Detecting Malicious Accounts in Permissionless Blockchains using\n Temporal Graph Properties

Abstract

The temporal nature of modeling accounts as nodes and transactions as\ndirected edges in a directed graph -- for a blockchain, enables us to\nunderstand the behavior (malicious or benign) of the accounts. Predictive\nclassification of accounts as malicious or benign could help users of the\npermissionless blockchain platforms to operate in a secure manner. Motivated by\nthis, we introduce temporal features such as burst and attractiveness on top of\nseveral already used graph properties such as the node degree and clustering\ncoefficient. Using identified features, we train various Machine Learning (ML)\nalgorithms and identify the algorithm that performs the best in detecting which\naccounts are malicious. We then study the behavior of the accounts over\ndifferent temporal granularities of the dataset before assigning them malicious\ntags. For Ethereum blockchain, we identify that for the entire dataset - the\nExtraTreesClassifier performs the best among supervised ML algorithms. On the\nother hand, using cosine similarity on top of the results provided by\nunsupervised ML algorithms such as K-Means on the entire dataset, we were able\nto detect 554 more suspicious accounts. Further, using behavior change analysis\nfor accounts, we identify 814 unique suspicious accounts across different\ntemporal granularities.\n