CN109741183A - Information acquisition method and device - Google Patents
Information acquisition method and device Download PDFInfo
- Publication number
- CN109741183A CN109741183A CN201811640283.0A CN201811640283A CN109741183A CN 109741183 A CN109741183 A CN 109741183A CN 201811640283 A CN201811640283 A CN 201811640283A CN 109741183 A CN109741183 A CN 109741183A
- Authority
- CN
- China
- Prior art keywords
- transaction
- address
- exchange
- determining
- network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 35
- 238000010586 diagram Methods 0.000 claims abstract description 35
- RTZKZFJDLAIYFH-UHFFFAOYSA-N Diethyl ether Chemical compound CCOCC RTZKZFJDLAIYFH-UHFFFAOYSA-N 0.000 claims description 42
- 239000003999 initiator Substances 0.000 claims description 12
- 238000004422 calculation algorithm Methods 0.000 claims description 9
- 238000004364 calculation method Methods 0.000 claims description 3
- 238000010276 construction Methods 0.000 claims description 2
- 238000012546 transfer Methods 0.000 description 26
- 238000004891 communication Methods 0.000 description 16
- 238000001514 detection method Methods 0.000 description 10
- 238000004590 computer program Methods 0.000 description 7
- 230000002159 abnormal effect Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000004931 aggregating effect Effects 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000004900 laundering Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the application provides an information acquisition method and device, wherein the method comprises the following steps: the method comprises the steps of obtaining transactions from Ethernet house nodes, determining each transaction of a transaction address, taking the transaction address as a point, taking each obtained and determined transaction as an edge, constructing a transaction network graph, obtaining a triangular relation network meeting preset conditions from the transaction network graph, and determining a transaction place address from the triangular relation network. According to the technical scheme provided by the embodiment of the application, the triangular relation network is obtained by utilizing the constructed transaction network diagram, the address of the exchange is determined from the triangular relation network based on the characteristic that the transaction of the address of the exchange forms the triangular relation, and the determined address of the exchange is monitored.
Description
Technical Field
The present application relates to the field of block chain technologies, and in particular, to an information obtaining method and apparatus.
Background
In a financial transaction system, in order to ensure user fund safety, information safety and the like, transactions in the transaction system can be monitored, the monitoring means can be abnormal transaction detection, anti-fraud, anti-money laundering and other applications, and the applications can achieve the purpose of abnormal transaction identification by analyzing historical transaction behaviors of a user, so that risks can be better controlled, and fund loss is reduced.
At present, the characteristics of open source and decentralization of the block chain and the wide application of the block chain in the financial field, especially the expandability of the Etheng, enable the Etheng to be widely used in the financial field. Due to the decentralized and anonymous nature of the etherhouses, monitoring of transactions in the etherhouses is difficult, especially for transactions addressed to exchanges with large volumes. In order to monitor the exchange address for transactions, the exchange address needs to be found from the ethernet house, however, the addresses where transactions are performed in the ethernet house include various types. Therefore, how to acquire the exchange address from the ethernet house becomes an urgent problem to be solved.
Disclosure of Invention
An object of the embodiments of the present application is to provide an information obtaining method and apparatus, so as to obtain an address of an exchange from an ethernet house. The specific technical scheme is as follows:
in a first aspect, an embodiment of the present application provides an information obtaining method, where the method includes:
acquiring a transaction address from the Etherhouse node, and determining each transaction of the transaction address;
taking the transaction address as a point and each determined transaction as an edge to construct a transaction network graph, wherein each edge in the transaction network graph represents a transaction initiator and a transaction receiver in each transaction by a direction;
and acquiring a triangular relation network meeting preset conditions from the transaction network diagram, wherein the preset conditions are as follows: the three transaction addresses are connected with each other, and the directions of three edges among the three transaction addresses form a closed loop;
determining an exchange address from the triangular relationship network.
Optionally, the determining an exchange address from the triangular relationship network comprises:
acquiring a connected network diagram of the three transaction addresses from the transaction network diagram by utilizing depth-first search;
judging whether connection exists between any two points in each acquired connected network graph;
if yes, determining that the transaction addresses in the connected network graph have correlation;
and determining the transaction address with correlation in the three transaction addresses as the exchange address.
Optionally, the determining an exchange address from the triangular relationship network comprises:
calculating a weight value of each transaction address in the transaction network graph by using a pagerank algorithm, wherein the weight value is used for representing the importance degree of the transaction address;
ranking the transaction addresses in the transaction network graph according to the magnitude sequence of the weight values;
and determining the transaction address ranked at the preset name time in the three transaction addresses as the exchange address.
Optionally, the method further comprises:
acquiring the transaction information of the address of the exchange from the Etherhouse node;
acquiring the transaction quantity of the created contracts and the average number of times of calling each created contract from the acquired transaction information;
and when the transaction number is greater than a preset number threshold value and the average number of times is less than a preset number threshold value, determining that the exchange address is a suspicious address.
Optionally, the method further comprises:
calculating an average amount to which each created contract is transferred based on the acquired transaction information;
when the transaction number is greater than a preset number threshold and the average number of times is less than a preset number threshold, determining that the exchange address is a suspicious address includes:
and when the transaction number is greater than a preset number threshold, the average number of times is less than a preset number threshold, and the average amount of money is less than a preset amount threshold, determining that the address of the exchange is a suspicious address.
In a second aspect, an embodiment of the present application provides an address detection apparatus, where the apparatus includes:
the first acquisition module is used for acquiring a transaction address from the Ether house node and determining each transaction of the transaction address;
the construction module is used for constructing a transaction network graph by taking the transaction address as a point and taking each determined transaction as one edge, wherein each edge in the transaction network graph represents a transaction initiator and a transaction receiver in each transaction by a direction;
a second obtaining module, configured to obtain, from the transaction network map, a trigonometric relationship network that meets a preset condition, where the preset condition is: the three transaction addresses are connected with each other, and the directions of three edges among the three transaction addresses form a closed loop;
a first determination module to determine an exchange address from the triangular relationship network.
Optionally, the first determining module is specifically configured to:
acquiring a connected network diagram of the three transaction addresses from the transaction network diagram by utilizing depth-first search;
judging whether connection exists between any two points in each acquired connected network graph;
if yes, determining that the transaction addresses in the connected network graph have correlation;
and determining the transaction address with correlation in the three transaction addresses as the exchange address.
Optionally, the first determining module is specifically configured to:
calculating a weight value of each transaction address in the transaction network graph by using a pagerank algorithm, wherein the weight value is used for representing the importance degree of the transaction address;
ranking the transaction addresses in the transaction network graph according to the magnitude sequence of the weight values;
and determining the transaction address ranked at the preset name time in the three transaction addresses as the exchange address.
Optionally, the apparatus further comprises:
a third obtaining module, configured to obtain the transaction information of the exchange address from the ethernet house node;
the fourth acquisition module is used for acquiring the transaction quantity of the created contracts and the average number of times of calling each created contract in the acquired transaction information;
and the second determination module is used for determining the exchange address as a suspicious address when the transaction number is greater than a preset number threshold and the average number of times is less than a preset number threshold.
Optionally, the apparatus further comprises:
a calculation module for calculating an average amount of money transferred to each of the created contracts based on the acquired transaction information;
the second determining module is specifically configured to:
and when the transaction number is greater than a preset number threshold, the average number of times is less than a preset number threshold, and the average amount of money is less than a preset amount threshold, determining that the address of the exchange is a suspicious address.
In a third aspect, an embodiment of the present application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, where the processor and the communication interface complete communication between the memory and the processor through the communication bus;
a memory for storing a computer program;
and the processor is used for realizing any one of the steps of the address detection method when executing the program stored in the memory.
In a fourth aspect, the present application provides a machine-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the method implements any one of the steps of the address detection method described above.
In the technical scheme provided by the embodiment of the application, the transaction is obtained from the Etherhouse nodes, each transaction of the transaction address is determined, the transaction address is taken as a point, each obtained and determined transaction is taken as an edge, a transaction network graph is constructed, a triangular relation network meeting preset conditions is obtained from the transaction network graph, and the address of a transaction place is determined from the triangular relation network. According to the technical scheme provided by the embodiment of the application, the triangular relation network is obtained by utilizing the constructed transaction network diagram, the address of the exchange is determined from the triangular relation network based on the characteristic that the transaction of the address of the exchange forms the triangular relation, and the determined address of the exchange is monitored.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 is a flowchart of an address detection method according to an embodiment of the present application;
FIG. 2 is a schematic diagram of a transaction network diagram provided by an embodiment of the present application;
FIG. 3 is another schematic diagram of a transaction network diagram provided by an embodiment of the present application;
fig. 4 is a structural diagram of an address detection apparatus according to an embodiment of the present application;
fig. 5 is a block diagram of an electronic device according to an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
In order to achieve the purpose of acquiring an exchange address from an ether house, an embodiment of the present application provides an information acquisition method and an information acquisition device, where the information acquisition method includes:
acquiring a transaction address from the Ether house node, and determining each transaction of the transaction address;
taking the transaction address as a point and each determined transaction as an edge to construct a transaction network graph, wherein each edge in the transaction network graph represents a transaction initiator and a transaction receiver in each transaction by a direction;
acquiring a triangular relation network meeting preset conditions from a transaction network diagram, wherein the preset conditions are as follows: the three transaction addresses are connected with each other, and the directions of three edges among the three transaction addresses form a closed loop;
the exchange address is determined from the triangular relationship network.
In the technical scheme provided by the embodiment of the application, the transaction is obtained from the Etherhouse nodes, each transaction of the transaction address is determined, the transaction address is taken as a point, each obtained and determined transaction is taken as an edge, a transaction network graph is constructed, a triangular relation network meeting preset conditions is obtained from the transaction network graph, and the address of a transaction place is determined from the triangular relation network. According to the technical scheme provided by the embodiment of the application, the triangular relation network is obtained by utilizing the constructed transaction network diagram, the address of the exchange is determined from the triangular relation network based on the characteristic that the transaction of the address of the exchange forms the triangular relation, and the determined address of the exchange is monitored.
First, an address detection method provided in the embodiment of the present application is described below. An information obtaining method provided in an embodiment of the present application, as shown in fig. 1, includes the following steps.
S101, obtaining a transaction address from the Etherhouse node, and determining each transaction of the transaction address.
The ether house is an open-source public block chain platform, and the ether house is a decentralized platform and comprises a plurality of ether house nodes, wherein the ether house nodes can be clients. The Ethernet lane nodes can carry out transaction, and the Ethernet lane nodes can carry out information synchronization, wherein the synchronized information comprises information such as transaction address, time, amount and the like of the transaction. That is, each ethernet house node has transaction information stored therein that a transaction has occurred in the ethernet house platform.
For example, the ether house includes an ether house node a, an ether house node b and an ether house node c, where the transfer transaction 1 occurs at the ether house node a, and the contract creation 1 occurs at the ether house node b, and then the transfer transaction 1 and the contract creation 1 are stored in the ether house node a, the ether house node b and the ether house node c.
The transaction addresses of the transactions conducted in the etherhouses are recorded by the etherhouse nodes, that is, the transaction addresses obtained from the etherhouse nodes execute the transactions, for example, common transfer, contract creation, or contract calling. Transaction addresses in an ethernet lane may be divided into external account addresses (EOAs) between which a transaction may be initiated and contract account addresses (SCs) to which a transaction may be initiated, which may initiate a transaction and which cannot initiate a transaction.
After obtaining the transaction address from the ethernet house node, each transaction of the transaction address may also be determined, i.e., each transaction of each transaction address is determined from the transaction information stored in the ethernet house.
The transactions in the etherhouses can be divided into three transaction types of common transfer, contract creation and contract calling, wherein the common transfer is a transaction initiated by an external account address and a transaction receiving party is also the external account address, the contract creation is a transaction initiated by the external account address and no transaction receiving party exists, and the contract calling is a transaction initiated by the external account address and a transaction receiving party is a contract account address.
For example, the transaction address that may be obtained from the ethernet house node includes address 1, address 2, and address 3, and it may be determined that the transaction for address 1 includes: ordinary transfer 1, ordinary transfer 2, and creating contract 1, it may be determined that the transaction for address 2 includes: ordinary transfer 3, invoking contract 1, invoking contract 2, and creating contract 2, it may be determined that the transaction for address 3 includes: the ordinary account transfer 4.
In one embodiment, after each transaction at each transaction address is determined, each transaction may be classified, i.e., the transaction type of each transaction is determined. In one implementation, the transaction type is determined according to the address types of both parties in each transaction, and when both parties are external account addresses, the transaction can be determined to be a normal transfer. When the transaction initiator is the external account address and the transaction recipient is empty, the transaction may be determined to be contract creation. When the transaction initiator of the two transaction parties is the external account address and the transaction recipient is the contract account address, the transaction may be determined to be a call contract.
And S102, constructing a transaction network graph by taking the transaction address as a point and each determined transaction as an edge.
Each transaction address can determine a point, each transaction can determine an edge, each edge in the transaction network graph is marked with a direction, and the direction of each edge is used for representing a transaction initiator and a transaction receiver in the transaction.
Taking fig. 2 as an example, the ethernet node includes 10 transaction addresses, a connection line between two points represents a transaction, a transaction 2 occurs between address 1 and address 4, and address 1 is a transaction initiator and address 4 is a transaction recipient. If the address 1 and the address 4 are external account addresses, the transaction 2 can be determined to be a common transfer transaction, and the transfer is carried out from the address 1 to the address 4.
S103, acquiring a triangular relation network meeting preset conditions from the trading network diagram.
The transaction network diagram is a connection diagram between transaction addresses, and the connection between the transaction addresses represents the transactions which have occurred. The triangular relation network meeting the conditions can be obtained from the trading network diagram, wherein the preset conditions are as follows: the three transaction addresses are connected with each other, and the directions of three edges among the three transaction addresses form a closed loop.
Taking fig. 2 as an example, in the triangulation network composed of the addresses 9, 6 and 10, the address 9 initiates a transaction to the address 10, the address 10 initiates a transaction to the address 6, the address 6 initiates a transaction to the address 9, and a closed loop is formed among the addresses 9, 6 and 10 in fig. 2, so that it can be determined that the triangulation network composed of the addresses 9, 6 and 10 satisfies a preset condition. In addition, the triangle relation network formed by the address 3, the address 1 and the address 2 also meets the preset condition.
And S104, determining the address of the exchange from the triangular relationship network.
After the triangular relation network meeting the preset condition is obtained, the address of the exchange can be determined from three transaction addresses in the triangular relation network. In one embodiment, if the exchange address is determined from the three transaction addresses, the triangulation network may be determined to be based on the exchange address, and the transactions in the triangulation network may be monitored.
The method comprises the steps that a user address, a secondary exchange address and an exchange address are included in a triangular relation network based on the exchange address, the user carries out money charging operation on the exchange through the user address, specifically, the user address initiates common transfer to the secondary exchange address, namely, the user address transfers money to the secondary exchange address, the secondary exchange address initiates common transfer to the exchange address, and namely, the secondary exchange address transfers money to the exchange address. In addition, the user can apply for a money withdrawal operation to the exchange through the user address, specifically, the user initiates a money withdrawal application to the exchange through the user address, and the exchange address transfers the applied amount to the user address after receiving the money withdrawal application.
In one embodiment, a Depth First Search (DFS) is used to obtain a connected network map of three transaction addresses from the transaction network map.
Before depth-first search is carried out, a point is determined from the trading network graph, depth-first search is initiated from the point, and depth-first traversal is carried out on the trading network graph sequentially from the adjacent points which are not traversed to the point until the points which are communicated with the point in the trading network graph are all accessed.
When the depth-first search is performed on the trading network map, the direction of a connecting line between two points can be not considered.
Taking fig. 3 as an example, fig. 3 is an undirected graph, where a depth-first search is initiated from a, and the adjacent points of a include points B, C and D, then the second point of traversal may be either one of B, C and D, and if traversing to B, the communication path that can be obtained is: when traversing to E, no point which is not traversed in the adjacent points of E is present, so that traversing by taking A as a starting point can obtain two other communication paths: A-C-F-H and A-D-G-H.
After the connected network graphs of the three transaction addresses are obtained, whether connection exists between any two points in each connected network graph or not can be judged, if any two points in each connected network graph are connected, the fact that the transaction addresses in the connected network graphs are related can be determined, and the connected network graphs are strong connected graphs. If there is a case where two points are not connected in the connected network graph, it may be determined that the connected graph is a weak connected graph. For example, if there is at least a discontinuity between E and F in fig. 3, it can be determined that fig. 3 is a weakly connected graph.
In the case where it is determined that there is a correlation between the transaction addresses in the connected network map, the transaction address having a correlation among the three transaction addresses may be determined as the exchange address. Points with relevance in the connected network diagram can be aggregated into one point to be represented in the trading network diagram, and the aggregated point is used for representing addresses with relevance.
For example, the exchange may include a plurality of addresses, and based on the correlation among the plurality of addresses of the exchange, the plurality of addresses may be aggregated into one address, the aggregated address is an address representing the exchange as a whole, and if the plurality of addresses of the exchange include address 1 and a user address transfers to address 1, the user address may be considered to transfer to the aggregated address.
By aggregating addresses with relevance into one address representation, the trading network diagram can be simplified, and the relationship between the addresses can be understood more intuitively.
In one embodiment, a weight value of each transaction address in the transaction network map can be calculated by using the pagerank algorithm, wherein the weight value is used for indicating the importance degree of the transaction address. When there are more transactions for an address, the importance of the address may be considered to be higher, and accordingly the weight value of the address is higher. Wherein, the transaction of one address comprises the transaction initiated by the address and the accepted transaction. When an address with a higher weight value is transacted with another address, the importance of the transacted address is increased accordingly, that is, the weight value of the address is increased accordingly.
An initial weight value can be set for each address in advance in the pagerank algorithm, and the iterative algorithm is performed until the weight value of each address converges to a fixed value, so that the converged fixed value is the calculated weight value of each address. Of course, when the weight value of the address does not converge, the obtained value may be used as the weight value of the address after iteration for a preset number of times. The preset times can be set by self-definition.
After the weight value of each transaction address in the transaction network graph is obtained, the calculated weight values can be ranked, and the transaction addresses in the transaction network graph are ranked according to the magnitude sequence of the weight values. For example, the trading network map includes an address a, an address B, an address C, and an address D, where the address a transfers 1eth to the address B, the address B transfers 1eth to the address C, the address C transfers 1eth to the address D, the address D transfers 1eth to the address a, the address B transfers 1eth to the address D, and the address C transfers 1eth to the address a, then the algorithm pagerank is used to obtain: the weight value for a is 1.220899, B is 1.188822, C is 0.656307, and D is 0.9339713. According to the sequence of the weighted values from big to small, the ranking of the transaction addresses can be obtained as follows: ABDC.
In one embodiment, after ranking the transaction addresses in the transaction network graph, the transaction address ranked before the preset name in the three transaction addresses can be determined as the exchange address.
In another embodiment, after calculating the weight value of each address in the transaction network map, it may be determined whether the weight value is greater than a preset weight value threshold, and if so, the address of the weight value may be determined as a suspected exchange address, and it is determined whether the suspected exchange address is an exchange address according to the triangular relationship network of the suspected exchange address and other information.
For example, if the weight value of an address is greater than a preset weight value threshold, it may be determined that the address is a suspected exchange address, and a triangular relationship network of the address may be determined from the transaction network diagram, and if the transaction amounts for the addresses are all large, it may be further determined that the suspected exchange address is an exchange address, that is, it is determined that the address is an exchange address.
The weight value threshold in the above embodiment may be set by a user. Based on the characteristics of frequent exchange transactions and more transaction amounts, the address with a higher weight value can be considered as a suspected exchange address. For example, if the threshold value of the weight value is 9.5 and the weight value of a transaction address is 9.865, it may be determined that the transaction address is a suspected exchange address.
Of course, the method for obtaining the exchange address from the ethernet house node is not limited to the above embodiment, and other obtaining methods are also possible, for example, for a known exchange address, identification may be performed in advance. When the transaction address with the preset identifier exists in the three transaction addresses in the triangular relationship network, the transaction address with the preset identifier can be determined as the exchange address.
In one embodiment, the transaction information for the exchange address may be obtained from the Etherhouse node.
The transaction information of the exchange address includes a transaction initiated by the exchange address and a transaction passively accepted as a recipient, and the transaction information of each transaction may include addresses of both parties of the transaction, transaction time, transaction amount and the like.
In one implementation of obtaining the transaction information of the exchange address from the ethernet house node, the stored data may be obtained from the ethernet house node, the data for the exchange address may be extracted from the stored data, the extracted data may be analyzed, each transaction of the exchange address may be determined, the transaction information of each transaction may be obtained, and the obtained transaction information may be stored as basic data.
In addition, the basic data may further include data block information, a log, receipt information, contract information, a token, and the like, wherein the data block information may provide information such as the height of a block where a transaction is located, time, gas, and the like, the log may provide event information in each transaction, the receipt information provides a transaction return status in each transaction and an address in a created contract, and the contract information and the token information may identify whether an ether house in each transaction is a contract address.
The transaction amount for creating the contract and the average number of times each contract created is called are obtained in the obtained transaction information.
The transaction type of each transaction message can be judged according to the address types of the two transaction parties in each transaction message. For example, when both transaction parties are external account addresses in the transaction information, it may be determined that the transaction type to which the transaction information belongs is a normal transfer. When only the transaction initiator of the two transaction parties in the transaction information is the external account address and the transaction receiver is empty, the transaction type to which the transaction information belongs can be determined as a contract creation.
After determining the transaction type to which each transaction information belongs, the transaction amount of which the transaction type is a contract creation in the acquired transaction information may be counted, and the counted transaction amount may be recorded.
Each time the exchange address makes a transaction to create a contract, a contract may be generated. The contract is a computer program in the ether house, can receive and store account amounts of both parties of a transaction, can respond to received information, and can perform operation according to preset rules.
After the contracts are generated, the contracts can be called by the external account address, and the Ethernet shop node can record the number of times each contract is called. For the exchange address, the number of times that each contract created by the exchange address is called may be obtained, and then the total number of times that the contract created by the exchange address is called may be calculated, and based on the total number of times that are called and the number of contracts created, the average number of times that each contract is called may be calculated by the following formula:
wherein,representing the average number of times each contract created by the exchange address was invoked, n representing the total number of times contracts created by the exchange address were invoked, and m representing the number of contracts created by the exchange address, i.e., the number of transactions taken to create a contract.
For example, if the exchange address creates a contract with a transaction amount of 1000, i.e., the exchange address creates 1000 contracts, and the total number of times that the 1000 contracts are called is 800, the average number of times can be calculated according to the above formulaIs 0.8.
And when the transaction number of the exchange address is greater than the preset number threshold and the average number of times is less than the preset number threshold, determining the exchange address as a suspicious address.
The preset number threshold may be set by a user, and the preset number threshold may also be set by a user. It may be considered that, for an address, if the number of contracts for which the address creates is large, but the created contracts are called less, the address may be considered as a suspicious address.
Based on this, the preset number threshold and the preset number threshold can be set by self according to experience, and when the transaction number is greater than the preset number threshold and the average number is less than the preset number threshold, the exchange address is determined as a suspicious address. The suspicious address may be an attack address, an address that is harmful to the network, and the like.
The exchange address may then be determined to be a normal address when any of the following three conditions occur: in the first case, the transaction number is not greater than the preset number threshold, and the average number of times is less than the preset number threshold; in the second case, the transaction number is greater than the preset number threshold, and the average number is not less than the preset number threshold; in a third case, the transaction amount is not greater than the preset amount threshold, and the average number of times is not less than the preset number threshold.
In order to improve the accuracy of address detection, an implementation manner provided by the embodiment of the present application may further determine, from the acquired transaction information, an average amount to which each created contract is transferred.
The acquired transaction information includes transaction information for each invocation of a contract created by the exchange address, and when the contract is invoked, the contract account address, as a transaction recipient, may store a transferred amount of money, which may be considered as the transferred amount of money for the contract. In this way, the transferred amount of each contract can be acquired from the acquired transaction information, the transferred total amount of the contract created by the exchange address can be calculated, and the average transferred amount of each contract can be calculated by the following formula based on the transferred total amount and the number of created contracts:
wherein,represents the average amount to which each contract created by the exchange address is transferred, ω represents the total amount to which contracts created by the exchange address are transferred, and m represents the number of contracts created by the exchange address, i.e., the number of transactions taken to create a contract.
After the transaction quantity for creating the contract, the average number of times of calling each created contract and the average amount of money transferred to each created contract are obtained, whether the transaction quantity is greater than a preset quantity threshold value, whether the average number of times is smaller than a preset number threshold value and whether the average amount of money is smaller than a preset amount threshold value can be respectively judged.
And when the transaction number is greater than the preset number threshold, the average number of times is less than the preset number threshold, and the average amount of money is less than the preset amount threshold, determining that the address of the exchange is a suspicious address.
The preset amount threshold may be set by a user. It may be considered that, for an address, if the number of contracts created by the address is large, but the number of created contracts to be called is small, and the amount of money transferred per time is small, the address may be considered as a suspicious address.
The exchange address may then be determined to be in the indeterminate state when any of the following three conditions occur:
in the first case, the transaction amount is not greater than the preset amount threshold, the average number of times is less than the preset number threshold, and the average amount of money is less than the preset amount threshold; in the second case, the transaction number is greater than the preset number threshold, the average number is not less than the preset number threshold, and the average amount is less than the preset amount threshold; in the third situation, the transaction amount is greater than the preset amount threshold, the average number of times is less than the preset number threshold, and the average amount is not less than the preset amount threshold.
The exchange address may then be determined to be a normal address when any of the following four conditions occur:
in the first case, the transaction number is not greater than the preset number threshold, the average number is not less than the preset number threshold, and the average amount is less than the preset amount threshold; in the second case, the transaction number is not greater than the preset number threshold, the average number of times is less than the preset number threshold, and the average amount of money is not less than the preset amount threshold; in the third situation, the transaction number is greater than the preset number threshold, the average number is not less than the preset number threshold, and the average amount is not less than the preset amount threshold; in a fourth situation, the transaction amount is not greater than the preset amount threshold, the average number of times is not less than the preset number threshold, and the average amount of money is not less than the preset amount threshold.
In the technical scheme provided by the embodiment of the application, the transaction is obtained from the Etherhouse nodes, each transaction of the transaction address is determined, the transaction address is taken as a point, each obtained and determined transaction is taken as an edge, a transaction network graph is constructed, a triangular relation network meeting preset conditions is obtained from the transaction network graph, and the address of a transaction place is determined from the triangular relation network. According to the technical scheme provided by the embodiment of the application, the triangular relation network is obtained by utilizing the constructed transaction network diagram, the address of the exchange is determined from the triangular relation network based on the characteristic that the transaction of the address of the exchange forms the triangular relation, and the determined address of the exchange is monitored.
Corresponding to the above information obtaining method embodiment, an embodiment of the present application further provides an information obtaining apparatus, as shown in fig. 4, the information obtaining apparatus includes:
a first obtaining module 410, configured to obtain a transaction address from the ethernet bay node, and determine each transaction of the transaction address;
the constructing module 420 is configured to construct a transaction network graph by taking the transaction address as a point and taking each determined transaction as an edge, where each edge in the transaction network graph represents a transaction initiator and a transaction receiver in each transaction by a direction;
a second obtaining module 430, configured to obtain, from the transaction network map, a triangulation network that meets preset conditions, where the preset conditions are: the three transaction addresses are connected with each other, and the directions of three edges among the three transaction addresses form a closed loop;
a first determining module 440, configured to determine the exchange address from the triangulation network.
In one embodiment, the first determining module 440 is specifically configured to:
acquiring a connected network diagram of three transaction addresses from the transaction network diagram by utilizing depth-first search;
judging whether connection exists between any two points in each acquired connected network graph;
if yes, determining that the transaction addresses in the connected network graph have correlation;
and determining the transaction address with correlation in the three transaction addresses as the exchange address.
In one embodiment, the first determining module 440 is specifically configured to:
calculating a weight value of each transaction address in the transaction network diagram by using a pagerank algorithm, wherein the weight value is used for representing the importance degree of the transaction address;
ranking the transaction addresses in the transaction network graph according to the magnitude sequence of the weight values;
and determining the transaction address ranked at the preset name in the three transaction addresses as the exchange address.
In one embodiment, the information acquiring apparatus may further include:
the third acquisition module is used for acquiring the transaction information of the address of the exchange from the Ether house node;
the fourth acquisition module is used for acquiring the transaction quantity of the created contracts and the average number of times of calling each created contract in the acquired transaction information;
and the second determining module is used for determining the exchange address as a suspicious address when the transaction number is greater than the preset number threshold and the average number of times is less than the preset number threshold.
In one embodiment, the information acquiring apparatus may further include:
a calculation module for calculating an average amount of money transferred to each of the created contracts based on the acquired transaction information;
the second determining module is specifically configured to:
and when the transaction number is greater than the preset number threshold, the average number of times is less than the preset number threshold, and the average amount of money is less than the preset amount threshold, determining that the address of the exchange is a suspicious address.
In the technical scheme provided by the embodiment of the application, the transaction is obtained from the Etherhouse nodes, each transaction of the transaction address is determined, the transaction address is taken as a point, each obtained and determined transaction is taken as an edge, a transaction network graph is constructed, a triangular relation network meeting preset conditions is obtained from the transaction network graph, and the address of a transaction place is determined from the triangular relation network. According to the technical scheme provided by the embodiment of the application, the triangular relation network is obtained by utilizing the constructed transaction network diagram, the address of the exchange is determined from the triangular relation network based on the characteristic that the transaction of the address of the exchange forms the triangular relation, and the determined address of the exchange is monitored.
Corresponding to the above information obtaining method embodiment, an embodiment of the present application further provides an electronic device, as shown in fig. 5, including a processor 510, a communication interface 520, a memory 530, and a communication bus 540, where the processor 510, the communication interface 520, and the memory 530 complete mutual communication through the communication bus 540;
a memory 530 for storing a computer program;
the processor 510, when executing the program stored in the memory 530, implements the following steps:
acquiring a transaction address from the Ether house node, and determining each transaction of the transaction address;
taking the transaction address as a point and each determined transaction as an edge to construct a transaction network graph, wherein each edge in the transaction network graph represents a transaction initiator and a transaction receiver in each transaction by a direction;
acquiring a triangular relation network meeting preset conditions from a transaction network diagram, wherein the preset conditions are as follows: the three transaction addresses are connected with each other, and the directions of three edges among the three transaction addresses form a closed loop;
the exchange address is determined from the triangular relationship network.
In the technical scheme provided by the embodiment of the application, the transaction is obtained from the Etherhouse nodes, each transaction of the transaction address is determined, the transaction address is taken as a point, each obtained and determined transaction is taken as an edge, a transaction network graph is constructed, a triangular relation network meeting preset conditions is obtained from the transaction network graph, and the address of a transaction place is determined from the triangular relation network. According to the technical scheme provided by the embodiment of the application, the triangular relation network is obtained by utilizing the constructed transaction network diagram, the address of the exchange is determined from the triangular relation network based on the characteristic that the transaction of the address of the exchange forms the triangular relation, and the determined address of the exchange is monitored.
The communication bus mentioned in the electronic device may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus.
The communication interface is used for communication between the electronic equipment and other equipment.
The Memory may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.
The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic device, discrete hardware component.
Corresponding to the above-mentioned address detection method embodiment, an embodiment of the present application further provides a machine-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the method steps of the above-mentioned address detection method are implemented.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, as for the embodiments of the information acquisition apparatus, the electronic device and the machine-readable storage medium, since they are substantially similar to the embodiments of the information acquisition method, the description is relatively simple, and for the relevant points, reference may be made to the partial description of the embodiments of the method.
The above description is only for the preferred embodiment of the present application, and is not intended to limit the scope of the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application are included in the protection scope of the present application.
Claims (10)
1. An information acquisition method, characterized in that the method comprises:
acquiring a transaction address from the Etherhouse node, and determining each transaction of the transaction address;
taking the transaction address as a point and each determined transaction as an edge to construct a transaction network graph, wherein each edge in the transaction network graph represents a transaction initiator and a transaction receiver in each transaction by a direction;
and acquiring a triangular relation network meeting preset conditions from the transaction network diagram, wherein the preset conditions are as follows: the three transaction addresses are connected with each other, and the directions of three edges among the three transaction addresses form a closed loop;
determining an exchange address from the triangular relationship network.
2. The method of claim 1, wherein determining an exchange address from the triangular relationship network comprises:
acquiring a connected network diagram of the three transaction addresses from the transaction network diagram by utilizing depth-first search;
judging whether connection exists between any two points in each acquired connected network graph;
if yes, determining that the transaction addresses in the connected network graph have correlation;
and determining the transaction address with correlation in the three transaction addresses as the exchange address.
3. The method of claim 1, wherein determining an exchange address from the triangular relationship network comprises:
calculating a weight value of each transaction address in the transaction network graph by using a pagerank algorithm, wherein the weight value is used for representing the importance degree of the transaction address;
ranking the transaction addresses in the transaction network graph according to the magnitude sequence of the weight values;
and determining the transaction address ranked at the preset name time in the three transaction addresses as the exchange address.
4. The method according to any one of claims 1-3, further comprising:
acquiring the transaction information of the address of the exchange from the Etherhouse node;
acquiring the transaction quantity of the created contracts and the average number of times of calling each created contract from the acquired transaction information;
and when the transaction number is greater than a preset number threshold value and the average number of times is less than a preset number threshold value, determining that the exchange address is a suspicious address.
5. The method of claim 4, further comprising:
calculating an average amount to which each created contract is transferred based on the acquired transaction information;
when the transaction number is greater than a preset number threshold and the average number of times is less than a preset number threshold, determining that the exchange address is a suspicious address includes:
and when the transaction number is greater than a preset number threshold, the average number of times is less than a preset number threshold, and the average amount of money is less than a preset amount threshold, determining that the address of the exchange is a suspicious address.
6. An information acquisition apparatus, characterized in that the apparatus comprises:
the first acquisition module is used for acquiring a transaction address from the Ether house node and determining each transaction of the transaction address;
the construction module is used for constructing a transaction network graph by taking the transaction address as a point and taking each determined transaction as one edge, wherein each edge in the transaction network graph represents a transaction initiator and a transaction receiver in each transaction by a direction;
a second obtaining module, configured to obtain, from the transaction network map, a trigonometric relationship network that meets a preset condition, where the preset condition is: the three transaction addresses are connected with each other, and the directions of three edges among the three transaction addresses form a closed loop;
a first determination module to determine an exchange address from the triangular relationship network.
7. The apparatus of claim 6, wherein the first determining module is specifically configured to:
acquiring a connected network diagram of the three transaction addresses from the transaction network diagram by utilizing depth-first search;
judging whether connection exists between any two points in each acquired connected network graph;
if yes, determining that the transaction addresses in the connected network graph have correlation;
and determining the transaction address with correlation in the three transaction addresses as the exchange address.
8. The apparatus of claim 6, wherein the first determining module is specifically configured to:
calculating a weight value of each transaction address in the transaction network graph by using a pagerank algorithm, wherein the weight value is used for representing the importance degree of the transaction address;
ranking the transaction addresses in the transaction network graph according to the magnitude sequence of the weight values;
and determining the transaction address ranked at the preset name time in the three transaction addresses as the exchange address.
9. The apparatus according to any one of claims 6-8, further comprising:
a third obtaining module, configured to obtain the transaction information of the exchange address from the ethernet house node;
the fourth acquisition module is used for acquiring the transaction quantity of the created contracts and the average number of times of calling each created contract in the acquired transaction information;
and the second determination module is used for determining the exchange address as a suspicious address when the transaction number is greater than a preset number threshold and the average number of times is less than a preset number threshold.
10. The apparatus of claim 9, further comprising:
a calculation module for calculating an average amount of money transferred to each of the created contracts based on the acquired transaction information;
the second determining module is specifically configured to:
and when the transaction number is greater than a preset number threshold, the average number of times is less than a preset number threshold, and the average amount of money is less than a preset amount threshold, determining that the address of the exchange is a suspicious address.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811640283.0A CN109741183A (en) | 2018-12-29 | 2018-12-29 | Information acquisition method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811640283.0A CN109741183A (en) | 2018-12-29 | 2018-12-29 | Information acquisition method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109741183A true CN109741183A (en) | 2019-05-10 |
Family
ID=66362497
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811640283.0A Pending CN109741183A (en) | 2018-12-29 | 2018-12-29 | Information acquisition method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109741183A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111444232A (en) * | 2020-01-03 | 2020-07-24 | 上海宓猿信息技术有限公司 | Method for mining digital currency exchange address and storage medium |
| CN112861123A (en) * | 2021-01-26 | 2021-05-28 | 中山大学 | Bit currency malicious address identification method and device |
| CN113064953A (en) * | 2021-04-21 | 2021-07-02 | 湖南天河国云科技有限公司 | Ether house address clustering method and device based on neighbor information aggregation |
| CN114239670A (en) * | 2021-09-06 | 2022-03-25 | 成都链安科技有限公司 | Method and device for identifying Ethereum exchange name based on counterparty matching |
| CN114819968A (en) * | 2022-03-25 | 2022-07-29 | 杭州趣链科技有限公司 | Transaction address analyzing and inquiring method, system, device, equipment and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150262168A1 (en) * | 2014-03-17 | 2015-09-17 | Coinbase, Inc. | Instant exchange |
| CN106600401A (en) * | 2015-10-14 | 2017-04-26 | 地气股份有限公司 | Electronic money management method and electronic money system |
| CN107967539A (en) * | 2017-11-29 | 2018-04-27 | 暨南大学 | The method for the fuel limitation merchandised on prediction ether mill based on machine learning and block chain technology |
| CN108053137A (en) * | 2017-12-27 | 2018-05-18 | 邵美 | A kind of block chain intelligence contract sort method |
| CN108615144A (en) * | 2018-04-11 | 2018-10-02 | 北京奇虎科技有限公司 | Identity information processing method, device and the computing device of block chain node |
-
2018
- 2018-12-29 CN CN201811640283.0A patent/CN109741183A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150262168A1 (en) * | 2014-03-17 | 2015-09-17 | Coinbase, Inc. | Instant exchange |
| CN106600401A (en) * | 2015-10-14 | 2017-04-26 | 地气股份有限公司 | Electronic money management method and electronic money system |
| CN107967539A (en) * | 2017-11-29 | 2018-04-27 | 暨南大学 | The method for the fuel limitation merchandised on prediction ether mill based on machine learning and block chain technology |
| CN108053137A (en) * | 2017-12-27 | 2018-05-18 | 邵美 | A kind of block chain intelligence contract sort method |
| CN108615144A (en) * | 2018-04-11 | 2018-10-02 | 北京奇虎科技有限公司 | Identity information processing method, device and the computing device of block chain node |
Non-Patent Citations (1)
| Title |
|---|
| 100TOKEN: "如何分析虚拟货币交易所的区块链地址？", 《HTTPS://WWW.JINSE.COM/ETHEREUM/182383.HTML》 * |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111444232A (en) * | 2020-01-03 | 2020-07-24 | 上海宓猿信息技术有限公司 | Method for mining digital currency exchange address and storage medium |
| CN112861123A (en) * | 2021-01-26 | 2021-05-28 | 中山大学 | Bit currency malicious address identification method and device |
| CN112861123B (en) * | 2021-01-26 | 2022-02-08 | 中山大学 | Bit currency malicious address identification method and device |
| CN113064953A (en) * | 2021-04-21 | 2021-07-02 | 湖南天河国云科技有限公司 | Ether house address clustering method and device based on neighbor information aggregation |
| CN113064953B (en) * | 2021-04-21 | 2023-08-22 | 湖南天河国云科技有限公司 | Block chain address clustering method and device based on neighbor information aggregation |
| CN114239670A (en) * | 2021-09-06 | 2022-03-25 | 成都链安科技有限公司 | Method and device for identifying Ethereum exchange name based on counterparty matching |
| CN114819968A (en) * | 2022-03-25 | 2022-07-29 | 杭州趣链科技有限公司 | Transaction address analyzing and inquiring method, system, device, equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11710131B2 (en) | Method and apparatus of identifying a transaction risk | |
| CN109741183A (en) | Information acquisition method and device | |
| CN107563757B (en) | Data risk identification method and device | |
| WO2021093051A1 (en) | Ip address assessment method and system, and device | |
| CN111539811A (en) | Risk account identification method and device | |
| CN104809132A (en) | Method and device for acquiring social relation type of network subject | |
| CN109299334A (en) | A kind of data processing method and device of knowledge mapping | |
| CN105391594A (en) | Method and device for recognizing characteristic account number | |
| CN112598428A (en) | Transaction data processing method and device, computer equipment and storage medium | |
| WO2025130600A1 (en) | Network security threat analysis method and apparatus, and electronic device and storage medium | |
| CN113469696B (en) | User anomaly evaluation method, device and computer readable storage medium | |
| CN113723522B (en) | Abnormal user identification method and device, electronic equipment and storage medium | |
| CN115099342A (en) | Feature extraction method and device, electronic equipment and storage medium | |
| CN111028083B (en) | Block chain wallet address evaluation method, device, system and storage medium | |
| CN115378713A (en) | Block chain application early warning defense method, storage medium and electronic equipment | |
| CN105844577A (en) | Relation network recognition method and device | |
| CN113076451B (en) | Abnormal behavior identification and risk model library establishment method and device and electronic equipment | |
| CN119420559A (en) | Big data driven network and information security risk assessment method and system | |
| CN111026882A (en) | Default determination method, device, equipment and storage medium based on knowledge graph | |
| CN117635299A (en) | Risk assessment method and device based on federal learning, electronic equipment and storage medium | |
| CN110956544A (en) | Digital asset transaction risk control method and device | |
| CN118586908B (en) | Method, device, storage medium and electronic equipment for cross-chain transaction tracking | |
| CN114445213B (en) | Transaction analysis method, device, equipment and storage medium | |
| CN113989005A (en) | A tax risk enterprise mining method and device | |
| CN112565227A (en) | Abnormal task detection method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190510 |