阅读说明：本技术 一种数字货币溯源方法及系统 (digital currency tracing method and system ) 是由 谭庆丰 王学宾 高悦 崔翔 田志宏 于 2019-09-04 设计创作，主要内容包括：本发明实施例提供的一种数字货币溯源方法,通过提取数字货币交易信息中的关键信息特征以获取该数字货币的交易传播路径,并将这些交易传播路径作为数字货币的交易集合,然后将交易集合内的所有交易传播路径按照时间的先后顺序进行排序,得到排序在前的N条交易传播路径,并根据N条交易传播路径找出交易发起者,采用本发明提供的实施例,能够实现对特定区域的任意数字货币用户进行高效溯源分析,且溯源的精度高、实时性好。(according to the digital currency traceability method provided by the embodiment of the invention, the transaction propagation paths of the digital currency are obtained by extracting the key information features in the digital currency transaction information, the transaction propagation paths are used as the transaction set of the digital currency, then all the transaction propagation paths in the transaction set are sequenced according to the time sequence to obtain N transaction propagation paths sequenced at the front, and the transaction initiator is found out according to the N transaction propagation paths.)

1. a digital currency traceability method is characterized by comprising the following steps:

Extracting a first transaction ID in transaction information of first digital currency, acquiring transaction propagation paths of which the transaction IDs are the first transaction IDs according to the first transaction ID, and taking the transaction propagation paths as a first transaction set of the first digital currency;

Sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

Judging whether two or more than two transaction propagation paths have the same source IP address in the N transaction propagation paths;

If there is one such address, then the address is taken as the address of the transaction initiator in the first currency;

If a plurality of such addresses exist, the neighbor relation of the plurality of such addresses is calculated, and the node with the maximum number of neighbor nodes is used as the transaction initiator of the first currency.

2. The method according to claim 1, wherein the extracting a first transaction ID from the transaction information of the first digital currency, obtaining transaction propagation paths with the transaction ID as the first transaction ID according to the first transaction ID, and using the transaction propagation paths as a first transaction set of the first digital currency specifically includes:

Extracting a first transaction ID in the transaction information of the first digital currency according to the transaction information of the first digital currency; the transaction information comprises a source IP, a destination IP, a source port, a destination port, a transaction ID, time, a digital currency type and a transaction amount;

acquiring a transaction ID as a transaction propagation path of the first transaction ID according to the first transaction ID of the first digital currency;

and calculating the correlation between all transaction propagation paths with the transaction ID as the first transaction ID and a preset first real-time transaction network topological graph, excluding transaction propagation paths without correlation, obtaining transaction propagation paths with correlation with the first real-time transaction network topological graph, and taking the transaction propagation paths with correlation with the first real-time transaction network topological graph as a first transaction set of the first digital currency.

3. The digital currency traceability method according to claim 2, wherein the preset first real-time transaction network topology map is constructed by:

Identifying transaction information of the first digital currency according to the characteristics of the digital currency interaction protocol;

Detecting respective adjacent neighbor nodes through a plurality of probe nodes deployed in the first digital currency propagation path, and generating a first network structure of the first digital currency transaction according to node information of the plurality of neighbor nodes and transaction information of the digital currency;

and generating a first real-time transaction network topological graph formed by the first digital currency in a transaction propagation path according to the adjacency relation among the plurality of neighbor nodes, the first network structure and the transaction information of the first digital currency.

4. the digital currency traceability method of claim 3, further comprising:

If the source IP addresses of two or more than two transaction propagation paths are not the same address, constructing a neighbor node relationship graph according to the neighbor node relationship between the source IP addresses of the N transaction propagation paths, searching communication paths in the neighbor node relationship graph through the reverse direction to obtain all the communication paths, and judging whether all the communication paths have addresses to which all the source IP addresses point;

if there is one such address, then the address is taken as the address of the transaction initiator for the first digital currency;

If a plurality of such addresses exist, calculating a node of which the adjacent neighbor node points to a plurality of or all of the plurality of addresses simultaneously according to the first real-time transaction network topological graph and the plurality of such addresses, and taking the node as a transaction initiator of the first digital currency.

5. the method according to claim 4, wherein when the communication protocol of the first digital currency is in an encrypted state, extracting a first time window in the transaction information of the first digital currency, acquiring transaction propagation paths of which the time windows are the first time windows according to the first time window, and using the transaction propagation paths as a first transaction set of the first digital currency;

sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

Judging whether two or more than two transaction propagation paths have the same source IP address in the N transaction propagation paths;

if the source IP addresses of two or more than two transaction propagation paths are the same address, taking the address as the address of the transaction initiator of the first currency;

If the source IP addresses of a plurality of two or more than two transaction propagation paths are the same address, calculating the neighbor relation of the plurality of addresses, and taking the node with the maximum number of neighbor nodes as the transaction initiator of the first currency;

If the source IP addresses of two or more than two transaction propagation paths are not the same address, constructing a neighbor node relationship graph according to the neighbor node relationship between the source IP addresses of the N transaction propagation paths, searching communication paths in the neighbor node relationship graph through the reverse direction to obtain all the communication paths, and judging whether all the communication paths have addresses to which all the source IP addresses point;

if an address exists to which all the source IP addresses point, the address is used as the address of the transaction initiator of the first digital currency;

if a plurality of addresses to which all the source IP addresses point exist, calculating to obtain a node of which the adjacent neighbor nodes point to a plurality of or all the addresses according to the first real-time transaction network topological graph and the addresses, and taking the node as a transaction initiator of the first digital currency.

6. A digital currency traceability system, comprising: the system comprises a data acquisition module, a path generation module, a first judgment module, a first traceability module and a second traceability module;

the data acquisition module is used for extracting a first transaction ID in transaction information of first digital currency, acquiring transaction propagation paths of which the transaction IDs are the first transaction IDs according to the first transaction ID, and taking the transaction propagation paths as a first transaction set of the first digital currency;

The path generation module is used for sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

the first judging module is used for judging whether source IP addresses of two or more than two transaction propagation paths exist in the N transaction propagation paths and are the same;

the first tracing module is used for taking the address as the address of a transaction initiator of the first currency if the address exists;

and the second tracing module is used for calculating the neighbor relation of a plurality of addresses if the addresses exist, and taking the node with the maximum number of neighbor nodes as the transaction initiator of the first currency.

7. the digital currency traceability system of claim 6, wherein the data acquisition module comprises: the device comprises an information extraction unit, a path acquisition unit and a data processing unit;

the information extraction unit is used for extracting a first transaction ID in the transaction information of the first digital currency according to the transaction information of the first digital currency; the transaction information comprises a source IP, a destination IP, a source port, a destination port, a transaction ID, time, a digital currency type and a transaction amount;

the path acquisition unit is used for acquiring a transaction ID as a transaction propagation path of the first transaction ID according to the first transaction ID of the first digital currency;

the data processing unit is configured to calculate correlations between all transaction propagation paths with the transaction IDs as the first transaction ID and a preset first real-time transaction network topology map, exclude transaction propagation paths without correlations, obtain transaction propagation paths with correlations with the first real-time transaction network topology map, and use the transaction propagation paths with correlations with the first real-time transaction network topology map as a first transaction set of the first digital currency.

8. the digital currency traceability system of claim 7, wherein the preset first real-time transaction network topology is constructed by:

identifying transaction information of the first digital currency according to the characteristics of the digital currency interaction protocol;

detecting respective adjacent neighbor nodes through a plurality of probe nodes deployed in the first digital currency propagation path, and generating a first network structure of the first digital currency transaction according to node information of the plurality of neighbor nodes and transaction information of the digital currency;

And generating a first real-time transaction network topological graph formed by the first digital currency in a transaction propagation path according to the adjacency relation among the plurality of neighbor nodes, the first network structure and the transaction information of the first digital currency.

9. The digital currency traceability system of claim 8, further comprising: the source tracing system comprises a second judgment module, a third source tracing module and a fourth source tracing module;

the second judging module is used for searching communication paths in the neighbor node relation graph through the reverse direction after constructing the neighbor node relation graph according to the neighbor node relation between the source IP addresses of the N transaction propagation paths if the source IP addresses of the two or more transaction propagation paths are not the same address, obtaining all the communication paths, and judging whether all the communication paths have addresses pointed by all the source IP addresses;

the third tracing module is used for taking the address as the address of the transaction initiator of the first digital currency if the address exists;

And the fourth tracing module is configured to, if a plurality of such addresses exist, calculate a node in which an adjacent neighboring node points to a plurality of or all of the plurality of such addresses simultaneously according to the first real-time transaction network topology map and the plurality of such addresses, and use the node as a transaction initiator of the first digital currency.

10. the digital currency traceability system of claim 9, wherein when the communication protocol of the first digital currency is in an encrypted state, a first time window in the transaction information of the first digital currency is extracted, transaction propagation paths of which the time windows are the first time windows are obtained according to the first time window, and the transaction propagation paths are used as a first transaction set of the first digital currency;

Sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

judging whether two or more than two transaction propagation paths have the same source IP address in the N transaction propagation paths;

if the source IP addresses of two or more than two transaction propagation paths are the same address, taking the address as the address of the transaction initiator of the first currency;

if the source IP addresses of a plurality of two or more than two transaction propagation paths are the same address, calculating the neighbor relation of the plurality of addresses, and taking the node with the maximum number of neighbor nodes as the transaction initiator of the first currency;

if the source IP addresses of two or more than two transaction propagation paths are not the same address, constructing a neighbor node relationship graph according to the neighbor node relationship between the source IP addresses of the N transaction propagation paths, searching communication paths in the neighbor node relationship graph through the reverse direction to obtain all the communication paths, and judging whether all the communication paths have addresses to which all the source IP addresses point;

if an address exists to which all the source IP addresses point, the address is used as the address of the transaction initiator of the first digital currency;

if a plurality of addresses to which all the source IP addresses point exist, calculating to obtain a node of which the adjacent neighbor nodes point to a plurality of or all the addresses according to the first real-time transaction network topological graph and the addresses, and taking the node as a transaction initiator of the first digital currency.

Technical Field

The invention relates to the technical field of block chains, in particular to a digital currency traceability method.

background

Since the smart first proposed the bitcone concept in 2008, the economic value of digital currency and its blockchain technology has been increasing through more than ten years of development. The address of the digital currency is widely used by asymmetric encryption and a hash algorithm method, namely, a public key of a user is subjected to hash operation to generate a character string with a specific format as a public user account address to identify the user, and the address is identified by the random 'pseudonym' generation method, so that the user can utilize one or more random 'pseudonyms' to engage in various criminal activities such as underground black production, smuggling, money washing and the like in the internet and a dark network without worrying about the association with the real identity information of the user. This anonymous mechanism of addresses presents a significant challenge to combat illicit acquisition of underground black-yielding transactions, money laundering, and the like.

Traditional digital currency traceability generally adopts transaction diagram analysis and heuristic address clustering technology to identify a plurality of other bit addresses belonging to a certain specific address, however, the method can only identify the relation between the addresses and cannot trace true user identity information.

in addition, other technologies include a method of implanting a probe node in a digital currency network, researching a transaction information forwarding mechanism of a neighbor node at a network layer, and judging whether the probe node is an initial transaction initiating node by first forwarding transaction information. In the method, a large number of probe nodes need to be deployed, and the probe nodes need to become neighbor nodes of a specific digital currency address and are selected as next hop addresses for forwarding transactions; then, according to the judgment basis of the neighbor node as the first transaction node, the method needs to actively initiate transactions to the digital currency network for many times and continuously, and the cost is very high.

disclosure of Invention

the embodiment of the invention aims to provide a digital currency tracing method, which can trace the identity of a digital currency address in a specific area without actively initiating a transaction and deploying detection nodes in a large scale.

in order to achieve the above object, an embodiment of the present invention provides a digital currency tracing method, including the following steps:

extracting a first transaction ID in transaction information of first digital currency, acquiring transaction propagation paths of which the transaction IDs are the first transaction IDs according to the first transaction ID, and taking the transaction propagation paths as a first transaction set of the first digital currency;

sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

Judging whether two or more than two transaction propagation paths have the same source IP address in the N transaction propagation paths;

If there is one such address, then the address is taken as the address of the transaction initiator in the first currency;

if a plurality of such addresses exist, the neighbor relation of the plurality of such addresses is calculated, and the node with the maximum number of neighbor nodes is used as the transaction initiator of the first currency.

further, the extracting a first transaction ID in the transaction information of the first digital currency, obtaining transaction propagation paths with the transaction ID as the first transaction ID according to the first transaction ID, and taking the transaction propagation paths as a first transaction set of the first digital currency specifically includes:

Extracting a first transaction ID in the transaction information of the first digital currency according to the transaction information of the first digital currency; the transaction information comprises a source IP, a destination IP, a source port, a destination port, a transaction ID, time, a digital currency type and a transaction amount;

acquiring a transaction ID as a transaction propagation path of the first transaction ID according to the first transaction ID of the first digital currency;

and calculating the correlation between all transaction propagation paths with the transaction ID as the first transaction ID and a preset first real-time transaction network topological graph, excluding transaction propagation paths without correlation, obtaining transaction propagation paths with correlation with the first real-time transaction network topological graph, and taking the transaction propagation paths with correlation with the first real-time transaction network topological graph as a first transaction set of the first digital currency.

further, the preset first real-time transaction network topology map is constructed by the following method:

Identifying transaction information of the first digital currency according to the characteristics of the digital currency interaction protocol;

Detecting respective adjacent neighbor nodes through a plurality of probe nodes deployed in the first digital currency propagation path, and generating a first network structure of the first digital currency transaction according to node information of the plurality of neighbor nodes and transaction information of the digital currency;

and generating a first real-time transaction network topological graph formed by the first digital currency in a transaction propagation path according to the adjacency relation among the plurality of neighbor nodes, the first network structure and the transaction information of the first digital currency.

further, the digital currency tracing method further includes:

If the source IP addresses of two or more than two transaction propagation paths are not the same address, constructing a neighbor node relationship graph according to the neighbor node relationship between the source IP addresses of the N transaction propagation paths, searching communication paths in the neighbor node relationship graph through the reverse direction to obtain all the communication paths, and judging whether all the communication paths have addresses to which all the source IP addresses point;

If there is one such address, then the address is taken as the address of the transaction initiator for the first digital currency;

If a plurality of such addresses exist, calculating a node of which the adjacent neighbor node points to a plurality of or all of the plurality of addresses simultaneously according to the first real-time transaction network topological graph and the plurality of such addresses, and taking the node as a transaction initiator of the first digital currency.

Further, when the communication protocol of the first digital currency is in an encryption state, extracting a first time window in the transaction information of the first digital currency, acquiring transaction propagation paths of which the time windows are the first time windows according to the first time window, and taking the transaction propagation paths as a first transaction set of the first digital currency;

sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

judging whether two or more than two transaction propagation paths have the same source IP address in the N transaction propagation paths;

If the source IP addresses of two or more than two transaction propagation paths are the same address, taking the address as the address of the transaction initiator of the first currency;

if the source IP addresses of a plurality of two or more than two transaction propagation paths are the same address, calculating the neighbor relation of the plurality of addresses, and taking the node with the maximum number of neighbor nodes as the transaction initiator of the first currency;

If the source IP addresses of two or more than two transaction propagation paths are not the same address, constructing a neighbor node relationship graph according to the neighbor node relationship between the source IP addresses of the N transaction propagation paths, searching communication paths in the neighbor node relationship graph through the reverse direction to obtain all the communication paths, and judging whether all the communication paths have addresses to which all the source IP addresses point;

if an address exists to which all the source IP addresses point, the address is used as the address of the transaction initiator of the first digital currency;

if a plurality of addresses to which all the source IP addresses point exist, calculating to obtain a node of which the adjacent neighbor nodes point to a plurality of or all the addresses according to the first real-time transaction network topological graph and the addresses, and taking the node as a transaction initiator of the first digital currency.

the embodiment of the invention also provides a digital currency traceability system, which comprises: the system comprises a data acquisition module, a path generation module, a first judgment module, a first traceability module and a second traceability module;

The data acquisition module is used for extracting a first transaction ID in transaction information of first digital currency, acquiring transaction propagation paths of which the transaction IDs are the first transaction IDs according to the first transaction ID, and taking the transaction propagation paths as a first transaction set of the first digital currency;

The path generation module is used for sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

the first judging module is used for judging whether source IP addresses of two or more than two transaction propagation paths exist in the N transaction propagation paths and are the same;

the first tracing module is used for taking the address as the address of a transaction initiator of the first currency if the address exists;

and the second tracing module is used for calculating the neighbor relation of a plurality of addresses if the addresses exist, and taking the node with the maximum number of neighbor nodes as the transaction initiator of the first currency.

further, the data obtaining module includes: the device comprises an information extraction unit, a path acquisition unit and a data processing unit;

the information extraction unit is used for extracting a first transaction ID in the transaction information of the first digital currency according to the transaction information of the first digital currency; the transaction information comprises a source IP, a destination IP, a source port, a destination port, a transaction ID, time, a digital currency type and a transaction amount;

the path acquisition unit is used for acquiring a transaction ID as a transaction propagation path of the first transaction ID according to the first transaction ID of the first digital currency;

the data processing unit is configured to calculate correlations between all transaction propagation paths with the transaction IDs as the first transaction ID and a preset first real-time transaction network topology map, exclude transaction propagation paths without correlations, obtain transaction propagation paths with correlations with the first real-time transaction network topology map, and use the transaction propagation paths with correlations with the first real-time transaction network topology map as a first transaction set of the first digital currency.

Further, the preset first real-time transaction network topology map is constructed by the following method:

identifying transaction information of the first digital currency according to the characteristics of the digital currency interaction protocol;

detecting respective adjacent neighbor nodes through a plurality of probe nodes deployed in the first digital currency propagation path, and generating a first network structure of the first digital currency transaction according to node information of the plurality of neighbor nodes and transaction information of the digital currency;

And generating a first real-time transaction network topological graph formed by the first digital currency in a transaction propagation path according to the adjacency relation among the plurality of neighbor nodes, the first network structure and the transaction information of the first digital currency.

further, the digital currency traceability system further comprises: the source tracing system comprises a second judgment module, a third source tracing module and a fourth source tracing module;

the second judging module is used for searching communication paths in the neighbor node relation graph through the reverse direction after constructing the neighbor node relation graph according to the neighbor node relation between the source IP addresses of the N transaction propagation paths if the source IP addresses of the two or more transaction propagation paths are not the same address, obtaining all the communication paths, and judging whether all the communication paths have addresses pointed by all the source IP addresses;

The third tracing module is used for taking the address as the address of the transaction initiator of the first digital currency if the address exists;

and the fourth tracing module is configured to, if a plurality of such addresses exist, calculate a node in which an adjacent neighboring node points to a plurality of or all of the plurality of such addresses simultaneously according to the first real-time transaction network topology map and the plurality of such addresses, and use the node as a transaction initiator of the first digital currency.

further, when the communication protocol of the first digital currency is in an encryption state, extracting a first time window in the transaction information of the first digital currency, acquiring transaction propagation paths of which the time windows are the first time windows according to the first time window, and taking the transaction propagation paths as a first transaction set of the first digital currency;

sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

judging whether two or more than two transaction propagation paths have the same source IP address in the N transaction propagation paths;

If the source IP addresses of two or more than two transaction propagation paths are the same address, taking the address as the address of the transaction initiator of the first currency;

If the source IP addresses of a plurality of two or more than two transaction propagation paths are the same address, calculating the neighbor relation of the plurality of addresses, and taking the node with the maximum number of neighbor nodes as the transaction initiator of the first currency;

if the source IP addresses of two or more than two transaction propagation paths are not the same address, constructing a neighbor node relationship graph according to the neighbor node relationship between the source IP addresses of the N transaction propagation paths, searching communication paths in the neighbor node relationship graph through the reverse direction to obtain all the communication paths, and judging whether all the communication paths have addresses to which all the source IP addresses point;

if an address exists to which all the source IP addresses point, the address is used as the address of the transaction initiator of the first digital currency;

if a plurality of addresses to which all the source IP addresses point exist, calculating to obtain a node of which the adjacent neighbor nodes point to a plurality of or all the addresses according to the first real-time transaction network topological graph and the addresses, and taking the node as a transaction initiator of the first digital currency.

compared with the prior art, the method has the following beneficial effects:

the digital currency tracing method provided by the embodiment of the invention obtains the transaction propagation paths of which the transaction IDs are the first transaction IDs by extracting the first transaction IDs of the first digital currency, takes the transaction propagation paths as the first transaction set of the first digital currency, sorts all the transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths which are sorted in the front, judges whether source IP addresses of two or more transaction propagation paths exist in the N transaction propagation paths are the same address, if so, takes the address as the address of a transaction initiator of the first currency, if so, calculates the neighbor relations of a plurality of such addresses, takes the node with the largest number of neighbor nodes as the transaction initiator of the first currency, and can realize the high-efficiency tracing analysis of any digital currency user in a specific area, and the tracing precision is high and the real-time performance is good.

drawings

FIG. 1 is a flow chart of an embodiment of a digital currency traceability method provided by the present invention;

Fig. 2 is a schematic structural diagram of an embodiment of a digital currency traceability system provided by the present invention.

Detailed Description

the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

referring to fig. 1, fig. 1 is a schematic flowchart illustrating a digital currency traceability method according to an embodiment of the present invention; the embodiment of the invention provides a digital currency traceability method, which comprises the steps of S1-S5;

s1, extracting a first transaction ID in the transaction information of the first digital currency, acquiring transaction propagation paths of which the transaction IDs are the first transaction IDs according to the first transaction ID, and taking the transaction propagation paths as a first transaction set of the first digital currency.

it should be noted that the digital currency tracing method provided by the present invention is suitable for tracing the source of any digital encryption currency, such as bitcoin, etherhouse, EOS, rale currency, etc., and is a general technical architecture, wherein a traffic analysis device is deployed on an ASes or IXPs border router, and the transaction information of the digital currency (such as bitcoin, etherhouse, EOS, etc.) flowing through the device can be identified through the characteristics of a digital currency interaction protocol.

Since the transaction information includes the source IP, the destination IP, the source port, the destination port, the transaction ID, the time, the digital currency type, and the transaction amount, the set of transaction propagation paths of the first digital currency can be screened by characterizing one or more key information of the first digital currency, including the source IP, the destination IP, the source port, the destination port, the transaction ID, the time, the digital currency type, and the transaction amount.

in this embodiment of the present invention, the step S1 specifically includes: extracting a first transaction ID in the transaction information of the first digital currency according to the transaction information of the first digital currency; acquiring a transaction ID as a transaction propagation path of the first transaction ID according to the first transaction ID of the first digital currency; and calculating the correlation between all transaction propagation paths with the transaction ID as the first transaction ID and a preset first real-time transaction network topological graph, excluding transaction propagation paths without correlation, obtaining transaction propagation paths with correlation with the first real-time transaction network topological graph, and taking the transaction propagation paths with correlation with the first real-time transaction network topological graph as a first transaction set of the first digital currency.

It should be noted that, by calculating the correlation between the transaction propagation path and the transaction network topology, the transaction propagation path with low correlation is generally eliminated, and a set of the pruned transaction propagation paths, that is, a set suspected to be derived from the transaction initiator, is obtained.

preferably, the preset first real-time transaction network topology is constructed by the following method: identifying transaction information of the first digital currency according to the characteristics of the digital currency interaction protocol; detecting respective adjacent neighbor nodes through a plurality of probe nodes deployed in the first digital currency propagation path, and generating a first network structure of the first digital currency transaction according to node information of the plurality of neighbor nodes and transaction information of the digital currency; and generating a first real-time transaction network topological graph formed by the first digital currency in a transaction propagation path according to the adjacency relation among the plurality of neighbor nodes, the first network structure and the transaction information of the first digital currency.

in this embodiment, the network structure of the digital currency is detected by a combination of active detection and passive traffic analysis. Specifically, the method comprises the following steps: firstly, deploying a plurality of probe nodes, and speculating neighbor nodes of a target node in an active detection mode; the network-wide transaction propagation information is then monitored by flow analysis equipment deployed at the border ASes/ISP, as well as probe nodes. Such as source IP, destination IP, source port, destination port, transaction ID, time, digital currency type, transaction amount, etc.

And constructing a real-time transaction network topological graph of the digital currency through actively sniffing the presumed relationship of the neighbor nodes, monitoring dynamic transaction propagation information through the probe nodes and the flow analysis equipment, and through the adjacency relationship of the nodes and the transaction propagation path of the digital currency.

And S2, sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front.

in the embodiment of the present invention, the transaction propagation path monitored by the flow analysis device includes three conditions: the first case is that the transaction initiator directly forwards, the second case is that the transaction initiator's neighbor node forwards, and the third case is that the second-order neighbor node forwards. Therefore, according to the characteristics of the digital currency network structure, the forwarding delay and the mechanism of transaction propagation, in general, directly forwarded transactions or transactions forwarded by neighbor nodes are seen first by the flow analysis device, and transactions forwarded by second-order neighbors are seen later. The previous N transaction propagations are therefore typically forwarded directly, or forwarded by a neighboring node. In this embodiment, N ≧ 1, and N is taken to be 30.

And S3, judging whether the source IP addresses of two or more than two transaction propagation paths in the N transaction propagation paths are the same address.

If there is one such address, S4 sets the address as the address of the transaction initiator in the first currency.

If there are a plurality of such addresses, S5 calculates the neighbor relation of the plurality of such addresses, and takes the node with the largest number of neighbor nodes as the transaction initiator of the first currency.

as a preferred embodiment of the present invention, the method for tracing to the source of digital currency further includes: if the source IP addresses of two or more than two transaction propagation paths are not the same address, constructing a neighbor node relationship graph according to the neighbor node relationship between the source IP addresses of the N transaction propagation paths, searching communication paths in the neighbor node relationship graph through the reverse direction to obtain all the communication paths, and judging whether all the communication paths have addresses to which all the source IP addresses point;

If there is one such address, then the address is taken as the address of the transaction initiator for the first digital currency;

If a plurality of such addresses exist, calculating a node of which the adjacent neighbor node points to a plurality of or all of the plurality of addresses simultaneously according to the first real-time transaction network topological graph and the plurality of such addresses, and taking the node as a transaction initiator of the first digital currency.

as another preferred embodiment of the present invention, when the communication protocol of the first digital currency is in an encrypted state, extracting a first time window in the transaction information of the first digital currency, acquiring transaction propagation paths with the time window being the first time window according to the first time window, and using the transaction propagation paths as a first transaction set of the first digital currency; sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1;

Judging whether two or more than two transaction propagation paths have the same source IP address in the N transaction propagation paths; if the source IP addresses of two or more than two transaction propagation paths are the same address, taking the address as the address of the transaction initiator of the first currency; if the source IP addresses of a plurality of two or more than two transaction propagation paths are the same address, calculating the neighbor relation of the plurality of addresses, and taking the node with the maximum number of neighbor nodes as the transaction initiator of the first currency; if the source IP addresses of two or more than two transaction propagation paths are not the same address, constructing a neighbor node relationship graph according to the neighbor node relationship between the source IP addresses of the N transaction propagation paths, searching communication paths in the neighbor node relationship graph through the reverse direction to obtain all the communication paths, and judging whether all the communication paths have addresses to which all the source IP addresses point; if an address exists to which all the source IP addresses point, the address is used as the address of the transaction initiator of the first digital currency; if a plurality of addresses to which all the source IP addresses point exist, calculating to obtain a node of which the adjacent neighbor nodes point to a plurality of or all the addresses according to the first real-time transaction network topological graph and the addresses, and taking the node as a transaction initiator of the first digital currency.

it should be noted that, if a communication protocol of a digital currency, such as an ethernet is encrypted, information such as transaction ID information and transaction amount cannot be obtained, the present invention considers a certain time window as a key feature, and thus obtains a transaction propagation path set with the same time window of the whole network.

referring to fig. 2, fig. 2 is a schematic structural diagram of an embodiment of a digital currency traceability system provided by the present invention, including: the system comprises a data acquisition module, a path generation module, a first judgment module, a first traceability module and a second traceability module;

The data acquisition module is used for extracting a first transaction ID in transaction information of first digital currency, acquiring transaction propagation paths of which the transaction IDs are the first transaction IDs according to the first transaction ID, and taking the transaction propagation paths as a first transaction set of the first digital currency; the path generation module is used for sequencing all transaction propagation paths in the first transaction set according to the time sequence to obtain N transaction propagation paths sequenced at the front; wherein N is more than or equal to 1; the first judging module is used for judging whether source IP addresses of two or more than two transaction propagation paths exist in the N transaction propagation paths and are the same; the first tracing module is used for taking the address as the address of a transaction initiator of the first currency if the address exists; and the second tracing module is used for calculating the neighbor relation of a plurality of addresses if the addresses exist, and taking the node with the maximum number of neighbor nodes as the transaction initiator of the first currency.

In this embodiment, the data obtaining module includes: the device comprises an information extraction unit, a path acquisition unit and a data processing unit;

the information extraction unit is used for extracting a first transaction ID in the transaction information of the first digital currency according to the transaction information of the first digital currency; the transaction information comprises a source IP, a destination IP, a source port, a destination port, a transaction ID, time, a digital currency type and a transaction amount;

The path acquisition unit is used for acquiring a transaction ID as a transaction propagation path of the first transaction ID according to the first transaction ID of the first digital currency;

the data processing unit is configured to calculate correlations between all transaction propagation paths with the transaction IDs as the first transaction ID and a preset first real-time transaction network topology map, exclude transaction propagation paths without correlations, obtain transaction propagation paths with correlations with the first real-time transaction network topology map, and use the transaction propagation paths with correlations with the first real-time transaction network topology map as a first transaction set of the first digital currency.

the preset first real-time transaction network topological graph is constructed by the following method: identifying transaction information of the first digital currency according to the characteristics of the digital currency interaction protocol; detecting respective adjacent neighbor nodes through a plurality of probe nodes deployed in the first digital currency propagation path, and generating a first network structure of the first digital currency transaction according to node information of the plurality of neighbor nodes and transaction information of the digital currency; and generating a first real-time transaction network topological graph formed by the first digital currency in a transaction propagation path according to the adjacency relation among the plurality of neighbor nodes, the first network structure and the transaction information of the first digital currency.

as a preferred embodiment of the present invention, the digital currency traceability system of the embodiment of the present invention further includes: the source tracing system comprises a second judgment module, a third source tracing module and a fourth source tracing module;

the second judging module is used for searching communication paths in the neighbor node relation graph through the reverse direction after constructing the neighbor node relation graph according to the neighbor node relation between the source IP addresses of the N transaction propagation paths if the source IP addresses of the two or more transaction propagation paths are not the same address, obtaining all the communication paths, and judging whether all the communication paths have addresses pointed by all the source IP addresses; the third tracing module is used for taking the address as the address of the transaction initiator of the first digital currency if the address exists; and the fourth tracing module is configured to, if a plurality of such addresses exist, calculate a node in which an adjacent neighboring node points to a plurality of or all of the plurality of such addresses simultaneously according to the first real-time transaction network topology map and the plurality of such addresses, and use the node as a transaction initiator of the first digital currency.

preferably, when the communication protocol of the first digital currency is in an encrypted state, a first time window in the transaction information of the first digital currency is extracted, transaction propagation paths with the time window as the first time window are acquired according to the first time window, and the transaction propagation paths are used as a first transaction set of the first digital currency.

To sum up, the embodiment of the present invention provides a digital currency tracing method, which includes extracting a first transaction ID of a first digital currency, obtaining transaction propagation paths with the transaction ID as the first transaction ID, using the transaction propagation paths as a first transaction set of the first digital currency, sorting all transaction propagation paths in the first transaction set according to a time sequence to obtain N transaction propagation paths sorted in the front, determining whether source IP addresses of two or more transaction propagation paths in the N transaction propagation paths are the same address, if one transaction propagation path exists, using the address as an address of a transaction initiator of the first currency, if a plurality of transaction propagation paths exist, calculating a neighbor relation of a plurality of such addresses, using a node with the largest number of neighbor nodes as a transaction initiator of the first currency, and thus, implementing efficient tracing analysis on any digital currency user in a specific area, and the tracing precision is high and the real-time performance is good.

the embodiment provided by the invention has the following beneficial effects:

(1) The real-time transaction network topological graph of the digital currency is constructed through a master method and a slave method, and the accuracy of source tracing analysis can be improved.

(2) through the real-time transaction network topological graph and the transaction propagation information, whether a certain specific transaction is a transaction initiator or not can be efficiently and accurately inferred, and the working efficiency of digital currency traceability is greatly improved.

While the foregoing is directed to the preferred embodiment of the present invention, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention.