of the number of resource bounces to the total number of resource mapping units is calculated to obtain the resource bounce index. The abnormal path offset value is compared with the anomaly judgment threshold, and the resource bounce index is compared with the bounce judgment threshold. When the abnormal path offset value is greater than or equal to the anomaly judgment threshold or the resource bounce index is greater than or equal to the bounce judgment threshold, the state switching flag is set to 1; otherwise, the state switching flag is set to 0. When the state transition flag is 1, the value of the execution state identifier will be modified to the state code value corresponding to the reversible liquidation state, and the entry time, exit time and state change information of the corresponding resource mapping unit of the subsequent state node will be recorded in the smart contract.

8. A method for detecting online transaction fraud based on smart contracts according to claim 1, characterized in that, Step seven specifically involves: Read the entry time, exit time, and state change sequence of each state node and resource mapping unit recorded in the reversible liquidation state; Calculate the dwell time of each state node and count the number of state nodes whose dwell time exceeds the corresponding state dwell time range; Traverse the state change sequence of the resource mapping unit, count the number of times the occupied state and the released state alternate, and count the number of times the state change direction of the resource mapping unit between adjacent state nodes is the same; The determination is based on a combination of the number of state nodes whose dwell time exceeds the interval and the number of times the resource mapping unit's state changes in the same direction. If the number of state nodes whose dwell time exceeds the interval is greater than or equal to a first threshold and the number of times the resource mapping unit's state changes in the same direction is less than or equal to a second threshold, the determination result is assigned as rollback liquidation. If the number of state nodes whose dwell time exceeds the interval is greater than or equal to the first threshold and the number of times the resource mapping unit's state changes in the same direction is greater than the second threshold, the determination result is assigned as delayed liquidation. If the number of state nodes whose dwell time exceeds the interval is less than the first threshold and the number of times the resource mapping unit's state changes in the same direction is less than or equal to the second threshold, the determination result is assigned as segmented liquidation. If the number of state nodes whose dwell time exceeds the interval is less than the first threshold and the number of times the resource mapping unit's state changes in the same direction is greater than the second threshold, the determination result is assigned as normal liquidation. Execute the corresponding liquidation path based on the judgment result and update the status of the resource mapping unit.

Images