CN-121980439-A - Abnormal node identification method, electronic equipment and computer program product

CN121980439ACN 121980439 ACN121980439 ACN 121980439ACN-121980439-A

Abstract

The embodiment of the application is suitable for the technical field of network security and provides an abnormal node identification method, electronic equipment and a computer program product, wherein the method comprises the steps of determining transaction data of a plurality of nodes of a blockchain and an initial node group; the method comprises the steps of receiving transaction data, sending the transaction data to a trained graph neural network model to trigger node embedded data output by the graph neural network model based on the transaction data, generating clustering results with different granularities according to the initial node group, the node embedded data and a trained similarity matrix, and generating an anomaly identification result according to the clustering results with different granularities.

Inventors

YANG JIE
SONG JIE
Zheng Tongya
He Runang
FENG ZUNLEI

Assignees

杭州高新区(滨江)区块链与数据安全研究院

Dates

Publication Date: 20260505
Application Date: 20251215

Claims (10)

1. An abnormal node identification method, comprising: determining transaction data of a plurality of nodes of the blockchain and an initial node group; Transmitting the transaction data to a trained graphic neural network model to trigger node embedded data output by the graphic neural network model based on the transaction data; Generating clustering results with different granularities according to the initial node group, the node embedded data and the trained similarity matrix; And generating an abnormal recognition result according to the clustering result of each granularity.
2. The method of claim 1, wherein generating cluster results of different granularities based on the initial node group, the node embedded data, and a trained similarity matrix comprises: Determining clustering constraint conditions corresponding to each granularity based on the initial node group, the node embedded data and the similarity matrix; Clustering is carried out according to the clustering algorithm corresponding to each granularity and the clustering constraint conditions, and a clustering result is generated; the granularity comprises single node granularity, node group granularity and identity category granularity.
3. The method according to claim 2, wherein the method further comprises: Determining a clustering accuracy based on the clustering result; Determining a clustering threshold value in each clustering algorithm under the condition that the clustering accuracy is smaller than an accuracy threshold value; And adjusting the clustering threshold values according to a preset step length.
4. The method of claim 2 or 3, wherein the graph neural network model and the similarity matrix are trained based on a training set, and wherein prior to generating the anomaly identification result from the clustering results at each granularity, the method further comprises: Determining the clustering confidence of each node based on the clustering result; generating a corresponding pseudo label aiming at the nodes with the clustering confidence coefficient larger than a first confidence coefficient threshold value and without labels; determining current iteration information; and returning to the step of transmitting the transaction data to the trained graph neural network model under the condition that the training set is adopted to finish retraining the graph neural network model and the similarity matrix.
5. The method of claim 2, wherein the similarity matrix comprises single-node similarity, wherein the determining cluster constraints corresponding to each granularity based on the initial node group, the node embedded data, and the similarity matrix comprises: Calculating an embedded reconstruction error according to the initial node group and the node embedded data; Adjusting the single-node similarity according to the embedded reconstruction error to generate a first adjustment similarity; generating a clustering threshold corresponding to the single node granularity according to the first adjustment similarity; and determining the clustering threshold corresponding to the single node granularity as a clustering constraint condition of the single node granularity.
6. The method of claim 5, wherein the clustering result corresponding to the single node granularity comprises a first node group, wherein the determining the clustering constraint condition corresponding to each granularity based on the initial node group, the node embedded data and the similarity matrix comprises: determining a second node group based on the k-hop neighborhood nodes of the first node group; determining an attention entropy value of the second node group; Generating a clustering threshold corresponding to the node group granularity according to the attention entropy value and the first clustering constraint condition; And determining a clustering threshold corresponding to the node group granularity as a clustering constraint condition of the node group granularity.
7. The method of claim 6, wherein the similarity matrix further comprises a node group similarity and an identity class similarity, wherein the identity class similarity is determined by the single node similarity and the node group similarity, wherein the clustering result corresponding to the node group granularity comprises a second node group, wherein the determining clustering constraint conditions corresponding to each granularity based on the initial node group, the node embedded data and the similarity matrix comprises: determining a node group density for each second node group; Determining the density limit value of the second node group as a clustering threshold value corresponding to the identity category granularity; adjusting the identity category similarity according to the density of each node group to generate a second adjustment similarity; And determining a clustering threshold corresponding to the identity category granularity, the second adjustment similarity and a preset initial merging threshold as clustering constraint conditions of the identity category granularity.
8. The method of claim 1, wherein the anomaly identification result comprises an aggregated link, the aggregated link generated by: Determining feature data corresponding to each granularity according to the clustering result, wherein the feature data comprises abnormal features, abnormal similarity and abnormal scores; Determining target nodes corresponding to the clustering results; an aggregated link is generated based on the initial node group, the target node, and the characteristic data.
9. An electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, which when executed by the processor causes the electronic device to implement the method of any one of claims 1-8.
10. A computer program product comprising a computer program which, when run, causes the method of any one of claims 1-8 to be performed.

Description

Abnormal node identification method, electronic equipment and computer program product Technical Field The embodiment of the application belongs to the technical field of network security, and particularly relates to an abnormal node identification method, electronic equipment and a computer program product. Background Blockchain technology is a distributed ledger technology that maintains a secure, transparent, non-tamperable data record in a decentralized manner. This technology is widely used in a variety of fields such as finance, supply chain management, intellectual property protection, etc. The digital resource can be digitized, authorized and traded by using the block chain technology. In the transaction process involving digital resources, abnormal transaction behavior may occur, upsetting the normal transaction order of the digital resources, and thus how to identify and process abnormal transactions is important. In some schemes, abnormal transaction data and corresponding account numbers are determined by acquiring transaction data of digital resources, then manually labeling the transaction data, and then clustering and classifying the transaction data based on a clustering algorithm. However, the method has high label dependence and low robustness, is easy to cause the distortion of the clustering result, has low interpretability of the clustering result, and is difficult to further analyze the data. Disclosure of Invention In view of this, the embodiments of the present application provide an abnormal node identification method, an electronic device, and a computer program product, which are used to improve robustness of clustering transaction data, thereby improving accuracy and reliability of abnormal transaction data identification. A first aspect of an embodiment of the present application provides an abnormal node identification method, including: determining transaction data of a plurality of nodes of the blockchain and an initial node group; Transmitting the transaction data to a trained graphic neural network model to trigger node embedded data output by the graphic neural network model based on the transaction data; Generating clustering results with different granularities according to the initial node group, the node embedded data and the trained similarity matrix; And generating an abnormal recognition result according to the clustering result of each granularity. In some implementations of the first aspect, the generating cluster results with different granularities according to the initial node group, the node embedded data, and the trained similarity matrix includes: Determining clustering constraint conditions corresponding to each granularity based on the initial node group, the node embedded data and the similarity matrix; Clustering is carried out according to the clustering algorithm corresponding to each granularity and the clustering constraint conditions, and a clustering result is generated; the granularity comprises single node granularity, node group granularity and identity category granularity. In some implementations of the first aspect, the method further includes: Determining a clustering accuracy based on the clustering result; Determining a clustering threshold value in each clustering algorithm under the condition that the clustering accuracy is smaller than an accuracy threshold value; And adjusting the clustering threshold values according to a preset step length. In some implementations of the first aspect, the graph neural network model and the similarity matrix are trained based on a training set, and before the generating of the anomaly identification result according to the clustering result of each granularity, the method further includes: Determining the clustering confidence of each node based on the clustering result; generating a corresponding pseudo label aiming at the nodes with the clustering confidence coefficient larger than a first confidence coefficient threshold value and without labels; determining current iteration information; and returning to the step of transmitting the transaction data to the trained graph neural network model under the condition that the training set is adopted to finish retraining the graph neural network model and the similarity matrix. In some implementations of the first aspect, the similarity matrix includes a single-node similarity, and the determining, based on the initial node group, the node embedded data, and the similarity matrix, a clustering constraint corresponding to each granularity includes: Calculating an embedded reconstruction error according to the initial node group and the node embedded data; Adjusting the single-node similarity according to the embedded reconstruction error to generate a first adjustment similarity; generating a clustering threshold corresponding to the single node granularity according to the first adjustment similarity; and determining the clustering threshold corresponding