Fraud detection on Ethereum is challenging because of the anonymity, speed and graph structure of blockchain transactions. While prior research has proven the effectiveness of using machine learning classifiers, Graph Neural Networks (GNNs) and behavioural heuristics to detect fraudulent transactions, most systems are offline and fail to consider real-world deployment challenges for real-time blockchain analytics. Here, we present DeTrust ETH, an operational fraud intelligence system for real-time tracking of Ethereum transactions on the Sepolia testnet. DeTrust ETH aims for the integration of five operational considerations: (1) real-time blockchain ingestion with Web3.py, (2) explainable machine learning with XGBoost and SHAP, (3) light-weight graph-based transaction tracing and risk propagation, (4) temporal trust decay and behavioural anomaly detection, and (5) tamper-resistant on-chain persistence of trust scores using Solidity smart contracts. The system maintains an in-memory directed transaction graph for real-time edge insertion and updating, circular-flow tracing, funding pattern tracing and fast path tracing, avoiding the retraining overhead of Graph Neural Networks (GNNs). Our experimental results demonstrate the median graph-query time is less than 20 ms, the system can handle 222.82 requests per second with a concurrent load, and 93.44% fraud recall with a recall-favouring threshold. Unlike prior research that mostly focuses on accuracy on historical data, DeTrust ETH focuses on real-time deployment. The novelty of this work lies in the design of a real-time, low-latency fraud intelligence architecture that integrates explainable machine learning, temporal trust modeling, and lightweight graph analytics under streaming blockchain constraints.
Blockchain-based financial systems process billions in transactions but remain vulnerable to sophisticated fraud schemes. Current detection approaches analyze completed transactions, preventing neither fund loss nor protocol exploitation. We address this through an oracle-mediated prevention system integrating machine learning inference with smart contract execution. Training ensemble models on 12,847 Ethereum transactions with engineered features capturing gas anomalies and temporal patterns, we achieve 94.2\% fraud classification accuracy. Testnet deployment demonstrates 1.09-second response latency with 6.8\% computational overhead, contrasting favorably against prior on-chain implementations requiring 34\% overhead. Our working prototype validates practical viability for production environments where security requirements justify marginal transaction costs.
Blockchain and decentralized finance have revolutionized the financial ecosystem while simultaneously exposing it to cryptocurrency phishing attacks. Existing phishing detection methods primarily rely on graph learning, but they face significant limitations. Static graph learning approaches fail to account for the temporal evolution of phishing patterns, while semi-dynamic methods, such as those combining static GNNs with LSTM, struggle to capture the irregular and bursty nature of blockchain transactions. Moreover, these methods overlook the diversity of Ethereum transactions, treating them as homogeneous graphs, and heavily rely on supervised learning, which requires extensive labeled data that is not readily available. These limitations reduce their adaptability to emerging phishing threats. In this paper, we present PhishEye, a fully dynamic self-supervised system that monitors on-chain transactions to detect phishing activities. PhishEye formulates Ethereum transactions as a heterogeneous temporal attributed multi-graph and incorporates a novel temporal graph contrastive learning model, which captures both temporal patterns and heterogeneous transaction types. The evaluation on a dataset of 161,658 addresses and 416,541 transactions shows that PhishEye outperforms existing methods, achieving an F1 score of 87.23% and an AUC of 98.43% for phishing transaction detection, and an F1 score of 94.19% and an AUC of 98.03% for phishing account detection. In real-world deployment from May 1, 2023 to July 31, 2024, PhishEye identified 1,803 previously unknown phishing addresses, providing early alerts that helped prevent losses exceeding 2 billion USD.
To address the challenges of topological obscurity and extreme label sparsity in large-scale Ethereum transaction networks, a novel self-supervised phishing detection framework named Eth-GBAV is proposed, integrating graph attention, broad learning, and adversarial variational inference. The framework initiates with a biased random walk strategy guided by transaction intensity and temporal dynamics to capture the initial behavioral semantics of nodes. To distill discriminative features from noisy backgrounds, a “Generative-Attention” encoding architecture is constructed, where a graph attention network aggregates weighted structural neighborhoods and a Variational Autoencoder (VAE) characterizes the underlying probability distribution of legitimate transaction patterns. By maximizing the evidence lower bound, anomalous accounts are effectively isolated through reconstruction residuals. Furthermore, the broad learning system is introduced as an efficient analytical decision layer. By mapping VAE-derived latent embeddings and reconstruction errors into an expanded high-dimensional feature space, the framework captures intricate behavioral correlations via mapping and enhancement neurons. Extensive experimental verification on two large-scale datasets demonstrates the superior performance of Eth-GBAV. On the XBlock dataset, it achieves a leading F1-score of 0.9847 and a recall of 0.9839, outperforming the most competitive state-of-the-art model by significant margins. On the Kaggle dataset, the framework maintains high robustness with an accuracy of 0.9592 and an F1-score of 0.9069.
Financial fraud across cross-border payment systems and blockchain-based transaction networks has grown in scale, sophistication, and velocity, driven by increased digitization, regulatory fragmentation, and the pseudonymous nature of decentralized infrastructures.This study presents a comprehensive examination of AI-driven anomaly detection techniques designed to address these evolving threats.From a broad perspective, the paper reviews the global financial ecosystem, highlighting vulnerabilities in traditional correspondent banking frameworks and emerging decentralized finance (DeFi) architectures.It then narrows to advanced machine learning and deep learning approaches, including supervised, unsupervised, and hybrid models such as autoencoders, graph neural networks, and reinforcement learning systems for real-time fraud detection.Particular emphasis is placed on transaction pattern analysis, behavioral profiling, and network topology modeling to uncover hidden relationships and detect anomalous activities across distributed ledgers and cross-border payment rails.The study further evaluates challenges such as data sparsity, class imbalance, adversarial manipulation, privacy constraints, and regulatory compliance, including AML and KYC requirements.By integrating AI with blockchain analytics and financial monitoring systems, the paper demonstrates how adaptive, scalable, and explainable detection frameworks can significantly enhance fraud prevention capabilities.The findings provide strategic insights for financial institutions, regulators, and fintech developers aiming to strengthen global financial security.
The rapid convergence of artificial intelligence and blockchain technologies has increased the demand for efficient and accurate methods to detect fraudulent behavior in smart contract–driven systems. Smart contracts automate digital transactions in decentralized environments, yet they remain vulnerable to fraud while operating under strict computational and scalability constraints. In this study, we propose an evolutionary-guided CNN compression framework tailored for Convolutional Neural Networks (CNNs) aimed at improving fraud detection in smart contract analysis while significantly reducing model complexity. The proposed approach uses evolutionary optimization to guide structured model compression, enabling the removal of redundant parameters without compromising predictive performance. Experimental evaluations demonstrate up to a 50% reduction in model parameters while maintaining 97.8–97.9% classification accuracy, making the resulting models suitable for deployment in resource-constrained environments. By combining evolutionary optimization with CNN-based fraud detection, this work provides an efficient and interpretable solution for smart contract analysis, supporting scalable and practical deployment in blockchain-related security applications.
As cross-chain interoperability advances, decentralized finance (DeFi) protocols enable illicit funds to be reorganized into uniform liquid assets that flow throughout the cryptocurrency market. Such operations can bypass monitoring targeted at individual blockchains and thereby weaken current regulatory frameworks. Motivated by these, we introduce UniDetect, a multi-chain cryptocurrency fraud account detection method based on large language models (LLMs). Specifically, we use domain knowledge to guide the LLM to generate general transaction summary texts applicable to heterogeneous blockchain accounts, which serve as evidence for fraud account detection. Furthermore, we introduce a two-stage alternating training strategy to continuously and dynamically enhance the multimodal joint reasoning for detecting fraudulent accounts based on both the textual evidence and the transaction graph patterns. Experiments on multiple blockchains show that UniDetect outperforms existing methods 5.57% to 7.58% in Kolmogorov-Smirnov (KS). For cross-chain zero-shot detection, UniDetect identifies over 94.58% of fraudulent accounts. It also generalizes well to non-blockchain data, delivering a 6.06% improvement in F1 over existing methods. The dataset and source code are available at https://github.com/msy0513/UniDetect.
Fraudulent activities on blockchain networks threaten the integrity and reliability of decentralized finance ecosystems. Accurately identifying malicious nodes such as phishing or ransomware addresses, within large-scale blockchain transaction graphs remains a critical challenge due to their dynamic, sparse, and continuously evolving topologies. Transfer learning offers a powerful paradigm for fraud detection because many fraudulent schemes, including ransomware and phishing, are often orchestrated by overlapping actor groups that share behavioral and structural patterns across networks. Leveraging these shared representations enables knowledge transfer from previously observed fraud types to emerging ones. However, the complex and multi-modal nature of digital financial systems introduces substantial challenges for graph-based transfer learning. Fraudulent activities are shaped by diverse modalities including graph structure, transaction sequences, temporal price dynamics, and textual metadata, while distributional shifts frequently occur across time and platforms. Existing graph transfer learning methods struggle to model such multi-modal dependencies and to align divergent feature distributions. To tackle these challenges, we develop a Multi-mOdal Enhanced Graph Transfer Learning (MOE-GTL) framework which incorporates graph, temporal, and textual modalities for fraudulent node detection. We further introduce Temporal-aware Maximum Mean Discrepancy (TMMD), a regularization mechanism that explicitly aligns multi-modal feature distributions between source and target graphs over time. Extensive experiments reveal that our MOE-GTL model notably improves the accuracy of fraudulent node classifications on Ethereum and Solana transaction graphs.
Against the complex characteristics of the Ethereum transaction network and the limitations of existing graph embedding methods based on random walks, which fail to effectively capture transaction temporal dynamics and the flow of funds, we propose a fraud detection algorithm for Ethereum, ETX2Vec (Ethereum Transactions (TX) to Vector), which improves upon transaction subgraph construction and random walk strategies. First, in terms of transaction subgraph construction, we extract the first-order predecessor and successor neighboring nodes of the target node to reconstruct the transaction subgraph, enabling the random walk to effectively capture the complete flow of funds. Second, in the design of the random walk strategy, we introduce two key improvements: (1) the next node is selected based on the non-decreasing principle of transaction timestamps, effectively capturing the temporal dynamics of transactions within the network, and (2) a biased random walk strategy is designed based on both transaction timestamps and amounts, with a parameter α introduced to control the weighting of these factors when calculating transition probabilities. Experimental results show that ETX2Vec achieves an average performance of 96.04% in downstream node classification tasks, outperforming the best model in similar studies by 3.74%, and even surpassing neural network models such as GAT and GCN. This demonstrates that ETX2Vec is more effective at understanding and processing the Ethereum transaction network, leading to the learning of high-quality node embedding vectors.
Faithful, Stable, Complete: Pick Two The Problem in Plain Language When a machine learning model makes a prediction — approving a loan, diagnosing a disease, flagging a transaction — practitioners use a tool called SHAP to answer "which input features mattered most?" SHAP is the most widely used explanation method in machine learning. Here is the problem: retrain the same model on the same data with a different random seed, and the explanation changes. The model's predictions barely move, but the "most important feature" can flip entirely. In 68% of 77 public datasets, the top feature is not stable across retrains. This is not a software bug. This is not fixable by tuning hyperparameters. We prove it is a mathematical impossibility. What We Prove No feature ranking can simultaneously be: Faithful — it reflects what the model actually learned Stable — it doesn't change when you retrain Complete — it ranks every pair of features …when features are correlated with similar importance. You must give up one. The proof is four lines long. It requires no assumptions about the model, the data, or the explanation method — only that correlated features admit models ranking them in opposite orders (the Rashomon property), which is true for every standard ML algorithm. How Bad Is It? We trained 50 XGBoost models on Breast Cancer Wisconsin — the dataset used in every SHAP tutorial — and counted how many different "top 3 most important features" appeared. Twenty-four. At 100 models: thirty-five. The "most common" answer appeared in only 12% of runs. Two randomly chosen models agree on the top-3 only 4.2% of the time. Every tutorial, textbook, and blog post showing SHAP on this dataset is showing one of two dozen equally valid answers. Three other datasets (California Housing, Heart Disease, Wine Quality) produce exactly one ranking every time — because their top features have clearly different importance. The theory correctly predicts which datasets are affected and which are safe. Dataset Distinct top-3 rankings (50 models) Two models agree? Breast Cancer 24 4.2% Diabetes 2 88.5% Wine Quality 1 100% (stable) Heart Disease 1 100% (stable) California Housing 1 100% (stable) It Gets Worse for Yes/No Questions For ranking questions (which feature is MORE important?), there is a fix: average across multiple models. But for binary questions — "does this feature contribute positively or negatively?", "is this feature selected?" — no fix exists. Even averaging doesn't help, because there's no middle ground between "positive" and "negative." We call this the bilemma. Real-World Consequences For loan applicants. We trained 30 models on German Credit data. Under standard settings, 45% of applicants receive a different "most important reason" for their decision depending on which model happens to be deployed. One applicant received six different top reasons across 30 models. For biomarker discovery. On a dataset of 10,935 genes distinguishing colon from kidney tissue, the "#1 most important gene" alternates between TSPAN8 (involved in tumor invasion) and CEACAM5/CEA (involved in immune evasion) depending on the random seed. A drug discovery pipeline targeting one gene makes a different bet than one targeting the other — and which bet gets made depends on a random number. For fairness audits. A SHAP-based audit checking whether a model relies on a protected attribute (like race or gender) reaches its conclusion with the reliability of a coin flip when the protected attribute is correlated with other features. The Fix DASH (Diversified Aggregation for Stable Hypotheses): train 25 models with different seeds, average their SHAP values. This is provably the best possible approach — no method can do better. Features that genuinely differ in importance get stable rankings. Features that are interchangeable get reported as tied, which is the honest answer. We also provide a 7-line diagnostic that identifies which features are at risk, requiring no statistical expertise and no assumptions about the data distribution. It outperforms the standard formula by 2× on real data. The practical workflow: Screen your model (1 model, seconds) Run the minority fraction diagnostic (7 lines of code) For flagged features, train 5 models and run a Z-test If unstable, use DASH with 25+ models Machine Verification Every mathematical claim is checked by a computer. The proofs are written in Lean 4 (a programming language for mathematics) and verified by its type-checker: 357 theorems, all machine-verified 6 axioms (the minimal assumptions the theory needs) Zero unproved claims across 58 files During the formalization, the computer caught two logical errors and one type mismatch that human reviewers missed. To our knowledge, this is the first formally verified impossibility result in explainable AI. Technical Details Architecture-dependent bounds Gradient boosting (XGBoost, LightGBM): instability diverges as correlation increases. At ρ = 0.9, the dominant feature gets 5× its fair share. Lasso: the ratio is infinite — one correlated feature gets everything, the other gets zero. Neural networks: 87% of feature pairs are unstable. Model instability dominates SHAP estimation noise by 8:1. Random forests: instability converges with more trees — the contrast case showing that parallel (not sequential) training helps. Cross-implementation. XGBoost, LightGBM, and Random Forest all show the same instability pattern. It is not specific to any one software package. Subsample sensitivity. Even at subsample = 0.95 (minimal randomness), 17 distinct rankings remain. Only fully deterministic training (subsample = 1.0) produces one ranking — but this sacrifices the regularization that makes the model accurate. Mechanistic interpretability. Preliminary evidence suggests the impossibility extends beyond feature importance to neural network circuit analysis. 10 transformers trained on modular addition (all achieving 100% accuracy) agree on only 36% of the top-3 circuit components. Design Space The achievable set of explanation methods has exactly two families: Family A (single model): faithful and complete, but unstable. Rankings flip up to 50% of the time. This is what standard SHAP does. Family B (DASH ensemble): faithful and stable, but reports ties for indistinguishable features. This is what DASH does. No third option exists. DASH is provably the best method in Family B. Associated Papers Companion paper (TMLR, under review). First-Mover Bias in Gradient Boosting Explanations: Mechanism, Detection, and Resolution.arXiv: https://arxiv.org/abs/2603.22346DOI: https://doi.org/10.5281/zenodo.19446088 Companion implementation: https://github.com/DrakeCaraker/dash-shap
A hybrid analytical framework is developed for the forensic investigation of Bitcoin transaction networks, addressing the inherent challenges posed by the decentralized and pseudo-anonymous characteristics of blockchain systems. While Bitcoin transactions are publicly accessible, detecting illicit activities within complex transaction graphs remains a significant challenge. Existing approaches typically depend on isolated techniques, such as rule-based methods or standalone machine learning models, which often lack sufficient effectiveness.The proposed framework combines graph-based network analysis, statistical modeling, and machine learning to enhance detection capability. Transactions are represented as a directed graph, where wallet addresses function as nodes and transactions as edges. From this representation, structural, behavioral, and temporal features are systematically extracted and integrated into a unified dataset. A Random Forest classifier is subsequently employed to categorize wallet addresses as either normal or suspicious.This integrated approach improves accuracy, scalability, and robustness, facilitating efficient analysis of large-scale blockchain data and enabling more reliable identification of fraudulent activities in real-world forensic investigations.
Wang Yishun, Wenkai Li, Xiaoqi Li, Zongwei Li · 6 authors
Smart contracts are self-executing programs that manage financial transactions on blockchain networks. Developers commonly rely on third-party code libraries to improve both efficiency and security. However, improper use of these libraries can introduce hidden vulnerabilities that are difficult to detect, leading to significant financial losses. Existing automated tools struggle to identify such misuse because it often requires understanding the developer's intent rather than simply scanning for known code patterns. This paper presents LibScan, an automated detection framework that combines large language model (LLM)-based semantic reasoning with rule-based code analysis, identifying eight distinct categories of library misuse in smart contracts. To improve detection reliability, the framework incorporates an iterative self-correction mechanism that refines its analysis across multiple rounds, alongside a structured knowledge base derived from large-scale empirical studies of real-world misuse cases. Experiments conducted on 662 real-world smart contracts demonstrate that LibScan achieves an overall detection accuracy of 85.15\%, outperforming existing tools by a margin of over 16 percentage points. Ablation experiments further confirm that combining both analysis approaches yields substantially better results than either method used independently.
This study examines the development and intellectual structure of fraud detection research through a bibliometric analysis. Using data extracted from a major scientific database and analyzed with bibliometric visualization tools, the study maps publication trends, influential contributors, and thematic evolution within the field. The findings reveal that fraud detection research is strongly centered on machine learning and increasingly shaped by advances in deep learning, neural networks, and data-driven approaches. At the same time, the field has expanded beyond traditional financial contexts into broader digital ecosystems, including cybersecurity, blockchain, and data privacy. The analysis also highlights a clear shift from conventional statistical methods toward more adaptive and complex models capable of handling large-scale and interconnected data. In addition, emerging themes such as predictive analytics, risk management, and decentralized finance indicate a growing orientation toward real-world application and decision-making. Overall, the study provides a comprehensive overview of the research landscape, identifies key trends and gaps, and offers directions for future research, particularly in integrating technological innovation with practical, ethical, and system-level considerations.
The landscape of e-commerce has witnessed a transformative shift in consumer behavior, driven by the rise of digital technologies and online platforms. As online purchases increase at an alarming rate, fraudulent activity has become a major concern for retailers and consumers alike. The objective of this research is to investigate methods for detecting fraudulent online transactions using machine learning algorithms. This paper proposes a Hybrid Agentic AI Architecture (HSAA) for edge-enabled e-commerce that incorporates intelligent agents and cryptographic security to enable real-time, trustworthy transaction processing. The architecture uses world-model distillation to enable efficient inference on edge devices. HSAA was tested on several large data sets such as a balanced credit card fraud set containing 2,952 transactions. The system scored 96.6% in detecting fraud, indicating very low false positives and high specificity. Negotiation exercises on 400 independent interactions were successful in 59%, with an average discount of 14.2%, using 1,142 zero-knowledge proofs that were verified with 100% validity. Some of the operational performance highlights include a throughput of 585 transactions per second, an average latency of 1.56 milliseconds, and a 81.9% reduction in bandwidth through selective state transfer. The findings support the argument that HSAA is a strong, secure, and high-performance edge-based e-commerce architecture, combining accuracy, efficiency, and reliability. Within HSAA, fraud detection functions as one of the core decision agents, while negotiation and secure execution mechanisms provide the broader operational context for trustworthy edge commerce. The architecture provides a solid basis for future studies in adaptive and autonomous AI-driven commercial systems.
The accelerating digitization of financial services has transformed global economic ecosystems while simultaneously amplifying the scale, speed, and structural complexity of financial fraud. Real-time payments, open banking infrastructures, fintech platforms, and decentralized finance environments have expanded transactional connectivity, creating highly dynamic and interconnected risk landscapes. Conventional rule-based and standalone machine learning systems demonstrate limited effectiveness against adaptive adversaries, coordinated fraud rings, synthetic identity schemes, and cross-platform laundering networks. Advanced detection strategies require intelligent architectures capable of modeling temporal behavior, relational dependencies, and large-scale streaming data within production-grade environments. This chapter presents a comprehensive framework for next-generation financial fraud detection integrating Artificial Intelligence, Deep Learning, and Graph Analytics. The discussion synthesizes supervised, unsupervised, and semi-supervised learning approaches with sequential deep learning architectures, transformer-based models, and graph neural networks for network-aware inference. Emphasis is placed on hierarchical multi-stage detection systems, cloud-native deployment strategies, adversarial robustness, privacy-preserving computation, and real-world validation methodologies. Critical challenges such as extreme class imbalance, concept drift, scalability of graph processing, explainability under regulatory constraints, and cross-institution collaboration are systematically examined. A unified hybrid AI–graph intelligence architecture is articulated to address both transactional anomalies and coordinated fraud ecosystems. The chapter contributes a structured taxonomy of modern financial fraud, an integrated modeling perspective combining temporal and structural intelligence, and a deployment-oriented evaluation framework aligned with real-world financial operations. By bridging theoretical advancements with production-grade implementation considerations, this work establishes a rigorous foundation for scalable, interpretable, and resilient fraud detection systems within evolving digital financial infrastructures.
Xiao Wang, Yanxiang Tong, Hai Dong, Ben Wang · 6 authors
The pervasive adoption of smart contracts in blockchain has raised concerns about their vulnerabilities, which have led to serious economic losses. To address the efficiency and performance drawbacks of traditional methods, researchers have turned to deep learning techniques, designing various vulnerability detection methods using specific code information sources. However, these learning-based methods face limitations in feature modeling. Most emphasize feature extraction from either source code or bytecode, resulting in limited feature coverage and compromised vulnerability representation. While some attempt to utilize both code sources, they typically treat one as auxiliary, failing to perform effective joint alignment. To this end, we propose DualSVD, a dual-source feature modeling framework for smart contract vulnerability detection. DualSVD encodes vulnerability-relevant source code functions into semantic vectors using word embeddings, and extracts bytecode features using a channel architecture fused via channel-wise attention. Both feature representations are then projected into a shared latent space and concatenated for classification. We evaluate the proposed approach on widely-used datasets covering eight smart contract vulnerability types. Experimental results demonstrate that DualSVD achieves an average F1-score of 92.70%, outperforming traditional and deep learning-based baselines by 37.81% and 4.94%, respectively. These results indicate that DualSVD provides a more comprehensive and effective representation of smart contract vulnerabilities, offering improved detection performance and stronger generalization ability.
This review explores the application of machine learning techniques for fraud detection and prevention in the Ethereum blockchain. As a leading platform for decentralized applications (dApps), Ethereum is vulnerable to fraudulent activities such as scams, hacking attempts, and malicious transactions. This paper provides a comprehensive analysis of machine learning models used to predict, detect, and mitigate fraudulent behavior within the Ethereum ecosystem. By overviewing various machine learning methods, this study identifies the most effective approaches for addressing different types of vulnerabilities while offering a thorough review of existing research, key challenges, and limitations. It also examines the datasets and feature engineering techniques applied in this domain, outlining future directions and potential strategies for improving fraud detection. While machine learning has enhanced Ethereum’s security, challenges such as data availability, adversarial attacks, and model interpretability remain significant concerns. To address these gaps, this study highlights the potential of integrating deep learning architectures, graph representations, and hybrid models that combine supervised and unsupervised learning. Additionally, it explores the use of active learning and genetic programming to further enhance fraud detection capabilities. Furthermore, leveraging AI, particularly through large language models, could improve interpretability at the account, block, or transaction level, offering a clearer, more comprehensive view of fraudulent behavior across the Ethereum network. By tackling these challenges, future advancements in machine learning could further strengthen the resilience, security, and trustworthiness of Ethereum’s infrastructure.
<b>Abstract.</b>Smart contract vulnerabilities have led to losses exceeding billions of US dollars in the decentralised finance (DeFi) ecosystem. Existing detection tools based on symbolic execution and static analysis, while precise, are computationally expensive and often impractical for large-scale screening. In this work, we propose a lightweight machine learning approach that operates directly on compiled EVM bytecode, requiring neither source code nor contract ABI. We design a feature engineering pipeline that extracts 65 security-oriented numerical features from disassembled bytecode instructions, covering reentrancy patterns, arithmetic overflow indicators, gas-based denial-of-service risks, access control anomalies, and environmental dependencies. Using a dataset of 117,091 real-world Ethereum smart contracts labelled by the Slither static analyser, we evaluate four classifiers—Logistic Regression, Decision Tree, Random Forest, and XGBoost—under stratified 5-fold cross-validation. XGBoost, optimised via Bayesian hyperparameter search (Optuna, 50 trials), achieves an F1-score of 0.947 on cross-validation and 93% accuracy on a held-out validation set, with 0.97 recall for vulnerable contracts and 0.85 recall for safe contracts. We additionally benchmark text-based opcode sequence representations and find that hand-crafted numerical features substantially outperform n-gram vectorisation approaches.<br>Code and materials (GitHub): https://github.com/SergeySolovyev/Machine-Learning-Based-Vulnerability-DetectionDate: 26 Feb 2026. Version: v1.
Zhaohuang Chen, Zhongqi Fu, Tao Liang, Haidong Ma · 6 authors
Abstract Since the proposal of the blockchain, its application scenarios have been continuously expanded. However, the anonymity feature of the blockchain has hindered market regulation, leading to numerous illegal activities such as phishing fraud, which has now become a serious type of crime. Currently, most phishing fraud detection technologies on blockchain platforms use transaction data to construct basic raw transaction graphs and then use neural network methods to mine key information. This study proposes a graph gated recurrent neural network (GGRNN) model that fully integrates temporal and spatial information, effectively utilizing time-related information in the transaction graph. It first takes an account as the center node to obtain its second-order transaction data and then constructs a dynamic transaction graph (DTG). Subsequently, the DTG is fed to the GGRNN to process the temporal features in a gated recurrent unit (GRU) framework and introduce graph convolutional network (GCN) operations to fully use the node neigh-bourhood topology features, obtain the embedded representation of the graph, and then perform graph classification for phishing node detection. To verify the effectiveness of the proposed model, it was applied to real-world Ethereum transaction datasets. Numerical results show that the proposed GGRNN model significantly outperforms state-of-the-art methods.
Fraud detection within the Ethereum network remains a major research challenge due to the strong statistical resemblance between legitimate and fraudulent transaction patterns, severe class imbalance, and the multiscale complexity of temporal-interaction dependencies. Proposing and evaluating a multi-branch attention-based system with automated architecture optimization, which can detect fraudulent Ethereum accounts with high accuracy, is the aim of this study. The experimental evaluation was performed on a dataset with 9,841 samples and 17 extracted features. The proposed system employed a hybrid multi-branch architecture combining CNN, Bi-LSTM, and LSTM with a Gated Fusion mechanism along with multiscale attention layers. The Artificial Bee Colony (ABC) algorithm was applied to automatically optimize sixteen key structural and learning parameters. The results indicate that the proposed system achieved an accuracy of 99.84 %, F1 score of 98.94 %, sensitivity of 98.76 percent, and precision of 99.12 percent. These results notably outperform eight algorithms, such as Random Forest, XGBoost, LGBM, and GADL. According to the confusion matrix analysis, there is a reduction in false negatives, confirming that the system produced only five such cases in the sample set. These findings show that the proposed system is an effective and efficient approach for detecting fraud in blockchain systems and enables deployment in exchanges, DeFi platforms, and regulatory institutions.
Transaction flow networks are crucial in detecting illicit activities such as wash trading, credit card fraud, cashback arbitrage fraud, and money laundering. \revise{Our collaborator, Grab, a leader in digital payments in Southeast Asia, faces increasingly sophisticated fraud patterns in its transaction flow networks. In industry settings such as Grab's fraud detection pipeline, identifying fraudulent activities heavily relies on detecting dense flows within transaction networks. Motivated by this practical foundation,} we propose the \emph{\(S\)-\(T\) densest flow} (\SDMF{}) query. Given a transaction flow network \( G \), a source set \( \Src \), a sink set \( \Dst \), and a size threshold \( k \), the query outputs subsets \( \Src' \subseteq \Src \) and \( \Dst' \subseteq \Dst \) such that the maximum flow from \( \Src' \) to \( \Dst' \) is densest, with \(|\Src' \cup \Dst'| \geq k\). Recognizing the NP-hardness of the \SDMF{} query, we develop an efficient divide-and-conquer algorithm, CONAN. \revise{Driven by industry needs for scalable and efficient solutions}, we introduce an approximate flow-peeling algorithm to optimize the performance of CONAN, enhancing its efficiency in processing large transaction networks. \revise{Our approach has been integrated into Grab's fraud detection scenario, resulting in significant improvements in identifying fraudulent activities.} Experiments show that CONAN outperforms baseline methods by up to three orders of magnitude in runtime and more effectively identifies the densest flows. We showcase CONAN's applications in fraud detection on transaction flow networks from our industry partner, Grab, and on non-fungible tokens (NFTs).
Blockchain technology and cryptocurrencies have attracted significant attention in recent years, yet remain susceptible to cyber threats such as phishing attacks. Existing detection approaches often suffer from high computational costs and limited robustness, especially when facing varying data distributions and sparse structures. To address these issues, we propose Robust, Node behavior, Transaction structure, and Network (R-NTN), a detection framework for Ethereum phishing accounts that leverages multi-dimensional transaction features. R-NTN first constructs 2-hop ego graphs via random walks, then extracts features from three complementary dimensions: behavioral attributes, transaction-based structural features, and network embeddings. These features are integrated into a unified representation for downstream classification. Experiments show that R-NTN consistently outperforms baseline methods and maintains high accuracy across datasets of different scales and compositions, demonstrating strong robustness and generalizability.