TSGN: Transaction Subgraph Networks Assisting Phishing Detection in Ethereum

To create a good investment environment in the Ethereum ecosystem, many researchers have paid lots of attention to study the effective detection methods for phishing scams. Wu et al. [9] proposed an approach to detect phishing scams on Ethereum by mining its transaction records. By considering the transaction amount and timestamp, it introduced a novel network embedding algorithm called trans2vec to extract the features of the addresses for subsequent phishing identification. Chen et al. [6] proposed a detecting method based on Graph Convolutional Network (GCN) and autoencoder to precisely distinguish phishing accounts. Li et al. [12] introduced a self-supervised incremental deep graph learning model based on Graph Neural Network (GNN), for phishing scam detection problem on Ethereum. One can see that these methods mentioned above mainly built phishing account detection as a node classification task, which cannot capture more potential global structural features for phishing accounts. Yuan et al. [13] built phishing identification problem as the graph classification task, which used line graph to enhance the Graph2Vec method and achieved good performance. However, Yuan et al. only consider the structural features obtained from line graphs, ignoring the transaction temporal information which plays a significant role in phishing scam detection. As we know, the phishing funds mostly flow from multiple accounts to a specific account. Our method takes the direction and temporal information into consideration and builds the Directed-TSGN and Temporal-TSGN models, revealing the topological pattern of phishing scams.

Graphs are a general language for describing and analyzing entities with relations or interactions. Due to its unique structure characteristics, the Blockchain ecosystem is naturally modeled as transaction networks to carry out related research. Simultaneously, many graph representation methods are applied to capture the dependency relationships between objects in the Blockchain network structures. There are two main categories of existing representation methods, the former mostly employs machine learning models with dedicated feature engineering [5, 6, 7], and the latter adopts some embedding techniques and deep learning models such as walk-based [9] and the GNN methods. For example, Hu et al. [8] presented a novel deep learning scam detection framework assembling with the Gate Recurrent Unit (GRU) network and attention mechanism, which produced good results on both Ponzi and Honeypot scams. Alarab et al. [10] adopted GCNs intertwined with linear layers to predict illicit transactions in the Bitcoin transaction graph and this method outperforms graph convolutional methods used in the original paper of the same data. Liu et al. [14] introduced an identity inference approach based on big graph analytics and learning, aiming to infer the identity of Blockchain addresses using the graph learning technique based on GCNs. Zhang et al. [15] constructed a graph to represent both syntactic and semantic structures of an Ethereum smart contract function and introduced the GNN for smart contract vulnerability detection.

According to the above works, one can find that the graph representation methods, especially GNNs, can indeed be utilized to study the Blockchain data and outperform in many different applications. However, the existing studies have two potential problems. Firstly, these researches are mostly based on a large-scale transaction network where the scarcity of labels and the huge volume of transactions make it difficult and intricate to take advantage of GNN methods. Secondly, such methods largely rely on the original transaction network and thus may overlook the powerful potential of transaction interactions which contain important hidden transaction patterns. In this work, we collect the 1-hop neighborhood information to construct the subgraph for each target address and use the features of the entire subgraph as the representation of the target node for avoiding inadequate graph feature learning. We further obtain the TSGNs and their three variants by structural space mapping, capturing potential transaction patterns from various aspects.

Generally, a cryptocurrency transaction network is modeled as an address interaction graph, illustrating the transferring amount and the flow direction of fund between different accounts in a certain time bucket. Given a set of addresses on Ethereum, we can construct transaction network as a directed graph $G=(V,E)$, where each node $v\in V$ indicates an address that can be an Externally Owned Account (EOA) or Contract Account (CA), the edge set is represented as a quad, $E=\{(v_{src},v_{dst},w,\ell)|v_{src},v_{dst}\in V,w\in\mathbb{R}^{+}\cup\{0\},\ell\in L\}$, where ($v_{src},v_{dst}$) indicates the direction of the transaction (e.g., assets transfer or smart contract invocation) from $v_{src}$ to $v_{dst}$, weight $w$ represents the amount of transferred cryptocurrencies or is 0 if the kind of transaction is smart contract invocation, and $l$ is the timestamp of the transaction.

Here, we construct a set of transaction graphs for the center addresses $\mathcal{G}=\{(G_{1},c_{1}),(G_{2},c_{2}),\cdots,(G_{n},c_{n})\}$, where $c_{i}\in C^{|\mathcal{G}|\times|\phi|}$ is the label of address $i$ and its corresponding transaction subgraph $G_{i}$, where $\phi$ is the label set of all target addresses. In this work, our purpose is to learn a mapping function $\mathscr{C}:\mathcal{G}\rightarrow C$ which can predict the labels of graphs in $\mathcal{G}$. The label set $C$ includes phishing labels and non-phishing labels in the scenario of Ethereum phishing account identification.

To keep mathematical formulas unified in a stricter and tidier manner, TABLE I shows the notations used in the progress of TSGNs modeling.

In this section, we introduce the detail of our transaction subgraph network model. Firstly, we give the definitions of transaction subgraph network (TSGN), directed transaction subgraph network (Directed-TSGN), and temporal transaction network (Temporal-TSGN). And then, we elaborate the construction methods of the TSGN, Directed-TSGN, and Temporal-TSGN, respectively.

According to the Definition 1, we can find that TSGN is the variant of SGN model [11] for the background of Ethereum transaction ecosystem. Different from SGN model, TSGN adds a network weight mapping mechanism $W^{\prime}\leftarrow f(W)$, which can retain the transaction amount information in the original transaction network for the downstream behaviour analysis task. The edge weights of TSGN can be calculated specifically by,

where $w^{\prime}\in W^{\prime}$ is the mapped weights, and $w_{a},w_{b}\in W$ are the original weights. Note that transaction amount is set to 0 when the account interaction relationship is the invocation of contract accounts. Here, TSGN is a classical model which can be applied for any simple Ethereum account interaction network. Considering the complex transaction direction information, we propose the variant named Directed-TSGN.

As shown in the Definition 2, Directed-TSGN based on TSGN model introduces the direction information into the mapping mechanism which can capture the path of transaction behavior. The weight $w^{*}$ can be obtained by Eq. (1). Also, Ethereum data is dynamic and gets larger and more complicated over time, which brings the challenge to analyze transaction behaviors by adopting some graph mining algorithms. In addition, phishing behaviors generally have the strong time-aware property. These challenges require the development of a novel graph model mapping approach that is suitable for the analysis of time-varying and dense networks. Hence, we further propose Temporal-TSGN.

Clearly, the Temporal-TSGN defined in the Definition 3 is the substructure which is obtained by filtering the nodes and edges of of Directed-TSGN according to the time information, i.e., $T_{T}\subseteq T_{D}$. By attaching the time attribute on the directed transaction subgraphs (edges), Temporal-TSGN can capture neighbor transaction flow information for each target account address while reducing the scale of the network. The weight value $w_{\times}$ can also be calculated by Eq. (1). Next, we would focus on the specific construction methods for the TSGN, Directed-TSGN, and Temporal-TSGN.

Fig. 2 shows the process of constructing TSGN. Given an original transaction network composed of a center address and its neighbor addresses, we can firstly get a plain transaction network with weight values by discarding the direction attribute and retaining the weight attribute. And then, this network is mapped into TSGN structural space according to the rule indicated in the Definition 1.

Specifically, the edges in the undirected transaction network is mapping to the nodes of TSGN, and then new edges are built between nodes $e_{1}$, $e_{2}$, $e_{3}$, $e_{4}$, $e_{5}$ because the edges of undirected transaction network share the common center node. There is no doubt that transaction subgraph mapping strategy of TSGN also works for the case that there are connections between neighbor addresses. The transactions $e_{6}$ and $e_{7}$ are mapped into the TSGN to acquire the neighbor trading pattern information for the center address. A pseudocode of constructing TSGN is given in Algorithm 1. The input of this algorithm is the original transaction network $G$($V$,$E$) and the output is the constructed TSGN, denoted by $T$($V^{\prime}$,$E^{\prime}$), where $V^{\prime}$ and $E^{\prime}$ represent the sets of nodes and edges in the TSGN, respectively. Here, we choose the weight mapping function introduced in Section III-B. Of course, different weight mapping functions can be defined as required.

Transaction direction is one of the most noteworthy characteristics in the field of financial research. Most of studies model the transaction pattern of an account by Indegree and Outdegree in a transaction graph. In Ethereum or Bitcion platform, transaction direction combined with transaction amount information can be adopted to study the peculiar unusual patterns [16], detect abnormal economic interactions [3], predict virtual currency prices [17] and so on. According to Section III-C, we can find that the TSGN model can not retain the direction information which may play an important role in the following phishing identification tasks. Moreover, the TSGN is denser than the original transaction network and even becomes a fully connected network, which may reduce the representation ability of graph mining algorithms. Directed-TSGN proposed in this paper can take into account the two attributes of transaction direction and amount into consideration, benefiting for extracting the potential transaction patterns of the target addresses.

In response to the above problems, we propose one variant of TSGN, named Directed-TSGN. As shown in Fig. 3, the construction of Directed-TSGN consists of the following three steps: (i) hold the direction and weight attributes, (ii) design the direction mapping strategies, (iii) construct the TSGN. The first step aims to hold the direction and weighted attributes of the original transaction network and prepare for the subsequent structural mapping. Similarly, the edges are mapped into the nodes $d_{1}$, $d_{2}$, $d_{3}$, $d_{4}$, $d_{5}$, $d_{6}$, $d_{7}$ of the Directed-TSGN. The two red directed dashed lines indicate that the transactions $d_{1}$ and $d_{2}$ and transactions $d_{3}$ and $d_{5}$ can be considered as two continuous transaction behaviors, respectively. In other words, the edges $d_{1}$ and $d_{2}$ and the edges $d_{3}$ and $d_{5}$ can form two 2-hop paths with the same direction, respectively. According to the four direction mapping strategies, we can build the new edges in the Directed-TSGN. Due to the fact that patterns of (b) and (d) don’t satisfy the requirements of constructing edges, the Directed-TSGN can limit the network size and get a relatively sparse transaction subgraph network. The pseudocodes of constructing Directed-TSGN consist of Algorithm 1 and 2. The input of Algorithm 2 is two transaction subgraphs $d_{a},d_{b}$ in the attribute attached graph $G$, and the output is the edge $(d_{a},d_{b})$ matching the mapping rules. Algorithm 2 aiming to illustrate the Directed-TSGN mapping will be executed when $G\leftarrow\mathcal{A}_{directed}(G)$ is attached the transaction direction attribute.

Temporal information, i.e., transaction timestamps, can clearly indicate when the transaction occurred. Hence, the transaction time in alliance with trading flow direction offers the possibility for the traceability of transferring funds on Ethereum [18]. In this section, we further introduce the temporal attribute of transactions into the TSGN mapping mechanism. On the basis of Directed-TSGN, Temporal-TSGN is proposed to fuse crucial temporal and direction attributes related to phishing detection for enhancing the ability to identify phishing scams. Temporal-TSGN improves the mapping strategies compared with Directed-TSGN, which can finely captures the temporal transaction flow structural information in Ethereum, further limiting the network scale.

Fig. 4 shows the progress of constructing Temporal-TSGN. Given an original transaction network, Directed-TSGN can be firstly obtained according to the strategy mentioned in Section III-D, and then we can get the Temporal-TSGN from Directed-TSGN by filtering the edges that are not in chronological order. The timestamps on the edges determine the order in which transaction are generated, i.e., $(t_{1},t_{2},t_{3},t_{4},t_{5},t_{6},t_{7})$. We define that, in the Temporal-TSGN, the transaction $t_{i}$ must be linked to transaction $t_{j}$ where $i<j$, which can form a 2-hop sequential transaction flow. Here, the edges $(t_{3},t_{2})$, $(t_{7},t_{3})$, and $(t_{6},t_{1})$ are unsatisfied with the formation condition and are therefore ignored.

At this point, the Temporal-TSGN mapping strategy can be summarized as the single edges part of Fig. 5. We attach the timestamps onto the edges of different directions, getting the fund flow of the transactions within a certain time frame. It is important to note that, a 2-hop transaction chain is available for the construction of Temporal-TSGN only under the three conditions described in the Definition 3. Specifically, the transaction chain $(v_{1}\stackrel{{\scriptstyle 4s}}{{\longrightarrow}}v_{2}\stackrel{{\scriptstyle 7s}}{{\longrightarrow}}v_{3})$ shown in Fig. 5 (a) can be successfully mapped into the TSGN structural space, becoming a 1-hop directed node pair, while the other three transaction chains $(v_{1}\stackrel{{\scriptstyle 4s}}{{\longrightarrow}}v_{2}\stackrel{{\scriptstyle 7s}}{{\longleftarrow}}v_{3})$, $(v_{1}\stackrel{{\scriptstyle 4s}}{{\longleftarrow}}v_{2}\stackrel{{\scriptstyle 7s}}{{\longleftarrow}}v_{3})$, and $(v_{1}\stackrel{{\scriptstyle 4s}}{{\longleftarrow}}v_{2}\stackrel{{\scriptstyle 7s}}{{\longrightarrow}}v_{3})$ shall be excluded since they do not satisfy the second condition or the third condition or both in the Definition 3, respectively.

Ethereum transaction data poses following several challenges. First, the transaction network is generally sparse and dynamic, but it chould be very dense when viewed over a long period of time. Secondly, the nodes in the transaction graph appear (i.e., new accounts are created) and disappear (i.e., no future transactions occur) daily. Thirdly, transaction throughput on a daily basis fluctuates greatly. So, the time attribute is a vitally important factor when constructing transaction networks, which can exhibit the real complexity of the Ethereum transaction network from the time dimension. Li [19] modeled the temporal relationship of historical transaction records between nodes to construct the edge representation of the Ethereum transaction network. In this section, how to deal with the mapping rules of multi-edge temporal networks is an urgent problem to be solved for the subsequent phishing behavior analysis.

It is worth to note that the temporal mapping mechanism can be extended to the case of multiple edges. As shown in Fig. 5 (e)-(l), the case of multi-edge mapping does not alter the loop of a nodes pair (Fig. 5 (e) and (f)), while the case of temporal edges can tackle it (Fig. 5 (i) and (j)). The timestamps can break the cycle in the network structure and orient the information flow in the TSGN. Intuitively, TSGN under multi-edge case can yield to a clear path of funding transferring and capture the fund flow pattern in the complex temporal transaction network, which is conducive to the detection of illegal trading activities.

In particular, the construction progress of TSGN for multi-edge transaction network, denoted as Multiple-TSGN, is shown in Fig. 6. Firstly, given a weighted directed multi-edge graph, it will turn to a MultiDiGraph where each transaction has its own fixed order of occurrence after being attached with the timestamp attribute. And then, according to the Algorithm 3, we can get the variant of Temporal-TSGN for multi-edge transaction network, i.e., Multiple-TSGN.

To date, it is still the research focus to deeply understand and analyze the knowledge of multi-edge temporal transaction networks in Ethereum. In this section, Multiple-TSGN proposed provides a novel perspective to excavate the potential transaction patterns in Ethereum.

As today’s largest blockchain-based application, Ethereum has fully open transaction data which are permanently recorded and easily accessed through the API of Etherscan ³³3https://etherscan.io or the academic blockchain data platform XBlock ⁴⁴4http://xblock.pro/.

Ethereum has gained massive momentum in recent years, mainly due to the success of cryptocurrencies. Considering that the entire cryptocurrency trading network is enormous, we crawl some phishing addresses and non-phishing addresses as the target nodes and extract their first-order neighbor nodes from the first seven million blocks of Ethereum to construct transaction network datasets (all transactions occerred between July 30, 2015 and January 2, 2019). After filtering and preprocessing the raw data, we randomly select 1050 phishing addresses and 1050 unlabeled addresses according based on the account label information on the XBlock platform, and crawl their neighbor addresses and transaction records to construct transaction networks. And then, these networks will be randomly divided so that we finally get three balanced star-form network datasets EtherG1, EtherG2, and EtherG3, each of which has 350 transaction networks of phishing addresses and 350 transaction networks of non-phishing addresses. Besides, in order to increase the structural complexity of the transaction networks, we expand the scale of the networks by introducing the interactive edges between 1-hop neighbors, yielding to three net-form transaction datasets EtherG4, EtherG5, and EtherG6. The basic statistics of these datasets are presented in TABLE II.

As shown in TABLE III, different variants of TSGN model have their own unique attribute dependencies. Hence, it is necessary to sketch the transaction network structure under different attributes. Based on Fig. 7, we further illustrate the details of edge statistics of TABLE II. Plain indicates no directed and temporal attributes are included in the network structures (Fig. 7 (a) and (d)), Directed means the edges of networks are directed (Fig. 7 (b) and (e)), and Multiedge signifies the edges are attached directed and temporal attributes simultaneously to distinguish the multiple same-directed edges between a node pair (Fig. 7 (c) and (f)). Note that, the weight is set as the inherent attribute. Apparently, the richer the edge attributes, the more complex the network structures. And the next experiments will be conducted on these six datasets to verify the performance of the four TSGN models.

In order to better verify the effect of the proposed TSGN models, we adopt six Ethereum phishing scams detection models, namely handcrafted features, Graph2Vec, DeepKernel, Diffpool, U2GNN and Line_Graph2Vec which are introduced in the following.

Handcrafted Features: Handcrafted features are the most straightforward method to depict structure properties of networks. Different from previous feature designs listing a lot transaction attributes, we adopted ten classic topological attributes in network science which are widely used in graph mining tasks [20, 11, 21, 22]. As a baseline, we aim at building the representation of the transaction networks by manually extracting the features for the subsequent account identification task. The first six handcrafted features are the basic statistics of topological structures, including Number of addresses, Number of transactions, Average degree of transaction subgraph, Percentage of leaf nodes, Network density, and Average neighbor degree. And the last four features, mainly including Average clustering coefficient, Largest eigenvalue of the adjacency matrix, Average betweenness centrality, and Average closeness centrality, are the relatively complex network computing properties. Here, Average clustering coefficient is a very popular metric to quantify the edge density in ego networks. Eigenvalues as the isomorphic invariant of a graph can be used to estimate many static attributes, such as connectivity, diameter, of transaction networks. Centrality measures are indicators of the importance (status, prestige, standing, and the like) of a node in a network. Above various features provide a comprehensive portrait of the transaction network.

Graph2Vec [23]: It is the first unsupervised embedding approach for the entire networks, which constructs Weisfeiler-Lehman tree features for nodes in graphs and then learn graph representations by decomposing the graph-feature co-occurrence matrix.

DeepKernel [24]: This method provides a unified framework, named DGK, that defines the similarity between graphs via leveraging the dependency information of sub-structures, while learning latent representations.

Diffpool [25]: This method proposed a differentiable graph pooling module, which can generate hierarchical representations of graphs and can be combined with various GNN architectures in an end-to-end manner. This method mainly solves the problem that the traditional GNN methods are flat and can’t learn the hierarchical representations of graphs.

U2GNN [26]: It presented a GNN model leveraging a transformer self-attention mechanism followed by a recurrent transition to induce a powerful aggregation function to learn graph representations, which achieved state-of-the-art performance on many classical benchmark for graph classification.

Line_Graph2Vec [13]: This method collected a set of subgraphs, each of which contains a target address and its surrounding transaction network, and then converted them into the corresponding line graphs which can be input into the Graph2Vec model for acquiring the representation vectors for all the graphs.

To investigate the performance of our TSGN models, above mentioned representation methods are adopted to extract the feature vectors for TN, TSGN, Directed-TSGN, and Temporal-TSGN, preparing for training the classification model. Here, the parameters setting of representation models under different TSGNs are given as follows.

For Handcrafted Features, there are no hyperparameters, just extract 10 features manually for each graph as the feature vectors to train the phishing detection model.

For Graph2Vec and Line_Graph2Vec, the parameter height of the WL kernel is set to 3. The commonly-used value of 1,024 is adopted as the embedding dimension. The other parameters are set to defaults: the learning rate is set to 0.025 and the epoch is set to 1000.

For DeepKernel, the Weisfelier-Lehman subtree kernel is used to build the corpus and its height is set to 2, the embedding dimension is set to 10, the window size is set to 5 and skip-gram is used for the word2vec model. Furthermore, the node degrees are set as the node labels for TN and all TSGNs. As the key point of this method, the sub-structure similarity matrix $\mathcal{M}$, is calculated by the matrix $\mathcal{V}$ with each column representing a sub-structure vector, $\mathcal{M}=\mathcal{V}\mathcal{V}^{\mathrm{T}}$. Let $\mathcal{P}$ denote the matrix with each column representing a sub-structure frequency vector. According to the definition of kernel: $\mathcal{K}=\mathcal{P}\mathcal{M}\mathcal{P}^{\mathrm{T}}=\mathcal{P}\mathcal{V}\mathcal{V}^{\mathrm{T}}\mathcal{P}^{\mathrm{T}}=\mathcal{H}\mathcal{H}^{\mathrm{T}}$, one can use the columns in the matrix $\mathcal{H}=\mathcal{P}\mathcal{V}$ as the inputs to the classifier.

For Diffpool, we use the in-degree and out-degree as the node features for the TN, and initialize the feature matrix by the edge weights of TN for different TSGNs. The other parameters of the model are set to defaults.

For U2GNN, we use the in-degree and out-degree as the node features for the TN, and initialize the feature matrix by the edge weights of TN for different TSGNs. The other parameters of the model are set to defaults.

Next, for each feature representation method, the feature vectors of TN is respectively concatenated with those of different TSGNs, and then the dimension of the feature vectors is reduced to the same as that of the feature vector obtained from the original transaction network using PCA in the experiments, for a fair comparison. For each dataset, one randomly split it into 9 folds for training and 1 fold for testing. In order to accurately evaluate the quality of each classification model, in this paper, we will use $F_{1}$-$Score$ as a metric,

where P is precision and R is recall. $F_{1}$-$Score$ is the harmonic mean of precision and recall, so it can more comprehensively judge the pros and cons of the classification models. To exclude the random effect of fold assignment, the experiment is repeated 300 times using the Random Forest classifier and then the average $F_{1}$-$Score$ and its standard deviation recorded. Moreover, Percentage Increase ($\%Increase$) is calculated to measure the performance improvement of the proposed models relative to the original model.

According to the above setting, we conduct some experiments on the six Ethereum datasets. To investigate the effectiveness of TSGN models, for each feature extraction algorithm, the classification results are compared on the basis of TN. Firstly, we present the performance of original model based on TN. The phishing identification performance of TSGN, Directed-TSGN, Temporal-TSGN, and Multiple-TSGN, integrating TN, are then displayed respectively. Note that, the concatenated feature vectors are fed into the same classification model for a fair comparison.

Moreover, for a better demonstration of network structures, we provide the visualization of real example network and its TSGNs as shown in Fig. 8. Fig. 8 (a)-(b) show the transaction networks of different types, following with TSGN, Directed-TSGN, and Temporal-TSGN shown in (c)-(e) which are mapped from (b) the net-form transaction network. Multiple-TSGN in (f) is constructed based on the multi-edge net-form transaction network. In these networks, the node with more dark color has a bigger degree value. The arrow on the edge represents the direction of fund flows between accounts, and the thicker edge with higher-level color means a higher transaction amount (orange, gray, and purple are adopted as the color levels in turns). It can be found that Directed-TSGN can indeed reduce the scale of TSGN and yield a clear structure of transfer flows, and Temporal-TSGN further filters the network structure of Directed-TSGN by the transaction temporal attribute, where some edges disappear such as (9,14), (16,14) and (14,1) and forth. Multiple-TSGN is much more complex than the other TSGNs, providing more interaction information from different accounts around the target node, benefiting the phishing detection.

As a simple case study, we utilize the t-SNE to visualize the results of classification on EtherG1 dataset based on Diffpool method to verify the effectiveness of our TSGN model. Here, we choose the Directed-TSGN to visualize since it produces the good performance that enhances the detection performance of Diffpool most, with $\%Increase$ of 14.58%. As shown in Fig. 9, the structural features are located in different places by utilizing t-SNE. The left shows the original detection result using Diffpool with TN model, while the right depicts the optimized distribution of the same dataset using Diffpool with Directed-TSGN. One can see that the transaction networks in EtherG1 dataset can indeed be distinguished by the original features of Diffpool, but it appears that the distinction of networks could become more explicit after TSGN mapping with direction, demonstrating the effectiveness of our Directed-TSGN model. It also suggests that our TSGN model provides more predominant features contrasted with original TN model.