System and method for generating virtual asset wallet address database based on harmful online site

Abstract

Disclosed are a system and a method for generating a virtual asset wallet address database based on a harmful online site. The system comprises: a whitelist collection server that collects and analyzes transaction data in a cryptocurrency transaction site to generate a whitelist composed of virtual asset electronic wallet addresses capable of normal transactions; a whitelist database server in which the whitelist generated by the whitelist collection server is stored; a crawling server that performs online resource crawling on at least one of a surface web, a dark web, and Telegram by using a predetermined keyword; a URL / electronic wallet address database server in which the corresponding URL / electronic wallet address is stored by the online resource crawling performed by the crawling server; an online blacklist analysis server that analyzes the white list stored in the white list database server and the URL / electronic wallet address stored in the URL / electronic wallet address database server to extract a high-risk virtual asset wallet address according to a predetermined criterion and generate a main blacklist composed of the extracted high-risk virtual asset wallet address; and a main blacklist database server in which the main blacklist generated by the online blacklist analysis server is stored.

Description

System and method for creating a virtual asset wallet address database based on online harmful sites

[0001] The present invention relates to a system and method for creating a virtual asset wallet address database, and more specifically, to a system and method for creating a virtual asset wallet address database based on an online harmful site.

[0002] Due to the inherent difficulty in tracking funds, blockchain-based virtual assets are often used for illegal financial transactions. If virtual asset wallets themselves are frequently used for highly risky transactions, it's important to proactively identify and prevent unauthorized use.

[0003] However, because it is very easy to create a virtual asset wallet and the security and authentication procedures are lax, anyone can create a virtual asset wallet at any time and use it for illegal purposes.

[0004] Accordingly, it is necessary to identify high-risk or harmful virtual asset wallets in advance to prevent them from being used for illegal transactions or fraudulent use.

[0005] However, the current virtual asset exchanges lack the means to prevent this.

[0006] In particular, given the numerous instances of virtual asset wallets being reused for illegal transactions or fraudulent use, there is a need for a means to quickly and accurately identify these illegal virtual asset wallets and monitor transactions.

[0007] The purpose of the present invention is to provide a virtual asset wallet address database creation system based on an online harmful site.

[0008] Another object of the present invention is to provide a method for creating a virtual asset wallet address database based on an online harmful site.

[0009] A system for generating a virtual asset wallet address database based on an online harmful site according to the purpose of the present invention described above may be configured to include: a whitelist collection server that collects and analyzes transaction data from a cryptocurrency exchange site to generate a whitelist of virtual asset electronic wallet addresses that allow normal transactions; a whitelist database server that stores the whitelist generated by the whitelist collection server; a crawling server that performs online resource crawling using predetermined keywords on at least one of the surface web, the dark web, and Telegram; a URL / electronic wallet address database server that stores URLs / electronic wallet addresses corresponding to the online resource crawling performed by the crawling server; an online blacklist analysis server that analyzes the whitelist stored in the whitelist database server and the URLs / electronic wallet addresses stored in the URL / electronic wallet address database server to extract high-risk virtual asset wallet addresses according to predetermined criteria and generates a main blacklist comprised of the extracted high-risk virtual asset wallet addresses; and a main blacklist database server that stores the main blacklist generated by the online blacklist analysis server.

[0010] Here, the whitelist collection server may be configured to include a dusting module that extracts a list of second virtual asset wallet addresses presumed to be held by the virtual asset exchange; an address verification module that compares and verifies a list of first virtual asset wallet addresses corresponding to whitelist candidates already extracted by online resource crawling with a list of second virtual asset wallet addresses extracted by the dusting module, and generates a basic whitelist based on the comparison and verification results; a pattern analysis module that performs transaction pattern analysis of the basic whitelist generated by the address verification module, and generates a scale-up whitelist presumed to be wallet addresses of the virtual asset exchange based on the performance results; and a clustering module that performs clustering on a plurality of virtual asset wallet addresses corresponding to the scale-up whitelist generated by the pattern analysis module to generate a final whitelist.

[0011] And the whitelist database server may be configured to include a whitelist database in which the generated final whitelist is stored.

[0012] And the crawling server may be configured to include a search module that performs online resource crawling using a predetermined keyword to search for online resources using high-risk electronic wallet addresses; an update module that automatically updates online resources searched by the search module; an address extraction module that extracts addresses of online resources updated by the update module; and an electronic currency-related URL / keyword database that stores corresponding URLs and keywords of online resources extracted by the address extraction module.

[0013] And the above URL / electronic wallet address database server can be configured to include a URL / electronic wallet address database in which the corresponding URL and electronic wallet address of the online resource extracted from the address extraction module are stored.

[0014] And the online blacklist analysis server may be configured to include a DB linkage module that mutually links the final whitelist stored in the whitelist database and the URLs and electronic wallet addresses stored in the URL / electronic wallet address database; a clustering linkage module that mutually links the final whitelist clustered and stored in the whitelist database with the URLs and electronic wallet addresses stored in the URL / electronic wallet address database; and a risk address judgment module that extracts high-risk virtual asset wallet addresses based on the mutual linkage results of the DB linkage module and the mutual linkage results of the clustering linkage module, and generates a main blacklist composed of the extracted high-risk virtual asset wallet addresses.

[0015] And the main blacklist database server may be configured to include a main blacklist database in which the main blacklist generated by the risk address judgment module is stored.

[0016] Another object of the present invention is to provide a method for generating a virtual asset wallet address database based on an online harmful site, comprising: a step in which a whitelist collection server collects and analyzes transaction data from a cryptocurrency exchange site to generate a whitelist composed of virtual asset electronic wallet addresses that enable normal transactions; a step in which the whitelist generated by the whitelist collection server is stored in a whitelist database server; a step in which a crawling server performs online resource crawling using predetermined keywords on at least one of the surface web, the dark web, and Telegram; a step in which a URL / electronic wallet address database server stores the URL / electronic wallet address corresponding to the online resource crawling performed by the crawling server; a step in which an online blacklist analysis server analyzes the whitelist stored in the whitelist database server and the URL / electronic wallet address stored in the URL / electronic wallet address database server to extract high-risk virtual asset wallet addresses according to predetermined criteria, and a step in which the main blacklist is generated composed of the extracted high-risk virtual asset wallet addresses; The main blacklist database server may be configured to include a step of storing the main blacklist generated from the online blacklist analysis server.

[0017] Here, the step of the whitelist collection server collecting and analyzing transaction data from a cryptocurrency exchange site to generate a whitelist consisting of virtual asset electronic wallet addresses that can perform normal transactions may be configured to include the steps of: a dusting module extracting a list of second virtual asset wallet addresses presumed to be held by the virtual asset exchange; a step of the address verification module comparing and verifying a list of first virtual asset wallet addresses corresponding to whitelist candidates already extracted by online resource crawling with a list of second virtual asset wallet addresses extracted by the dusting module, and generating a basic whitelist based on the comparison and verification results; a step of the pattern analysis module performing transaction pattern analysis on the basic whitelist generated by the address verification module, and generating a scale-up whitelist presumed to be wallet addresses of the virtual asset exchange based on the performance results; and a step of the clustering module performing clustering on a plurality of virtual asset wallet addresses corresponding to the scale-up whitelist generated by the pattern analysis module to generate a final whitelist.

[0018] And the step of crawling the online resource using a predetermined keyword for at least one of the surface web, the dark web, and Telegram by the crawling server may be configured to include a step of crawling the online resource using a predetermined keyword by the search module to search for an online resource using a high-risk electronic wallet address; a step of automatically updating the online resource searched by the search module by the update module; a step of extracting the address of the online resource updated by the update module by the address extraction module; and a step of storing the corresponding URL and keyword of the online resource extracted by the address extraction module in an electronic currency-related URL / keyword database.

[0019] According to the system and method for creating a virtual asset wallet address database based on the above-described online harmful site, a database is constructed by creating a whitelist and a blacklist of virtual asset wallets for each virtual asset through online resource crawling, thereby enabling the rapid filtering and monitoring of illegal use and fraudulent transactions in virtual asset wallet address transactions.

[0020] FIG. 1 is a block diagram of a virtual asset wallet address database creation system based on an online harmful site according to one embodiment of the present invention.

[0021] FIG. 2 is a detailed configuration diagram of a virtual asset wallet address database creation system based on an online harmful site according to one embodiment of the present invention.

[0022] Figure 3 is a flowchart of a method for creating a virtual asset wallet address database based on an online harmful site according to an embodiment of the present invention.

[0023] Figures 4 to 7 are detailed flowcharts of a method for creating a virtual asset wallet address database based on an online harmful site according to an embodiment of the present invention.

[0024] The present invention is susceptible to various modifications and embodiments. Specific embodiments are illustrated in the drawings and detailed descriptions of specific embodiments for carrying out the invention are provided. However, this is not intended to limit the present invention to specific embodiments, but rather to encompass all modifications, equivalents, and alternatives falling within the spirit and technical scope of the present invention. Throughout the description of each drawing, similar reference numerals have been used to designate similar components.

[0025] Terms such as first, second, A, and B may be used to describe various components, but these components should not be limited by these terms. These terms are used solely to distinguish one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component. The term "and / or" includes a combination of multiple related items described herein or any of multiple related items described herein.

[0026] When a component is referred to as being "connected" or "connected" to another component, it should be understood that it may be directly connected or connected to that other component, but that there may be other components intervening. Conversely, when a component is referred to as being "directly connected" or "connected" to another component, it should be understood that there are no other components intervening.

[0027] The terminology used in this application is only used to describe specific embodiments and is not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly indicates otherwise. In this application, it should be understood that the terms "comprise" or "have" indicate the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, but do not preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0028] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and will not be interpreted in an idealized or overly formal sense unless explicitly defined herein.

[0029] Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the attached drawings.

[0030] FIG. 1 is a block diagram of a virtual asset wallet address database creation system based on an online harmful site according to one embodiment of the present invention, and FIG. 2 is a detailed diagram of a virtual asset wallet address database creation system based on an online harmful site according to one embodiment of the present invention.

[0031] Referring to the drawing, a virtual asset wallet address database creation system (200) based on an online harmful site according to one embodiment of the present invention may be configured to include a whitelist collection server (210), a whitelist database server (220), a crawling server (230), a URL / electronic wallet address database server (240), an online blacklist analysis server (250), and a main blacklist database server (260).

[0032] Below, the detailed configuration is explained.

[0033] The whitelist collection server (210) can be configured to collect and analyze transaction data from a cryptocurrency trading site and create a whitelist consisting of virtual asset electronic wallet addresses that can be used for normal transactions.

[0034] The whitelist collection server (210) may be configured to include a dusting module (211), an address verification module (212), a pattern analysis module (213), and a clustering module (214).

[0035] Below, the detailed configuration is explained.

[0036] The dusting module (211) may be configured to extract a list of second virtual asset wallet addresses presumed to be held by a virtual asset exchange.

[0037] The address verification module (212) can be configured to compare and verify a first virtual asset wallet address list corresponding to a whitelist candidate group already extracted by online resource crawling and a second virtual asset wallet address list extracted by the dusting module (211), and to generate a basic whitelist based on the comparison and verification result.

[0038] The pattern analysis module (213) may be configured to perform transaction pattern analysis of the basic whitelist generated by the address verification module (212) and, based on the performance results, generate a scale-up whitelist estimated to be a wallet address of a virtual asset exchange.

[0039] The clustering module (214) can be configured to perform clustering on a plurality of virtual asset wallet addresses corresponding to the scale-up whitelist generated by the pattern analysis module (213) to generate a final whitelist.

[0040] The whitelist database server (220) may be configured to include a URL / electronic wallet address database (221) in which a whitelist generated by the whitelist collection server (210) is stored.

[0041] The crawling server (230) may be configured to perform online resource crawling using a predetermined keyword for at least one of the surface web, the dark web, or Telegram.

[0042] The crawling server (230) may be configured to include a search module (231), an update module (232), an address extraction module (233), and an electronic currency-related URL / keyword database (234).

[0043] Below, the detailed configuration is explained.

[0044] The search module (231) can be configured to perform online resource crawling using a predetermined keyword to search for online resources in which high-risk electronic wallet addresses are used.

[0045] The update module (232) may be configured to automatically update online resources searched by the search module (231).

[0046] The address extraction module (233) may be configured to extract the address of an online resource updated by the update module (232).

[0047] The electronic currency-related URL / keyword database (234) can be configured to store the corresponding URLs and keywords of online resources extracted from the address extraction module (233).

[0048] The URL / electronic wallet address database server (240) may be configured to include a whitelist database (241) in which URLs / electronic wallet addresses are stored by online resource crawling performed by the crawling server (230).

[0049] The online blacklist analysis server (250) may be configured to analyze the whitelist stored in the whitelist database server (220) and the URL / electronic wallet address stored in the URL / electronic wallet address database server (240) to extract high-risk virtual asset wallet addresses according to predetermined criteria and to create a main blacklist composed of the extracted high-risk virtual asset wallet addresses.

[0050] The online blacklist analysis server (250) can be configured to include a DB linkage module (251), a clustering linkage module (252), and a risk address judgment module (253).

[0051] Below, the detailed configuration is explained.

[0052] The DB linkage module (251) can be configured to mutually link the final whitelist stored in the whitelist database (221) and the URL and electronic wallet address stored in the URL / electronic wallet address database (241).

[0053] The clustering linkage module (252) can be configured to interconnect the final whitelist stored in a clustered manner in the whitelist database (221) with the URLs and electronic wallet addresses stored in the URL / electronic wallet address database (241).

[0054] The risk address judgment module (253) can be configured to extract high-risk virtual asset wallet addresses based on the mutual linkage results of the DB linkage module (251) and the mutual linkage results of the clustering linkage module (252), and to create a main blacklist composed of the extracted high-risk virtual asset wallet addresses.

[0055] The main blacklist database server (260) may be configured to include a main blacklist database (261) in which the main blacklist generated by the online blacklist analysis server (250) is stored.

[0056] Figure 3 is a flowchart of a method for creating a virtual asset wallet address database based on an online harmful site according to an embodiment of the present invention.

[0057] Referring to Figure 3, a whitelist collection server (210) collects and analyzes transaction data from cryptocurrency trading sites to create a whitelist consisting of virtual asset e-wallet addresses that can be used for normal transactions (S10). Details are as follows.

[0058] First, the dusting module (211) extracts a list of second virtual asset wallet addresses presumed to be held by a virtual asset exchange. Then, the address verification module (212) compares and verifies the first virtual asset wallet address list corresponding to the whitelist candidate group already extracted through online resource crawling with the second virtual asset wallet address list extracted by the dusting module (211), and generates a basic whitelist based on the comparison and verification results. Then, the pattern analysis module (213) performs transaction pattern analysis on the basic whitelist generated by the address verification module (212), and based on the analysis results, generates a scale-up whitelist presumed to be the wallet addresses of the virtual asset exchange. Then, the clustering module (214) clusters a plurality of virtual asset wallet addresses corresponding to the scale-up whitelist generated by the pattern analysis module (213) to generate a final whitelist.

[0059] Next, the whitelist generated from the whitelist collection server is stored in the whitelist database server (220) (S20).

[0060] Next, the crawling server crawls online resources using a predetermined keyword on at least one of the surface web, dark web, or Telegram (S30). The details are as follows.

[0061] First, the search module (231) crawls online resources using a predetermined keyword to search for online resources using high-risk electronic wallet addresses. The update module (232) then automatically updates the online resources searched by the search module (231). The address extraction module (233) then extracts the addresses of the online resources updated by the update module (232). The URLs and keywords of the online resources extracted by the address extraction module (233) are then stored in the electronic currency-related URL / keyword database (234).

[0062] Next, the URL / electronic wallet address is stored in the URL / electronic wallet address database server (240) by online resource crawling performed by the crawling server (230) (S40).

[0063] Next, the online blacklist analysis server (250) analyzes the whitelist stored in the whitelist database server (220) and the URL / electronic wallet address stored in the URL / electronic wallet address database server (240) to extract high-risk virtual asset wallet addresses according to predetermined criteria, and creates a main blacklist composed of the extracted high-risk virtual asset wallet addresses (S50).

[0064] Next, the main blacklist generated from the online blacklist analysis server (250) is stored in the main blacklist database server (260) (S60).

[0065] Figures 4 to 7 are detailed flowcharts of a method for creating a virtual asset wallet address database based on an online harmful site according to an embodiment of the present invention.

[0066] Referring to Figure 4, the detailed sequence of online resource crawling for blacklist generation of the crawling server (230) is illustrated. The search module (211) is configured to select URLs and keywords to download web pages, and the address extraction module (213) is configured to extract, verify, and collect electronic currency addresses.

[0067] Figure 5 shows the detailed process of the whitelist collection task.

[0068] Referring to FIG. 5, a detailed process of collecting and storing an unspecified number of wallet addresses through dusting by the dusting module (231) is shown.

[0069] Referring to Figure 6, the detailed process for performing pattern analysis on wallet addresses collected through dusting and storing those that meet the conditions in a whitelist is illustrated. At this time, if a certain amount of funds is transferred to a specific address, either simultaneously or in multiple transactions, it is stored in the whitelist.

[0070] Additionally, it is configured to define upper / lower addresses by merging or expanding wallet addresses through clustering.

[0071] Meanwhile, Fig. 7 is a detailed sequence of analysis by the online blacklist analysis server (250). Referring to Fig. 7, it is configured to determine whether an address is at risk through DB linkage and clustering linkage of a previously created whitelist or blacklist.

[0072] As described above, the present invention is configured to construct a database by creating a whitelist and a blacklist of virtual asset wallets for each virtual asset through online resource crawling, thereby enabling the rapid filtering and monitoring of illegal use and fraudulent transactions in transactions of virtual asset wallet addresses.

[0073] Although the present invention has been described with reference to the above embodiments, it will be understood by those skilled in the art that various modifications and changes can be made to the present invention without departing from the spirit and scope of the present invention as set forth in the claims below.

Claims

1. A whitelist collection server that collects and analyzes transaction data from cryptocurrency trading sites to create a whitelist of virtual asset e-wallet addresses that can be used for normal transactions; A whitelist database server in which a whitelist generated from the above whitelist collection server is stored; A crawling server that crawls online resources using a given keyword on at least one of the surface web, dark web, or telegram; A URL / electronic wallet address database server in which the URL / electronic wallet address is stored by online resource crawling performed on the above crawling server; An online blacklist analysis server that analyzes the whitelist stored in the above whitelist database server and the URL / electronic wallet address stored in the URL / electronic wallet address database server to extract high-risk virtual asset wallet addresses according to predetermined criteria and creates a main blacklist composed of the extracted high-risk virtual asset wallet addresses; A virtual asset wallet address database creation system based on an online harmful site, including a main blacklist database server in which a main blacklist generated from the above online blacklist analysis server is stored.

2. In paragraph 1, the whitelist collection server, A dusting module that extracts a list of secondary virtual asset wallet addresses believed to be held by a virtual asset exchange; An address verification module that compares and verifies a first virtual asset wallet address list corresponding to a whitelist candidate group already extracted by online resource crawling and a second virtual asset wallet address list extracted by the dusting module, and creates a basic whitelist based on the comparison and verification results; A pattern analysis module that performs transaction pattern analysis of the basic whitelist generated by the above address verification module and generates a scale-up whitelist estimated to be a wallet address of the virtual asset exchange based on the performance result; A virtual asset wallet address database creation system based on an online harmful site, characterized in that it comprises a clustering module that performs clustering on a plurality of virtual asset wallet addresses corresponding to the scale-up whitelist created in the above pattern analysis module to create a final whitelist.

3. In the second paragraph, the whitelist database server, A virtual asset wallet address database creation system based on an online harmful site, characterized in that it comprises a whitelist database in which the generated final whitelist is stored.

4. In the third paragraph, the crawling server, A search module that crawls online resources using specific keywords to search for online resources using high-risk electronic wallet addresses; An update module that automatically updates online resources searched by the above search module; An address extraction module that extracts the address of an online resource updated by the above update module; A virtual asset wallet address database creation system based on an online harmful site, characterized in that it comprises an electronic currency-related URL / keyword database in which the corresponding URLs and keywords of online resources extracted from the above address extraction module are stored.

5. In paragraph 4, the URL / electronic wallet address database server, A virtual asset wallet address database creation system based on an online harmful site, characterized in that it comprises a URL / electronic wallet address database in which the corresponding URL of the online resource extracted from the above address extraction module and the corresponding electronic wallet address are stored.

6. In paragraph 4, the online blacklist analysis server, A DB linking module that interconnects the final whitelist stored in the above whitelist database and the URL and electronic wallet address stored in the above URL / electronic wallet address database; A clustering linkage module that interconnects the final whitelist clustered and stored in the above whitelist database with the URLs and electronic wallet addresses stored in the above URL / electronic wallet address database; A virtual asset wallet address database creation system based on an online harmful site, characterized in that it comprises a risk address judgment module that extracts high-risk virtual asset wallet addresses based on the mutual linkage results of the above DB linkage module and the mutual linkage results of the above clustering linkage module, and creates a main blacklist composed of the extracted high-risk virtual asset wallet addresses.

7. In paragraph 6, the main blacklist database server, A virtual asset wallet address database creation system based on an online harmful site, characterized in that it comprises a main blacklist database in which a main blacklist generated by the above risk address judgment module is stored.

8. A step where a whitelist collection server collects and analyzes transaction data from cryptocurrency exchange sites to create a whitelist consisting of virtual asset electronic wallet addresses that can be used for normal transactions; A step in which a whitelist generated from the whitelist collection server is stored in a whitelist database server; A step in which a crawling server crawls online resources using a predetermined keyword for at least one of the surface web, the dark web, or Telegram; A step in which the URL / electronic wallet address is stored in the URL / electronic wallet address database server by online resource crawling performed on the crawling server; A step in which an online blacklist analysis server analyzes the whitelist stored in the whitelist database server and the URL / electronic wallet address stored in the URL / electronic wallet address database server to extract high-risk virtual asset wallet addresses according to predetermined criteria, and creates a main blacklist composed of the extracted high-risk virtual asset wallet addresses; A method for creating a virtual asset wallet address database based on an online harmful site, comprising a step of storing a main blacklist generated from the online blacklist analysis server in a main blacklist database server.

9. In paragraph 8, the step of the whitelist collection server collecting and analyzing transaction data from a cryptocurrency trading site to create a whitelist consisting of virtual asset electronic wallet addresses that can conduct normal transactions is as follows: A step in which the dusting module extracts a list of second virtual asset wallet addresses presumed to be held by a virtual asset exchange; A step in which the address verification module compares and verifies the first virtual asset wallet address list corresponding to the whitelist candidate group already extracted by online resource crawling with the second virtual asset wallet address list extracted by the dusting module, and creates a basic whitelist based on the comparison and verification result; A step in which a pattern analysis module performs transaction pattern analysis of a basic whitelist generated by the address verification module, and generates a scale-up whitelist estimated to be a wallet address of the virtual asset exchange based on the performance result; A method for creating a virtual asset wallet address database based on an online harmful site, characterized in that the clustering module is configured to include a step of creating a final whitelist by performing clustering on a plurality of virtual asset wallet addresses corresponding to the scale-up whitelist created by the pattern analysis module.

10. In the 9th paragraph, the step of crawling the online resource using a predetermined keyword for at least one of the surface web, the dark web, and the telegram is as follows: A step in which a search module crawls online resources using a predetermined keyword to search for online resources in which high-risk electronic wallet addresses are used; A step in which the update module automatically updates the online resources searched by the search module; A step in which the address extraction module extracts the address of an online resource updated by the update module; A method for creating a virtual asset wallet address database based on an online harmful site, characterized in that it comprises a step of storing the corresponding URL and keyword of the online resource extracted from the address extraction module in the electronic currency-related URL / keyword database.

Images