CN114429402A - Risk identification method, device and equipment for accounts in the Ethereum blockchain - Google Patents

Abstract

The embodiment of the specification particularly relates to a risk identification method, a risk identification device and risk identification equipment for an account in an ether house block chain. The method provided by the embodiment of the specification can be used for identifying and classifying the accounts in the Etherhouse block chain, and is favorable for further tracing deceased and remedying victims. The method provided by the embodiment of the specification has high effectiveness in detecting the risk account, and can rank the importance of each feature, so as to provide reference and inspiration for further improving the method or analyzing similar block chains.

Description

Risk identification method, device and equipment for accounts in the Ethereum blockchain

technical field

The present invention relates to the field of computer technology, in particular to a risk identification method, device and electronic device for accounts in the Ethereum blockchain.

Background technique

Since the Ethereum mainnet launched in 2015, it has received a lot of attention. Compared with other blockchains, developers can easily write decentralized applications on Ethereum, which provides new solutions for many application scenarios, allowing Ethereum to quickly gather a large number of users after the mainnet is launched. As of February 2021, there are over 360,000 token contracts on Ethereum, reflecting its high popularity.

However, any new technology can potentially be used for illegal activities, and Ethereum is no exception. In recent years, more and more companies have begun to support the use of virtual currency for payment, which has brought blockchain technology including Ethereum into the public eye, and further attracted more illegal profit-seekers. 's scam. The scams that exist on Ethereum include Ponzi schemes, donation scams, phishing, extortion, etc. These illegal activities have caused losses to a large number of victims, negatively affected the reputation of Ethereum, and become resistance to the promotion and development of Ethereum. one.

In the existing technology, it is mainly aimed at the identification of Ponzi schemes that occur on Ethereum and the identification of anti-money laundering. There is a lack of information on accounts that are normally used and accounts that are used for scams in the presence of multiple scams. Identify distinctions. This may have a certain impact on the use of normal accounts, and at the same time affect subsequent accountability for risky accounts.

Therefore, how to identify the risks of the accounts on the Ethereum blockchain and improve the security of the accounts in the Ethereum blockchain has become a technical problem that needs to be solved urgently.

SUMMARY OF THE INVENTION

In view of the above problems in the prior art, the purpose of this paper is to provide a risk identification method, device and electronic device for accounts in the Ethereum blockchain, which can classify and identify risks in the accounts in the Ethereum blockchain, improve the Security of accounts on the Ethereum blockchain.

In order to solve the above technical problems, the specific technical solutions in this paper are as follows:

On the one hand, this paper provides a risk identification method for accounts in the Ethereum blockchain, the method includes:

According to the target account address of the account to be identified in the Ethereum blockchain, obtain the target transaction information of the account to be identified;

Input the target transaction information into a pre-established account risk identification model, use the account risk identification model to extract the account characteristics of the account to be identified based on the target transaction information, and treat the account to be identified according to the extracted account characteristics. Identifying accounts for risk identification; wherein, the account risk identification model is obtained by model training based on transaction information of historical risk accounts and transaction information of historical normal accounts;

According to the risk identification result output by the account risk identification model, it is determined whether the account to be identified belongs to a risk account.

Further, the construction method of the account risk identification model includes:

Collect the account address of the historical risk account and the account address of the historical normal account;

Obtain the transaction information of the historical risk account based on the account address of the historical risk account, and obtain the transaction information of the historical normal account based on the account address of the historical normal account;

Perform feature extraction on the transaction information of the historical risk account to obtain a risk account feature set, and perform feature extraction on the transaction information of the historical normal account to obtain a normal account feature set;

Model training is performed on the account risk identification model by using the risk account feature set and the normal account feature set to obtain the account risk identification model.

Further, the method also includes:

The performing model training on the account risk identification model by using the risk account feature set and the normal account feature set to obtain the account risk identification model, including:

Inputting the risk account feature set and the normal account feature set into the account risk identification model, carrying out model training, and using grid search to determine the target model parameter combination of the account risk identification model;

An account risk identification model is obtained based on the target model parameter combination.

Further, the account address of the collection historical risk account includes:

Obtain the primary account address of the risk account from the risk account database, or obtain the primary account address of the risk account by querying the risk keywords in the risk behavior monitoring platform or the Ethereum blockchain browser;

After obtaining the primary account address of the risk account, check the address of the primary account, delete the duplicate primary account address, and obtain the account address of the risk account.

Further, the method for collecting the account address of the historical normal account includes:

Collect the Ethereum address of the transaction sender from the Ethereum block as the alternate account address;

After deduplication, the alternate account address is compared with the collected account address of the historical risk account, the alternate account address that is the same as the account address of the historical risk account is deleted, and the remaining alternate account addresses are used as the historical normal account. Account address.

Further, the method also includes:

Calculate the average gain rate of each account feature by using the account risk identification model;

Sort each account feature according to the average gain rate of each account feature from high to low, and take the account feature with the top specified ranking as the risk identification account feature;

The use of the account risk identification model to extract the account characteristics of the to-be-identified account based on the target transaction information, and to carry out risk identification to the to-be-identified account according to the extracted account characteristics, includes:

After using the account risk identification model to extract the account characteristics of the to-be-identified account based on the target transaction information, screen out the account characteristics that are the same as the risk identification account characteristics in the risk identification account characteristics. The model uses the screened account characteristics to perform risk identification on the to-be-identified account.

Further, the account features include: statistical features and transaction type features, and the statistical features include: transaction amount features, transaction times features, and transaction time features.

On the other hand, this article provides a risk identification device for accounts in the Ethereum blockchain, including:

an information acquisition module, configured to acquire the target transaction information of the to-be-identified account according to the target account address of the to-be-identified account in the Ethereum blockchain;

The machine learning model identification module is used for inputting the target transaction information into a pre-established account risk identification model, using the account risk identification model to extract the account characteristics of the account to be identified based on the target transaction information, and extracting The obtained account characteristics carry out risk identification on the account to be identified; wherein, the account risk identification model is obtained by model training based on the transaction information of the historical risk account and the transaction information of the historical normal account;

An account risk identification module, configured to determine whether the to-be-identified account belongs to a risk account according to the risk identification result output by the account risk identification model.

Further, the device also includes a model building module for building the account risk identification model using the following method:

Collect the account address of the historical risk account and the account address of the historical normal account;

Obtain the transaction information of the historical risk account based on the account address of the historical risk account, and obtain the transaction information of the historical normal account based on the account address of the historical normal account;

Perform feature extraction on the transaction information of the historical risk account to obtain a risk account feature set, and perform feature extraction on the transaction information of the historical normal account to obtain a normal account feature set;

Model training is performed on the account risk identification model by using the risk account feature set and the normal account feature set to obtain the account risk identification model.

In another aspect, the present document also provides an electronic device, the electronic device includes a processor and a memory, the memory stores at least one instruction, at least a piece of program, a code set or an instruction set, the at least one instruction, the At least one section of program, the code set or the instruction set is loaded and executed by the processor to implement the above-mentioned method for implementing the risk identification method for an account in the Ethereum blockchain by using a lightweight network middleware as described above.

A risk identification method, device and electronic equipment for accounts in the Ethereum blockchain described in this paper use the transaction information of historical risk accounts and historical security accounts for model training, build an account risk identification model, and then use the constructed The account risk identification model extracts and predicts the account characteristics of the account to be identified, realizes the identification of risk accounts in the Ethereum blockchain, and improves the security of accounts in the Ethereum blockchain. Using the method provided by the embodiments of this specification can realize the identification and classification of the accounts in the Ethereum blockchain, which is helpful for further accountability of fraudsters and remediation of victims. The method provided by the embodiments of this specification can have high effectiveness in detecting risk accounts, and can rank the importance of each feature, providing reference and inspiration for further improvement of the method or analysis of similar blockchains.

In order to make the above-mentioned and other objects, features and advantages of this paper more obvious and easy to understand, preferred embodiments are exemplified below, and are described in detail as follows in conjunction with the accompanying drawings.

Description of drawings

In order to more clearly illustrate the embodiments or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that are used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only For some embodiments herein, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative effort.

1 is a schematic flowchart of a method for risk identification of accounts in the Ethereum blockchain according to an embodiment of this specification;

FIG. 2 is a schematic flowchart of account risk identification performed by an account risk identification model in an embodiment of this specification;

3 is a schematic diagram of a feature selection strategy in an embodiment of this specification;

4 is a schematic diagram of the transaction type characteristics of an account in the Ethereum blockchain in an embodiment of this specification;

5 is a schematic structural diagram of a risk identification device for an account in the Ethereum blockchain according to an embodiment of this specification;

FIG. 6 shows a schematic structural diagram of an electronic device for risk identification of an account in the Ethereum blockchain provided by an embodiment of this document.

Detailed ways

The technical solutions in the embodiments herein will be clearly and completely described below with reference to the accompanying drawings in the embodiments herein. Obviously, the described embodiments are only a part of the embodiments herein, rather than all the embodiments. Based on the embodiments herein, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the scope of protection herein.

It should be noted that the terms "first", "second" and the like in the description and claims herein and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. It is to be understood that data so used may be interchanged under appropriate circumstances such that the embodiments herein described can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, apparatus, product or device comprising a series of steps or units is not necessarily limited to those expressly listed Rather, those steps or units may include other steps or units not expressly listed or inherent to these processes, methods, products or devices.

With the advancement of science and technology, blockchain technology has been gradually applied in various fields, but the security of accounts in blockchain technology is still a key issue that needs to be studied. Blockchain is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain is essentially a decentralized database. At the same time, as the underlying technology of Bitcoin, it is a series of data blocks associated with cryptographic methods. Each data block contains a batch of Bitcoin network transactions. information to verify the validity of its information (anti-counterfeiting) and generate the next block. Ethereum (English) is an open-source public blockchain platform with smart contract functions. It provides a decentralized Ethereum Virtual Machine (EVM) through its dedicated cryptocurrency, Ether, to process peer-to-peer contracts.

The embodiments of this specification are aimed at distinguishing risk accounts and legal accounts in the Ethereum blockchain based on data analysis and detection, using machine learning models to identify risks in the accounts in the Ethereum blockchain, and identifying risk accounts in them to ensure that the ether Security of transactions in the blockchain.

Fig. 1 is a schematic flowchart of a risk identification method for an account in the Ethereum blockchain according to an embodiment of this specification. As shown in Fig. 1, the risk identification method for an account in the Ethereum blockchain provided in this specification can be applied to the server, In a client such as a terminal device such as a computer, a smart phone, a smart wearable device, a tablet computer, etc., the method includes:

Step 102: Acquire target transaction information of the account to be identified according to the target account address of the account to be identified in the Ethereum blockchain.

In the specific implementation process, each account in the Ethereum blockchain corresponds to an account address, and all transaction information of the account can be obtained through the account address. When performing risk identification on an account to be identified, the target account address of the account to be identified can be obtained from the Ethereum blockchain first, and then the target transaction information of the account to be identified can be obtained based on the target account address. The account to be identified can be understood as an account that needs risk identification or detection. The target transaction information can be the transaction data of the account to be identified within a specified time range. The time range for obtaining the target transaction information can be set according to the actual application requirements. , you can also set the account risk identification frequency of the Ethereum blockchain, and perform risk identification on the accounts in the Ethereum blockchain every specified time in turn, or perform risk identification for a specific account, which is not specified in the embodiment of this specification. limited.

Step 104: Input the target transaction information into a pre-established account risk identification model, use the account risk identification model to extract the account characteristics of the account to be identified based on the target transaction information, and compare the account characteristics according to the extracted account characteristics. The account to be identified is subjected to risk identification; wherein, the account risk identification model is obtained through model training based on the transaction information of the historical risk account and the transaction information of the historical normal account.

In the specific implementation process, the embodiment of this specification can use the transaction information of the historical risk account and the transaction information of the historical normal account to train the machine learning model in advance, and build a system that can identify the risks of the accounts in the Ethereum blockchain. Account risk identification model. When it is necessary to identify the risk of the account to be identified, the trained account risk identification model is used to identify the risk of the account to be identified. The machine learning algorithm used in the account risk identification model can be selected according to actual needs, for example, a neural network algorithm, a random forest algorithm, etc. can be used, which are not specifically limited in the embodiments of this specification.

The embodiment of this specification is mainly to identify whether the account in the Ethereum blockchain is a safe account or a risk account. Based on this, the account risk identification model in the embodiment of this specification can select a classifier model such as: XGBoost (Extreme Gradient Boosting, extreme gradient boosting) A classifier is an efficient implementation of the gradient boosting tree algorithm. When constructing the XGBoost classifier, the objective function can be constructed first, and then the objective function can be expanded by using Taylor series, and the objective function can be converted into a polynomial function related to the prediction residual for calculation. The core idea is to continuously add base classifiers to the model to continuously fit the residuals of the previous prediction results, and finally weight the results of all base classifiers to obtain the final result. Of course, other machine learning algorithms may also be used to construct an account risk identification model according to actual usage requirements, which are not specifically limited in the embodiments of this specification.

In some embodiments of this specification, the method for constructing the account risk identification model may include:

Collect the account address of the historical risk account and the account address of the historical normal account;

Obtain the transaction information of the historical risk account based on the account address of the historical risk account, and obtain the transaction information of the historical normal account based on the account address of the historical normal account;

Perform feature extraction on the transaction information of the historical risk account to obtain a risk account feature set, and perform feature extraction on the transaction information of the historical normal account to obtain a normal account feature set;

Model training is performed on the account risk identification model by using the risk account feature set and the normal account feature set to obtain the account risk identification model.

In the specific implementation process, a part of historical risk accounts and a part of historical normal accounts can be selected as samples respectively, the account addresses of historical risk accounts and the account addresses of historical normal accounts can be collected, and then the transaction information of the corresponding historical risk accounts can be obtained based on the account addresses. and historical normal account transaction information. Feature extraction is performed on the acquired transaction information, and a risk account feature set and a normal account feature set are extracted, which are respectively used as a positive sample set and a negative sample set. Using the extracted risk account feature set and normal account feature set to train the account risk identification model, the objective function, constraints, etc. of the account risk identification model can be constructed in advance, and then the risk account feature set and the normal account feature set are used. Input the data into the model, adjust the objective function of the model or the parameters in the constraints until the recognition accuracy of the model meets the preset requirements or the number of training times meets the preset requirements, and the process of model training is completed, and the final model obtained is recorded as Account risk identification model.

Use historically known risk accounts and data that have been confirmed to belong to safe accounts as samples to train the machine learning model, and then use the trained model to identify the risk of the account to be identified, which can realize the risk account in the Ethereum blockchain. Identify and ensure the security of account transactions in the Ethereum blockchain.

In some embodiments of this specification, performing model training on the account risk identification model by using the risk account feature set and the normal account feature set to obtain the account risk identification model includes:

Inputting the risk account feature set and the normal account feature set into the account risk identification model, carrying out model training, and using grid search to determine the target model parameter combination of the account risk identification model;

An account risk identification model is obtained based on the target model parameter combination.

In the specific implementation process, during model training, after inputting the data in the risk account feature set and the normal account feature set into the model, the AUC (Area under the Curve of ROC) can be used as the model performance scoring standard, and using Grid search optimizes the model parameters, determines the best model parameter combination, and brings the best model parameter combination into the model to obtain a trained model. The grid search method can specify an exhaustive search method of parameter values, and the optimal learning algorithm is obtained by optimizing the parameters of the estimated function through cross-validation. That is, the possible values of each parameter are arranged and combined, the results of all possible combinations are listed to generate a "grid", then each combination is used for training, and the performance is evaluated using cross-validation. After the fitting function has tried all parameter combinations, it returns an appropriate classifier that automatically adjusts to the best parameter combination. The optimal model parameter combination in the embodiment of this specification is recorded as the target model parameter combination, and the model parameter can be understood as the parameter in the machine learning model that affects the performance of the model. For example, the model parameters for the XGBoost classifier may include important parameters such as learning rate learning_rate, maximum depth max_depth, and the number of weak classifiers n_estimators.

Grid search is used to determine the best combination of model parameters to obtain the account risk identification model with the most accurate identification results, which lays a data foundation for the subsequent risk identification of accounts in the Ethereum blockchain.

In some embodiments of this specification, the method further includes:

Calculate the average gain rate of each account feature by using the account risk identification model;

Sort each account feature according to the average gain rate of each account feature from high to low, and take the account feature with the top specified ranking as the risk identification account feature;

The use of the account risk identification model to extract the account characteristics of the to-be-identified account based on the target transaction information, and to carry out risk identification to the to-be-identified account according to the extracted account characteristics, includes:

After using the account risk identification model to extract the account characteristics of the to-be-identified account based on the target transaction information, screen out the account characteristics that are the same as the risk identification account characteristics in the risk identification account characteristics. The model uses the screened account characteristics to perform risk identification on the to-be-identified account.

In the specific implementation process, at the end of the model training, the importance of each account feature of the input model can be ranked according to the average gain rate. The average gain rate can be understood as the average of the sum of the gain rates of the feature when the tree model is split in the past. value. For the XGBoost classifier, the importance of each feature can be obtained through get_score in the Python package of XGBoost, and the average gain rate ranking of each feature can be obtained by setting importance_type='gain'.

The resulting feature ranking can be used to improve feature selection. For example, the average gain rate can be ranked from high to low for each account feature, and the account feature ranked first in the specified ranking can be used as the risk identification account feature. In the case of relatively limited operating performance, when judging accounts, you can select the account features that are ranked higher, that is, select the risk-identifying account features in the account features of the account to be identified for operation, and remove the features ranked lower to reduce the risk. The computation time of the model. In addition, the top-ranked features are the common features of more abnormal accounts, and this feature ranking can be used to analyze the characteristics of risky behaviors.

Screening the account characteristics through the average gain rate reduces the calculation amount of the model, improves the calculation speed of the model, and further improves the speed of account risk identification in the Ethereum blockchain.

In some embodiments of this specification, the account address of the historical risk account for the collection may include:

Obtain the primary account address of the risk account from the risk account database, or obtain the primary account address of the risk account by querying the risk keywords in the risk behavior monitoring platform or the Ethereum blockchain browser;

After obtaining the primary account address of the risk account, check the address of the primary account, delete the duplicate primary account address, and obtain the account address of the risk account.

In the specific implementation process, the account address of the risk account can be collected through the risk account database. The risk database can be understood as the database that stores the account information of illegal behaviors. It can also be used on the risk behavior supervision platform specially designed to monitor the risk behavior. Query the account address of the risk account by entering the corresponding risk keyword or directly entering the risk keyword in the browser of the Ethereum blockchain.

For example: CryptoScamDB can be used to collect the account addresses of risky accounts. CryptoScamDB (cryptoscamdb.org) is an open source database that collects reports on illegal activities related to cryptocurrency, such as scam activity, which records URLs related to cryptocurrency scam activities. Other information and associated cryptocurrency addresses, Ethereum-related scams are also included in its database, as shown in Table 1, which is a piece of scam data in the scam database provided by CryptoScamDB. Multiple Ethereum addresses used for scam activities can be collected through the website's interface. Alternatively, collect the account addresses of risky accounts through the AlienVault platform, an open cyber threat intelligence platform that provides a large number of reports on scams and attacks, by calling the platform API or directly searching for key points such as Ethereum on the platform You can get a report on Ethereum, so you can get the Ethereum address of the scam, that is, the account address of the risk account. In addition, you can search for keywords such as phish, heist, scam, hack, etc. on the Ethereum browser Etherscan to obtain malicious account addresses that have been marked with relevant tags.

Table 1

Usually, different scam activities may use the same cryptocurrency address. After collecting the relevant addresses of the risky accounts, the account address can be checked for duplicates. For the duplicate account addresses, only one address can be reserved to obtain different addresses. All these addresses collected are marked as risk account addresses and added to the account address dataset.

Through the risk account database or related platforms, the account addresses of known risks can be quickly obtained, which provides a data basis for the training of subsequent machine learning models.

In some embodiments of this specification, the method for collecting the account address of the historical normal account includes:

Collect the Ethereum address of the transaction sender from the Ethereum block as the alternate account address;

After deduplication, the alternate account address is compared with the collected account address of the historical risk account, the alternate account address that is the same as the account address of the historical risk account is deleted, and the remaining alternate account addresses are used as the historical normal account. Account address.

In the specific implementation process, the collection of the account address of the normal account can be directly collected in the Ethereum block, the Ethereum address of the transaction sender in the Ethereum block is directly collected as the backup account address, and the backup account address is deduplicated. Then, compare it with the account address of the historical risk account, delete the account address of the risk account, and record the remaining spare account address as the account address of the historical normal account. In addition, the account identification of ERC20 transactions may be involved in the embodiments of this specification, and the Ethereum ERC20 standard was officially incorporated into the Ethereum specification in September 2017, and it may take some time for people to understand it after it is included in the specification. It will be used later, so when collecting legitimate addresses for normal use, you should try to select an account that is still active after this time node. You can use the Web3.py tool to read the information stored by the Ethereum node, by randomly selecting the Ethereum block generated after September 2017, and collecting the Ethereum address of the sender of all transactions recorded in the block as Alternative legitimate account addresses for normal use, and remove duplicate addresses to ensure that each address in the alternative addresses is different. Compare these alternative addresses with the already collected account addresses of risky accounts used as scams, remove the scam addresses that appear in the alternative addresses, and all remaining addresses are considered to be tentative legal accounts used as negative samples. The account address of the normal account. The collected number of account addresses of normal accounts can be similar to the number of account addresses of risk accounts, and all the collected legal account addresses can be marked and added to the account address data set. Table 2 can be understood as a collection of account addresses, such as As shown in Table 2, each account address can have a corresponding label. The one marked with 0 is the legal address, that is, the account address of the normal account, and the one marked with 1 is the account address of the fraudulent account, that is, the risk account.

Table 2

By directly collecting the account address in the blockchain, comparing the collected account address with the risk account address, and deleting the fraudulent address, the account address of the normal account is obtained, and there is no need to identify and obtain the normal account. It improves the efficiency of data collection and provides a data basis for subsequent model training.

After obtaining the account address, you can obtain the transaction information of the corresponding account based on the account address. The Ethereum browser Etherscan provides a large number of APIs to query and browse various types of information on the Ethereum mainnet, including the query API for the historical data of the Ethereum account. These APIs can collect information about common transactions, internal transactions, and ERC20 transactions corresponding to each Ethereum account address. It should be noted that the relevant API only returns the 10,000 most recent transactions of a specific type of the target address, but the information provided by the 10,000 transactions is enough for this method to be used, and this limitation has no substantial impact on the results of this method.

After the account risk identification model is constructed, when using the account risk identification model to identify the risk of the account to be identified, the obtained target transaction information of the account to be identified can be input into the account risk identification model, and the target transaction can be identified by the account risk identification model. The information is feature extraction, the account features of the account to be identified are extracted, and the risk identification model is used to identify the risk of the account to be identified based on the extracted account features.

Step 106: Determine whether the account to be identified belongs to a risk account according to the risk identification result output by the account risk identification model.

In the specific implementation process, FIG. 2 is a schematic flowchart of the account risk identification model for account risk identification in an embodiment of this specification. As shown in FIG. 2, the account risk identification model mainly has two functions, one is the extraction of account features , a classification and identification of accounts based on the extracted account features. After obtaining the target account address of the account to be identified, you can directly input the target account address into the account risk identification model, or you can first obtain the corresponding transaction information based on the account address, and then use the account risk identification model to perform feature extraction and determine whether For the judgment of abnormal addresses, based on the output results of the model, it can be determined whether the account to be identified is a risk account. The model can directly output the risk label of the account to be identified. For example, if the output is 0, it means a normal account, and if the output is 1, it means a risk account. The account risk identification model can also output the score of the risk degree of the account to be identified. The higher the score, the greater the possibility of belonging to the risk account. Specifically, the model can be configured according to the actual use requirements, which is not specified in the embodiment of this specification. limited.

The risk identification method for accounts in the Ethereum blockchain provided by the embodiments of this specification uses the transaction information of historical risk accounts and historical security accounts for model training to construct an account risk identification model, and then uses the constructed account risk identification model to treat Identify the account characteristics of the account for extraction and risk prediction, realize the identification of risk accounts in the Ethereum blockchain, and improve the security of accounts in the Ethereum blockchain. Using the method provided by the embodiments of this specification can realize the identification and classification of the accounts in the Ethereum blockchain, which is helpful for further accountability of fraudsters and remediation of victims. The method provided by the embodiments of this specification can have high effectiveness in detecting risk accounts, and can rank the importance of each feature, providing reference and inspiration for further improvement of the method or analysis of similar blockchains.

In addition, in the extraction of account features in the embodiment of this specification, the extracted account features may mainly include statistical features and transaction type features, and the statistical features include: transaction amount features, transaction times features, and transaction time features.

In the specific implementation process, the embodiment of this specification can extract the characteristics of the account from two dimensions respectively. The first dimension is the statistical characteristics of the transaction history of the account address, which is called the width-breadth-time feature selection strategy (Width- Breadth-Time Strategy) is WBTS, Table 3 shows some account features in some embodiments of this specification, and FIG. 3 is a schematic diagram of a feature selection strategy in an embodiment of this specification, as shown in FIG. 3 and Table 3, for statistical features Extraction can mainly be considered from the following aspects:

(1) The breadth feature of historical transactions in the account is the feature of transaction amount. Considering an account as a node, a transaction as a connection channel between accounts, and the size of the transfer amount of an account during a transaction as the transaction width, the transaction width characteristics of the account can be obtained by statistics.

Such as: account balance, total transfer amount received by account, total transfer amount sent by account, minimum transfer amount received by account, minimum transfer amount sent by account, maximum transfer amount received by account, maximum transfer amount sent by account , the average amount of transfers received by the account, the average amount of transfers sent by the account, and so on.

(2) The breadth characteristic of the historical transactions occurred in the account is the characteristic of the number of transactions. Considering an account as a node and a transaction connected to an account, statistics on how many different accounts are connected to the same account can obtain the transaction breadth characteristics of the account.

For example: the number of transfers received by the account, the number of transfers sent by the account, how many transfers the account has received from different addresses, how many transfers the account has sent to different addresses, and so on.

(3) The time characteristics of account address transactions are transaction time characteristics. For different accounts, the frequency of transactions is different, and the active time range of the account is also different, so the time-related characteristics of transactions in the account are counted.

For example: the average time for the account to receive the transfer, the average time for the account to send out the transfer, the time span from the first transfer to the last transfer, the time span from the first transfer to the last transfer, the first transfer The time span from when the transfer occurred to the last time the transfer occurred, etc.

In addition, other types of features can also be considered, and this part of the features is mainly used to supplement the features that are not included in the first three types of features, but have certain meanings. Such as: the number of successful account transactions, the number of failed account transactions, and so on.

table 3

Generally, the account used for the scam will receive a large number of transfers from victims in a short period of time in the initial stage of the scam, and the scam address usually hopes to transfer the illicit money with fewer transfers to pay less gas fees when transferring out. . In the embodiment of this specification, by extracting the characteristics of the transaction amount, the number of transactions, and the transaction time of the account, it can be analyzed that there are differences between the risk account and the normally used account in terms of use time, transfer amount, and in and out of the transfer, so that the risk account can be accurately used. Risk accounts are identified.

The second dimension is the transaction type characteristics for Ethereum. Figure 4 is a schematic diagram of the transaction type characteristics of accounts in the Ethereum blockchain in an embodiment of this specification. As shown in Figure 4, according to the characteristics of Ethereum itself, it can be The transaction types between account addresses are divided into ordinary transactions, internal transactions, and ERC20 transactions. Table 4 is the account features extracted in some embodiments of this specification. As shown in Table 4, combined with the features extracted from the first dimension, corresponding to three different transaction type features, transaction amount features and transaction times can also be extracted respectively. Breadth features, transaction time features, and other features, resulting in twelve categories of features.

Among them, ERC20 is actually a currency protocol, which can issue many substitutable passports, and then use these things to represent many things, such as certificates, points or tokens, etc. ERC (Etherum Request for Comments) represents the protocol proposal submitted by Ethereum developers, and 20 represents the number of the proposal.

Table 4

ordinary transaction insider trading ERC20 transaction Transaction width class Common Transaction Width Features Insider Transaction Width Features ERC20 transaction width characteristics trade breadth Common Transaction Breadth Features Insider Transaction Breadth Features ERC20 transaction breadth characteristics trading hours General Trading Hours Features Insider Trading Time Features ERC20 transaction time characteristics other kind Other features of ordinary transactions Other features of insider trading Other features of ERC20 transactions

The embodiments of this specification extract account features from different dimensions, comprehensively cover the account features of risk accounts, and then accurately learn the features of risk accounts, laying a data foundation for accurately identifying risk accounts in the Ethereum blockchain.

In order to verify the availability of the risk identification method for accounts in the Ethereum blockchain provided in the implementation of this specification, the embodiment of this specification also provides an experimental process for specific applications: the experiment is performed when the CPU is an 8-core Inter Core i5-9300H 2.40GHz, and the memory is For 8G, it was performed on an Aspire A715-74G computer running win10.

The data collection part uses the account address of the data extraction risk account provided by CryptoScamDB, and uses the Web3.py tool to obtain the alternative legal address from the Ethereum remote node provided by Infura. Historical data is obtained through Etherscan's query transaction records for each address, and then account features are extracted from each account according to the feature extraction algorithm in this method to form a training data set.

Using grid search, it can be determined that when the learning rate is 0.2, the maximum depth is 5, and the number of weak classifiers is 280 in this experimental data set, the average AUC value of 10-fold cross-validation is the largest. At this time, the score of the AUC value is as follows Table 1. The average training time was 10.3756 seconds, the average AUC score was 0.992034, and the standard deviation of the AUC score was 0.00230191. Table 5 is the result of grid search in an embodiment of this specification. As shown in Table 5, it can be seen that this method has high accuracy and feasibility, and can more accurately distinguish scam addresses from legitimate addresses.

table 5

Name AUC split0_test_score 0.991337 split1_test_score 0.995122 split2_test_score 0.993343 split3_test_score 0.987229 split4_test_score 0.995007 split5_test_score 0.989108 split6_test_score 0.992601 split7_test_score 0.992016 split8_test_score 0.992684 split9_test_score 0.991895 mean_test_score 0.992034

By comparing the average gain rate of the features, the importance of each feature to the model can be ranked. Different results of each run may lead to different rankings of each feature, but the approximate range of the ranking fluctuations of each feature is basically the same. The ranking of the feature importance can be used to analyze the behavior features of the account addresses of the risk account, and further improve the feature selection and improvement method. Table 6 lists the top 20 account characteristics of the experiment. It can be seen that the characteristics of the time span are of great significance for distinguishing whether an account is an account used as a scam.

Table 6

Based on the above-described risk identification method for an account in the Ethereum blockchain, one or more embodiments of this specification further provide a risk identification device for an account in the Ethereum blockchain. The apparatuses may include apparatuses (including distributed systems), software (applications), modules, plug-ins, servers, clients, etc. that use the methods described in the embodiments of this specification in combination with apparatuses that implement necessary hardware. Based on the same innovative idea, the apparatuses in one or more embodiments provided by the embodiments of this specification are described in the following embodiments. Since the implementation solution of the device to solve the problem is similar to the method, the implementation of the specific device in the embodiments of the present specification may refer to the implementation of the foregoing method, and repeated descriptions will not be repeated. As used below, the term "unit" or "module" may be a combination of software and/or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, implementations in hardware, or a combination of software and hardware, are also possible and contemplated.

FIG. 5 is a schematic structural diagram of a risk identification device for an account in the Ethereum blockchain according to an embodiment of this specification. As shown in FIG. 5 , the device includes:

An information acquisition module 501, configured to acquire target transaction information of the to-be-identified account according to the target account address of the to-be-identified account in the Ethereum blockchain;

The machine learning model identification module 502 is configured to input the target transaction information into a pre-established account risk identification model, and use the account risk identification model to extract the account characteristics of the to-be-identified account based on the target transaction information. The extracted account features perform risk identification on the account to be identified; wherein, the account risk identification model is obtained by model training based on the transaction information of the historical risk account and the transaction information of the historical normal account;

The account risk identification module 503 is configured to determine whether the account to be identified belongs to a risk account according to the risk identification result output by the account risk identification model.

In addition, in some embodiments of this specification, the apparatus further includes a model building module, configured to build the account risk identification model by using the following method:

Collect the account address of the historical risk account and the account address of the historical normal account;

Obtain the transaction information of the historical risk account based on the account address of the historical risk account, and obtain the transaction information of the historical normal account based on the account address of the historical normal account;

Perform feature extraction on the transaction information of the historical risk account to obtain a risk account feature set, and perform feature extraction on the transaction information of the historical normal account to obtain a normal account feature set;

Model training is performed on the account risk identification model by using the risk account feature set and the normal account feature set to obtain the account risk identification model.

The above-mentioned embodiments of the apparatus part refer to the embodiments of the method part, and there may also be other embodiments, which will not be repeated here.

On the other hand, an embodiment of the present specification is a computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one piece of program, and the at least one instruction or at least one piece of program is loaded and executed by a processor to achieve the above The described risk identification method for accounts in the Ethereum blockchain.

On the other hand, the embodiments of this specification provide an electronic device for risk identification of accounts in the Ethereum blockchain, and FIG. 6 shows an electronic device for risk identification of accounts in the Ethereum blockchain provided by the embodiments of this document. As shown in FIG. 6, the device includes a processor, a memory, a communication interface and a bus, and the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is executed by the The processor loads and executes to implement the risk identification method for an account in the Ethereum blockchain as described in any of the above.

It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. For the same and similar parts among the various embodiments, refer to each other Can. The test method provided by the embodiment of the present invention has the same implementation principle and technical effect as the foregoing system embodiment. For a brief description, for the parts not mentioned in the method embodiment, reference may be made to the corresponding content in the foregoing system embodiment.

It should be understood that, in the various embodiments herein, the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, rather than the implementation of the embodiments herein. The process constitutes any qualification.

It should also be understood that, in the embodiments herein, the term "and/or" is only an association relationship for describing associated objects, indicating that there may be three kinds of relationships. For example, A and/or B can mean that A exists alone, A and B exist at the same time, and B exists alone. In addition, the character "/" in this document generally indicates that the related objects are an "or" relationship.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. Interchangeability, the above description has generally described the components and steps of each example in terms of function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this document.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above may refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided herein, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solutions in the embodiments herein.

In addition, each functional unit in each of the embodiments herein may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions in this article are essentially or make contributions to the prior art, or all or part of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments herein. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

The principles and implementations of this paper are described by using specific examples in this paper. The descriptions of the above examples are only used to help understand the methods and core ideas of this paper; , there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to this article.

Claims (10)

1. A risk identification method for an account in the Ethereum blockchain, wherein the method comprises: According to the target account address of the account to be identified in the Ethereum blockchain, obtain the target transaction information of the account to be identified; Input the target transaction information into a pre-established account risk identification model, use the account risk identification model to extract the account characteristics of the account to be identified based on the target transaction information, and treat the account to be identified according to the extracted account characteristics. Identifying accounts for risk identification; wherein, the account risk identification model is obtained by model training based on transaction information of historical risk accounts and transaction information of historical normal accounts; According to the risk identification result output by the account risk identification model, it is determined whether the account to be identified belongs to a risk account. 2. The risk identification method of an account in the Ethereum blockchain according to claim 1, wherein the construction method of the account risk identification model comprises: Collect the account address of the historical risk account and the account address of the historical normal account; Obtain the transaction information of the historical risk account based on the account address of the historical risk account, and obtain the transaction information of the historical normal account based on the account address of the historical normal account; Perform feature extraction on the transaction information of the historical risk account to obtain a risk account feature set, and perform feature extraction on the transaction information of the historical normal account to obtain a normal account feature set; Model training is performed on the account risk identification model by using the risk account feature set and the normal account feature set to obtain the account risk identification model. 3. The risk identification method for accounts in the Ethereum blockchain according to claim 2, wherein the account risk identification model is modeled by using the risk account feature set and the normal account feature set Training to obtain the account risk identification model, including: Inputting the risk account feature set and the normal account feature set into the account risk identification model, carrying out model training, and using grid search to determine the target model parameter combination of the account risk identification model; An account risk identification model is obtained based on the target model parameter combination. 4. The risk identification method of an account in the Ethereum blockchain according to claim 2, wherein the collection of the account address of the historical risk account comprises: Obtain the primary account address of the risk account from the risk account database, or obtain the primary account address of the risk account by querying the risk keywords in the risk behavior monitoring platform or the Ethereum blockchain browser; After obtaining the primary account address of the risk account, check the address of the primary account, delete the duplicate primary account address, and obtain the account address of the risk account. 5. The risk identification method of an account in the Ethereum blockchain according to claim 4, wherein the method for collecting the account address of the historical normal account comprises: Collect the Ethereum address of the transaction sender from the Ethereum block as the alternate account address; After deduplication, the alternate account address is compared with the collected account address of the historical risk account, the alternate account address that is the same as the account address of the historical risk account is deleted, and the remaining alternate account addresses are used as the historical normal account. Account address. 6. The risk identification method for accounts in the Ethereum blockchain according to claim 1, wherein the method further comprises: Calculate the average gain rate of each account feature by using the account risk identification model; Sort each account feature according to the average gain rate of each account feature from high to low, and take the account feature with the top specified ranking as the risk identification account feature; The use of the account risk identification model to extract the account characteristics of the to-be-identified account based on the target transaction information, and to carry out risk identification to the to-be-identified account according to the extracted account characteristics, includes: After using the account risk identification model to extract the account characteristics of the to-be-identified account based on the target transaction information, screen out the account characteristics that are the same as the risk identification account characteristics in the risk identification account characteristics. The model uses the screened account characteristics to perform risk identification on the to-be-identified account. 7. The risk identification method for accounts in the Ethereum blockchain according to claim 1, wherein the account features include: statistical features and transaction type features, and the statistical features include: transaction amount features, transaction times Features, transaction time features. 8. A risk identification device for accounts in the Ethereum blockchain, wherein the device comprises: an information acquisition module, configured to acquire the target transaction information of the to-be-identified account according to the target account address of the to-be-identified account in the Ethereum blockchain; The machine learning model identification module is used for inputting the target transaction information into a pre-established account risk identification model, using the account risk identification model to extract the account characteristics of the account to be identified based on the target transaction information, and extracting The obtained account characteristics carry out risk identification on the account to be identified; wherein, the account risk identification model is obtained by model training based on the transaction information of the historical risk account and the transaction information of the historical normal account; An account risk identification module, configured to determine whether the to-be-identified account belongs to a risk account according to the risk identification result output by the account risk identification model. 9. The risk identification device for an account in the Ethereum blockchain according to claim 8, wherein the device further comprises a model building module for constructing the account risk identification model using the following method: Collect the account address of the historical risk account and the account address of the historical normal account; Obtain the transaction information of the historical risk account based on the account address of the historical risk account, and obtain the transaction information of the historical normal account based on the account address of the historical normal account; Perform feature extraction on the transaction information of the historical risk account to obtain a risk account feature set, and perform feature extraction on the transaction information of the historical normal account to obtain a normal account feature set; Model training is performed on the account risk identification model by using the risk account feature set and the normal account feature set to obtain the account risk identification model. 10. An electronic device comprising a processor and a memory, wherein at least one instruction, at least one program, code set or instruction set is stored in the memory, the at least one instruction, the at least one program, all the The set of codes or instructions is loaded and executed by the processor to implement the method of any of claims 1-7.

Images