CN117078259A - Cross-chain abnormal transaction detection method and system based on graph random neural network - Google Patents
Cross-chain abnormal transaction detection method and system based on graph random neural network Download PDFInfo
- Publication number
- CN117078259A CN117078259A CN202311180769.1A CN202311180769A CN117078259A CN 117078259 A CN117078259 A CN 117078259A CN 202311180769 A CN202311180769 A CN 202311180769A CN 117078259 A CN117078259 A CN 117078259A
- Authority
- CN
- China
- Prior art keywords
- graph
- cross
- node
- link
- chain
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 59
- 238000013528 artificial neural network Methods 0.000 title claims abstract description 39
- 238000001514 detection method Methods 0.000 title claims abstract description 18
- 238000000034 method Methods 0.000 claims abstract description 29
- 239000011159 matrix material Substances 0.000 claims description 87
- 238000005192 partition Methods 0.000 claims description 65
- 238000012549 training Methods 0.000 claims description 47
- 238000003062 neural network model Methods 0.000 claims description 17
- 238000004891 communication Methods 0.000 claims description 14
- 238000004590 computer program Methods 0.000 claims description 13
- 238000003860 storage Methods 0.000 claims description 13
- 238000002372 labelling Methods 0.000 claims description 12
- 239000013598 vector Substances 0.000 claims description 10
- 230000005540 biological transmission Effects 0.000 claims description 7
- 230000000977 initiatory effect Effects 0.000 claims description 7
- 238000007781 pre-processing Methods 0.000 claims description 6
- 238000005070 sampling Methods 0.000 claims description 4
- 238000000638 solvent extraction Methods 0.000 claims description 3
- 238000004364 calculation method Methods 0.000 claims 1
- 238000013473 artificial intelligence Methods 0.000 abstract description 2
- 238000010586 diagram Methods 0.000 description 9
- 238000009826 distribution Methods 0.000 description 5
- 230000006870 function Effects 0.000 description 5
- 230000008569 process Effects 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 4
- 238000012545 processing Methods 0.000 description 4
- 238000009499 grossing Methods 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 238000013459 approach Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008033 biological extinction Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000008034 disappearance Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 239000003550 marker Substances 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 238000013530 stochastic neural network Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/042—Knowledge-based neural networks; Logical representations of neural networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/047—Probabilistic or stochastic networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/0895—Weakly supervised learning, e.g. semi-supervised or self-supervised learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Accounting & Taxation (AREA)
- Artificial Intelligence (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Health & Medical Sciences (AREA)
- Life Sciences & Earth Sciences (AREA)
- General Engineering & Computer Science (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computing Systems (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- General Business, Economics & Management (AREA)
- Computer Security & Cryptography (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Probability & Statistics with Applications (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a cross-chain abnormal transaction detection method based on a graph random neural network, which relates to the field of artificial intelligence, in particular to cross-chain abnormal detection. The method can better avoid excessive smoothness by using linear feature propagation and consistency regularization, is more robust and has stronger generalization capability, so that the accuracy and reliability of model abnormal transaction detection are improved.
Description
Technical Field
The invention belongs to the field of blockchain technology and artificial intelligence, and particularly relates to a cross-chain abnormal transaction detection method and system based on a graph random neural network.
Background
With the development of the blockchain technology, the number of blockchains which are applicable to different application scenes is increased continuously, but due to the mutual independence of the blockchains, data communication, value transfer and other operations cannot be effectively performed among the blockchains, and the blockchain cross-chain technology is an important technical means for realizing interconnection and intercommunication of the blockchains and improving expandability. However, the interconnection and interworking between blockchains inevitably also create a transaction security problem, so that anomaly detection in a cross-chain network becomes a problem to be solved.
In the solution of anomaly detection, the graph neural network method has become a powerful and effective method. The main idea of the graph neural network is to learn a new representation of a node through a deterministic feature propagation process, but this approach has the problems of being overly smooth, poorly robust, and easily overfitting the scarce label information. Therefore, the invention provides a method and a system for detecting abnormal transactions across chains based on a graph random neural network in combination with the graph random neural network method, which can reliably and effectively solve the problem of detecting abnormal transactions in the across chains.
Disclosure of Invention
Based on the background and the problems existing in the prior art, the invention adopts the following technical scheme: in a first aspect, a method for detecting abnormal transactions across a chain based on a graph random neural network is provided, which can detect abnormal transactions in the chain across network by utilizing a graph data enhancement and consistency regularization strategy of semi-supervised learning, and obtain classification results of detecting abnormal transactions and normal transactions. The method comprises the following steps:
step 1, constructing a cross-link partition of a cross-link network, and configuring a cross-link route between every two cross-link partitions;
step 2, collecting transaction data of users in a cross-chain network based on cross-chain partition and cross-chain routing, constructing the transaction data into a graph, wherein nodes in the graph represent transactions in a blockchain, any node represents one transaction in the cross-chain network, the nodes also comprise characteristic information of the nodes, edges in the graph represent fund flows among the transactions, the relation among the nodes in the graph is stored by using an adjacent matrix, and the characteristic information of the nodes is stored by using a characteristic matrix;
step 3, labeling the nodes in the graph with labels based on the feature matrix to obtain the original labels of each node;
step 4, constructing a graph random neural network pre-training model, which comprises graph data enhanced random propagation, two-layer perceptron classification and collaborative training, and inputting an adjacent matrix and a feature matrix as training data into the graph random neural network pre-training model for training to obtain the graph random neural network model;
and 5, converting the blockchain transaction data to be tested into graph data, inputting the graph data into a graph random neural network model, outputting the prediction probability of each node in the graph, judging whether the node is an abnormal node or not through a preset threshold value, if the prediction probability of the node is higher than the preset threshold value, the node is the abnormal node, otherwise, the node is a normal node, and the abnormal node represents abnormal transaction in a cross-chain network.
As an implementation manner, the building of the partition of the cross-chain network includes the following steps:
classifying blockchains in a cross-chain network according to transaction types to obtain cross-chain partitions, wherein the blockchains comprising settlement, repayment and lending are divided into payment partitions; dividing a blockchain comprising evidence storage and evidence collection into evidence storage partitions; dividing a blockchain comprising message passing and information transmission into communication partitions;
and configuring a cross-link router for realizing information transmission between every two cross-link partitions, wherein the cross-link router comprises a routing information management module, a communication processor and a distributor, the routing information management module is used for storing a dynamic routing table, and the communication processor and the distributor are used for analyzing communication data packets between block chains and between nodes.
As an implementation manner, the constructing the adjacency matrix and the feature matrix of the graph based on the cross-link partition and the cross-link routing includes the following steps:
collecting transaction data of users in a cross-link network, wherein the transaction data at least comprises fund flows among transactions, the number of times of initiating cross-link transactions within a preset period, the number of transaction objects, the total transaction amount, the overtime and default times of the cross-link transactions, punished or reported times and key input error times;
constructing transaction data into a graph, constructing an adjacency matrix by using fund flows among transactions, constructing a feature matrix by using the rest six types of data, constructing cross-link network transaction data into a partition subgraph in a cross-link partition, storing the partition subgraph by using the partition adjacency matrix and the partition feature matrix, constructing data into a route subgraph in a cross-link route, and storing the route subgraph by using the route adjacency matrix and the route feature matrix.
As an implementation manner, the labeling the nodes in the graph based on the feature matrix to obtain the original label of each node includes the following steps:
respectively setting threshold values for the number of times of initiating cross-chain transactions, the number of transaction objects and the total transaction amount in a preset period, if the characteristic value corresponding to a certain node exceeds various preset threshold values, indicating that the node is an abnormal node, marking, and marking that the label value is 1;
respectively setting threshold values for the values of the overtime and the default times of the cross-link transaction, the punished or reported times and the key input error times in the preset period, if the characteristic value corresponding to a certain node exceeds the set threshold value, indicating that the node is an abnormal node, marking, and the label value is 2;
if the node is not marked as 1 or 2, the node is marked as a normal node, and the label value is 0.
As an implementation manner, the graph stochastic neural network model, in order to enable each node to aggregate information from only a subset of its multi-hop neighbors by completely ignoring the features of certain nodes, reduces the dependence of the node on specific neighbors, thereby helping to improve the robustness of the model, includes the following steps:
randomly sampling the feature vector of each node and the feature vector to obtain a binary mask, and multiplying the binary mask to obtain a disturbance feature matrix;
obtaining an enhanced feature matrix by iteratively calculating the product of an average value matrix of power series from 0 order to K order of the symmetrical normalized adjacent matrix and the disturbance feature matrix;
after executing the two steps for S times, generating S enhanced feature matrixes, and inputting the S enhanced feature matrixes into a two-layer perceptron to obtain S node prediction output vectors;
the graph random neural network pre-training model is cooperatively trained through supervision loss and consistency regularization loss, wherein the supervision loss is calculated through cross entropy loss between the node prediction output and the original label, and the consistency regularization loss is obtained through minimizing the square L2 distance between two node prediction outputs, namely, the square L2 distance between S node prediction output vectors.
In a second aspect, a cross-chain abnormal transaction detection system based on a graph random neural network is provided, which is characterized by comprising a cross-chain partitioning module, a preprocessing module, a model training module and a classification judging module:
the cross-link partition module is used for constructing cross-link partitions of a cross-link network and configuring cross-link routes between every two cross-link partitions;
the preprocessing module is used for constructing transaction data of users in a cross-link network into a graph, wherein in the graph, node relations are stored by using an adjacent matrix, characteristic information of nodes is stored by using a characteristic matrix, and labels of each node are marked;
the model training module comprises random propagation of graph data enhancement, two-layer perceptron classification and collaborative training, and an adjacent matrix and a feature matrix are used as training data to be input into the model training module for training, so that a graph random neural network model is obtained;
the classification judging module is used for converting the blockchain transaction data to be tested into graph data, inputting the graph data into the graph random neural network model, outputting the prediction probability of each node in the graph, and judging whether the node is an abnormal node or not through a preset threshold value.
In a third aspect, a computer readable storage medium is provided, the computer readable storage medium storing a computer program which, when executed by a processor, performs the method of:
constructing a cross-link partition of a cross-link network, and configuring a cross-link route between every two cross-link partitions;
collecting transaction data of users in a cross-chain network based on cross-chain partition and cross-chain routing, and constructing the transaction data into a graph, wherein nodes in the graph represent transactions in a blockchain, nodes also comprise characteristic information of the nodes, edges in the graph represent fund flows among the transactions, relations among the nodes in the graph are stored by using an adjacent matrix, and the characteristic information of the nodes is stored by using a characteristic matrix;
labeling nodes in the graph with labels based on the feature matrix to obtain an original label of each node;
constructing a graph random neural network pre-training model, wherein the graph random neural network pre-training model comprises graph data enhanced random propagation, two-layer perceptron classification and collaborative training, and inputting an adjacent matrix and a feature matrix as training data into the graph random neural network pre-training model for training to obtain the graph random neural network model;
converting the blockchain transaction data to be tested into graph data, inputting the graph data into a graph random neural network model, outputting the prediction probability of each node in the graph, judging whether the node is an abnormal node or not through a preset threshold value, if the prediction probability of the node is higher than the preset threshold value, the node is the abnormal node, otherwise, the node is a normal node, and the abnormal node represents abnormal transaction in a cross-chain network.
In a fourth aspect, a cross-chain abnormal transaction detection device based on a graph random neural network is provided, including a memory, a processor, and a computer program stored in the memory and running on the processor, where the processor implements the following method when executing the computer program:
constructing a cross-link partition of a cross-link network, and configuring a cross-link route between every two cross-link partitions;
collecting transaction data of users in a cross-chain network based on cross-chain partition and cross-chain routing, and constructing the transaction data into a graph, wherein nodes in the graph represent transactions in a blockchain, nodes also comprise characteristic information of the nodes, edges in the graph represent fund flows among the transactions, relations among the nodes in the graph are stored by using an adjacent matrix, and the characteristic information of the nodes is stored by using a characteristic matrix;
labeling nodes in the graph with labels based on the feature matrix to obtain an original label of each node;
constructing a graph random neural network pre-training model, which comprises graph data enhanced random propagation, two-layer perceptron classification and collaborative training, and inputting an adjacent matrix and a feature matrix as training data into the graph random neural network model for training to obtain the graph random neural network model;
converting the blockchain transaction data to be tested into graph data, inputting the graph data into a graph random neural network model, outputting the prediction probability of each node in the graph, judging whether the node is an abnormal node or not through a preset threshold value, if the prediction probability of the node is higher than the threshold value, the node is the abnormal node, otherwise, the node is a normal node, and the abnormal node represents abnormal transaction in a cross-chain network.
The invention at least comprises the following beneficial effects:
(1) The method for detecting the abnormal cross-chain transaction based on the graph random neural network provides a new thought for the safety problem of the cross-chain transaction, effectively captures the abnormal cross-chain transaction, and improves the accuracy and reliability of the detection of the abnormal cross-chain transaction.
(2) The cross-chain abnormal transaction detection method based on the graph random neural network is provided, is better in avoiding excessive smoothing through linear feature propagation and consistency regularization, and is more robust and has stronger generalization capability.
Additional advantages, objects, and features of the invention will be set forth in part in the description which follows and in part will become apparent to those having ordinary skill in the art upon examination of the following or may be learned from practice of the invention.
Drawings
FIG. 1 is a schematic diagram of a cross-link partition and a cross-link router constructed in accordance with the present invention.
Fig. 2 is a schematic diagram of steps of a cross-chain abnormal transaction detection method based on a graph random neural network.
FIG. 3 is a flow chart of a cross-chain abnormal transaction detection method based on a graph random neural network.
Detailed Description
In order to clearly illustrate the present invention and make the objects, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention are clearly and completely described below in conjunction with the drawings in the embodiments of the present invention, so that those skilled in the art can implement the embodiments according to the description and the text of the present invention. The technology of the present invention will be described in detail with reference to the following drawings.
The invention provides a cross-chain abnormal transaction detection method based on a graph random neural network, wherein the schematic diagram of the steps of the method is shown in figure 1, and the specific steps are as follows:
(1) The cross-chain partitions are built for the cross-chain network and cross-chain routes are configured between each two partitions, as shown in fig. 2. The cross-chain partitions are classified according to blockchain transaction types: the payment system comprises a payment partition, a certificate storage partition and a communication partition, wherein the payment partition mainly comprises settlement, repayment and lending, the certificate storage partition mainly comprises certificate storage and evidence obtaining, and the communication partition mainly comprises message transmission and message transmission; and then a cross-link router for information transmission, which is configured between the cross-link partitions, wherein the cross-link router comprises an information management module, a communication processor and a distributor, the information management module is used for storing dynamic routing tables, and the communication processor and the distributor are used for analyzing communication data packets between the blockchains and between users.
(2) Collecting transaction data of users in a cross-link network based on cross-link partition and cross-link routing, constructing the transaction data into a graph, constructing an adjacency matrix and a feature matrix of the graph, wherein the transaction data at least comprises fund flows among transactions, the number of times of initiating the cross-link transaction in a preset period, the number of transaction objects, the total number of transaction amounts, the overtime and default times of the cross-link transaction, punished or reported times and key input error times of the cross-link transaction, constructing the adjacency matrix by utilizing the fund flows among the transactions, and constructing the feature matrix by using the rest six data; constructing transaction data of a cross-chain network into a partition sub-graph in a cross-chain partition, storing the partition sub-graph by using a partition adjacent matrix and a partition characteristic matrix, constructing the data into a route sub-graph in a cross-chain route, storing the route sub-graph by using a route adjacent matrix and a route characteristic matrix, and storing the transaction data in the cross-chain network by using an adjacent matrix A and a characteristic matrix X in the graph by combining the two adjacent matrices and the characteristic matrix.
(3) Labeling the nodes in the graph by presetting a threshold value for the characteristic value of the characteristic matrix, and obtaining the original label of each node. The specific implementation steps are as follows:
setting the threshold value as 10,10,100000 for the number of times of initiating the cross-link transaction within 30 minutes, the number of transaction objects and the total transaction amount; if the characteristic value corresponding to a certain node exceeds the set threshold value, the node is possibly an abnormal node, labeling is carried out, and the label value is 1;
setting the values of the cross-link transaction overtime and the number of violations, punished or reported number and key input error number pair within 30 minutes as 3,3 and 5 respectively; if the characteristic value corresponding to a certain node exceeds the set threshold value, the node is a certain abnormal node, marking is carried out, and the label value is 2;
if the node is not marked as 1 or 2, the node is marked as a normal node, and the label value is 0; and labeling labels through the nodes to obtain the original labels of each node.
(4) The invention constructs a random neural network model of a semi-supervised node classification graph, as shown in figure 3, the model comprises random propagation of graph data enhancement and two-layer perceptron classificationAnd co-training. The random propagation of graph data enhancement has two steps. To take structural effects into account, the entire feature vectors of some nodes are deleted, instead of deleting a single feature element, enabling each node to aggregate only information from its (multi-hop) neighbor subset by completely ignoring the features of some nodes, thus reducing its dependence on specific neighbors, thus helping to improve the robustness of the model. The specific process is as follows: first for each node v i Random sampling binary mask e i Bernoulli (1-delta). Second, a perturbation feature matrix is obtained by multiplying the feature vector of each node by a mask corresponding to the feature vectorI.e. < ->Wherein X is i The i-th row vector of X is represented. Finally, factor->Zoom->To ensure that the perturbation feature matrix expectation is equal to the expectation of X.
The sampling process is only performed during training, and during testing, it will be straightforwardSet as the original feature matrix X. In the second step of random propagation, mixed order propagation is used, i.e. +.>Wherein->Is->An average of the power series from 0 to K,/>is a symmetric normalized adjacency matrix, and D is a degree matrix of a. This propagation rule enables the model to contain more local information than the direct use +.>In comparison, the risk of excessive smoothing is reduced. Note that the dense matrix is calculated +.>Is computationally inefficient, so in implementation by iterative computation and summing the sparse matrix +.>Andis calculated by the product of +.>The problem of gradient extinction is particularly pronounced for non-normalized adjacency matrices, because there are some very large elements and very small elements in the matrix, which can lead to numerical instability in the gradient computation. By symmetrically normalizing the adjacency matrix, the two problems can be effectively solved, so that the influence of each node in the model is more balanced, and the problem of gradient disappearance is reduced, thereby improving the performance of the model.
After S times of random propagation are executed, S enhanced feature matrixes are generatedEach enhancement feature matrix is input into a two-layer perceptron to obtain a corresponding output: />Wherein-> Representation->And the predicted probability, Θ, is the model parameter. In graph-based semi-supervised learning, the goal is typically to smooth the label information on the graph by regularization, i.e., its loss function is a combination of supervised loss on the marker nodes and graph regularization loss. For m marked nodes of the n nodes, the supervision objective of the node classification task for each iteration graph is defined as the average cross entropy loss of S enhancement:
in a semi-supervised setting, the predictive consistency between S-enhancements of unlabeled data is optimized. Taking into account the simple case of s=2, the squared L2 distance between the two outputs is minimized, i.eTo extend this idea to multiple enhancement cases, the tag distribution center is first calculated by taking the average of all the distributions, i.eThe labels are then "guessed" from the average distribution using sharpening techniques. Specifically, the probability of guessing for the jth class by the ith node is calculated as follows:
wherein 0<T.ltoreq.1 serves as a value to control the sharpness of the classification distribution.
At T.fwdarw.0, the sharpened label distribution will be close to the one-hot distribution, minimizingAnd->The distance between the two is as follows:
therefore, by setting T to a small value, the model can be forced to output low entropy prediction.
The final loss is:where lambda is a super parameter for controlling the balance between the two losses.
In summary, the method for detecting the cross-chain abnormal transaction based on the graph random neural network provides technical support for detecting the cross-chain abnormal nodes, the method constructs cross-chain partitions and cross-chain routes, converts cross-chain transaction data into graph representation, constructs an adjacent matrix and a feature matrix according to transaction information and feature information in the partitions and the routes, inputs the adjacent matrix and the feature matrix into a graph random neural network pre-training model, learns new feature representation of nodes in the cross-chain network through random propagation enhanced by graph data, performs S random propagation processes to obtain S enhanced feature matrices, inputs the enhanced feature matrices into two layers of perceptrons to obtain predicted output of the nodes, and finally obtains final output through collaborative training to detect abnormal transactions in the cross-chain network. The method can better avoid excessive smoothing by using linear feature propagation and consistency regularization, is more robust and has stronger generalization capability, so that the accuracy and reliability of detecting abnormal nodes of the model are improved.
Example 2:
the system for detecting the cross-chain abnormal transaction based on the graph random neural network is characterized by comprising a cross-chain partitioning module, a preprocessing module, a model training module and a classification judging module:
the cross-link partition module is used for constructing cross-link partitions of a cross-link network and configuring cross-link routes between every two cross-link partitions;
the preprocessing module is used for constructing transaction data of users in a cross-link network into a graph, wherein in the graph, node relations are stored by using an adjacent matrix, characteristic information of nodes is stored by using a characteristic matrix, and labels of each node are marked;
the model training module comprises random propagation of graph data enhancement, two-layer perceptron classification and collaborative training, and an adjacent matrix and a feature matrix are used as training data to be input into the model training module for training, so that a graph random neural network model is obtained;
the classification judging module is used for converting the blockchain transaction data to be tested into graph data, inputting the graph data into the graph random neural network model, outputting the prediction probability of each node in the graph, and judging whether the node is an abnormal node or not through a preset threshold value.
All changes and modifications that come within the spirit and scope of the invention are desired to be protected and all equivalent thereto are deemed to be within the scope of the invention.
In this specification, each embodiment is described in a progressive manner, and each embodiment is mainly described in a different manner from other embodiments, so that identical and similar parts of each embodiment are mutually referred to.
It will be apparent to those skilled in the art that embodiments of the present invention may be provided as a method, apparatus, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, terminal devices (systems), and computer program products according to the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It should be noted that:
reference in the specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. Thus, the appearances of the phrase "one embodiment" or "an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment.
The previous description of the embodiments is provided to facilitate a person of ordinary skill in the art in order to make and use the present invention. It will be apparent to those having ordinary skill in the art that various modifications to the above-described embodiments may be readily made and the generic principles described herein may be applied to other embodiments without the use of inventive faculty. Therefore, the present invention is not limited to the above-described embodiments, and those skilled in the art, based on the present disclosure, should make improvements and modifications within the scope of the present invention.
Claims (10)
1. The cross-chain abnormal transaction detection method based on the graph random neural network is characterized by comprising the following steps of:
constructing a cross-link partition of a cross-link network, and configuring a cross-link route between every two cross-link partitions;
collecting transaction data of users in a cross-chain network based on cross-chain partition and cross-chain routing, and constructing the transaction data into a graph, wherein nodes in the graph represent transactions in a blockchain, any node represents one transaction in the cross-chain network, the nodes also comprise characteristic information of the nodes, edges in the graph represent fund flows among the transactions, relations among the nodes in the graph are stored by using an adjacent matrix, and the characteristic information of the nodes is stored by using a characteristic matrix;
labeling nodes in the graph with labels based on the feature matrix to obtain an original label of each node;
constructing a graph random neural network pre-training model, wherein the graph random neural network pre-training model comprises graph data enhanced random propagation, two-layer perceptron classification and collaborative training, and inputting an adjacent matrix and a feature matrix as training data into the graph random neural network pre-training model for training to obtain the graph random neural network model;
converting the blockchain transaction data to be tested into graph data, inputting the graph data into a graph random neural network model, outputting the prediction probability of each node in the graph, judging whether the node is an abnormal node or not through a preset threshold value, if the prediction probability of the node is higher than the preset threshold value, the node is the abnormal node, otherwise, the node is a normal node, and the abnormal node represents abnormal transaction in a cross-chain network.
2. The method for detecting abnormal transactions across chains based on graph random neural network according to claim 1, wherein the steps of constructing across chain partitions of the across chain network and configuring across chain routes between every two across chain partitions include the following steps:
classifying blockchains in a cross-chain network according to transaction types to obtain cross-chain partitions, wherein the blockchains comprising settlement, repayment and lending are divided into payment partitions; dividing a blockchain comprising evidence storage and evidence collection into evidence storage partitions; dividing a blockchain comprising message passing and information transmission into communication partitions;
configuring a cross-link route for realizing information transmission among the cross-link partitions, wherein the cross-link route comprises a route information management module, a communication processor and a distributor, and the route information management module is used for storing a dynamic route table; the communication processor and the distributor are used for analyzing communication data packets between the blockchains and between nodes.
3. The method for detecting abnormal transactions across links based on graph random neural network according to claim 1, wherein the constructing the adjacency matrix and the feature matrix of the graph based on the cross-link partition and the cross-link routing comprises the following steps:
collecting transaction data of nodes in a cross-link network, wherein the transaction data at least comprises fund flows among transactions, the number of times of initiating cross-link transactions within a preset period, the number of transaction objects, the total transaction amount, the overtime and default times of the cross-link transactions, punished or reported times and key input error times;
constructing transaction data as a graph, constructing an adjacency matrix by utilizing fund flows among transactions, and constructing a feature matrix by using the number of times of initiating cross-link transactions, the number of transaction objects, the total transaction amount, the overtime and default times of the cross-link transactions, punished or reported times and key input error times in a preset period;
constructing the cross-link network transaction data into a partition sub-graph in a cross-link partition, storing the partition sub-graph by using a partition adjacency matrix and a partition characteristic matrix, constructing the data into a route sub-graph in a cross-link route, and storing the route sub-graph by using a route adjacency matrix and a route characteristic matrix.
4. The method for detecting abnormal transactions across chains based on graph random neural network according to claim 3, wherein the labeling the nodes in the graph based on the feature matrix to obtain the original label of each node comprises the following steps:
respectively setting threshold values for the number of times of initiating cross-chain transactions, the number of transaction objects and the total transaction amount in a preset period; if the characteristic value corresponding to a certain node exceeds various preset thresholds, the node is indicated as an abnormal node, labeling is carried out, and the label value is 1;
respectively setting threshold values for the values of the overtime and the default times of the cross-chain transaction, punished or reported times and key input error times in a certain time period; if the characteristic value corresponding to a certain node exceeds the set threshold value, the node is a certain abnormal node, marking is carried out, and the label value is 2;
if the node is not marked as 1 or 2, the node is marked as a normal node, and the label value is 0; and labeling labels through the nodes to obtain the original labels of each node.
5. The graph-random neural network-based cross-chain abnormal transaction detection method of claim 1, wherein the graph data enhanced random propagation comprises:
randomly sampling a binary mask for each node based on the feature matrix, and multiplying the feature vector of each node with the mask corresponding to the feature vector to obtain a disturbance feature matrix;
and obtaining the enhanced feature matrix by iteratively calculating the product of the average value matrix of the power series from 0 order to K order of the symmetrical normalized adjacent matrix and the disturbance feature matrix.
6. The method for detecting abnormal transactions across chains based on graph random neural network according to claim 5, further comprising the steps of generating S enhanced feature matrices after performing the graph data enhanced random propagation S times, and inputting the enhanced feature matrices into two-layer perceptrons to obtain node prediction output.
7. The method for detecting abnormal transactions across chains based on graph random neural networks according to claim 6, wherein the co-training comprises the steps of:
performing cross entropy loss calculation on the node prediction output and the original label to obtain supervision loss;
the random propagation of the graph data enhancement is carried out for S times, S node prediction outputs are obtained through a two-layer perceptron, and consistency regularization loss is obtained by minimizing the square distance between the two node prediction outputs;
and the graph random neural network model is obtained by cooperatively training the graph random neural network pre-training model through supervision loss and consistency regularization loss.
8. The system for detecting the cross-chain abnormal transaction based on the graph random neural network is characterized by comprising a cross-chain partitioning module, a preprocessing module, a model training module and a classification judging module:
the cross-link partition module is used for constructing cross-link partitions of a cross-link network and configuring cross-link routes between every two cross-link partitions;
the preprocessing module is used for constructing transaction data of users in a cross-link network into a graph, storing node relations in the graph by an adjacent matrix, storing characteristics of nodes by a characteristic matrix, and labeling labels of each node;
the model training module comprises random propagation of graph data enhancement, two-layer perceptron classification and collaborative training, and an adjacent matrix and a feature matrix are used as training data to be input into the model training module for training, so that a graph random neural network model is obtained;
the classification judging module is used for converting the blockchain transaction data to be tested into graph data, inputting the graph data into the graph random neural network model, outputting the prediction probability of each node in the graph, and judging whether the node is an abnormal node or not through a preset threshold value.
9. A computer readable storage medium storing a computer program, which when executed by a processor implements the method of any one of claims 1 to 7.
10. A cross-chain abnormal transaction detection device of a graph random neural network, comprising a memory, a processor and a computer program stored in the memory and running on the processor, wherein the processor implements the method of any one of claims 1 to 7 when executing the computer program.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311180769.1A CN117078259A (en) | 2023-09-13 | 2023-09-13 | Cross-chain abnormal transaction detection method and system based on graph random neural network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311180769.1A CN117078259A (en) | 2023-09-13 | 2023-09-13 | Cross-chain abnormal transaction detection method and system based on graph random neural network |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117078259A true CN117078259A (en) | 2023-11-17 |
Family
ID=88713444
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311180769.1A Pending CN117078259A (en) | 2023-09-13 | 2023-09-13 | Cross-chain abnormal transaction detection method and system based on graph random neural network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117078259A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117493213A (en) * | 2023-11-30 | 2024-02-02 | 湖南长银五八消费金融股份有限公司 | Method, device, equipment and medium for detecting test coverage rate of financial business system |
-
2023
- 2023-09-13 CN CN202311180769.1A patent/CN117078259A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117493213A (en) * | 2023-11-30 | 2024-02-02 | 湖南长银五八消费金融股份有限公司 | Method, device, equipment and medium for detecting test coverage rate of financial business system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Taheri et al. | Predictive temporal embedding of dynamic graphs | |
| CN113822315A (en) | Attribute graph processing method and device, electronic equipment and readable storage medium | |
| CN112395466A (en) | Fraud node identification method based on graph embedded representation and recurrent neural network | |
| CN112215604A (en) | Method and device for identifying information of transaction relationship | |
| WO2023010502A1 (en) | Method and apparatus for anomaly detection on graph | |
| CN114818999B (en) | Account identification method and system based on self-encoder and generation countermeasure network | |
| CN117078259A (en) | Cross-chain abnormal transaction detection method and system based on graph random neural network | |
| CN117272195A (en) | Block chain abnormal node detection method and system based on graph convolution attention network | |
| CN115659966A (en) | Rumor detection method and system based on dynamic heteromorphic graph and multi-level attention | |
| Huang et al. | Unsupervised feature learning from finite data by message passing: discontinuous versus continuous phase transition | |
| Yan et al. | TL-CNN-IDS: transfer learning-based intrusion detection system using convolutional neural network | |
| CN114511063A (en) | Power data prediction model construction method, device, apparatus, medium, and program | |
| Choe et al. | Neural network schemes for detecting rare events in human genomic DNA | |
| Mohammed et al. | Improving forecasts of the EGARCH model using artificial neural network and fuzzy inference system | |
| CN113435307B (en) | Operation and maintenance method, system and storage medium based on visual recognition technology | |
| CN117768377A (en) | Power grid backbone optical communication system route calculation method based on graph neural network | |
| Usmanova et al. | Federated continual learning through distillation in pervasive computing | |
| Peng et al. | Smile net: A supervised graph embedding-based machine learning approach for nextg vulnerability detection | |
| CN109697511B (en) | Data reasoning method and device and computer equipment | |
| Zhou et al. | An efficient split learning framework for recurrent neural network in mobile edge environment | |
| Hintze et al. | Cryptic information transfer in differently-trained recurrent neural networks | |
| CN114048328B (en) | Knowledge-graph link prediction method and system based on conversion hypothesis and message transmission | |
| CN115587318A (en) | Source code classification method based on neural network | |
| CN114912927A (en) | Block chain anti-fraud analysis method and system | |
| JP2023543128A (en) | Marketing arbitrage network dark industry identification method based on dynamic attention graph network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |