As digital technologies increase interconnectivity among us, the need to safeguard our network infrastructure from sophisticated cyber threats has never been more important. This chapter provides a review of the modern cybersecurity technologies that seek to protect our networks. A discussion of strategic approaches for protecting networks, tools needed, and the future of technology in cyber- protection. It has considered traditional forms of cybersecurity protection (e.g., firewalls, intrusion detection systems; IDS) along with modern AI-driven cyber threat detection and response. We discuss predecessor and subsequent paradigms of cybersecurity protection, including, but not limited to, zero trust architecture, the continued monitoring of networks as an operational method, and distributed ledger technology using blockchain; blockchain solutions like smart contracts and protocols (e.g., Hyperledger). Examining the trends in the future of cybersecurity protections, and highlight some of those that include predictive analytics and automated remediation of malware threats via Automated Threat Remediation, threat intelligence sharing, and a collaborative approach to countering threats. In summary, this chapter reinforced the importance of a low-latency, adaptive, and multi-layered defense approach to evolved cyber threats, and highlighted the need for organizations to demonstrate compliance with global standards and regulatory frameworks.
Open access
Network Security and Intrusion Detection
Advanced Research in Systems and Signal Processing
Small and medium size enterprises are becoming critical in driving innovations and economic growth in digital economy. However SME growing reliance on digital technologies exposes to cybersecurity attacks such as data breaches and phishing attacks and ransoms ware attack leads to greater financial loss, reputational challenges and business closure. In order to protect the SME business operation and their process data against cyber security attacks, many researchers applies emerging technologies such as Artificial intelligence and blockchain. Despite of many advantages of the implementing blockchain towards decentralization and transparency while artificial intelligence approaches towards predicting and classifying attacks, it is mandatory to establish an integrated solution to enhance security of the distributed servers of the SME. In this paper, blockchain integrated convolution neural network is designed to predict and classify the user with user level to secure access of data in blockchain enabled distributed servers. Initially Blockchain is established to business process data of the SME with immutable ledger for fostering trust and transparency. Convolution Neural Network establishes access control mechanism to blockchain distributed server to authenticate user against unauthorized access and predict the user level of access to data. In Blockchain, trusted nodes can validate the transaction and request for data access through generation of new transaction by user. User request is logged in blockchain which leads to data transparency and support detect the malicious user to retrieve data in the blockchain. Convolution Neural Network processes the log data of blockchain which contain user request. The user requests were processed in the convolution layer to extract the spatial temporal features. Extracted feature were embedded as spatial embedding and temporal embedding and applied to Max pooling layer. Max pooling layer reduces spatial dimension of the feature map. Spatially reduced feature map is applied to fully connected layer which contains activation function and softmax function to authenticate user and categorize the user with level of access to the data. Experimental analysis of the model is performed in the blockchain platform named as hyperledger which enables convolution neural network for authenticate user and categorize level of user towards data access. Performance analysis of the model proves that model is more secure and accurate against detecting authorized user and classifying user on their level access to data.
Software defined networking (SDN) increasingly integrates multiple controllers from diverse vendors to enhance network scalability, flexibility, and reliability. However, such heterogeneous deployments pose significant security threats, especially at the east-west interface which is connecting these controllers. Existing solutions are inadequate for ensuring robust protection across multi-vendor SDN environments as most of them are meant to a specific type of attacks, use centralized solution, or designed for homogeneous SDN environments. This study proposes a blockchain-based security framework to address existing security gaps within heterogeneous SDN environments. The framework establishes a decentralized, robust, and interoperable security layer for distributed SDN controllers. By utilizing the Ethereum blockchain with customized smart contract-based checks, the proposed approach enables mutual authentication among controllers, secures data exchange, and controls network access. The framework effectively mitigates common SDN threats such as distributed denial-of-service (DDoS), man-in-the-middle (MitM), false data injection, and unauthorized access. Experimental results highlight the practicality of the solution, achieving a stable throughput of approximately 20 transactions per second with an average authentication latency of 28-40 ms. These results demonstrate that the proposed framework not only enhances inter-controller communication security but also maintains the network performance, making it a reliable and scalable solution for real-world SDN deployments.
Ahmad M. Almasabi, Ahmad B. Alkhodre, Maher Khemakhem, Fathy Eassa ¡ 6 authors
IoT environments have introduced diverse logistic support services into our lives and communities, in areas such as education, medicine, transportation, and agriculture. However, with new technologies and services, the issue of privacy and data security has become more urgent. Moreover, the rapid changes in IoT and the capabilities of attacks have highlighted the need for an adaptive and reliable framework. In this study, we applied the proposed simulation to the proposed hybrid framework, making use of deep learning to continue monitoring IoT data; we also used the blockchain association in the framework to log, tackle, manage, and document all of the IoT sensorâs data points. Five sensors were run in a SimPy simulation environment to check and examine our frameworkâs capability in a real-time IoT environment; deep learning (ANN) and the blockchain technique were integrated to enhance the efficiency of detecting certain attacks (benign, part of a horizontal port scan, attack, C&C, Okiru, DDoS, and file download) and to continue logging all of the IoT sensor data, respectively. The comparison of different machine learning (ML) models showed that the DL outperformed all of them. Interestingly, the evaluation results showed a mature and moderate level of accuracy and precision and reached 97%. Moreover, the proposed framework confirmed superior performance under varied conditions like diverse attack types and network sizes comparing to other approaches. It can improve its performance over time and can detect anomalies in real-time IoT environments.
Rami Almatarneh, Mohammad Aljaidi, Ayoub Alsarhan, Sami Aziz Alshammari ¡ 6 authors
The rapid evolution of Web 4.0, characterized by decentralized systems, real-time data processing, and AI-driven interfaces, presents serious security threats such as SQL injection (SQLi) attacks, adversarial model poisoning, and IoT device spoofing. This paper presents a unified AI-blockchain framework designed to address these vulnerabilities, incorporating bidirectional LSTM networks for SQLi detection, Trimmed Mean aggregation with a reputation system for model poisoning defense, and CNN-based IoT authentication anchored to a decentralized blockchain. Evaluated on the Bitcoin OTC trust network, the framework clearly shows outstanding performance, with SQLi detection achieving 96.2% accuracy (94.8% precision and 92.5% recall), far outperforming traditional rule-based systems such as Snort (82.1% accuracy). The success rate of model poisoning attacks is reduced from 78% (in the absence of defense) to just 12% through the application of Trimmed Mean aggregation and dynamic reputation scoring, while IoT spoofing detection attains a 91.3% F1-score through cosine similarity-based matching of network traffic embeddings. The blockchain layer, which uses Delegated Proof-of-Stake (DPoS) consensus, achieves 1,450 transactions per second (TPS) with a validation latency of only 220 milliseconds, ensuring efficient real-time auditability. Furthermore, user trust scores increased by 48% after implementation (4.3/5 vs. 2.9/5 before implementation), confirming the framework's practical impact. Nevertheless, some limitations still persist, such as the 15% latency overhead due to federated learning and the use of synthetic IoT data, which may limit or reduce the framework's real-world applicability. The proposed combination of AI-based adaptive threat detection and blockchain-based tamper-proof transparency will pave the way for secure, user-focused architectures in Web 4.0, providing a scalable framework to address the evolving cyber threats in decentralized environments.
Autonomous Vehicles (AV) proliferation brings important and pressing security and reliability issues that must be dealt with to guarantee public safety and help their widespread adoption. The contribution of the proposed research is towards achieving more secure, reliable, and trustworthy autonomous transportation system by providing more capabilities for anomaly detection, data provenance, and real-time response in safety critical AV deployments. In this research, we develop a new framework that combines the power of Artificial Intelligence (AI) for real-time anomaly detection with blockchain technology to detect and prevent any malicious activity including sensor failures in AVs. Through Long Short-Term Memory (LSTM) networks, our approach continually monitors associated multi-sensor data streams to detect anomalous patterns that may represent cyberattacks as well as hardware malfunctions. Further, this framework employs a decentralized platform for securely storing sensor data and anomaly alerts in a blockchain ledger for data incorruptibility and authenticity, while offering transparent forensic features. Moreover, immediate automated response mechanisms are deployed using smart contracts when anomalies are found. This makes the AV system more resilient to attacks from both cyberspace and hardware component failure. Besides, we identify potential challenges of scalability in handling high frequency sensor data, computational constraint in resource constrained environment, and of distributed data storage in terms of privacy.
bstract In order to give users instant access to market data, portfolio management features, and analytical tools, this research paper introduces CryptoTracker, a feature-rich real-time cryptocurrency tracking application. The system makes use of contemporary web technologies to provide a responsive interface that is constantly updated to reflect the state of the market. In addition to outlining the system's functionality, architecture, and implementation specifics, we also go into the difficulties in creating trustworthy cryptocurrency tracking tools in a volatile market. Keywords: Cryptocurrency, Real-time tracking, Portfolio management, Web technologies, Financial analysis, Data visualization
In response to the Cybersecurity Law, organizations face numerous management and technical requirements. Detection techniques such as vulnerability scanning and penetration testing are employed to identify risks. Addressing these vulnerabilities demands substantial manpower, time, and financial resources. Security concerns also arise during digital file transmission and remediation efforts. This study proposes a security detection platform with step-by-step implementation guidelines, enabling resource-limited units to replicate the setup and address security gaps. It compares detection results between open-source and commercial tools, highlighting key differences and offering remediation strategies. Numerous digital files (e.g., test reports) are generated during testing. To ensure secure storage and sharing, the system integrates IOTAâs distributed ledger and IPFS, generating HASH values and uploading files on-chain to preserve integrity and authenticity. The objective is to deliver a scalable, cost-effective security detection framework that enhances system resilience while minimizing resource consumption.
Detecting similar data is crucial for optimizing file storage and transmission in HTTP protocols and Content Delivery Networks.Traditional MinHash methods encounter significant efficiency challenges due to their reliance on K-shingle structures, resulting in high computational costs and storage requirements.Additionally, these methods expose privacy risks in cloud environments, where sensitive information can be inferred from MinHash signatures.To address both efficiency and security concerns, we propose Horse-MinHash, which integrates a fast, content-defined feature extraction scheme with a non-interactive zero-knowledge proof-based similarity estimation method.Our approach significantly enhances computational efficiency while ensuring robust privacy protection by preventing plaintext exposure.Experimental results demonstrate that Horse-MinHash achieves lower mean squared error in Jaccard similarity estimation and reduces time overhead for average block sizes of 16KB or more, outperforming state-of-the-art methods. CCS Concepts Security and privacy File system security; Management and querying of encrypted data.
This research article introduces a deep learning (DL) for identifying vulnerabilities in the smart contracts, leveraging an optimized DL method. The proposed method, termed LogT BiLSTM, combines bidirectional long short-term memory (BiLSTM) with logistic chaos Tasmanian devil optimization (LogT) for enhancing detection of vulnerability. The evaluation of the suggested approach is conducted using publicly available datasets. Initially, preprocessing steps involve removing duplicate data and imputing missing data. Subsequently, the vulnerability detection process utilizes BiLSTM, with the optimization of the loss function achieved through LogT. Results indicate promising performance in identifying vulnerabilities in SC, highlighting the efficacy of the LogT-BiLSTM approach.
The rapid proliferation of Internet of Things (IoT) devices has ushered in a new era of connectivity and data exchange, revolutionizing various industries. However, the inherent vulnerabilities in traditional centralized transaction systems pose significant security challenges, particularly when dealing with sensitive data generated by IoT devices. This paper introduces an ICAA (Integrity Consensus Authorization Algorithm) for securing transaction records over the IoT network by leveraging Decentralized Distributed Ledger Technology (DDL), integrating the PICA (Proof-of-Integrity Consensus Algorithm) and CTAP (Context-Aware Transaction Authorization Protocol). The proposed system addresses the limitations of centralized architectures by employing a decentralized ledger, ensuring transparency, immutability, and tamper-resistant transaction records. The Proof-of-Integrity Consensus Algorithm enhances the security of the network by validating and confirming transactions based on the integrity of the data stored in the distributed ledger. This consensus mechanism minimizes the risk of fraudulent activities and unauthorized modifications, making it well-suited for the dynamic and distributed nature of IoT environments. Furthermore, the integration of the Context-Aware Transaction Authorization Protocol enhances the adaptability of the system to the diverse contexts in which IoT devices operate. The synergy between the Proof-of-Integrity Consensus Algorithm and the Context-Aware Transaction Authorization Protocol creates a comprehensive and secure framework for managing transaction records in IoT networks. . The proposed HGGC is 5.026% better than the ECMQV-MAC, 0.4215% better than QKD, and 0.0843% better than OTP in the nodes 200. The proposed model contributes to the establishment of a trustworthy and resilient infrastructure for the IoT, laying the foundation for secure and transparent transactions in the connected world.
Mohammed Ibraheem Hussein, Ohood Saadoon Hlail, Asma Ibrahim Hussein, Amjed Abbas Ahmed ¡ 6 authors
Balancing efficient threat detection with data privacy becomes increasingly difficult as cyber threats develop in complexity. The Adaptive Zero-Knowledge Threat Hunting Framework (AZTH), a revolutionary integration of zero-knowledge proofs (ZKP) and artificial intelligence (AI) for private and secure cybersecurity operations, is presented in the presented study. AZTH maintains strong confidentiality regarding sensitive data yet uses federated learning, quantum-resistant cryptography, and dynamic deception systems to improve threat intelligence sharing as well as real-time threat mitigation. Together with an assessment of its efficacy in several operating situations, the architecture, approach, and possible uses of the framework are given.
As more organizations move to use the multi-tenant cloud infrastructure, the perimeter-based security model is insufficient for the concept of zero-trust security states. Thatently, curing this complex environment, It has ânever trust, always verifyâ. Completely contradicting the conventional models, Zero Trust continually promotes authentication and validation of every access request (inside or outside the network perimeter). As they try to understand how to protect the isolation of tenants, stop alteration movements, and support identity cross services, the paper investigates the challenges and parts of zero trust taking effect in the multi-tenant cloud. Everything must always be authenticated, no matter the connection status, to ensure the user (only the user) has permission to do all the things they need. Further, it shows that Artificial Intelligence (AI) and Machine Learning (ML) technologies can highly enhance the detection of threats and adaptive access control. It shall see an exhibited case study of a SaaS provider going from providing limited risk mitigation against these risks, such as credential stuffing, API abuse, and insider data leakage, to Zero Trust security. This paper discusses decentralized identity (DID), post-quantum cryptography, blockchain as immutable audit trails, and AI-led autonomous zero trust systems as some of the future emerging trends. As the world reaches the multi-tenant cloud architecture, they are ready to enhance cloud security further.
Jinish Patel, Joseph Reiner, Brenden Stilwell, Abdullah Wahbeh ¡ 5 authors
With the growing popularity of cryptocurrencies, detecting potential market manipulation and fraudulent activities has become crucial for maintaining market integrity. In this study, we aim to detect anomalous Bitcoin transactions using an integrated approach by combining clustering techniques with statistical outlier detection. More specifically, anomalies were detected using three approaches: a distance-based method, flagging points with distances greater than the 95th percentile from their cluster centers; a statistical method, identifying transactions with any feature having an absolute Z-score greater than 3; and a hybrid approach, where transactions flagged by either method were considered anomalous. Using sample subset Bitcoin transaction data from 2015, our results showed that the combined approach was able to achieve the best performance with a total of 6492 (6.61%) detected anomalous transactions out of a total of 98,151 transactions.
In recent years, a large number of on-chain attacks have emerged in the blockchain empowered Web3 ecosystem. In the year of 2023 alone, on-chain attacks have caused losses of over 585 million. Attackers use blockchain transactions to carry out on-chain attacks, for example, exploiting vulnerabilities or business logic flaws in Web3 applications. A wealth of efforts have been devoted to detecting on-chain attack transactions through expert patterns and machine learning techniques. However, in this ever-evolving ecosystem, the performance of current methods is limited in detecting new on-chain attacks, due to the obsoleting of attack recognition patterns or the reliance on on-chain attack samples. In this paper, we propose a universal approach for detecting on-chain attacks even when there are few or even no new on-chain attack samples. Specifically, an in-depth analysis of the transaction characteristics is conducted, and we propose a new insight to train a generic attack transaction detecting model, i.e., transaction reconstruction. Particularly, to overcome the over-fitting in the transaction reconstruction task, we use the web-scale function comments related to transactions as supervision information, rather than expert-confirmed labels. Experimental results demonstrate that the proposed approach surpasses the supervised state-of-the-art by 13% in AUC, with just 30 known on-chain attack samples. Moreover, without any known attack samples, our method can still detect new on-chain attacks in the wild (with a precision of 61.83%). Among attacks detected in the wild, we confirm 1,692 address poisoning attacks, a new type of on-chain attack targeting token holders. Our code is available at: https://github.com/wuzhy1ng/attack_trans_detection_www25.
C. Aparna, S. Radha, C. Aarthi, K. M. Karthick Raghunath
ABSTRACT Mobile Ad hoc networks (MANETs) are key for applications in which flexibility and organization are paramount, but the security of such networks entails threats that can exploit the vulnerability of their open architecture, resulting in various attacks. To address such issues, a novel architectural framework is always required. One such framework is introduced, namely, the HoneyFed Secure Architecture (HFSA), which provides the combination of an advanced honey encryption system with federated learningâbased decentralized security to improve the security of MANET. Honey encryption, on the other hand, employs adaptive deception techniques to generate plausible decoy data on decryption failure, employs dynamic key management for tamper resistance, and provides perfect authentication through multiâfactor methods and zeroâknowledge proofs. We found that federated learning offers decentralized model training, where nodes jointly train local models while exchanging progress updates without exposing raw data, enabling 81.4% more detections of emerging threats while preserving data privacy. Using the proposed HFSA approach achieves a 78% protection improvement against attacks and a 71% reduction in unauthorized access. HFSA offers a robust and scalable framework of security that uses continuous learning and adaptation to the vulnerabilities of the MANETs to enhance network resilience.
The DC-Microgrids (DC-MGs) are increasingly prone to various cyber-attacks due to the advancement of intelligent controlling, monitoring, operation methods. A typical DC-MGs integrates components like batteries, super capacitors, electronic devices, Photovoltaic (PV) systems, and loads. Given these vulnerabilities, cyber-attack detection, and the security of data exchanged in smart DC-MGs, similar to Cyber-Physical Systems (CPS), have become critical areas to focus. This paper proposes a novel approach to detect false data injection attack (FDIAs) in DC-MGs using Wavelet transform and Support Vector Machines (SVMs) with Blockchain technology. The analysis shows that the output voltage dropped from 350 V to 300 V during the False Data Injection Attack (FDIA) at 0.4 s and returned to 350 V by 0.7 s. Significant oscillations observed between 0.4 and 0.7 s and detection model achieved 400 true negatives, 191 true positives, 10 false negatives, and no false positives, demonstrating high accuracy in identifying FDIA instances.
Nasir Nadeem, Ahmad Ramli Saad, Zeeha Aslam, Zohaa Naveed
The purpose of this study is to assess this form of technocrimeand identify the misinformation gaps to restrict area suggestions, educational offer frameworks, and legislative proposals aimed at advancing the digital financial literacy of prospective young investors. The research aims to highlight how these scams affect multilateral financial inclusion, economic empowerment, and a reliable digital financial ecosystem. These schemes are targeted at university students who possess low financial literacy and are lured by the prospects of easy money, which endanger their lives in the long run. This descriptive research is based on an online survey conducted among students of Multan, using simple random sampling, collected through an online survey. The study will analyze the relationship between financial literacy and victimization in order to test the hypothesis that those with lower literacy are more susceptible. The research will also look into the disinformation marketing and recruitment strategies on social media and other Internet platforms regarding cryptocurrency. The study aids in accomplishing SDG 8: Decent Work and Economic Growth within the context of Pakistanâs digital economy. This research helps to understand the contribution of technocrime to the obstacles of financial inclusion and helps to develop a strongerdigital economic infrastructure proposal.
M. K. Ghosh, Chirag Dinesh Jain, Raju Halder, Joydeep Chandra
Phishing scams on the Ethereum network have become a serious threat, especially with the influx of new users into the cryptocurrency market. Current detection methods are mainly focused on long-term consistent transaction patterns with smooth temporal dynamics. However, these methods often struggle to differentiate between phishing and non-phishing users, whose behaviours may appear deceptively similar. Additionally, they face challenges such as network sparsity and data leakage, leading to significant performance limitations. To address these issues, we introduce TEMPER, a novel sequential learning framework designed to jointly capture the subtle distinctions between long- and short-term user behaviours and their correlations to provide more comprehensive insights. TEMPER effectively generates distinguishable user embeddings, enabling the accurate identification of phishing users. Unlike previous approaches, TEMPER mitigates data leakage through a novel sequential transaction sampling algorithm and addresses network sparsity with short-term temporal learning. Through extensive experimentation on three real-world Ethereum datasets, TEMPER demonstrates its efficacy by achieving a 3-4% improvement in the F1-Score compared to existing baseline models, representing a significant advancement in Ethereum phishing user detection.
ABSTRACT IoT is a rapidly developing technology with a wealth of creative application possibilities. However, IoT wireless sensor networks are vulnerable to Denial of Service (DoS) attacks due to their insecure nature. Although network integrity and security have been ensured through the use of distributed ledger and blockchain technologies, privacy preservation concerns frequently arise with traditional approaches. So, deep learningâbased Physicsâinformed neural networks (PINN) and Honestyâbased Distributed ProofâofâAuthority (HDPoA) are developed to enhance transaction security and detect intrusions. Initially, the mobile nodes were deployed in different regions to gather transactions and an intrusion detection system to analyze attacks. First, the Intrusion Detection System (IDS) uses a deep learning approach for detecting the intrusion in the network. For that, the collected data from the deployed nodes are preâprocessed using Variational autoâencoder and minâmax normalization to standardize input dataset values. Then the features are selected using wild horse optimization and classified using PINN to predict data attack or nonâattack. After that, Homomorphic variable tag generation is used for normal transactions with multiple copies in the same document, which are then converted into hash values using the Keccak hashing function. The miner validates transactions based on rankâbased priority. Honestyâbased Distributed ProofâofâAuthority (HDPoA) was used for network security, making it suitable for deployment in blockchainâbased IoT applications. The proposed deep learningâbased PINN classifier reached 97.2% accuracy and 96.52% specificity. Homomorphic variable (HV) tag generation takes 0.4 s, while the Keccak algorithm takes 0.3 s for hash generation, and the HDPoA protocol has 420 s for block generation time.
ABSTRACT Ensuring the security and privacy of sensitive health data in Internet of Things (IoT)âbased healthcare systems (HCS) is a critical challenge. This paper proposes a robust security framework by integrating blockchain mechanisms and deep learning (DL) approaches to enhance security and data privacy. The proposed framework leverages the Ethereum blockchain with zero knowledge proof (ZKP) to ensure data integrity and confidentiality, while the interplanetary file system (IPFS) provides secure and efficient data storage. Additionally, a novel AtâGANâBiLSTM model is introduced for intrusion detection by combining the attention mechanism, generative adversarial networks (GAN) and bidirectional long shortâterm memory (BiâLSTM) to improve detection accuracy and also help to enhance model robustness. The proposed model is evaluated by two different benchmark datasets, namely CICIDSâ2018 (D1) and ToNâIoT (D2), achieving accuracies of 99.9% and 99.1%, respectively. Comparative investigation shows that the proposed approach reduces false alarm rates (FAR) and performs better than current models in identifying impersonation, insider, and manâinâtheâmiddle (MITM) attacks. By integrating blockchain and DL, the proposed framework significantly enhances intrusion detection, data security, and overall system resilience, addressing key vulnerabilities in IoTâbased healthcare security.
With the growth of the Internet of Things (IoT), millions of users, devices, and applications compose a complex and heterogeneous network, which increases the complexity of digital identity management. Traditional centralized digital identity management systems (DIMS) confront single points of failure and privacy leakages. The emergence of blockchain technology presents an opportunity for DIMS to handle the single point of failure problem associated with centralized architectures. However, the transparency inherent in blockchain technology still exposes DIMS to privacy leakages. In this paper, we propose the privacy-protected IoT DIMS (PPID), a novel blockchain-based distributed identity system to protect the privacy of on-chain identity data. The PPID achieves the unlinkability of identity-credential-verification. Specifically, the PPID adopts the Zero Knowledge Proof (ZKP) algorithm and Shamir secret sharing (SSS) to safeguard privacy security, resist replay attacks, and ensure data integrity. Finally, we evaluate the performance of ZKP computation in PPID, as well as the transaction fees of smart contract on the Ethereum blockchain.
Open access
Blockchain Technology Applications and Security
Network Security and Intrusion Detection
Advanced Steganography and Watermarking Techniques
Blockchain networks have become a cornerstone of decentralized finance and digital asset management, yet they remain susceptible to fraudulent activities, money laundering, and illicit financial transactions. Traditional anomaly detection methods, including rule-based systems and supervised machine learning models, often struggle to generalize across evolving blockchain transaction patterns due to their reliance on static heuristics and manually engineered features. Graph-based learning techniques offer a more robust approach by leveraging the inherent structure of blockchain transactions, where wallets and transactions form a dynamic graph.This study proposes a novel Spatial-Temporal Graph Neural Network (STGNN)-based anomaly detection framework for blockchain transactions. By modeling transaction flows as evolving graphs, the proposed system captures both spatial dependencies between wallets and temporal patterns in transaction sequences. The framework employs Graph Convolutional Networks (GCN) or Graph Attention Networks (GAT) to extract spatial representations, while Gated Recurrent Units (GRU) or Temporal Convolutional Networks (TCN) model the time-dependent evolution of transaction behaviors. The fusion of these spatial-temporal features enables the detection of anomalous transactions that deviate from expected network behaviors.Experimental evaluations on real-world blockchain datasets demonstrate that the STGNN-based model achieves higher detection accuracy, lower false positive rates, and better adaptability than traditional fraud detection techniques. The study further explores the system's scalability and generalization across different blockchain networks, revealing its potential for real-time monitoring of illicit financial activities. These findings highlight the effectiveness of graph-based deep learning models in strengthening blockchain security and provide a foundation for future research in decentralized fraud detection, anti-money laundering (AML) compliance, and intelligent financial surveillance.
The rapid expansion of blockchain technology has led to increased security challenges, particularly in detecting fraudulent transactions and malicious activities within decentralized networks. Traditional anomaly detection techniques, including rule-based heuristics and supervised learning models, struggle to adapt to the dynamic and complex nature of blockchain transactions. This paper introduces a graph neural network (GNN)-based anomaly detection framework designed to improve blockchain security by leveraging the inherent graph structure of transaction networks. The proposed approach models blockchain transactions as a directed graph, where nodes represent wallet addresses and edges correspond to transaction flows. By applying spatial and temporal graph learning techniques, the framework captures both network topology and transaction evolution over time, allowing for the identification of anomalous activities such as money laundering, phishing scams, and Ponzi schemes. The GNN model incorporates graph convolutional networks (GCN), graph attention networks (GAT), and gated recurrent units (GRU) to learn both spatial dependencies and sequential patterns within blockchain transactions. Experiments conducted on Bitcoin and Ethereum transaction datasets demonstrate that the GNN-based framework outperforms conventional fraud detection methods in terms of precision, recall, and false positive reduction. The model successfully detects fraudulent transactions with an F1-score of 0.92, showing its effectiveness in identifying emerging threats in blockchain networks. These results highlight the potential of deep learning-based anomaly detection in enhancing blockchain security, providing a scalable and adaptive solution for detecting fraud in decentralized financial ecosystems.