Deployment-Oriented AutoML-Based Anomaly Detection for Ethereum Wallets: Architecture and System-Level Evaluation

Abstract

Most blockchain anomaly detection research is model-centric, focusing on either proposing new models or comparing benchmarks. Very little work addresses how such methods behave when actually deployed. Data ingestion, feature updates, and inference stability are among the practical concerns that usually get ignored. This work targets this: design, implementation, and evaluation of an AutoML-based platform for anomaly detection targeting Ethereum wallets. The emphasis is on operational behavior, rather than algorithmic novelty. The system is an AutoGluon ensemble that is trained offline from historical, labeled data. Each wallet behavior is represented as a fixed-length feature vector. During inference, live blockchain data is fetched through the blockchain API. This data is transformed into features required by the trained model. The predictor then outputs probabilistic risk scores along with feature-level explanations. Feature computation and model inference are treated as separate processes. This separation allows repeated inference without online learning or continuous retraining. The experimental evaluation discusses several deployment-relevant factors, including class imbalance during training and the contribution of different feature groups. It also examines the stability of the risk score under repeated feature recomputation. Results show that imbalance-aware training improves the reliability of detection. They also indicate that anomaly detection depends on the combined effect of multiple behavioral feature categories.