Node monitoring to detect misclassified on-chain addresses

1 . A system for detecting anomalous activities based on internet protocol (IP) addresses related to on-chain messages, the system comprising a computer system that comprises one or more processors programmed with computer program instructions that, when executed, cause the computer system to perform operations comprising:

obtaining, via the Internet, from a set of internet protocol (IP) addresses, a set of messages indicating an on-chain address;

inputting the set of IP addresses and a message count of the set of messages to an encoder neural network to obtain an embedding vector;

providing the embedding vector to a machine learning model to obtain a predicted use pattern related to the on-chain address;

obtaining, via a network database, a stored set of registered IP addresses; and

based on the predicted use pattern and the stored set of registered IP addresses not comprising each respective address of the set of IP addresses, stopping a blockchain operation associated with the on-chain address.

2 . The system of claim 1 , wherein the on-chain address is a first on-chain address, and wherein the set of IP addresses comprises a first IP address, the operations further comprising:

updating a first record of an off-chain database associated with the on-chain address;

obtaining a second set of messages from a second IP address indicating blockchain operations associated with a second on-chain address;

obtaining an on-chain dataset comprising updates associated with the second on-chain address;

determining whether a recorded update of the on-chain dataset indicating the second on-chain address matches any message of the second set of messages obtained from the second IP address;

in response to a determination that the recorded update indicating the second on-chain address does not match any message of the second set of messages obtained from the second IP address, updating a second record of the off-chain database to indicate a use pattern violation for the second on-chain address.

3 . The system of claim 1 , wherein the stored set of registered IP addresses is associated with a user, the operations further comprising:

determining that the stored set of registered IP addresses does not comprise a first IP address of the set of IP addresses;

sending, to a message destination mapped to the user, a confirmation message indicating the first IP address of the set of IP addresses; and

in response to receiving a confirmation value from the user, updating the stored set of registered IP addresses with the first IP address.

4 . The system of claim 1 , the operations further comprising updating a record of an off-chain database associated with the on-chain address, wherein the record associates the on-chain address with a user, and wherein updating the record comprises preventing the user identified by the record from accessing an account associated with the on-chain address.

5 . A method comprising:

obtaining, from a set of internet protocol (IP) addresses, a set of messages indicating an on-chain address;

inputting the set of IP addresses and a message count of the set of messages to an encoder neural network to obtain an embedding vector;

providing the embedding vector to a machine learning model to obtain a predicted use pattern related to the on-chain address;

determining that a stored set of registered IP addresses does not comprise each respective address of the set of IP addresses; and

based on the predicted use pattern and the determining that the stored set of registered IP addresses does not comprise each respective address of the set of IP addresses, stopping a blockchain operation associated with the on-chain address.

6 . The method of claim 5 , further comprising establishing a new node of a plurality of on-chain nodes, wherein an on-chain dataset is distributed across the plurality of on-chain nodes, and wherein obtaining the set of messages comprises obtaining the set of messages at the new node from the set of IP addresses.

7 . The method of claim 5 , further comprising:

obtaining a pre-determined duration, wherein providing the embedding vector to the machine learning model comprises providing the embedding vector to the machine learning model based on a determination that a message of the set of messages is timestamped with a time that is within the pre-determined duration.

8 . The method of claim 5 , further comprising:

updating a record of an off-chain database associated with the on-chain address, wherein the record associates the on-chain address with a first user;

receiving a request indicating the on-chain address from a second user; and

in response to a determination that the on-chain address is already associated with the first user, updating the record of the second user to indicate the second user as anomalous.

9 . The method of claim 5 , wherein the stored set of registered IP addresses comprises at least two IP addresses.

10 . The method of claim 5 , wherein the set of IP addresses comprises a first IP address of a user, further comprising:

obtaining, from a second IP address, a second set of messages indicating the on-chain address;

determining a result indicating that a set of flagged IP addresses comprises the second IP address; and

in response to determining the result, locking an account of the user.

11 . The method of claim 10 , further comprising:

retrieving a set of virtual private network (VPN) IP addresses; and

updating the set of flagged IP addresses based on the set of VPN IP addresses.

12 . A set of non-transitory, machine-readable media storing instructions that, when executed by a set of processors, perform operations comprising:

obtaining, from a set of internet protocol (IP) addresses, a set of messages indicating an on-chain address;

inputting the set of IP addresses and a message count of the set of messages to an encoder neural network to obtain an embedding vector;

providing the embedding vector to a machine learning model to obtain a predicted use pattern related to the on-chain address; and

based on the predicted use pattern and a stored set of registered IP addresses not comprising each respective address of the set of IP addresses, stopping a blockchain operation associated with the on-chain address.

13 . The set of non-transitory, machine-readable media of claim 12 , further comprising determining a count of messages of the set of messages, wherein stopping the blockchain operation comprises determining whether the predicted use pattern matches a use pattern category in response to a determination that the count is less than or equal to a count threshold.

14 . The set of non-transitory, machine-readable media of claim 12 , wherein determining whether the stored set of registered IP addresses comprises the set of IP addresses comprises:

determining whether a first message of the set of messages satisfies a minimum amount threshold, wherein the first message is sent via a first IP address of the set of IP addresses; and

in response to a determination that the set of messages satisfies the minimum amount threshold, determining whether the stored set of registered IP addresses comprises the first IP address.

15 . The set of non-transitory, machine-readable media of claim 12 , further comprising:

obtaining an update indicating an approved virtual private network (VPN) IP address; and

updating the stored set of registered IP addresses to comprise the approved VPN IP address.

16 . The set of non-transitory, machine-readable media of claim 12 , further comprising determining a geographic location based on a first IP address of the set of IP addresses, wherein determining the predicted use pattern comprises providing the geographic location to the machine learning model.

17 . The set of non-transitory, machine-readable media of claim 12 , the operations further comprising:

determining a first geographic location based on a first IP address of the set of IP addresses, wherein a first message is sent from the first IP address;

determining a second geographic location based on a second IP address of the set of IP addresses, wherein a second message is sent from the second IP address; and

determining a time difference between when the first message and the second message are sent;

determining a transport time threshold based on a distance between the first geographic location and the second geographic location; and

in response to a determination that the time difference is greater than the transport time threshold, updating a record of an off-chain database to indicate anomalous activity.

18 . The set of non-transitory, machine-readable media of claim 12 , wherein the on-chain address is an address of an on-chain application, the operations further comprising:

in response to a determination that the stored set of registered IP addresses does not comprise the set of IP addresses, updating a state of the on-chain application;

based on the updating of the state of the on-chain application, preventing transfers from the on-chain address.

19 . The set of non-transitory, machine-readable media of claim 18 , the operations further comprising:

receiving a request to transfer an amount of a digital asset from the on-chain address;

determining whether a minimum threshold is satisfied based on the request and a preexisting amount associated with the on-chain address; and

transferring the amount based on a determination that the minimum threshold is satisfied.