Patent Description:
The present disclosure relates to providing safeguards against fraud in blockchain transactions.

Cryptocurrencies (e.g., Bitcoin) may provide a medium of exchange for pseudonymous/anonymous cryptocurrency transactors. Cryptocurrencies may operate on a decentralized network of computing devices that each operate according to a blockchain protocol. The decentralized network may control a blockchain transaction ledger that includes a list of transactions between different blockchain addresses. The transactions on the decentralized network may be verified through cryptography. Transactors may interact with the decentralized network using wallet applications. In some cases, the transactors may interact with the decentralized network via a digital currency exchange.

The following documents are relevant prior art in the field: <CIT>, <CIT>, <CIT>, <CIT>.

In one example, the present disclosure is directed to a method comprising acquiring, at a server, blockchain data from a blockchain network. The blockchain data includes a plurality of transactions between a plurality of blockchain addresses. The method further comprises labeling a set of the blockchain addresses as fraudulent and generating a graph data structure based on the blockchain data. The graph data structure includes nodes for the blockchain addresses and includes edges between the nodes for blockchain transactions. The method further comprises calculating a set of scoring features for each blockchain address. Each set of scoring features includes a graph-based scoring feature. Calculating the graph-based scoring feature includes calculating a number of transactions associated with the blockchain address in the graph data structure. The method further comprises generating a scoring model using sets of scoring features for the blockchain addresses that are labeled as fraudulent and generating a trust score for each of the blockchain addresses using the scoring features associated with the blockchain addresses and the scoring model. The trust score indicates a likelihood that the blockchain address is involved in fraudulent activity. The method further comprises receiving a trust request for a specified blockchain address from a requesting device and sending the trust score for the specified blockchain address to the requesting device.

In one example, the present disclosure is directed to a system comprising one or more processing units that execute computer-readable instructions that cause the one or more processing units to acquire blockchain data from a blockchain network. The blockchain data includes a plurality of transactions between a plurality of blockchain addresses. The one or more processing units are configured to label a set of the blockchain addresses as fraudulent and generate a graph data structure based on the blockchain data. The graph data structure includes nodes for the blockchain addresses and includes edges between the nodes for blockchain transactions. The one or more processing units are configured to calculate a set of scoring features for each blockchain address. Each set of scoring features includes a graph-based scoring feature. Calculating the graph-based scoring feature includes calculating a number of transactions associated with the blockchain address in the graph data structure. The one or more processing units are configured to generate a scoring model using sets of scoring features for the blockchain addresses that are labeled as fraudulent and generate a trust score for each of the blockchain addresses using the scoring features associated with the blockchain addresses and the scoring model. The trust score indicates a likelihood that the blockchain address is involved in fraudulent activity. The one or more processing units are configured to receive a trust request for a specified blockchain address from a requesting device and send the trust score for the specified blockchain address to the requesting device.

The present disclosure will become more fully understood from the detailed description and the accompanying drawings.

Although cryptocurrencies have experienced growth, the mainstream utility of cryptocurrencies as a medium of exchange may be more limited due to lack of payer protections. For example, cryptocurrency funds sent to a fraudulent party may not be readily recovered. The trust system <NUM> of the present disclosure generates trust scores for cryptocurrency transactors. The trust scores can offer cryptocurrency transactors a safeguard against fraud while preserving user anonymity and autonomy. The trust scores may provide a baseline level of trust upon which other security layers can be built, including cryptocurrency payment insurance, protection, and restitution (e.g., see <FIG>).

A trust system <NUM> (e.g., a server) generates trust scores for cryptocurrency transactors. For example, for a cryptocurrency based on blockchain technology, the trust system <NUM> can generate trust scores for different blockchain addresses that interact on the blockchain. The trust system <NUM> may determine the trust scores based on data retrieved from various data sources along with blockchain data upon which the cryptocurrency is based. A trust score may be a number (e.g., a decimal or integer) that indicates a likelihood that the blockchain address is involved in fraudulent activity. Put another way, a trust score can represent the propensity of a blockchain address to be involved with fraudulent activity.

A cryptocurrency transactor can request trust scores from the trust system <NUM> before engaging in a blockchain transaction in which funds (e.g., blockchain tokens) are transacted on the blockchain. In general, a transactor can use a trust score to determine whether the blockchain address with which they are transacting is trustworthy. For example, a transactor that intends to send funds to a receiving party may request a trust score for the receiving party. In this example, the transactor can use the trust score for the intended receiver in order to evaluate the likelihood that the intended receiver is a fraudulent party.

Transactors can use trust scores to take a variety of actions. For example, transactors may use trust scores to determine whether to proceed with or cancel a blockchain transaction. As another example, transactors (e.g., digital exchanges) can use trust scores to determine whether to insure a transaction (e.g., see <FIG>). As another example, organizations can use trust scores to decide whether to accept funds from a blockchain address. As such, the trust scores described herein can help protect transactors from falling victim to fraud or from receiving fraudulent funds. Note that the trust scores inform the transactors of the degree to which any cryptocurrency address may be trusted without requiring the transactor to know the identity of the party behind the address. As such, the trust scores may preserve a transactor anonymity.

<FIG> illustrates an example trust system <NUM> in communication with cryptocurrency transactor computing devices <NUM>, <NUM>, <NUM> (hereinafter "transactor computing devices") via a network <NUM>. The network <NUM> may include various types of computer networks, such as a local area network (LAN), wide area network (WAN), and/or the Internet. The trust system <NUM> may include one or more computing devices (e.g., one or more server computing devices). The transactor computing devices include computing devices that can interact with the trust system <NUM>. Example transactor computing devices may include user transactor devices <NUM>, such as smartphones, tablets, laptop computers, desktop computers, or other computing devices. A user transactor device <NUM> may include an operating system <NUM> and a plurality of applications, such as a web browser application <NUM> and additional applications <NUM>.

The user transactor device <NUM> can include a transaction application <NUM> that can transact with the blockchain network <NUM> to perform blockchain transactions. The transaction application <NUM> can also request trust scores from the trust system <NUM>. Example transaction applications may be referred to as "wallet applications. " For example, the transaction application <NUM> may be referred to as a "decentralized wallet," as there may be no centralized server-side components.

Additional example transactor devices may be included in intermediate transaction systems <NUM>. An intermediate transaction system <NUM> (e.g., one or more server computing devices) may communicate with the blockchain network <NUM>, user transactor devices <NUM>, and the trust system <NUM>. An intermediate transaction system <NUM> can perform cryptocurrency transactions on behalf of the user transactor devices <NUM>. The intermediate transaction system <NUM> can also acquire trust scores from the trust system <NUM> on behalf of the user transactor devices <NUM>. In some implementations, the intermediate transaction system <NUM> can provide a user interface for the user transactor devices <NUM> (e.g., via a web-based interface and/or an installed transaction application). An example intermediate transaction system may include a digital currency exchange (e.g., Coinbase, Inc. In some implementations, exchanges may be decentralized.

Additional example transactor devices may be included in automated transaction systems <NUM>. An automated transaction system <NUM> (e.g., one or more server computing devices) may communicate with the trust system <NUM> and the blockchain network <NUM>. Example automated transaction systems <NUM> may include payment systems, such as a payment system or gateway that makes recurring payments (e.g., Stripe, Inc. or Plaid Inc.

The transactor devices <NUM>, <NUM>, <NUM> can engage in transactions on the blockchain network <NUM>. A blockchain network <NUM> may be formed by a network of computing devices that each operate according to a blockchain protocol <NUM>. The blockchain network <NUM> may control a blockchain transaction ledger <NUM> (hereinafter "blockchain ledger <NUM>"). The blockchain ledger <NUM> includes a list of transactions between different blockchain addresses. The blockchain ledger <NUM> may also include additional data, such as transaction metadata. Example blockchain networks may include, but are not limited to, Bitcoin, Ethereum, etc. Although a single blockchain network <NUM> is illustrated in <FIG>, the trust system <NUM> can provide trust scores for addresses on multiple different blockchain networks using the techniques described herein.

A blockchain ledger <NUM> may include blockchain addresses that identify transactors on the blockchain network <NUM>. A transactor may refer to a party that controls transactions for a blockchain address. For example, a transactor may include an individual or an organization, such as a business, a non-governmental organization, or a decentralized autonomous organization. A transactor can control one or more blockchain addresses on a single blockchain network. A transactor can also have one or more blockchain addresses on different blockchain networks.

A transactor can initiate a blockchain transaction in which the transactor's blockchain address sends/receives funds to/from another blockchain address. A blockchain address that sends funds to another blockchain address may be referred to herein as a "blockchain sender address" or a "sender address. " The blockchain address that receives funds may be referred to herein as a "blockchain receiver address" or a "receiver address.

The transactor devices <NUM>, <NUM>, <NUM> can send trust requests <NUM> to the trust system <NUM> and receive trust responses <NUM> from the trust system <NUM> (e.g., see <FIG>). The trust request <NUM> may indicate one or more blockchain addresses for which the transactor would like a trust report (e.g., one or more trust scores). In some implementations, the trust request <NUM> can include a request payment, such as a blockchain token and/or fiat currency (e.g., United States Dollars). The request payment may be collected by the owner/operator of the trust system <NUM> as payment for providing the trust score(s).

In one example, a transactor device <NUM>, <NUM>, <NUM> can send a trust request <NUM> to the trust system <NUM> and receive a trust response <NUM> (e.g., trust report) from the trust system <NUM>. The transactor device <NUM>, <NUM>, <NUM> and trust system <NUM> may communicate via an application programming interface (API). The trust request <NUM> may include a blockchain address for the transactor on the other side of the transaction. For example, a trust request from a sender may request a trust report for the receiver's blockchain address. The sender may make a decision based on the received trust report, such as whether to engage in the blockchain transaction with the receiver.

<FIG> illustrate interactions between different transactor devices/systems <NUM>, <NUM>, <NUM>, the blockchain network <NUM>, and the trust system <NUM>. In <FIG>, the user transactor device <NUM> includes a transaction application <NUM> (e.g., a wallet application) that transacts with the blockchain network <NUM>. The transaction application <NUM> includes a trust request module <NUM> that interfaces with the trust system <NUM>. For example, the trust request module <NUM> can generate the trust request <NUM> (e.g., a web request). The trust request module <NUM> can also receive the trust response <NUM> from the trust system <NUM>. In some implementations, the trust request module <NUM> can generate a graphical user interface (GUI) that the user may interact with in order to send the trust request <NUM> and view the trust report (e.g., see <FIG>).

In <FIG>, a transactor device <NUM> can transact on the blockchain network <NUM> via an intermediate transaction system <NUM>. For example, in <FIG>, the transactor device <NUM> can include a web browser application <NUM> that interacts with the intermediate transaction system <NUM>. The intermediate transaction system <NUM> (e.g., a web server) can provide an interface to the web browser <NUM> for transacting on the blockchain network <NUM>. The intermediate transaction system <NUM> may also provide an interface (e.g., a web-based interface) for the user to select whether the user wants a trust report before engaging in the blockchain transaction.

In <FIG>, an automated transaction system <NUM> controls transactions on the blockchain network <NUM>. The automated transaction system <NUM> can also request trust reports from the trust system <NUM>. In some implementations, the transactions engaged in by the automated transaction system may depend on the trust scores reported by the trust system. For example, the automated transaction system can engage in transactions if the trust score indicates that the address is not fraudulent.

Although devices/systems <NUM>, <NUM>, <NUM> may make a trust request <NUM> in order to receive trust scores before making a blockchain transaction, in some implementations, other devices/systems may request trust scores in other scenarios. For example, compliance officers at an exchange may request trust scores for compliance reasons.

Referring back to <FIG>, the environment includes data sources <NUM> that the trust system <NUM> may use to determine whether blockchain addresses are fraudulent. Example data sources <NUM> described herein include fraud data sources and custody data sources.

<FIG> illustrate aspects of the trust system <NUM>. <FIG> illustrates an example trust system <NUM>. <FIG> is a method that describes operation of the trust system <NUM> illustrated in <FIG>. <FIG> illustrates data acquisition and processing of fraud and custody data sources. <FIG> illustrates acquisition and processing of blockchain data. <FIG> illustrate generation and processing of a blockchain graph data structure. <FIG> illustrates scoring feature generation and scoring model generation. <FIG> illustrates the generation of trust scores for a blockchain address using a scoring model and scoring features for the blockchain address. <FIG> illustrate aspects of a user transactor device communicating with the trust system. <FIG> illustrates the use of a trust system for a payment insurance application.

Referring to <FIG>, the trust system <NUM> acquires and processes a variety of data described herein. The trust system <NUM> includes a trust system data store <NUM> that can store data for a plurality of blockchain addresses. The data associated with a single blockchain address is illustrated herein as a blockchain address record <NUM>. The trust system data store <NUM> may include a plurality of such blockchain address records <NUM>, each for a different blockchain address. Each blockchain address record <NUM> can include a blockchain address <NUM> that uniquely identifies the record. The blockchain address record <NUM> described herein represents data stored in the trust system <NUM>. The trust system <NUM> may include a variety of different data structures that are used to implement the data. Accordingly, the blockchain address record <NUM> may be implemented using one or more different data structures than explicitly illustrated herein.

<FIG> is a method that describes operation of the trust system <NUM> illustrated in <FIG>. In block <NUM>, the data acquisition and processing module <NUM> acquires and processes a variety of types of data <NUM>, such as custody data and fraud data (e.g., see <FIG>). The data acquisition and processing module <NUM> may store custody and fraud data <NUM> related to a blockchain address in the blockchain address record <NUM>. The data acquisition and processing module <NUM> may also generate a fraud label <NUM> that indicates whether the blockchain address is likely fraudulent based on the acquired fraud data.

In block <NUM>, the blockchain acquisition and processing module <NUM> acquires and processes blockchain data (e.g., the blockchain ledger <NUM>) (e.g., see <FIG>). The blockchain acquisition and processing module <NUM> may store raw and processed blockchain data <NUM> relevant to a blockchain address in the blockchain address record <NUM>. In block <NUM>, the graph generation and processing module <NUM> generates a blockchain graph data structure based on the blockchain data (e.g., see <FIG>). The blockchain graph data structure may be stored in the graph data store <NUM>. The graph generation and processing module <NUM> may also process the graph to determine one or more graph-based values <NUM> (e.g., importance values) that may be used to generate trust scores.

In block <NUM>, the feature generation module <NUM> generates scoring features <NUM> for blockchain addresses (e.g., see <FIG>). In block <NUM>, the scoring model generation module <NUM> generates one or more scoring models based on the scoring features and other data (e.g., labeled fraud data). The one or more scoring models may be stored in the scoring model data store <NUM>. In block <NUM>, the trust score generation module <NUM> generates one or more trust scores <NUM> for blockchain addresses using one or more scoring models and the scoring features associated with the blockchain addresses (e.g., see <FIG>).

In block <NUM>, the transactor interface module <NUM> receives a trust request <NUM> for a blockchain address from a requesting device. In block <NUM>, the transactor interface module <NUM> sends a trust response <NUM> including a trust score to the requesting device. The transactor interface module <NUM> may store data related to the requests and responses in the request data <NUM> of the blockchain address record <NUM>.

Detailed examples of the various trust system modules and data stores are now described with respect to <FIG> and <FIG>. <FIG> and <FIG> may illustrate subsets of the modules and data stores included in the trust system <NUM> (e.g., as illustrated in <FIG>). Various modules and data stores have been omitted from <FIG> and <FIG> for illustration purposes only. For example, the various modules and data stores have been omitted to focus on the functionality associated with the modules and data stores that are illustrated in <FIG> and <FIG>.

Referring to <FIG>, the data acquisition and processing module <NUM> includes a data acquisition module <NUM>-<NUM> that acquires data from the fraud and custody data sources <NUM>. The data acquisition and processing module <NUM> also includes a data processing module <NUM>-<NUM> that processes the acquired data. The raw and processed data <NUM> can be stored in the trust system data store <NUM>. The data acquisition module <NUM>-<NUM> can acquire data in a variety of ways. In some implementations, the data acquisition module <NUM>-<NUM> can acquire curated data, such as curated data provided by partners/customers of the trust system <NUM>. In some cases, the owner/operator of the trust system <NUM> may purchase curated data. In some cases, the operator of the trust system <NUM> can user peer-reviewed structured data.

In some implementations, the data acquisition module <NUM>-<NUM> may be configured to automatically acquire data (e.g., crawl/scrape websites). For example, the data acquisition module <NUM>-<NUM> may be configured to do targeted data acquisition, such as acquiring data for specific social media accounts. As another example, the data acquisition module <NUM>-<NUM> may perform more general data acquisition, such as more general crawling/scraping of sites.

The data acquisition module <NUM>-<NUM> can acquire custody data from custody data sources <NUM>-<NUM>. Custody data may indicate the party that owns/controls the blockchain address (e.g., the keys). Example parties that may take custody of blockchain addresses may include, but are not limited to, exchanges, wallets, and banks. In some implementations, the custody sources <NUM>-<NUM> can provide the custody data to the trust system <NUM>.

In some implementations, the trust system <NUM> may implement custodian specific trust score generation. For example, the trust system <NUM> may select a specific scoring model based on the custodian associated with the blockchain address. In some implementations, the trust system <NUM> may implement customer/custodian specific reporting for blockchain addresses (e.g., based on the custodian associated with the blockchain address). For example, the trust report may be formatted in a specific manner for a specific custodian.

The data acquisition module <NUM>-<NUM> acquires data that may provide evidence of fraud from a variety of fraud data sources <NUM>-<NUM>. The trust system <NUM> may make a determination of the likelihood of fraud for blockchain addresses based on fraud data. For example, the trust system <NUM> may label blockchain addresses as fraud based on the fraud data. Subsequently, the trust system <NUM> may generate scoring features and scoring models based on the labeled blockchain addresses.

In some implementations, the trust system <NUM> may be configured to acquire databases and lists that indicate fraudulent activity associated with a blockchain address. In one example, fraud data sources <NUM>-<NUM> can include databases of fraud information, such as third-party databases of fraud information and/or customer provided databases of fraud information. The databases may be provided by public entities (e.g., government watchlists) and/or private entities (e.g., a company generated watchlist).

In some examples, a database of fraud information may be provided to the trust system <NUM> in the form of a blacklist that includes a list of blockchain addresses that have been identified as having engaged in fraud. In this example, the trust system <NUM> may acquire public blacklists, purchase blacklists, and/or receive blacklists from customers of the trust system <NUM>. In some cases, blacklists may have been peer reviewed by a community of trusted parties (e.g., experts). In some implementations, the data processing module <NUM>-<NUM> can mark addresses as fraudulent if the address is included on a blacklist. In other implementations, the trust system <NUM> can use the presence of the blockchain address on a blacklist as a scoring feature for determining whether the blacklisted blockchain address is likely fraudulent.

In some implementations, the data acquisition module <NUM>-<NUM> may be configured to acquire fraud data from targeted locations, such as locations on the internet specified by web uniform resource locators (URLs) and/or usernames (e.g., a specific social media account). In some implementations, a customer of the trust system <NUM> may provide locations (e.g., web URLs) that the data acquisition module <NUM>-<NUM> may monitor for fraudulent activity. For example, a customer may provide a web address to a social media page associated with a specific blockchain address. In this example, the data processing module <NUM>-<NUM> may identify fraudulent behavior if a blockchain address other than the specified blockchain address appears in the web contents at the web address. In another example, if there is a known contribution address of an initial coin offering (ICO), accounts and blockchain addresses fraudulently attempting to acquire funds (e.g., phish) may be detected. The trust system <NUM> may then notify the customer of the fraudulent address and use the evidence of fraudulent activity as described herein.

Although the data acquisition module <NUM>-<NUM> may be configured to acquire fraud data from targeted locations, in some implementations, the data acquisition module <NUM>-<NUM> can generally crawl and scrape other data sources (e.g., social media sites) for fraud data and other data. In these examples, the data processing module <NUM>-<NUM> may identify fraudulent blockchain addresses based on behavior across a social media platform, such as scams that request funds from multiple social media users, new accounts that directly ask other users for funds, and fake initial coin offering scams.

In some implementations, the trust system <NUM> (e.g., the data processing module <NUM>-<NUM>) may label a blockchain address as fraudulent (e.g., at <NUM>). For example, the data processing module <NUM>-<NUM> may label a blockchain address as fraud based on fraud data. In a specific example, the data processing module <NUM>-<NUM> may label a blockchain address as fraud if the blockchain address is included in one or more blacklists. If a blockchain address is not labeled as fraud, the fraud status of the blockchain address may be unknown. Put another way, an unlabeled blockchain address does not necessarily indicate that the blockchain address is not fraudulent. In some cases, a blockchain address may be labeled as a known good address that is not fraudulent. For example, an exchange wallet or verified smart contract may be examples of known good addresses.

For blockchain addresses that are assigned one or more trust scores and labeled as fraud, the fraud label for the blockchain address may be dispositive on the issue of fraud for the blockchain address. As such, in these implementations, the trust system <NUM> may disregard the trust score for the blockchain address and/or set the trust score for the blockchain address to a <NUM>% certainty of fraud. In other implementations, the trust system <NUM> may continue to calculate trust scores for the blockchain addresses labeled as fraud.

The fraud label <NUM> can also include fraud label metadata. The fraud label metadata may indicate the source of the information used to label the blockchain address as fraud (e.g., a specific blacklist). The fraud label metadata may also indicate a type of fraud (e.g., a phishing scam). The fraud label metadata can also include the content of the fraudulent behavior, such as text associated with a scam (e.g., text posted online or in an email). The trust system <NUM> can return the fraud label metadata to a requesting device to clearly explain the reason the trust system <NUM> has labeled a blockchain address as fraudulent.

Referring to <FIG>, the blockchain data acquisition module <NUM>-<NUM> (hereinafter "blockchain acquisition module <NUM>-<NUM>") can acquire blockchain data from the blockchain network <NUM>. For example, the blockchain acquisition module <NUM>-<NUM> can acquire the blockchain transaction ledger <NUM>. The blockchain acquisition module <NUM>-<NUM> can store the raw blockchain data <NUM> in the trust system data store <NUM>. The blockchain processing module <NUM>-<NUM> can process the blockchain transaction ledger <NUM> and store the processed blockchain values <NUM> (e.g., transaction amounts, dormancy, etc.) in the trust system data store <NUM> (e.g., in a blockchain address record <NUM>).

The blockchain transaction ledger <NUM> includes data for a plurality of blockchain transactions. Each transaction may include: <NUM>) a sender address, <NUM>) a receiver address, and <NUM>) a value amount (e.g., a coin amount). A transaction may also include transaction identification data that uniquely identifies the transaction on the blockchain. The transaction identification data may be referred to herein as a transaction identifier (ID). In some implementations, a transaction hash can be used as a unique identifier for a transaction. A transaction hash may be a string of pseudorandom characters that uniquely identify a transaction. Some blockchains may also include additional data that the trust system <NUM> may store and process. Example additional data may include internal transaction data, such as a program that is executed in an Ethereum smart contract.

The blockchain transaction ledger can include a plurality of blocks. Each of the blocks can include a collection of transactions. A block may include a collection of transactions that occurred on the blockchain within a certain period of time. A block may include a block number (e.g., a sequentially assigned number) that may act as an identifier for the block. In the case of Bitcoin, a transaction may include the sending party's address, the receiving party's address, the amount sent, and various parameters describing speed. Ethereum may include similar transaction data, as well as raw data around what function on a smart contract was executed, if a function was executed.

Different blockchain networks may include different types of blockchain ledgers. For example, different blockchain ledgers may include blockchain transaction data in different formats. As another example, different blockchain ledgers may include additional or alternative data associated with transactions. The blockchain acquisition module <NUM>-<NUM> can be configured to acquire blockchain transaction data for different blockchains. For example, the blockchain acquisition module <NUM>-<NUM> can include different modules, each of which may be configured for acquiring blockchain transaction data for a different blockchain network.

In some cases, a blockchain network can include timing data that indicates the time of blockchain transactions (e.g., relative/absolute time). In these implementations, the blockchain acquisition module <NUM>-<NUM> can use the provided timing data to indicate when the transaction occurred. In other cases, a blockchain network may not include timing data. In these implementations, the blockchain acquisition module <NUM>-<NUM> can generate a time stamp for the transaction. In some cases, timing data can be generated from the block assigned to the transaction. Blocks may be assigned as part of the mining process whereby actors on the blockchain compete to verify the validity of a set of transactions. Once a block is mined, and the transactions are verified, then the timing data can be assumed from other miners' consensus.

The blockchain processing module <NUM>-<NUM> can determine a variety of values based on the acquired blockchain data. The trust system <NUM> (e.g., the trust score generation module <NUM>) can use the determined values as scoring features for determining trust scores. The trust system <NUM> (e.g., the model generation module <NUM>) can also generate scoring models based on the determined values. The blockchain values for a blockchain address can be stored in the blockchain address record (e.g., at <NUM>).

The blockchain processing module <NUM>-<NUM> can include functionality for determining the different blockchain values described herein. For example, the blockchain processing module <NUM>-<NUM> of <FIG> includes a dormancy determination module <NUM> that can determine dormancy values for a blockchain address. The blockchain processing module <NUM>-<NUM> also includes a behavior identification module <NUM> that can determine whether the blockchain address matches one or more behavioral templates (e.g., patterns or fingerprints). The modules <NUM>, <NUM> included in the blockchain processing module <NUM>-<NUM> of <FIG> are only example modules. As such, the blockchain processing module <NUM>-<NUM> may include additional/alternative modules than those modules illustrated in <FIG>. Additionally, the blockchain values included in the blockchain data <NUM> of <FIG> are only example values. As such, the blockchain data for a blockchain address may include additional/alternative values.

In some implementations, the blockchain processing module <NUM>-<NUM> may determine values associated with the amount of funds transacted by a blockchain address. For example, the blockchain processing module <NUM>-<NUM> may determine: <NUM>) a total amount of funds received by the blockchain address, <NUM>) a total amount of funds sent by the blockchain address, <NUM>) the total amount of funds transacted in and out of the blockchain address, and <NUM>) the average transaction amount for the blockchain address.

In some implementations, the blockchain processing module <NUM>-<NUM> may determine values associated with the timing of transactions associated with a blockchain address. For example, the blockchain processing module <NUM>-<NUM> can determine an activity level of the blockchain address, such as how often the address is involved in a transaction (e.g., average times between transactions and variance). As another example, the blockchain processing module <NUM>-<NUM> can determine the age of transactions associated with the address. Another example scoring feature related to timing may include the time between entrance of funds and exit of funds from a blockchain address (e.g., timing for a single transaction or average over multiple transactions). In some cases, fraudulent activity may not immediately exit an address.

As another example, the dormancy determination module <NUM> can determine the probability of dormancy for the blockchain address. An example dormancy probability may indicate an amount of time for which the blockchain address is not associated with transactions. For example, a dormancy probability may indicate an amount of time for which the blockchain address is not associated with transactions relative to the address' expected time between transactions. Put another way, the example dormancy time may indicate the probability that the blockchain address is dormant. With respect to dormancy likelihood, fraudulent addresses may not stay active for long in some cases.

In some implementations, the blockchain processing module <NUM>-<NUM> may determine values associated with the timing of transactions and the amount of the transactions. For example, the blockchain processing module <NUM>-<NUM> may determine: <NUM>) a total amount of funds received over a period of time, <NUM>) a total amount of funds transferred over a period of time, and <NUM>) a total amount of funds transacted over a period of time.

In some implementations, the blockchain processing module <NUM>-<NUM> may determine values associated with how the blockchain address interacts with other blockchain addresses. For example, the blockchain processing module <NUM>-<NUM> may determine the list of addresses that have interacted with the blockchain address and/or the total number of addresses that have interacted with the blockchain address (e.g., as senders and/or receivers). This value may be iteratively computed to determine how important an address is to its local neighborhood and the blockchain as a whole.

The blockchain processing module <NUM>-<NUM> includes a behavior identification module <NUM> that can determine whether a blockchain address matches specific behavior templates that may be indicative of fraud. If the behavior identification module <NUM> identifies a match between a blockchain address' behavior and a behavior template, the match may be stored in the blockchain address record <NUM>. In some implementations, the trust system <NUM> may store a set of behavior templates. In these implementations, the behavior identification module <NUM> can determine whether the blockchain address' behavior matches one or more of the set of behavior templates.

A behavior template may include a set of conditions that, if satisfied, cause the behavior template to be matched to the blockchain address. A behavior template may include conditions that are based on any of the blockchain values described herein. For example, a behavior template may include conditions that are based on at least one of <NUM>) amounts of funds transferred, <NUM>) the number of transactions, <NUM>) the timing of transactions (e.g., rate of transactions), <NUM>) how the blockchain address interacts with other addresses (e.g., number of different senders/receivers and patterns of transactions), and <NUM>) the likelihood of dormancy of the address.

In one specific example, a behavior template may define a threshold number of transactions (e.g., <NUM> transactions in and out) at a threshold rate. In this example, the behavior template may be matched if a blockchain address engages in a low number of transactions (e.g., less than or equal to the threshold number) in quick succession (e.g., a short rapid burst). Another example condition for the behavior template may be a high dormancy probability, as any transactions may be limited to bursts. In another specific example, a behavior template may define a high threshold number of transactions (e.g., irregularly high for the blockchain). In this example, a behavior template may be matched if the blockchain address engages in greater than the threshold number of transactions. In this example, the behavior template may also require a high importance value, such that the blockchain address is required to have a minimum importance value to match the template. Furthermore, the behavior template may require a low likelihood of dormancy, as the fraudulent behavior may follow a pattern of regular transactions.

If the blockchain address matches a behavior template, the match may be stored as a blockchain value in the blockchain address record <NUM>. For example, the blockchain address record may store a binary value (e.g., <NUM>/<NUM>) for each behavior template that indicates whether the behavior template was matched. In implementations where the behavior identification module <NUM> determines a value (e.g., a decimal or integer value) that indicates how well the blockchain address matches the behavior template, the value may be stored in the blockchain address record <NUM>.

Referring to <FIG>, the graph generation module <NUM>-<NUM> generates a blockchain graph data structure based on the blockchain transactions for a plurality of different blockchain addresses. The graph data structure includes blockchain addresses and transactions between the blockchain addresses. For example, for each blockchain address, the graph data structure may describe each transaction associated with the blockchain address along with the direction of the transaction, such as whether the blockchain address was a sender or receiver. The graph data structure can also include the transaction amount for each transaction. In some implementations, the graph data structure can include fraud data (e.g., fraud labels). The fraud label can indicate that the address has been involved in fraudulent activity (e.g., a known fraudulent address).

<FIG> illustrates an example representation of the graph data structure. In <FIG>, the graph data structure is represented by nodes and edges. The graph data structure includes blockchain addresses as nodes of the graph. The transactions between blockchain addresses are edges between the nodes, where the arrows indicate the direction of the transaction (e.g., the receiver is at the arrowhead). The amount for each transaction is labeled adjacent to the arrow. The fraud label for each blockchain address is included above the node. <FIG> includes <NUM> transactors with blockchain addresses A, X, Y, Z. Blockchain address Y has been labeled as a fraudulent address. The other blockchain addresses have an unknown fraud status. The graph illustrates <NUM> blockchain transactions. A first transaction is from blockchain address X to blockchain address A for a first amount (i.e., amount <NUM>). A second transaction is from blockchain address Y to blockchain address A for a second amount (i.e., amount <NUM>). A third transaction is from blockchain address A to blockchain address Z for a third amount (i.e., amount <NUM>).

The graph data structure is stored in the graph data store <NUM>. The graph generation module <NUM>-<NUM> can update the graph data structure over time so that the graph data structure includes an up to date representation of the transactions included on the blockchain network <NUM>.

The graph processing module <NUM>-<NUM> can generate graph-based values <NUM> using the graph data structure. The graph-based values <NUM> may be stored in the blockchain address record <NUM>. The graph processing module <NUM>-<NUM> can update the graph-based values <NUM> over time.

In some implementations, the graph processing module <NUM>-<NUM> can determine one or more importance values for each of the blockchain addresses. The importance values may indicate the importance of a blockchain address relative to other blockchain addresses (e.g., relative to all blockchain addresses). In some implementations, the graph processing module <NUM>-<NUM> may determine the importance values for a blockchain address based on adjacent blockchain addresses. In some implementations, the graph processing module <NUM>-<NUM> may weight the contribution of adjacent blockchain addresses by the importance of the blockchain addresses.

In some implementations, the graph processing module <NUM>-<NUM> may determine an importance value by counting the number of transactions coming into a blockchain address. In this specific example, more transactions may indicate that the blockchain address is more important than other blockchain addresses with fewer incoming transactions. In some implementations, the graph processing module <NUM>-<NUM> may determine an importance value by determining the number of different blockchain addresses with which the blockchain interacts. In some implementations, the graph processing module <NUM>-<NUM> may determine an importance value that indicates the total amount of funds into the blockchain address relative to the amount of funds out of the address (e.g., amount out divided by amount in). In another example, the graph processing module <NUM>-<NUM> may determine an importance value that indicates the number of transactions into the blockchain address relative to the number of transactions out of the blockchain address (e.g., total number of transactions in divided by total number of transactions out). In another example, the graph processing module <NUM>-<NUM> may determine an importance value based on the number of transactions in to the blockchain address, the number of transactions out of the blockchain address, the amount of funds in, and the amount of funds out. In some implementations, the graph processing module <NUM>-<NUM> may implement other processing techniques, such as PageRank (PR) and/or personalized hitting time (PHT).

In some implementations, the graph processing module <NUM>-<NUM> may determine a fraud distance scoring feature that indicates the blockchain address' distance from fraud in the graph. For example, fraud distance scoring features may include a minimum distance from fraud, an average distance from fraud, and/or the number of fraudulent blockchain addresses with which the blockchain address has interacted.

Referring to <FIG>, the feature generation module <NUM> can generate scoring features for each of the blockchain addresses. The trust system <NUM> (e.g., trust score generation module <NUM>) can generate one or more trust scores for a blockchain address based on the scoring features associated with the blockchain address. The scoring features can be numerical values (e.g., integer or decimal values), Boolean values (e.g., <NUM>/<NUM>), enumerated values, or other values.

The feature generation module <NUM> can generate the scoring features based on any of the blockchain values described herein. For example, scoring features for a blockchain address may be based on <NUM>) amounts associated with transactions, <NUM>) timing data associated with transactions (e.g., dormancy), <NUM>) graph-based values (e.g., one or more importance values) associated with the blockchain address, and/or <NUM>) behavior-based data associated with the blockchain address.

With respect to behavior-based data, the feature generation module <NUM> may generate a Boolean scoring feature that indicates whether the blockchain address matches any of the behavior templates. In another example, the feature generation module <NUM> may generate a Boolean scoring feature for each of the behavior templates, such that the scoring features identify which of the behavior templates are matched. In another example, the feature generation module <NUM> may generate a scoring feature that indicates how many of the behavior templates were matched (e.g., a percentage of the total available). In another example, instead of generating Boolean features, the feature generation module <NUM> may generate numeric values that indicate how well the blockchain address matched the behavior templates, such as a decimal value (e.g., <NUM>-<NUM>) that indicates how well the behavior template was matched.

The trust system <NUM> includes a scoring model generation module <NUM> (referred to herein as a "model generation module <NUM>") that can generate scoring models <NUM> that are used to generate trust scores for a blockchain address. For example (e.g., see <FIG>), a scoring model can receive scoring features for a blockchain address and output a trust score for the blockchain address. The model generation module <NUM> can generate a scoring model based on training data. The training data can include scoring features along with associated fraud labels. The set of scoring features a model uses as input may be referred to herein as a "feature vector. " In some implementations, the trust system <NUM> can use a deep neural net to score, where the classification is determined by known good/bad addresses. The neural net may be trained over the feature vectors. In some implementations, the trust system <NUM> can leverage models based on random forests, decision trees, and logistic regression, and combine them in the form of a "consensus of experts.

The model generation module <NUM> can generate a scoring model (e.g., a machine learned model) based on training data that includes sets of feature vectors and their corresponding fraud label (e.g., Fraud: <NUM>/<NUM>). In this example, the generated scoring model may output a trust score (e.g., a decimal value) that indicates the likelihood the blockchain address is fraudulent. In some implementations, the training data may also include a label that positively indicates that the blockchain address is a known good address (e.g., not fraudulent).

Although the trust system <NUM> can generate scoring models that are used to generate trust scores, the trust system may generate trust scores in other manners. For example, the trust system may generate trust scores using scoring functions (e.g., weighted scoring functions) and/or heuristic models that generate trust scores according to rules.

<FIG> illustrates an example trust score generation module <NUM> that generates trust scores for blockchain addresses. The trust score generation module <NUM> may generate a trust score for a blockchain address by using a feature vector for the blockchain address and a scoring model. For example, the trust score generation module <NUM> may input a feature vector for a blockchain address into a scoring model that outputs a trust score.

The trust score <NUM> for a blockchain address can be stored in the blockchain address record <NUM>. The trust score generation module <NUM> can generate trust scores for each of the blockchain addresses. The trust score generation module <NUM> can also update the trust scores over time, such as when additional data is acquired at the trust system <NUM>. A blockchain address record <NUM> can include the most recently calculated trust score, as well as historically calculated trust scores. In some implementations, the trust system <NUM> can leverage the change in trust score (and historical score) to provide a real-time alerting system, such that a party can be notified if the trust score of an address drops (e.g., as in the case of an organization receiving fraudulent funds through an address they control). The trust system <NUM> may provide an API that can hook into their service that can freeze the transaction and alert the relevant people at that organization (e.g., by phone, email, etc.).

The trust score generation module <NUM> may be configured to provide the trust score in a variety of formats. In some implementations, the trust score may be an integer value with a minimum and maximum value. For example, the trust score may range from <NUM>-<NUM>, where a trust score of '<NUM>' indicates that the blockchain address is likely fraudulent. In this example, a trust score of '<NUM>' may indicate that the blockchain address is not likely fraudulent (i.e., very trustworthy). In some implementations, the trust score may be a decimal value. For example, the trust score may be a decimal value that indicates a likelihood of fraud (e.g., a percentage value from <NUM>-<NUM>%). In some implementations, a trust score may range from a maximum negative value to a maximum positive value (e.g., -<NUM> to <NUM>), where a larger negative value indicates that the address is more likely fraudulent. In this example, a larger positive value may indicate that the address is more likely trustworthy. The customer may select the trust score format they prefer.

<FIG> illustrates interaction between the trust system <NUM> and a transactor device <NUM>, <NUM>, <NUM> (e.g., a user device or server). In <FIG>, the transactor interface module <NUM> receives a trust request <NUM> for a blockchain address. The transactor interface module <NUM> may retrieve the trust score for the indicated blockchain address. The transactor interface module <NUM> sends the retrieved trust score to the transactor device <NUM>, <NUM>, <NUM> in the trust response <NUM>. Although the transactor interface module <NUM> can retrieve a pre-generated trust score, in some cases, the trust system <NUM> may generate a trust score in real time in response to the trust request <NUM> if the trust score is not yet calculated and/or is outdated.

The transactor interface module <NUM> may provide an interface for transactor devices/systems <NUM>, <NUM>, <NUM>. For example, the transactor interface module <NUM> may provide an API for interacting with the trust system <NUM>. In some implementations, the transactor interface module <NUM> can generate interfaces for user transactor devices <NUM>, such as a GUI (e.g., a web-based interface). In other cases, the transactor application <NUM> and/or an intermediate transaction system <NUM> can generate a GUI for displaying data retrieved from the trust system <NUM>.

In some implementations, the transactor interface module <NUM> can store request data <NUM> for each trust request <NUM>. The request data <NUM> may include any data associated with a received trust request <NUM> and/or the provided trust response <NUM>. The request data <NUM> may be stored in the associated blockchain address record <NUM>.

In some implementations, a blockchain address record may store request data <NUM> each time a trust request <NUM> is made for the blockchain address. In these implementations, the request data <NUM> may indicate a number of times a trust request was made for the blockchain address. The request data <NUM> may also indicate the blockchain address that made the trust request, the trust score that was reported to the requestor, and the time of the request. Accordingly, the request data <NUM> may show trends over time regarding the parties that are requesting trust scores for a blockchain address.

In some implementations, the scoring features for a blockchain address may include scoring features that are based on the request data <NUM>. One example scoring feature may be a total number of times a trust request was made for the blockchain address. Another example scoring feature may be a number of different blockchain addresses that made trust requests for the blockchain address. Other example features may include the frequency at which trust requests were made for the blockchain address (e.g., a number of requests over a time period).

<FIG> illustrate example GUIs that may be generated on a user transactor device <NUM> by the transaction application <NUM> or the intermediate transaction system <NUM>. The illustrated GUIs may be for a sender in a blockchain transaction. It can be assumed that the blockchain network on which the blockchain transactions occur in <FIG> use units of "coins" for transactions. The top portion of the GUIs includes fields that indicate the sender's information, such as the sender's blockchain address and their balance (e.g., <NUM> coins). The top portion of the GUIs also include fields in which the sender can specify a receiver address and indicate the transaction amount (e.g., <NUM> coins) for the potential transaction. The GUIs include a "Send Coins" GUI element that can initiate the specified transaction between the sender and the receiver.

The lower portion of the GUIs in <FIG> provide the sender with the option of acquiring a trust report from the trust system <NUM> before engaging in the transaction. For example, in <FIG>, the user can select (e.g., touch/click) the "Request Trust Report" GUI element to send a trust request to the trust system. The trust request may include the receiver's address, as specified in the "To:" box above. <FIG> illustrates an example trust report received in response to the trust request.

In <FIG>, the received trust report indicates that the receiver had a trust score of -. It can be assumed in this case that a negative valued trust score near -<NUM> indicates that the receiver address is likely fraudulent. Similarly, a positive valued trust score near <NUM> may indicate that the receiver address is not fraudulent. In addition to the numeric score of -<NUM>, the trust report also summarizes the meaning of the trust score number. Specifically, the trust report indicates that the "trust score indicates that the receiver has likely engaged in fraudulent activity. " The GUI also provides a "Cancel Transaction" GUI element that the sender may select (e.g., touch/click) to cancel the specified transaction.

<FIG> illustrates an example in which the trust system <NUM> is queried as part of a payment insurance process. In <FIG>, the user transactor device <NUM> transacts on the blockchain network <NUM> via an intermediate transaction system <NUM>. The intermediate transaction system <NUM> includes a trust request module <NUM> that can retrieve trust reports from the trust system <NUM>. The intermediate transaction system <NUM> may also provide payment insurance to the transactor.

The intermediate transaction system <NUM> of <FIG> includes a payment insurance module <NUM> that may determine whether a transaction will be insured. The terms on which transactions are insurable may be agreed to by the owner/operator of the intermediate transaction system <NUM> and the owner/operator of the payment insurance system <NUM> (e.g., an underwriter system). In some implementations, payment insurance may be provided for transactions in which the transacting blockchain addresses have trust scores that indicate a low likelihood of fraud. The payment insurance system <NUM> can acquire data related to the transactions (e.g., trust scores, timing, etc.) for auditing purposes.

In <FIG>, initially, the transactor device <NUM> may initiate a transaction with the intermediate transaction system <NUM>. In response to the initiated transaction, the intermediate transaction system <NUM> (e.g., the trust request module <NUM>) may retrieve a trust report for the receiver and/or the sender. The intermediate transaction system <NUM> may then determine whether the transaction is insurable. For example, the payment insurance module <NUM> may determine whether the transacting blockchain addresses have trust scores that indicate a low likelihood of fraud. In some implementations, the payment insurance module <NUM> may compare trust scores to trust score threshold values that indicate a maximum tolerable likelihood for fraud. In these implementations, the payment insurance module <NUM> may indicate that the transaction is insurable if the trust score(s) are less than the trust score threshold value. If the trust score(s) are greater than the tolerable level for fraud, payment insurance may be declined.

In some implementations, the payment insurance module <NUM> may query the payment insurance system <NUM> to determine whether the transaction is insurable. The query may indicate the trust scores for the transacting parties. In these implementations, the payment insurance system <NUM> can make the determination of whether to insure the transaction. The payment insurance system <NUM> may then notify the intermediate transaction system <NUM> of whether the transaction is insurable.

In addition to the trust system <NUM> playing a part in payment insurance processes, the trust system <NUM> may also play a role in other financial processes. For example, the trust scores/reports generated by the trust system <NUM> may be used in order to freeze transactions and/or clawback funds.

Although the trust system <NUM> may calculate a single trust score for each of the blockchain addresses, regardless of whether the blockchain address is a sender or receiver, in some implementations, the trust system <NUM> may calculate a receiver trust score and a sender trust score for each address. In one example, a blockchain address which regularly falls prey to scams can have the sender trust score set as less trustworthy than a blockchain address which does not often fall prey to scams. In another example, a blockchain address which regularly falls prey to phishing scams may not have a modified receiver trust score when there is no indication of nefarious activity associated with receiving funds at the blockchain address.

Modules and data stores included in the trust system <NUM> represent features that may be included in the trust system <NUM> of the present disclosure. The modules and data stores described herein may be embodied by electronic hardware, software, firmware, or any combination thereof. Depiction of different features as separate modules and data stores does not necessarily imply whether the modules and data stores are embodied by common or separate electronic hardware or software components. In some implementations, the features associated with the one or more modules and data stores depicted herein may be realized by common electronic hardware and software components. In some implementations, the features associated with the one or more modules and data stores depicted herein may be realized by separate electronic hardware and software components.

The modules and data stores may be embodied by electronic hardware and software components including, but not limited to, one or more processing units, one or more memory components, one or more input/output (I/O) components, and interconnect components. Interconnect components may be configured to provide communication between the one or more processing units, the one or more memory components, and the one or more I/O components. For example, the interconnect components may include one or more buses that are configured to transfer data between electronic components. The interconnect components may also include control circuits (e.g., a memory controller and/or an I/O controller) that are configured to control communication between electronic components.

The one or more processing units may include one or more central processing units (CPUs), graphics processing units (GPUs), digital signal processing units (DSPs), or other processing units. The one or more processing units may be configured to communicate with memory components and I/O components. For example, the one or more processing units may be configured to communicate with memory components and I/O components via the interconnect components.

A memory component (e.g., main memory and/or a storage device) may include any volatile or non-volatile media. For example, memory may include, but is not limited to, electrical media, magnetic media, and/or optical media, such as a random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), electrically-erasable programmable ROM (EEPROM), Flash memory, hard disk drives (HDD), magnetic tape drives, optical storage technology (e.g., compact disc, digital versatile disc, and/or Blu-ray Disc), or any other memory components.

Memory components may include (e.g., store) data described herein. For example, the memory components may include the data included in the data stores. Memory components may also include instructions that may be executed by one or more processing units. For example, memory may include computer-readable instructions that, when executed by one or more processing units, cause the one or more processing units to perform the various functions attributed to the modules and data stores described herein.

The I/O components may refer to electronic hardware and software that provide communication with a variety of different devices. For example, the I/O components may provide communication between other devices and the one or more processing units and memory components. In some examples, the I/O components may be configured to communicate with a computer network. For example, the I/O components may be configured to exchange data over a computer network using a variety of different physical connections, wireless connections, and protocols. The I/O components may include, but are not limited to, network interface components (e.g., a network interface controller), repeaters, network bridges, network switches, routers, and firewalls. In some examples, the I/O components may include hardware and software that is configured to communicate with various human interface devices, including, but not limited to, display screens, keyboards, pointer devices (e.g., a mouse), touchscreens, speakers, and microphones. In some examples, the I/O components may include hardware and software that is configured to communicate with additional devices, such as external memory (e.g., external HDDs).

In some implementations, the trust system <NUM> may include one or more computing devices that are configured to implement the techniques described herein. Put another way, the features attributed to the modules and data stores described herein may be implemented by one or more computing devices. Each of the one or more computing devices may include any combination of electronic hardware, software, and/or firmware described above. For example, each of the one or more computing devices may include any combination of processing units, memory components, I/O components, and interconnect components described above. The one or more computing devices of the trust system <NUM> may also include various human interface devices, including, but not limited to, display screens, keyboards, pointing devices (e.g., a mouse), touchscreens, speakers, and microphones. The computing devices may also be configured to communicate with additional devices, such as external memory (e.g., external HDDs).

Claim 1:
A system comprising:
one or more processing units that execute computer-readable instructions that cause the one or more processing units to:
acquire blockchain data from a blockchain network, wherein the blockchain data includes a plurality of transactions between a plurality of blockchain addresses;
label a set of the blockchain addresses as fraudulent;
generate a graph data structure based on the blockchain data, wherein the graph data structure includes nodes for the blockchain addresses and includes edges between the nodes for blockchain transactions;
calculate a set of scoring features for each blockchain address, wherein each set of scoring features includes a graph-based scoring feature, and wherein calculating the graph-based scoring feature includes calculating a number of transactions associated with the blockchain address in the graph data structure;
generate a scoring model using sets of scoring features for the blockchain addresses that are labeled as fraudulent;
generate a trust score for each of the blockchain addresses using the scoring features associated with the blockchain addresses and the scoring model, wherein the trust score indicates a likelihood that the blockchain address is involved in fraudulent activity;
generate a graphical user interface (GUI) to be displayed at a requesting device;
receive a trust request for a specified blockchain address from the requesting device via the displayed GUI; and
send the trust score for the specified blockchain address to the requesting device to be displayed via the GUI.