Blockchain transaction safety
A method includes acquiring blockchain data that includes transactions between a plurality of blockchain addresses. The method includes labeling a set of the blockchain addresses as fraudulent and generating a graph data structure based on the blockchain data. The method includes calculating a set of scoring features for each blockchain address, where each set of scoring features includes a graph-based scoring feature. Calculating the graph-based scoring feature includes calculating a number of transactions associated with the blockchain address in the graph data structure. The method includes generating a scoring model using sets of scoring features for the blockchain addresses that are labeled as fraudulent and generating a trust score for each blockchain address using the scoring features and the scoring model. The trust score indicates a likelihood that the blockchain address is involved in fraudulent activity. Additionally, the method includes sending a requested trust score to a requesting device.
1. A method comprising:
acquiring, at a server, blockchain data from a blockchain network, wherein the blockchain data includes a transaction data corresponding to a plurality of blockchain transactions, wherein each blockchain transaction is between at least two blockchain addresses of a plurality of blockchain addresses on the blockchain network;
maintaining, at the server, a graph data structure based on the blockchain data, wherein the graph data structure includes a plurality of address nodes and a plurality of transaction edges, wherein each address node corresponds to a respective blockchain address of the plurality of blockchain addresses, and each transaction edge connects two respective address nodes corresponding to a first blockchain address and a second blockchain address involved in a respective transaction of the plurality of blockchain transactions; and
for each address node of at least a subset of the address nodes of the plurality of address nodes:
calculating, at the server, a set of scoring features associated with the address node, wherein the set of scoring features is based on the graph data structure and at least one blockchain transaction of the plurality of blockchain transactions associated with the blockchain address;
determining, at the server, a trust score for the blockchain address associated with the address node, wherein the trust score is based on a scoring model and the set of scoring features associated with the blockchain address, and the trust score indicates a likelihood that the blockchain address is involved in fraudulent transactions; and
updating, at the server, the graph data structure based on the trust score determined with respect to the blockchain address associated with the address node.
2. The method of claim 1 , wherein calculating the set of scoring features comprises,
calculating a number of transactions associated with at least one blockchain address of the plurality of blockchain addresses that is a receiver address, and
calculating a number of transactions associated with at least one blockchain address of the plurality of blockchain addresses that is a sender address.
3. The method of claim 1 , wherein calculating the set of scoring features comprises calculating an amount of funds transacted with at least one blockchain address of the plurality of blockchain addresses.
4. The method of claim 1 , wherein calculating the set of scoring features comprises,
calculating an amount of funds received by at least one blockchain address of the plurality of blockchain addresses, and
calculating an amount of funds sent by at least one blockchain address of the plurality of blockchain addresses.
5. The method of claim 1 , wherein the set of scoring features is based on a distance between at least one address node of the plurality of address nodes and at least one other node of the plurality of nodes that has been determined to be involved in fraudulent transactions.
6. The method of claim 1 , wherein the set of scoring features includes a transaction rate scoring feature, and wherein calculating the transaction rate scoring feature comprises calculating a rate at which at least one blockchain address of the plurality of blockchain addresses transacts with other blockchain addresses of the plurality of blockchain addresses.
7. The method of claim 1 , wherein the set of scoring features includes a transaction amount scoring feature, and wherein calculating the transaction amount scoring feature comprises calculating an amount of funds transacted by at least one blockchain address of the plurality of blockchain addresses within a period of time.
8. The method of claim 1 , wherein the set of scoring features includes a timing scoring feature, and wherein calculating the timing scoring feature comprises calculating a time between an entrance of funds into at least one blockchain address of the plurality of blockchain addresses and an exit of the funds from the at least one blockchain address of the plurality of blockchain addresses.
9. The method of claim 1 , wherein the set of scoring features includes a dormancy scoring feature, and wherein calculating the dormancy scoring feature comprises calculating an amount of time for which at least one blockchain address of the plurality of blockchain addresses does not participate in transactions.
10. The method of claim 9 , wherein calculating the dormancy scoring feature comprises calculating an amount of time for which at least one blockchain address of the plurality of blockchain addresses does not participate in transactions relative to an expected amount of time between transactions for the at least one blockchain address.
11. The method of claim 1 , wherein the set of scoring features includes a request data scoring feature, and wherein calculating the request data scoring feature comprises calculating a number of times a trust score was requested for at least one blockchain address of the plurality of blockchain addresses.
12. The method of claim 1 , wherein the set of scoring features includes a behavior feature that indicates whether a behavior of at least one blockchain address of the plurality of blockchain addresses satisfies conditions specified in a behavior template.
13. The method of claim 12 , wherein the behavior template includes conditions that specify a number of transactions and a rate of transactions.
14. The method of claim 1 , wherein the set of scoring features includes,
a first behavior feature that indicates whether a behavior of at least one blockchain address of the plurality of blockchain addresses satisfies a first set of conditions specified in a first behavior template, and
a second behavior feature that indicates whether a behavior of at least one blockchain address of the plurality of blockchain addresses satisfies a second set of conditions specified in a second behavior template.
15. The method of claim 1 , further comprising:
acquiring a list of fraudulent blockchain addresses; and
labeling at least one blockchain address of the plurality of blockchain addresses as fraudulent based on the acquired list.
16. A system comprising:
one or more processing units that execute computer-readable instructions that cause the one or more processing units to:
acquire blockchain data from a blockchain network, wherein the blockchain data includes a transaction data corresponding to a plurality of blockchain transactions, wherein each blockchain transaction is between at least two blockchain addresses of a plurality of blockchain addresses on the blockchain network;
maintain a graph data structure based on the blockchain data, wherein the graph data structure includes a plurality of nodes and a plurality of transaction edges, wherein each address node corresponds to a respective blockchain address of the plurality of blockchain addresses, and each transaction edge connects two respective address nodes corresponding to a first blockchain address and a second blockchain address involved in a respective transaction of the plurality of blockchain transactions; and
for each address node of at least a subset of the address nodes of the plurality of address nodes:
calculate a set of scoring features associated with the address node, wherein the set of scoring features is based on the graph data structure and at least one blockchain transaction of the plurality of blockchain transactions associated with the blockchain address;
determine a trust score for the blockchain address associated with the address node, wherein the trust score is based on a scoring model and the set of scoring features associated with the blockchain address, and the trust score indicates a likelihood that the blockchain address is involved in fraudulent transactions; and
update the graph data structure based on the trust score determined with respect to the blockchain address associated with the address node.
17. The system of claim 16 , wherein calculating the set of scoring features comprises,
calculating a number of transactions in which at least one blockchain address of the plurality of blockchain addresses is a receiver address, and
calculating a number of transactions in which at least one blockchain address of the plurality of blockchain addresses is a sender address.
18. The system of claim 16 , wherein calculating the set of scoring features comprises calculating an amount of funds transacted with at least one blockchain address of the plurality of blockchain addresses.
19. The system of claim 16 , wherein calculating the set of scoring features comprises,
calculating an amount of funds received by at least one blockchain address of the plurality of blockchain addresses, and
calculating an amount of funds sent by at least one blockchain address of the plurality of blockchain addresses.
20. The system of claim 16 , wherein the set of scoring features is based on a distance between at least one address node of the plurality of address nodes and at least one other node of the plurality of nodes that has been determined to be involved in fraudulent transactions.