Trans2Graph: Mining Ethereum Phishers With Graph on Heterogeneous Temporal Transaction Data

Abstract

In recent years, phishing scams have caused huge economic losses in Ethereum, the largest blockchain platform enabling smart contracts. Many new sorts of phishing attacks based on smart contracts, specifically targeting Ethereum assets such as Ether and tokens, are emerging. Existing Ethereum phishing detection methods usually mine the transaction relationships among accounts from block data, while neglecting to mine the temporal transaction patterns inherent in the accounts themselves in different transaction types introduced by smart contracts. Such information provides a new perspective for analyzing account transaction preferences. However, since this information is hidden in heterogeneous data such as trace data and event logs, it is difficult to analyze and mine the information. In this paper, we contribute Trans2Graph, a novel graph-based framework for Ethereum data modeling and phishing detection, to fully exploit the massively heterogeneous temporal transaction data. We propose a new paradigm for the fusion of heterogeneous Ethereum data and model the implicit transition relationships among multiple heterogeneous transactions of each Ethereum account into a heterogeneous, temporal, directed multigraph called transaction state transition graph. Empirical analysis shows that phishing accounts have unique patterns in both the heterogeneity and time dynamics of transaction state transition graphs. Based on the analysis, we develop a novel attention-based graph neural network for the learning of heterogeneous temporal state transition graphs and phishing detection. Experiments on a large-scale real-world dataset demonstrate that Trans2Graph achieves a minimum 52.57% improvement in the average precision metric on state-of-the-art account interaction graph-based methods and a minimum 11.52% improvement in average precision on transaction sequence-based methods.