WO2020248658A1 - 一种异常账户的检测方法及装置 - Google Patents

一种异常账户的检测方法及装置 Download PDF

Info

Publication number
WO2020248658A1
WO2020248658A1 PCT/CN2020/082440 CN2020082440W WO2020248658A1 WO 2020248658 A1 WO2020248658 A1 WO 2020248658A1 CN 2020082440 W CN2020082440 W CN 2020082440W WO 2020248658 A1 WO2020248658 A1 WO 2020248658A1
Authority
WO
WIPO (PCT)
Prior art keywords
transaction
attribute
preset
transaction log
target
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/082440
Other languages
English (en)
French (fr)
Inventor
方思羽
左军
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Advanced New Technologies Co Ltd
Original Assignee
Advanced New Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Advanced New Technologies Co Ltd filed Critical Advanced New Technologies Co Ltd
Publication of WO2020248658A1 publication Critical patent/WO2020248658A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing

Definitions

  • One or more embodiments of this specification relate to the field of computer technology, and in particular to a method and device for detecting abnormal accounts.
  • Blockchain technology is built on a point-to-point (P2P) network, using chained data structures to verify and store data, using distributed node consensus algorithms to generate and update data, and using cryptography to ensure data transmission and Access security, a new distributed infrastructure and computing paradigm that uses smart contracts composed of automated script codes to program and manipulate data. Because of its weak centralization, non-tampering, tolerance and other advantages, it is widely used in the financial industry.
  • P2P point-to-point
  • the accounts and keys (such as public keys and private keys) for users to access blockchain nodes in the blockchain network are usually saved in the user terminal in a text file format.
  • the user terminal is attacked by hackers, it is extremely easy to cause the leakage of the user's account and key. After the hacker steals the user's account and key, he can use the user's account and key to log in to the blockchain node and conduct transactions, thereby causing the user's economic losses.
  • One or more embodiments of this specification describe a detection method and device for abnormal accounts, which can realize detection of abnormal accounts.
  • a method for detecting abnormal accounts is provided.
  • the method is applied to a blockchain node in a blockchain network.
  • the method includes: when a preset sampling period is reached, according to each area in the blockchain The time stamp of the block, the target block whose time stamp belongs to the preset time range is obtained; the transaction log set corresponding to the target account is obtained from the transaction log contained in the target block, and the transaction log set includes the target account Multiple transaction logs related to multiple transactions initiated, each transaction log having multiple target attributes, the target attributes being transaction time, Internet Protocol IP address, transaction status, or transaction amount; for each transaction log set A target attribute, at least according to the attribute value of the target attribute in each transaction log and the abnormal condition preset for the target attribute, determine the risk score of the target attribute in the transaction log set; and according to each transaction log set The risk score of the target attribute determines the total risk score of the transaction log collection; if the total risk score is greater than a preset score threshold, the target account is determined to be an abnormal account.
  • the multiple target attributes include a first attribute
  • the target is determined in the transaction log set at least according to the attribute value of the target attribute in each transaction log and an abnormal condition preset for the target attribute
  • the risk score of the attribute includes: if the attribute value of the first attribute in each transaction log satisfies the first abnormal condition preset for the first attribute, then the risk score for the first attribute is determined For the first score preset for the first attribute, the first score indicates that the first attribute is an abnormal attribute; if the attribute value of the first attribute in each transaction log does not satisfy the For the first abnormal condition, the risk score for the first attribute is determined to be zero.
  • the multiple target attributes include a second attribute
  • the target attribute in the transaction log set is determined at least according to the attribute value of the target attribute in each transaction log and an abnormal condition preset for the target attribute
  • the risk score of the attribute includes: determining that the number of transaction logs whose attribute value of the second attribute in each transaction log satisfies the second abnormal condition preset for the second attribute accounts for the total number of transaction logs in the transaction log set.
  • the ratio of the number of transaction logs, and the risk score of the second attribute is determined according to the ratio.
  • the first attribute is transaction time
  • the attribute value of the first attribute in each transaction log satisfies a first abnormal condition preset for the first attribute
  • the The determination of the risk score of the first attribute as the first score preset for the first attribute includes: determining the time interval between adjacent transaction logs in the transaction log set according to the transaction time of each transaction log If there is a first preset number of time intervals less than the preset first preset duration in the transaction log set, the risk score for the transaction time is determined as the first score preset for the transaction time.
  • the first attribute is an IP address
  • the attribute value of the first attribute in the transaction logs meets the first abnormal condition preset for the first attribute
  • the The risk score of the first attribute is determined as the first score preset for the first attribute, including: if there are adjacent transaction logs in the transaction log set, the time interval of transaction time is less than a second preset duration, And the IP addresses are not the same, the risk score for the IP address is determined as the first score preset for the IP address.
  • the first attribute is a transaction status
  • the attribute value of the first attribute in each transaction log satisfies the first abnormal condition preset for the first attribute
  • the The risk score of the first attribute is determined as the first score preset for the first attribute, including: if there are a second preset number of consecutive transaction logs in the transaction log set and the transaction status is transaction failure, then The risk score for the transaction state is determined as the first score preset for the transaction state.
  • the first attribute is the transaction amount
  • the attribute value of the first attribute in each transaction log satisfies the first abnormal condition preset for the first attribute
  • the The risk score of the first attribute is determined as the first score preset for the first attribute, including: if there is a transaction log with a transaction amount greater than a preset transaction amount threshold in the transaction log set, then The risk score of the transaction amount is determined as the first score preset for the transaction amount.
  • the second attribute is a transaction status
  • the number of transaction logs for which the attribute value of the second attribute in each transaction log meets a second abnormal condition preset for the second attribute is determined
  • the proportion of the total number of transaction logs in the transaction log set, and the determination of the risk score of the second attribute according to the proportion includes: determining that the transaction status in each transaction log is a transaction log with a transaction failure
  • the ratio of the number to the total number of transaction logs in the transaction log set, and the risk score for the transaction state is determined as the product of the second score preset for the transaction state and the ratio.
  • the second attribute is a transaction amount
  • the number of transaction logs for which the attribute value of the second attribute in each transaction log meets a second abnormal condition preset for the second attribute is determined
  • the ratio of the total number of transaction logs in the transaction log set, and determining the risk score of the second attribute according to the ratio includes: determining that the transaction amount in each transaction log is greater than a preset transaction amount
  • the ratio of the number of threshold transaction logs to the total number of transaction logs in the transaction log set, and the risk score for the transaction amount is determined as the ratio.
  • the preset transaction amount threshold is determined according to the average value of the transaction amount of each transaction log in the transaction log set.
  • the determining the total risk score of the transaction log set according to the risk score of each target attribute in the transaction log set includes: determining the total risk score of each target attribute according to a preset weight coefficient for each target attribute The weighted sum of the risk scores of, obtains the total risk score of the transaction log collection.
  • the method further includes: when it is detected that the target account is logged in, sending alarm information to the user terminal logging in the target account.
  • a device for detecting abnormal accounts is provided.
  • the device is applied to a blockchain node in a blockchain network.
  • the device includes: a first acquisition module for when the preset sampling period is reached , According to the timestamp of each block in the blockchain, obtain the target block whose timestamp belongs to the preset time range; the second obtaining module is used to obtain the transaction log corresponding to the target account from the transaction log contained in the target block
  • the transaction log collection includes multiple transaction logs related to multiple transactions initiated by the target account, each transaction log has multiple target attributes, and the target attributes are transaction time, Internet Protocol IP address, transaction Status or transaction amount;
  • the first determining module is used to determine for each target attribute in the transaction log set, at least according to the attribute value of the target attribute in each transaction log and the abnormal condition preset for the target attribute
  • the risk score of the target attribute in the transaction log set a second determining module, configured to determine the total risk score of the transaction log set according to the risk score of each target attribute in the transaction log set; a third
  • the multiple target attributes include a first attribute
  • the first determining module is specifically configured to: if the attribute value of the first attribute in each transaction log satisfies a predetermined value for the first attribute If the first abnormal condition is set, the risk score for the first attribute is determined as the first score preset for the first attribute, and the first score indicates that the first attribute is an abnormal attribute; if If the attribute value of the first attribute in each transaction log does not satisfy the first abnormal condition, the risk score for the first attribute is determined to be zero.
  • the multiple target attributes include a second attribute
  • the first determining module is specifically configured to: determine that the attribute value of the second attribute in each transaction log satisfies a predetermined value for the second attribute. Set the ratio of the number of transaction logs of the second abnormal condition to the total number of transaction logs in the transaction log set, and determine the risk score of the second attribute according to the ratio.
  • the first attribute is transaction time
  • the first determining module is specifically configured to: determine the time interval between adjacent transaction logs in the transaction log set according to the transaction time of each transaction log If there is a first preset number of time intervals less than the preset first preset duration in the transaction log set, the risk score for the transaction time is determined as the first score preset for the transaction time.
  • the first attribute is an IP address
  • the first determining module is specifically configured to: if the transaction time interval of adjacent transaction logs in the transaction log set is less than a second preset duration, And the IP addresses are not the same, the risk score for the IP address is determined as the first score preset for the IP address.
  • the first attribute is a transaction status
  • the first determining module is specifically configured to: if there are a second preset number of consecutive transaction logs in the transaction log set, the transaction status is transaction failure, then The risk score for the transaction state is determined as the first score preset for the transaction state.
  • the first attribute is a transaction amount
  • the first determining module is specifically configured to: if there is a transaction log with a transaction amount greater than a preset transaction amount threshold in the transaction log set, target the transaction amount The risk score of the transaction amount is determined as the first score preset for the transaction amount.
  • the second attribute is a transaction status
  • the first determining module is specifically configured to: determine that the number of transaction logs whose transaction status is a transaction failure in each transaction log accounts for the transaction log set And determine the risk score for the transaction status as the product of the second score preset for the transaction status and the ratio.
  • the second attribute is a transaction amount
  • the first determining module is specifically configured to: determine that the number of transaction logs in each transaction log whose transaction amount is greater than a preset transaction amount threshold accounts for The ratio of the total number of transaction logs in the transaction log set is determined, and the risk score for the transaction amount is determined as the ratio.
  • the preset transaction amount threshold is determined according to the average value of the transaction amount of each transaction log in the transaction log set.
  • the second determination module is specifically configured to: according to a weight coefficient preset for each target attribute, weighted and sum the risk scores of each target attribute to obtain the total risk score of the transaction log set.
  • the device further includes: a sending module, configured to send alarm information to the user terminal logging in the target account when the target account is detected to be logged in.
  • a sending module configured to send alarm information to the user terminal logging in the target account when the target account is detected to be logged in.
  • a blockchain node including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, any one of the first aspect is implemented The method described in the item.
  • a computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed in a computer, the computer is caused to execute the method in any one of the first aspect.
  • the embodiments of this specification provide a method and device for detecting abnormal accounts.
  • the blockchain node obtains the target block whose time stamp belongs to the preset time range according to the timestamp of each block in the blockchain, and obtains it from the transaction log contained in the target block
  • the transaction log collection corresponding to the target account.
  • the transaction log collection includes multiple transaction logs initiated by the target account, each transaction log has multiple target attributes, and the target attributes are transaction time, Internet Protocol IP address, transaction status, or transaction amount.
  • the blockchain node determines the target attribute in the transaction log collection at least according to the attribute value of the target attribute in each transaction log and the abnormal conditions preset for the target attribute. Risk score.
  • the blockchain node determines the total risk score of the transaction log set according to the risk score of each target attribute in the transaction log set. If the total risk score is greater than the preset score threshold, the blockchain node determines that the target account is an abnormal account. In this way, the blockchain node can detect whether the target account is an abnormal account by analyzing the transaction log in the transaction log collection of the target account.
  • Fig. 1 is an architecture diagram of a blockchain system provided by an embodiment of the specification
  • FIG. 2 is a flowchart of a method for detecting abnormal accounts according to an embodiment of this specification
  • FIG. 3 is a schematic structural diagram of an abnormal account detection device provided by an embodiment of this specification.
  • FIG. 4 is a schematic structural diagram of an abnormal account detection device provided by an embodiment of this specification.
  • Fig. 1 is an architecture diagram of a blockchain system provided by an embodiment of this specification.
  • the system includes a user terminal and a blockchain network.
  • the blockchain network includes multiple blockchain nodes, and each blockchain node runs a trading platform, which can interact with multiple users and provide services for the users.
  • the user can log in to the service platform by entering the account and key on the client terminal in the user terminal, and conduct transactions with other users.
  • the client can be an application (Application, APP), a distributed application (Decentralized Application, DAPP), a browser, etc. on the user terminal.
  • the blockchain node in the blockchain network will record the transaction log corresponding to the account.
  • each transaction log may include multiple target attributes.
  • the target attributes may be transaction time, Internet Protocol (IP) address, transaction status or transaction amount, or other attributes, which are not limited in the embodiment of this specification.
  • IP Internet Protocol
  • This manual introduces the target attribute as transaction time, IP address, transaction status or transaction amount as an example. Other situations are similar.
  • the embodiment of this specification provides a method for detecting abnormal accounts, which is applied to blockchain nodes in a blockchain network, as shown in Figure 2, the processing process is as follows:
  • Step 201 When the preset sampling period is reached, obtain the target block whose time stamp belongs to the preset time range according to the time stamp of each block in the blockchain.
  • the sampling period and time range may be pre-stored in the blockchain node.
  • the sampling period and time range can be set by technicians based on experience.
  • the blockchain node can package the transaction into a block, and add the block to the zone based on the consensus algorithm between each node Block chain.
  • the blockchain node can also record the transaction status or transaction information of transactions initiated by each account in the form of a log, thereby generating a transaction log.
  • the transaction log can record the time when each transaction was initiated, the account initiated, whether the transaction was successful, the type of transaction, the amount of the transaction, and so on.
  • the blockchain node may generate a transaction log based on one transaction, or generate a transaction log based on multiple consecutive transaction records, which is not limited in the embodiment of this specification.
  • the blockchain node can store the transaction log corresponding to each account in the local database, and can also store the transaction log on the blockchain in the form of blocks.
  • a timestamp corresponding to the block will be generated according to the time of addition.
  • the blockchain node can periodically obtain the timestamp of the block from the blockchain according to the preset sampling period. Time range (such as one week or one month or one year) block (ie target block), in order to read the transaction log of the corresponding time range.
  • Step 202 Obtain a transaction log set corresponding to the target account from the transaction log contained in the target block.
  • the transaction log collection includes multiple transaction logs related to multiple transactions initiated by the target account, each transaction log has multiple target attributes, and the target attributes are transaction time, IP address, transaction status, or transaction amount.
  • the blockchain node after the blockchain node obtains the target block, it can further obtain the transaction log with the originator (from) field being the target account from the transaction log contained in the target block to form a transaction log set corresponding to the target account.
  • the transaction set includes log content of multiple transactions initiated by the target account; each transaction log in the transaction log set may include multiple target attributes; the target attributes may be transaction time, IP address, transaction status Or the transaction amount may also be other attributes, which are not limited in the embodiment of this description.
  • Table 1 shows the transaction log set corresponding to account 1 obtained by the blockchain node.
  • Step 203 For each target attribute in the transaction log set, determine the risk score of the target attribute in the transaction log set at least according to the attribute value of the target attribute in each transaction log and the abnormal condition preset for the target attribute.
  • the abnormal conditions corresponding to each target attribute can be pre-stored in the blockchain node.
  • the abnormal condition corresponding to each target attribute can be set by the technician based on experience.
  • the block chain node After the block chain node obtains the transaction log set corresponding to the target account, for each target attribute in the transaction log set, the block chain node can according to the attribute value of the target attribute in each transaction log and the abnormal condition corresponding to the target attribute , To determine the risk score of the target attribute in the transaction log collection.
  • the blockchain node can determine the risk score of the target attribute in the transaction log collection in various ways. The embodiment of this specification provides two feasible ways for introduction, which are specifically as follows:
  • the multiple target attributes include the first attribute. If the attribute value of the first attribute in each transaction log satisfies the first abnormal condition preset for the first attribute, the blockchain node will assign the risk score for the first attribute Determined as the first score preset for the first attribute. Wherein, the first score indicates that the first attribute is an abnormal attribute. If the attribute value of the first attribute in each transaction log does not meet the first abnormal condition, the blockchain node determines the risk score for the first attribute as 0.
  • the corresponding relationship between the target attribute and the score can be pre-stored in the blockchain node.
  • the corresponding relationship between the target attribute and the score can be set by the technician based on experience.
  • Table 2 shows the correspondence between the target attributes and scores stored in the blockchain nodes.
  • Serial number Target attribute fraction 1 transaction hour 30 2 IP address 10 3 trading status 40 4 The transaction amount 20
  • the blockchain node can determine whether the attribute value of the first attribute in each transaction log satisfies the corresponding value of the first attribute Abnormal conditions. If the attribute value of the first attribute satisfies the abnormal condition corresponding to the first attribute, the blockchain node can determine that the first attribute is an abnormal attribute, and determine the risk score of the first attribute as the first attribute corresponding to the first attribute. One score. If the attribute value of the first attribute does not satisfy the abnormal condition corresponding to the first attribute, the blockchain node can determine that the first attribute is a normal attribute, and determine the risk score of the first attribute as zero.
  • the abnormal conditions corresponding to the target attributes are different. The embodiments of this specification provide several examples of judging whether the target attribute is an abnormal attribute and determining the risk score of the target attribute, as follows:
  • Example 1 The first attribute is the transaction time.
  • the blockchain node determines whether the first attribute is an abnormal attribute, and the process of determining the risk score of the first attribute is as follows:
  • Step 1 Determine the time interval between adjacent transactions in the transaction log set according to the transaction time recorded in each transaction log.
  • the blockchain node can determine the time interval of the transaction time of adjacent transactions in the transaction log set according to the transaction time in each transaction log.
  • the transaction time interval of transaction log 1 and transaction log 2 is 35 seconds
  • the transaction time interval of transaction log 2 and transaction log 3 is 1 minute and 20 seconds
  • the time interval of transaction time of 4 is 3 minutes and 25 seconds
  • the time interval of transaction time of transaction log 4 and transaction log 5 is 31 seconds
  • the time interval of transaction time of transaction log 5 and transaction log 6 is 3 minutes 59 seconds.
  • Step 2 If there are a first preset number of time intervals less than the preset first preset duration in the transaction log set, the risk score for the transaction time is determined as the first score preset for the transaction time.
  • the first preset number and the first preset duration may be pre-stored in the blockchain node.
  • the first preset number and the first preset duration can be set by a technician based on experience.
  • the blockchain node After the blockchain node obtains the time interval of the transaction time of adjacent transaction logs in the transaction log set, it can further determine whether there are a first preset number of time intervals less than the preset first preset duration in the transaction log set . If there are a first preset number of time intervals less than the preset first preset duration in the transaction log collection, it means that the target account may be stolen by hackers and frequent transactions are performed, and the blockchain node can determine the transaction time Is an abnormal attribute, and the risk score of the transaction time is determined as the first score corresponding to the transaction time.
  • the blockchain node can determine that the transaction time is a normal attribute, and take the transaction The risk score of time is determined to be zero.
  • the first preset duration is 1 minute, and the first preset number is 2.
  • the time interval (35 seconds) between the transaction time of transaction log 1 and transaction log 2 is less than the first preset Duration (1 minute)
  • the time interval (31 seconds) between transaction log 4 and transaction log 5 transaction time is less than the first preset duration (1 minute)
  • the number of time intervals less than the preset first preset duration is 2
  • the blockchain node can determine that the transaction time is an abnormal attribute, and the risk score of the transaction time is determined to be 30.
  • Example 2 The first attribute is the IP address, and the blockchain node judges whether the first attribute is an abnormal attribute, and the process of determining the risk score of the first attribute is: if there are adjacent transaction log transaction times in the transaction log set If the time interval is less than the second preset time period and the IP addresses are different, the risk score for the IP address is determined as the first score preset for the IP address.
  • the second preset duration may be pre-stored in the blockchain node.
  • the second preset duration can be set by a technician based on experience.
  • the blockchain node can determine whether there are adjacent transaction logs in the transaction log set. The time interval of the transaction time is less than the second preset time period and the IP addresses are different. If the transaction time interval of adjacent transaction logs in the transaction log set is less than the second preset time period and the IP addresses are different, it means that the target account may be stolen by hackers and the target account is logged in to perform transactions in a remote place.
  • the blockchain node can determine that the IP address is an abnormal attribute, and determine the risk score of the IP address as the first score corresponding to the IP address.
  • the transaction time interval is less than the second preset duration and the IP addresses are not the same, then the IP address is normal, and the blockchain node can determine that the IP address is a normal attribute, and The risk score of the IP address is determined to be 0.
  • the second preset duration is 5 minutes.
  • the time interval (3 minutes and 25 seconds) between the transaction time of transaction log 3 and transaction log 4 is less than the second preset duration (5 minutes).
  • the IP address (10.0.0.1) of transaction log 3 and the IP address (20.0.0.1) of transaction log 4 are not the same, the blockchain node can determine that the IP address is an abnormal attribute, and determine the risk score of the IP address as 10.
  • Example 3 The first attribute is the transaction status.
  • the blockchain node judges whether the first attribute is an abnormal attribute, and the process of determining the risk score of the first attribute is: if there are a second preset number of consecutive transactions in the transaction log collection
  • the transaction status of the log is transaction failure, and the risk score for the transaction status is determined as the first score preset for the transaction status.
  • the second preset number may be pre-stored in the blockchain node.
  • the second preset number can be set by a technician based on experience.
  • the blockchain node can determine whether there is a second preset number of consecutive transaction logs in the transaction log set in which the transaction status is transaction failure. If there is a second preset number of consecutive transaction logs in the transaction log set and the transaction status is transaction failure, it means that the target account may be stolen by a hacker and a key attempt is made.
  • the blockchain node can determine that the transaction status is an abnormal attribute. And the risk score of the transaction status is determined as the first score corresponding to the transaction status.
  • the transaction status is normal, and the blockchain node can determine that the transaction status is a normal attribute, and calculate the risk score of the transaction status Determined to be 0.
  • the second preset number is 3.
  • the transaction statuses of transaction 3, transaction 4, and transaction 5 are all transaction failures, and the blockchain node can determine that the transaction status is an abnormal attribute, and The risk score of this transaction status is determined to be 40.
  • Example 4 The first attribute is the transaction amount, the blockchain node judges whether the target attribute is an abnormal attribute, and the process of determining the risk score of the first attribute is: if there is a transaction log set whose transaction amount is greater than the preset transaction amount threshold In the transaction log, the risk score for the transaction amount is determined as the first score preset for the transaction amount.
  • the transaction amount threshold may be pre-stored in the blockchain node.
  • the transaction amount threshold can be set by a technician based on experience.
  • the blockchain node can determine whether there is a transaction log with a transaction amount greater than a preset transaction amount threshold in the transaction log collection. If there is a transaction log whose transaction amount is greater than the preset transaction amount threshold in the transaction log collection, it means that the target account has been stolen by hackers and a large-value transaction is performed.
  • the blockchain node can determine that the transaction amount is an abnormal attribute and take The risk score of the amount is determined as the first score corresponding to the transaction amount. If there is no transaction log with a transaction amount greater than the preset transaction amount threshold in the transaction log set, it means that the transaction amount is normal, and the blockchain node can determine the transaction amount as a normal attribute, and determine the risk score of the transaction amount as 0.
  • the transaction amount threshold is 3000. As shown in Table 1 and Table 2, the transaction amount of transaction 5 (5000) and the transaction amount of transaction 6 (8000) are both greater than the transaction amount threshold (3000), then the blockchain node can determine The transaction amount is an abnormal attribute, and the risk score of the transaction amount is determined to be 20.
  • Method 2 The multiple target attributes include the second attribute, and the blockchain node can determine that the attribute value of the second attribute in each transaction log meets the second abnormal condition preset for the second attribute.
  • the number of transaction logs in the transaction log collection According to the proportion of the total number of transaction logs, determine the risk score of the second attribute.
  • the blockchain node can determine the first attribute in the transaction log. Whether the attribute value of the second attribute meets the second abnormal condition corresponding to the second attribute. If the attribute value of the second attribute in the transaction log meets the second abnormal condition corresponding to the second attribute, the blockchain node can determine that the transaction log is the target transaction log. Then, the blockchain node can count the number of target transaction logs. After the blockchain node obtains the number of target transaction logs, it can further determine the ratio of the number of target transaction logs to the total number of transaction logs in the transaction log set, and determine the risk score of the second attribute according to the ratio. Among them, for different target attributes, the abnormal conditions corresponding to the target attributes are different.
  • the embodiments of this specification provide several examples of determining the risk scores of the target attributes, which are specifically as follows:
  • Example 1 The second attribute is the transaction status, and the process of determining the risk score of the second attribute by the blockchain node is: determining the number of transaction logs whose transaction status is failed in each transaction log accounts for the total number of transaction logs in the transaction log set The risk score for the transaction status is determined as the product of the second score preset for the transaction status and the ratio.
  • the blockchain node after the blockchain node obtains the transaction log set corresponding to the target account, it can determine the proportion of the number of transaction logs whose transaction status is failed in each transaction log to the total number of transaction logs in the transaction log set. Then, the blockchain node can determine the risk score of the transaction state as the product of the second score corresponding to the transaction state and the ratio.
  • Example 2 The second attribute is the transaction amount.
  • the process of determining the risk score of the second attribute by the blockchain node is: determining that the number of transaction logs in each transaction log whose transaction amount is greater than the preset transaction amount threshold accounts for the transaction log collection The proportion of the total number of transaction logs, and the risk score for the transaction amount is determined as the proportion.
  • the transaction amount threshold may be pre-stored in the blockchain node.
  • the transaction amount threshold can be set by a technician based on experience. After the block chain node obtains the transaction log set corresponding to the target account, it can determine the proportion of the number of transaction logs in each transaction log whose transaction amount is greater than the preset transaction amount threshold to the total number of transaction logs in the transaction log set, and compare the transaction The risk score of the amount is determined as a ratio.
  • the transaction amount threshold is 3000.
  • the transaction amount of transaction 5 (5000) and the transaction amount (8000) of transaction 6 are both greater than the transaction amount threshold (3000), and the transaction amount is greater than the preset transaction amount threshold
  • the preset transaction amount threshold may be determined according to the average value of the transaction amount of each transaction log in the transaction log set.
  • preset coefficients can be pre-stored in the blockchain node.
  • the preset coefficient can be set by a technician based on experience.
  • the blockchain node can determine the product of the average value of the transaction amount of each transaction log in the transaction log set and the preset coefficient as the transaction amount threshold.
  • the preset coefficient is 1.2.
  • the transaction amount threshold is:
  • Step 204 Determine the total risk score of the transaction log set according to the risk score of each target attribute in the transaction log set.
  • the blockchain node determines the risk score of each target attribute, it can further calculate the sum of the risk scores of each target attribute, and use the sum as the total risk score of the transaction log collection.
  • the blockchain node may weighted and sum the risk scores of each target attribute according to a weight coefficient preset for each target attribute to obtain the total risk score of the transaction log set.
  • the corresponding relationship between the target attribute and the weight coefficient may be pre-stored in the blockchain node.
  • the corresponding relationship between the target attribute and the weight coefficient can be set by the technician based on experience.
  • Table 3 shows the corresponding relationship between the target attributes and the weight coefficients stored in the blockchain nodes.
  • the risk score of each target attribute can be weighted and summed to obtain the total risk score of the transaction log collection.
  • the risk score of the transaction time is 0, the risk score of the IP address is 10, the risk score of the transaction status is 40, and the risk score of the transaction amount is 20.
  • Step 205 If the total risk score is greater than the preset score threshold, it is determined that the target account is an abnormal account.
  • the score threshold may be pre-stored in the blockchain node. Among them, the score threshold can be set by a technician based on experience. After the blockchain node obtains the total risk score of the transaction log collection, it can further determine whether the total risk score is greater than or equal to the preset score threshold. If the total risk score is greater than or equal to the preset score threshold, it means that the account has been stolen by hackers, and the blockchain node can determine that the target account is an abnormal account. If the total risk score is less than the preset score threshold, the account is normal, and the blockchain node can determine that the target account is a normal account.
  • the blockchain node can determine that the target account is an abnormal account if the preset score threshold is 60 and the total risk score of the transaction log collection is 70, then the total risk score (70) is greater than the preset score threshold (60), then the blockchain node can determine that the target account is an abnormal account if the preset score threshold is 60 and the total risk score of the transaction log collection is 70, then the total risk score (70) is greater than the preset score threshold (60), then the blockchain node can determine that the target account is an abnormal account .
  • the blockchain node may also send alarm information to the user terminal logging in to the target account when it detects that the target account is logged in.
  • the blockchain node after the blockchain node determines that the target account is an abnormal account, it can send alarm information to the user terminal logging in to the target account when it detects that the target account is logged in to remind the user that the target account may be stolen by hackers.
  • the blockchain node can also send a text message to the mobile phone number bound to the target account to remind the user, or send an email to the mailbox bound to the target account to remind the user, and other methods can also be used to remind the user.
  • This manual implements The examples are not limited.
  • the embodiment of this specification provides a method for detecting abnormal accounts.
  • the blockchain node obtains the target block whose time stamp belongs to the preset time range according to the timestamp of each block in the blockchain, and obtains it from the transaction log contained in the target block
  • the transaction log collection corresponding to the target account.
  • the transaction log collection includes multiple transaction logs initiated by the target account, each transaction log has multiple target attributes, and the target attributes are transaction time, Internet Protocol IP address, transaction status, or transaction amount.
  • the blockchain node determines the target attribute in the transaction log collection at least according to the attribute value of the target attribute in each transaction log and the abnormal conditions preset for the target attribute. Risk score.
  • the blockchain node determines the total risk score of the transaction log set according to the risk score of each target attribute in the transaction log set. If the total risk score is greater than the preset score threshold, the blockchain node determines that the target account is an abnormal account. In this way, the blockchain node can detect whether the target account is an abnormal account by analyzing the transaction log in the transaction log collection of the target account.
  • an embodiment of this specification also provides an abnormal account detection device, which is applied to a blockchain node in a blockchain network, and the device includes:
  • the first obtaining module 310 is configured to obtain the target block whose time stamp belongs to the preset time range according to the time stamp of each block in the blockchain when the preset sampling period is reached;
  • the second obtaining module 320 is configured to obtain a transaction log set corresponding to the target account from the transaction log contained in the target block.
  • the transaction log set includes multiple transaction logs initiated by the target account, and each transaction log has multiple Target attribute, target attribute is transaction time, Internet Protocol IP address, transaction status or transaction amount;
  • the first determining module 330 is configured to determine, for each target attribute in the transaction log set, the target attribute in the transaction log set at least according to the attribute value of the target attribute in each transaction log and the abnormal condition preset for the target attribute The risk score of the attribute;
  • the second determining module 340 is configured to determine the total risk score of the transaction log set according to the risk score of each target attribute in the transaction log set;
  • the third determining module 350 is configured to determine that the target account is an abnormal account if the total risk score is greater than the preset score threshold.
  • the multiple target attributes include a first attribute
  • the first determining module 330 is specifically configured to:
  • the risk score for the first attribute is determined as the first score preset for the first attribute, and the first score Indicates that the first attribute is an abnormal attribute;
  • the risk score for the first attribute is determined to be zero.
  • the multiple target attributes include a second attribute
  • the first determining module 330 is specifically configured to:
  • the first attribute is transaction time
  • the first determining module 330 is specifically used for:
  • the risk score for the transaction time is determined as the first score preset for the transaction time.
  • the first attribute is an IP address
  • the first determining module 330 is specifically configured to:
  • the risk score for the IP address is determined as the first score preset for the IP address.
  • the first attribute is the transaction status
  • the first determining module 330 is specifically configured to:
  • the risk score for the transaction status is determined as the first score preset for the transaction status.
  • the first attribute is the transaction amount
  • the first determining module 330 is specifically used for:
  • the risk score for the transaction amount is determined as the first score preset for the transaction amount.
  • the second attribute is the transaction status
  • the first determining module 330 is specifically configured to:
  • the second attribute is the transaction amount
  • the first determining module 330 is specifically used for:
  • the preset transaction amount threshold is determined according to the average value of the transaction amount of each transaction log in the transaction log set.
  • the second determining module 340 is specifically configured to:
  • the weighted sum of the risk scores of each target attribute is obtained to obtain the total risk score of the transaction log collection.
  • the device further includes:
  • the sending module 360 is configured to send alarm information to the user terminal logging in to the target account when the target account login is detected.
  • the embodiment of this specification provides an abnormal account detection device.
  • the blockchain node obtains the target block whose time stamp belongs to the preset time range according to the timestamp of each block in the blockchain, and obtains it from the transaction log contained in the target block
  • the transaction log collection corresponding to the target account.
  • the transaction log collection includes multiple transaction logs initiated by the target account, each transaction log has multiple target attributes, and the target attributes are transaction time, Internet Protocol IP address, transaction status, or transaction amount.
  • the blockchain node determines the target attribute in the transaction log collection at least according to the attribute value of the target attribute in each transaction log and the abnormal conditions preset for the target attribute. Risk score.
  • the blockchain node determines the total risk score of the transaction log set according to the risk score of each target attribute in the transaction log set. If the total risk score is greater than the preset score threshold, the blockchain node determines that the target account is an abnormal account. In this way, the blockchain node can detect whether the target account is an abnormal account by analyzing the transaction log in the transaction log collection of the target account.
  • the embodiments of this specification also provide a blockchain node, including a memory and a processor, and executable code is stored in the memory.
  • executable code is stored in the memory.
  • the embodiments of this specification also provide a computer-readable storage medium on which a computer program is stored.
  • the computer program is executed in a computer, the computer is caused to execute the method executed by the blockchain node.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种异常账户的检测方法及装置，涉及计算机技术领域。该方法应用于区块链网络中的区块链节点，首先，当达到预设的采样周期时，根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块（S201），从目标区块包含的交易日志中获取目标账户对应的交易日志集合（S202）。然后，针对交易日志集合中的每个目标属性，区块链节点至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定交易日志集合中该目标属性的风险分数（S203）。之后，根据交易日志集合中各目标属性的风险分数，确定交易日志集合的风险总分（S204）。如果风险总分大于预设分值阈值，则区块链节点确定目标账户为异常账户（S205）。所述方法可以对异常账户进行检测。

Description

一种异常账户的检测方法及装置 技术领域
本说明书一个或多个实施例涉及计算机技术领域，尤其涉及一种异常账户的检测方法及装置。
背景技术
区块链技术是构建在点对点(Point to Point，P2P)网络上，利用链式数据结构来验证与存储数据，利用分布式节点共识算法来生成和更新数据，利用密码学的方式保证数据传输和访问的安全，利用由自动化脚本代码组成的智能合约来编程和操作数据的一种全新的分布式基础架构与计算范式。由于其具有弱中心化、不可篡改、包容性等优势，被广泛应用于金融行业。
用户访问区块链网络中的区块链节点的账户和密钥(比如公钥和私钥)，通常以文本文件格式保存在用户终端中。当用户终端被黑客攻击时，极容易造成用户的账户和密钥发生泄漏。黑客窃取到用户的账户和密钥后，可以使用该用户的账户和密钥登录区块链节点，进行交易，从而造成该用户的经济损失。
因此，亟待一种异常账户的检测方案。
发明内容
本说明书一个或多个实施例描述了一种异常账户的检测方法及装置，能够实现对异常账户的检测。
第一方面，提供了一种异常账户的检测方法，所述方法应用于区块链网络中的区块链节点，所述方法包括：当达到预设的采样周期时，根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块；从所述目标区块包含的交易日志中获取目标账户对应的交易日志集合，所述交易日志集合中包括与所述目标账户发起的多笔交易相关的多条交易日志，每条交易日志具有多个目标属性，所述目标属性为交易时间、互联网协议IP地址、交易状态或交易金额；针对所述交易日志集合中的每个目标属性，至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定所述交易日志集合中该目标属性的风险分数；根据所述交易日志集合中各目标属性的风险 分数，确定所述交易日志集合的风险总分；如果所述风险总分大于预设分值阈值，则确定所述目标账户为异常账户。
可选的，所述多个目标属性包括第一属性，所述至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定所述交易日志集合中该目标属性的风险分数，包括：如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，所述第一分数指示出所述第一属性为异常属性；如果所述各条交易日志中所述第一属性的属性值不满足所述第一异常条件，则将针对所述第一属性的风险分数确定为0。
可选的，所述多个目标属性包括第二属性，所述至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定所述交易日志集合中该目标属性的风险分数，包括：确定所述各条交易日志中所述第二属性的属性值满足针对所述第二属性预设的第二异常条件的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并根据所述比例，确定所述第二属性的风险分数。
可选的，所述第一属性为交易时间，所述如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，包括：根据所述各条交易日志的交易时间，确定所述交易日志集合中相邻的交易日志的时间间隔；如果所述交易日志集合中存在第一预设数目个小于预设的第一预设时长的时间间隔，则将针对交易时间的风险分数确定为针对所述交易时间预设的第一分数。
可选的，所述第一属性为IP地址，所述如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，包括：如果所述交易日志集合中存在相邻的交易日志的交易时间的时间间隔小于第二预设时长，且IP地址不相同，则将针对所述IP地址的风险分数确定为针对所述IP地址预设的第一分数。
可选的，所述第一属性为交易状态，所述如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，包括：如果所述交易日志集合中存在连续的第二预设数目个交易日志的交易状态为交易失败，则将针对所述交易状态的风险分数 确定为针对所述交易状态预设的第一分数。
可选的，所述第一属性为交易金额，所述如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，包括：如果所述交易日志集合中存在交易金额大于预设的交易金额阈值的交易日志，则将针对所述交易金额的风险分数确定为针对所述交易金额预设的第一分数。
可选的，所述第二属性为交易状态，所述确定所述各条交易日志中所述第二属性的属性值满足针对所述第二属性预设的第二异常条件的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并根据所述比例，确定所述第二属性的风险分数，包括：确定所述各条交易日志中所述交易状态为交易失败的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并将针对所述交易状态的风险分数确定为针对所述交易状态预设的第二分数与所述比例的乘积。
可选的，所述第二属性为交易金额，所述确定所述各条交易日志中所述第二属性的属性值满足针对所述第二属性预设的第二异常条件的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并根据所述比例，确定所述第二属性的风险分数，包括：确定所述各条交易日志中所述交易金额大于预设的交易金额阈值的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并将针对所述交易金额的风险分数确定为所述比例。
可选的，所述预设的交易金额阈值根据所述交易日志集合中各交易日志的交易金额的平均值确定。
可选的，所述根据所述交易日志集合中各目标属性的风险分数，确定所述交易日志集合的风险总分，包括：根据针对各目标属性预设的权重系数，对所述各目标属性的风险分数加权求和，得到所述交易日志集合的风险总分。
可选的，所述确定目标账户为异常账户之后，所述方法还包括：当检测到所述目标账户登录时，向登录所述目标账户的用户终端发送告警信息。
第二方面，提供了一种异常账户的检测装置，所述装置应用于区块链网络中的区块链节点，所述装置包括：第一获取模块，用于当达到预设的采样周期时，根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块；第二获取模块，用于从所述目标区块包含的交易日志中获取目标账户对应的交易日志集合，所述交易日志集合 中包括与所述目标账户发起的多笔交易相关的多条交易日志，每条交易日志具有多个目标属性，所述目标属性为交易时间、互联网协议IP地址、交易状态或交易金额；第一确定模块，用于针对所述交易日志集合中的每个目标属性，至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定所述交易日志集合中该目标属性的风险分数；第二确定模块，用于根据所述交易日志集合中各目标属性的风险分数，确定所述交易日志集合的风险总分；第三确定模块，用于如果所述风险总分大于预设分值阈值，则确定所述目标账户为异常账户。
可选的，所述多个目标属性包括第一属性，所述第一确定模块，具体用于：如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，所述第一分数指示出所述第一属性为异常属性；如果所述各条交易日志中所述第一属性的属性值不满足所述第一异常条件，则将针对所述第一属性的风险分数确定为0。
可选的，所述多个目标属性包括第二属性，所述第一确定模块，具体用于：确定所述各条交易日志中所述第二属性的属性值满足针对所述第二属性预设的第二异常条件的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并根据所述比例，确定所述第二属性的风险分数。
可选的，所述第一属性为交易时间，所述第一确定模块，具体用于：根据所述各条交易日志的交易时间，确定所述交易日志集合中相邻的交易日志的时间间隔；如果所述交易日志集合中存在第一预设数目个小于预设的第一预设时长的时间间隔，则将针对交易时间的风险分数确定为针对所述交易时间预设的第一分数。
可选的，所述第一属性为IP地址，所述第一确定模块，具体用于：如果所述交易日志集合中存在相邻的交易日志的交易时间的时间间隔小于第二预设时长，且IP地址不相同，则将针对所述IP地址的风险分数确定为针对所述IP地址预设的第一分数。
可选的，所述第一属性为交易状态，所述第一确定模块，具体用于：如果所述交易日志集合中存在连续的第二预设数目个交易日志的交易状态为交易失败，则将针对所述交易状态的风险分数确定为针对所述交易状态预设的第一分数。
可选的，所述第一属性为交易金额，所述第一确定模块，具体用于：如果所述交易日志集合中存在交易金额大于预设的交易金额阈值的交易日志，则将针对所述交易金额的风险分数确定为针对所述交易金额预设的第一分数。
可选的，所述第二属性为交易状态，所述第一确定模块，具体用于：确定所述各条交易日志中所述交易状态为交易失败的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并将针对所述交易状态的风险分数确定为针对所述交易状态预设的第二分数与所述比例的乘积。
可选的，所述第二属性为交易金额，所述第一确定模块，具体用于：确定所述各条交易日志中所述交易金额大于预设的交易金额阈值的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并将针对所述交易金额的风险分数确定为所述比例。
可选的，所述预设的交易金额阈值根据所述交易日志集合中各交易日志的交易金额的平均值确定。
可选的，所述第二确定模块，具体用于：根据针对各目标属性预设的权重系数，对所述各目标属性的风险分数加权求和，得到所述交易日志集合的风险总分。
可选的，所述装置还包括：发送模块，用于当检测到所述目标账户登录时，向登录所述目标账户的用户终端发送告警信息。
第三方面，提供了一种区块链节点，包括存储器和处理器，其中，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现第一方面中任一项的所述的方法。
第四方面，提供了一种计算机可读存储介质，其上存储有计算机程序，其中，当所述计算机程序在计算机中执行时，令计算机执行第一方面中任一项的所述的方法。
通过本说明书实施例提供了一种异常账户的检测方法及装置。首先，当达到预设的采样周期时，区块链节点根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块，并从目标区块包含的交易日志中获取目标账户对应的交易日志集合。其中，交易日志集合中包括由目标账户发起的多条交易日志，每条交易日志具有多个目标属性，目标属性为交易时间、互联网协议IP地址、交易状态或交易金额。然后，针对交易日志集合中的每个目标属性，区块链节点至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定交易日志集合中该目标属性的风险分数。之后，区块链节点根据交易日志集合中各目标属性的风险分数，确定交易日志集合的风险总分，如果风险总分大于预设分值阈值，则区块链节点确定目标账户为异常账户。这样，区块链节点通过对目标账户的交易日志集合中的交易日志进行分析，可以检测目标账户是否为异常账户。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为本说明书实施例提供的区块链系统的架构图；
图2为本说明书实施例提供的一种异常账户的检测方法的流程图；
图3为本说明书实施例提供的一种异常账户的检测装置的结构示意图；
图4为本说明书实施例提供的一种异常账户的检测装置的结构示意图。
具体实施方式
下面结合附图，对本说明书提供的方案进行描述。
图1为本说明书实施例提供的区块链系统的架构图，如图1所示，该系统包括用户终端和区块链网络。其中，区块链网络包括多个区块链节点，每个区块链节点上运行有交易平台，该交易平台可以与多个用户进行交互，为用户提供服务。用户可以通过在用户终端中的客户端输入账户和密钥的方式登录服务平台，并与其他用户进行交易。其中，客户端可以为用户终端上的应用程序(Application，APP)、分布式应用程序(Decentralized Application，DAPP)、浏览器等。区块链网络中的区块链节点则会记录该账户对应的交易日志。其中，每条交易日志可以包括多个目标属性，目标属性可以为交易时间、互联网协议(Internet Protocol，IP)地址、交易状态或交易金额，也可以为其他属性，本说明书实施例不作限定。本说明书以目标属性为交易时间、IP地址、交易状态或交易金额为例进行介绍，其他情况与之类似。
本说明书实施例提供了一种异常账户的检测方法，该方法应用于区块链网络中的区块链节点，如图2所示，处理过程如下：
步骤201，当达到预设的采样周期时，根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块。
在实施例中，区块链节点中可以预先存储有采样周期和时间范围。该采样周期和时间范围可以由技术人员根据经验进行设定。当某一账户通过区块链节点上运行的交易 平台发起与其他账户的交易时，区块链节点可以将该交易打包到区块，并基于各个节点之间的共识算法将区块添加到区块链中。此外，区块链节点还可以将各个账户发起的交易的交易状况或交易信息通过日志的形式进行记录，从而生成交易日志。例如，交易日志中可以记录各个交易发起的时间、发起的账户、交易是否成功、交易的类型、交易的金额，等等。其中，区块链节点可以根据一笔交易生成一条交易日志，也可以根据连续的多笔交易记录生成一条交易日志，本说明书实施例不作限定。之后，区块链节点可以将各个账户对应的交易日志存储在本地数据库中，还可以将交易日志以区块的形式存储至区块链上。如本领域技术人员所示，当将区块添加到区块链上时，会根据添加时刻生成该区块对应的时间戳。当区块链节点需要检测某一账户(即目标账户)是否为异常账户时，区块链节点可以根据预设的采样周期，周期性的从区块链中获取区块的时间戳属于预设时间范围(比如一周或者一个月或者一年)的区块(即目标区块)，以便从中读取对应时间范围的交易日志。
步骤202，从目标区块包含的交易日志中获取目标账户对应的交易日志集合。
其中，交易日志集合中包括与目标账户发起的多笔交易相关的多条交易日志，每条交易日志具有多个目标属性，目标属性为交易时间、IP地址、交易状态或交易金额。
在实施中，区块链节点得到目标区块后，可以进一步从目标区块包含的交易日志中获取发起方(from)字段为目标账户的交易日志，组成目标账户对应的交易日志集合。其中，该交易集合中包括由该目标账户发起的多条交易的日志内容；该交易日志集合中的每条交易日志可以包括多个目标属性；该目标属性可以为交易时间、IP地址、交易状态或交易金额，还可以为其他属性，本说明实施例不作限定。表一为区块链节点获取到的账户1对应的交易日志集合。
表一
序号 账户 交易时间 IP地址 交易金额 交易状态
交易1 账户1 2019.1.12 15:30:10 10.0.0.1 500 交易成功
交易2 账户1 2019.1.12 15:30:45 10.0.0.1 1000 交易失败
交易3 账户1 2019.1.12 15:32:05 10.0.0.1 100 交易成功
交易4 账户1 2019.1.12 15:35:30 20.0.0.1 3000 交易失败
交易5 账户1 2019.1.12 15:36:01 20.0.0.1 5000 交易失败
交易6 账户1 2019.1.12 15:40:00 20.0.0.1 8000 交易失败
步骤203，针对交易日志集合中的每个目标属性，至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定交易日志集合中该目标属性的风险分数。
在实施中，区块链节点中可以预先存储有各目标属性对应的异常条件。其中，各目标属性对应的异常条件可以由技术人员根据经验进行设定。区块链节点得到目标账户对应的交易日志集合后，针对交易日志集合中的每个目标属性，区块链节点可以根据各条交易日志中该目标属性的属性值与该目标属性对应的异常条件，确定交易日志集合中该目标属性的风险分数。其中，区块链节点确定交易日志集合中该目标属性的风险分数的方式可以是多种多样的，本说明书实施例提供了两种可行的方式进行介绍，具体如下：
方式一，多个目标属性包括第一属性，如果各条交易日志中第一属性的属性值满足针对第一属性预设的第一异常条件，则区块链节点将针对第一属性的风险分数确定为针对第一属性预设的第一分数。其中，第一分数指示出第一属性为异常属性。如果各条交易日志中第一属性的属性值不满足第一异常条件，则区块链节点将针对第一属性的风险分数确定为0。
在实施中，区块链节点中可以预先存储有目标属性和分数的对应关系。其中，目标属性和分数的对应关系可以由技术人员根据经验进行设定。表二为区块链节点中存储的目标属性和分数的对应关系。
表二
序号 目标属性 分数
1 交易时间 30
2 IP地址 10
3 交易状态 40
4 交易金额 20
以目标属性为第一属性为例，区块链节点得到目标账户对应的交易日志集合后，区块链节点可以判断各条交易日志中该第一属性的属性值是否满足该第一属性对应的异常条件。如果该第一属性的属性值满足该第一属性对应的异常条件，则区块链节点可以确定该第一属性为异常属性，并将该第一属性的风险分数确定为第一属性对应的第一分数。如果该第一属性的属性值不满足该第一属性对应的异常条件，则区块链节点可以确定该第一属性为正常属性，并将该第一属性的风险分数确定为0。其中，对于不同的目标属性，目标属性对应的异常条件也不相同，本说明书实施例提供了几种判断目标属 性是否为异常属性，并确定目标属性的风险分数的示例，具体如下：
示例一，第一属性为交易时间，区块链节点判断第一属性是否为异常属性，并确定第一属性的风险分数的过程如下：
步骤一，根据各条交易日志中记录的交易时间，确定交易日志集合中相邻的交易的时间间隔。
在实施中，区块链节点可以根据各条交易日志中的交易时间，确定交易日志集合中相邻的交易的交易时间的时间间隔。
例如，如表一所示，交易日志1和交易日志2的交易时间的时间间隔为35秒，交易日志2和交易日志3的交易时间的时间间隔为1分20秒，交易日志3和交易日志4的交易时间的时间间隔为3分25秒，交易日志4和交易日志5的交易时间的时间间隔为31秒，交易日志5和交易日志6的交易时间的时间间隔为3分59秒。
步骤二，如果交易日志集合中存在第一预设数目个小于预设的第一预设时长的时间间隔，则将针对交易时间的风险分数确定为针对交易时间预设的第一分数。
在实施中，区块链节点中可以预先存储有第一预设数目和第一预设时长。其中，该第一预设数目和该第一预设时长可以由技术人员根据经验进行设定。区块链节点得到交易日志集合中相邻的交易日志的交易时间的时间间隔后，可以进一步判断该交易日志集合中是否存在第一预设数目个小于预设的第一预设时长的时间间隔。如果该交易日志集合中存在第一预设数目个小于预设的第一预设时长的时间间隔，则说明该目标账户可能被黑客窃取，并进行频繁的交易，区块链节点可以确定交易时间为异常属性，并将该交易时间的风险分数确定为交易时间对应的第一分数。如果该交易日志集合中不存在第一预设数目个小于预设的第一预设时长的时间间隔，则说明该交易时间正常，区块链节点可以确定交易时间为正常属性，并将该交易时间的风险分数确定为0。
例如，第一预设时长为1分钟，第一预设数目为2，如表一、表二所示，交易日志1和交易日志2的交易时间的时间间隔(35秒)小于第一预设时长(1分钟)，交易日志4和交易日志5的交易时间的时间间隔(31秒)小于第一预设时长(1分钟)，小于预设的第一预设时长的时间间隔的数目为2，则区块链节点可以确定交易时间为异常属性，并将交易时间的风险分数确定为30。
示例二，第一属性为IP地址，区块链节点判断第一属性是否为异常属性，并确定第一属性的风险分数的过程为：如果交易日志集合中存在相邻的交易日志的交易时间的 时间间隔小于第二预设时长，且IP地址不相同，则将针对IP地址的风险分数确定为针对IP地址预设的第一分数。
在实施中，区块链节点中可以预先存储有第二预设时长。其中，该第二预设时长可以由技术人员根据经验进行设定。区块链节点可以判断交易日志集合中是否存在相邻的交易日志的交易时间的时间间隔小于第二预设时长，且IP地址不相同。如果交易日志集合中存在相邻的交易日志的交易时间的时间间隔小于第二预设时长，且IP地址不相同，则说明该目标账户可能被黑客窃取，且在异地登录该目标账户进行交易，区块链节点可以确定IP地址为异常属性，并将该IP地址的风险分数确定为IP地址对应的第一分数。如果交易日志集合中不存在相邻的交易日志的交易时间的时间间隔小于第二预设时长，且IP地址不相同，则说明IP地址正常，区块链节点可以确定IP地址为正常属性，并将该IP地址的风险分数确定为0。
例如，第二预设时长为5分钟，如表一、表二所示，交易日志3和交易日志4的交易时间的时间间隔(3分25秒)小于第二预设时长(5分钟)，且交易日志3的IP地址(10.0.0.1)与交易日志4的IP地址(20.0.0.1)不相同，则区块链节点可以确定IP地址为异常属性，并将该IP地址的风险分数确定为10。
示例三，第一属性为交易状态，区块链节点判断第一属性是否为异常属性，并确定第一属性的风险分数的过程为：如果交易日志集合中存在连续的第二预设数目个交易日志的交易状态为交易失败，则将针对交易状态的风险分数确定为针对交易状态预设的第一分数。
在实施中，区块链节点中可以预先存储有第二预设数目。其中，该第二预设数目可以由技术人员根据经验进行设定。区块链节点可以判断交易日志集合中是否存在连续的第二预设数目个交易日志的交易状态为交易失败。如果交易日志集合中存在连续的第二预设数目个交易日志的交易状态为交易失败，则说明目标账户可能被黑客窃取，并进行密钥尝试，区块链节点可以确定交易状态为异常属性，并将该交易状态的风险分数确定为交易状态对应的第一分数。如果交易日志集合中不存在连续的第二预设数目个交易日志的交易状态为交易失败，则说明交易状态正常，区块链节点可以确定交易状态为正常属性，并将该交易状态的风险分数确定为0。
例如，第二预设数目为3，如表一、表二所示，交易3、交易4和交易5的交易状态均为交易失败，则区块链节点可以确定交易状态为异常属性，并将该交易状态的风险 分数确定为40。
示例四，第一属性为交易金额，区块链节点判断目标属性是否为异常属性，并确定第一属性的风险分数的过程为：如果交易日志集合中存在交易金额大于预设的交易金额阈值的交易日志，则将针对交易金额的风险分数确定为针对交易金额预设的第一分数。
在实施中，区块链节点中可以预先存储有交易金额阈值。其中，该交易金额阈值可以由技术人员根据经验进行设定。区块链节点可以判断交易日志集合中是否存在交易金额大于预设的交易金额阈值的交易日志。如果交易日志集合中存在交易金额大于预设的交易金额阈值的交易日志，则说明该目标账户被黑客窃取，并进行大额交易，区块链节点可以确定交易金额为异常属性，并将该交易金额的风险分数确定为交易金额对应的第一分数。如果交易日志集合中不存在交易金额大于预设的交易金额阈值的交易日志，则说明交易金额正常，区块链节点可以确定交易金额为正常属性，并将该交易金额的风险分数确定为0。
例如，交易金额阈值为3000，如表一、表二所示，交易5的交易金额(5000)和交易6的交易金额(8000)均大于交易金额阈值(3000)，则区块链节点可以确定交易金额为异常属性，并将该交易金额的风险分数确定为20。
方式二，多个目标属性包括第二属性，区块链节点可以确定各条交易日志中第二属性的属性值满足针对第二属性预设的第二异常条件的交易日志的数目占交易日志集合中总交易日志数目的比例，并根据比例，确定第二属性的风险分数。
在实施中，以目标属性为第二属性为例，区块链节点得到目标账户对应的交易日志集合后，针对每条交易日志中的第二属性，区块链节点可以判断该交易日志中第二属性的属性值是否满足该第二属性对应的第二异常条件。如果该交易日志中第二属性的属性值满足该第二属性对应的第二异常条件，则区块链节点可以确定该交易日志为目标交易日志。然后，区块链节点可以统计目标交易日志的数目。区块链节点得到目标交易日志的数目后，可以进一步确定目标交易日志的数目占交易日志集合中总交易日志数目的比例，并根据比例，确定第二属性的风险分数。其中，对于不同的目标属性，目标属性对应的异常条件也不相同，本说明书实施例提供了几种确定目标属性的风险分数的示例，具体如下：
示例一，第二属性为交易状态，区块链节点确定第二属性的风险分数的过程为：确定各条交易日志中交易状态为交易失败的交易日志的数目占交易日志集合中总交易 日志数目的比例，并将针对交易状态的风险分数确定为针对交易状态预设的第二分数与比例的乘积。
在实施中，区块链节点得到目标账户对应的交易日志集合后，可以确定各条交易日志中交易状态为交易失败的交易日志的数目占交易日志集合中总交易日志数目的比例。然后，区块链节点可以将交易状态的风险分数确定为交易状态对应第二分数与该比例的乘积。
例如，如表一、表二所示，交易3、交易4和交易5的交易状态均为交易失败，则交易状态为交易失败的交易日志的数目占交易日志集合中总交易日志数目的比例为3/6＝0.5，交易状态的风险分数为40*0.5＝20。
示例二，第二属性为交易金额，区块链节点确定第二属性的风险分数的过程为：确定各条交易日志中交易金额大于预设的交易金额阈值的交易日志的数目占交易日志集合中总交易日志数目的比例，并将针对交易金额的风险分数确定为比例。
在实施中，区块链节点中可以预先存储有交易金额阈值。其中，该交易金额阈值可以由技术人员根据经验进行设定。区块链节点得到目标账户对应的交易日志集合后，可以确定各条交易日志中交易金额大于预设的交易金额阈值的交易日志的数目占交易日志集合中总交易日志数目的比例，并将交易金额的风险分数确定为比例。
例如，交易金额阈值为3000，如表一所示，交易5的交易金额(5000)和交易6的交易金额(8000)均大于交易金额阈值(3000)，则交易金额大于预设的交易金额阈值的交易日志的数目占交易日志集合中总交易日志数目的比例为2/6＝0.33，也即该交易金额的风险分数为0.33。
可选的，预设的交易金额阈值可以根据交易日志集合中各交易日志的交易金额的平均值确定。
在实施中，区块链节点中可以预先存储有预设系数。其中，该预设系数可以由技术人员根据经验进行设定。区块链节点可以确定交易日志集合中各交易日志的交易金额的平均值与预设系数的乘积，作为交易金额阈值。
例如，预设系数为1.2，如表一所示，交易金额阈值为：
(500+1000+100+3000+5000+8000)/6*1.2＝3520。
步骤204，根据交易日志集合中各目标属性的风险分数，确定交易日志集合的风险 总分。
在实施中，区块链节点确定出各目标属性的风险分数后，可以进一步计算各目标属性的风险分数的和值，并将该和值作为交易日志集合的风险总分。
例如，交易时间的风险分数为0，IP地址的风险分数为10，交易状态的风险分数为40，交易金额的风险分数为20，则交易日志集合的风险总分为0+10+40+20＝70。
可选的，区块链节点可以根据针对各目标属性预设的权重系数，对各目标属性的风险分数加权求和，得到交易日志集合的风险总分。
在实施中，区块链节点中可以预先存储有目标属性与权重系数的对应关系。其中，目标属性与权重系数的对应关系可以由技术人员根据经验进行设定。表三为区块链节点中存储的目标属性和权重系数的对应关系。
表三
序号 目标属性 权重系数
1 交易时间 0.3
2 IP地址 0.1
3 交易状态 0.4
4 交易金额 0.2
区块链节点确定出各目标属性的风险分数后，可以对各目标属性的风险分数加权求和，得到交易日志集合的风险总分。
例如，交易时间的风险分数为0，IP地址的风险分数为10，交易状态的风险分数为40，交易金额的风险分数为20，如表三所示，则交易日志集合的风险总分为0*0.3+10*0.1+40*0.4+20*0.2＝21。
步骤205，如果风险总分大于预设分值阈值，则确定目标账户为异常账户。
在实施中，区块链节点中可以预先存储有分值阈值。其中，该分值阈值可以由技术人员根据经验进行设定。区块链节点得到交易日志集合的风险总分后，可以进一步判断该风险总分是否大于或等于预设分值阈值。如果该风险总分大于或等于预设分值阈值，则说明该账户被黑客窃取，区块链节点可以确定目标账户为异常账户。如果该风险总分小于预设分值阈值，则说明该账户正常，区块链节点可以确定目标账户为正常账户。
例如，预设分值阈值为60，交易日志集合的风险总分为70，则该风险总分(70) 大于预设分值阈值(60)，则区块链节点可以确定目标账户为异常账户。
可选的，区块链节点确定目标账户为异常账户之后，还可以当检测到目标账户登录时，向登录目标账户的用户终端发送告警信息。
在实施中，区块链节点确定目标账户为异常账户之后，可以在检测到目标账户登录时，向登录目标账户的用户终端发送告警信息，以提醒用户该目标账户存在被黑客窃取的风险。可选的，区块链节点也可以向该目标账户绑定的手机号发送短信提醒用户，也可以向该目标账户绑定的邮箱发送邮件提醒用户，还可以采用其他方式提醒用户，本说明书实施例不作限定。
通过本说明书实施例提供了一种异常账户的检测方法。首先，当达到预设的采样周期时，区块链节点根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块，并从目标区块包含的交易日志中获取目标账户对应的交易日志集合。其中，交易日志集合中包括由目标账户发起的多条交易日志，每条交易日志具有多个目标属性，目标属性为交易时间、互联网协议IP地址、交易状态或交易金额。然后，针对交易日志集合中的每个目标属性，区块链节点至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定交易日志集合中该目标属性的风险分数。之后，区块链节点根据交易日志集合中各目标属性的风险分数，确定交易日志集合的风险总分，如果风险总分大于预设分值阈值，则区块链节点确定目标账户为异常账户。这样，区块链节点通过对目标账户的交易日志集合中的交易日志进行分析，可以检测目标账户是否为异常账户。
基于相同的技术构思，如图3所示，本说明书实施例还提供了一种异常账户的检测装置，该装置应用于区块链网络中的区块链节点，该装置包括：
第一获取模块310，用于当达到预设的采样周期时，根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块；
第二获取模块320，用于从所述目标区块包含的交易日志中获取目标账户对应的交易日志集合，交易日志集合中包括由目标账户发起的多条交易日志，每条交易日志具有多个目标属性，目标属性为交易时间、互联网协议IP地址、交易状态或交易金额；
第一确定模块330，用于针对交易日志集合中的每个目标属性，至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定交易日志集合中该目标属性的风险分数；
第二确定模块340，用于根据交易日志集合中各目标属性的风险分数，确定交易日志集合的风险总分；
第三确定模块350，用于如果风险总分大于预设分值阈值，则确定目标账户为异常账户。
可选的，多个目标属性包括第一属性，第一确定模块330，具体用于：
如果各条交易日志中第一属性的属性值满足针对第一属性预设的第一异常条件，则将针对第一属性的风险分数确定为针对第一属性预设的第一分数，第一分数指示出第一属性为异常属性；
如果各条交易日志中第一属性的属性值不满足第一异常条件，则将针对第一属性的风险分数确定为0。
可选的，多个目标属性包括第二属性，第一确定模块330，具体用于：
确定各条交易日志中第二属性的属性值满足针对第二属性预设的第二异常条件的交易日志的数目占交易日志集合中总交易日志数目的比例，并根据比例，确定第二属性的风险分数。
可选的，第一属性为交易时间，第一确定模块330，具体用于：
根据各条交易日志的交易时间，确定交易日志集合中相邻的交易日志的时间间隔；
如果交易日志集合中存在第一预设数目个小于预设的第一预设时长的时间间隔，则将针对交易时间的风险分数确定为针对交易时间预设的第一分数。
可选的，第一属性为IP地址，第一确定模块330，具体用于：
如果交易日志集合中存在相邻的交易日志的交易时间的时间间隔小于第二预设时长，且IP地址不相同，则将针对IP地址的风险分数确定为针对IP地址预设的第一分数。
可选的，第一属性为交易状态，第一确定模块330，具体用于：
如果交易日志集合中存在连续的第二预设数目个交易日志的交易状态为交易失败，则将针对交易状态的风险分数确定为针对交易状态预设的第一分数。
可选的，第一属性为交易金额，第一确定模块330，具体用于：
如果交易日志集合中存在交易金额大于预设的交易金额阈值的交易日志，则将针对交易金额的风险分数确定为针对交易金额预设的第一分数。
可选的，第二属性为交易状态，第一确定模块330，具体用于：
确定各条交易日志中交易状态为交易失败的交易日志的数目占交易日志集合中总交易日志数目的比例，并将针对交易状态的风险分数确定为针对交易状态预设的第二分数与比例的乘积。
可选的，第二属性为交易金额，第一确定模块330，具体用于：
确定各条交易日志中交易金额大于预设的交易金额阈值的交易日志的数目占交易日志集合中总交易日志数目的比例，并将针对交易金额的风险分数确定为比例。
可选的，预设的交易金额阈值根据交易日志集合中各交易日志的交易金额的平均值确定。
可选的，第二确定模块340，具体用于：
根据针对各目标属性预设的权重系数，对各目标属性的风险分数加权求和，得到交易日志集合的风险总分。
可选的，如图4所示，该装置还包括：
发送模块360，用于当检测到目标账户登录时，向登录目标账户的用户终端发送告警信息。
通过本说明书实施例提供了一种异常账户的检测装置。首先，当达到预设的采样周期时，区块链节点根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块，并从目标区块包含的交易日志中获取目标账户对应的交易日志集合。其中，交易日志集合中包括由目标账户发起的多条交易日志，每条交易日志具有多个目标属性，目标属性为交易时间、互联网协议IP地址、交易状态或交易金额。然后，针对交易日志集合中的每个目标属性，区块链节点至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定交易日志集合中该目标属性的风险分数。之后，区块链节点根据交易日志集合中各目标属性的风险分数，确定交易日志集合的风险总分，如果风险总分大于预设分值阈值，则区块链节点确定目标账户为异常账户。这样，区块链节点通过对目标账户的交易日志集合中的交易日志进行分析，可以检测目标账户是否为异常账户。
基于相同的技术构思，本说明书实施例还提供了一种区块链节点，包括存储器和处理器，存储器中存储有可执行代码，处理器执行可执行代码时，实现上述区块链节点 执行的方法。
基于相同的技术构思，本说明书实施例还提供了一种计算机可读存储介质，其上存储有计算机程序，当计算机程序在计算机中执行时，令计算机执行上述区块链节点执行的方法。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请的保护范围之内。

Claims (26)

  1. 一种异常账户的检测方法，其中，所述方法应用于区块链网络中的区块链节点，所述方法包括：
    当达到预设的采样周期时，根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块；
    从所述目标区块包含的交易日志中获取目标账户对应的交易日志集合，所述交易日志集合中包括与所述目标账户发起的多笔交易相关的多条交易日志，每条交易日志具有多个目标属性，所述目标属性为交易时间、互联网协议IP地址、交易状态或交易金额；
    针对所述交易日志集合中的每个目标属性，至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定所述交易日志集合中该目标属性的风险分数；
    根据所述交易日志集合中各目标属性的风险分数，确定所述交易日志集合的风险总分；
    如果所述风险总分大于预设分值阈值，则确定所述目标账户为异常账户。
  2. 根据权利要求1所述的方法，其中，所述多个目标属性包括第一属性，所述至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定所述交易日志集合中该目标属性的风险分数，包括：
    如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，所述第一分数指示出所述第一属性为异常属性；
    如果所述各条交易日志中所述第一属性的属性值不满足所述第一异常条件，则将针对所述第一属性的风险分数确定为0。
  3. 根据权利要求1所述的方法，其中，所述多个目标属性包括第二属性，所述至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定所述交易日志集合中该目标属性的风险分数，包括：
    确定所述各条交易日志中所述第二属性的属性值满足针对所述第二属性预设的第二异常条件的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并根据所述比例，确定所述第二属性的风险分数。
  4. 根据权利要求2所述的方法，其中，所述第一属性为交易时间，所述如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，包括：
    根据所述各条交易日志的交易时间，确定所述交易日志集合中相邻的交易日志的时间间隔；
    如果所述交易日志集合中存在第一预设数目个小于预设的第一预设时长的时间间隔，则将针对交易时间的风险分数确定为针对所述交易时间预设的第一分数。
  5. 根据权利要求2所述的方法，其中，所述第一属性为IP地址，所述如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，包括：
    如果所述交易日志集合中存在相邻的交易日志的交易时间的时间间隔小于第二预设时长，且IP地址不相同，则将针对所述IP地址的风险分数确定为针对所述IP地址预设的第一分数。
  6. 根据权利要求2所述的方法，其中，所述第一属性为交易状态，所述如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，包括：
    如果所述交易日志集合中存在连续的第二预设数目个交易日志的交易状态为交易失败，则将针对所述交易状态的风险分数确定为针对所述交易状态预设的第一分数。
  7. 根据权利要求2所述的方法，其中，所述第一属性为交易金额，所述如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分数，包括：
    如果所述交易日志集合中存在交易金额大于预设的交易金额阈值的交易日志，则将针对所述交易金额的风险分数确定为针对所述交易金额预设的第一分数。
  8. 根据权利要求3所述的方法，其中，所述第二属性为交易状态，所述确定所述各条交易日志中所述第二属性的属性值满足针对所述第二属性预设的第二异常条件的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并根据所述比例，确定所述第二属性的风险分数，包括：
    确定所述各条交易日志中所述交易状态为交易失败的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并将针对所述交易状态的风险分数确定为针对所述交易状态预设的第二分数与所述比例的乘积。
  9. 根据权利要求3所述的方法，其中，所述第二属性为交易金额，所述确定所述各条交易日志中所述第二属性的属性值满足针对所述第二属性预设的第二异常条件的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并根据所述比例，确定所述第二属性的风险分数，包括：
    确定所述各条交易日志中所述交易金额大于预设的交易金额阈值的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并将针对所述交易金额的风险分数确定为所述比例。
  10. 根据权利要求7或9所述的方法，其中，所述预设的交易金额阈值根据所述交易日志集合中各交易日志的交易金额的平均值确定。
  11. 根据权利要求1所述的方法，其中，所述根据所述交易日志集合中各目标属性的风险分数，确定所述交易日志集合的风险总分，包括：
    根据针对各目标属性预设的权重系数，对所述各目标属性的风险分数加权求和，得到所述交易日志集合的风险总分。
  12. 根据权利要求1所述的方法，其中，所述确定目标账户为异常账户之后，所述方法还包括：
    当检测到所述目标账户登录时，向登录所述目标账户的用户终端发送告警信息。
  13. 一种异常账户的检测装置，其中，所述装置应用于区块链网络中的区块链节点，所述装置包括：
    第一获取模块，用于当达到预设的采样周期时，根据区块链中各区块的时间戳，获取时间戳属于预设时间范围的目标区块；
    第二获取模块，用于从所述目标区块包含的交易日志中获取目标账户对应的交易日志集合，所述交易日志集合中包括与所述目标账户发起的多笔交易相关的多条交易日志，每条交易日志具有多个目标属性，所述目标属性为交易时间、互联网协议IP地址、交易状态或交易金额；
    第一确定模块，用于针对所述交易日志集合中的每个目标属性，至少根据各条交易日志中该目标属性的属性值与针对该目标属性预设的异常条件，确定所述交易日志集合中该目标属性的风险分数；
    第二确定模块，用于根据所述交易日志集合中各目标属性的风险分数，确定所述交易日志集合的风险总分；
    第三确定模块，用于如果所述风险总分大于预设分值阈值，则确定所述目标账户为异常账户。
  14. 根据权利要求13所述的装置，其中，所述多个目标属性包括第一属性，所述第一确定模块，具体用于：
    如果所述各条交易日志中所述第一属性的属性值满足针对所述第一属性预设的第一异常条件，则将针对所述第一属性的风险分数确定为针对所述第一属性预设的第一分 数，所述第一分数指示出所述第一属性为异常属性；
    如果所述各条交易日志中所述第一属性的属性值不满足所述第一异常条件，则将针对所述第一属性的风险分数确定为0。
  15. 根据权利要求13所述的装置，其中，所述多个目标属性包括第二属性，所述第一确定模块，具体用于：
    确定所述各条交易日志中所述第二属性的属性值满足针对所述第二属性预设的第二异常条件的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并根据所述比例，确定所述第二属性的风险分数。
  16. 根据权利要求14所述的装置，其中，所述第一属性为交易时间，所述第一确定模块，具体用于：
    根据所述各条交易日志的交易时间，确定所述交易日志集合中相邻的交易日志的时间间隔；
    如果所述交易日志集合中存在第一预设数目个小于预设的第一预设时长的时间间隔，则将针对交易时间的风险分数确定为针对所述交易时间预设的第一分数。
  17. 根据权利要求14所述的装置，其中，所述第一属性为IP地址，所述第一确定模块，具体用于：
    如果所述交易日志集合中存在相邻的交易日志的交易时间的时间间隔小于第二预设时长，且IP地址不相同，则将针对所述IP地址的风险分数确定为针对所述IP地址预设的第一分数。
  18. 根据权利要求14所述的装置，其中，所述第一属性为交易状态，所述第一确定模块，具体用于：
    如果所述交易日志集合中存在连续的第二预设数目个交易日志的交易状态为交易失败，则将针对所述交易状态的风险分数确定为针对所述交易状态预设的第一分数。
  19. 根据权利要求14所述的装置，其中，所述第一属性为交易金额，所述第一确定模块，具体用于：
    如果所述交易日志集合中存在交易金额大于预设的交易金额阈值的交易日志，则将针对所述交易金额的风险分数确定为针对所述交易金额预设的第一分数。
  20. 根据权利要求15所述的装置，其中，所述第二属性为交易状态，所述第一确定模块，具体用于：
    确定所述各条交易日志中所述交易状态为交易失败的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并将针对所述交易状态的风险分数确定为针对所述 交易状态预设的第二分数与所述比例的乘积。
  21. 根据权利要求15所述的装置，其中，所述第二属性为交易金额，所述第一确定模块，具体用于：
    确定所述各条交易日志中所述交易金额大于预设的交易金额阈值的交易日志的数目占所述交易日志集合中总交易日志数目的比例，并将针对所述交易金额的风险分数确定为所述比例。
  22. 根据权利要求19或21所述的装置，其中，所述预设的交易金额阈值根据所述交易日志集合中各交易日志的交易金额的平均值确定。
  23. 根据权利要求13所述的装置，其中，所述第二确定模块，具体用于：
    根据针对各目标属性预设的权重系数，对所述各目标属性的风险分数加权求和，得到所述交易日志集合的风险总分。
  24. 根据权利要求13所述的装置，其中，所述装置还包括：
    发送模块，用于当检测到所述目标账户登录时，向登录所述目标账户的用户终端发送告警信息。
  25. 一种区块链节点，包括存储器和处理器，其中，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现权利要求1-12中任一项的所述的方法。
  26. 一种计算机可读存储介质，其上存储有计算机程序，其中，当所述计算机程序在计算机中执行时，令计算机执行权利要求1-12中任一项的所述的方法。
PCT/CN2020/082440 2019-06-12 2020-03-31 一种异常账户的检测方法及装置 Ceased WO2020248658A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910507875.3A CN110414985A (zh) 2019-06-12 2019-06-12 一种异常账户的检测方法及装置
CN201910507875.3 2019-06-12

Publications (1)

Publication Number Publication Date
WO2020248658A1 true WO2020248658A1 (zh) 2020-12-17

Family

ID=68358970

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/082440 Ceased WO2020248658A1 (zh) 2019-06-12 2020-03-31 一种异常账户的检测方法及装置

Country Status (3)

Country Link
CN (1) CN110414985A (zh)
TW (1) TW202046206A (zh)
WO (1) WO2020248658A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113886343A (zh) * 2021-09-29 2022-01-04 未鲲(上海)科技服务有限公司 交易数据异常监控方法、系统、设备及介质
US20230196370A1 (en) * 2021-12-20 2023-06-22 Accenture Global Solutions Limited Artificial intelligence (ai) based transaction data processing and reconciliation

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110414985A (zh) * 2019-06-12 2019-11-05 阿里巴巴集团控股有限公司 一种异常账户的检测方法及装置
CN111275348A (zh) * 2020-02-05 2020-06-12 张�浩 电子订单信息处理方法、服务器及电子订单信息处理系统
CN111506895A (zh) * 2020-04-17 2020-08-07 支付宝(杭州)信息技术有限公司 一种应用登录图的构建方法及装置
CN111667267B (zh) * 2020-05-29 2023-04-18 中国工商银行股份有限公司 一种区块链交易风险识别方法及装置
JP2021196792A (ja) * 2020-06-12 2021-12-27 富士通株式会社 検出プログラム、検出方法および検出装置
CN112907263B (zh) * 2021-03-22 2022-01-18 北京太火红鸟科技有限公司 异常订单量检测方法、装置、设备及存储介质
CN114187001A (zh) * 2021-12-13 2022-03-15 北京航空航天大学杭州创新研究院 跨链节点的风险管理方法
CN116611829B (zh) * 2023-07-21 2023-11-14 山东美丽乡村云计算有限公司 一种基于区块链的消费监管系统
CN117745288B (zh) * 2024-02-20 2024-05-14 中国信息通信研究院 区块链交易数据的可视化方法和装置、设备和介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106327220A (zh) * 2016-08-31 2017-01-11 无锡雅座在线科技发展有限公司 异常账户的确定方法和装置
CN107230084A (zh) * 2017-05-03 2017-10-03 同济大学 一种基于大数据的用户行为认证方法及系统
CN108122114A (zh) * 2017-12-25 2018-06-05 同济大学 针对异常重复交易欺诈检测方法、系统、介质及设备
CN108985553A (zh) * 2018-06-05 2018-12-11 中国平安人寿保险股份有限公司 一种异常用户的识别方法及设备
WO2019072300A2 (en) * 2018-12-21 2019-04-18 Alibaba Group Holding Limited BLOCK CHAIN DATA PROTECTION BASED ON A GENERIC ACCOUNT MODEL AND A HOMOMORPHIC ENCRYPTION
CN109872151A (zh) * 2017-12-04 2019-06-11 万事达卡国际公司 用于对匿名交易进行风险评分的方法和系统
CN110414985A (zh) * 2019-06-12 2019-11-05 阿里巴巴集团控股有限公司 一种异常账户的检测方法及装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104751566B (zh) * 2013-12-30 2018-11-27 中国银联股份有限公司 监测伪卡风险的方法和实现该方法的交易处理系统
CN106295349B (zh) * 2015-05-29 2020-06-05 阿里巴巴集团控股有限公司 账号被盗的风险识别方法、识别装置及防控系统
CN108133373A (zh) * 2018-01-04 2018-06-08 交通银行股份有限公司 探寻涉机器行为的风险账户的方法及装置
CN108876102B (zh) * 2018-05-04 2023-08-22 创新先进技术有限公司 一种风险交易挖掘方法、装置及设备
CN109151518B (zh) * 2018-08-06 2021-02-02 武汉斗鱼网络科技有限公司 一种被盗账号的识别方法、装置及电子设备

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106327220A (zh) * 2016-08-31 2017-01-11 无锡雅座在线科技发展有限公司 异常账户的确定方法和装置
CN107230084A (zh) * 2017-05-03 2017-10-03 同济大学 一种基于大数据的用户行为认证方法及系统
CN109872151A (zh) * 2017-12-04 2019-06-11 万事达卡国际公司 用于对匿名交易进行风险评分的方法和系统
CN108122114A (zh) * 2017-12-25 2018-06-05 同济大学 针对异常重复交易欺诈检测方法、系统、介质及设备
CN108985553A (zh) * 2018-06-05 2018-12-11 中国平安人寿保险股份有限公司 一种异常用户的识别方法及设备
WO2019072300A2 (en) * 2018-12-21 2019-04-18 Alibaba Group Holding Limited BLOCK CHAIN DATA PROTECTION BASED ON A GENERIC ACCOUNT MODEL AND A HOMOMORPHIC ENCRYPTION
CN110414985A (zh) * 2019-06-12 2019-11-05 阿里巴巴集团控股有限公司 一种异常账户的检测方法及装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113886343A (zh) * 2021-09-29 2022-01-04 未鲲(上海)科技服务有限公司 交易数据异常监控方法、系统、设备及介质
US20230196370A1 (en) * 2021-12-20 2023-06-22 Accenture Global Solutions Limited Artificial intelligence (ai) based transaction data processing and reconciliation
US12505444B2 (en) * 2021-12-20 2025-12-23 Accenture Global Solutions Limited Artificial intelligence (AI) based transaction data processing and reconciliation

Also Published As

Publication number Publication date
TW202046206A (zh) 2020-12-16
CN110414985A (zh) 2019-11-05

Similar Documents

Publication Publication Date Title
WO2020248658A1 (zh) 一种异常账户的检测方法及装置
JP7199775B2 (ja) スマートコントラクトに基づくデータ処理方法、データ処理装置、ノード機器、及びコンピュータプログラム
US12160446B2 (en) Detection of a malicious entity within a network
EP3797396B1 (en) Blockchain transaction safety
EP3970038B1 (en) Siem system and methods for exfiltrating event data
CN108768943B (zh) 一种检测异常账号的方法、装置及服务器
US10771497B1 (en) Using IP address data to detect malicious activities
EP3516574B1 (en) Enterprise graph method of threat detection
US9462009B1 (en) Detecting risky domains
US20220180368A1 (en) Risk Detection, Assessment, And Mitigation Of Digital Third-Party Fraud
JP2019070912A (ja) セキュリティ評価システムおよびセキュリティ評価方法
US9942255B1 (en) Method and system for detecting abusive behavior in hosted services
CN109698809B (zh) 一种账号异常登录的识别方法及装置
US10599873B2 (en) Method for rate-limiting interactions based on dynamically calculated values by supplying problems of varying difficulty to be solved
WO2017214427A1 (en) Detection and prevention of fraudulent activity on social media accounts
CN112533209A (zh) 黑产识别方法及黑产识别装置
EP3796613A1 (en) Techniques for repeat authentication
WO2020258102A1 (zh) 内容推送方法、装置、移动终端及存储介质
CN110619022B (zh) 基于区块链网络的节点检测方法、装置、设备及存储介质
US11855989B1 (en) System and method for graduated deny list
CN108804501B (zh) 一种检测有效信息的方法及装置
CN110807209B (zh) 一种数据处理方法、设备及存储介质
CN117093627A (zh) 信息挖掘的方法、装置、电子设备和存储介质
CN106713242A (zh) 数据请求的处理方法及处理装置
CN116527389A (zh) 端口扫描检测

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20823066

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20823066

Country of ref document: EP

Kind code of ref document: A1