MT $$^2$$ 2 AD: multi-layer temporal transaction anomaly detection in ethereum networks with GNN
Abstract In recent years, a surge of criminal activities with cross-cryptocurrency trades have emerged in Ethereum, the second-largest public blockchain platform. Most of the existing anomaly detection methods utilize the traditional machine learning with feature engineering or graph representation...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Springer
2023-07-01
|
| Series: | Complex & Intelligent Systems |
| Subjects: | |
| Online Access: | https://doi.org/10.1007/s40747-023-01126-z |
| _version_ | 1797272223886606336 |
|---|---|
| author | Beibei Han Yingmei Wei Qingyong Wang Francesco Maria De Collibus Claudio J. Tessone |
| author_facet | Beibei Han Yingmei Wei Qingyong Wang Francesco Maria De Collibus Claudio J. Tessone |
| author_sort | Beibei Han |
| collection | DOAJ |
| description | Abstract In recent years, a surge of criminal activities with cross-cryptocurrency trades have emerged in Ethereum, the second-largest public blockchain platform. Most of the existing anomaly detection methods utilize the traditional machine learning with feature engineering or graph representation learning technique to capture the information in transaction network. However, these methods either ignore the timestamp information and the transaction flow direction information in transaction network or only consider single transaction network, the cross-cryptocurrency trading patterns in Ethereum are usually ignored. In this paper, we introduce a Multi-layer Temporal Transaction Anomaly Detection (MT $$^2$$ 2 AD) model in Ethereum network with graph neural network. Specifically, for a given Ethereum token transaction network, we first extract its initial features including the structure subgraph and edge’s feature. Then, we model the temporal information in subgraph as a series of network snapshots according to the timestamp on each edge and time window. To capture the cross-cryptocurrency trading patterns, we combine the snapshots from multiple token transactions at a given timestamp, and we consider it as a new combined graph. We further use the graph convolution encoder with attention mechanism and pooling operation on this new graph to obtain the graph-level embedding, and we transform the anomaly detection on dynamic multi-layer Ethereum transaction networks as a graph classification task with these graph-level embeddings. MT $$^2$$ 2 AD can integrate the transaction structure feature, edge’s feature and cross-cryptocurrency trading patterns into a framework to perform the anomaly detection with graph neural networks. Experiments on three real-world multi-layer transaction networks show that the proposed MT $$^2$$ 2 AD (0.8789 Precision, 0.9375 Recall, 0.4987 FbMacro and 0.9351 FbWeighted) can achieve the best performance on most evaluation metrics in comparison with some competing approaches, and the effectiveness in consideration of multiple tokens is also demonstrated. |
| first_indexed | 2024-03-07T14:25:15Z |
| format | Article |
| id | doaj.art-78c8eff59f654eecac9c047d6660bbad |
| institution | Directory Open Access Journal |
| issn | 2199-4536 2198-6053 |
| language | English |
| last_indexed | 2024-03-07T14:25:15Z |
| publishDate | 2023-07-01 |
| publisher | Springer |
| record_format | Article |
| series | Complex & Intelligent Systems |
| spelling | doaj.art-78c8eff59f654eecac9c047d6660bbad2024-03-06T08:07:29ZengSpringerComplex & Intelligent Systems2199-45362198-60532023-07-0110161362610.1007/s40747-023-01126-zMT $$^2$$ 2 AD: multi-layer temporal transaction anomaly detection in ethereum networks with GNNBeibei Han0Yingmei Wei1Qingyong Wang2Francesco Maria De Collibus3Claudio J. Tessone4College of Systems Engineering, National University of Defense TechnologyCollege of Systems Engineering, National University of Defense TechnologyCollege of Systems Engineering, National University of Defense TechnologyBlockchain and Distributed Ledger Technologies Group, Universität ZürichBlockchain and Distributed Ledger Technologies Group, Universität ZürichAbstract In recent years, a surge of criminal activities with cross-cryptocurrency trades have emerged in Ethereum, the second-largest public blockchain platform. Most of the existing anomaly detection methods utilize the traditional machine learning with feature engineering or graph representation learning technique to capture the information in transaction network. However, these methods either ignore the timestamp information and the transaction flow direction information in transaction network or only consider single transaction network, the cross-cryptocurrency trading patterns in Ethereum are usually ignored. In this paper, we introduce a Multi-layer Temporal Transaction Anomaly Detection (MT $$^2$$ 2 AD) model in Ethereum network with graph neural network. Specifically, for a given Ethereum token transaction network, we first extract its initial features including the structure subgraph and edge’s feature. Then, we model the temporal information in subgraph as a series of network snapshots according to the timestamp on each edge and time window. To capture the cross-cryptocurrency trading patterns, we combine the snapshots from multiple token transactions at a given timestamp, and we consider it as a new combined graph. We further use the graph convolution encoder with attention mechanism and pooling operation on this new graph to obtain the graph-level embedding, and we transform the anomaly detection on dynamic multi-layer Ethereum transaction networks as a graph classification task with these graph-level embeddings. MT $$^2$$ 2 AD can integrate the transaction structure feature, edge’s feature and cross-cryptocurrency trading patterns into a framework to perform the anomaly detection with graph neural networks. Experiments on three real-world multi-layer transaction networks show that the proposed MT $$^2$$ 2 AD (0.8789 Precision, 0.9375 Recall, 0.4987 FbMacro and 0.9351 FbWeighted) can achieve the best performance on most evaluation metrics in comparison with some competing approaches, and the effectiveness in consideration of multiple tokens is also demonstrated.https://doi.org/10.1007/s40747-023-01126-zAnomaly detectionMulti-layer transaction networksGraph classificationTemporal networkGraph representation learning |
| spellingShingle | Beibei Han Yingmei Wei Qingyong Wang Francesco Maria De Collibus Claudio J. Tessone MT $$^2$$ 2 AD: multi-layer temporal transaction anomaly detection in ethereum networks with GNN Complex & Intelligent Systems Anomaly detection Multi-layer transaction networks Graph classification Temporal network Graph representation learning |
| title | MT $$^2$$ 2 AD: multi-layer temporal transaction anomaly detection in ethereum networks with GNN |
| title_full | MT $$^2$$ 2 AD: multi-layer temporal transaction anomaly detection in ethereum networks with GNN |
| title_fullStr | MT $$^2$$ 2 AD: multi-layer temporal transaction anomaly detection in ethereum networks with GNN |
| title_full_unstemmed | MT $$^2$$ 2 AD: multi-layer temporal transaction anomaly detection in ethereum networks with GNN |
| title_short | MT $$^2$$ 2 AD: multi-layer temporal transaction anomaly detection in ethereum networks with GNN |
| title_sort | mt 2 2 ad multi layer temporal transaction anomaly detection in ethereum networks with gnn |
| topic | Anomaly detection Multi-layer transaction networks Graph classification Temporal network Graph representation learning |
| url | https://doi.org/10.1007/s40747-023-01126-z |
| work_keys_str_mv | AT beibeihan mt22admultilayertemporaltransactionanomalydetectioninethereumnetworkswithgnn AT yingmeiwei mt22admultilayertemporaltransactionanomalydetectioninethereumnetworkswithgnn AT qingyongwang mt22admultilayertemporaltransactionanomalydetectioninethereumnetworkswithgnn AT francescomariadecollibus mt22admultilayertemporaltransactionanomalydetectioninethereumnetworkswithgnn AT claudiojtessone mt22admultilayertemporaltransactionanomalydetectioninethereumnetworkswithgnn |