| CPC G06Q 20/4016 (2013.01) [G06Q 20/36 (2013.01)] | 20 Claims |
|
1. A deep learning based method for detecting abnormal cryptocurrency transactions between computing devices in a blockchain network, the method comprising:
establishing, by a communication interface of a fraud detection server, a communication link with a plurality of computing devices in the blockchain network,
the plurality of computing devices comprising a first computing device associated with a first user wallet address and one or more second computing devices associated with one or more second user wallet addresses,
the fraud detection server comprising a memory configured to store:
one or more transaction data of transactions between the first user wallet address and at least one of the one or more second user wallet addresses,
one or more input codes associated with the transactions between the first user wallet address and the at least one of the one or more second user wallet addresses, and
one or more bytecodes associated with distributing the one or more input codes in the blockchain network;
generating, by a processor of the fraud detection server, a first data set associated with the first user wallet address based at least in part on the one or more transaction data, the first data set comprising a set of normalized statistical features of the one or more transaction data, by:
retrieving, from the memory of the fraud detection server, a set of transaction data of the one or more transaction data associated with the first user wallet address,
deriving a set of statistical features based on the set of transaction data, and
converting the set of statistical features into the set of normalized statistical features, the set of normalized statistical features comprising a label value indicating a fraudulent cryptocurrency transaction or a normal cryptocurrency transaction in the blockchain network;
converting, by the processor, the one or more input codes into a second data set associated with the first user wallet address, the second data set comprising a first set of integers, by:
retrieving, from the memory, a set of transaction data of the one or more transaction data associated with the first user wallet address,
extracting a set of input codes of the one or more input codes included in the set of transaction data,
concatenating the set of input codes into a string,
dividing the string by a predetermined unit to generate a divided string,
performing integer encoding on the divided string, and
inserting the result of integer encoding into the first set of integers, the first set of integers comprising a label value indicating a fraudulent cryptocurrency transaction or a normal cryptocurrency transaction in the blockchain network;
converting, by the processor, the bytecodes into a third data set associated with a contract address of the first user wallet address, the third data set comprising a second set of integers, by:
extracting a set of bytecodes of the one or more bytecodes associated with the contract address,
dividing the set of bytecodes by a predetermined unit,
performing integer encoding on the divided set of bytecodes, and
inserting the result of integer encoding into the second set of integers, the second set of integers comprising a label value indicating a fraudulent cryptocurrency transaction or a normal cryptocurrency transaction in the blockchain network;
running a pre-learned deep learning module of the processor using the first data set associated with the set of normalized statistical features to extract a first feature vector, the first feature vector comprising a first new feature generated by correlating adjacent statistical features in the first data set;
running the pre-learned deep learning module of the processor using the second data set associated with the one or more input codes to extract a second feature vector, the second feature vector comprising a second new feature data generated by correlating adjacent input codes in the second data set;
running the pre-learned deep learning module of the processor using the third data set associated with the one or more bytecodes to extract a third feature vector, the third feature vector comprising a third new feature data generated by correlating adjacent bytecodes in the third data set,
wherein a first number of layers are used in the pre-learned deep learning module that extracts the third feature vector by using the one or more bytecodes,
wherein a second number of layers are used in the pre-learned deep learning module that extracts the second feature vector by using the one or more input codes,
wherein the first number of layers are greater than the second number of layers in order to compensate a detection performance that would be lower in the pre-learned deep learning module that uses the one or more bytecodes than in the pre-learned deep learning module that uses the one or more input codes, and
wherein the detection performance comprises:
an accuracy performance representing a matching rate between a label value of the second or third data set and a predicted value of the pre-learned deep learning module for fraudulent cryptocurrency transaction detection, and
a precision performance representing a ratio of a case as actually labeled fraudulent cryptocurrency transaction to all cases determined by the pre-learned deep learning module to be fraudulent cryptocurrency transaction;
combining, by the processor, the first feature vector, the second feature vector, and the third feature vector into an intermediate value, by:
concatenating the first feature vector, the second feature vector, and the third feature vector into a concatenated vector;
performing layer normalization on the concatenated vector,
applying a layer normalized value to a feed-forward network, and
deriving the intermediate value obtained by adding a value that has passed through the feed-forward network to the concatenated vector; and
running the pre-learned deep learning module of the processor using the intermediate value to determine the fraudulent cryptocurrency transaction in the blockchain network by:
comparing, by the processor, the intermediate value to a predetermined reference value stored in the memory; and
determining, by the processor, a fraudulent activity in the transaction between the first wallet address and the at least one of the one or more second user wallet addresses in response to the intermediate value being greater than the predetermined reference value, by using a binary classification model that classifies the transaction as one of a fraudulent cryptocurrency transaction or a normal cryptocurrency transaction based on a comparison of the intermediate value and the predetermined reference value,
wherein running the pre-learned deep learning module to extract the first feature vector comprises applying an importance weight gate to the first data set associated with the set of normalized statistical features by:
applying, by the processor, a linear artificial neural network (ANN) to the first data set to generate a first result value, the first result value representing an initial statistical feature,
applying, by the processor, the first data set to a pre-learned convolutional neural network (CNN),
applying, by the processor, maxpooling to a value that has passed through the convolutional neural network to reduce a dimension of a hidden state vector and not to consider elements of relatively low importance among statistical feature values,
applying, by the processor, a softmax function to a value that has passed through the maxpooling to generate a second result value, the second result value representing a numerical value of how much each statistical feature among the set of normalized statistical features is weighted on detecting whether there is a fraudulent cryptocurrency transaction, and
multiplying, by the processor, the first result value and the second result value to generate an element-wise product,
wherein the element-wise product enables a higher weight to be given to a statistical value that plays a more important role in detecting the fraudulent cryptocurrency transaction,
wherein the feed-forward network comprises two or more linear artificial neural networks and two or more leaky ReLU functions alternately arranged with respect to each other, and
wherein applying the layer normalized value to the feed-forward network comprises:
feeding the layer normalized value into a first linear artificial neural network of the two or more linear artificial neural networks;
feeding an output of the first linear artificial neural network into a first leaky ReLU function of the two or more leaky ReLU functions;
feeding an output of the first leaky ReLU function into a second linear artificial neural network of the two or more linear artificial neural networks; and
feeding an output of the second linear artificial neural network into a second leaky ReLU function of the two or more leaky ReLU functions.
|