Machine learning to detect misclassified on-chain addresses

1 . A system for detecting anomalous activities based on on-chain transactions, the system comprising a computer system that comprises one or more processors programmed with computer program instructions that, when executed, cause the computer system to perform operations comprising:

retrieving a set of on-chain transactions of an on-chain address from a scan of on-chain transactions based on a request identifying the on-chain address, wherein retrieving the set of on-chain transactions comprises retrieving a superset of on-chain transactions, and wherein each respective set of on-chain transactions indicates a respective on-chain address of a plurality of on-chain addresses associated with a plurality of keys;

generating a sequence of embedding vectors by providing the set of on-chain transactions to an encoder neural network, wherein each respective embedding vector corresponds with a respective transaction of the set of on-chain transactions, wherein providing the set of on-chain transactions comprises inputting the superset of on-chain transactions to the encoder neural network to determine a plurality of vector sequences comprising the sequence of embedding vectors;

predicting a use pattern of the on-chain address by providing the sequence of embedding vectors to a machine learning model, wherein the use pattern indicates multiple users, and wherein providing the sequence of embedding vectors to the machine learning model comprises providing the superset of on-chain transactions to the machine learning model to generate the plurality of vector sequences;

determining whether the predicted use pattern matches with a provided use pattern that is provided by a user, wherein the provided use pattern indicates a single user; and

in response to a determination that the predicted use pattern does not match with the provided use pattern, updating a record of the on-chain address in an off-chain database to indicate anomalous activity.

2 . A method comprising:

retrieving a set of on-chain transactions of an on-chain address from a scan of the set of on-chain transactions based on a request identifying the on-chain address, wherein retrieving the set of on-chain transactions comprises retrieving a superset of on-chain transactions, wherein each respective set of on-chain transactions indicates a respective on-chain address of a plurality of on-chain addresses associated with a plurality of keys;

predicting a first use pattern indicating multiple users of the on-chain address by (i) inputting the set of on-chain transactions to an encoder neural network to obtain a sequence of embedding vectors, wherein inputting the set of on-chain transactions comprises inputting the superset of on-chain transactions to the encoder neural network to determine a plurality of vector sequences comprising the sequence of embedding vectors and (ii) providing the sequence of embedding vectors to a second machine learning model, wherein each respective embedding vector of the sequence of embedding vectors corresponds with a respective transaction of the set of on-chain transactions, and wherein providing the sequence of embedding vectors to the second machine learning model comprises providing the superset of on-chain transactions to the second machine learning model to generate the plurality of vector sequences;

determining whether the first use pattern matches with a second use pattern; and

in response to a determination that the first use pattern does not match with the second use pattern, updating a record of the on-chain address in an off-chain database to indicate anomalous activity.

3 . The method of claim 2 , wherein predicting the first use pattern comprises predicting the first use pattern based on a subset of on-chain transactions of the set of on-chain transactions, and wherein each respective transaction of the subset of on-chain transactions is indicated to have occurred within a pre-determined duration.

4 . The method of claim 2 , further comprising:

obtaining a hierarchical deterministic key;

determining a plurality of derived keys based on the hierarchical deterministic key, wherein a first derived key of the plurality of derived keys corresponds with the on-chain address; and

obtaining the plurality of on-chain addresses based on the plurality of derived keys.

5 . The method of claim 2 , wherein the on-chain address is a first on-chain address, and wherein the first on-chain address is indicated as controlled by a user, the method further comprising, in response to a determination that the first use pattern does not match with the second use pattern, updating a state of an on-chain application to prevent further transactions with a second on-chain address, wherein the second on-chain address is an address of the on-chain application accessible to the user.

6 . The method of claim 2 , further comprising obtaining a set of internet protocol (IP) addresses mapped to the set of on-chain transactions, wherein each respective IP address maps to a respective on-chain transaction, and wherein predicting the first use pattern further comprises predicting the first use pattern based on the set of IP addresses.

7 . The method of claim 6 , wherein the on-chain address is provided by a user, further comprising:

determining whether a first IP address of the set of IP addresses matches with a virtual private network (VPN) IP address; and

sending a warning to a message destination mapped to the user in response to a determination that the first IP address matches with the VPN IP address.

8 . The method of claim 2 , wherein the on-chain address is a first on-chain address, and wherein the set of on-chain transactions includes a transaction with a second on-chain address, and wherein the second on-chain address is an address of an on-chain application, further comprising:

determining whether program code of the on-chain application comprises a flagged pattern; and

in response to a determination that the program code comprises the flagged pattern, updating the record of the on-chain address.

9 . The method of claim 2 , further comprising:

obtaining a set of flagged on-chain addresses; and

determining a set of matches between the set of on-chain transactions and the set of flagged on-chain addresses, wherein determining the first use pattern comprises determining the first use pattern based on the set of matches.

10 . The method of claim 2 , wherein updating the record of the on-chain address in the off-chain database comprises sending a warning message to a message destination associated with a user, wherein the on-chain address is provided by the user.

11 . A set of non-transitory, machine-readable media storing instructions that, when executed by a set of processors, perform operations comprising:

retrieving a set of on-chain transactions from on-chain transaction data based on an on-chain address, wherein retrieving the set of on-chain transactions comprises retrieving a superset of on-chain transactions, wherein each respective set of on-chain transactions indicates a respective on-chain address of a plurality of on-chain addresses associated with a plurality of keys;

predicting a first use pattern of the on-chain address by (i) inputting the set of on-chain transactions to an encoder neural network to obtain a sequence of vectors, wherein inputting the set of on-chain transactions comprises inputting the superset of on-chain transactions to the encoder neural network to determine a plurality of vector sequences comprising the sequence of vectors and (ii) providing the sequence of vectors to a second machine learning model, wherein each respective vector of the sequence of vectors corresponds with a respective transaction of the set of on-chain transactions, and wherein providing the sequence of vectors to the second machine learning model comprises providing the superset of on-chain transactions to the second machine learning model to generate the plurality of vector sequences; and

generating an alert related to anomalous activity based on a determination that the first use pattern does not match with a second use pattern.

12 . The set of non-transitory, machine-readable media of claim 11 , the operations further comprising:

obtaining a first training set comprising a first set of training vectors mapped to a set of known single-user on-chain addresses;

obtaining a second training set comprising a second set of training vectors mapped to a set of known multi-user on-chain addresses; and

training the second machine learning model based on the first training set and the second training set.

13 . The set of non-transitory, machine-readable media of claim 11 , the operations further comprising:

retrieving a first key of a plurality of private keys, wherein accessing the on-chain address requires the plurality of private keys; and

determining a set of geographic locations associated with the set of on-chain transactions based on transactions associated with the first key, wherein predicting the first use pattern comprises predicting the first use pattern based on the set of geographic locations.

14 . The set of non-transitory, machine-readable media of claim 11 , wherein generating the sequence of vectors comprises generating the sequence of vectors based on transaction amounts of the set of on-chain transactions.

15 . The set of non-transitory, machine-readable media of claim 11 , wherein the on-chain address is a first on-chain address, further comprising determining an address type category based on a second on-chain address of at least one transaction of the set of on-chain transactions, wherein generating the sequence of vectors comprises generating at least one vector based on the address type category.

16 . The set of non-transitory, machine-readable media of claim 11 , wherein the first use pattern indicates a first predicted count of users, the operations further comprising updating a record of the on-chain address based on the first predicted count of users.

17 . The set of non-transitory, machine-readable media of claim 11 , further comprising determining a set of differences indicating differences between transaction amounts of the set of on-chain transactions, wherein generating the sequence of vectors comprises generating the sequence of vectors based on the set of differences.

18 . The set of non-transitory, machine-readable media of claim 11 , further comprising determining a set of time differences indicating time differences between transaction events of the set of on-chain transactions, wherein generating the sequence of vectors comprises generating the sequence of vectors based on the set of time differences.

19 . The set of non-transitory, machine-readable media of claim 11 , wherein:

the sequence of vectors is in an embedding space;

predicting the first use pattern of the on-chain address comprises:

determining a set of distances in the embedding space between a model vector and the sequence of vectors; and

selecting the first use pattern based on the set of distances.

20 . The set of non-transitory, machine-readable media of claim 11 , further comprising determining duration that the on-chain address has been allocated with a resource amount that is greater than a minimum resource amount, wherein predicting the first use pattern comprises predicting the first use pattern based on the duration.